18:12:43 <jdstrand> #startmeeting 18:12:43 <meetingology> Meeting started Mon Sep 17 18:12:43 2012 UTC. The chair is jdstrand. Information about MeetBot at http://wiki.ubuntu.com/meetingology. 18:12:43 <meetingology> 18:12:43 <meetingology> Available commands: #accept #accepted #action #agree #agreed #chair #commands #endmeeting #endvote #halp #help #idea #info #link #lurk #meetingname #meetingtopic #nick #progress #rejected #replay #restrictlogs #save #startmeeting #subtopic #topic #unchair #undo #unlurk #vote #voters #votesrequired 18:12:49 <jdstrand> The meeting agenda can be found at: 18:12:50 <jdstrand> [LINK] https://wiki.ubuntu.com/SecurityTeam/Meeting 18:12:53 <jdstrand> [TOPIC] Announcements 18:15:24 * jdstrand is waiting for one more person 18:16:41 <sarnold> jdstrand: pong 18:16:57 <jdstrand> sarnold: fyi, The meeting agenda can be found at: https://wiki.ubuntu.com/SecurityTeam/Meeting 18:17:01 <sarnold> (sorry friends, I was unaware that #ubuntu-* was the shorthand for "find it on freendoe") 18:17:18 <jdstrand> so, only announcement this week is welcoming sarnold to the ubuntu-security team :) 18:17:32 <mdeslaur> sarnold: welcome! (again!) 18:17:33 <jdstrand> sarnold: welcome! :) 18:17:34 <jjohansen> Welcome sarnold 18:17:50 <sarnold> thank you all :) 18:18:18 <jdstrand> [TOPIC] Weekly stand-up report 18:18:22 <jdstrand> I'll go first 18:19:15 <jdstrand> I'm on triage this week and am also patch piloting. I am supposed to do that today, but may need to reschedule... we'll see 18:19:38 <jdstrand> I've got quite a bit of backlog from last week that I need to get through 18:19:47 <jdstrand> and also follow-ups surrounding the manager's sprint 18:20:08 <jdstrand> I also figure I'll be helping sarnold come up to speed a bit 18:20:32 <jdstrand> I've also got some audits to do, and hopefully get to some updates 18:20:37 <jdstrand> mdeslaur: you're up 18:21:18 <mdeslaur> I just published some updates 18:21:30 <mdeslaur> and am working on testing dhcp and dbus updates 18:21:45 <mdeslaur> I need to investigate some gpg key issues 18:21:51 <mdeslaur> and then will pick something else from the list 18:21:55 <mdeslaur> that's it from me 18:21:57 <mdeslaur> sbeattie: you're up 18:22:05 <sbeattie> I'm on community this week 18:22:32 <sbeattie> I'm briefly looking at a regression fix for openjdk-7 for doko 18:23:02 <sbeattie> I've also got glibc on my plate 18:23:48 <sbeattie> I've still got the apparmor/dbus stuff to upload to a ppa 18:24:02 <sbeattie> after that, I'll try to pick up another update or two 18:24:12 <sbeattie> that's it for me. 18:24:36 <tyhicks> I'm up since Micah is out today 18:24:43 <tyhicks> I'm in the happy place again this week 18:24:50 <tyhicks> I'll be submitting the fix for bug 1051892 to upstream OpenSSL today for their comments 18:24:52 <ubottu> Launchpad bug 1051892 in openssl (Ubuntu) "[Quantal] Regression in TLS 1.2 workarounds" [High,Triaged] https://launchpad.net/bugs/1051892 18:25:00 <tyhicks> Then I'll proceed with preparing updates for rubygems and ruby1.9.1 18:25:10 <tyhicks> With the kernel merge window coming up soon, I need to get through all of my eCryptfs patch review backlog 18:25:25 <tyhicks> I'm also in the process of getting the latest AppArmor introspection interface patches from jjohansen to start work on my related work items 18:25:35 <tyhicks> jjohansen: You're up 18:25:47 <jjohansen> I have an apparmor QRT failure happening on the QA machines but not locally to finish tracking down. The IMA config and YAMA upstream sync to finish up. 18:25:47 <jjohansen> I still have to get together with sbeattie/tyhicks over apparmor dbus stuff 18:25:56 <jjohansen> And then its back to apparmor labeling/stacking 18:26:55 <jjohansen> thats it for me, jdstrand back to you 18:28:09 <jdstrand> sarnold: you're up 18:28:18 <jdstrand> jjohansen: jeez, already ignoring the new guy :P 18:28:27 <jjohansen> oops 18:28:29 <sarnold> new-employee handling; I think I've just about finished making launchpad happy 18:29:00 <sarnold> I downloaded the magic cve tool but I was a bit shocked at how many CVE entries from three years ago appear to still need work -- are those for real? :) 18:29:14 <jdstrand> yes, they are 18:29:33 <sarnold> oh. my. 18:29:46 <jdstrand> Canonical-supported CVEs should not really be above 'low' though 18:30:17 <jdstrand> community supported packages are in various states of up-to-dateness 18:30:54 <sarnold> so, CVE-2008-2004 isn't 'low' but it does have a handful of 'needed'... is that waiting on upstream? 18:30:54 <ubottu> The drive_init function in QEMU 0.9.1 determines the format of a raw disk image based on the header, which allows local guest users to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted. (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2004) 18:30:57 <jdstrand> (of course, we have some mediums to do, but you'll see more of that this week) 18:31:40 <jdstrand> sarnold: without looking, xen-3.3 userspace is in universe and community supported 18:31:52 <sarnold> ah! 18:32:02 <sarnold> so the situation is not as dire as it first looked. Thanks. 18:32:21 <sarnold> jdstrand: I think that covers me for now. :) Thanks. 18:32:26 <jdstrand> well, not for canonical supported stuff anyway :) 18:32:30 <jdstrand> np 18:32:44 <jdstrand> which brings me to our next topic 18:32:51 <jdstrand> [TOPIC] Highlighted packages 18:32:56 <jdstrand> The Ubuntu Security team will highlight some community-supported packages that might be good candidates for updating and or triaging. If you would like to help Ubuntu and not sure where to start, this is a great way to do so. 18:33:00 <jdstrand> See https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures for details and if you have any questions, feel free to ask in #ubuntu-security. To find out other ways of helping out, please see https://wiki.ubuntu.com/SecurityTeam/GettingInvolved. 18:33:07 <jdstrand> http://people.canonical.com/~ubuntu-security/cve/pkg/sun-javadb.html 18:33:11 <jdstrand> http://people.canonical.com/~ubuntu-security/cve/pkg/osc.html 18:33:14 <jdstrand> http://people.canonical.com/~ubuntu-security/cve/pkg/ejabberd.html 18:33:17 <jdstrand> http://people.canonical.com/~ubuntu-security/cve/pkg/pure-ftpd.html 18:33:19 <jdstrand> http://people.canonical.com/~ubuntu-security/cve/pkg/libdbd-pg-perl.html 18:33:30 <jdstrand> [TOPIC] Miscellaneous and Questions 18:33:40 <jdstrand> There are a lot of merge opportunities for packages listed in http://people.canonical.com/~ubuntu-security/d2u/. Performing these updates is a great way to help Ubuntu and bolster your developer application. 18:33:47 <jdstrand> Does anyone have any other questions or items to discuss? 18:37:44 <jdstrand> #endmeeting