{"push_id":3041530867,"size":3,"distinct_size":3,"ref":"refs/heads/updates","head":"17f944144b3d9c5131569b1cc988cc90fd676671","before":"cf605b9129bf37be451da5ccb66dad5545d0e998","commits":[{"sha":"ac8e2ef053de273ce7a0cf0cb611e599dca4b298","author":{"name":"Quentin Armitage","email":"d6b8e48afb2534b213e391cab43016505747a234@armitage.org.uk"},"message":"When opening files for write, ensure files can only be read by root\n\nIssue #1048 referred to CVE-2018-19046 regarding files used for\ndebugging purposes could potentially be read by non root users.\n\nThis commit ensures that such log files cannot be opened by non root\nusers.\n\nSigned-off-by: Quentin Armitage <quentin@armitage.org.uk>","distinct":true,"url":"https://api.github.com/repos/pqarmitage/keepalived/commits/ac8e2ef053de273ce7a0cf0cb611e599dca4b298"},{"sha":"26c8d6374db33bcfcdcd758b1282f12ceef4b94f","author":{"name":"Quentin Armitage","email":"d6b8e48afb2534b213e391cab43016505747a234@armitage.org.uk"},"message":"Disable fopen_safe() append mode by default\n\nIf a non privileged user creates /tmp/keepalived.log and has it open\nfor read (e.g. tail -f), then even though keepalived will change the\nowner to root and remove all read/write permissions from non owners,\nthe application which already has the file open will be able to read\nthe added log entries.\n\nAccordingly, opening a file in append mode is disabled by default, and\nonly enabled if --enable-smtp-alert-debug or --enable-log-file (which\nare debugging options and unset by default) are enabled.\n\nThis should further alleviate security concerns related to CVE-2018-19046.\n\nSigned-off-by: Quentin Armitage <quentin@armitage.org.uk>","distinct":true,"url":"https://api.github.com/repos/pqarmitage/keepalived/commits/26c8d6374db33bcfcdcd758b1282f12ceef4b94f"},{"sha":"17f944144b3d9c5131569b1cc988cc90fd676671","author":{"name":"Quentin Armitage","email":"d6b8e48afb2534b213e391cab43016505747a234@armitage.org.uk"},"message":"Make sure a non privileged user cannot read keepalived file output\n\nEnsure that when a file such as /tmp/keepalived.data is wriiten,\nno non privileged can have a previous version of that file already\nopen, thereby allowing them to read the data.\n\nThis should fully resolve CVE-2018-19046.\n\nSigned-off-by: Quentin Armitage <quentin@armitage.org.uk>","distinct":true,"url":"https://api.github.com/repos/pqarmitage/keepalived/commits/17f944144b3d9c5131569b1cc988cc90fd676671"}]}
{"actor":{"display_login":"pqarmitage"}}