16:34 #startmeeting 16:34 Meeting started Mon Nov 4 16:34:17 2013 UTC. The chair is jdstrand. Information about MeetBot at http://wiki.ubuntu.com/meetingology. 16:34 16:34 Available commands: #accept #accepted #action #agree #agreed #chair #commands #endmeeting #endvote #halp #help #idea #info #link #lurk #meetingname #meetingtopic #nick #progress #rejected #replay #restrictlogs #save #startmeeting #subtopic #topic #unchair #undo #unlurk #vote #voters #votesrequired 16:34 The meeting agenda can be found at: 16:34 [LINK] https://wiki.ubuntu.com/SecurityTeam/Meeting 16:34 [TOPIC] Announcements 16:34 Thanks to the following individuals: 16:34 Christian Biamont (christianbiamont) provided a debdiff for precise for xml-security-c (LP: #1192874) 16:34 Launchpad bug 1192874 in xml-security-c (Ubuntu Saucy) "heap overflow while processing InclusiveNamespace PrefixList" [Undecided,Fix released] https://launchpad.net/bugs/1192874 16:34 Felix Geyer (debfx) provided debdiffs for precise-raring for libapache2-mod-fcgid (LP: #1238242) 16:34 Launchpad bug 1238242 in libapache2-mod-fcgid (Ubuntu Lucid) "CVE-2013-4365: possible heap buffer overwrite" [Undecided,New] https://launchpad.net/bugs/1238242 16:34 Felix Geyer (debfx) provided debdiffs for precise-raring for ejabberd (LP: #1239307) 16:34 Launchpad bug 1239307 in ejabberd (Ubuntu Lucid) "Allows SSLv2 and weak ciphers" [Undecided,New] https://launchpad.net/bugs/1239307 16:34 christianbiamont, debfx: Your work is very much appreciated and will keep Ubuntu users secure. Great job! :) 16:35 [TOPIC] Weekly stand-up report 16:35 hi! 16:35 I'll go first 16:35 I'm on triage this week 16:36 I've got quite a few things to catch up on from being at the sprint last week 16:36 also I need to process/communicate outcomes from sprint next week 16:36 in general, there shouldn't be any surprises for our team 16:37 nothing major was added to our plans for 14.04 and 14.10 16:38 I will be doing a click-apaprmor upload to sponsor a fix for cjwatson. I'm getting some CI testing going around click-apparmor which is why I haven't updated it yet 16:38 I hope to have that today or tomorrow at the latest 16:38 I know tyhicks wants me to sponsor an apparmor upload 16:38 I think that's it for me 16:38 mdeslaur: you're up 16:38 hi! I'm on community this week 16:39 I'm currently pushing out libav updates 16:39 FYI, the libav and ffmpeg codebases have diverged to the point of it being unreasonable to track both using the same set of CVEs 16:39 as such, I've updated the CVEs in the tracker 16:39 oh, interesting 16:39 mdeslaur: updated as in, updated the boilerplate? 16:40 jdstrand: as in added README.libav, killing the boilerplate, and marking existing cves as ignored or not-affected for libav 16:40 cool 16:40 we shouldn't track ffmpeg CVEs as affecting libav 16:41 I noticed libav is now in universe in trusty 16:41 does kurt agree? 16:41 tomorrow I'm off, and further down this week, I plan on finishing my merges and picking up some more updates 16:41 sarnold: no idea 16:42 sarnold: but the CVE descriptions never had "libav" in them 16:42 and I can't track vulnerabilities/commits across them 16:42 and libav is commiting a whole slew of independant security fixes now without asking for CVEs 16:44 anyway, that's it from me 16:44 sbeattie: you're up 16:45 hrm, sbeattie seems to be MIA 16:45 I'll go 16:45 I'll wrap up a pending apparmor upload today and hand it off to jdstrand (thanks!) 16:45 Then I need to look into an ecryptfs/apparmor kernel bug that I hit last week 16:46 I also have some merges that I need to do 16:46 oh, and I need to look at enabling yama on the mobile kernels 16:47 that's it for me 16:47 jjohansen: you're up 16:48 sarnold: lets go to you 16:48 hehe 16:49 it appears I'm in my happy place again this week \o/ 16:49 I've been getting the hang of both canonistack and smo ser's virtual maas deployment scripts with an eye towards being able to do some maas update testing 16:50 I've prepared new versions of the maas updates for release hopefully this week -- it depends if the -proposed updates have moved into the -updates queue yet or not. 16:50 sarnold: \o/ 16:50 (bigjools had finished the last verification-needed test last week, so I hope the automated framework moved them through by now) 16:51 mdeslaur: yeah, it'll be nice to finally cross these two off the list :) 16:51 which two? 16:52 unfortunately smo ser's older script isn't his preferred testing method, and I had trouble getting the newer script to work, but I think his older script will work well enough for a starting point for documenting how the whole thing works.. 16:52 jdstrand: CVE-2013-1057 and CVE-2013-1058 16:52 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1057) 16:52 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1058) 16:52 ah, two CVEs, yes (I thought you were talking about source packages) 16:53 ah :) 16:53 once this is done I may do another MIR or pick up an update, depending upon mdeslaur's preference :) 16:54 * mdeslaur consults magic 8 ball 16:54 chrisccoulson: your turn :) 16:54 chromium is up to date now (had mozilla updates last week as well) 16:54 \o/ 16:55 \o/ 16:55 chrisccoulson: woot! 16:55 this week i shall be helping get people up and running with oxide 16:56 \o/ 16:56 i'm currently trying to improve the workflow for maintaining the chromium patches in oxide. there were various issues at the end of last week 16:56 interesting 16:57 other than that, i'll be back on to the usual again :) 16:57 chrisccoulson: so, oxide made a big splash last week-- you should be getting the help now 16:57 jdstrand, excellent, thanks 16:57 jdstrand, you did a presentation didn't you? 16:57 I did 16:58 jdstrand, how did that go? 16:59 chrisccoulson: well-- most everyone realized it was the plan of record 17:00 chrisccoulson: phonedations had a number of questions cause we hadn't brought them into the loop before that (though they were in the meeting in april and saw the emails on it stating it was the plan) 17:00 chrisccoulson: they've done quite a bit of work on qtwebkit to make sure it works well on armhf 17:01 ah, ok. although i can't imagine it working that well, with no jit ;) 17:01 chrisccoulson: and I imagine they will also start helping out soon (eg rsalveti). but like I said elsewhere-- getting you the armhf hardware and you can do some benchmarks marks to give to them 17:02 yeah, I don't have the details. you and rsalveti should definitely talk at some point though 17:02 yeah, that's cool 17:02 I want to update/form a new bp for oxide for this cycle 17:02 we can talk more about that this week 17:03 oh, yes, that is another thing I have to do-- work with mdeslaur and all of you on bps for vUDS 17:03 I don't know that we'll have an oxide session-- I think the work is known. we'll discuss later 17:04 chrisccoulson: did you have any other questions or anything else to report? 17:04 jdstrand, no, i think that's me done 17:04 [TOPIC] Highlighted packages 17:04 The Ubuntu Security team will highlight some community-supported packages that might be good candidates for updating and or triaging. If you would like to help Ubuntu and not sure where to start, this is a great way to do so. 17:04 See https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures for details and if you have any questions, feel free to ask in #ubuntu-security. To find out other ways of helping out, please see https://wiki.ubuntu.com/SecurityTeam/GettingInvolved. 17:04 http://people.canonical.com/~ubuntu-security/cve/pkg/openjpa.html 17:04 http://people.canonical.com/~ubuntu-security/cve/pkg/flightgear.html 17:04 http://people.canonical.com/~ubuntu-security/cve/pkg/sanlock.html 17:04 http://people.canonical.com/~ubuntu-security/cve/pkg/rawstudio.html 17:04 http://people.canonical.com/~ubuntu-security/cve/pkg/lighttpd.html 17:05 [TOPIC] Miscellaneous and Questions 17:05 Does anyone have any other questions or items to discuss? 17:06 mdeslaur, tyhicks, sarnold, chrisccoulson: thanks! 17:06 #endmeeting