[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20160825023855.GA6807@openwall.com>
Date: Thu, 25 Aug 2016 05:38:56 +0300
From: Solar Designer <solar@...nwall.com>
To: announce@...ts.openwall.com
Cc: owl-users@...ts.openwall.com
Subject: [openwall-announce] new Owl ISOs & templates
Hi,
Like last summer, I've generated and released new Owl 3.1-stable and
Owl-current ISO images and OpenVZ container templates. These are dated
August 24, and are already on some of the mirrors:
http://www.openwall.com/Owl/
The updates since last summer are minor, and are mostly limited to bug
and security fixes. These include GnuPG update addressing the recently
publicized PRNG flaw (CVE-2016-6313), and Linux/OpenVZ kernel update
addressing several DoS vulnerabilities.
More detail may be found in the change logs as usual:
http://www.openwall.com/Owl/CHANGES-3.1-stable.shtml
http://www.openwall.com/Owl/CHANGES-current.shtml
On a related note, as ridiculous as this is, Owl dodged last year's
OpenSSH privilege separation bypass due to use of April 2003 code (plus
our patches and backports amounting to 29 patch files now), whereas
those bugs were introduced into OpenSSH in May 2003:
http://www.openwall.com/lists/oss-security/2015/08/12/17
While things like this are nice, obviously a lot of packages in Owl are
badly out of date, and Owl is barely kept on life support through these
infrequent updates for only the most pressing issues.
Arguably, Owl has served its purpose years ago:
http://www.openwall.com/lists/owl-users/2014/12/30/1
We'll need to decide on whether and what to do with Owl next, beside
the prolonged life support. One possibility is turning it into a
smaller (and safer?) OpenVZ 7 hosting platform than OpenVZ project's own
VzLinux is (which is based on RHEL7, inheriting the bloat), but nothing
is certain yet.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
