| Newsgroups |
gmane.comp.version-control.cvs.gui.user |
| Message-ID |
<98A50FFF9B65334EBF1969B30CD7B023E86728@w2k8srvrg.march-hare.local> |
--_000_98A50FFF9B65334EBF1969B30CD7B023E86728w2k8srvrgmarchhar_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
We have been informed of "Insecure Library Loading Vulnerability" in WinCVS=
(all versions) a by "hyp3rlinx / apparition security".
A fix for the CVS Suite edition on WinCVS has been released on Friday 2nd F=
eb 2018 and will be announcing the fix on our twitter feed and to our custo=
mers later today 5 Feb 2018.
https://www.march-hare.com/cvspro/
I have posted full details on SourceForge using 'private' ticket 1012.
Also, a quick reminder that the 'old' versions of CVSNT shipped with WinCVS=
have known security vulnerabilities:
https://www.march-hare.com/cvspro/security.htm
CVSNT is the software that actually does the 'checkout' and 'commit' operat=
ions - you can 'see' it running in the 'progress' window in WinCVS. CVSNT =
client is bundled with WinCVS. WinCVS is the 'GUI' that gives you the menu=
and dialog boxes. WinCVS itself does not do any version control, that's w=
hat the CVSNT client is doing.
In particular the CVSNT client (and hence WinCVS) is susceptible to the rec=
ent 'wipe SSH-2 private keys from memory' and 'diffie-hellman range check' =
security issues.
http://march-hare.com/cvspro/security.htm#CVE-2015-2157
CVS Suite 2009R2 (CVSNT 2.8.01) was updated on 3rd August 2015 to resolve t=
his.
CVS Suite 2009R2 client contains WinCVS, TortoiseCVS, CVS Suite Studio, Rel=
ease Manager etc. and is compatible with Windows 8, Windows 7, Windows Vist=
a and Windows XP.
CVS Suite 2009R2 command line client is compatible with Linux, Mac and Wind=
ows.
CVS Suite 2009R2 server contains the high performance server service, integ=
ration with Jira, Bugzilla and Mantis, failsafe audit, change and merge tra=
cking and is compatible with Linux, Mac, and Windows Server 2016, Windows S=
erver 2012R2, Windows Server 2012, Windows Server 2008R2, Windows Server 20=
08 and Windows Server 2003.
For more information please contact [email protected]<mailto:support@m=
arch-hare.com>
Regards,
Arthur Barrett
Product Manager
March Hare Software
authors of CVSNT since 2004
--_000_98A50FFF9B65334EBF1969B30CD7B023E86728w2k8srvrgmarchhar_
Content-Type: text/html; charset=US-ASCII
Content-Transfer-Encoding: 7bit
<head>
<style type="text/css">
<!--
/* start of attachment style */
.ygrp-photo-title{
clear: both;
font-size: smaller;
height: 15px;
overflow: hidden;
text-align: center;
width: 75px;
}
div.ygrp-photo{
background-position: center;
background-repeat: no-repeat;
background-color: white;
border: 1px solid black;
height: 62px;
width: 62px;
}
div.photo-title
a,
div.photo-title a:active,
div.photo-title a:hover,
div.photo-title a:visited {
text-decoration: none;
}
div.attach-table div.attach-row {
clear: both;
}
div.attach-table div.attach-row div {
float: left;
/* margin: 2px;*/
}
p {
clear: both;
padding: 15px 0 3px 0;
overflow: hidden;
}
div.ygrp-file {
width: 30px;
valign: middle;
}
div.attach-table div.attach-row div div a {
text-decoration: none;
}
div.attach-table div.attach-row div div span {
font-weight: normal;
}
div.ygrp-file-title {
font-weight: bold;
}
/* end of attachment style */
-->
</style>
</head>
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
..MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<!-- |**|begin egp html banner|**| -->
<br><br>
<!-- |**|end egp html banner|**| -->
<div class="WordSection1">
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">We have been informed of "Insecure Library Loading Vulnerability" in WinCVS (all versions) a by "hyp3rlinx / apparition security".<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">A fix for the CVS Suite edition on WinCVS has been released on Friday 2nd Feb 2018 and will be announcing the fix on our twitter feed and to our customers later today 5 Feb 2018.<o:p></o:p></p>
<p class="MsoPlainText"><a href="https://www.march-hare.com/cvspro/">https://www.march-hare.com/cvspro/</a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I have posted full details on SourceForge using 'private' ticket 1012.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Also, a quick reminder that the 'old' versions of CVSNT shipped with WinCVS have known security vulnerabilities:<o:p></o:p></p>
<p class="MsoPlainText"><a href="https://www.march-hare.com/cvspro/security.htm">https://www.march-hare.com/cvspro/security.htm</a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CVSNT is the software that actually does the 'checkout' and 'commit' operations - you can 'see' it running in the 'progress' window in WinCVS. CVSNT client is bundled with WinCVS. WinCVS is the 'GUI' that gives you the menu and dialog
boxes. WinCVS itself does not do any version control, that's what the CVSNT client is doing.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">In particular the CVSNT client (and hence WinCVS) is susceptible to the recent 'wipe SSH-2 private keys from memory' and 'diffie-hellman range check' security issues.<o:p></o:p></p>
<p class="MsoPlainText"><a href="http://march-hare.com/cvspro/security.htm#CVE-2015-2157">http://march-hare.com/cvspro/security.htm#CVE-2015-2157</a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CVS Suite 2009R2 (CVSNT 2.8.01) was updated on 3rd August 2015 to resolve this.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CVS Suite 2009R2 client contains WinCVS, TortoiseCVS, CVS Suite Studio, Release Manager etc. and is compatible with Windows 8, Windows 7, Windows Vista and Windows XP.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CVS Suite 2009R2 command line client is compatible with Linux, Mac and Windows.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CVS Suite 2009R2 server contains the high performance server service, integration with Jira, Bugzilla and Mantis, failsafe audit, change and merge tracking and is compatible with Linux, Mac, and Windows Server 2016, Windows Server 2012R2,
Windows Server 2012, Windows Server 2008R2, Windows Server 2008 and Windows Server 2003.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">For more information please contact <a href="mailto:[email protected]">
[email protected]</a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Regards,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Arthur Barrett<o:p></o:p></p>
<p class="MsoPlainText">Product Manager<o:p></o:p></p>
<p class="MsoPlainText">March Hare Software<o:p></o:p></p>
<p class="MsoPlainText">authors of CVSNT since 2004 <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<!-- |**|begin egp html banner|**| -->
<br>
<br>
<!-- |**|end egp html banner|**| -->
<div width="1" style="color: white; clear: both;"/>__._,_.___</div>
<div id="fromDMARC" style="clear:both; margin-top: 10px;">
<hr style="height:2px ; border-width:0; color:#E3E3E3; background-color:#E3E3E3;">
Posted by: Arthur Barrett <[email protected]> <hr style="height:2px ; border-width:0; color:#E3E3E3; background-color:#E3E3E3;">
</div>
<!-- Start Recommendations -->
<!-- End Recommendations -->
<!-- |**|begin egp html banner|**| -->
<img src="http://geo.yahoo.com/serv?s=97476590/grpId=2082656/grpspId=1707281907/msgId=19168/stime=1517799701" width="1" height="1"> <br>
<!-- |**|end egp html banner|**| -->
<!-- |**|begin egp html banner|**| -->
<br>
<!-- |**|begin egp html banner|**| -->
<div id="ygrp-vital" style="background-color: #f2f2f2; font-family: Verdana; font-size: 10px; margin-bottom: 10px; padding: 10px;">
<span id="vithd" style="font-weight: bold; color: #333; text-transform: uppercase; "><a href="https://groups.yahoo.com/neo/groups/cvsgui/info;_ylc=X3oDMTJlbWc1bTg4BF9TAzk3MzU5NzE0BGdycElkAzIwODI2NTYEZ3Jwc3BJZAMxNzA3MjgxOTA3BHNlYwN2dGwEc2xrA3ZnaHAEc3RpbWUDMTUxNzc5OTcwMQ--" style="text-decoration: none;">Visit Your Group</a></span>
<ul style="list-style-type: none; margin: 0; padding: 0; display: inline;">
</ul>
</div>
<div id="ft" style="font-family: Arial; font-size: 11px; margin-top: 5px; padding: 0 2px 0 0; clear: both;">
<a href="https://groups.yahoo.com/neo;_ylc=X3oDMTJkbzR2a25xBF9TAzk3NDc2NTkwBGdycElkAzIwODI2NTYEZ3Jwc3BJZAMxNzA3MjgxOTA3BHNlYwNmdHIEc2xrA2dmcARzdGltZQMxNTE3Nzk5NzAx" style="float: left;"><img src="http://l.yimg.com/ru/static/images/yg/img/email/new_logo/logo-groups-137x15.png" height="15" width="137" alt="Yahoo! Groups" style="border: 0;"/></a>
<div style="color: #747575; float: right;"> • <a href="https://info.yahoo.com/privacy/us/yahoo/groups/details.html" style="text-decoration: none;">Privacy</a> • <a href="mailto:[email protected]?subject=Unsubscribe" style="text-decoration: none;">Unsubscribe</a> • <a href="https://info.yahoo.com/legal/us/yahoo/utos/terms/" style="text-decoration: none;">Terms of Use</a> </div>
</div>
<!-- |**|end egp html banner|**| -->
</div> <!-- ygrp-msg -->
<br>
<!-- |**|end egp html banner|**| -->
<div style="color: white; clear: both;"/>__,_._,___</div>
</body>
</html>
--_000_98A50FFF9B65334EBF1969B30CD7B023E86728w2k8srvrgmarchhar_--