Live GIS Disc Press Release 49 - Revision history

Wiki-Camerons: typo

2014-04-18T03:18:09Z

typo

Wiki-Camerons at 20:28, 14 April 2014

2014-04-14T20:28:38Z

Wiki-Camerons at 12:17, 14 April 2014

2014-04-14T12:17:42Z

Wiki-Camerons at 23:40, 13 April 2014

2014-04-13T23:40:40Z

Wildintellect: /* How to Fix */

2014-04-13T17:47:32Z

How to Fix

Darkblueb: /* How to Fix */

2014-04-13T16:29:12Z

How to Fix

Darkblueb: /* OSGeo-Live and HeartBleed vulnerability */

2014-04-13T16:02:09Z

OSGeo-Live and HeartBleed vulnerability

Darkblueb: /* OSGeo-Live and HeartBleed vulnerability */

2014-04-13T15:59:39Z

OSGeo-Live and HeartBleed vulnerability

Darkblueb: /* OSGeo-Live and Heartbleed vulnerability */

2014-04-13T15:48:38Z

OSGeo-Live and Heartbleed vulnerability

Darkblueb: /* OSGeo-Live and Heartbleed vulnerability */

2014-04-13T15:17:15Z

OSGeo-Live and Heartbleed vulnerability

@@ Line 14: / Line 14: @@
-==OSGeo-Live releases effected==
+==OSGeo-Live releases affected==
-OSGeo-Live releases based on Ubuntu 12.04 are effected. This includes versions:
+OSGeo-Live releases based on Ubuntu 12.04 are affected. This includes versions:
 * 6.0
 * 6.5
@@ Line 30: / Line 30: @@
 The default password is "user" (four characters).
-Using the graphical update manager will also work, click the 8 pointed start in the top toolbar. Make sure to check for updates and apply any updates to libssl available.
+Using the graphical update manager will also work, click the 8 pointed star in the top toolbar. Make sure to check for updates and apply any updates to libssl available.
 A '''restart''' of all services is required after the update is applied, otherwise old libs are used for RAM. You can either restart by hand or reboot the whole system.

← Older revision		Revision as of 20:28, 14 April 2014
Line 32:		Line 32:
	Using the graphical update manager will also work, click the 8 pointed start in the top toolbar. Make sure to check for updates and apply any updates to libssl available.		Using the graphical update manager will also work, click the 8 pointed start in the top toolbar. Make sure to check for updates and apply any updates to libssl available.

−	A '''restart''' of all services is ~~recommended~~ after the update is applied. You can either ~~do them~~ by hand or reboot the whole system.	+	A '''restart''' of all services is required after the update is applied, otherwise old libs are used for RAM. You can either restart by hand or reboot the whole system.

@@ Line 3: / Line 3: @@
 April 2014
-The [http://heartbleed.com/ Heartbleed Bug] - described in [http://www.ubuntu.com/usn/usn-2165-1/ this Ubuntu Security Note] - is a serious security exposure, and the relevant software components are shipped on the OSGeo-Live from version 6.0 to the present. Please read the following text carefully, and apply to your own OSGeo-Live usage as appropriate.
+The [http://heartbleed.com/ Heartbleed Bug] - described in [http://www.ubuntu.com/usn/usn-2165-1/ this Ubuntu Security Note] - is a serious security exposure, and the relevant software components shipped on the OSGeo-Live versions 6.0 to the present 7.9.
 As described in many widely available posts on the Internet, the HeartBleed vulnerability is exposed when network software  uses the Transport Layer Security (TLS) feature built on top of a current version of the encryption library openssl. The fix to the vulnerability is to upgrade the openssl package via the Ubuntu/Debian apt mechanism.
-No software on the OSGeoLive is configured to serve network connections using TLS "out of the box." However, some software (such as QGis) which provide WMS connectivity to other network services, may create a reverse-vulnerability when a secure connection is established. By patching your OSGeo-Live openssl library, you can close that reverse-exposure.
+No software on the OSGeo-Live is configured to serve network connections using TLS "out of the box." However, some software (such as QGis) which provide WMS connectivity to other network services, may create a reverse-vulnerability when a secure connection is established. By patching your OSGeo-Live openssl library, you can close that reverse-exposure.
-Please note that the OSGeo-Live project does not recommend using the Live "as-is" for production deployment on the Internet.
+Please note that the OSGeo-Live project does not recommend using OSGeo-Live "as-is" for production deployment on the Internet.
-All users of OSGeo Live from versions 6.0 to the present 7.9 release are strongly encouraged to apply software updates to any installed system
+All users of OSGeo Live from versions 6.0 to the present 7.9 release are strongly encouraged to apply software updates to any installed system.
-==OSGeo-Live releases effected include==
+==OSGeo-Live releases effected==
 OSGeo-Live releases based on Ubuntu 12.04 are effected. This includes versions:
 * 6.0
@@ Line 30: / Line 30: @@
 The default password is "user" (four characters).
-Using the graphical update manager will also work click the 8 pointed start in the top toolbar. Make sure to check for updates and apply any updates to libssl available.
+Using the graphical update manager will also work, click the 8 pointed start in the top toolbar. Make sure to check for updates and apply any updates to libssl available.
 A '''restart''' of all services is recommended after the update is applied. You can either do them by hand or reboot the whole system.

@@ Line 3: / Line 3: @@
 April 2014
-The [http://heartbleed.com/ Heartbleed Bug] - described in [http://www.ubuntu.com/usn/usn-2165-1/ this Ubuntu Security Note] - is a serious security exposure, and the relevant software components are shipped on the OSGeoLive from version 6.0 to the present. Please read the following text carefully, and apply to your own OSGeoLive usage as appropriate.
+The [http://heartbleed.com/ Heartbleed Bug] - described in [http://www.ubuntu.com/usn/usn-2165-1/ this Ubuntu Security Note] - is a serious security exposure, and the relevant software components are shipped on the OSGeo-Live from version 6.0 to the present. Please read the following text carefully, and apply to your own OSGeo-Live usage as appropriate.
 As described in many widely available posts on the Internet, the HeartBleed vulnerability is exposed when network software  uses the Transport Layer Security (TLS) feature built on top of a current version of the encryption library openssl. The fix to the vulnerability is to upgrade the openssl package via the Ubuntu/Debian apt mechanism.
-No software on the OSGeoLive is configured to serve network connections using TLS "out of the box." However, some software (such as QGis) which provide WMS connectivity to other network services, may create a reverse-vulnerability when a secure connection is established. By patching your OSGeoLive openssl library, you can close that reverse-exposure.
+No software on the OSGeoLive is configured to serve network connections using TLS "out of the box." However, some software (such as QGis) which provide WMS connectivity to other network services, may create a reverse-vulnerability when a secure connection is established. By patching your OSGeo-Live openssl library, you can close that reverse-exposure.
-Please note that the OSGeoLive project does not recommend using the Live "as-is" for production deployment on the Internet.
+Please note that the OSGeo-Live project does not recommend using the Live "as-is" for production deployment on the Internet.
 All users of OSGeo Live from versions 6.0 to the present 7.9 release are strongly encouraged to apply software updates to any installed system
@@ Line 22: / Line 22: @@
 == How to Fix ==
-The OSGeoLive project recommends that all installed versions of an affected OSGeoLive release follow at a minimum, these steps:
+The OSGeo-Live project recommends that all installed versions of an affected OSGeo-Live release follow at a minimum, these steps:
 <pre>
 sudo apt-get update

@@ Line 25: / Line 25: @@
 <pre>
 sudo apt-get update
-sudo apt-get upgrade openssl
+sudo apt-get install libssl1.0.0
 </pre>
 The default password is "user" (four characters).

← Older revision		Revision as of 16:29, 13 April 2014
Line 27:		Line 27:
	sudo apt-get upgrade openssl		sudo apt-get upgrade openssl
	</pre>		</pre>
		+
		+	The default password is "user" (four characters).

@@ Line 1: / Line 1: @@
-= OSGeo-Live and Heartbleed vulnerability=
+= OSGeo-Live and HeartBleed vulnerability=
 April 2014
-The [http://heartbleed.com/ Heartbleed Bug], (what is HeartBleed), (how much does it affect the OSGeo Live apps, and how)
+The [http://heartbleed.com/ Heartbleed Bug] - described in [http://www.ubuntu.com/usn/usn-2165-1/ this Ubuntu Security Note] - is a serious security exposure, and the relevant software components are shipped on the OSGeoLive from version 6.0 to the present. Please read the following text carefully, and apply to your own OSGeoLive usage as appropriate.
-(OSGeoLive disclaimer regarding production setup)
+As described in many widely available posts on the Internet, the HeartBleed vulnerability is exposed when network software  uses the Transport Layer Security (TLS) feature built on top of a current version of the encryption library openssl. The fix to the vulnerability is to upgrade the openssl package via the Ubuntu/Debian apt mechanism.
 ==OSGeo-Live releases effected include==