Synopsis: Low: openhpi security, bug fix, and enhancement update
Advisory ID: SLSA-2015:2369-1
Issue Date: 2015-11-19
CVE Numbers: CVE-2015-3248
It was found that the “/var/lib/openhpi” directory provided by OpenHPI
used world-writeable and world-readable permissions. A local user could
use this flaw to view, modify, and delete OpenHPI-related data, or even
fill up the storage device hosting the /var/lib directory. (CVE-2015-3248)
The openhpi packages have been upgraded to upstream version 3.4.0, which
provides a number of bug fixes and enhancements over the previous version.
This update also fixes the following bug:
* Network timeouts were handled incorrectly in the openhpid daemon. As a
consequence, network connections could fail when external plug-ins were
used. With this update, handling of network socket timeouts has been
improved in openhpid, and the described problem no longer occurs.
– Scientific Linux Development Team