Synopsis:          Important: OpenAFS security update
Advisory ID:       RITM0891205
Issue Date:        2019-10-23
--Security Fixes:
* Fix OPENAFS-SA-2019-001: information leakage in failed RPC output
Generated RPC handler routines ran output variables through XDR encoding
even when the call had failed and would shortly be aborted (and for
which uninitialized output variables is common); any complete packets
assembled in the process would be sent to the peer, leaking the contents
of the uninitialized memory in question.

* Fix OPENAFS-SA-2019-002: information leakage from uninitialized scalars
Generated RPC handler routines did not initialize output variables of
scalar (fixed-length) type, since they did not require dedicated logic to
free.  Such variables allocated on the stack could remain uninitialized
in some cases (including those affected by OPENAFS-SA-2019-001), and the
contents of uninitialized memory would be returned to the peer.
--SL6
  x86_64
    kmod-openafs-754-1.6.24-290.sl6.754.23.1.x86_64.rpm
    kmod-openafs-754-debuginfo-1.6.24-290.sl6.754.23.1.x86_64.rpm
  i386
    kmod-openafs-754-1.6.24-290.sl6.754.23.1.i686.rpm
    kmod-openafs-754-debuginfo-1.6.24-290.sl6.754.23.1.i686.rpm
SL7
  x86_64
    kmod-openafs-1.6-sl-1062-1.6.24-290.sl7.1062.4.1.x86_64.rpm
    kmod-openafs-1.6-sl-1062-debuginfo-1.6.24-290.sl7.1062.4.1.x86_64.rpm

- Scientific Linux Development Team