Xen 4.13.2 released

Xen 4.13.2 released

[Jan Beulich]

All,

I am pleased to announce the release of Xen 4.13.2. This is available
immediately from its git repository
http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.13
(tag RELEASE-4.13.2) or from the XenProject download page
https://xenproject.org/downloads/xen-project-archives/xen-project-4-13-series/xen-project-4-13-2/
(where a list of changes can also be found).

We recommend all users of the 4.13 stable series to update to this
latest point release.

Regards, Jan

Re: Xen 4.13.2 released

[Michael Young]

On Tue, 3 Nov 2020, Jan Beulich wrote:

> All,
>
> I am pleased to announce the release of Xen 4.13.2. This is available
> immediately from its git repository
> http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.13
> (tag RELEASE-4.13.2) or from the XenProject download page
> https://xenproject.org/downloads/xen-project-archives/xen-project-4-13-series/xen-project-4-13-2/
> (where a list of changes can also be found).

Is the entry for XSA-335 correct on the download page? That was a qemu 
patch but I don't think it was included in 4.13.2.

 	Michael Young

Re: Xen 4.13.2 released

[Jan Beulich]

On 04.11.2020 00:55, Michael Young wrote:
> On Tue, 3 Nov 2020, Jan Beulich wrote:
>> I am pleased to announce the release of Xen 4.13.2. This is available
>> immediately from its git repository
>> http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.13
>> (tag RELEASE-4.13.2) or from the XenProject download page
>> https://xenproject.org/downloads/xen-project-archives/xen-project-4-13-series/xen-project-4-13-2/
>> (where a list of changes can also be found).
> 
> Is the entry for XSA-335 correct on the download page? That was a qemu 
> patch but I don't think it was included in 4.13.2.

Interesting, thanks for pointing this out. The qemu-trad part,
albeit "just" a SUPPORT.md update, didn't even make it into
staging yet afaics. While this can perhaps be viewed as benign,
I'm concerned that the qemuu fix also doesn't look to have
landed in any of the branches yet, despite the version bump on
the staging/master branches just 5 days ago. Anthony, Stefano?

Jan

Re: Xen 4.13.2 released

[Anthony PERARD]

On Wed, Nov 04, 2020 at 08:47:57AM +0100, Jan Beulich wrote:
> On 04.11.2020 00:55, Michael Young wrote:
> > On Tue, 3 Nov 2020, Jan Beulich wrote:
> >> I am pleased to announce the release of Xen 4.13.2. This is available
> >> immediately from its git repository
> >> http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.13
> >> (tag RELEASE-4.13.2) or from the XenProject download page
> >> https://xenproject.org/downloads/xen-project-archives/xen-project-4-13-series/xen-project-4-13-2/
> >> (where a list of changes can also be found).
> > 
> > Is the entry for XSA-335 correct on the download page? That was a qemu 
> > patch but I don't think it was included in 4.13.2.
> 
> Interesting, thanks for pointing this out. The qemu-trad part,
> albeit "just" a SUPPORT.md update, didn't even make it into
> staging yet afaics. While this can perhaps be viewed as benign,
> I'm concerned that the qemuu fix also doesn't look to have
> landed in any of the branches yet, despite the version bump on
> the staging/master branches just 5 days ago. Anthony, Stefano?

I've pushed the fix now, to qemu-xen trees.

Maybe George's script could check qemu-xen trees as well? Or someone in
the security team could push the patchs or tell me about XSAs involving
QEMU, otherwise that's going to happen again.

Cheers,

-- 
Anthony PERARD

Re: Xen 4.13.2 released

[George Dunlap]

> On Nov 6, 2020, at 3:49 PM, Anthony PERARD <anthony.perard@citrix.com> wrote:
> 
> On Wed, Nov 04, 2020 at 08:47:57AM +0100, Jan Beulich wrote:
>> On 04.11.2020 00:55, Michael Young wrote:
>>> On Tue, 3 Nov 2020, Jan Beulich wrote:
>>>> I am pleased to announce the release of Xen 4.13.2. This is available
>>>> immediately from its git repository
>>>> http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.13
>>>> (tag RELEASE-4.13.2) or from the XenProject download page
>>>> https://xenproject.org/downloads/xen-project-archives/xen-project-4-13-series/xen-project-4-13-2/
>>>> (where a list of changes can also be found).
>>> 
>>> Is the entry for XSA-335 correct on the download page? That was a qemu 
>>> patch but I don't think it was included in 4.13.2.
>> 
>> Interesting, thanks for pointing this out. The qemu-trad part,
>> albeit "just" a SUPPORT.md update, didn't even make it into
>> staging yet afaics. While this can perhaps be viewed as benign,
>> I'm concerned that the qemuu fix also doesn't look to have
>> landed in any of the branches yet, despite the version bump on
>> the staging/master branches just 5 days ago. Anthony, Stefano?
> 
> I've pushed the fix now, to qemu-xen trees.
> 
> Maybe George's script could check qemu-xen trees as well? Or someone in
> the security team could push the patchs or tell me about XSAs involving
> QEMU, otherwise that's going to happen again.

Making a script you could put into a cron job to tell you when a QEMU XSA comes out should be fairly easy.  (Although, of course in this case it wouldn’t have worked because xsa.json didn’t have the correct information.)

Checking that it’s been applied would be a bit more work; it’s on my list of things to do.

It’s all in Go, so maybe I should publish the packages; then maybe you could send me a PR. :-)

 -George