The following Fedora EPEL 7 Security updates need testing: Age URL 631 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-3c9292b62d condor-8.6.11-1.el7 373 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-c499781e80 python-gnupg-0.4.4-1.el7 371 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-bc0182548b bubblewrap-0.3.3-2.el7 80 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-fa8a2e97c6 python-waitress-1.4.3-1.el7 20 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-19d171a465 python34-3.4.10-5.el7 12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-324f1b735d chromium-81.0.4044.122-1.el7 12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-c4860b563d openvpn-2.4.9-1.el7 8 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-320cd2c3b5 java-latest-openjdk-14.0.1.7-2.rolling.el7 5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-12ba1ceddb wordpress-5.1.5-1.el7 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-76347da426 seamonkey-2.53.2-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
bcftools-1.9-3.el7 composer-1.10.6-1.el7 drraw-2.2-0.22.b2.el7 nx-libs-3.5.99.23-1.el7 pure-ftpd-1.0.47-4.el7 python-collada-0.6-2.el7 python-fasteners-0.9.0-3.el7 viewvc-1.1.28-1.el7
Details about builds:
================================================================================ bcftools-1.9-3.el7 (FEDORA-EPEL-2020-f7b02980b0) Tools for genomic variant calling and manipulating VCF/BCF files -------------------------------------------------------------------------------- Update Information:
Initial package. -------------------------------------------------------------------------------- ChangeLog:
-------------------------------------------------------------------------------- References:
[ 1 ] Bug #1774741 - Review Request: bcftools - Tools for genomic variant calling and manipulating VCF/BCF files https://bugzilla.redhat.com/show_bug.cgi?id=1774741 --------------------------------------------------------------------------------
================================================================================ composer-1.10.6-1.el7 (FEDORA-EPEL-2020-e2a446f497) Dependency Manager for PHP -------------------------------------------------------------------------------- Update Information:
**Version 1.10.6** - 2020-05-06 * Fixed version guessing to take composer- runtime-api and composer-plugin-api requirements into account to avoid selecting packages which require Composer 2 * Fixed package name validation to allow several dashes following each other * Fixed post-status-cmd script not firing when there were no changes to be displayed * Fixed composer-runtime-api support on Composer 1.x, the package is now present as 1.0.0 * Fixed support for composer show --name-only --self * Fixed detection of GitLab URLs when handling authentication in some cases -------------------------------------------------------------------------------- ChangeLog:
* Wed May 6 2020 Remi Collet remi@remirepo.net - 1.10.6-1 - update to 1.10.6 - provide php-composer(composer-runtime-api) --------------------------------------------------------------------------------
================================================================================ drraw-2.2-0.22.b2.el7 (FEDORA-EPEL-2020-59cf8b2c42) Web based presentation front-end for RRDtool -------------------------------------------------------------------------------- Update Information:
First EPEL 7 build. -------------------------------------------------------------------------------- ChangeLog:
--------------------------------------------------------------------------------
================================================================================ nx-libs-3.5.99.23-1.el7 (FEDORA-EPEL-2020-907fcc3b1e) NX X11 protocol compression libraries -------------------------------------------------------------------------------- Update Information:
Update to 3.5.99.23 -------------------------------------------------------------------------------- ChangeLog:
* Sat Feb 1 2020 Orion Poplawski orion@nwra.com - 3.5.99.23-1 - Update to 3.5.99.23 * Wed Jan 29 2020 Fedora Release Engineering releng@fedoraproject.org - 3.5.99.22-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Mon Dec 16 2019 Orion Poplawski orion@nwra.com - 3.5.99.22-1 - Update to 3.5.99.22 * Thu Aug 15 2019 Orion Poplawski orion@nwra.com - 3.5.99.21-2 - BR libXfont2 on Fedora and RHEL 8+ * Thu Aug 15 2019 Orion Poplawski orion@nwra.com - 3.5.99.21-1 - Update to 3.5.99.21 * Thu Jul 25 2019 Fedora Release Engineering releng@fedoraproject.org - 3.5.99.20-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Sun Apr 28 2019 Orion Poplawski orion@nwra.com - 3.5.99.20-1 - Update to 3.5.99.20 * Fri Feb 1 2019 Fedora Release Engineering releng@fedoraproject.org - 3.5.99.17-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ pure-ftpd-1.0.47-4.el7 (FEDORA-EPEL-2020-c9c5ded31b) Lightweight, fast and secure FTP server -------------------------------------------------------------------------------- Update Information:
Fix CVE-2020-9365 and CVE-2020-9274 -------------------------------------------------------------------------------- ChangeLog:
* Wed May 6 2020 Ond��ej Lyson��k olysonek@redhat.com - 1.0.47-4 - Fix CVE-2020-9365 and CVE-2020-9274 - Resolves: rhbz#1828689 - Resolves: rhbz#1831060 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1828687 - CVE-2020-9365 pure-ftpd: OOB read in pure_strcmp function in utils.c https://bugzilla.redhat.com/show_bug.cgi?id=1828687 [ 2 ] Bug #1831058 - CVE-2020-9274 pure-ftpd: uninitialized pointer in the diraliases linked list leads to denial of service or information disclosure https://bugzilla.redhat.com/show_bug.cgi?id=1831058 --------------------------------------------------------------------------------
================================================================================ python-collada-0.6-2.el7 (FEDORA-EPEL-2020-46bc32828d) A python module for creating, editing and loading COLLADA -------------------------------------------------------------------------------- Update Information:
Rebuild for EPEL 7. -------------------------------------------------------------------------------- ChangeLog:
* Wed May 6 2020 Orion Poplawski orion@nwra.com - 0.6-2 - Cleanup spec and rebuild to fix dependencies * Mon Apr 8 2019 Richard Shaw hobbes1069@gmail.com - 0.6-1 - Update to 0.6. --------------------------------------------------------------------------------
================================================================================ python-fasteners-0.9.0-3.el7 (FEDORA-EPEL-2020-995610dbd1) A python package that provides useful locks -------------------------------------------------------------------------------- Update Information:
add Python 3 subpackage -------------------------------------------------------------------------------- ChangeLog:
* Mon Apr 13 2020 Felix Schwarz fschwarz@fedoraproject.org - 0.9.0-3 - add Python 3 subpackage -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1823122 - python-fasteners: Provide python3 packages in EPEL 7 https://bugzilla.redhat.com/show_bug.cgi?id=1823122 --------------------------------------------------------------------------------
================================================================================ viewvc-1.1.28-1.el7 (FEDORA-EPEL-2020-ec788c8a86) Browser interface for CVS and SVN version control repositories -------------------------------------------------------------------------------- Update Information:
Fix for CVE-2020-5283. ViewVC 1.1.28 ChangeLog - security fix: escape subdir lastmod file name (#211) - fix standalone.py first request failure (#195) ViewVC 1.1.27 ChangeLog: - suppress stack traces (with option to show) (#140) - distinguish text/binary/image files by icons (#166, #175) - colorize alternating file content lines (#167) - link to the instance root from the ViewVC logo (#168) - display directory and root counts, too (#169) - fix double fault error in standalone.py (#157) - support timezone offsets with minutes piece (#176) -------------------------------------------------------------------------------- ChangeLog:
* Wed May 6 2020 Bojan Smojver bojan@rexursive.com - 1.1.28-1 - bump up to 1.1.28 - CVE-2020-5283 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1831804 - CVE-2020-5283 viewvc: XSS vulnerability in CVS show_subdir_lastmod support [fedora-30] https://bugzilla.redhat.com/show_bug.cgi?id=1831804 [ 2 ] Bug #1831805 - CVE-2020-5283 viewvc: XSS vulnerability in CVS show_subdir_lastmod support [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1831805 [ 3 ] Bug #1831806 - CVE-2020-5283 viewvc: XSS vulnerability in CVS show_subdir_lastmod support [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1831806 --------------------------------------------------------------------------------
epel-devel@lists.fedoraproject.org