Fedora EPEL 7 updates-testing report
by updates@fedoraproject.org
The following Fedora EPEL 7 Security updates need testing:
Age URL
162 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-f9d6ff695a bibutils-6.6-1.el7 ghc-hs-bibutils-6.6.0.0-1.el7 pandoc-citeproc-0.3.0.1-4.el7
146 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-3c9292b62d condor-8.6.11-1.el7
37 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-0346a55d0f nagios-4.4.2-3.el7
20 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-b6fa6cebc3 game-music-emu-0.6.2-1.el7
17 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-b43fdd19c3 vcftools-0.1.16-1.el7
9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-25ef4c914f tcpreplay-4.3.1-1.el7
5 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-b96164478d php-horde-Horde-Image-2.5.4-1.el7
4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-6c3fb8b090 chromium-71.0.3578.98-2.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
fotoxx-19.0-1.el7
incron-0.5.12-9.el7
libsodium-1.0.17-1.el7
libwebsockets-3.0.1-2.el7
mosquitto-1.5.5-2.el7
perl-generators-1.08-7.el7
php-horde-Horde-Form-2.0.19-1.el7
php-horde-imp-6.2.23-1.el7
php-horde-kronolith-4.2.26-1.el7
purple-facebook-0.9.5-13.9ff9acf9fa14.el7
python-django-1.11.18-1.el7
tor-0.3.5.7-1.el7
Details about builds:
================================================================================
fotoxx-19.0-1.el7 (FEDORA-EPEL-2019-f0e275ac58)
Photo editor
--------------------------------------------------------------------------------
Update Information:
19.0
--------------------------------------------------------------------------------
================================================================================
incron-0.5.12-9.el7 (FEDORA-EPEL-2019-60b62db475)
Inotify cron system
--------------------------------------------------------------------------------
Update Information:
Add fix the zombie / defunct processes.
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jan 5 2019 Kevin Fenzi <kevin(a)scrye.com> - 0.5.12-9
- Add patch to prevent zombies from upstream post release commits. Fixes bug #1656939
* Tue Jul 17 2018 Kevin Fenzi <kevin(a)scrye.com> - 0.5.12-8
- Fix FTBFS by adding BuildRequires: gcc-c++
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.5.12-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1656939 - Incron causes defunct processes
https://bugzilla.redhat.com/show_bug.cgi?id=1656939
--------------------------------------------------------------------------------
================================================================================
libsodium-1.0.17-1.el7 (FEDORA-EPEL-2019-71208a49bb)
The Sodium crypto library
--------------------------------------------------------------------------------
Update Information:
** Version 1.0.17** - Bug fix: `sodium_pad()` didn't properly support block
sizes >= 256 bytes. - JS/WebAssembly: some old iOS versions can't instantiate
the WebAssembly module; fall back to Javascript on these. - JS/WebAssembly:
compatibility with newer Emscripten versions. - Bug fix:
`crypto_pwhash_scryptsalsa208sha256_str_verify()` and
`crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()` didn't return `EINVAL`
on input strings with a short length, unlike their high-level counterpart. -
Added a workaround for Visual Studio 2010 bug causing CPU features not to be
detected. - Portability improvements. - Test vectors from Project Wycheproof
have been added. - New low-level APIs for arithmetic mod the order of the prime
order group: `crypto_core_ed25519_scalar_random()`,
`crypto_core_ed25519_scalar_reduce()`, `crypto_core_ed25519_scalar_invert()`,
`crypto_core_ed25519_scalar_negate()`,
`crypto_core_ed25519_scalar_complement()`, `crypto_core_ed25519_scalar_add()`
and `crypto_core_ed25519_scalar_sub()`. - New low-level APIs for scalar
multiplication without clamping: `crypto_scalarmult_ed25519_base_noclamp()` and
`crypto_scalarmult_ed25519_noclamp()`. These new APIs are especially useful for
blinding. - `sodium_sub()` has been implemented. - Support for WatchOS has
been added. - getrandom(2) is now used on FreeBSD 12+. - The `nonnull`
attribute has been added to all relevant prototypes. - More reliable AVX512
detection. - Javascript/Webassembly builds now use dynamic memory growth.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 7 2019 Remi Collet <remi(a)remirepo.net> - 1.0.17-1
- update to 1.0.17
--------------------------------------------------------------------------------
================================================================================
libwebsockets-3.0.1-2.el7 (FEDORA-EPEL-2019-b78513aba4)
A lightweight C library for Websockets
--------------------------------------------------------------------------------
Update Information:
Rebuild for libwebsockets 3.x ---- Update to latest upstream release 3.0.1
(rhbz#1604687)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 7 2019 Peter Robinson <pbrobinson(a)fedoraproject.org> 3.0.1-2
- Add libuv-devel Requires to devel package
* Tue Dec 18 2018 Fabian Affolter <mail(a)fabian-affolter.ch> - 3.0.1-1
- Update to latest upstream release 3.0.1 (rhbz#1604687)
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.0.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Mon May 7 2018 Fabian Affolter <mail(a)fabian-affolter.ch> - 3.0.0-1
- Update to latest upstream release 3.0.0 (rhbz#1575605)
* Thu Mar 15 2018 Fabian Affolter <mail(a)fabian-affolter.ch> - 2.4.2-1
- Update to latest upstream release 2.4.2 (rhbz#1504377)
* Fri Feb 16 2018 Fabian Affolter <mail(a)fabian-affolter.ch> - 2.4.1-1
- Update to latest upstream release 2.4.1 (rhbz#1504377)
* Wed Feb 7 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.4.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Fri Oct 20 2017 Fabian Affolter <mail(a)fabian-affolter.ch> - 2.4.0-1
- Update to latest upstream release 2.4.0 (rhbz#1504377)
* Thu Aug 3 2017 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.3.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Sat Jul 29 2017 Fabian Affolter <mail(a)fabian-affolter.ch> - 2.3.0-1
- Update to latest upstream release 2.3.0 (rhbz#1472509)
* Wed Jul 26 2017 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.2.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Thu May 11 2017 Fabian Affolter <mail(a)fabian-affolter.ch> - 2.2.0-1
- Update to latest upstream release 2.2.1 (rhbz#1437272)
* Sat Mar 25 2017 Fabian Affolter <mail(a)fabian-affolter.ch> - 2.2.0-1
- Update to latest upstream release 2.2.0 (rhbz#1422477)
* Tue Mar 14 2017 Fabian Affolter <mail(a)fabian-affolter.ch> - 2.1.1-1
- Update to latest upstream release 2.1.1 (rhbz#1422477)
* Fri Feb 10 2017 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.1.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Thu Nov 17 2016 Fabian Affolter <mail(a)fabian-affolter.ch> - 2.1.0-2
- Move tests (rhbz#1390538)
* Thu Nov 17 2016 Fabian Affolter <mail(a)fabian-affolter.ch> - 2.1.0-1
- Update to latest upstream release 2.1.0 (rhbz#1376257)
* Mon Oct 31 2016 Fabian Affolter <mail(a)fabian-affolter.ch> - 2.0.3-1
- Update to latest upstream release 2.0.3
* Wed Aug 3 2016 Fabian Affolter <mail(a)fabian-affolter.ch> - 2.0.2-1
- Update to latest upstream release 2.0.2 (rhbz#1358988)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1604687 - libwebsockets: FTBFS in Fedora rawhide
https://bugzilla.redhat.com/show_bug.cgi?id=1604687
--------------------------------------------------------------------------------
================================================================================
mosquitto-1.5.5-2.el7 (FEDORA-EPEL-2019-b78513aba4)
An Open Source MQTT v3.1/v3.1.1 Broker
--------------------------------------------------------------------------------
Update Information:
Rebuild for libwebsockets 3.x ---- Update to latest upstream release 3.0.1
(rhbz#1604687)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 7 2019 Peter Robinson <pbrobinson(a)fedoraproject.org> 1.5.5-2
- Rebuild for libwebsockets 3.x
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1604687 - libwebsockets: FTBFS in Fedora rawhide
https://bugzilla.redhat.com/show_bug.cgi?id=1604687
--------------------------------------------------------------------------------
================================================================================
perl-generators-1.08-7.el7 (FEDORA-EPEL-2019-482c6561b5)
RPM Perl dependencies generators
--------------------------------------------------------------------------------
Update Information:
This release removes perl-interpreter package that is provided by RHEL-7.6's
perl package now. Users are recommended to upgrade to RHEL-7.6.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 7 2019 Petr Pisar <ppisar(a)redhat.com> - 1.08-7
- Remove perl-interpreter package (bug #1663304)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1663304 - Drop sub-package perl-interpreter
https://bugzilla.redhat.com/show_bug.cgi?id=1663304
--------------------------------------------------------------------------------
================================================================================
php-horde-Horde-Form-2.0.19-1.el7 (FEDORA-EPEL-2019-8e5fe375cf)
Horde Form API
--------------------------------------------------------------------------------
Update Information:
**Horde_Form 2.0.19** * [mjr] SECURITY: Prevent RCE vulnerability due to
potential directory traversal in Image uploads (An independent security
researcher has reported this vulnerability to SecuriTeam Secure Disclosure
program).
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 7 2019 Remi Collet <remi(a)remirepo.net> - 2.0.19-1
- update to 2.0.19
- use range dependencies
--------------------------------------------------------------------------------
================================================================================
php-horde-imp-6.2.23-1.el7 (FEDORA-EPEL-2019-afdb744710)
A web based webmail system
--------------------------------------------------------------------------------
Update Information:
**imp 6.2.23** * [mjr] Fix attachment handling in minimal mode (PR #3, Thorsten
Kahler). * [mjr] Fix regular expression error with PHP 7.3. * [mjr] Fix fatal
error when requested attachment not found in minimal mode.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 7 2019 Remi Collet <remi(a)remirepo.net> - 6.2.23-1
- update to 6.2.23
- use range dependencies
--------------------------------------------------------------------------------
================================================================================
php-horde-kronolith-4.2.26-1.el7 (FEDORA-EPEL-2019-487cae9793)
A web based calendar
--------------------------------------------------------------------------------
Update Information:
**kronolith 4.2.26** * [mjr] Remove hard coded end date for calendar feed and
allow it to be specified in url.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 7 2019 Remi Collet <remi(a)remirepo.net> - 4.2.26-1
- update to 4.2.26
- use range dependencies
--------------------------------------------------------------------------------
================================================================================
purple-facebook-0.9.5-13.9ff9acf9fa14.el7 (FEDORA-EPEL-2019-7e599c4ff7)
Facebook protocol plugin for purple2
--------------------------------------------------------------------------------
Update Information:
- Add patch from upstream fixing 'Failed to get sync_sequence_id' - Add patch to
check and link zlib
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 7 2019 Bj��rn Esser <besser82(a)fedoraproject.org> - 0.9.5-13.9ff9acf9fa14
- Add patch to check and link zlib
* Mon Jan 7 2019 Bj��rn Esser <besser82(a)fedoraproject.org> - 0.9.5-12.9ff9acf9fa14
- Add patch from upstream fixing 'Failed to get sync_sequence_id' (#1663599)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1663599 - Stop working with the error: Failed to get sync_sequence_id
https://bugzilla.redhat.com/show_bug.cgi?id=1663599
--------------------------------------------------------------------------------
================================================================================
python-django-1.11.18-1.el7 (FEDORA-EPEL-2019-01cf520c0b)
A high-level Python Web framework
--------------------------------------------------------------------------------
Update Information:
update to 1.11.18, fix for CVE-2019-3498 (rhbz#1663724)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 7 2019 Matthias Runge <mrunge(a)redhat.com> - 1.11.18-1
- update to 1.11.18, fix for CVE-2019-3498 (rhbz#1663724)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1663724 - CVE-2019-3498 python-django: Content spoofing via URL path in default 404 page [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1663724
--------------------------------------------------------------------------------
================================================================================
tor-0.3.5.7-1.el7 (FEDORA-EPEL-2019-e9f0dbf0b2)
Anonymizing overlay network for TCP
--------------------------------------------------------------------------------
Update Information:
update to latest upstream LTS release
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 7 2019 Marcel H��rry <mh+fedora(a)scrit.ch> - 0.3.5.7-1
- update to latest upstream release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1649336 - Switch tor from 0.2.9 LTS to 0.3.5 LTS
https://bugzilla.redhat.com/show_bug.cgi?id=1649336
--------------------------------------------------------------------------------