Fedora EPEL 8 updates-testing report
by updates@fedoraproject.org
The following Fedora EPEL 8 Security updates need testing:
Age URL
12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-2aa68c5f5e tor-0.4.3.7-1.el8
12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-317c124dc0 rpki-client-6.8p1-1.el8
11 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-6c93c61069 pngcheck-2.4.0-2.el8
9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-b3000c1eea seamonkey-2.53.5-2.el8
1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-a45bb612b3 chromium-87.0.4280.66-1.el8
The following builds have been pushed to Fedora EPEL 8 updates-testing
anope-2.0.9-3.el8
fail2ban-0.11.2-1.el8
java-latest-openjdk-15.0.1.9-2.rolling.el8
kea-1.8.0-2.el8
python-f5-sdk-3.0.21-8.el8
python-ratelimitingfilter-1.1-4.el8
retrace-server-1.22.4-1.el8
singularity-3.7.0-1.el8
Details about builds:
================================================================================
anope-2.0.9-3.el8 (FEDORA-EPEL-2020-b2d631c074)
IRC services designed for flexibility and ease of use
--------------------------------------------------------------------------------
Update Information:
- Correct include path for OpenSSL 1.1 on RHEL 7
--------------------------------------------------------------------------------
ChangeLog:
* Tue Nov 24 2020 Robert Scheck <robert(a)fedoraproject.org> 2.0.9-3
- Correct include path for OpenSSL 1.1 on RHEL 7
--------------------------------------------------------------------------------
================================================================================
fail2ban-0.11.2-1.el8 (FEDORA-EPEL-2020-6ada33d7a2)
Daemon to ban hosts that cause multiple authentication errors
--------------------------------------------------------------------------------
Update Information:
ver. 0.11.2 (2020/11/23) - heal-the-world-with-security-tools ----------- ###
Fixes * [stability] prevent race condition - no ban if filter (backend) is
continuously busy if too many messages will be found in log, e. g. initial
scan of large log-file or journal (gh-2660) * pyinotify-backend sporadically
avoided initial scanning of log-file by start * python 3.9 compatibility (and
Travis CI support) * restoring a large number (500+ depending on files ulimit)
of current bans when using PyPy fixed * manual ban is written to database, so
can be restored by restart (gh-2647) * `jail.conf`: don't specify `action`
directly in jails (use `action_` or `banaction` instead) * no mails-action added
per default anymore (e. g. to allow that `action = %(action_mw)s` should be
specified per jail or in default section in jail.local), closes gh-2357 *
ensure we've unique action name per jail (also if parameter `actname` is not set
but name deviates from standard name, gh-2686) * don't use `%(banaction)s`
interpolation because it can be complex value (containing `[...]` and/or
quotes), so would bother the action interpolation * fixed type conversion in
config readers (take place after all interpolations get ready), that allows to
specify typed parameters variable (as substitutions) as well as to supply it in
other sections or as init parameters. * `action.d/*-ipset*.conf`: several ipset
actions fixed (no timeout per default anymore), so no discrepancy between
ipset and fail2ban (removal from ipset will be managed by fail2ban only,
gh-2703) * `action.d/cloudflare.conf`: fixed `actionunban` (considering new-line
chars and optionally real json-parsing with `jq`, gh-2140, gh-2656) *
`action.d/nftables.conf` (type=multiport only): fixed port range selector,
replacing `:` with `-` (gh-2763) * `action.d/firewallcmd-*.conf` (multiport
only): fixed port range selector, replacing `:` with `-` (gh-2821) *
`action.d/bsd-ipfw.conf`: fixed selection of rule-no by large list or initial
`lowest_rule_num` (gh-2836) * `filter.d/common.conf`: avoid substitute of
default values in related `lt_*` section, `__prefix_line` should be
interpolated in definition section (inside the filter-config, gh-2650) *
`filter.d/dovecot.conf`: - add managesieve and submission support (gh-2795);
- accept messages with more verbose logging (gh-2573); * `filter.d/courier-
smtp.conf`: prefregex extended to consider port in log-message (gh-2697) *
`filter.d/traefik-auth.conf`: filter extended with parameter mode (`normal`,
`ddos`, `aggressive`) to handle the match of username differently (gh-2693):
- `normal`: matches 401 with supplied username only - `ddos`: matches 401
without supplied username only - `aggressive`: matches 401 and any variant
(with and without username) * `filter.d/sshd.conf`: normalizing of user pattern
in all RE's, allowing empty user (gh-2749) ### New Features and Enhancements *
fail2ban-regex: - speedup formatted output (bypass unneeded stats creation)
- extended with prefregex statistic - more informative output for
`datepattern` (e. g. set from filter) - pattern : description * parsing of
action in jail-configs considers space between action-names as separator also
(previously only new-line was allowed), for example `action = a b` would specify
2 actions `a` and `b` * new filter and jail for GitLab recognizing failed
application logins (gh-2689) * new filter and jail for Grafana recognizing
failed application logins (gh-2855) * new filter and jail for SoftEtherVPN
recognizing failed application logins (gh-2723) * `filter.d/guacamole.conf`
extended with `logging` parameter to follow webapp-logging if it's configured
(gh-2631) * `filter.d/bitwarden.conf` enhanced to support syslog (gh-2778) *
introduced new prefix `{UNB}` for `datepattern` to disable word boundaries in
regex; * datetemplate: improved anchor detection for capturing groups `(^...)`;
* datepattern: improved handling with wrong recognized timestamps (timezones, no
datepattern, etc) as well as some warnings signaling user about invalid
pattern or zone (gh-2814): - filter gets mode in-operation, which gets
activated if filter starts processing of new messages; in this mode a
timestamp read from log-line that appeared recently (not an old line), deviating
too much from now (up too 24h), will be considered as now (assuming a
timezone issue), so could avoid unexpected bypass of failure (previously
exceeding `findtime`); - better interaction with non-matching optional
datepattern or invalid timestamps; - implements special datepattern `{NONE}` -
allow to find failures totally without date-time in log messages, whereas
filter will use now as timestamp (gh-2802) * performance optimization of
`datepattern` (better search algorithm in datedetector, especially for single
template); * fail2ban-client: extended to unban IP range(s) by subnet
(CIDR/mask) or hostname (DNS), gh-2791; * extended capturing of alternate tags
in filter, allowing combine of multiple groups to single tuple token with new
tag prefix `<F-TUPLE_`, that would combine value of `<F-V>` with all value of
`<F-TUPLE_V?_n?>` tags (gh-2755)
--------------------------------------------------------------------------------
ChangeLog:
* Tue Nov 24 2020 Richard Shaw <hobbes1069(a)gmail.com> - 0.11.2-1
- Update to 0.11.2.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1901008 - fail2ban-0.11.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1901008
--------------------------------------------------------------------------------
================================================================================
java-latest-openjdk-15.0.1.9-2.rolling.el8 (FEDORA-EPEL-2020-a6a96a7957)
OpenJDK Runtime Environment 15
--------------------------------------------------------------------------------
Update Information:
Create a copy of java as alt-java with alternatives and man pages
--------------------------------------------------------------------------------
ChangeLog:
* Mon Nov 23 2020 Jiri Vanek <jvanek(a)redhat.com> - 1:15.0.1.9-2.rolling
- Create a copy of java as alt-java with alternatives and man pages
- java-11-openjdk doesn't have a JRE tree, so don't try and copy alt-java there...
--------------------------------------------------------------------------------
================================================================================
kea-1.8.0-2.el8 (FEDORA-EPEL-2020-ebbcaeafa2)
DHCPv4, DHCPv6 and DDNS server from ISC
--------------------------------------------------------------------------------
Update Information:
Added epel branch
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
================================================================================
python-f5-sdk-3.0.21-8.el8 (FEDORA-EPEL-2020-4942432f31)
F5 Networks Python SDK
--------------------------------------------------------------------------------
Update Information:
First EPEL 8 build
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
================================================================================
python-ratelimitingfilter-1.1-4.el8 (FEDORA-EPEL-2020-23819afa61)
A rate limiting filter for the Python logging system
--------------------------------------------------------------------------------
Update Information:
- Fix python glob RHBZ#1900528
--------------------------------------------------------------------------------
ChangeLog:
* Tue Nov 24 2020 Martin Kutlak <mkfedora(a)outlook.com> - 1.1-4
- Drop python2 from spec file
- Fix python3 glob
--------------------------------------------------------------------------------
================================================================================
retrace-server-1.22.4-1.el8 (FEDORA-EPEL-2020-2c54b2ea91)
Application for remote coredump analysis
--------------------------------------------------------------------------------
Update Information:
New upstream release 1.22.4 - Make retrace-server-reposync-faf work again -
Update list of Fedora versions shown on stats page: remove releases before 31
and Fedora 33 - Do not allocate pseudo-TTY for Podman container - Remove
intermediate Podman containers even after image build fails - Reformat manager
page to improve readability (dwysocha(a)redhat.com) - Rework display of finished,
running, and available tasks (dwysocha(a)redhat.com) - Update translations
--------------------------------------------------------------------------------
ChangeLog:
* Tue Nov 24 2020 Packit Service <user-cont-team+packit-service(a)redhat.com> - 1.22.4-1
- Release version 1.22.4-1 (Mat��j Grabovsk��)
- r-s-reposync-faf: Fix type errors (Mat��j Grabovsk��)
- fedora: Remove old releases before 31 (Mat��j Grabovsk��)
- fedora: Add Fedora 33 to version list (Mat��j Grabovsk��)
- Update translations (Jenkins Automation Server)
- retrace: Do not allocate pseudo-TTY for container (Mat��j Grabovsk��)
- retrace: Slight refactoring in Podman backend (Mat��j Grabovsk��)
- retrace: Remove intermediate Podman containers in build (Mat��j Grabovsk��)
- retrace: More precise argument type (Mat��j Grabovsk��)
- Update translations (Jenkins Automation Server)
- ftp/manager: Add link on manager page and create backlink on ftp page (Dave Wysochanski)
- managertask: Remove unnecessary whitespace at right of notes and backtrace (Dave Wysochanski)
- manager: Rework display of finished, running, and available tasks (Dave Wysochanski)
- manager: reformat manager page to improve readability (Dave Wysochanski)
--------------------------------------------------------------------------------
================================================================================
singularity-3.7.0-1.el8 (FEDORA-EPEL-2020-fc267134e0)
Application and environment virtualization
--------------------------------------------------------------------------------
Update Information:
Upgrade to upstream 3.7.0.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Nov 24 2020 Dave Dykstra <dwd(a)fedoraproject.org> - 3.7.0-1
- Upgrade to upstream 3.7.0.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1896572 - singularity-3.7.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1896572
--------------------------------------------------------------------------------