Hi all,
A heads-up that I'm preparing a rebase of Fish in EPEL 9 to address this
CVE
https://bugzilla.redhat.com/show_bug.cgi?id=2253972
> Code execution does not appear to be possible, but denial of service (through large brace expansion) or information disclosure (such as variable expansion) is potentially possible under certain circumstances
It's not a high severity, and there are several very minor behavioral
changes in every 3.Y.0 minor releases since 3.3.1, so I figure I'll play
it safe and treat it as an incompatible update and flag it to this list
first.
Best regards,
--
_o) Michel Lind
_( ) identities: https://keyoxide.org/5dce2e7e9c3b1cffd335c1d78b229d2f7ccc04f2
README: https://fedoraproject.org/wiki/User:Salimma#README
The following Fedora EPEL 9 Security updates need testing:
Age URL
7 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-e9dcb51f6d uriparser-0.9.8-2.el9
4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-46a02bfa95 suricata-7.0.10-1.el9
2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-ff88bfea14 exim-4.98.2-1.el9
1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-03946aa814 yarnpkg-1.22.22-7.el9
1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-0aeac9995d upx-5.0.0-1.el9
The following builds have been pushed to Fedora EPEL 9 updates-testing
baresip-3.21.0-1.el9
c-icap-0.6.3-2.el9
libre-3.21.0-1.el9
perl-Data-Entropy-0.008-1.el9
python-apprise-1.9.3-1.el9
rust-sha256-1.6.0-1.el9
Details about builds:
================================================================================
baresip-3.21.0-1.el9 (FEDORA-EPEL-2025-77ab6e9243)
Modular SIP user-agent with audio and video support
--------------------------------------------------------------------------------
Update Information:
Baresip v3.21.0 (2025-03-26)
call: use call_find_replaces for finding call to replace
contact commands
menu: return on UA_EVENT_SIPSESS_CONN
recalculate jbuf number of frame after reuse packet
pulse: add NULL checks for paconn_get
menu: remove CMD_PRM flag from hangup command
portaudio: fixed inconsistency between the device specification in audio_source
and via /ausrc
aufile: return 0 instead of err
aureceiver: cleanup rtpext_find is moved to re
stream,rtprecv: add rtprecv_set_srate
call: fix cppcheck warning
bump version to 3.21.0
libre v3.21.0 (2025-03-26)
fmt/pl: add pl_strncasecmp and tests
ci: upgrade run-on-arch-action to fix random segfaults
test: add testing of RTCP FIR-RFC5104
rtpext: add rtpext_find
rtp: add rtp_ prefix to member functions
rtp/rtcp: add rtcp_send_twcc and rtcp_rtpfb_twcc_encode
list: optimize list_count
bump version to 3.21.0
--------------------------------------------------------------------------------
ChangeLog:
* Sun Mar 30 2025 Robert Scheck <robert(a)fedoraproject.org> 3.21.0-1
- Upgrade to 3.21.0 (#2355005)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2355005 - baresip-3.21.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2355005
[ 2 ] Bug #2355014 - libre-3.21.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2355014
--------------------------------------------------------------------------------
================================================================================
c-icap-0.6.3-2.el9 (FEDORA-EPEL-2025-6716c61a2d)
An implementation of an ICAP server
--------------------------------------------------------------------------------
Update Information:
Upgrade to 0.6.3 release.
--------------------------------------------------------------------------------
ChangeLog:
* Sun Mar 30 2025 Frank Crawford <frank(a)crawford.emu.id.au> - 0.6.3-2
- Add sysusers.d config as a source file for F42 and above.
* Mon Mar 24 2025 Frank Crawford <frank(a)crawford.emu.id.au> - 0.6.3-1
- Update to 0.6.3 release.
* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek(a)in.waw.pl> - 0.6.2-4
- Add sysusers.d config file to allow rpm to create users/groups automatically
* Sun Jan 26 2025 Frank Crawford <frank(a)crawford.emu.id.au> - 0.6.2-4
- Patch for GCC15 issues - BZ2339953.
- Remove mv due to unify /usr/bin and /usr/sbin
* Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.6.2-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Wed Jul 17 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.6.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
libre-3.21.0-1.el9 (FEDORA-EPEL-2025-77ab6e9243)
Generic library for real-time communications
--------------------------------------------------------------------------------
Update Information:
Baresip v3.21.0 (2025-03-26)
call: use call_find_replaces for finding call to replace
contact commands
menu: return on UA_EVENT_SIPSESS_CONN
recalculate jbuf number of frame after reuse packet
pulse: add NULL checks for paconn_get
menu: remove CMD_PRM flag from hangup command
portaudio: fixed inconsistency between the device specification in audio_source
and via /ausrc
aufile: return 0 instead of err
aureceiver: cleanup rtpext_find is moved to re
stream,rtprecv: add rtprecv_set_srate
call: fix cppcheck warning
bump version to 3.21.0
libre v3.21.0 (2025-03-26)
fmt/pl: add pl_strncasecmp and tests
ci: upgrade run-on-arch-action to fix random segfaults
test: add testing of RTCP FIR-RFC5104
rtpext: add rtpext_find
rtp: add rtp_ prefix to member functions
rtp/rtcp: add rtcp_send_twcc and rtcp_rtpfb_twcc_encode
list: optimize list_count
bump version to 3.21.0
--------------------------------------------------------------------------------
ChangeLog:
* Sun Mar 30 2025 Robert Scheck <robert(a)fedoraproject.org> 3.21.0-1
- Upgrade to 3.21.0 (#2355014)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2355005 - baresip-3.21.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2355005
[ 2 ] Bug #2355014 - libre-3.21.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2355014
--------------------------------------------------------------------------------
================================================================================
perl-Data-Entropy-0.008-1.el9 (FEDORA-EPEL-2025-3ea9a27f9b)
Entropy (randomness) management
--------------------------------------------------------------------------------
Update Information:
Prior to version 0.008, the Perl module Data::Entropy relied on Perl's builtin
rand function to choose an entropy source. Version 0.008 does away with this
need.
--------------------------------------------------------------------------------
ChangeLog:
* Sun Mar 30 2025 Emmanuel Seyman <emmanuel(a)seyman.fr> - 0.008-1
- Update to 0.008, with new maintainer (#2355612)
* Sat Jan 18 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.007-27
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Mon Aug 5 2024 Miroslav Suchý <msuchy(a)redhat.com> - 0.007-26
- convert license to SPDX
* Thu Jul 18 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.007-25
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Thu Jan 25 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.007-24
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Sun Jan 21 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.007-23
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Thu Jul 20 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.007-22
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2355612 - perl-Data-Entropy-0.008 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2355612
[ 2 ] Bug #2355706 - CVE-2025-1860 perl-Data-Entropy: Data::Entropy for Perl uses insecure rand() function for cryptographic functions [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2355706
[ 3 ] Bug #2355707 - CVE-2025-1860 perl-Data-Entropy: Data::Entropy for Perl uses insecure rand() function for cryptographic functions [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2355707
[ 4 ] Bug #2355708 - CVE-2025-1860 perl-Data-Entropy: Data::Entropy for Perl uses insecure rand() function for cryptographic functions [fedora-40]
https://bugzilla.redhat.com/show_bug.cgi?id=2355708
[ 5 ] Bug #2355709 - CVE-2025-1860 perl-Data-Entropy: Data::Entropy for Perl uses insecure rand() function for cryptographic functions [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2355709
--------------------------------------------------------------------------------
================================================================================
python-apprise-1.9.3-1.el9 (FEDORA-EPEL-2025-938df7f832)
A simple wrapper to many popular notification services used today
--------------------------------------------------------------------------------
Update Information:
Updated to v1.9.3
--------------------------------------------------------------------------------
ChangeLog:
* Sun Mar 30 2025 Chris Caron <lead2gold(a)gmail.com> - 1.9.3
- Updated to v1.9.3
* Sat Jan 18 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.9.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Wed Jan 8 2025 Chris Caron <lead2gold(a)gmail.com> - 1.9.2
- Updated to v1.9.2
--------------------------------------------------------------------------------
================================================================================
rust-sha256-1.6.0-1.el9 (FEDORA-EPEL-2025-ab88cc1d47)
SHA256 crypto digest
--------------------------------------------------------------------------------
Update Information:
Move modules to own files
separate modules
fix char type
--------------------------------------------------------------------------------
ChangeLog:
* Fri Mar 28 2025 Michel Lind <salimma(a)fedoraproject.org> - 1.6.0-1
- Update to 1.6.0; Fixes: RHBZ#2349264
* Sun Jan 19 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.5.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Sat Jul 20 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.5.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Sat Jan 27 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.5.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2349264 - rust-sha256-1.6.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2349264
--------------------------------------------------------------------------------
The following builds have been pushed to Fedora EPEL 10.0 updates-testing
fish-4.0.1-2.el10_0
kiwi-10.2.16-3.el10_0
Details about builds:
================================================================================
fish-4.0.1-2.el10_0 (FEDORA-EPEL-2025-1831e25756)
Friendly interactive shell
--------------------------------------------------------------------------------
Update Information:
Rebase fish to v4.x
--------------------------------------------------------------------------------
ChangeLog:
* Fri Mar 21 2025 Benjamin A. Beasley <code(a)musicinmybrain.net> - 4.0.1-2
- Update lru to 0.13.0 (proposed upstream)
* Wed Mar 19 2025 Neal Gompa <ngompa(a)fedoraproject.org> - 4.0.1-1
- Update to 4.0.1 upstream release
* Thu Feb 27 2025 Neal Gompa <ngompa(a)fedoraproject.org> - 4.0.0-3
- Disable building on 32-bit architectures
* Thu Feb 27 2025 Neal Gompa <ngompa(a)fedoraproject.org> - 4.0.0-2
- Fix bundled js dep provides
* Thu Feb 27 2025 Neal Gompa <ngompa(a)fedoraproject.org> - 4.0.0-1
- Rebase to new upstream release 4.0.0
* Thu Jan 16 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.7.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
kiwi-10.2.16-3.el10_0 (FEDORA-EPEL-2025-6dd9aa9ea8)
Flexible operating system image builder
--------------------------------------------------------------------------------
Update Information:
Add patch to allow C locale in images
--------------------------------------------------------------------------------
ChangeLog:
* Sat Mar 29 2025 Neal Gompa <ngompa(a)fedoraproject.org> - 10.2.16-3
- Add patch to allow the C locale in images
--------------------------------------------------------------------------------
The following builds have been pushed to Fedora EPEL 10.0 updates-testing
python-copr-2.1-1.el10_0
rust-image-0.25.5-3.el10_0
rust-once_cell-1.21.3-1.el10_0
rust-ring-0.17.14-1.el10_0
voms-2.1.2-1.el10_0
Details about builds:
================================================================================
python-copr-2.1-1.el10_0 (FEDORA-EPEL-2025-f3439dd832)
Python interface for Copr
--------------------------------------------------------------------------------
Update Information:
copr release March 2025
--------------------------------------------------------------------------------
ChangeLog:
* Tue Mar 25 2025 Pavel Raiskup <praiskup(a)redhat.com> 2.1-1
- doc: remove a non existent parameter from docstring
- drop six dependency
--------------------------------------------------------------------------------
================================================================================
rust-image-0.25.5-3.el10_0 (FEDORA-EPEL-2025-ab8f77ecd2)
Imaging library
--------------------------------------------------------------------------------
Update Information:
Enable AVIF support via dav1d (RPM metadata only change).
--------------------------------------------------------------------------------
ChangeLog:
* Thu Mar 27 2025 Fabio Valentini <decathorpe(a)gmail.com> - 0.25.5-3
- Enable the avif-native feature
* Sun Jan 19 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.25.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
rust-once_cell-1.21.3-1.el10_0 (FEDORA-EPEL-2025-d4b383d7bb)
Single assignment cells and lazy values
--------------------------------------------------------------------------------
Update Information:
Update to version 1.21.3.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Mar 28 2025 Fabio Valentini <decathorpe(a)gmail.com> - 1.21.3-1
- Update to version 1.21.3; Fixes RHBZ#2352430
--------------------------------------------------------------------------------
================================================================================
rust-ring-0.17.14-1.el10_0 (FEDORA-EPEL-2025-f54eda0d3e)
Safe, fast, small crypto using Rust
--------------------------------------------------------------------------------
Update Information:
Update to version 0.17.14.
This also includes a fix for RUSTSEC-2025-0009, though no Fedora package should
be affected by it.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Mar 27 2025 Fabio Valentini <decathorpe(a)gmail.com> - 0.17.14-1
- Update to version 0.17.14; Fixes RHBZ#2345670
* Thu Mar 27 2025 Fabio Valentini <decathorpe(a)gmail.com> - 0.17.13-1
- Update to version 0.17.13
* Thu Mar 27 2025 Fabio Valentini <decathorpe(a)gmail.com> - 0.17.12-1
- Update to version 0.17.12
* Thu Mar 27 2025 Fabio Valentini <decathorpe(a)gmail.com> - 0.17.11-1
- Update to version 0.17.11
* Thu Mar 27 2025 Fabio Valentini <decathorpe(a)gmail.com> - 0.17.10-1
- Update to version 0.17.10
* Thu Mar 27 2025 Fabio Valentini <decathorpe(a)gmail.com> - 0.17.9-1
- Update to version 0.17.9
* Tue Feb 25 2025 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.17.8-7
- Fix accidental duplicated sections in rust2rpm.toml
* Mon Feb 17 2025 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.17.8-6
- Fix missing Perl scripts for generating assembly code on aarch64
* Mon Feb 17 2025 Benjamin A. Beasley <code(a)musicinmybrain.net> - 0.17.8-5
- Never use pre-generated object files from upstream
* Sun Jan 19 2025 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.17.8-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
voms-2.1.2-1.el10_0 (FEDORA-EPEL-2025-1ed2323e59)
Virtual Organization Membership Service
--------------------------------------------------------------------------------
Update Information:
VOMS 2.1.2
--------------------------------------------------------------------------------
ChangeLog:
* Thu Mar 27 2025 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 2.1.2-1
- Update to version 2.1.2
- Drop patch accepted upstream
* Sat Mar 8 2025 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 2.1.0-5
- Move user/group creation logic to sysusers.d fragment
* Sun Jan 19 2025 Mattias Ellert <mattias.ellert(a)physics.uu.se> - 2.1.0-4
- Fix compilation with GCC 15
--------------------------------------------------------------------------------