The following Fedora EPEL 7 Security updates need testing:
Age URL
13
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-3f4ec3ba2a
sympa-6.2.62-1.el7
13
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-23a46d718e
libopenmpt-0.5.8-1.el7
9
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-314d2feba2
chromium-90.0.4430.93-1.el7
9
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-80d45ac7ec
ansible-2.9.21-1.el7
6
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-680600d10f
python-impacket-0.9.22-3.el7
2
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-352a65d3bc
djvulibre-3.5.25.3-23.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
configsnap-0.20.1-1.el7
drbd-9.17.0-1.el7
knot-3.0.6-1.el7
libidn2-2.3.1-1.el7
prosody-0.11.9-1.el7
python-pefile-2021.5.13-1.el7
sec-2.9.0-1.el7
Details about builds:
================================================================================
configsnap-0.20.1-1.el7 (FEDORA-EPEL-2021-b5c3437e7e)
Record and compare system state
--------------------------------------------------------------------------------
Update Information:
Update python binary for python3 based distros ---- Port configsnap to python3
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 12 2021 Christos Triantafyllidis
<christos.triantafyllidis(a)rackspace.co.uk> - 0.20.1-1
- Update python binary for python3 based distros
* Fri May 7 2021 Nick Rhodes <nrhodes91(a)gmail.com> - 0.20.0-3
- Fix build issues in Koji
* Fri May 7 2021 Nick Rhodes <nrhodes91(a)gmail.com> - 0.20.0-1
- Port to python3 compatibility (PR 120)
--------------------------------------------------------------------------------
================================================================================
drbd-9.17.0-1.el7 (FEDORA-EPEL-2021-47f19d6ceb)
DRBD user-land tools and scripts
--------------------------------------------------------------------------------
Update Information:
Upstream release of 9.17.0
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 13 2021 Peter Hanecak <hany(a)hany.sk> - 9.17.0-1
- Upstream release of 9.17.0
- fixed permission for tmpfiles.d/drbd.conf
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1953557 - drbd-9.17.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1953557
--------------------------------------------------------------------------------
================================================================================
knot-3.0.6-1.el7 (FEDORA-EPEL-2021-0d059dc73f)
High-performance authoritative DNS server
--------------------------------------------------------------------------------
Update Information:
Update to upstream 3.0.6
--------------------------------------------------------------------------------
ChangeLog:
* Fri May 14 2021 Jakub Ru��i��ka <jakub.ruzicka(a)nic.cz> - 3.0.6-1
- Update to 3.0.6
--------------------------------------------------------------------------------
================================================================================
libidn2-2.3.1-1.el7 (FEDORA-EPEL-2021-5ef16bc4ca)
Library to support IDNA2008 internationalized domain names
--------------------------------------------------------------------------------
Update Information:
Libidn2 2.3.1 (released 2021-05-12) =================================== *
Implement full roundtrip for lookup functionality With TR64 enabled
(default), `������i` was converted to `xn-- o-oia59s`. The output contains an
illegal space and thus could not be decoded any more. * Fix domain too long
error * doc: `idn2.1` and `libidn2.texi` automatically get `idn2 --help`
output. * Updated gnulib files and various build fixes. In particular,
it no longer attempts to detect a host CC compiler.
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 12 2021 Robert Scheck <robert(a)fedoraproject.org> 2.3.1-1
- Upgrade to 2.3.1 (#1960005)
* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.3.0-5
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Tue Jul 28 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.3.0-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue May 26 2020 Jeff Law <law(a)redhat.com> - 2.3.0-3
- Touch a couple autoconf related files to prevent undesired rebuilding
if %configure changes one or more configure files.
* Wed Jan 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.3.0-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1960005 - libidn2-2.3.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1960005
--------------------------------------------------------------------------------
================================================================================
prosody-0.11.9-1.el7 (FEDORA-EPEL-2021-c44d955770)
Flexible communications server for Jabber/XMPP
--------------------------------------------------------------------------------
Update Information:
Prosody 0.11.9 ============== This release addresses a number of important
security issues that affect most deployments of Prosody. Full details are
available in a separate security advisory. Upstream recommends that all
deployments upgrade or apply the mitigations described in the advisory:
https://prosody.im/security/advisory_20210512/ Note: Upstream updated the
default config file. YUM or RPM will create a
`/etc/prosody/prosody.cfg.lua.rpmnew` file, so make sure you update your
existing `/etc/prosody/prosody.cfg.lua` to enable mod_limits after the upgrade.
Security -------- * mod_limits, prosody.cfg.lua: Enable rate limits by
default * certmanager: Disable renegotiation by default * mod_proxy65:
Restrict access to local c2s connections by default * util.startup: Set more
aggressive defaults for GC * mod_c2s, mod_s2s, mod_component, mod_bosh,
mod_websockets: Set default stanza size limits *
mod_auth_internal_{plain,hashed}: Use constant-time string comparison for
secrets * mod_dialback: Remove dialback-without-dialback feature *
mod_dialback: Use constant-time comparison with hmac Minor changes
------------- * util.hashes: Add constant-time string comparison (binding to
`CRYPTO_memcmp`) * mod_c2s: Don���t throw errors in async code when connections
are gone * mod_c2s: Fix traceback in session close when conn is nil *
core.certmanager: Improve detection of LuaSec/OpenSSL capabilities *
mod_saslauth: Use a defined SASL error * MUC: Add support for advertising
muc#roomconfig_allowinvites in room disco#info * mod_saslauth: Don���t throw
errors in async code when connections are gone * mod_pep: Advertise base
pubsub feature (fixes #1632: mod_pep missing pubsub feature in disco) *
prosodyctl check config: Add `gc` to list of global options * prosodyctl
about: Report libexpat version if known * util.xmppstream: Add API to
dynamically configure the stanza size limit for a stream * util.set: Add
`is_set()` to test if an object is a set * mod_http: Skip IP resolution in
non-proxied case * mod_c2s: Log about missing conn on async state changes *
util.xmppstream: Reduce internal default xmppstream limit to 1MB
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 13 2021 Robert Scheck <robert(a)fedoraproject.org> 0.11.9-1
- Upgrade to 0.11.9 (#1960244, #1960332, #1960335, #1960340,
* Fri Apr 30 2021 Robert Scheck <robert(a)fedoraproject.org> 0.11.8-4
- Added upstream patch to avoid '-Wl,--as-needed' removing linking
to libpthread when building with current libicu (#1954178)
* Tue Mar 2 2021 Zbigniew J��drzejewski-Szmek <zbyszek(a)in.waw.pl> - 0.11.8-3
- Rebuilt for updated systemd-rpm-macros
See
https://pagure.io/fesco/issue/2583.
* Fri Feb 26 2021 Robert Scheck <robert(a)fedoraproject.org> 0.11.8-2
- Added upstream patch to unbreak Lua 5.4 support (#1933063)
- Added %check to run some common commands (as a small testsuite)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1960332 - CVE-2021-32917 prosody: use of mod_proxy65 is unrestricted in
default configuration
https://bugzilla.redhat.com/show_bug.cgi?id=1960332
[ 2 ] Bug #1960335 - CVE-2021-32918 prosody: DoS via insufficient memory consumption
controls
https://bugzilla.redhat.com/show_bug.cgi?id=1960335
[ 3 ] Bug #1960340 - CVE-2021-32919 prosody: undocumented dialback-without-dialback
option insecure
https://bugzilla.redhat.com/show_bug.cgi?id=1960340
[ 4 ] Bug #1960343 - CVE-2021-32920 prosody: DoS via repeated TLS renegotiation causing
excessive CPU consumption
https://bugzilla.redhat.com/show_bug.cgi?id=1960343
[ 5 ] Bug #1960349 - CVE-2021-32921 prosody: use of timing-dependent string comparison
with sensitive values
https://bugzilla.redhat.com/show_bug.cgi?id=1960349
--------------------------------------------------------------------------------
================================================================================
python-pefile-2021.5.13-1.el7 (FEDORA-EPEL-2021-65ec199e6d)
Python module for working with Portable Executable files
--------------------------------------------------------------------------------
Update Information:
bump to version 2021.5.13
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1960414 - python-pefile-2021.5.13 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1960414
--------------------------------------------------------------------------------
================================================================================
sec-2.9.0-1.el7 (FEDORA-EPEL-2021-50f7bdb3cf)
Simple Event Correlator script to filter log file entries
--------------------------------------------------------------------------------
Update Information:
New upstream release
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 13 2021 Stefan Schulze Frielinghaus <stefansf(a)fedoraproject.org> -
2.9.0-1
- New upstream release
--------------------------------------------------------------------------------