The following Fedora EPEL 9 Security updates need testing:
Age URL
6
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-684f77a897
podman-tui-1.0.0-1.el9
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-5d9511ad6e
prometheus-podman-exporter-1.11.0-1.el9
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-3e437ee2d0
pandoc-2.14.0.3-17.el9 patat-0.8.7.0-4.el9
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-1e7f709e59
suricata-6.0.17-1.el9
1
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-5e764f8789
opensmtpd-7.4.0p1-1.el9
The following builds have been pushed to Fedora EPEL 9 updates-testing
chromium-123.0.6312.58-1.el9
netdata-1.45.1-1.el9
python-damo-2.2.7-1.el9
redict-7.3.0~rc1-1.el9
sbsigntools-0.9.5-3.el9
tinyxml-2.6.2-28.el9
Details about builds:
================================================================================
chromium-123.0.6312.58-1.el9 (FEDORA-EPEL-2024-24aceec24b)
A WebKit (Blink) powered web browser that Google doesn't want you to use
--------------------------------------------------------------------------------
Update Information:
Update to 123.0.6312.58
* High CVE-2024-2625: Object lifecycle issue in V8
* Medium CVE-2024-2626: Out of bounds read in Swiftshader
* Medium CVE-2024-2627: Use after free in Canvas
* Medium CVE-2024-2628: Inappropriate implementation in Downloads
* Medium CVE-2024-2629: Incorrect security UI in iOS
* Medium CVE-2024-2630: Inappropriate implementation in iOS
* Low CVE-2024-2631: Inappropriate implementation in iOS
--------------------------------------------------------------------------------
ChangeLog:
* Wed Mar 20 2024 Than Ngo <than(a)redhat.com> - 123.0.6312.58-1
- update to 123.0.6312.58
* High CVE-2024-2625: Object lifecycle issue in V8
* Medium CVE-2024-2626: Out of bounds read in Swiftshader
* Medium CVE-2024-2627: Use after free in Canvas
* Medium CVE-2024-2628: Inappropriate implementation in Downloads
* Medium CVE-2024-2629: Incorrect security UI in iOS
* Medium CVE-2024-2630: Inappropriate implementation in iOS
* Low CVE-2024-2631: Inappropriate implementation in iOS
* Fri Mar 15 2024 Than Ngo <than(a)redhat.com> - 123.0.6312.46-1
- update to 123.0.6312.46
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2269307 - CVE-2024-2400 chromium: chromium-browser: Use after free in
Performance Manager [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2269307
[ 2 ] Bug #2270390 - CVE-2024-2626 CVE-2024-2627 CVE-2024-2628 CVE-2024-2629
CVE-2024-2630 CVE-2024-2631 chromium: various flaws [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2270390
[ 3 ] Bug #2270392 - CVE-2024-2625 chromium: chromium-browser: Object lifecycle issue in
V8 [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2270392
--------------------------------------------------------------------------------
================================================================================
netdata-1.45.1-1.el9 (FEDORA-EPEL-2024-99d0280e19)
Real-time performance monitoring
--------------------------------------------------------------------------------
Update Information:
Update from upstream
--------------------------------------------------------------------------------
ChangeLog:
* Wed Mar 27 2024 Didier Fabert <didier.fabert(a)gmail.com> 1.45.1-1
- Update from upstream
* Thu Mar 21 2024 Didier Fabert <didier.fabert(a)gmail.com> 1.45.0-1
- Update from upstream
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2270902 - netdata-1.45.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2270902
--------------------------------------------------------------------------------
================================================================================
python-damo-2.2.7-1.el9 (FEDORA-EPEL-2024-987d9aa9f1)
Data Access Monitoring Operator
--------------------------------------------------------------------------------
Update Information:
v2.2.7
Support region box right-side aligning (--region_box_align) of 'damo show'
Cleanup code
v2.2.6
Cleanup code
--------------------------------------------------------------------------------
ChangeLog:
* Tue Mar 26 2024 Packit <hello(a)packit.dev> - 2.2.7-1
- Update to 2.2.7
- Resolves rhbz#2271542
* Tue Mar 19 2024 Packit <hello(a)packit.dev> - 2.2.6-1
- Update to 2.2.6
- Resolves rhbz#2270231
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2271542 - python-damo-2.2.7 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2271542
--------------------------------------------------------------------------------
================================================================================
redict-7.3.0~rc1-1.el9 (FEDORA-EPEL-2024-5e3399739d)
A persistent key-value database
--------------------------------------------------------------------------------
Update Information:
initial package build
--------------------------------------------------------------------------------
ChangeLog:
* Sun Mar 24 2024 Jonathan Wright <jonathan(a)almalinux.org> - 7.3.0~rc1-1
- Initial package build, release candidate
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2271615 - Review Request: redict - A persistent key-value database
https://bugzilla.redhat.com/show_bug.cgi?id=2271615
--------------------------------------------------------------------------------
================================================================================
sbsigntools-0.9.5-3.el9 (FEDORA-EPEL-2024-9970c00ca4)
Signing utility for UEFI secure boot
--------------------------------------------------------------------------------
Update Information:
Signing utility for UEFI secure boot
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jan 27 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.9.5-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Sat Jul 22 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.9.5-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Fri May 5 2023 Dominik Mierzejewski <dominik(a)greysector.net> - 0.9.5-1
- update to 0.9.5 (#2179697)
- drop obsolete patches
* Sat Jan 21 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.9.4-11
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Tue Jan 17 2023 Dominik Mierzejewski <dominik(a)greysector.net> - 0.9.4-10
- fix build with GCC 13
* Sat Jul 23 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.9.4-9
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2271896 - Please branch and build sbsigntools in epel9
https://bugzilla.redhat.com/show_bug.cgi?id=2271896
--------------------------------------------------------------------------------
================================================================================
tinyxml-2.6.2-28.el9 (FEDORA-EPEL-2024-e2cad98fb0)
A simple, small, C++ XML parser
--------------------------------------------------------------------------------
Update Information:
Security fixes for CVE-2021-42260, CVE-2023-34194 and its duplicate
CVE-2023-40462.
Fix incorrect text element encoding (upstream isssue #51).
Enable tests.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 3 2024 Dominik Mierzejewski <dominik(a)greysector.net> - 2.6.2-28
- apply Debian patch to fix CVE-2021-42260 (rhbz#2253716, rhbz#2253718)
- apply Debian patch to fix CVE-2023-34194 and its duplicate, CVE-2023-40462
(rhbz#2254376, rhbz#2254381)
- fix incorrect text element encoding (upstream isssue #51)
- compile and run tests
* Sat Jul 22 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-27
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Sat Jan 21 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-26
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Sat Jul 23 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-25
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Sat Jan 22 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.6.2-24
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2253717 - CVE-2021-42260 tinyxml: infinite loop causes crash [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2253717
[ 2 ] Bug #2254380 - TRIAGE CVE-2023-34194 tinyxml: reachable assertion may lead to
denial of service [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2254380
--------------------------------------------------------------------------------