The following Fedora EPEL 7 Security updates need testing:
Age URL
631
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-3c9292b62d
condor-8.6.11-1.el7
373
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-c499781e80
python-gnupg-0.4.4-1.el7
371
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-bc0182548b
bubblewrap-0.3.3-2.el7
80
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-fa8a2e97c6
python-waitress-1.4.3-1.el7
20
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-19d171a465
python34-3.4.10-5.el7
12
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-324f1b735d
chromium-81.0.4044.122-1.el7
12
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-c4860b563d
openvpn-2.4.9-1.el7
8
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-320cd2c3b5
java-latest-openjdk-14.0.1.7-2.rolling.el7
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-12ba1ceddb
wordpress-5.1.5-1.el7
2
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-76347da426
seamonkey-2.53.2-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
bcftools-1.9-3.el7
composer-1.10.6-1.el7
drraw-2.2-0.22.b2.el7
nx-libs-3.5.99.23-1.el7
pure-ftpd-1.0.47-4.el7
python-collada-0.6-2.el7
python-fasteners-0.9.0-3.el7
viewvc-1.1.28-1.el7
Details about builds:
================================================================================
bcftools-1.9-3.el7 (FEDORA-EPEL-2020-f7b02980b0)
Tools for genomic variant calling and manipulating VCF/BCF files
--------------------------------------------------------------------------------
Update Information:
Initial package.
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1774741 - Review Request: bcftools - Tools for genomic variant calling and
manipulating VCF/BCF files
https://bugzilla.redhat.com/show_bug.cgi?id=1774741
--------------------------------------------------------------------------------
================================================================================
composer-1.10.6-1.el7 (FEDORA-EPEL-2020-e2a446f497)
Dependency Manager for PHP
--------------------------------------------------------------------------------
Update Information:
**Version 1.10.6** - 2020-05-06 * Fixed version guessing to take composer-
runtime-api and composer-plugin-api requirements into account to avoid selecting
packages which require Composer 2 * Fixed package name validation to allow
several dashes following each other * Fixed post-status-cmd script not firing
when there were no changes to be displayed * Fixed composer-runtime-api
support on Composer 1.x, the package is now present as 1.0.0 * Fixed support
for composer show --name-only --self * Fixed detection of GitLab URLs when
handling authentication in some cases
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 6 2020 Remi Collet <remi(a)remirepo.net> - 1.10.6-1
- update to 1.10.6
- provide php-composer(composer-runtime-api)
--------------------------------------------------------------------------------
================================================================================
drraw-2.2-0.22.b2.el7 (FEDORA-EPEL-2020-59cf8b2c42)
Web based presentation front-end for RRDtool
--------------------------------------------------------------------------------
Update Information:
First EPEL 7 build.
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
================================================================================
nx-libs-3.5.99.23-1.el7 (FEDORA-EPEL-2020-907fcc3b1e)
NX X11 protocol compression libraries
--------------------------------------------------------------------------------
Update Information:
Update to 3.5.99.23
--------------------------------------------------------------------------------
ChangeLog:
* Sat Feb 1 2020 Orion Poplawski <orion(a)nwra.com> - 3.5.99.23-1
- Update to 3.5.99.23
* Wed Jan 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> -
3.5.99.22-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Mon Dec 16 2019 Orion Poplawski <orion(a)nwra.com> - 3.5.99.22-1
- Update to 3.5.99.22
* Thu Aug 15 2019 Orion Poplawski <orion(a)nwra.com> - 3.5.99.21-2
- BR libXfont2 on Fedora and RHEL 8+
* Thu Aug 15 2019 Orion Poplawski <orion(a)nwra.com> - 3.5.99.21-1
- Update to 3.5.99.21
* Thu Jul 25 2019 Fedora Release Engineering <releng(a)fedoraproject.org> -
3.5.99.20-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Sun Apr 28 2019 Orion Poplawski <orion(a)nwra.com> - 3.5.99.20-1
- Update to 3.5.99.20
* Fri Feb 1 2019 Fedora Release Engineering <releng(a)fedoraproject.org> -
3.5.99.17-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
pure-ftpd-1.0.47-4.el7 (FEDORA-EPEL-2020-c9c5ded31b)
Lightweight, fast and secure FTP server
--------------------------------------------------------------------------------
Update Information:
Fix CVE-2020-9365 and CVE-2020-9274
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 6 2020 Ond��ej Lyson��k <olysonek(a)redhat.com> - 1.0.47-4
- Fix CVE-2020-9365 and CVE-2020-9274
- Resolves: rhbz#1828689
- Resolves: rhbz#1831060
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1828687 - CVE-2020-9365 pure-ftpd: OOB read in pure_strcmp function in
utils.c
https://bugzilla.redhat.com/show_bug.cgi?id=1828687
[ 2 ] Bug #1831058 - CVE-2020-9274 pure-ftpd: uninitialized pointer in the diraliases
linked list leads to denial of service or information disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1831058
--------------------------------------------------------------------------------
================================================================================
python-collada-0.6-2.el7 (FEDORA-EPEL-2020-46bc32828d)
A python module for creating, editing and loading COLLADA
--------------------------------------------------------------------------------
Update Information:
Rebuild for EPEL 7.
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 6 2020 Orion Poplawski <orion(a)nwra.com> - 0.6-2
- Cleanup spec and rebuild to fix dependencies
* Mon Apr 8 2019 Richard Shaw <hobbes1069(a)gmail.com> - 0.6-1
- Update to 0.6.
--------------------------------------------------------------------------------
================================================================================
python-fasteners-0.9.0-3.el7 (FEDORA-EPEL-2020-995610dbd1)
A python package that provides useful locks
--------------------------------------------------------------------------------
Update Information:
add Python 3 subpackage
--------------------------------------------------------------------------------
ChangeLog:
* Mon Apr 13 2020 Felix Schwarz <fschwarz(a)fedoraproject.org> - 0.9.0-3
- add Python 3 subpackage
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1823122 - python-fasteners: Provide python3 packages in EPEL 7
https://bugzilla.redhat.com/show_bug.cgi?id=1823122
--------------------------------------------------------------------------------
================================================================================
viewvc-1.1.28-1.el7 (FEDORA-EPEL-2020-ec788c8a86)
Browser interface for CVS and SVN version control repositories
--------------------------------------------------------------------------------
Update Information:
Fix for CVE-2020-5283. ViewVC 1.1.28 ChangeLog - security fix: escape subdir
lastmod file name (#211) - fix standalone.py first request failure (#195)
ViewVC 1.1.27 ChangeLog: - suppress stack traces (with option to show) (#140)
- distinguish text/binary/image files by icons (#166, #175) - colorize
alternating file content lines (#167) - link to the instance root from the
ViewVC logo (#168) - display directory and root counts, too (#169) - fix double
fault error in standalone.py (#157) - support timezone offsets with minutes
piece (#176)
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 6 2020 Bojan Smojver <bojan(a)rexursive.com> - 1.1.28-1
- bump up to 1.1.28
- CVE-2020-5283
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1831804 - CVE-2020-5283 viewvc: XSS vulnerability in CVS show_subdir_lastmod
support [fedora-30]
https://bugzilla.redhat.com/show_bug.cgi?id=1831804
[ 2 ] Bug #1831805 - CVE-2020-5283 viewvc: XSS vulnerability in CVS show_subdir_lastmod
support [epel-6]
https://bugzilla.redhat.com/show_bug.cgi?id=1831805
[ 3 ] Bug #1831806 - CVE-2020-5283 viewvc: XSS vulnerability in CVS show_subdir_lastmod
support [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1831806
--------------------------------------------------------------------------------