The following Fedora EPEL 6 Security updates need testing:
Age URL
87
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-b7556983e8
tomcat-7.0.92-1.el6
11
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-06b243cced
guacamole-server-1.0.0-1.el6
The following builds have been pushed to Fedora EPEL 6 updates-testing
R-3.5.3-1.el6
fedfind-4.2.2-1.el6
holland-1.1.13-1.el6
nagios-plugins-2.2.1-15.20180725git3429dad.el6
python-productmd-1.20-1.el6
tcpreplay-4.3.1-3.el6
Details about builds:
================================================================================
R-3.5.3-1.el6 (FEDORA-EPEL-2019-5938ab715a)
A language for data analysis and graphics
--------------------------------------------------------------------------------
Update Information:
Update R to 3.5.3, rkward and rpy rebuild to reflect new R.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 11 2019 Tom Callaway <spot(a)fedoraproject.org> - 3.5.3-1
- update to 3.5.3
* Sun Feb 17 2019 Igor Gnatenko <ignatenkobrain(a)fedoraproject.org> - 3.5.2-5
- Rebuild for readline 8.0
* Thu Jan 31 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.5.2-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Wed Jan 23 2019 Pete Walter <pwalter(a)fedoraproject.org> - 3.5.2-3
- Rebuild for ICU 63
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1687337 - R-3.5.3 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1687337
--------------------------------------------------------------------------------
================================================================================
fedfind-4.2.2-1.el6 (FEDORA-EPEL-2019-91ddb5937b)
Fedora compose and image finder
--------------------------------------------------------------------------------
Update Information:
Sync image types and formats and bring in new ones. Also includes a fedfind
build that works correctly with the changes to productmd.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Mar 8 2019 Adam Williamson <awilliam(a)redhat.com> - 4.2.2-1
- New release 4.2.2: work correctly with productmd 1.20
* Thu Jan 31 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.2.1-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Thu Nov 22 2018 Adam Williamson <awilliam(a)redhat.com> - 4.2.1-1
- New release 4.2.1: make test suite work without Python 2
- Disable Python 2 build on F30+, EL8+
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.2.0-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Tue Jun 19 2018 Miro Hron��ok <mhroncok(a)redhat.com> - 4.2.0-2
- Rebuilt for Python 3.7
--------------------------------------------------------------------------------
================================================================================
holland-1.1.13-1.el6 (FEDORA-EPEL-2019-f69c46a276)
Pluggable Backup Framework
--------------------------------------------------------------------------------
Update Information:
- Latest upstream
--------------------------------------------------------------------------------
ChangeLog:
* Tue Mar 12 2019 Carl George <carl(a)george.computer> - 1.1.13-1
- Latest upstream
* Mon Feb 18 2019 Carl George <carl(a)george.computer> - 1.1.12-1
- Latest upstream
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1685294 - holland-1.1.13 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1685294
--------------------------------------------------------------------------------
================================================================================
nagios-plugins-2.2.1-15.20180725git3429dad.el6 (FEDORA-EPEL-2019-7bf33722b6)
Host/service/network monitoring program plugins for Nagios
--------------------------------------------------------------------------------
Update Information:
Backport proxy prefix to check_smtp. ---- Update to latest git and fix release
string to match ---- Fix mysql patch problem with <f26 ---- Fix mysql patch
problem with <f26
--------------------------------------------------------------------------------
ChangeLog:
* Tue Mar 12 2019 Patrick Uiterwijk <puiterwijk(a)redhat.com> -
2.2.1-15.20180725git3429dad
- Update requirement for ps to procps
- Fix check_smtp certificate verification
- Add upstream PR #428 to add PROXY protocol support to check_smtp
* Wed Jul 25 2018 Stephen Smoogen <smooge(a)fedoraproject.org> -
2.2.1-14.20180725git3429dad
- Update to latest git and fix release string to match
- Fix BZ#1604915
- Fix BZ#1579292
- Possibly fix BZ#1525609
- Possibly fix BZ#1518811
- Possibly fix BZ#1470823
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.2.1-13
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Wed Feb 14 2018 Karsten Hopp <karsten(a)redhat.com> - 2.2.1-12
- fix conditionals
- include mysql_version for MYSQL_PORT macro
- fix perl shebang in plugin-scripts/check_ntp
* Thu Feb 8 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.2.1-11
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Sat Jan 20 2018 Bj��rn Esser <besser82(a)fedoraproject.org> - 2.2.1-10
- Rebuilt for switch to libxcrypt
* Tue Nov 21 2017 Stephen Smoogen <smooge(a)fedoraproject.org> - 2.2.1-9
- Fix mysql patch problem with <f26
- Fix BZ#1478721
* Tue Nov 21 2017 Stephen Smoogen <smooge(a)fedoraproject.org> - 2.2.1-8
- remove git from the release as it isn't standard
- Fix BZ#1512892
- Fix BZ#1512380
- Fix BZ#1500028
- Fix BZ#1494080
- Fix BZ#1478721
* Thu Aug 3 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
2.2.1-7git
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Wed Jul 26 2017 Fedora Release Engineering <releng(a)fedoraproject.org> -
2.2.1-6git
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1604915 - nagios-plugins: FTBFS in Fedora rawhide
https://bugzilla.redhat.com/show_bug.cgi?id=1604915
[ 2 ] Bug #1579292 - installing nagios-plugins pulls in openssl
https://bugzilla.redhat.com/show_bug.cgi?id=1579292
[ 3 ] Bug #1525609 - nagios-plugins-dns: check_dns --querytype=AAAA doesn't work
https://bugzilla.redhat.com/show_bug.cgi?id=1525609
[ 4 ] Bug #1518811 - check_ide_smart Invalid argument to ioctl() (EINVAL)
https://bugzilla.redhat.com/show_bug.cgi?id=1518811
[ 5 ] Bug #1470823 - nagios-plugins-load (2.2.1-1.fc26.x86_64) fails with error message:
CRITICAL - You need more args
https://bugzilla.redhat.com/show_bug.cgi?id=1470823
[ 6 ] Bug #1478721 - nagios-plugins-load requires the uptime binary at runtime
https://bugzilla.redhat.com/show_bug.cgi?id=1478721
[ 7 ] Bug #1484963 - check_disk 2.2.1-4git broken in latest EPEL release
https://bugzilla.redhat.com/show_bug.cgi?id=1484963
[ 8 ] Bug #1480085 - nagios-plugins-http 2.2.1-4git breaks http result content check
https://bugzilla.redhat.com/show_bug.cgi?id=1480085
--------------------------------------------------------------------------------
================================================================================
python-productmd-1.20-1.el6 (FEDORA-EPEL-2019-91ddb5937b)
Library providing parsers for metadata related to OS installation
--------------------------------------------------------------------------------
Update Information:
Sync image types and formats and bring in new ones. Also includes a fedfind
build that works correctly with the changes to productmd.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Mar 5 2019 Lubom��r Sedl���� <lsedlar(a)redhat.com> - 1.20-1
- Improve getting sync between image types and formats
* Sat Feb 2 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.19-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
tcpreplay-4.3.1-3.el6 (FEDORA-EPEL-2019-d8d946a765)
Replay captured network traffic
--------------------------------------------------------------------------------
Update Information:
Patch CVE-2019-8376, CVE-2019-8377 and CVE-2019-8381.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Mar 13 2019 Bojan Smojver <bojan@rexursive com> - 4.3.1-3
- patch CVE-2019-8376, CVE-2019-8377 and CVE-2019-8381
* Sun Feb 3 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.3.1-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Sat Dec 29 2018 Bojan Smojver <bojan@rexursive com> - 4.3.1-1
- bump up to 4.3.1
* Sat Jul 14 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.2.5-6
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Fri Mar 9 2018 Bojan Smojver <bojan@rexursive com> - 4.2.5-5
- add gcc build requirement
* Fri Feb 9 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.2.5-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Thu Aug 3 2017 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.2.5-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Thu Jul 27 2017 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.2.5-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1678245 - CVE-2019-8377 tcpreplay: null pointer dereference in function
get_ipv6_l4proto() in get.c [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1678245
[ 2 ] Bug #1678242 - CVE-2019-8376 tcpreplay: null pointer dereference in function
get_layer4_v6() in get.c [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1678242
[ 3 ] Bug #1678231 - CVE-2019-8381 tcpreplay: invalid memory access in function
do_checksum in checksum.c [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1678231
[ 4 ] Bug #1646408 - CVE-2018-18408 tcpreplay: use-after-free in post_args function in
tcpbridge.c [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1646408
[ 5 ] Bug #1646403 - CVE-2018-18407 tcpreplay: tcpreplay: heap-based buffer over-read
in csum_replace4 function in incremental_checksum.h [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1646403
[ 6 ] Bug #1678244 - CVE-2019-8377 tcpreplay: null pointer dereference in function
get_ipv6_l4proto() in get.c [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1678244
[ 7 ] Bug #1678241 - CVE-2019-8376 tcpreplay: null pointer dereference in function
get_layer4_v6() in get.c [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1678241
[ 8 ] Bug #1678230 - CVE-2019-8381 tcpreplay: invalid memory access in function
do_checksum in checksum.c [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1678230
--------------------------------------------------------------------------------