The following Fedora EPEL 7 Security updates need testing: Age URL 13 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-3f4ec3ba2a sympa-6.2.62-1.el7 13 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-23a46d718e libopenmpt-0.5.8-1.el7 9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-314d2feba2 chromium-90.0.4430.93-1.el7 9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-80d45ac7ec ansible-2.9.21-1.el7 6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-680600d10f python-impacket-0.9.22-3.el7 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-352a65d3bc djvulibre-3.5.25.3-23.el7

The following builds have been pushed to Fedora EPEL 7 updates-testing

configsnap-0.20.1-1.el7 drbd-9.17.0-1.el7 knot-3.0.6-1.el7 libidn2-2.3.1-1.el7 prosody-0.11.9-1.el7 python-pefile-2021.5.13-1.el7 sec-2.9.0-1.el7

Details about builds:

================================================================================ configsnap-0.20.1-1.el7 (FEDORA-EPEL-2021-b5c3437e7e) Record and compare system state -------------------------------------------------------------------------------- Update Information:

Update python binary for python3 based distros ---- Port configsnap to python3 -------------------------------------------------------------------------------- ChangeLog:

* Wed May 12 2021 Christos Triantafyllidis christos.triantafyllidis@rackspace.co.uk - 0.20.1-1 - Update python binary for python3 based distros * Fri May 7 2021 Nick Rhodes nrhodes91@gmail.com - 0.20.0-3 - Fix build issues in Koji * Fri May 7 2021 Nick Rhodes nrhodes91@gmail.com - 0.20.0-1 - Port to python3 compatibility (PR 120) --------------------------------------------------------------------------------

================================================================================ drbd-9.17.0-1.el7 (FEDORA-EPEL-2021-47f19d6ceb) DRBD user-land tools and scripts -------------------------------------------------------------------------------- Update Information:

Upstream release of 9.17.0 -------------------------------------------------------------------------------- ChangeLog:

* Thu May 13 2021 Peter Hanecak hany@hany.sk - 9.17.0-1 - Upstream release of 9.17.0 - fixed permission for tmpfiles.d/drbd.conf -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1953557 - drbd-9.17.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1953557 --------------------------------------------------------------------------------

================================================================================ knot-3.0.6-1.el7 (FEDORA-EPEL-2021-0d059dc73f) High-performance authoritative DNS server -------------------------------------------------------------------------------- Update Information:

Update to upstream 3.0.6 -------------------------------------------------------------------------------- ChangeLog:

* Fri May 14 2021 Jakub Ru��i��ka jakub.ruzicka@nic.cz - 3.0.6-1 - Update to 3.0.6 --------------------------------------------------------------------------------

================================================================================ libidn2-2.3.1-1.el7 (FEDORA-EPEL-2021-5ef16bc4ca) Library to support IDNA2008 internationalized domain names -------------------------------------------------------------------------------- Update Information:

Libidn2 2.3.1 (released 2021-05-12) =================================== * Implement full roundtrip for lookup functionality With TR64 enabled (default), `������i` was converted to `xn-- o-oia59s`. The output contains an illegal space and thus could not be decoded any more. * Fix domain too long error * doc: `idn2.1` and `libidn2.texi` automatically get `idn2 --help` output. * Updated gnulib files and various build fixes. In particular, it no longer attempts to detect a host CC compiler. -------------------------------------------------------------------------------- ChangeLog:

* Wed May 12 2021 Robert Scheck robert@fedoraproject.org 2.3.1-1 - Upgrade to 2.3.1 (#1960005) * Tue Jan 26 2021 Fedora Release Engineering releng@fedoraproject.org - 2.3.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild * Tue Jul 28 2020 Fedora Release Engineering releng@fedoraproject.org - 2.3.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Tue May 26 2020 Jeff Law law@redhat.com - 2.3.0-3 - Touch a couple autoconf related files to prevent undesired rebuilding if %configure changes one or more configure files. * Wed Jan 29 2020 Fedora Release Engineering releng@fedoraproject.org - 2.3.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1960005 - libidn2-2.3.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=1960005 --------------------------------------------------------------------------------

================================================================================ prosody-0.11.9-1.el7 (FEDORA-EPEL-2021-c44d955770) Flexible communications server for Jabber/XMPP -------------------------------------------------------------------------------- Update Information:

Prosody 0.11.9 ============== This release addresses a number of important security issues that affect most deployments of Prosody. Full details are available in a separate security advisory. Upstream recommends that all deployments upgrade or apply the mitigations described in the advisory: https://prosody.im/security/advisory_20210512/ Note: Upstream updated the default config file. YUM or RPM will create a `/etc/prosody/prosody.cfg.lua.rpmnew` file, so make sure you update your existing `/etc/prosody/prosody.cfg.lua` to enable mod_limits after the upgrade. Security -------- * mod_limits, prosody.cfg.lua: Enable rate limits by default * certmanager: Disable renegotiation by default * mod_proxy65: Restrict access to local c2s connections by default * util.startup: Set more aggressive defaults for GC * mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default stanza size limits * mod_auth_internal_{plain,hashed}: Use constant-time string comparison for secrets * mod_dialback: Remove dialback-without-dialback feature * mod_dialback: Use constant-time comparison with hmac Minor changes ------------- * util.hashes: Add constant-time string comparison (binding to `CRYPTO_memcmp`) * mod_c2s: Don���t throw errors in async code when connections are gone * mod_c2s: Fix traceback in session close when conn is nil * core.certmanager: Improve detection of LuaSec/OpenSSL capabilities * mod_saslauth: Use a defined SASL error * MUC: Add support for advertising muc#roomconfig_allowinvites in room disco#info * mod_saslauth: Don���t throw errors in async code when connections are gone * mod_pep: Advertise base pubsub feature (fixes #1632: mod_pep missing pubsub feature in disco) * prosodyctl check config: Add `gc` to list of global options * prosodyctl about: Report libexpat version if known * util.xmppstream: Add API to dynamically configure the stanza size limit for a stream * util.set: Add `is_set()` to test if an object is a set * mod_http: Skip IP resolution in non-proxied case * mod_c2s: Log about missing conn on async state changes * util.xmppstream: Reduce internal default xmppstream limit to 1MB -------------------------------------------------------------------------------- ChangeLog:

* Thu May 13 2021 Robert Scheck robert@fedoraproject.org 0.11.9-1 - Upgrade to 0.11.9 (#1960244, #1960332, #1960335, #1960340, * Fri Apr 30 2021 Robert Scheck robert@fedoraproject.org 0.11.8-4 - Added upstream patch to avoid '-Wl,--as-needed' removing linking to libpthread when building with current libicu (#1954178) * Tue Mar 2 2021 Zbigniew J��drzejewski-Szmek zbyszek@in.waw.pl - 0.11.8-3 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. * Fri Feb 26 2021 Robert Scheck robert@fedoraproject.org 0.11.8-2 - Added upstream patch to unbreak Lua 5.4 support (#1933063) - Added %check to run some common commands (as a small testsuite) -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1960332 - CVE-2021-32917 prosody: use of mod_proxy65 is unrestricted in default configuration https://bugzilla.redhat.com/show_bug.cgi?id=1960332 [ 2 ] Bug #1960335 - CVE-2021-32918 prosody: DoS via insufficient memory consumption controls https://bugzilla.redhat.com/show_bug.cgi?id=1960335 [ 3 ] Bug #1960340 - CVE-2021-32919 prosody: undocumented dialback-without-dialback option insecure https://bugzilla.redhat.com/show_bug.cgi?id=1960340 [ 4 ] Bug #1960343 - CVE-2021-32920 prosody: DoS via repeated TLS renegotiation causing excessive CPU consumption https://bugzilla.redhat.com/show_bug.cgi?id=1960343 [ 5 ] Bug #1960349 - CVE-2021-32921 prosody: use of timing-dependent string comparison with sensitive values https://bugzilla.redhat.com/show_bug.cgi?id=1960349 --------------------------------------------------------------------------------

================================================================================ python-pefile-2021.5.13-1.el7 (FEDORA-EPEL-2021-65ec199e6d) Python module for working with Portable Executable files -------------------------------------------------------------------------------- Update Information:

bump to version 2021.5.13 -------------------------------------------------------------------------------- ChangeLog:

-------------------------------------------------------------------------------- References:

[ 1 ] Bug #1960414 - python-pefile-2021.5.13 is available https://bugzilla.redhat.com/show_bug.cgi?id=1960414 --------------------------------------------------------------------------------

================================================================================ sec-2.9.0-1.el7 (FEDORA-EPEL-2021-50f7bdb3cf) Simple Event Correlator script to filter log file entries -------------------------------------------------------------------------------- Update Information:

New upstream release -------------------------------------------------------------------------------- ChangeLog:

* Thu May 13 2021 Stefan Schulze Frielinghaus stefansf@fedoraproject.org - 2.9.0-1 - New upstream release --------------------------------------------------------------------------------