The following Fedora EPEL 7 Security updates need testing:
Age URL
24
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-4a9fc09599
openjpeg2-2.3.1-10.el7
11
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-ab8d229496
awstats-7.8-2.el7
10
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-a8b2c928f5
dia-0.97.3-16.el7
6
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-143227c7ed
sympa-6.2.60-1.el7
1
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-5843fdc72c
adplug-2.3.3-1.el7 audacious-plugins-4.0.5-3.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
coturn-4.5.2-1.el7
libmodulemd2-2.11.2-1.1.el7
s3fs-fuse-1.88-1.el7
Details about builds:
================================================================================
coturn-4.5.2-1.el7 (FEDORA-EPEL-2021-6bfa86551f)
TURN/STUN & ICE Server
--------------------------------------------------------------------------------
Update Information:
Coturn 4.5.2 ============ - Fix null pointer dereference in case of out of
memory - Add prometheus metrics - Delete trailing whitespace in example
configuration files - Add architecture ppc64le to travis build - Fix
misleading option in doc (prometheus) - Allow RFC6062 TCP relay data to look
like TLS - Add support for proxy protocol V1 - Print full date and time in
logs - Add new options: "new-log-timestamp" and
"new-log-timestamp-format" -
Do not use FIPS and remove hardcode `OPENSSL_VERSION_NUMBER` with LibreSSL -
Add ACME redirect url - Support of `--acme-redirect <URL>` - Fix acme
security, redundancy, consistency - Disable binding request logging to avoid
DoS attacks (Breaking change!) - Add new `--log-binding` option to enable
binding request logging - Fix stale-nonce documentation - Version number is
changed to semver 2.0 - pkg-config, and various cleanups in configure file -
Add systemd notification for better systemd integration - Fix: Null pointer
dereference on tcp_client_input_handler_rfc6062data function - Fix: use-after-
free vulnerability on write_to_peerchannel function - Fix: use-after-free
vulnerability on write_client_connection function - Little refactoring
prometheus - Fix c++ support - Simplify - Remove session
id/allocation labels - Remove per session metrics - Fix CVE-2020-26262
- Fix ipv6 ::1 loopback check - Not allow allocate peer address 0.0.0.0/8
and ::/128 - For more details see the github security advisory:
https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 11 2021 Robert Scheck <robert(a)fedoraproject.org> - 4.5.2-1
- Upgrade to 4.5.2 (#1914861)
* Sun Sep 27 2020 Christian Glombek <lorbus(a)fedoraproject.org> - 4.5.1.3-3
- Rebuilt for libevent 2.1.12 soname bump
* Mon Jul 27 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.5.1.3-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1915045 - CVE-2020-26262 coturn: Loopback access control bypass
https://bugzilla.redhat.com/show_bug.cgi?id=1915045
--------------------------------------------------------------------------------
================================================================================
libmodulemd2-2.11.2-1.1.el7 (FEDORA-EPEL-2021-07fff01e4a)
Module metadata manipulation library
--------------------------------------------------------------------------------
Update Information:
Update to libmodulemd 2.11.2 Also fixes a bug when trying to import the python2
bindings.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 11 2021 Stephen Gallagher <sgallagh(a)redhat.com> - 2.11.2-1.1
- Fix issue with loading python2 bindings
* Thu Jan 7 2021 Stephen Gallagher <sgallagh(a)redhat.com> - 2.11.2-1
- Release 2.11.2
- Extend read_packager_[file|string]() to support overriding the module name
and stream.
--------------------------------------------------------------------------------
================================================================================
s3fs-fuse-1.88-1.el7 (FEDORA-EPEL-2021-8873b594c6)
FUSE-based file system backed by Amazon S3
--------------------------------------------------------------------------------
Update Information:
Update to 1.88 from
https://github.com/s3fs-fuse/s3fs-fuse (#1914881) Full
changelog:
https://github.com/s3fs-fuse/s3fs-fuse/releases/tag/v1.88
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jan 11 2021 Julio Gonz��lez Gil <packages(a)juliogonzalez.es> - 1.88-1
- Update to 1.88 from
https://github.com/s3fs-fuse/s3fs-fuse (#1914881)
Full changelog:
https://github.com/s3fs-fuse/s3fs-fuse/releases/tag/v1.88
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1914881 - s3fs-fuse-1.88 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1914881
--------------------------------------------------------------------------------