The following Fedora EPEL 7 Security updates need testing:
Age URL
6
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2022-ce8d5824ad
halibut-1.3-3.el7
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2022-aaaeae50ce
rubygem-jmespath-1.3.1-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
perl-Parse-DMIDecode-0.03-6.el7
python-bottle-0.12.21-1.el7
tio-1.39-1.el7
Details about builds:
================================================================================
perl-Parse-DMIDecode-0.03-6.el7 (FEDORA-EPEL-2022-c94627008d)
Interface to SMBIOS using dmidecode
--------------------------------------------------------------------------------
Update Information:
This release fixes a memory leak and warnings about unportable hexadecimal
numbers and about an uninitialized number of structures on machines with SMBIOS
version 3.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jun 13 2022 Petr Pisar <ppisar(a)redhat.com> - 0.03-6
- Fix a memory leak when destructing Parse::DMIDecode::Handle objects
(CPAN RT#125088)
- Fix supressing portability warnings (CPAN RT#143252)
- Do not warn on SMBIOS version 3 (bug #1661251)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1661251 - Fails due to uninitialised value
https://bugzilla.redhat.com/show_bug.cgi?id=1661251
--------------------------------------------------------------------------------
================================================================================
python-bottle-0.12.21-1.el7 (FEDORA-EPEL-2022-0286a0e93a)
Fast and simple WSGI-framework for small web-applications
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2020-28473
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jun 13 2022 Ali Erdinc Koroglu <aekoroglu(a)fedoraproject.org> - 0.12.21-1
- Update to 0.12.21 (rhbz #1926760)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1926760 - CVE-2020-28473 python-bottle: Web Cache Poisoning by using a vector
called parameter cloaking may lead to integrity and availability compromise [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1926760
--------------------------------------------------------------------------------
================================================================================
tio-1.39-1.el7 (FEDORA-EPEL-2022-639e144f14)
Simple TTY terminal I/O application
--------------------------------------------------------------------------------
Update Information:
# tio v1.39 * Improve key command response for local echo and timestamp *
Fix invalid hex character error message * Make sure only matched config
section is parsed * Add support for `disable` keyword in config file *
Unify error message formating * Cleanup list devices code * Fix command-
line `tty-device|config` parsing Allow user to add options on both sides of
the provided config argument. For example: `$ tio -b 9600 am64-evm -e`
Before, tio only allowed adding arguments after the config argument.
Implemented as simple as possible by introducing two stage option parsing. *
Update bash completion * Add support for IPv4 and IPv6 network sockets
Add support for IPv4 and IPv6 network sockets via socket syntax `inet:<port>`
and `inet6:<port>` respectively. For example, to listen and redirect serial
device I/O to a host bound IPv4 socket simply do: `$ tio /dev/ttyUSB0 --socket
inet:4444` To connect do e.g.: `$ nc 127.0.0.1 4444` Likewise, for
IPv6 do: `$ tio /dev/ttyUSB0 --socket inet6:4444` To connect do e.g.: `$ nc
::1 4444` If port is `0` or no port is provided default port `3333` is
used. * Fix tio deleting unix socket file If tio has a unix file socket
open, a second tio instance of tio may delete the socket file. This change fixes
so that it will not be deleted and tio will instead error and complain about
conflicting socket file. * Rework color option Rework the color option
to support setting ANSI color code values ranging from 0..255 or `none` for no
color or `list` to print a list of available ANSI colors codes. Also,
disables color when piping. * Remove print of hex mode status at startup *
Remove newline option in hex mode * Fix configfile memory leaks * Remove
command-line option inconsistencies Optional arguments, as parsed by the
`getopt_long` mechanism, are inherently inconsistent with how you define
required arguments. To avoid confusion we decide to avoid this
inconsistency by replacing optional options with additional options with
required argmuments. * Replace `1` with `enable` in config files *
Convert errors to warnings * Extended hexadecimal mode. While in hex
mode (`ctrl`-`t` `h`) you can output hexadecimal values. E.g.: to send `0x0A`
you have to type `0A` (always 2 characters). Added option `-x`, `--hex` to
start in hexadecimal mode. Added option `--newline-in-hex` to interpret
newline characters in hex mode. This is disabled by default, because, in my
opinion, hex stream is fundamentally different from text, so a "new line" is
meaningless in this context.
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 12 2022 Robert Scheck <robert(a)fedoraproject.org> 1.39-1
- Upgrade to 1.39 (#2096097)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2096097 - tio-1.39 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2096097
--------------------------------------------------------------------------------