The following Fedora EPEL 7 Security updates need testing:
Age URL
520
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-3c9292b62d
condor-8.6.11-1.el7
261
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-c499781e80
python-gnupg-0.4.4-1.el7
259
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-bc0182548b
bubblewrap-0.3.3-2.el7
12
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-32603d41ea
GraphicsMagick-1.3.34-1.el7
10
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-b5ec870c52
mingw-wavpack-5.1.0-9.el7
9
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-75cc3918d1
rubygem-ox-2.4.11-5.el7
8
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-9ffdf25269
python-django-1.11.27-1.el7
8
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-12cd208593
gnulib-0-31.20200107git.el7
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-de388d4fd0
chromium-79.0.3945.117-1.el7
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-35e87bab10
perl-Clipboard-0.21-1.el7.1
5
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-a062204588
rubygem-rack-1.6.12-1.el7
3
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-87fd65eed3
python3-pillow-6.2.2-1.el7
2
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-345003feba
thunderbird-enigmail-2.1.5-1.el7
1
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-348d34c4c6
elog-3.1.4-1.20190113git283534d97d5a.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
composer-1.9.2-1.el7
copr-cli-1.84-1.el7
dhtest-1.5-2.el7
fail2ban-0.10.5-1.el7
python-copr-1.100-1.el7
zstd-1.4.4-1.el7
Details about builds:
================================================================================
composer-1.9.2-1.el7 (FEDORA-EPEL-2020-caaa5bac52)
Dependency Manager for PHP
--------------------------------------------------------------------------------
Update Information:
**Version 1.9.2** - 2020-01-14 * Fixed minor git driver bugs * Fixed schema
validation for version field to allow dev-* versions too * Fixed external
processes' output being formatted even though it should not * Fixed issue with
path repositories when trying to install feature branches
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 14 2020 Remi Collet <remi(a)remirepo.net> - 1.9.2-1
- update to 1.9.2
--------------------------------------------------------------------------------
================================================================================
copr-cli-1.84-1.el7 (FEDORA-EPEL-2020-9e0df872da)
Command line interface for COPR
--------------------------------------------------------------------------------
Update Information:
- don't spam stdout/stderr when downloading build - added new command 'copr
chroot-list'
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 15 2020 Tomas Hrnciar <thrnciar(a)redhat.com> 1.84-1
- Don't spam when downloading build
- fix chroot-list command to work on both python2 and python3
- add command to list all available chroots
--------------------------------------------------------------------------------
================================================================================
dhtest-1.5-2.el7 (FEDORA-EPEL-2020-51794c07a5)
A DHCP client simulation on linux
--------------------------------------------------------------------------------
Update Information:
DHCP client test tool
--------------------------------------------------------------------------------
ChangeLog:
* Sun Dec 15 2019 Petr Men����k <pemensik(a)redhat.com> - 1.5-2
- Add license
* Thu Mar 15 2018 Petr Men����k <pemensik(a)redhat.com> - 1.5-1
- Initial package
--------------------------------------------------------------------------------
================================================================================
fail2ban-0.10.5-1.el7 (FEDORA-EPEL-2020-843907fe20)
Daemon to ban hosts that cause multiple authentication errors
--------------------------------------------------------------------------------
Update Information:
ver. 0.10.5 (2020/01/10) - deserve-more-respect-a-jedis-weapon-must -----------
Yes, Hrrrm... ### Fixes * [compatibility] systemd backend: default flags
changed to SYSTEM_ONLY(4), fixed in gh-2444 in order to ignore user session
files per default, so could prevent "Too many open files" errors on a lot of
user sessions (see gh-2392) * [grave] fixed parsing of multi-line filters
(`maxlines` > 1) together with systemd backend, now systemd-filter replaces
newlines in message from systemd journal with `\n` (otherwise multi-line
parsing may be broken, because removal of matched string from multi-line buffer
window is confused by such extra new-lines, so they are retained and got
matched on every followed message, see gh-2431) * [stability] prevent race
condition - no unban if the bans occur continuously (gh-2410); now an unban-
check will happen not later than 10 tickets get banned regardless there are
still active bans available (precedence of ban over unban-check is 10 now) *
fixed read of included config-files (`.local` overwrites options of `.conf` for
config-files included with before/after) * `action.d/abuseipdb.conf`:
switched to use AbuseIPDB API v2 (gh-2302) * `action.d/badips.py`: fixed start
of banaction on demand (which may be IP-family related), gh-2390 *
`action.d/helpers-common.conf`: rewritten grep arguments, now options `-wF` used
to match only whole words and fixed string (not as pattern), gh-2298 *
`filter.d/apache-auth.conf`: - ignore errors from mod_evasive in `normal` mode
(mode-controlled now) (gh-2548); - extended with option `mode` - `normal`
(default) and `aggressive` * `filter.d/sshd.conf`: - matches `Bad protocol
version identification` in `ddos` and `aggressive` modes (gh-2404). - captures
`Disconnecting ...: Change of username or service not allowed` (gh-2239,
gh-2279) - captures `Disconnected from ... [preauth]`, preauth phase only,
different handling by `extra` (with supplied user only) and
`ddos`/`aggressive` mode (gh-2115, gh-2239, gh-2279) * `filter.d/mysqld-
auth.conf`: - MYSQL 8.0.13 compatibility (log-error-verbosity = 3), log-
format contains few additional words enclosed in brackets after "[Note]"
(gh-2314) * `filter.d/sendmail-reject.conf`: - `mode=extra` now captures port
IDs of `TLSMTA` and `MSA` (defaults for ports 465 and 587 on some distros) *
`files/fail2ban.service.in`: fixed systemd-unit template - missing nftables
dependency (gh-2313) * several `action.d/mail*`: fixed usage with multiple log
files (ultimate fix for gh-976, gh-2341) * `filter.d/sendmail-reject.conf`:
fixed journal usage for some systems (e. g. CentOS): if only identifier set
to `sm-mta` (no unit `sendmail`) for some messages (gh-2385) *
`filter.d/asterisk.conf`: asterisk can log additional timestamp if logs into
systemd-journal (regex extended with optional part matching this, gh-2383) *
`filter.d/postfix.conf`: - regexp's accept variable suffix code in status of
postfix for precise messages (gh-2442) - extended with new postfix filter
mode `errors` to match "too many errors" (gh-2439), also included within
modes `normal`, `more` (`extra` and `aggressive`), since postfix parameter
`smtpd_hard_error_limit` is default 20 (additionally consider `maxretry`) *
`filter.d/named-refused.conf`: - support BIND 9.11.0 log format (includes an
additional field @0xXXX..., gh-2406); - `prefregex` extended, more selective
now (denied/NOTAUTH suffix moved from failregex, so no catch-all there anymore)
* `filter.d/sendmail-auth.conf`, `filter.d/sendmail-reject.conf` : - ID in
prefix can be longer as 14 characters (gh-2563); * all filters would accept
square brackets around IPv4 addresses also (e. g. monit-filter, gh-2494) *
avoids unhandled exception during flush (gh-2588) * fixes pass2allow-ftp jail -
due to inverted handling, action should prohibit access per default for any IP,
therefore reset start on demand parameter for this action (it will be started
immediately by repair); * auto-detection of IPv6 subsystem availability
(important for not on-demand actions or jails, like pass2allow); ### New
Features * new replacement tags for failregex to match subnets in form of IP-
addresses with CIDR mask (gh-2559): - `<CIDR>` - helper regex to match CIDR
(simple integer form of net-mask); - `<SUBNET>` - regex to match sub-net
adresses (in form of IP/CIDR, also single IP is matched, so part /CIDR is
optional); * grouped tags (`<ADDR>`, `<HOST>`, `<SUBNET>`) recognize IP
addresses enclosed in square brackets * new failregex-flag tag `<F-MLFGAINED>`
for failregex, signaled that the access to service was gained (ATM used
similar to tag `<F-NOFAIL>`, but it does not add the log-line to matches,
gh-2279) * filters: introduced new configuration parameter `logtype` (default
`file` for file-backends, and `journal` for journal-backends, gh-2387); can
be also set to `rfc5424` to force filters (which include common.conf) to use
RFC 5424 conform prefix-line per default (gh-2467); * for better performance and
safety the option `logtype` can be also used to select short prefix-line for
file-backends too for all filters using `__prefix_line` (`common.conf`), if
message logged only with `hostname svc[nnnn]` prefix (often the case on several
systems): ```ini [jail] backend = auto filter = flt[logtype=short] ``` *
`filter.d/common.conf`: differentiate `__prefix_line` for file/journal logtype's
(speedup and fix parsing of systemd-journal); * `filter.d/traefik-auth.conf`:
used to ban hosts, that were failed through traefik * `filter.d/znc-
adminlog.conf`: new filter for ZNC (IRC bouncer); requires the adminlog module
to be loaded ### Enhancements * introduced new options: `dbmaxmatches`
(fail2ban.conf) and `maxmatches` (jail.conf) to contol how many matches per
ticket fail2ban can hold in memory and store in database (gh-2402, gh-2118); *
fail2ban.conf: introduced new section `[Thread]` and option `stacksize` to
configure default size of the stack for threads running in fail2ban (gh-2356),
it could be set in `fail2ban.local` to avoid runtime error "can't start new
thread" (see gh-969); * jail-reader extended (amend to gh-1622): actions support
multi-line options now (interpolations containing new-line); * fail2ban-
client: extended to ban/unban multiple tickets (see gh-2351, gh-2349); Syntax:
- `fail2ban-client set <jain> banip <ip1> ... <ipN>` -
`fail2ban-client set
<jain> unbanip [--report-absent] <ip1> ... <ipN>` * fail2ban-client:
extended
with new feature which allows to inform fail2ban about single or multiple
attempts (failure) for IP (resp. failure-ID), see gh-2351; Syntax: -
`fail2ban-client set <jail> attempt <ip> [<failure-message1> ...
<failure-
messageN>]` * `action.d/nftables.conf`: - isolate fail2ban rules into a
dedicated table and chain (gh-2254) - `nftables-allports` supports multiple
protocols in single rule now - combined nftables actions to single action
`nftables`: * `nftables-common` is removed (replaced with single action
`nftables` now) * `nftables-allports` is obsolete, superseded by
`nftables[type=allports]` * `nftables-multiport` is obsolete, superseded by
`nftables[type=multiport]` - allowed multiple protocols in
`nftables[type=multiport]` action (single set with multiple rules in chain),
following configuration in jail would replace 3 separate actions, see
https://github.com/fail2ban/fail2ban/pull/2254#issuecomment-534684675 *
`action.d/badips.py`: option `loglevel` extended with level of summary message,
following example configuration logging summary with NOTICE and rest with DEBUG
log-levels: `action = badips.py[loglevel="debug, notice"]` *
samplestestcase.py (testSampleRegexsFactory) extended: - allow coverage of
journal logtype; - new option `fileOptions` to set common filter/test options
for whole test-file; * large enhancement: auto-reban, improved invariant check
and conditional operations (gh-2588): - improves invariant check and repair
(avoid unhandled exception, consider family on conditional operations, etc),
prepared for bulk re-ban in repair case (if bulk-ban becomes implemented); -
automatic reban (repeat banning action) after repair/restore sane environment,
if already logged ticket causes new failures (via new action operation
`actionreban` or `actionban` if still not defined in action); * introduces
banning epoch for actions and tickets (to distinguish or recognize removed set
of the tickets); * invariant check avoids repair by unban/stop (unless
parameter `actionrepair_on_unban` set to `true`); * better handling for all
conditional operations (distinguish families for certain operations like
repair/flush/stop, prepared for other families, e. g. if different handling for
subnets expected, etc); * partially implements gh-980 (more breakdown safe
handling); * closes gh-1680 (better as large-scale banning implementation with
on-demand reban by failure, at least unless a bulk-ban gets implemented); *
fail2ban-regex - several enhancements and fixes: - improved usage output
(don't put a long help if an error occurs); - new option `--no-check-all` to
avoid check of all regex's (first matched only); - new option `-o`, `--out` to
set token only provided in output (disables check-all and outputs only expected
data).
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jan 14 2020 Orion Poplawski <orion(a)nwra.com> - 0.10.5-1
- Update to 0.10.5
--------------------------------------------------------------------------------
================================================================================
python-copr-1.100-1.el7 (FEDORA-EPEL-2020-9e0df872da)
Python interface for Copr
--------------------------------------------------------------------------------
Update Information:
- don't spam stdout/stderr when downloading build - added new command 'copr
chroot-list'
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 15 2020 Tomas Hrnciar <thrnciar(a)redhat.com> 1.100-1
- add command to list all available chroots
--------------------------------------------------------------------------------
================================================================================
zstd-1.4.4-1.el7 (FEDORA-EPEL-2020-0548f77682)
Zstd compression library
--------------------------------------------------------------------------------
Update Information:
Latest upstream with performance improvements
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jan 15 2020 P��draig Brady <P(a)draigBrady.com> - 1.4.4-1
- Latest upstream
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1468076 - None
https://bugzilla.redhat.com/show_bug.cgi?id=1468076
--------------------------------------------------------------------------------