The following Fedora EPEL 7 Security updates need testing:
Age URL
4
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-f552ecb2a6
borgbackup-1.1.18-2.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
chromium-116.0.5845.187-1.el7
prosody-0.12.4-1.el7
python-scitokens-1.8.1-1.el7
Details about builds:
================================================================================
chromium-116.0.5845.187-1.el7 (FEDORA-EPEL-2023-9d0dbed062)
A WebKit (Blink) powered web browser that Google doesn't want you to use
--------------------------------------------------------------------------------
Update Information:
update to 116.0.5845.187. Fixes following security issue: CVE-2023-4863 ----
update to 116.0.5845.179. Fixes following security issues: CVE-2023-4427
CVE-2023-4428 CVE-2023-4429 CVE-2023-4430 CVE-2023-4431 CVE-2023-4572
CVE-2023-4761 CVE-2023-4762 CVE-2023-4763 CVE-2023-4764
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 12 2023 Than Ngo <than(a)redhat.com> - 116.0.5845.187-1
- update to 116.0.5845.187
* Fri Sep 8 2023 Than Ngo <than(a)redhat.com> - 116.0.5845.179-1
- update to 116.0.5845.179
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2234749 - CVE-2023-4427 CVE-2023-4428 CVE-2023-4429 CVE-2023-4430
CVE-2023-4431 chromium: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2234749
[ 2 ] Bug #2234750 - CVE-2023-4427 CVE-2023-4428 CVE-2023-4429 CVE-2023-4430
CVE-2023-4431 chromium: various flaws [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2234750
[ 3 ] Bug #2235800 - CVE-2023-4572 chromium: chromium-browser: Use after free in
MediaStream [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2235800
[ 4 ] Bug #2235801 - CVE-2023-4572 chromium: chromium-browser: Use after free in
MediaStream [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2235801
[ 5 ] Bug #2236152 - CVE-2021-29390 chromium: libjpeg-turbo: heap-buffer-overflow
vulnerability in decompress_smooth_data in jdcoefct.c [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2236152
[ 6 ] Bug #2237509 - CVE-2023-4761 CVE-2023-4762 CVE-2023-4763 CVE-2023-4764 chromium:
various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2237509
[ 7 ] Bug #2237510 - CVE-2023-4761 CVE-2023-4762 CVE-2023-4763 CVE-2023-4764 chromium:
various flaws [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2237510
[ 8 ] Bug #2238432 - CVE-2023-4863 chromium: chromium-browser: Heap buffer overflow in
WebP [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2238432
[ 9 ] Bug #2238433 - CVE-2023-4863 chromium: chromium-browser: Heap buffer overflow in
WebP [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2238433
--------------------------------------------------------------------------------
================================================================================
prosody-0.12.4-1.el7 (FEDORA-EPEL-2023-7152e9d18f)
Flexible communications server for Jabber/XMPP
--------------------------------------------------------------------------------
Update Information:
# Prosody 0.12.4 Upstream is pleased to announce a new minor release from
their stable branch. Upstream is relieved to announce this overdue maintenance
release containing a number of bug fixes and also some improvements from the
last few months. Especially the `prosodyctl check` tool which gained some new
diagnostic checks as well as handling of configuration option types the same way
Prosody itself does. ## Minor changes * core.certmanager: Update Mozilla TLS
config to version 5.7 * util.error: Fix error on conversion of invalid error
stanza * util.array: Fix `new()` library function * util.array: Expose
`new()` on module table * prosodyctl: Fix output of error messages containing
`%` * util.prosodyctl.check: Correct suggested replacement for `disallow_s2s`
* util.prosodyctl.check: Allow same config syntax variants as in Prosody for
some options * util.prosodyctl.check: Fix error where hostname can���t be turned
into A label * util.prosodyctl.check: Hint about the `external_addresses`
config option * util.prosodyctl.check: Suggest `http_cors_override` instead of
older CORS settings * util.prosodyctl.check: Validate format of module list
options * mod_websocket: Add a `pre-session-close` event * mod_smacks: Fix
stray watchdog closing sessions * mod_csi_simple: Disable revert-to-inactive
timer when going to active mode * mod_csi_simple: Clear delayed active mode
timer on disable * mod_admin_shell: Fix display of remote cert status when
expired etc * mod_smacks: Replace existing watchdog when starting hibernation
* mod_http: Fix error if `access_control_allow_origins` is set * mod_pubsub:
Send correct `jid` attribute in disco#items * mod_http: Unhook CORS handlers
only if active to fix an error * mod_s2s: Add event where resolver for s2sout
can be tweaked
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 13 2023 Robert Scheck <robert(a)fedoraproject.org> 0.12.4-1
- Upgrade to 0.12.4 (#2172143)
* Fri Jul 21 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.12.3-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Tue Jul 11 2023 Franti��ek Zatloukal <fzatlouk(a)redhat.com> - 0.12.3-2
- Rebuilt for ICU 73.2
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2172143 - prosody-0.12.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2172143
--------------------------------------------------------------------------------
================================================================================
python-scitokens-1.8.1-1.el7 (FEDORA-EPEL-2023-f0a6ba347d)
SciToken reference implementation library
--------------------------------------------------------------------------------
Update Information:
Initial upload
--------------------------------------------------------------------------------
ChangeLog:
* Wed Aug 9 2023 Derek Weitzel <dweitzel(a)unl.edu> - 1.8.1-1
- Turn off tests that require networking
* Tue Aug 8 2023 Derek Weitzel <dweitzel(a)unl.edu> - 1.8.0-1
- Add demo token issuer convenience functions
- Improve testing of deserialization
- Add RPM improvements for EPEL
* Tue Nov 22 2022 Derek Weitzel <dweitzel(a)unl.edu> - 1.7.4-1
- Fix the version within the package
* Tue Nov 22 2022 Derek Weitzel <dweitzel(a)unl.edu> - 1.7.3-1
- Remove aud enforcement from deserailize function
- Add configuration for readthedocs
- Remove six dependency
* Tue Oct 4 2022 Derek Weitzel <dweitzel(a)unl.edu> - 1.7.2-1
- Documentation updates
* Wed Sep 28 2022 Derek Weitzel <dweitzel(a)unl.edu> - 1.7.1-1
- Documentation updates
- Fix setup tools and add pyproject.toml
* Fri Feb 18 2022 Derek Weitzel <dweitzel(a)unl.edu> - 1.7.0-1
- Fix serialize mismatch between Python 3 and Python 2
- Fix bug decoding a token with no audience
- Update algorithm used to test UnsupportedKeyException
- Update pyjwt version in requirements.txt
- Default cached public keys set to 4 days
* Wed Nov 3 2021 Brian Lin <blin(a)cs.wisc.edu> - 1.6.2-1
- Fix Python library version (SOFTWARE-4879)
* Wed Nov 3 2021 Brian Lin <blin(a)cs.wisc.edu> - 1.6.1-1
- Reduce PyJWT version requirement made possible by #121 (SOFTWARE-4879)
* Mon Oct 11 2021 Derek Weitzel <dweitzel(a)cse.unl.edu> - 1.6.0-1
- Ensure compatibility with older versions of PyJWT
- Adding multiple aud in token support
* Mon Oct 11 2021 Derek Weitzel <dweitzel(a)cse.unl.edu> - 1.5.0-1
- Include tests in distribution
- Bump pyjwt version
- Add test run with minimum dependencies
- Run continuous integration on macOS and windows
- Check verified claims for issuer in SciToken.serialize
- Add base SciTokensException class
- Remove verify=False keyword from calls to decode()
- Print package list in CI jobs
- Use python3_pkgversion macro in RPM package names
- Move package version declaration into 'scitokens' module
- Fix deprecation warning from cryptography.utils.int_from_bytes
* Mon Apr 19 2021 Derek Weitzel <dweitzel(a)cse.unl.edu> - 1.4.0-1
- Add WLCG Token Discovery static function
* Mon Jan 25 2021 Derek Weitzel <dweitzel(a)cse.unl.edu> - 1.3.1-1
- Fix dependency change of behavior in PyJWT
- Add lifetime argument to scitokens-admin-create-token
* Wed Sep 30 2020 Diego Davila <didavila(a)ucsd.edu> - 1.2.4-3
- Force the creation of symlinks so it doesn't fail on update (software-4233)
* Mon Sep 28 2020 Diego Davila <didavila(a)ucsd.edu> - 1.2.4-2
- Avoid overwriting of scripts: scitokens-admin-create-* (software-4233)
* Tue Sep 22 2020 Derek Weitzel <dweitzel(a)cse.unl.edu> - 1.2.4-1
- Same version in setup.py and spec
* Fri Sep 11 2020 Diego Davila <didavila(a)ucsd.edu> - 1.2.2-3
- Add conditions to build both py2 and py3 packages for el7 (software-4233)
* Mon Aug 10 2020 Diego Davila <didavila(a)ucsd.edu> - 1.2.2-2
- Add conditions to build for el8 (software-4126)
* Fri Feb 22 2019 Derek Weitzel <dweitzel(a)cse.unl.edu> - 1.2.2-1
- Add EC support to the admin tools
* Sun Oct 21 2018 Derek Weitzel <dweitzel(a)cse.unl.edu> - 1.2.1-1
- Support multiple audiences in verifier
* Tue Jul 10 2018 Derek Weitzel <dweitzel(a)cse.unl.edu> - 1.2.0-1
- Merge in the "scope" change accidently mentioned in 1.1.0
* Fri Jul 6 2018 Derek Weitzel <dweitzel(a)cse.unl.edu> - 1.1.0-1
- Add support for updated RFC for "scope"
- Add support for Elliptic Curve cryptography
* Tue Jan 30 2018 Derek Weitzel <dweitzel(a)cse.unl.edu> - 1.0.2-1
- Fix bug when configuration is not specified
* Tue Jan 30 2018 Derek Weitzel <dweitzel(a)cse.unl.edu> - 1.0.0-1
- Add optional configuration file
- Fix bug for missing kid
- Add automatic jti generation
* Mon Nov 6 2017 Derek Weitzel <dweitzel(a)cse.unl.edu> - 0.3.3-1
- Add subject testing in the Enforcer
* Mon Nov 6 2017 Derek Weitzel <dweitzel(a)cse.unl.edu> - 0.3.2-3
- Include dependency for python-setuptools
* Fri Nov 3 2017 Derek Weitzel <dweitzel(a)cse.unl.edu> - 0.3.2-2
- Update packaging to not include 2 scripts for the admin-create*
- Include the correct package for python-jwt dependency
* Thu Nov 2 2017 Derek Weitzel <dweitzel(a)cse.unl.edu> - 0.3.2-1
- Version bump to include spec in tag
* Wed Nov 1 2017 Derek Weitzel <dweitzel(a)cse.unl.edu> - 0.3.1-1
- Fix packaging to include internal util module
* Wed Nov 1 2017 Derek Weitzel <dweitzel(a)cse.unl.edu> - 0.3.0-1
- Initial package.
--------------------------------------------------------------------------------