The following Fedora EPEL 7 Security updates need testing: Age URL 28 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-2c81054303 remctl-3.14-1.el7 11 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-cae67a6aed knot-resolver-2.3.0-1.el7 8 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-e4a3d0e9ef drupal7-7.59-1.el7 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-996cb2153b quassel-0.12.5-1.el7 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-5ae7f0e7c7 python-pygit2-0.26.4-1.el7 libgit2-0.26.3-1.el7 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-ce811a54c9 roundcubemail-1.1.12-2.el7

The following builds have been pushed to Fedora EPEL 7 updates-testing

90-Second-Portraits-1.01b-3.el7 GraphicsMagick-1.3.29-1.el7 PyQuante-1.6.5-12.el7 agedu-0-15.20171202.8a8299e.el7 composer-1.6.5-1.el7 csdiff-1.4.0-1.el7 csmock-2.1.1-1.el7 globus-net-manager-0.18-1.el7 kstart-4.2-7.el7 love-0.10.2-12.el7 mb2md-3.20-17.el7 mosquitto-1.4.15-2.el7 mrrescue-1.02e-8.el7 myproxy-6.1.29-1.el7 mysql-mmm-2.2.1-15.el7 nodejs-6.14.2-1.el7 nordugrid-arc-5.4.2-5.el7 ocaml-labltk-8.06.4-3.el7 orthorobot-1.1.1-7.el7 packmol-18.013-1.el7 pcc-1.1.0-1.1.20180504cvs.el7 python-ansible-tower-cli-3.3.0-2.el7 python-dns-lexicon-2.2.2-1.el7 python-mpmath-1.0.0-1.el7 safetyblanket-1.01-2.el7 seamonkey-2.49.3-1.el7 wannier90-2.0.0-9.el7

Details about builds:

================================================================================ 90-Second-Portraits-1.01b-3.el7 (FEDORA-EPEL-2018-708a43eccb) Frantic street painting game -------------------------------------------------------------------------------- Update Information:

New packages --------------------------------------------------------------------------------

================================================================================ GraphicsMagick-1.3.29-1.el7 (FEDORA-EPEL-2018-4ea1a823cd) An ImageMagick fork, offering faster image generation and better quality -------------------------------------------------------------------------------- Update Information:

Latest upstream release, see http://www.graphicsmagick.org/NEWS.html#april-29-2017 -------------------------------------------------------------------------------- ChangeLog:

* Wed May 2 2018 Rex Dieter rdieter@fedoraproject.org - 1.3.29-1 - 1.3.29 (#1574031]) * Wed Mar 7 2018 Rex Dieter rdieter@fedoraproject.org - 1.3.28-4 - BR: gcc-c++, %make_build %make_install %ldconfig_scriptlets * Fri Feb 16 2018 Rex Dieter rdieter@fedoraproject.org - 1.3.28-3 - use %ldconfig_scriptlets - s/libungif/giflib * Wed Feb 7 2018 Fedora Release Engineering releng@fedoraproject.org - 1.3.28-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1574031 - GraphicsMagick-1.3.29 is available https://bugzilla.redhat.com/show_bug.cgi?id=1574031 --------------------------------------------------------------------------------

================================================================================ PyQuante-1.6.5-12.el7 (FEDORA-EPEL-2018-4d579df83d) Python Quantum Chemistry -------------------------------------------------------------------------------- Update Information:

First release in EPEL7. --------------------------------------------------------------------------------

================================================================================ agedu-0-15.20171202.8a8299e.el7 (FEDORA-EPEL-2018-4d579df83d) An utility for tracking down wasted disk space -------------------------------------------------------------------------------- Update Information:

First release in EPEL7. --------------------------------------------------------------------------------

================================================================================ composer-1.6.5-1.el7 (FEDORA-EPEL-2018-8d9f2a1b2e) Dependency Manager for PHP -------------------------------------------------------------------------------- Update Information:

**Version 1.6.5** 2018-05-04 * Fixed regression in 1.6.4 causing strange update behaviors with dev packages * Fixed regression in 1.6.4 color support detection for Windows * Fixed issues dealing with broken symlinks when switching branches and using path repositories * Fixed JSON schema for package repositories * Fixed issues on computers set to Turkish locale * Fixed classmap parsing of files using short-open-tags when they are disabled in php -------------------------------------------------------------------------------- ChangeLog:

* Fri May 4 2018 Remi Collet remi@remirepo.net - 1.6.5-1 - update to 1.6.5 --------------------------------------------------------------------------------

================================================================================ csdiff-1.4.0-1.el7 (FEDORA-EPEL-2018-5c53f75ef5) Non-interactive tools for processing code scan results in plain-text -------------------------------------------------------------------------------- Update Information:

- update to latest upstream release -------------------------------------------------------------------------------- ChangeLog:

* Thu May 3 2018 Kamil Dudka kdudka@redhat.com 1.4.0-1 - update to latest upstream release - make both python2 and python3 optional * Mon Feb 19 2018 Kamil Dudka kdudka@redhat.com 1.3.3-4 - add explicit BR for the gcc-c++ compiler --------------------------------------------------------------------------------

================================================================================ csmock-2.1.1-1.el7 (FEDORA-EPEL-2018-5c53f75ef5) A mock wrapper for Static Analysis tools -------------------------------------------------------------------------------- Update Information:

- update to latest upstream release -------------------------------------------------------------------------------- ChangeLog:

* Thu May 3 2018 Kamil Dudka kdudka@redhat.com 2.1.1-1 - update to latest upstream release - introduce the experimental bandit plug-in --------------------------------------------------------------------------------

================================================================================ globus-net-manager-0.18-1.el7 (FEDORA-EPEL-2018-2c0106fe5e) Globus Toolkit - Network Manager -------------------------------------------------------------------------------- Update Information:

globus-net-manager * Fix pre-connect not using changed remote contact myproxy * Fix -Werror=format-security errors -------------------------------------------------------------------------------- ChangeLog:

* Thu May 3 2018 Mattias Ellert mattias.ellert@physics.uu.se - 0.18-1 - GT6 update: Fix pre-connect not using changed remote contact * Wed Feb 7 2018 Iryna Shcherbina ishcherb@redhat.com - 0.17-5 - Update Python 2 dependency declarations to new packaging standards (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) * Wed Feb 7 2018 Fedora Release Engineering releng@fedoraproject.org - 0.17-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild * Wed Aug 2 2017 Fedora Release Engineering releng@fedoraproject.org - 0.17-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild * Wed Jul 26 2017 Fedora Release Engineering releng@fedoraproject.org - 0.17-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild --------------------------------------------------------------------------------

================================================================================ kstart-4.2-7.el7 (FEDORA-EPEL-2018-4863c4f649) Daemon version of kinit for Kerberos v5 -------------------------------------------------------------------------------- Update Information:

Update to latest Fedora package -------------------------------------------------------------------------------- ChangeLog:

* Wed Feb 7 2018 Fedora Release Engineering releng@fedoraproject.org - 4.2-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild * Thu Aug 3 2017 Fedora Release Engineering releng@fedoraproject.org - 4.2-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild * Wed Jul 26 2017 Fedora Release Engineering releng@fedoraproject.org - 4.2-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild * Fri Feb 10 2017 Fedora Release Engineering releng@fedoraproject.org - 4.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1558664 - Please update package to version 4.2 (matching EPEL7) https://bugzilla.redhat.com/show_bug.cgi?id=1558664 --------------------------------------------------------------------------------

================================================================================ love-0.10.2-12.el7 (FEDORA-EPEL-2018-708a43eccb) A free 2D game engine which enables easy game creation in Lua -------------------------------------------------------------------------------- Update Information:

New packages --------------------------------------------------------------------------------

================================================================================ mb2md-3.20-17.el7 (FEDORA-EPEL-2018-4d579df83d) Mailbox to maildir converter -------------------------------------------------------------------------------- Update Information:

First release in EPEL7. --------------------------------------------------------------------------------

================================================================================ mosquitto-1.4.15-2.el7 (FEDORA-EPEL-2018-36bc13caa1) An Open Source MQTT v3.1/v3.1.1 Broker -------------------------------------------------------------------------------- Update Information:

Update systemd unit file (rhbz#1564733) -------------------------------------------------------------------------------- ChangeLog:

* Sat May 5 2018 Fabian Affolter mail@fabian-affolter.ch - 1.4.15-2 - Update systemd unit file (rhbz#1564733) -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1564733 - mosquitto fails to start https://bugzilla.redhat.com/show_bug.cgi?id=1564733 --------------------------------------------------------------------------------

================================================================================ mrrescue-1.02e-8.el7 (FEDORA-EPEL-2018-708a43eccb) Arcade-style fire fighting game -------------------------------------------------------------------------------- Update Information:

New packages --------------------------------------------------------------------------------

================================================================================ myproxy-6.1.29-1.el7 (FEDORA-EPEL-2018-2c0106fe5e) Manage X.509 Public Key Infrastructure (PKI) security credentials -------------------------------------------------------------------------------- Update Information:

globus-net-manager * Fix pre-connect not using changed remote contact myproxy * Fix -Werror=format-security errors -------------------------------------------------------------------------------- ChangeLog:

* Thu May 3 2018 Mattias Ellert mattias.ellert@physics.uu.se - 6.1.29-1 - Update to 6.1.29: Fix -Werror=format-security errors * Thu Feb 8 2018 Fedora Release Engineering releng@fedoraproject.org - 6.1.28-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild * Thu Aug 3 2017 Fedora Release Engineering releng@fedoraproject.org - 6.1.28-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild * Wed Jul 26 2017 Fedora Release Engineering releng@fedoraproject.org - 6.1.28-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild --------------------------------------------------------------------------------

================================================================================ mysql-mmm-2.2.1-15.el7 (FEDORA-EPEL-2018-1698223c96) Multi-Master Replication Manager for MySQL -------------------------------------------------------------------------------- Update Information:

# Multi-Master Replication Manager for MySQL mmm_agentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager (MMM) mmm_agentd daemon 2.2.1. mmm_agentd commonly runs with root privileges and does not require authentication by default. A specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm_agentd process. An attacker that can initiate a TCP session with mmm_agentd can trigger these vulnerabilities. The impact of these vulnerabilities can be lessened by configuring mmm_agentd to require TLS mutual authentication and by using network ACLs to prevent hosts other than legitimate mmm_mond hosts from accessing mmm_agentd. For example on Linux iptables rules can be used to block access to the port mmm_agent is listening on from all hosts except the mmm_monitor. The configuration of ssl can be used where firewall rules are not practical. See Socket Documentation http://mysql-mmm.org/mysql-mmm.html#SEC58 Add to mmm_common.conf <socket> type ssl cert_file /etc/ssl/certs/www.example.com.bundle.crt key_file /etc/ssl/certs/www.example.com.key ca_file /etc/ssl/certs/ca-bundle.crt # or ca-certificates.crt </socket> Now only those with access to the private key can send commands. Whilst your web server certificate will do the job, you may consider registering a dedicated certificate just for this task. NOTE: By now there are a some good alternatives to MySQL-MMM. Maybe you want to check out Galera Cluster which is part of MariaDB Galera Cluster and Percona XtraDB Cluster. - http://mysql-mmm.org - http://galeracluster.com/ - https://mariadb.com/kb/en/library/what-is-mariadb-galera-cluster/ - https://www.percona.com/software/mysql-database/percona-xtradb-cluster -------------------------------------------------------------------------------- ChangeLog:

* Wed May 2 2018 David Beveridge dave@bevhost.com 2.2.1-15 - Patch for mmm_agentd Remote Command Injection Vulnerabilities - TALOS-2017-0501, CVE-2017-14474 - CVE-2017-14481 - Corrected permissions on systemd unit files. -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1575161 https://bugzilla.redhat.com/show_bug.cgi?id=1575161 --------------------------------------------------------------------------------

================================================================================ nodejs-6.14.2-1.el7 (FEDORA-EPEL-2018-994322297a) JavaScript runtime -------------------------------------------------------------------------------- Update Information:

Update to Node.js 6.14.2 -------------------------------------------------------------------------------- ChangeLog:

* Thu May 3 2018 Stephen Gallagher sgallagh@redhat.com - 1:6.14.2-1 - Update to 6.14.2 - https://nodejs.org/en/blog/release/v6.14.2/ - https://nodejs.org/en/blog/release/v6.14.1/ * Fri Apr 13 2018 Rafael dos Santos rdossant@redhat.com - 1:6.14.0-2 - Use standard Fedora linker flags (bug #1543859) --------------------------------------------------------------------------------

================================================================================ nordugrid-arc-5.4.2-5.el7 (FEDORA-EPEL-2018-f120a00246) Advanced Resource Connector Grid Middleware -------------------------------------------------------------------------------- Update Information:

* Minor packaging tweaks * Backport a few out-of-bounds compiler warning fixes * python34-nordugrid-arc package for EPEL 7 -------------------------------------------------------------------------------- ChangeLog:

* Thu May 3 2018 Mattias Ellert mattias.ellert@physics.uu.se - 5.4.2-5 - Create python34-nordugrid-arc package on EPEL 7 - Add BuildRequires on gcc-c++ - Use pylint in EPEL 7 (it's back) - Adjust python dependencies for old releases * Tue Feb 20 2018 Iryna Shcherbina ishcherb@redhat.com - 5.4.2-4 - Update Python 2 dependency declarations to new packaging standards (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) * Thu Feb 8 2018 Fedora Release Engineering releng@fedoraproject.org - 5.4.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild * Fri Jan 26 2018 Mattias Ellert mattias.ellert@physics.uu.se - 5.4.2-2 - Fix out-of-bounds errors causing test failures --------------------------------------------------------------------------------

================================================================================ ocaml-labltk-8.06.4-3.el7 (FEDORA-EPEL-2018-259d39cd63) Tcl/Tk interface for OCaml -------------------------------------------------------------------------------- Update Information:

Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1568359 - ocaml-lablgl needs rebuild for rhel7.5 https://bugzilla.redhat.com/show_bug.cgi?id=1568359 --------------------------------------------------------------------------------

================================================================================ orthorobot-1.1.1-7.el7 (FEDORA-EPEL-2018-708a43eccb) A perspective based puzzle game -------------------------------------------------------------------------------- Update Information:

New packages --------------------------------------------------------------------------------

================================================================================ packmol-18.013-1.el7 (FEDORA-EPEL-2018-4d579df83d) Packing optimization for molecular dynamics simulations -------------------------------------------------------------------------------- Update Information:

First release in EPEL7. --------------------------------------------------------------------------------

================================================================================ pcc-1.1.0-1.1.20180504cvs.el7 (FEDORA-EPEL-2018-4d579df83d) The Portable C Compiler -------------------------------------------------------------------------------- Update Information:

First release in EPEL7. --------------------------------------------------------------------------------

================================================================================ python-ansible-tower-cli-3.3.0-2.el7 (FEDORA-EPEL-2018-0f6211d302) A CLI tool for Ansible Tower -------------------------------------------------------------------------------- Update Information:

Update to 3.3.0 (rhbz #1572014) -------------------------------------------------------------------------------- ChangeLog:

* Sat May 5 2018 Athmane Madjoudj athmane@fedoraproject.org - 3.3.0-2 - Requires python-setuptools in epel7 * Sat May 5 2018 Athmane Madjoudj athmane@fedoraproject.org - 3.3.0-1 - Update to 3.3.0 (rhbz #1572014) * Fri Feb 9 2018 Fedora Release Engineering releng@fedoraproject.org - 3.2.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1572014 - python-ansible-tower-cli-v3.3.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1572014 --------------------------------------------------------------------------------

================================================================================ python-dns-lexicon-2.2.2-1.el7 (FEDORA-EPEL-2018-1c74e4aa00) Manipulate DNS records on various DNS providers in a standardized/agnostic way -------------------------------------------------------------------------------- Update Information:

Update to 2.2.2. -------------------------------------------------------------------------------- ChangeLog:

* Thu May 3 2018 Eli Young elyscape@gmail.com - 2.2.2-1 - Update to 2.2.2 (#1574265) -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1574265 - python-dns-lexicon-2.2.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=1574265 --------------------------------------------------------------------------------

================================================================================ python-mpmath-1.0.0-1.el7 (FEDORA-EPEL-2018-7acb3b5454) A pure Python library for multiprecision floating-point arithmetic -------------------------------------------------------------------------------- Update Information:

Update to ten-year anniversary 1.0.0 release, mostly containing various bug fixes. See full changelog at https://github.com/fredrik- johansson/mpmath/blob/master/CHANGES -------------------------------------------------------------------------------- ChangeLog:

* Fri May 4 2018 Susi Lehtola jussilehtola@fedoraproject.org - 1.0.0-1 - Update to 1.0.0. * Fri Feb 9 2018 Fedora Release Engineering releng@fedoraproject.org - 0.19-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild * Thu Jan 25 2018 Iryna Shcherbina ishcherb@redhat.com - 0.19-11 - Update Python 2 dependency declarations to new packaging standards (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) * Sat Aug 19 2017 Zbigniew J��drzejewski-Szmek zbyszek@in.waw.pl - 0.19-10 - Python 2 binary package renamed to python2-mpmath See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 * Thu Jul 27 2017 Fedora Release Engineering releng@fedoraproject.org - 0.19-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild * Sat Feb 11 2017 Fedora Release Engineering releng@fedoraproject.org - 0.19-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild * Mon Dec 19 2016 Miro Hron��ok mhroncok@redhat.com - 0.19-7 - Rebuild for Python 3.6 * Tue Jul 19 2016 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 0.19-6 - https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Pac... * Thu Feb 4 2016 Fedora Release Engineering releng@fedoraproject.org - 0.19-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild * Tue Nov 10 2015 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 0.19-4 - Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5 * Thu Jun 18 2015 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 0.19-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1565339 - python-mpmath-1.0.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1565339 --------------------------------------------------------------------------------

================================================================================ safetyblanket-1.01-2.el7 (FEDORA-EPEL-2018-708a43eccb) Creepy blanket simulator -------------------------------------------------------------------------------- Update Information:

New packages --------------------------------------------------------------------------------

================================================================================ seamonkey-2.49.3-1.el7 (FEDORA-EPEL-2018-1ec98a14c5) Web browser, e-mail, news, IRC client, HTML editor -------------------------------------------------------------------------------- Update Information:

Update to 2.49.3 Based on the Firefox/Thunderbird ESR (extension support release) code version 52.7.3 Fixes various security issues, see https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/ and https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/ for more info. -------------------------------------------------------------------------------- ChangeLog:

* Fri May 4 2018 Dmitry Butskoy Dmitry@Butskoy.name 2.49.3-1 - update to 2.49.3 --------------------------------------------------------------------------------

================================================================================ wannier90-2.0.0-9.el7 (FEDORA-EPEL-2018-4d579df83d) Maximally-localised Wannier functions -------------------------------------------------------------------------------- Update Information:

First release in EPEL7. --------------------------------------------------------------------------------