[SECURITY] Fedora EPEL 8 Update: ntfs-3g-2021.8.22-2.el8
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-bb15ff6d4d
2021-09-16 18:19:20.239806
--------------------------------------------------------------------------------
Name : ntfs-3g
Product : Fedora EPEL 8
Version : 2021.8.22
Release : 2.el8
URL : https://www.tuxera.com/company/open-source/
Summary : Linux NTFS userspace driver
Description :
NTFS-3G is a stable, open source, GPL licensed, POSIX, read/write NTFS
driver for Linux and many other operating systems. It provides safe
handling of the Windows XP, Windows Server 2003, Windows 2000, Windows
Vista, Windows Server 2008 and Windows 7 NTFS file systems. NTFS-3G can
create, remove, rename, move files, directories, hard links, and streams;
it can read and write normal and transparently compressed files, including
streams and sparse files; it can handle special files like symbolic links,
devices, and FIFOs, ACL, extended attributes; moreover it provides full
file access right and ownership support.
--------------------------------------------------------------------------------
Update Information:
Fix issue with incorrect obsoletes.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 8 2021 Tom Callaway <spot(a)fedoraproject.org> - 2:2021.8.22-2
- remove incorrect obsoletes
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2001608 - CVE-2021-33285 ntfs3g: when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur.
https://bugzilla.redhat.com/show_bug.cgi?id=2001608
[ 2 ] Bug #2001609 - CVE-2021-33286 ntfs-3g: When a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur
https://bugzilla.redhat.com/show_bug.cgi?id=2001609
[ 3 ] Bug #2001613 - CVE-2021-33287 ntfs-3g: When specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur
https://bugzilla.redhat.com/show_bug.cgi?id=2001613
[ 4 ] Bug #2001616 - CVE-2021-33289 ntfs-3g: When a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur
https://bugzilla.redhat.com/show_bug.cgi?id=2001616
[ 5 ] Bug #2001619 - CVE-2021-35266 ntfs-3g: When a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur
https://bugzilla.redhat.com/show_bug.cgi?id=2001619
[ 6 ] Bug #2001621 - CVE-2021-35267 ntfs-3g: A stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution
https://bugzilla.redhat.com/show_bug.cgi?id=2001621
[ 7 ] Bug #2001623 - CVE-2021-35268 ntfs-3g: When a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur
https://bugzilla.redhat.com/show_bug.cgi?id=2001623
[ 8 ] Bug #2001645 - CVE-2021-35269 ntfs-3g: when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur
https://bugzilla.redhat.com/show_bug.cgi?id=2001645
[ 9 ] Bug #2001649 - CVE-2021-39251 ntfs-3g: A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open
https://bugzilla.redhat.com/show_bug.cgi?id=2001649
[ 10 ] Bug #2001650 - CVE-2021-39252 ntfs-3g: A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup
https://bugzilla.redhat.com/show_bug.cgi?id=2001650
[ 11 ] Bug #2001651 - CVE-2021-39253 ntfs-3g: A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i
https://bugzilla.redhat.com/show_bug.cgi?id=2001651
[ 12 ] Bug #2001652 - CVE-2021-39254 ntfs-3g: A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow
https://bugzilla.redhat.com/show_bug.cgi?id=2001652
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update ntfs-3g' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
2 years, 9 months
Fedora EPEL 7 Update: libuv-1.42.0-2.el7
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-6680fb81a2
2021-09-15 17:54:44.859765
--------------------------------------------------------------------------------
Name : libuv
Product : Fedora EPEL 7
Version : 1.42.0
Release : 2.el7
URL : http://libuv.org/
Summary : Platform layer for node.js
Description :
libuv is a new platform layer for Node. Its purpose is to abstract IOCP on
Windows and libev on Unix systems. We intend to eventually contain all platform
differences in this library.
--------------------------------------------------------------------------------
Update Information:
Update to 1.42.0
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 2 2021 Stephen Gallagher <sgallagh(a)redhat.com> 1:1.42.0-2
- Drop use of rpmautospec for the release field
* Tue Aug 31 2021 Stephen Gallagher <sgallagh(a)redhat.com> 1:1.42.0-1
- Update to 1.42.0
* Thu Jul 22 2021 Fedora Release Engineering <releng(a)fedoraproject.org> 1:1.41.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Fri Jul 9 2021 Stephen Gallagher <sgallagh(a)redhat.com> 1:1.41.1-1
- idna: fix OOB read in punycode decoder
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1980113 - libuv-1.42.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1980113
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update libuv' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
2 years, 9 months
Fedora EPEL 7 Update: yascreen-1.86-1.el7
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-ffb7118d2f
2021-09-15 17:54:44.859662
--------------------------------------------------------------------------------
Name : yascreen
Product : Fedora EPEL 7
Version : 1.86
Release : 1.el7
URL : https://github.com/bbonev/yascreen/
Summary : Yet Another Screen Library (lib(n)curses alternative)
Description :
lib(n)curses alternative oriented towards modern terminals.
Suitable for developing terminal applications or daemons with
telnet access and terminal support.
Main features
* small footprint
* does not have external dependencies
* allows both internal and external event loop
* allows stdin/stdout or external input/output (can work over socket)
* supports basic set of telnet sequences, making it suitable for built-in
terminal interfaces for daemons
* supports a limited set of input keystroke sequences
* fully Unicode compatible (parts of this depend on wcwidth in libc)
* supports utf8 verification of input
* relies only on a limited subset of ANSI/xterm ESC sequences, making it
compatible with mostly all modern terminals (inspired by linenoise)
* there is no curses API and ancient terminal compatibility, hence less bloat
* clean API with opaque private data, usable from C/C++
--------------------------------------------------------------------------------
Update Information:
Update to latest ver 1.86
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 7 2021 Boian Bonev <bbonev(a)ipacct.com> - 1.86-1
- Update to latest ver 1.86
* Fri Jul 23 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.85-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Thu Jan 28 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.85-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update yascreen' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
2 years, 9 months
[SECURITY] Fedora EPEL 7 Update: proftpd-1.3.5e-11.el7
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-7f33ec2b58
2021-09-15 17:54:44.859753
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora EPEL 7
Version : 1.3.5e
Release : 11.el7
URL : http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by xinetd instead are included.
--------------------------------------------------------------------------------
Update Information:
This update fixes an issue of memory disclosure to RADIUS servers by mod_radius,
particularly where short passwords are used.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 7 2021 Paul Howarth <paul(a)city-fan.org> - 1.3.5e-11
- Fix memory disclosure to RADIUS servers by mod_radius (#2001690)
https://github.com/proftpd/proftpd/issues/1284
https://github.com/proftpd/proftpd/pull/1285
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2001690 - proftpd: memory disclosure to RADIUS servers by mod_radius
https://bugzilla.redhat.com/show_bug.cgi?id=2001690
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update proftpd' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
2 years, 9 months
Fedora EPEL 8 Update: python-flask-oidc-1.4.0-12.el8
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-7e278aaf2f
2021-09-15 17:33:38.499123
--------------------------------------------------------------------------------
Name : python-flask-oidc
Product : Fedora EPEL 8
Version : 1.4.0
Release : 12.el8
URL : https://github.com/puiterwijk/flask-oidc
Summary : An openID Connect support for Flask
Description :
OpenID Connect support for Flask.
This library should work with any standards compliant
OpenID Connect provider. It has been tested with:
Google+ Login, Ipsilon
--------------------------------------------------------------------------------
Update Information:
First EL-8 build
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2003858 - Please branch and build python-flask-oidc for EPEL 8
https://bugzilla.redhat.com/show_bug.cgi?id=2003858
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update python-flask-oidc' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
2 years, 9 months
Fedora EPEL 8 Update: httpie-2.5.0-1.el8
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-3989157863
2021-09-15 17:33:38.499113
--------------------------------------------------------------------------------
Name : httpie
Product : Fedora EPEL 8
Version : 2.5.0
Release : 1.el8
URL : https://httpie.org/
Summary : A Curl-like tool for humans
Description :
HTTPie is a CLI HTTP utility built out of frustration with existing tools. The
goal is to make CLI interaction with HTTP-based services as human-friendly as
possible.
HTTPie does so by providing an http command that allows for issuing arbitrary
HTTP requests using a simple and natural syntax and displaying colorized
responses.
--------------------------------------------------------------------------------
Update Information:
Update to 2.5.0
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 8 2021 Mikel Olasagasti Uranga <mikel(a)olasagasti.info> - 2.5.0-1
- Update to 2.5.0
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update httpie' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
2 years, 9 months
Fedora EPEL 8 Update: libmongocrypt-1.2.2-1.el8
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-c2314b4b43
2021-09-15 17:33:38.499104
--------------------------------------------------------------------------------
Name : libmongocrypt
Product : Fedora EPEL 8
Version : 1.2.2
Release : 1.el8
URL : https://github.com/mongodb/libmongocrypt
Summary : The companion C library for client side encryption in drivers
Description :
The companion C library for client side encryption in drivers.
--------------------------------------------------------------------------------
Update Information:
**Version 1.2.2** * Fix pkg-config and PPA build dependency on libbson. * Fix
JSON schema caching behavior when server reports no JSON schema
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 8 2021 Remi Collet <remi(a)remirepo.net> - 1.2.2-1
- update to 1.2.2
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update libmongocrypt' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
2 years, 9 months
Fedora EPEL 8 Update: acme-tiny-4.1.0-7.el8
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-aa9e9819ec
2021-09-15 17:33:38.499095
--------------------------------------------------------------------------------
Name : acme-tiny
Product : Fedora EPEL 8
Version : 4.1.0
Release : 7.el8
URL : https://github.com/diafygi/acme-tiny
Summary : Tiny auditable script to issue, renew Let's Encrypt certificates
Description :
This is a tiny, auditable script that you can throw on your server to issue and
renew Let's Encrypt certificates. Since it has to be run on your server and
have access to your private Let's Encrypt account key, I tried to make it as
tiny as possible (currently less than 200 lines). The only prerequisites are
python and openssl.
Well, that and a web server - but then you only need this with a web server.
This package adds a simple directory layout and timer service that runs
acme_tiny on installed CSRs as the acme user for privilege separation.
--------------------------------------------------------------------------------
Update Information:
Add acme-tiny-notify service to make incrond unnecessary. It still works with
existing incrond setups.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 7 2021 Stuart D. Gathman <stuart(a)gathman.org> 4.1.0-7
- Fix BZ#1839904, BZ#2000099
- enhance notify after cert update, incrond no longer needed
* Tue Mar 2 2021 Zbigniew J��drzejewski-Szmek <zbyszek(a)in.waw.pl> - 4.1.0-6
- Rebuilt for updated systemd-rpm-macros
See https://pagure.io/fesco/issue/2583.
* Mon Jan 25 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.1.0-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Mon Jul 27 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.1.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Thu Apr 9 2020 Stuart D. Gathman <stuart(a)gathman.org> 4.1.0-3
- Update README-fedora.md to describe notify.sh
- Apply selected changes from Marcel Metz <mmetz(a)adrian-broher.net>:
- Use openssl x509 -checkend parameter to determine certificate expiration
- Remove Let's Encrypt intermediate certificate
- Remove cron job used on non systemd systems
* Tue Jan 28 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.1.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2000099 - Post renewal hook not called
https://bugzilla.redhat.com/show_bug.cgi?id=2000099
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update acme-tiny' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
2 years, 9 months
Fedora EPEL 8 Update: python-ws4py-0.5.1-7.el8
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-ed298b6742
2021-09-15 17:33:38.499085
--------------------------------------------------------------------------------
Name : python-ws4py
Product : Fedora EPEL 8
Version : 0.5.1
Release : 7.el8
URL : https://ws4py.readthedocs.org/en/latest/
Summary : WebSocket client and server library
Description :
WebSocket client and server library.
--------------------------------------------------------------------------------
Update Information:
Build for EPEL8
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1989135 - Provide python3-ws4py for EPEL-8
https://bugzilla.redhat.com/show_bug.cgi?id=1989135
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update python-ws4py' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
2 years, 9 months
Fedora EPEL 8 Update: sparse-0.6.4-1.el8
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2021-41af5a335e
2021-09-15 17:33:38.499074
--------------------------------------------------------------------------------
Name : sparse
Product : Fedora EPEL 8
Version : 0.6.4
Release : 1.el8
URL : https://sparse.wiki.kernel.org
Summary : A semantic parser of source files
Description :
Sparse is a semantic parser of source files: it's neither a compiler
(although it could be used as a front-end for one) nor is it a
preprocessor (although it contains as a part of it a preprocessing
phase).
It is meant to be a small - and simple - library. Scanty and meager,
and partly because of that easy to use. It has one mission in life:
create a semantic parse tree for some arbitrary user for further
analysis. It's not a tokenizer, nor is it some generic context-free
parser. In fact, context (semantics) is what it's all about - figuring
out not just what the grouping of tokens are, but what the _types_ are
that the grouping implies.
Sparse is primarily used in the development and debugging of the Linux kernel.
--------------------------------------------------------------------------------
Update Information:
Update to 0.6.4 release.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 7 2021 Jeff Layton <jlayton(a)redhat.com> - 0.6.4-1
- Update to 0.6.4 release
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update sparse' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
2 years, 9 months