-------------------------------------------------------------------------------- Fedora EPEL Update Notification FEDORA-EPEL-2020-fa8a2e97c6 2020-09-04 14:41:13.770806 --------------------------------------------------------------------------------
Name : python-waitress Product : Fedora EPEL 7 Version : 1.4.3 Release : 1.el7 URL : https://github.com/Pylons/waitress Summary : Waitress WSGI server Description : Waitress is meant to be a production-quality pure-Python WSGI server with very acceptable performance. It has no dependencies except ones which live in the Python standard library. It runs on CPython on Unix and Windows under Python 2.6+ and Python 3.3+. It is also known to run on PyPy 1.6.0+ on UNIX. It supports HTTP/1.0 and HTTP/1.1.
-------------------------------------------------------------------------------- Update Information:
Update to 1.4.3 to fix a number of CVEs: CVE-2019-16786 CVE-2019-16785 CVE-2019-16789 Note: This is a large jump in versions for epel7, but as far as I can see there's no incompatible changes in the changelog. Please test! -------------------------------------------------------------------------------- ChangeLog:
* Fri Feb 7 2020 Lorenzo Gil Sanchez lorenzo.gil.sanchez@gmail.com - 1.4.3-1 - Update to 1.4.3 Fixes bug #1785591 * Thu Jan 30 2020 Fedora Release Engineering releng@fedoraproject.org - 1.4.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Mon Jan 20 2020 Lorenzo Gil Sanchez lorenzo.gil.sanchez@gmail.com - 1.4.2-1 - Update to 1.4.2 Fixes bugs #1785591 #1789807 #1789809 #1789810 #1791415 * Thu Jan 16 2020 Lorenzo Gil Sanchez lorenzo.gil.sanchez@gmail.com - 1.4.1-1 - Update to 1.4.1 Fixes bug #1785591 * Wed Dec 25 2019 Lorenzo Gil Sanchez lorenzo.gil.sanchez@gmail.com - 1.4.0-1 - Update to 1.4.0 Fixes bug #1785591 * Sun Oct 6 2019 Kevin Fenzi kevin@scrye.com - 1.3.1-1 - Update to 1.3.1. Fixes bug #1747075 * Mon Sep 9 2019 Miro Hron��ok mhroncok@redhat.com - 1.2.1-5 - Subpackage python2-waitress has been removed See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal * Sat Aug 17 2019 Miro Hron��ok mhroncok@redhat.com - 1.2.1-4 - Rebuilt for Python 3.8 * Fri Jul 26 2019 Fedora Release Engineering releng@fedoraproject.org - 1.2.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Sat Jun 29 2019 Kevin Fenzi kevin@scrye.com - 1.2.1-2 - Remove non free docs from src.rpm and provide script to do so before upload. - Fixes bug #1684335 * Tue Feb 5 2019 Lorenzo Gil Sanchez lorenzo.gil.sanchez@gmail.com - 1.2.1-1 - Update to 1.2.1 (#1667466) * Sat Feb 2 2019 Fedora Release Engineering releng@fedoraproject.org - 1.1.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild * Sat Jul 14 2018 Fedora Release Engineering releng@fedoraproject.org - 1.1.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild * Sun Jun 17 2018 Miro Hron��ok mhroncok@redhat.com - 1.1.0-3 - Rebuilt for Python 3.7 * Fri Feb 9 2018 Fedora Release Engineering releng@fedoraproject.org - 1.1.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild * Sat Nov 11 2017 Lorenzo Gil Sanchez lorenzo.gil.sanchez@gmail.com - 1.1.0-1 - Update to 1.1.0 (#1504455) * Thu Jul 27 2017 Fedora Release Engineering releng@fedoraproject.org - 1.0.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild * Sat Feb 18 2017 Lorenzo Gil Sanchez lorenzo.gil.sanchez@gmail.com - 1.0.2-1 - Update to 1.0.2. Fixes bug #1419297 * Sat Feb 11 2017 Fedora Release Engineering releng@fedoraproject.org - 1.0.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild * Mon Dec 19 2016 Miro Hron��ok mhroncok@redhat.com - 1.0.1-2 - Rebuild for Python 3.6 * Tue Oct 25 2016 Kevin Fenzi kevin@scrye.com - 1.0.1-1 - Update to 1.0.1. Fixes bug #1387885 * Sat Sep 3 2016 Kevin Fenzi kevin@scrye.com - 1.0.0-1 - Update to 1.0.0. Fixes bug #1372330 * Tue Jul 19 2016 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 0.9.0-4 - https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Pac... * Wed Jun 29 2016 Igor Gnatenko ignatenko@redhat.com - 0.9.0-3 - Modernize spec to comply with new packaging guidelines * Thu May 26 2016 Lorenzo Gil Sanchez lorenzo.gil.sanchez@gmail.com - 0.9.0-2 - Fixed Source0 to point to new PyPi predictable URL format * Thu May 5 2016 Lorenzo Gil Sanchez lorenzo.gil.sanchez@gmail.com - 0.9.0-1 - Update to 0.9.0 - Fixed 2 warnings from fedpkg lint * Sun Apr 10 2016 Kevin Fenzi kevin@scrye.com - 0.9.0b1-1 - Update to 0.9.0b1. Fixes bug #1325661 * Mon Mar 21 2016 Lorenzo Gil Sanchez lorenzo.gil.sanchez@gmail.com - 0.9.0b0-1 - New (beta) version * Thu Feb 4 2016 Fedora Release Engineering releng@fedoraproject.org - 0.8.10-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild * Tue Nov 10 2015 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 0.8.10-2 - Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5 * Wed Sep 16 2015 Ralph Bean rbean@redhat.com - 0.8.10-1 - new version * Thu Jun 18 2015 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 0.8.9-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1468175 - Backport security fix from v1.0.0 to prevent header spoofing via underscore/dash conflation https://bugzilla.redhat.com/show_bug.cgi?id=1468175 [ 2 ] Bug #1785591 - python-waitress-1.4.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1785591 [ 3 ] Bug #1789810 - CVE-2019-16789 python-waitress: waitress: HTTP Request Smuggling through Invalid whitespace characters in headers [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1789810 [ 4 ] Bug #1791417 - CVE-2019-16786 python-waitress: waitress: HTTP request smuggling through invalid Transfer-Encoding [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1791417 [ 5 ] Bug #1791421 - CVE-2019-16785 python-waitress: waitress: HTTP request smuggling through LF vs CRLF handling [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1791421 --------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use su -c 'yum update python-waitress' at the command line. For more information, refer to "YUM", available at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7%5C /html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------