--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2024-3e437ee2d0
2024-03-31 00:46:13.292419
--------------------------------------------------------------------------------
Name : pandoc
Product : Fedora EPEL 9
Version : 2.14.0.3
Release : 17.el9
URL :
https://hackage.haskell.org/package/pandoc
Summary : Conversion between markup formats
Description :
Pandoc is a Haskell library for converting from one markup format to another,
and a command-line tool that uses this library. It can read several dialects of
Markdown and (subsets of) HTML, reStructuredText, LaTeX, DocBook, JATS,
MediaWiki markup, DokuWiki markup, TWiki markup, TikiWiki markup, Jira markup,
Creole 1.0, Haddock markup, OPML, Emacs Org-Mode, Emacs Muse, txt2tags, ipynb
(Jupyter notebooks), Vimwiki, Word Docx, ODT, EPUB, FictionBook2, roff man,
Textile, BibTeX, BibLaTeX, CSL JSON, , and CSV, and it can write Markdown,
reStructuredText, XHTML, HTML 5, LaTeX, ConTeXt, DocBook, JATS, OPML, TEI,
OpenDocument, ODT, Word docx, PowerPoint pptx, RTF, MediaWiki, DokuWiki, XWiki,
ZimWiki, Textile, Jira, roff man, roff ms, plain text, Emacs Org-Mode,
AsciiDoc, Haddock markup, EPUB (v2 and v3), ipynb, FictionBook2, InDesign ICML,
Muse, CSL JSON, LaTeX beamer slides, and several kinds of HTML/JavaScript slide
shows (S5, Slidy, Slideous, DZSlides, reveal.js).
In contrast to most existing tools for converting Markdown to HTML, pandoc has
a modular design: it consists of a set of readers, which parse text in a given
format and produce a native representation of the document, and a set of
writers, which convert this native representation into a target format.
Thus, adding an input or output format requires only adding a reader or writer.
For pdf output please also install pandoc-pdf or weasyprint.
--------------------------------------------------------------------------------
Update Information:
backport pandoc fixes for CVE-2023-35936 and CVE-2023-38745
--------------------------------------------------------------------------------
ChangeLog:
* Fri Mar 22 2024 Jens Petersen <petersen(a)redhat.com> - 2.14.0.3-17
- backport fixes for CVE-2023-35936 and CVE-2023-38745
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2220872 - TRIAGE pandoc: TRIAGE_CVE-2023-35936 pandoc: allows attacker to
create or overwrite arbitrary files on the system [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2220872
[ 2 ] Bug #2227033 - CVE-2023-38745 pandoc: allows attacker to create or overwrite
arbitrary files on the system [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2227033
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update pandoc' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------