[Bug 2052682] New: CVE-2022-24303 python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related action
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2052682
Bug ID: 2052682
Summary: CVE-2022-24303 python-pillow: temporary directory with
a space character allows removal of unrelated file
after im.show() and related action
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: bdettelb(a)redhat.com, cstratak(a)redhat.com,
epel-packagers-sig(a)lists.fedoraproject.org,
infra-sig(a)lists.fedoraproject.org,
manisandro(a)gmail.com, miminar(a)redhat.com,
orion(a)nwra.com, python-maint(a)redhat.com,
python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com
Target Milestone: ---
Classification: Other
If the path to the temporary directory on Linux or macOS contained a space,
this would break removal of the temporary image file after im.show() (and
related actions), and potentially remove an unrelated file. This been present
since PIL.
Reference:
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2052682
1 year, 9 months
[Bug 2069709] New: python-stack-data fails to build with Python 3.11: executing.executing.NotOneValueFound: Expected one value, found 0
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2069709
Bug ID: 2069709
Summary: python-stack-data fails to build with Python 3.11:
executing.executing.NotOneValueFound: Expected one
value, found 0
Product: Fedora
Version: rawhide
Status: NEW
Component: python-stack-data
Assignee: lbalhar(a)redhat.com
Reporter: thrnciar(a)redhat.com
CC: epel-packagers-sig(a)lists.fedoraproject.org,
lbalhar(a)redhat.com, mhroncok(a)redhat.com,
michel(a)michel-slm.name, thrnciar(a)redhat.com
Blocks: 2016048 (PYTHON3.11)
Target Milestone: ---
Classification: Fedora
python-stack-data fails to build with Python 3.11.0a6.
=================================== FAILURES
===================================
_________________________________ test_example
_________________________________
def test_example():
from .samples.example import bar
> result = bar()
tests/test_core.py:573:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
tests/samples/example.py:27: in bar
exec("result = foo()", globals(), names)
<string>:1: in <module>
???
tests/samples/example.py:20: in foo
result = print_stack(
tests/samples/example.py:35: in print_stack
for frame_info in list(FrameInfo.stack_data(frame, options))[-3:]:
/usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__
return self.send(None)
/usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send
value = self.__wrapped.send(obj)
stack_data/core.py:565: in stack_data
yield from collapse_repeated(
stack_data/utils.py:84: in collapse_repeated
yield from map(mapper, original_group)
stack_data/core.py:555: in mapper
return cls(f, options)
/usr/lib/python3.11/site-packages/typeguard/__init__.py:1033: in wrapper
retval = func(*args, **kwargs)
stack_data/core.py:520: in __init__
self.executing = Source.executing(frame_or_tb)
/usr/lib/python3.11/site-packages/executing/executing.py:335: in executing
node = find_node(lasti)
/usr/lib/python3.11/site-packages/executing/executing.py:321: in find_node
return only(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
it = <generator object Source.executing.<locals>.find_node.<locals>.<genexpr>
at 0x7f8a614b36a0>
def only(it):
if hasattr(it, '__len__'):
if len(it) != 1:
raise NotOneValueFound('Expected one value, found %s' %
len(it))
# noinspection PyTypeChecker
return list(it)[0]
lst = tuple(islice(it, 2))
if len(lst) == 0:
> raise NotOneValueFound('Expected one value, found 0')
E executing.executing.NotOneValueFound: Expected one value, found 0
/usr/lib/python3.11/site-packages/executing/executing.py:164: NotOneValueFound
____________________________ test_pygments_example
_____________________________
def test_pygments_example():
from .samples.pygments_example import bar
> result = bar()
tests/test_core.py:618:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
tests/samples/pygments_example.py:17: in bar
@deco
tests/samples/pygments_example.py:26: in deco
f.result = print_stack()
tests/samples/pygments_example.py:43: in print_stack
for frame_info in list(FrameInfo.stack_data(frame, options))[-2:]:
/usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__
return self.send(None)
/usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send
value = self.__wrapped.send(obj)
stack_data/core.py:565: in stack_data
yield from collapse_repeated(
stack_data/utils.py:84: in collapse_repeated
yield from map(mapper, original_group)
stack_data/core.py:555: in mapper
return cls(f, options)
/usr/lib/python3.11/site-packages/typeguard/__init__.py:1033: in wrapper
retval = func(*args, **kwargs)
stack_data/core.py:520: in __init__
self.executing = Source.executing(frame_or_tb)
/usr/lib/python3.11/site-packages/executing/executing.py:354: in executing
opname(index - 2) == "PRECALL_FUNCTION"
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
i = 44
def opname(i):
> return bc_list[i // 2].opname
E IndexError: list index out of range
/usr/lib/python3.11/site-packages/executing/executing.py:346: IndexError
_________________________________ test_example
_________________________________
n = 0
def foo(n=5):
if n > 0:
return foo(n - 1)
x = 1
lst = (
[
x,
]
+ []
+ []
+ []
+ []
+ []
)
try:
> return int(str(lst))
E ValueError: invalid literal for int() with base 10: '[1]'
tests/samples/formatter_example.py:21: ValueError
During handling of the above exception, another exception occurred:
n = 0
def foo(n=5):
if n > 0:
return foo(n - 1)
x = 1
lst = (
[
x,
]
+ []
+ []
+ []
+ []
+ []
)
try:
return int(str(lst))
except:
try:
> return 1 / 0
E ZeroDivisionError: division by zero
tests/samples/formatter_example.py:24: ZeroDivisionError
The above exception was the direct cause of the following exception:
capsys = <_pytest.capture.CaptureFixture object at 0x7f8a618fc490>
def test_example(capsys):
from .samples.formatter_example import bar, print_stack1,
format_stack1, format_frame, f_string
@contextmanager
def check_example(name):
yield
stderr = capsys.readouterr().err
compare_to_file(stderr, name)
with check_example("variables"):
try:
> bar()
tests/test_formatter.py:40:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
def bar():
> exec("foo()")
tests/samples/formatter_example.py:30:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
> ???
<string>:1:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
n = 5
def foo(n=5):
if n > 0:
> return foo(n - 1)
tests/samples/formatter_example.py:8:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
n = 4
def foo(n=5):
if n > 0:
> return foo(n - 1)
tests/samples/formatter_example.py:8:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
n = 3
def foo(n=5):
if n > 0:
> return foo(n - 1)
tests/samples/formatter_example.py:8:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
n = 2
def foo(n=5):
if n > 0:
> return foo(n - 1)
tests/samples/formatter_example.py:8:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
n = 1
def foo(n=5):
if n > 0:
> return foo(n - 1)
tests/samples/formatter_example.py:8:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
n = 0
def foo(n=5):
if n > 0:
return foo(n - 1)
x = 1
lst = (
[
x,
]
+ []
+ []
+ []
+ []
+ []
)
try:
return int(str(lst))
except:
try:
return 1 / 0
except Exception as e:
> raise TypeError from e
E TypeError
tests/samples/formatter_example.py:26: TypeError
During handling of the above exception, another exception occurred:
capsys = <_pytest.capture.CaptureFixture object at 0x7f8a618fc490>
def test_example(capsys):
from .samples.formatter_example import bar, print_stack1,
format_stack1, format_frame, f_string
@contextmanager
def check_example(name):
yield
stderr = capsys.readouterr().err
compare_to_file(stderr, name)
with check_example("variables"):
try:
bar()
except Exception:
> MyFormatter(show_variables=True).print_exception()
tests/test_formatter.py:42:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
stack_data/formatting.py:72: in print_exception
self.print_lines(self.format_exception(e), file=file)
stack_data/formatting.py:83: in print_lines
for line in lines:
/usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__
return self.send(None)
/usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send
value = self.__wrapped.send(obj)
stack_data/formatting.py:100: in format_exception
yield from self.format_stack(e.__traceback__)
/usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__
return self.send(None)
/usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send
value = self.__wrapped.send(obj)
stack_data/formatting.py:107: in format_stack
yield from self.format_stack_data(
/usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__
return self.send(None)
/usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send
value = self.__wrapped.send(obj)
stack_data/formatting.py:118: in format_stack_data
for item in stack:
/usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__
return self.send(None)
/usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send
value = self.__wrapped.send(obj)
stack_data/core.py:565: in stack_data
yield from collapse_repeated(
stack_data/utils.py:84: in collapse_repeated
yield from map(mapper, original_group)
stack_data/core.py:555: in mapper
return cls(f, options)
/usr/lib/python3.11/site-packages/typeguard/__init__.py:1033: in wrapper
retval = func(*args, **kwargs)
stack_data/core.py:520: in __init__
self.executing = Source.executing(frame_or_tb)
/usr/lib/python3.11/site-packages/executing/executing.py:335: in executing
node = find_node(lasti)
/usr/lib/python3.11/site-packages/executing/executing.py:321: in find_node
return only(
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
it = <generator object Source.executing.<locals>.find_node.<locals>.<genexpr>
at 0x7f8a5ef609a0>
def only(it):
if hasattr(it, '__len__'):
if len(it) != 1:
raise NotOneValueFound('Expected one value, found %s' %
len(it))
# noinspection PyTypeChecker
return list(it)[0]
lst = tuple(islice(it, 2))
if len(lst) == 0:
> raise NotOneValueFound('Expected one value, found 0')
E executing.executing.NotOneValueFound: Expected one value, found 0
/usr/lib/python3.11/site-packages/executing/executing.py:164: NotOneValueFound
----------------------------- Captured stderr call
-----------------------------
Traceback (most recent call last):
File "formatter_example.py", line 21, in foo
9 | x = 1
10 | lst = (
11 | [
12 | x,
(...)
18 | + []
19 | )
20 | try:
--> 21 | return int(str(lst))
^^^^^^^^^^^^^
22 | except:
[
x,
] = [1]
[
x,
]
+ [] = [1]
[
x,
]
+ []
+ [] = [1]
[
x,
]
+ []
+ []
+ [] = [1]
[
x,
]
+ []
+ []
+ []
+ [] = [1]
[
x,
]
+ []
+ []
+ []
+ []
+ [] = [1]
lst = [1]
n = 0
n - 1 = -1
n > 0 = False
str(lst) = '[1]'
x = 1
ValueError: invalid literal for int() with base 10: '[1]'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "formatter_example.py", line 24, in foo
21 | return int(str(lst))
22 | except:
23 | try:
--> 24 | return 1 / 0
^^^^^
25 | except Exception as e:
[
x,
] = [1]
[
x,
]
+ [] = [1]
[
x,
]
+ []
+ [] = [1]
[
x,
]
+ []
+ []
+ [] = [1]
[
x,
]
+ []
+ []
+ []
+ [] = [1]
[
x,
]
+ []
+ []
+ []
+ []
+ [] = [1]
lst = [1]
n = 0
n - 1 = -1
n > 0 = False
str(lst) = '[1]'
x = 1
ZeroDivisionError: division by zero
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "formatter_example.py", line 30, in bar
29 | def bar():
--> 30 | exec("foo()")
^^^^^^^^^^^^^
=============================== warnings summary
===============================
../../../../usr/lib64/python3.11/site-packages/pyximport/pyximport.py:51
/usr/lib64/python3.11/site-packages/pyximport/pyximport.py:51:
DeprecationWarning: the imp module is deprecated in favour of importlib and
slated for removal in Python 3.12; see the module's documentation for
alternative uses
import imp
-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
=========================== short test summary info
============================
FAILED tests/test_core.py::test_example -
executing.executing.NotOneValueFoun...
FAILED tests/test_core.py::test_pygments_example - IndexError: list index
out...
FAILED tests/test_formatter.py::test_example -
executing.executing.NotOneValu...
=================== 3 failed, 13 passed, 1 warning in 3.03s
====================
ERROR: InvocationError for command /usr/bin/pytest (exited with code 1)
___________________________________ summary
____________________________________
ERROR: py311: commands failed
https://docs.python.org/3.11/whatsnew/3.11.html
For the build logs, see:
https://copr-be.cloud.fedoraproject.org/results/@python/python3.11/fedora...
For all our attempts to build python-stack-data with Python 3.11, see:
https://copr.fedorainfracloud.org/coprs/g/python/python3.11/package/pytho...
Testing and mass rebuild of packages is happening in copr. You can follow these
instructions to test locally in mock if your package builds with Python 3.11:
https://copr.fedorainfracloud.org/coprs/g/python/python3.11/
Let us know here if you have any questions.
Python 3.11 is planned to be included in Fedora 37. To make that update
smoother, we're building Fedora packages with all pre-releases of Python 3.11.
A build failure prevents us from testing all dependent packages (transitive
[Build]Requires), so if this package is required a lot, it's important for us
to get it fixed soon.
We'd appreciate help from the people who know this package best, but if you
don't want to work on this now, let us know so we can try to work around it on
our side.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2016048
[Bug 2016048] Python 3.11
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2069709
1 year, 10 months
[Bug 2068421] New: python-executing fails to build with Python 3.11: InvocationError: self.get_executing(inspect.currentframe().f_back)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2068421
Bug ID: 2068421
Summary: python-executing fails to build with Python 3.11:
InvocationError:
self.get_executing(inspect.currentframe().f_back)
Product: Fedora
Version: rawhide
Status: NEW
Component: python-executing
Assignee: rominf(a)aiven.io
Reporter: thrnciar(a)redhat.com
CC: epel-packagers-sig(a)lists.fedoraproject.org,
lbalhar(a)redhat.com, mhroncok(a)redhat.com,
paul.wouters(a)aiven.io, rominf(a)aiven.io,
thrnciar(a)redhat.com
Blocks: 2016048 (PYTHON3.11)
Target Milestone: ---
Link ID: Github alexmojaki/executing/pull/31
Classification: Fedora
python-executing fails to build with Python 3.11.0a6.
+ /usr/bin/python3 -m tox --current-env -q --recreate -e py311
Traceback (most recent call last):
File
"/builddir/build/BUILDROOT/python-executing-0.8.2-2.fc37.x86_64/usr/lib/python3.11/site-packages/executing/executing.py",
line 317, in executing
args = executing_cache[key]
~~~~~~~~~~~~~~~^^^^^
KeyError: (<code object <module> at 0x7fb5361790d0, file
"/builddir/build/BUILD/executing-0.8.2/tests/test_main.py", line 1>,
140416273322192, 552)
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/builddir/build/BUILD/executing-0.8.2/tests/test_main.py", line 682, in
<module>
assert tester([1, 2, 3]) == [1, 2, 3]
^^^^^^^^^^^^^^^^^
File "/builddir/build/BUILD/executing-0.8.2/tests/utils.py", line 40, in
__call__
ex = self.get_executing(inspect.currentframe().f_back)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/builddir/build/BUILD/executing-0.8.2/tests/utils.py", line 28, in
get_executing
return Source.executing(frame)
^^^^^^^^^^^^^^^^^^^^^^^
File
"/builddir/build/BUILDROOT/python-executing-0.8.2-2.fc37.x86_64/usr/lib/python3.11/site-packages/executing/executing.py",
line 372, in executing
args = find(source=cls.for_frame(frame), retry_cache=True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File
"/builddir/build/BUILDROOT/python-executing-0.8.2-2.fc37.x86_64/usr/lib/python3.11/site-packages/executing/executing.py",
line 349, in find
node_finder = NodeFinder(frame, stmts, tree, lasti)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File
"/builddir/build/BUILDROOT/python-executing-0.8.2-2.fc37.x86_64/usr/lib/python3.11/site-packages/executing/executing.py",
line 626, in __init__
raise RuntimeError(op_name)
^^^^^^^^^^^^^^^^^^^^^^^^^^^
RuntimeError: CALL
ERROR: InvocationError for command
/builddir/build/BUILD/executing-0.8.2/.tox/py311/bin/python tests/test_main.py
(exited with code 1)
___________________________________ summary
____________________________________
ERROR: py311: commands failed
error: Bad exit status from /var/tmp/rpm-tmp.m2JoFZ (%check)
Bad exit status from /var/tmp/rpm-tmp.m2JoFZ (%check)
Upstream has WIP PR for Python 3.11 suport.
The PyFrameObject structure member has been moved to the internal C API
headers.
While the documentation notes that the PyFrameObject fields are subject to
change at any time, they have been stable for a long time and were used in
several popular extensions.
In Python 3.11, the frame struct was reorganized to allow performance
optimizations. Some fields were removed entirely, as they were details of the
old implementation.
PyFrameObject fields:
f_back: use PyFrame_GetBack().
f_blockstack: removed.
f_builtins: use PyObject_GetAttrString((PyObject*)frame, "f_builtins").
f_code: use PyFrame_GetCode().
f_gen: removed.
f_globals: use PyObject_GetAttrString((PyObject*)frame, "f_globals").
f_iblock: removed.
f_lasti: use PyObject_GetAttrString((PyObject*)frame, "f_lasti"). Code
using f_lasti with PyCode_Addr2Line() must use PyFrame_GetLineNumber() instead.
f_lineno: use PyFrame_GetLineNumber()
f_locals: use PyObject_GetAttrString((PyObject*)frame, "f_locals").
f_stackdepth: removed.
f_state: no public API (renamed to f_frame.f_state).
f_trace: no public API.
f_trace_lines: use PyObject_GetAttrString((PyObject*)frame,
"f_trace_lines") (it also be modified).
f_trace_opcodes: use PyObject_GetAttrString((PyObject*)frame,
"f_trace_opcodes") (it also be modified).
f_localsplus: no public API (renamed to f_frame.localsplus).
f_valuestack: removed.
The Python frame object is now created lazily. A side effect is that the f_back
member must not be accessed directly, since its value is now also computed
lazily. The PyFrame_GetBack() function must be called instead.
https://docs.python.org/3.11/whatsnew/3.11.html
For the build logs, see:
https://copr-be.cloud.fedoraproject.org/results/@python/python3.11/fedora...
For all our attempts to build python-executing with Python 3.11, see:
https://copr.fedorainfracloud.org/coprs/g/python/python3.11/package/pytho...
Testing and mass rebuild of packages is happening in copr. You can follow these
instructions to test locally in mock if your package builds with Python 3.11:
https://copr.fedorainfracloud.org/coprs/g/python/python3.11/
Let us know here if you have any questions.
Python 3.11 is planned to be included in Fedora 37. To make that update
smoother, we're building Fedora packages with all pre-releases of Python 3.11.
A build failure prevents us from testing all dependent packages (transitive
[Build]Requires), so if this package is required a lot, it's important for us
to get it fixed soon.
We'd appreciate help from the people who know this package best, but if you
don't want to work on this now, let us know so we can try to work around it on
our side.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2016048
[Bug 2016048] Python 3.11
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2068421
1 year, 10 months
[Bug 2067098] New: ImageMagick: heap-buffer-overflow in PushShortPixel of quantum-private.h [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2067098
Bug ID: 2067098
Summary: ImageMagick: heap-buffer-overflow in PushShortPixel of
quantum-private.h [fedora-all]
Product: Fedora
Version: 35
Status: NEW
Component: ImageMagick
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: luya_tfz(a)thefinalzone.net
Reporter: trathi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: blaise(a)gmail.com, dcavalca(a)fb.com,
epel-packagers-sig(a)lists.fedoraproject.org,
fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net,
michel(a)michel-slm.name, ngompa13(a)gmail.com,
pampelmuse(a)gmx.at, sergio(a)serjux.com,
troy(a)troycurtisjr.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2067098
1 year, 11 months
[Bug 2064538] New: ImageMagick: heap-use-after-free in RelinquishDCMInfo of dcm.c
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2064538
Bug ID: 2064538
Summary: ImageMagick: heap-use-after-free in RelinquishDCMInfo
of dcm.c
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: trathi(a)redhat.com
CC: blaise(a)gmail.com, dcavalca(a)fb.com,
epel-packagers-sig(a)lists.fedoraproject.org,
fedora(a)famillecollet.com, jhorak(a)redhat.com,
luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name,
ngompa13(a)gmail.com, pampelmuse(a)gmx.at,
sergio(a)serjux.com, troy(a)troycurtisjr.com
Target Milestone: ---
Classification: Other
A heap-use-after-free vulnerability was found in ImageMagick's
RelinquishDCMInfo function of dcm.c.
References:
https://github.com/ImageMagick/ImageMagick/issues/4947
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2064538
1 year, 11 months
[Bug 2066640] New: ImageMagick: heap-use-after-free in RelinquishDCMInfo of dcm.c [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2066640
Bug ID: 2066640
Summary: ImageMagick: heap-use-after-free in RelinquishDCMInfo
of dcm.c [fedora-all]
Product: Fedora
Version: 35
Status: NEW
Component: ImageMagick
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: luya_tfz(a)thefinalzone.net
Reporter: trathi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: blaise(a)gmail.com, dcavalca(a)fb.com,
epel-packagers-sig(a)lists.fedoraproject.org,
fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net,
michel(a)michel-slm.name, ngompa13(a)gmail.com,
pampelmuse(a)gmx.at, sergio(a)serjux.com,
troy(a)troycurtisjr.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2066640
1 year, 11 months
[Bug 2058882] New: ipython-8.1.0 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2058882
Bug ID: 2058882
Summary: ipython-8.1.0 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: ipython
Keywords: FutureFeature, Triaged
Assignee: lbalhar(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: dcantrell(a)redhat.com,
epel-packagers-sig(a)lists.fedoraproject.org,
lbalhar(a)redhat.com, mhroncok(a)redhat.com,
michel(a)michel-slm.name, mrunge(a)redhat.com,
orion(a)nwra.com, python-sig(a)lists.fedoraproject.org,
tomspur(a)fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 8.1.0
Current version/release in rawhide: 8.0.1-1.fc36
URL: https://ipython.org/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from Anitya:
https://release-monitoring.org/project/1399/
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2058882
1 year, 11 months
[Bug 2058448] New: rocksdb: rebuild for gflags update in c8s
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2058448
Bug ID: 2058448
Summary: rocksdb: rebuild for gflags update in c8s
Product: Fedora EPEL
Version: epel8
Status: NEW
Component: rocksdb
Assignee: epel-packagers-sig(a)lists.fedoraproject.org
Reporter: carl(a)redhat.com
CC: dcavalca(a)fb.com,
epel-packagers-sig(a)lists.fedoraproject.org,
hegjon(a)gmail.com, mmuzila(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
In CentOS Stream 8, the gflags package was updated from 2.1.2-6.el8 to
2.2.2-1.el8 (see bug 2035143). That introduces an soname bump from
libgflags.so.2.1 to libgflags.so.2.2. rocksdb links against that soname and
must be rebuilt in epel8-next to work correctly on c8s.
Version-Release number of selected component (if applicable):
rocksdb-6.26.1-2.el8
Steps to Reproduce:
1. dnf install rocksdb (this resolves to the older gflags in the repo)
2. dnf update gflags
Actual results:
Error:
Problem: problem with installed package rocksdb-6.26.1-2.el8.x86_64
- package rocksdb-6.26.1-2.el8.x86_64 requires libgflags.so.2.1()(64bit), but
none of the providers can be installed
- cannot install both gflags-2.2.2-1.el8.x86_64 and gflags-2.1.2-6.el8.x86_64
- cannot install the best update candidate for package
gflags-2.1.2-6.el8.x86_64
(try to add '--allowerasing' to command line to replace conflicting packages or
'--skip-broken' to skip uninstallable packages or '--nobest' to use not only
best candidate packages)
Expected results:
installation of the latest gflags and rocksdb
Additional info:
This is happening in c8s now, but will also happen when RHEL 8.6 is released.
At that point it can be remediated in regular epel8.
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2058448
1 year, 11 months
[Bug 2069579] New: Please update to at least 3.7.4.3
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2069579
Bug ID: 2069579
Summary: Please update to at least 3.7.4.3
Product: Fedora EPEL
Version: epel8
Status: NEW
Component: python-typing-extensions
Assignee: michel(a)michel-slm.name
Reporter: lzachar(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
hegjon(a)gmail.com, mail(a)fabian-affolter.ch,
michel(a)michel-slm.name
Target Milestone: ---
Classification: Fedora
Description of problem:
Could we get (at least) 3.7.4.3 into the EPEL-8 please?
In the testing of tmt package we use requre which uses GitPython which tries to
import SupportsIndex.
And current packaged version of python3-typing-extensions doesn't have it yet.
Version-Release number of selected component (if applicable):
python3-typing-extensions-3.7.4.2-1.el8
Additional info:
https://github.com/teemtee/tmt/pull/1069#issuecomment-1076704492
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2069579
1 year, 11 months