[SECURITY] Fedora 32 Update: tomcat-9.0.31-2.fc32
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-0e42878ba7
2020-03-31 00:15:07.170546
--------------------------------------------------------------------------------
Name : tomcat
Product : Fedora 32
Version : 9.0.31
Release : 2.fc32
URL : http://tomcat.apache.org/
Summary : Apache Servlet/JSP Engine, RI for Servlet 4.0/JSP 2.3 API
Description :
Tomcat is the servlet container that is used in the official Reference
Implementation for the Java Servlet and JavaServer Pages technologies.
The Java Servlet and JavaServer Pages specifications are developed by
Sun under the Java Community Process.
Tomcat is developed in an open and participatory environment and
released under the Apache Software License version 2.0. Tomcat is intended
to be a collaboration of the best-of-breed developers from around the world.
--------------------------------------------------------------------------------
Update Information:
This update includes a rebase from 9.0.30 up to 9.0.31 which resolves one CVE
along with various other bugs/features: * rhbz#1806805 CVE-2020-1938 tomcat:
Apache Tomcat AJP File Read/Inclusion Vulnerability * rhbz#1801729
tomcat-9.0.31 is available **WARNING** - This update does *not* enforce the
change in defaults for the AJP Connector like the upstream fix does. This is
done to prevent breakage of current installations, but it is highly advised to
review your AJP Connector configuration to ensure that it is only accessible by
your proxy! For more information see the [Tomcat Security
Page](https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9....
and the [Tomcat Security Considerations
Document](https://tomcat.apache.org/tomcat-9.0-doc/security-
howto.html#Connectors).
--------------------------------------------------------------------------------
ChangeLog:
* Thu Mar 12 2020 Coty Sutherland <csutherl(a)redhat.com> - 1:9.0.31-2
- Related: rhbz#1806398 Undo changes in defaults for AJP connector (CVE-2020-1938) to prevent breakage, please update your configuration accordingly
* Thu Mar 5 2020 Coty Sutherland <csutherl(a)redhat.com> - 1:9.0.31-1
- Update to 9.0.31
- Resolves: rhbz#1806398 - CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-0e42878ba7' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 2 months
Fedora 32 Update: libvirt-python-6.1.0-1.fc32
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-a7cf97e07a
2020-03-31 00:15:07.170527
--------------------------------------------------------------------------------
Name : libvirt-python
Product : Fedora 32
Version : 6.1.0
Release : 1.fc32
URL : http://libvirt.org
Summary : The libvirt virtualization API python3 binding
Description :
The libvirt-python package contains a module that permits applications
written in the Python programming language to use the interface
supplied by the libvirt library to use the virtualization capabilities
of recent versions of Linux (and other OSes).
--------------------------------------------------------------------------------
Update Information:
Update to version 6.1.0
--------------------------------------------------------------------------------
ChangeLog:
* Wed Mar 4 2020 Cole Robinson <crobinso(a)redhat.com> - 6.1.0-1
- Update to version 6.1.0
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-a7cf97e07a' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 2 months
Fedora 32 Update: authselect-1.2-1.fc32
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-9f8d3d996d
2020-03-31 00:15:07.170506
--------------------------------------------------------------------------------
Name : authselect
Product : Fedora 32
Version : 1.2
Release : 1.fc32
URL : https://github.com/authselect/authselect
Summary : Configures authentication and identity sources from supported profiles
Description :
Authselect is designed to be a replacement for authconfig but it takes
a different approach to configure the system. Instead of letting
the administrator build the PAM stack with a tool (which may potentially
end up with a broken configuration), it would ship several tested stacks
(profiles) that solve a use-case and are well tested and supported.
At the same time, some obsolete features of authconfig are not
supported by authselect.
--------------------------------------------------------------------------------
Update Information:
Rebase to latest upstream release. Release notes:
https://github.com/authselect/authselect/releases/tag/1.2
--------------------------------------------------------------------------------
ChangeLog:
* Wed Mar 4 2020 Pavel B��ezina <pbrezina(a)redhat.com> - 1.2-1
- Rebase to 1.2
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1745136 - no support for UID_MIN in /etc/login.defs
https://bugzilla.redhat.com/show_bug.cgi?id=1745136
[ 2 ] Bug #1785596 - authselect & recovering to a clean state?
https://bugzilla.redhat.com/show_bug.cgi?id=1785596
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-9f8d3d996d' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 2 months
Fedora 32 Update: uid_wrapper-1.2.7-3.fc32
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-3435693c7f
2020-03-31 00:15:07.170439
--------------------------------------------------------------------------------
Name : uid_wrapper
Product : Fedora 32
Version : 1.2.7
Release : 3.fc32
URL : http://cwrap.org/
Summary : A wrapper for privilege separation
Description :
Some projects like a file server need privilege separation to be able to switch
to the connection user and do file operations. uid_wrapper convincingly lies
to the application letting it believe it is operating as root and even
switching between UIDs and GIDs as needed.
To use it set the following environment variables:
LD_PRELOAD=libuid_wrapper.so
UID_WRAPPER=1
This package doesn't have a devel package cause this project is for
development/testing.
--------------------------------------------------------------------------------
Update Information:
Fix invalid library path in cmake configuration file (bz#1809275)
--------------------------------------------------------------------------------
ChangeLog:
* Tue Mar 3 2020 Anderson Sasaki <ansasaki(a)redhat.com> - 1.2.7-3
- Fix invalid library path in cmake configuration file (bz#1809275)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1809275 - Invalid data provided in uid_wrapper-config.cmake
https://bugzilla.redhat.com/show_bug.cgi?id=1809275
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-3435693c7f' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 2 months
Fedora 31 Update: libreoffice-6.3.5.2-3.fc31
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-8f74760060
2020-03-30 01:49:08.331390
--------------------------------------------------------------------------------
Name : libreoffice
Product : Fedora 31
Version : 6.3.5.2
Release : 3.fc31
URL : http://www.libreoffice.org/
Summary : Free Software Productivity Suite
Description :
LibreOffice is an Open Source, community-developed, office productivity suite.
It includes the key desktop applications, such as a word processor,
spreadsheet, presentation manager, formula editor and drawing program, with a
user interface and feature set similar to other office suites. Sophisticated
and flexible, LibreOffice also works transparently with a variety of file
formats, including Microsoft Office File Formats.
--------------------------------------------------------------------------------
Update Information:
- selecting multiple slides in impress and using the print dialog didn't
automatically fill in the expected range
--------------------------------------------------------------------------------
ChangeLog:
* Fri Mar 27 2020 Caol��n McNamara <caolanm(a)redhat.com> - 1:6.3.5.2-3
- selecting multiple slides and using print dlg doesn't fill in range
* Mon Mar 23 2020 Stephan Bergmann <sbergman(a)redhat.com> - 1:6.3.5.2-2
- Rebuilt for Flatpak
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-8f74760060' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 2 months
Fedora 31 Update: wabt-1.0.13-1.fc31
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-b24705762e
2020-03-30 01:49:08.331376
--------------------------------------------------------------------------------
Name : wabt
Product : Fedora 31
Version : 1.0.13
Release : 1.fc31
URL : https://github.com/WebAssembly/wabt
Summary : The WebAssembly Binary Toolkit
Description :
WABT (we pronounce it "wabbit") is a suite of tools for WebAssembly. These tools
are intended for use in (or for development of) toolchains or other systems that
want to manipulate WebAssembly files. Unlike the WebAssembly spec interpreter
(which is written to be as simple, declarative and "speccy" as possible), they
are written in C/C++ and designed for easier integration into other systems.
Unlike Binaryen these tools do not aim to provide an optimization platform or a
higher-level compiler target; instead they aim for full fidelity and compliance
with the spec (e.g. 1:1 round-trips with no changes to instructions).
--------------------------------------------------------------------------------
Update Information:
This update includes initial WASM C API implementation and many bug fixes.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Mar 20 2020 Dominik Mierzejewski <rpm(a)greysector.net> 1.0.13-1
- update to 1.0.13 (#1792557)
- drop obsolete patch and work-arounds
- bundle wasm-c-api (only wasm.h used for build)
- double test timeout again to prevent failures on armv7hl
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1792557 - wabt-1.0.13 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1792557
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-b24705762e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 2 months
Fedora 31 Update: numix-icon-theme-0.1.0-24.20200320.gitea068b4.fc31
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-9faaff5f27
2020-03-30 01:49:08.331361
--------------------------------------------------------------------------------
Name : numix-icon-theme
Product : Fedora 31
Version : 0.1.0
Release : 24.20200320.gitea068b4.fc31
URL : https://github.com/numixproject/numix-icon-theme
Summary : Numix Project icon theme
Description :
Numix is the official icon theme from the Numix project.
It is heavily inspired by, and based upon parts of the Elementary,
Humanity and Gnome icon themes.
--------------------------------------------------------------------------------
Update Information:
Update to release 20.03.20: * mimetype symlinks * mesonbuild symlinks *
More geolocation stuff
--------------------------------------------------------------------------------
ChangeLog:
* Sat Mar 21 2020 Brendan Early <mymindstorm(a)evermiss.net> - 0.1.0-24.20200320.gitea068b4
- Update to release 20.03.20
* Wed Jan 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.1.0-23.20190920.gitcfef86f
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1815699 - numix-icon-theme-20.03.20 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1815699
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-9faaff5f27' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 2 months
Fedora 31 Update: sgtk-menu-1.3.1-3.fc31
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-ee6dd5270c
2020-03-30 01:49:08.331345
--------------------------------------------------------------------------------
Name : sgtk-menu
Product : Fedora 31
Version : 1.3.1
Release : 3.fc31
URL : https://github.com/nwg-piotr/sgtk-menu
Summary : GTK launcher for sway & other WMs
Description :
This project is an attempt to create a launcher, that behaves decently on sway,
but also works on other window managers. It may or may not work on some DEs - I
don't care much about it. For what I managed to test so far, see the
Compatibility chart.
--------------------------------------------------------------------------------
Update Information:
Initial package
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1807337 - Review Request: sgtk-menu - GTK launcher for sway & other WMs
https://bugzilla.redhat.com/show_bug.cgi?id=1807337
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-ee6dd5270c' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 2 months
Fedora 31 Update: golang-github-logrusorgru-aurora-2.0-1.fc31
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-ddf5bbe9da
2020-03-30 01:49:08.331330
--------------------------------------------------------------------------------
Name : golang-github-logrusorgru-aurora
Product : Fedora 31
Version : 2.0
Release : 1.fc31
URL : https://github.com/logrusorgru/aurora
Summary : Golang ultimate ANSI-colors that supports Printf/Sprintf methods
Description :
Golang ultimate ANSI-colors that supports Printf/Sprintf methods.
--------------------------------------------------------------------------------
Update Information:
Initial package for Fedora
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1808287 - Review Request: golang-github-logrusorgru-aurora - Golang ultimate ANSI-colors that supports Printf/Sprintf methods
https://bugzilla.redhat.com/show_bug.cgi?id=1808287
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-ddf5bbe9da' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 2 months
[SECURITY] Fedora 31 Update: libmodsecurity-3.0.3-6.fc31
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-dc9aee5510
2020-03-30 01:49:08.331314
--------------------------------------------------------------------------------
Name : libmodsecurity
Product : Fedora 31
Version : 3.0.3
Release : 6.fc31
URL : https://www.modsecurity.org/
Summary : A library that loads/interprets rules written in the ModSecurity SecRules
Description :
Libmodsecurity is one component of the ModSecurity v3 project.
The library codebase serves as an interface to ModSecurity Connectors
taking in web traffic and applying traditional ModSecurity processing.
In general, it provides the capability to load/interpret rules written
in the ModSecurity SecRules format and apply them to HTTP content provided
by your application via Connectors.
--------------------------------------------------------------------------------
Update Information:
Fix DoS vulnerability (CVE-2019-19886, RHBZ #1801720 / #1801719)
--------------------------------------------------------------------------------
ChangeLog:
* Sat Mar 21 2020 Othman Madjoudj <athmane(a)fedoraproject.org> - 3.0.3-6
- Fix DoS vulnerability (CVE-2019-19886, RHBZ #1801720 / #1801719)
* Wed Jan 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.0.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1801719 - CVE-2019-19886 libmodsecurity: denial of service in Transaction::addRequestHeader in transaction.cc [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1801719
[ 2 ] Bug #1801720 - CVE-2019-19886 libmodsecurity: denial of service in Transaction::addRequestHeader in transaction.cc [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=1801720
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-dc9aee5510' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 2 months