Fedora 30 Update: scap-security-guide-0.1.49-1.fc30
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-6ea0d2892b
2020-04-01 02:35:47.694903
--------------------------------------------------------------------------------
Name : scap-security-guide
Product : Fedora 30
Version : 0.1.49
Release : 1.fc30
URL : https://github.com/ComplianceAsCode/content/
Summary : Security guidance and baselines in SCAP formats
Description :
The scap-security-guide project provides a guide for configuration of the
system from the final system's security point of view. The guidance is specified
in the Security Content Automation Protocol (SCAP) format and constitutes
a catalog of practical hardening advice, linked to government requirements
where applicable. The project bridges the gap between generalized policy
requirements and specific implementation guidelines. The Fedora system
administrator can use the oscap CLI tool from openscap-scanner package, or the
scap-workbench GUI tool from scap-workbench package to verify that the system
conforms to provided guideline. Refer to scap-security-guide(8) manual page for
further information.
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream SCAP-Security-Guide-0.1.49 release:
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 23 2020 Watson Sato <wsato(a)redhat.com> - 0.1.49-1
- Update to latest upstream SCAP-Security-Guide-0.1.49 release:
https://github.com/ComplianceAsCode/content/releases/tag/v0.1.49
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-6ea0d2892b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 1 month
[SECURITY] Fedora 30 Update: coturn-4.5.1.1-3.fc30
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-f3fcb1608a
2020-04-01 02:35:47.694890
--------------------------------------------------------------------------------
Name : coturn
Product : Fedora 30
Version : 4.5.1.1
Release : 3.fc30
URL : https://github.com/coturn/coturn/
Summary : TURN/STUN & ICE Server
Description :
The Coturn TURN Server is a VoIP media traffic NAT traversal server and gateway.
It can be used as a general-purpose network traffic TURN server/gateway, too.
This implementation also includes some extra features. Supported RFCs:
TURN specs:
- RFC 5766 - base TURN specs
- RFC 6062 - TCP relaying TURN extension
- RFC 6156 - IPv6 extension for TURN
- Experimental DTLS support as client protocol.
STUN specs:
- RFC 3489 - "classic" STUN
- RFC 5389 - base "new" STUN specs
- RFC 5769 - test vectors for STUN protocol testing
- RFC 5780 - NAT behavior discovery support
The implementation fully supports the following client-to-TURN-server protocols:
- UDP (per RFC 5766)
- TCP (per RFC 5766 and RFC 6062)
- TLS (per RFC 5766 and RFC 6062); TLS1.0/TLS1.1/TLS1.2
- DTLS (experimental non-standard feature)
Supported relay protocols:
- UDP (per RFC 5766)
- TCP (per RFC 6062)
Supported user databases (for user repository, with passwords or keys, if
authentication is required):
- SQLite
- MySQL
- PostgreSQL
- Redis
Redis can also be used for status and statistics storage and notification.
Supported TURN authentication mechanisms:
- long-term
- TURN REST API (a modification of the long-term mechanism, for time-limited
secret-based authentication, for WebRTC applications)
The load balancing can be implemented with the following tools (either one or a
combination of them):
- network load-balancer server
- DNS-based load balancing
- built-in ALTERNATE-SERVER mechanism.
--------------------------------------------------------------------------------
Update Information:
* An exploitable heap overflow vulnerability exists in the way CoTURN 4.5.1.1
web server parses POST requests. A specially crafted HTTP POST request can lead
to information leaks and other misbehavior. * An exploitable denial-of-service
vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.
A specially crafted HTTP POST request can lead to server crash and denial of
service.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 23 2020 Robert Scheck <robert(a)fedoraproject.org> - 4.5.1.1-3
- Added upstream patch for CVE-2020-6061 (#1816159)
- Backported upstream patch for CVE-2020-6062 (#1816163)
* Tue Jan 28 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.5.1.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1816159 - CVE-2020-6061 coturn: specially crafted HTTP POST request can lead to heap overflow which can result in information leak
https://bugzilla.redhat.com/show_bug.cgi?id=1816159
[ 2 ] Bug #1816163 - CVE-2020-6062 coturn: specially crafted HTTP POST request can lead to server crash and denial of service
https://bugzilla.redhat.com/show_bug.cgi?id=1816163
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-f3fcb1608a' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 1 month
[SECURITY] Fedora 30 Update: drupal8-8.8.4-1.fc30
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-51637cf853
2020-04-01 02:35:47.694876
--------------------------------------------------------------------------------
Name : drupal8
Product : Fedora 30
Version : 8.8.4
Release : 1.fc30
URL : https://www.drupal.org/8
Summary : An open source content management platform
Description :
Drupal is an open source content management platform powering millions of
websites and applications. It���s built, used, and supported by an active and
diverse community of people around the world.
--------------------------------------------------------------------------------
Update Information:
https://www.drupal.org/project/drupal/releases?version=8
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 23 2020 Shawn Iwinski <shawn(a)iwin.ski> - 8.8.4-1
- Update to 8.8.4 (RHBZ #1705226)
* Tue Jan 28 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 8.6.17-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Wed Jul 24 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 8.6.17-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Mon Jun 17 2019 Shawn Iwinski <shawn(a)iwin.ski> - 8.6.17-1
- Update to 8.6.17
* Fri May 10 2019 Shawn Iwinski <shawn(a)iwin.ski> - 8.6.16-1
- Update to 8.6.16
- https://www.drupal.org/SA-CORE-2019-007
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1705226 - drupal8-8.8.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1705226
[ 2 ] Bug #1816223 - drupal8: Drupal: in HTML data processor pasting specially crafted HTML code could result in XSS [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1816223
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-51637cf853' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 1 month
Fedora 30 Update: wfuzz-2.4.5-3.fc30
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-9bfecc9d42
2020-04-01 02:35:47.694863
--------------------------------------------------------------------------------
Name : wfuzz
Product : Fedora 30
Version : 2.4.5
Release : 3.fc30
URL : http://wfuzz.io
Summary : Web fuzzer
Description :
Wfuzz has been created to facilitate the task in web applications assessments
and it is based on a simple concept: it replaces any reference to the FUZZ
keyword by the value of a given payload.
--------------------------------------------------------------------------------
Update Information:
Fix changelog entries
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-9bfecc9d42' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 1 month
Fedora 30 Update: python-ana-0.06-1.fc30
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-c8e0846a56
2020-04-01 02:35:47.694850
--------------------------------------------------------------------------------
Name : python-ana
Product : Fedora 30
Version : 0.06
Release : 1.fc30
URL : https://pypi.org/project/ana/
Summary : Python module to provide easy distributed data storage
Description :
ANA is a project to provide easy distributed data storage. It provides every
object with a UUID and, when pickled, will first serialize the object's state
to a central location and then "pickle" the object into just its UUID.
--------------------------------------------------------------------------------
Update Information:
Initial package for Fedora
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-c8e0846a56' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 1 month
Fedora 30 Update: php-phpseclib-2.0.26-1.fc30
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-69a90d58a8
2020-04-01 02:35:47.694837
--------------------------------------------------------------------------------
Name : php-phpseclib
Product : Fedora 30
Version : 2.0.26
Release : 1.fc30
URL : https://github.com/phpseclib/phpseclib
Summary : PHP Secure Communications Library
Description :
MIT-licensed pure-PHP implementations of an arbitrary-precision integer
arithmetic library, fully PKCS#1 (v2.1) compliant RSA, DES, 3DES, RC4,
Rijndael, AES, Blowfish, Twofish, SSH-1, SSH-2, SFTP, and X.509
--------------------------------------------------------------------------------
Update Information:
**Version 2.0.26** * SFTP: another attempt at speeding up uploads (#1455) *
SSH2: try logging in with none as an auth method first (#1454) * ASN1: fix
for malformed ASN1 strings (#1456)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 23 2020 Remi Collet <remi(a)remirepo.net> - 2.0.26-1
- update to 2.0.26
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-69a90d58a8' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 1 month
Fedora 30 Update: php-stack-builder-1.0.6-1.fc30
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-7df02a1f89
2020-04-01 02:35:47.694824
--------------------------------------------------------------------------------
Name : php-stack-builder
Product : Fedora 30
Version : 1.0.6
Release : 1.fc30
URL : https://github.com/stackphp/builder
Summary : Builder for stack middleware based on HttpKernelInterface
Description :
Builder for stack middlewares based on HttpKernelInterface.
Stack/Builder is a small library that helps you construct a nested
HttpKernelInterface decorator tree. It models it as a stack of middlewares.
Autoloader: /usr/share/php/Stack/autoload-builder.php
--------------------------------------------------------------------------------
Update Information:
## 1.0.6 (2020-01-30) * Add compability with Symfony 5. * Remove Silex
dependencies for tests.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Feb 26 2020 Shawn Iwinski <shawn.iwinski(a)gmail.com> - 1.0.6-1
- Update to 1.0.6 (RHBZ #1796631)
- Drop Symfony 2 interoperability
- Patch tests boostrap to run with Symfony >=5 and <5
- Use range dependencies
- Use PHPUnit 8
* Thu Jan 30 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.0.5-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Fri Jul 26 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.0.5-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1796631 - php-stack-builder-1.0.6 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1796631
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-7df02a1f89' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 1 month
Fedora 30 Update: zork-1.0.2-3.fc30
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-2fbe3fb3b6
2020-04-01 02:35:47.694810
--------------------------------------------------------------------------------
Name : zork
Product : Fedora 30
Version : 1.0.2
Release : 3.fc30
URL : https://github.com/devshane/zork
Summary : Public Domain original DUNGEON game (Zork I)
Description :
Public Domain source code to the original DUNGEON game (Zork I). Released to
the PD by Infocom. Includes source files, headers, and information.
This version of Dungeon was modified from FORTRAN to C. The original was
written in DEC FORTRAN, translated from MDL. It was then translated to f77 for
UN*X systems, from which it was translated to C. The C translation was done
with the help of f2c, the FORTRAN to C translator written by David Gay (AT&T
Bell Labs), Stu Feldman (Bellcore), Mark Maimone (Carnegie-Mellon University),
and Norm Schryer (AT&T Bell Labs).
--------------------------------------------------------------------------------
Update Information:
Add zork package
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1704522 - Review Request: zork - Public Domain source code to the original DUNGEON game (Zork I)
https://bugzilla.redhat.com/show_bug.cgi?id=1704522
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-2fbe3fb3b6' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 1 month
Fedora 30 Update: ephemeral-6.3.1-1.fc30
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-72fa16aba4
2020-04-01 02:35:47.694797
--------------------------------------------------------------------------------
Name : ephemeral
Product : Fedora 30
Version : 6.3.1
Release : 1.fc30
URL : https://github.com/cassidyjames/ephemeral
Summary : Private-by-default, always-incognito browser
Description :
Browse the Internet in private without leaving a trace of history on your
computer. Ephemeral is a stripped down private browser that's perfect for
avoiding persistent cookies or web trackers. Close the window and all traces of
your browsing are removed from your device.
--------------------------------------------------------------------------------
Update Information:
Update to latest version
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 23 2020 Artem Polishchuk <ego.cordatus(a)gmail.com> - 6.3.1-1
- Update to 6.3.1
- Enable LTO
- Clean SVG icon dupes
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-72fa16aba4' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 1 month
Fedora 30 Update: perl-CPAN-Perl-Releases-5.20200320-1.fc30
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2020-cada965801
2020-04-01 02:35:47.694782
--------------------------------------------------------------------------------
Name : perl-CPAN-Perl-Releases
Product : Fedora 30
Version : 5.20200320
Release : 1.fc30
URL : https://metacpan.org/release/CPAN-Perl-Releases
Summary : Mapping Perl releases on CPAN to the location of the tarballs
Description :
CPAN::Perl::Releases is a module that contains the mappings of all perl
releases that have been uploaded to CPAN to the authors/id/ path that the
tarballs reside in.
--------------------------------------------------------------------------------
Update Information:
Updated to the latest version ---- Updated to the latest version
--------------------------------------------------------------------------------
ChangeLog:
* Mon Mar 23 2020 Jitka Plesnikova <jplesnik(a)redhat.com> - 5.20200320-1
- 5.20200320 bump
* Mon Mar 16 2020 Jitka Plesnikova <jplesnik(a)redhat.com> - 5.20200314-1
- 5.20200314 bump
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1813602 - perl-CPAN-Perl-Releases-5.20200314 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1813602
[ 2 ] Bug #1815667 - perl-CPAN-Perl-Releases-5.20200320 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1815667
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2020-cada965801' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
4 years, 1 month