https://bugzilla.redhat.com/show_bug.cgi?id=2269568
Bug ID: 2269568
Summary: CVE-2024-2467 perl-Crypt-OpenSSL-RSA: side-channel
attack in PKCS#1 v1.5 padding mode (Marvin Attack)
[fedora-all]
Product: Fedora
Version: 39
Status: NEW
Component: perl-Crypt-OpenSSL-RSA
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: wjhns174(a)hardakers.net
Reporter: mcascell(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: perl-devel(a)lists.fedoraproject.org,
wjhns174(a)hardakers.net
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
http://bugzilla.redhat.com/show_bug.cgi?id=2269567
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2269568
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=1923909
Bug ID: 1923909
Summary: Upgrade perl-Tree-DAG_Node to 1.32
Product: Fedora
Version: rawhide
Status: NEW
Component: perl-Tree-DAG_Node
Assignee: spotrh(a)gmail.com
Reporter: jplesnik(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: jose.p.oliveira.oss(a)gmail.com, paul(a)city-fan.org,
perl-devel(a)lists.fedoraproject.org, spotrh(a)gmail.com
Target Milestone: ---
Classification: Fedora
Latest Fedora delivers 1.31 version. Upstream released 1.32. When you have free
time, please upgrade it.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2035273
Bug ID: 2035273
Summary: CVE-2020-16156 perl-CPAN: allows Signature
Verification Bypass
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mrehak(a)redhat.com
CC: caswilli(a)redhat.com, hhorak(a)redhat.com,
jorton(a)redhat.com, jplesnik(a)redhat.com,
kaycoth(a)redhat.com, mspacek(a)redhat.com,
perl-devel(a)lists.fedoraproject.org,
perl-maint-list(a)redhat.com, ppisar(a)redhat.com
Target Milestone: ---
Classification: Other
It was found that cpan and cpanm are vulnerable to a signature verification
bypass. Additionally, CPAN::Checksums (used by PAUSE) does not uniquely
identify packages in the signed CHECKSUMS file, enabling a supply chain attack.
Reference:
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2035273
https://bugzilla.redhat.com/show_bug.cgi?id=2257106
Bug ID: 2257106
Summary: F40FailsToInstall: perl-WWW-Google-Contacts
Product: Fedora
Version: rawhide
Status: NEW
Component: perl-WWW-Google-Contacts
Assignee: avibrazil(a)gmail.com
Reporter: fti-bugs(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: avibrazil(a)gmail.com,
perl-devel(a)lists.fedoraproject.org
Blocks: 2231790 (F40FailsToInstall,RAWHIDEFailsToInstall)
Target Milestone: ---
Classification: Fedora
Hello,
Please note that this comment was generated automatically by
https://pagure.io/releng/blob/main/f/scripts/ftbfs-fti/follow-policy.py
If you feel that this output has mistakes, please open an issue at
https://pagure.io/releng/
Your package (perl-WWW-Google-Contacts) Fails To Install in Fedora 40:
can't install perl-WWW-Google-Contacts:
- nothing provides perl(Net::Google::AuthSub) needed by
perl-WWW-Google-Contacts-0.39-23.fc39.noarch
If you know about this problem and are planning on fixing it, please
acknowledge so by setting the bug status to ASSIGNED. If you don't have time to
maintain this package, consider orphaning it, so maintainers of dependent
packages realize the problem.
If you don't react accordingly to the policy for FTBFS/FTI bugs
(https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…)
your package may be orphaned in 8+ weeks.
P.S. The data was generated solely from koji buildroot, so it might be newer
than the latest compose or the content on mirrors. To reproduce, use the
koji/local repo only, e.g. in mock:
$ mock -r fedora-40-x86_64 --config-opts mirrored=False install
perl-WWW-Google-Contacts
P.P.S. If this bug has been reported in the middle of upgrading multiple
dependent packages, please consider using side tags:
https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d…
Thanks!
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2231790
[Bug 2231790] Fedora 40 Fails To install Tracker
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2257106
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2230255
Bug ID: 2230255
Summary: perl-HTTP-Tiny: a ton of new dependencies all of a
sudden?
Product: Fedora
Version: 38
Hardware: All
OS: Linux
Status: NEW
Component: perl-HTTP-Tiny
Assignee: jplesnik(a)redhat.com
Reporter: aros(a)gmx.com
QA Contact: extras-qa(a)fedoraproject.org
CC: jplesnik(a)redhat.com, mspacek(a)redhat.com,
perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com
Target Milestone: ---
Classification: Fedora
Why does a new version of perl-HTTP-Tiny now depend on a ton of new Perl
subpackages?
Could this please be made optional?
# dnf update perl-HTTP-Tiny
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Upgrading:
perl-HTTP-Tiny noarch 0.086-2.fc38 updates 55 k
Installing dependencies:
perl-AutoLoader noarch 5.74-497.fc38 updates 22 k
perl-Digest noarch 1.20-490.fc38 fedora 25 k
perl-Digest-MD5 x86_64 2.58-490.fc38 fedora 36 k
perl-IO-Socket-IP noarch 0.41-492.fc38 fedora 41 k
perl-IO-Socket-SSL noarch 2.081-1.fc38 fedora 227 k
perl-Mozilla-CA noarch 20221114-2.fc38 fedora 12 k
perl-Net-SSLeay x86_64 1.92-5.fc38 fedora 361 k
perl-URI noarch 5.17-2.fc38 fedora 120 k
perl-base noarch 2.27-497.fc38 updates 17 k
perl-libnet noarch 3.15-1.fc38 fedora 128 k
Transaction Summary
================================================================================
Install 10 Packages
Upgrade 1 Package
Total download size: 1.0 M
Is this ok [y/N]:
Operation aborted.
This looks totally excessive and unnecessary.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2230255
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2074940
Bug ID: 2074940
Summary: Remove usage of gethostbyname() and inet_addr() from
perl-FCGI package
Product: Fedora
Version: rawhide
Status: NEW
Component: perl-FCGI
Assignee: emmanuel(a)seyman.fr
Reporter: mspacek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: bstinson(a)redhat.com, emmanuel(a)seyman.fr,
iarnell(a)gmail.com, jwboyer(a)redhat.com,
mspacek(a)redhat.com,
perl-devel(a)lists.fedoraproject.org,
perl-maint-list(a)redhat.com,
rhel-cs-apps-subsystem-qe(a)redhat.com
Depends On: 1979848
Target Milestone: ---
Classification: Fedora
+++ This bug was initially created as a clone of Bug #1979848 +++
Description of problem:
rpminspect is failing in gating
Version-Release number of selected component (if applicable):
perl-FCGI-0.79-7.el9
Actual results:
Forbidden function symbols found:
gethostbyname
inet_addr
Expected results:
no forbidden functions
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1979848
[Bug 1979848] Remove usage of gethostbyname() and inet_addr() from perl-FCGI
package
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2074940