rjones pushed to ocaml-num (rawhide). "OCaml 4.12.0 build"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 10:09:56 UTC
From c8aae6c74815fcaa10021e2755e045347ff55e33 Mon Sep 17 00:00:00 2001
From: Richard W.M. Jones <rjones(a)redhat.com>
Date: Mar 01 2021 10:09:48 +0000
Subject: OCaml 4.12.0 build
---
diff --git a/ocaml-num.spec b/ocaml-num.spec
index 1bb3043..f3491fb 100644
--- a/ocaml-num.spec
+++ b/ocaml-num.spec
@@ -1,6 +1,6 @@
Name: ocaml-num
Version: 1.4
-Release: 0.6%{?dist}
+Release: 0.7%{?dist}
Summary: Legacy Num library for arbitrary-precision integer and rational arithmetic
License: LGPLv2+ with exceptions
@@ -97,6 +97,9 @@ find $OCAMLFIND_DESTDIR -name '*.cmti' -delete
%changelog
+* Mon Mar 1 10:09:47 GMT 2021 Richard W.M. Jones <rjones(a)redhat.com> - 1.4-0.7
+- OCaml 4.12.0 build
+
* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.4-0.6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
https://src.fedoraproject.org/rpms/ocaml-num/c/c8aae6c74815fcaa10021e2755...
3Â years, 2Â months
rjones pushed to ocaml-dune (rawhide). "OCaml 4.12.0 build"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 10:09:59 UTC
From 3fcc79c83575567f01b93f9e163d4c77680955fd Mon Sep 17 00:00:00 2001
From: Richard W.M. Jones <rjones(a)redhat.com>
Date: Mar 01 2021 10:09:49 +0000
Subject: OCaml 4.12.0 build
---
diff --git a/ocaml-dune.spec b/ocaml-dune.spec
index 8b6906c..06d7a26 100644
--- a/ocaml-dune.spec
+++ b/ocaml-dune.spec
@@ -6,7 +6,7 @@
Name: ocaml-%{libname}
Version: 2.8.2
-Release: 3%{?dist}
+Release: 4%{?dist}
Summary: A composable build system for OCaml
# Dune itself is MIT. Some bundled libraries have a different license:
@@ -210,6 +210,9 @@ cp -ar README.md CHANGES.md MIGRATION.md doc/_build/* %{buildroot}%{_pkgdocdir}/
%{_emacs_sitelispdir}/dune*
%changelog
+* Mon Mar 1 10:09:48 GMT 2021 Richard W.M. Jones <rjones(a)redhat.com> - 2.8.2-4
+- OCaml 4.12.0 build
+
* Mon Feb 1 2021 Richard W.M. Jones <rjones(a)redhat.com> - 2.8.2-3
- Bump and rebuild for updated ocaml Dynlink dependency.
https://src.fedoraproject.org/rpms/ocaml-dune/c/3fcc79c83575567f01b93f9e1...
3Â years, 2Â months
nathans pushed to redis (rawhide). "v6.2.0"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 10:09:37 UTC
From 39912eb37661c730c874df8e9f9f4d563ebc5409 Mon Sep 17 00:00:00 2001
From: Nathan Scott <nathans(a)redhat.com>
Date: Mar 01 2021 10:09:02 +0000
Subject: v6.2.0
---
diff --git a/.gitignore b/.gitignore
index 5481da9..e0d883e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -83,3 +83,4 @@ clog
/redis-6.0.10.tar.gz
/redis-6.0.11.tar.gz
/redis-doc-e052823.tar.gz
+/redis-6.2.0.tar.gz
diff --git a/0002-install-redis-check-rdb-as-a-symlink-instead-of-dupl.patch b/0002-install-redis-check-rdb-as-a-symlink-instead-of-dupl.patch
deleted file mode 100644
index d43be3b..0000000
--- a/0002-install-redis-check-rdb-as-a-symlink-instead-of-dupl.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 79ed52edf84676786e5817cddb8914c5925144c7 Mon Sep 17 00:00:00 2001
-From: Remi Collet <fedora(a)famillecollet.com>
-Date: Fri, 9 Sep 2016 17:23:27 +0200
-Subject: [PATCH 2/3] install redis-check-rdb as a symlink instead of
- duplicating the binary
-
----
- src/Makefile | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/Makefile b/src/Makefile
-index 2a68649..585c95b 100644
---- a/src/Makefile
-+++ b/src/Makefile
-@@ -307,9 +307,9 @@ install: all
- $(REDIS_INSTALL) $(REDIS_SERVER_NAME) $(INSTALL_BIN)
- $(REDIS_INSTALL) $(REDIS_BENCHMARK_NAME) $(INSTALL_BIN)
- $(REDIS_INSTALL) $(REDIS_CLI_NAME) $(INSTALL_BIN)
-- $(REDIS_INSTALL) $(REDIS_CHECK_RDB_NAME) $(INSTALL_BIN)
-- $(REDIS_INSTALL) $(REDIS_CHECK_AOF_NAME) $(INSTALL_BIN)
- @ln -sf $(REDIS_SERVER_NAME) $(INSTALL_BIN)/$(REDIS_SENTINEL_NAME)
-+ @ln -sf $(REDIS_SERVER_NAME) $(INSTALL_BIN)/$(REDIS_CHECK_RDB_NAME)
-+ @ln -sf $(REDIS_SERVER_NAME) $(INSTALL_BIN)/$(REDIS_CHECK_AOF_NAME)
-
- uninstall:
- rm -f $(INSTALL_BIN)/{$(REDIS_SERVER_NAME),$(REDIS_BENCHMARK_NAME),$(REDIS_CLI_NAME),$(REDIS_CHECK_RDB_NAME),$(REDIS_CHECK_AOF_NAME),$(REDIS_SENTINEL_NAME)}
---
-2.24.1
-
diff --git a/redis.spec b/redis.spec
index 7c8b597..36ebd02 100644
--- a/redis.spec
+++ b/redis.spec
@@ -19,7 +19,7 @@
%global macrosdir %(d=%{_rpmconfigdir}/macros.d; [ -d $d ] || d=%{_sysconfdir}/rpm; echo $d)
Name: redis
-Version: 6.0.11
+Version: 6.2.0
Release: 1%{?dist}
Summary: A persistent key-value database
# redis, jemalloc, linenoise, lzf, hiredis are BSD
@@ -43,8 +43,6 @@ Source10: https://github.com/%{name}/%{name}-doc/archive/%{doc_commit}/
# Update configuration for Fedora
# https://github.com/redis/redis/pull/3491 - man pages
Patch0001: 0001-1st-man-pageis-for-redis-cli-redis-benchmark-redis-c.patch
-# https://github.com/redis/redis/pull/3494 - symlink
-Patch0002: 0002-install-redis-check-rdb-as-a-symlink-instead-of-dupl.patch
BuildRequires: make
BuildRequires: gcc
@@ -130,7 +128,6 @@ administration and development.
%setup -q
mv ../%{name}-doc-%{doc_commit} doc
%patch0001 -p1
-%patch0002 -p1
mv deps/lua/COPYRIGHT COPYRIGHT-lua
mv deps/jemalloc/COPYING COPYING-jemalloc
@@ -299,6 +296,10 @@ fi
%changelog
+* Mon Mar 01 2021 Nathan Scott <nathans(a)redhat.com> - 6.2.0-1
+- Upstream 6.2.0 release (RHBZ #1915463).
+- drop patch merged upstream.
+
* Wed Feb 24 2021 Nathan Scott <nathans(a)redhat.com> - 6.0.11-1
- Upstream 6.0.11 release.
diff --git a/sources b/sources
index 836dfbe..711bbc5 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (redis-6.0.11.tar.gz) = 13b08a98c2d89c2c53c9a80fe27acc98dbc9fd8e93d7baabed381c401877bd8672cf4472b17d8843edda674c41849859b90a722a3c99d99cfdc3769ae5e0a979
+SHA512 (redis-6.2.0.tar.gz) = 905cdcbe42b6126c2bfb68a948cb38d232af3d04e620c51897fb80ac43b5b8da1f60e9701377dcd15db8c3eb168ab9c3605d5715d664903e0a620b464d1ac9b8
SHA512 (redis-doc-e052823.tar.gz) = 391e7f5566dfd734d34dec3ffb388392a1139f9180f3f5ba49e9cf63aa90b9cc4995973a76fa6a6561a32566ee32d3a07e8359aefb50d7cbbf91fa0d8be60c64
https://src.fedoraproject.org/rpms/redis/c/39912eb37661c730c874df8e9f9f4d...
3Â years, 2Â months
dcaratti pushed to wpa_supplicant (f33). "P2P: Fix a corner case in
peer addition based on PD Request (..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 10:04:37 UTC
From 7d20818447f5bd47c6769c5ea4c85f3ce3386c2e Mon Sep 17 00:00:00 2001
From: Davide Caratti <dcaratti(a)redhat.com>
Date: Mar 01 2021 10:02:20 +0000
Subject: P2P: Fix a corner case in peer addition based on PD Request
CVE-2021-27803
Upstream advisory:
https://w1.fi/security/2021-1/wpa_supplicant-p2p-provision-discovery-proc...
Signed-off-by: Davide Caratti <dcaratti(a)redhat.com>
---
diff --git a/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch b/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
new file mode 100644
index 0000000..1942bb3
--- /dev/null
+++ b/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
@@ -0,0 +1,50 @@
+From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni(a)codeaurora.org>
+Date: Tue, 8 Dec 2020 23:52:50 +0200
+Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD Request
+
+p2p_add_device() may remove the oldest entry if there is no room in the
+peer table for a new peer. This would result in any pointer to that
+removed entry becoming stale. A corner case with an invalid PD Request
+frame could result in such a case ending up using (read+write) freed
+memory. This could only by triggered when the peer table has reached its
+maximum size and the PD Request frame is received from the P2P Device
+Address of the oldest remaining entry and the frame has incorrect P2P
+Device Address in the payload.
+
+Fix this by fetching the dev pointer again after having called
+p2p_add_device() so that the stale pointer cannot be used.
+
+Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
+Signed-off-by: Jouni Malinen <jouni(a)codeaurora.org>
+---
+ src/p2p/p2p_pd.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c
+index 3994ec03f86b..05fd593494ef 100644
+--- a/src/p2p/p2p_pd.c
++++ b/src/p2p/p2p_pd.c
+@@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2p_data *p2p, const u8 *sa,
+ goto out;
+ }
+
++ dev = p2p_get_device(p2p, sa);
+ if (!dev) {
+- dev = p2p_get_device(p2p, sa);
+- if (!dev) {
+- p2p_dbg(p2p,
+- "Provision Discovery device not found "
+- MACSTR, MAC2STR(sa));
+- goto out;
+- }
++ p2p_dbg(p2p,
++ "Provision Discovery device not found "
++ MACSTR, MAC2STR(sa));
++ goto out;
+ }
+ } else if (msg.wfd_subelems) {
+ wpabuf_free(dev->info.wfd_subelems);
+--
+2.25.1
+
diff --git a/wpa_supplicant.spec b/wpa_supplicant.spec
index ef6e7ac..163f10a 100644
--- a/wpa_supplicant.spec
+++ b/wpa_supplicant.spec
@@ -5,7 +5,7 @@ Summary: WPA/WPA2/IEEE 802.1X Supplicant
Name: wpa_supplicant
Epoch: 1
Version: 2.9
-Release: 7%{?dist}
+Release: 8%{?dist}
License: BSD
Source0: http://w1.fi/releases/%{name}-%{version}.tar.gz
Source1: wpa_supplicant.conf
@@ -36,6 +36,9 @@ Patch8: 0001-p2p-Limit-P2P_DEVICE-name-to-appropriate-ifname-size.patch
#fix for CVE-2021-0326
Patch9: 0001-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch
+#fix for CVE-2021-27803
+Patch10: 0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
+
URL: http://w1.fi/wpa_supplicant/
%if %with gui
@@ -191,6 +194,9 @@ chmod -R 0644 wpa_supplicant/examples/*.py
%changelog
+* Mon Mar 1 2021 Davide Caratti <dcaratti(a)redhat.com> - 1:2.9-8
+- Fix a corner case in peer addition based on PD Request (CVE-2021-27803)
+
* Thu Feb 4 2021 Davide Caratti <dcaratti(a)redhat.com> - 1:2.9-7
- Fix copying of secondary device types for P2P group client (CVE-2021-0326)
https://src.fedoraproject.org/rpms/wpa_supplicant/c/7d20818447f5bd47c6769...
3Â years, 2Â months
packagerbot pushed to dummy-test-package-gloster (rawhide). "Bump
release (..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 09:59:34 UTC
From e0bb404dbfb23b8ba825cb718048f9a217a06f40 Mon Sep 17 00:00:00 2001
From: packagerbot <admin(a)fedoraproject.org>
Date: Mar 01 2021 09:59:29 +0000
Subject: Bump release
Signed-off-by: packagerbot <admin(a)fedoraproject.org>
---
diff --git a/dummy-test-package-gloster.spec b/dummy-test-package-gloster.spec
index 61ff670..48bc1a5 100644
--- a/dummy-test-package-gloster.spec
+++ b/dummy-test-package-gloster.spec
@@ -3,7 +3,7 @@
Name: dummy-test-package-gloster
Version: 0
-Release: 2866%{?dist}
+Release: 2867%{?dist}
Summary: Dummy Test Package called Gloster
License: CC0
URL: http://fedoraproject.org/wiki/DummyTestPackages
@@ -32,6 +32,9 @@ cp -p uuid %{buildroot}%{_datadir}/%{name}
%{_datadir}/%{name}
%changelog
+* Mon Mar 01 2021 packagerbot <admin(a)fedoraproject.org> - 0-2867
+- rebuilt
+
* Mon Mar 01 2021 packagerbot <admin(a)fedoraproject.org> - 0-2866
- rebuilt
https://src.fedoraproject.org/rpms/dummy-test-package-gloster/c/e0bb404db...
3Â years, 2Â months
adelton pushed to swid-tools (f34). "Rebased to 0.8.12."
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 09:56:53 UTC
From 6bd37f43e0a8a55bd720f7f3aa923c13cd017151 Mon Sep 17 00:00:00 2001
From: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Mar 01 2021 09:43:07 +0000
Subject: Rebased to 0.8.12.
---
diff --git a/.gitignore b/.gitignore
index 28e48bb..d875db3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@
/rpm2swidtag-0.8.9.tar.gz
/rpm2swidtag-0.8.10.tar.gz
/rpm2swidtag-0.8.11.tar.gz
+/rpm2swidtag-0.8.12.tar.gz
diff --git a/sources b/sources
index c39495e..f4be5b9 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (rpm2swidtag-0.8.11.tar.gz) = 5cd1aae99f74f0722fedd32467ab7c8162987d289d8527f46fb738854c40731038e374359a7f1502cf942640bd0c8209bf380210e296348fdd9625b09c574e0b
+SHA512 (rpm2swidtag-0.8.12.tar.gz) = fdd96355bcfbcf4933b61bde4bf150f1843b397ab5cc5d84dac149c3f0d1e4fb3aac50718cbee3f2bcdc103b0d90cf5a22355b66666522557f91ec99f828de86
diff --git a/swid-tools.spec b/swid-tools.spec
index aaeb7a0..ef3c588 100644
--- a/swid-tools.spec
+++ b/swid-tools.spec
@@ -3,8 +3,8 @@
Summary: Tools for producing SWID tags for rpm packages and inspecting the SWID tags
Name: swid-tools
-Version: 0.8.11
-Release: 4%{?dist}
+Version: 0.8.12
+Release: 1%{?dist}
License: ASL 2.0
URL: https://github.com/swidtags/rpm2swidtag
Source0: https://github.com/swidtags/%{upstream_name}/releases/download/%{upstream...
@@ -97,6 +97,9 @@ if rpm -q rpm2swidtag dnf-plugin-swidtags 2> /dev/null | grep -E -q '(rpm2swidta
fi
%changelog
+* Mon Mar 01 2021 Jan Pazdziora <jpazdziora(a)redhat.com> - 0.8.12-1
+- Rebased to 0.8.12.
+
* Mon Mar 01 2021 Jan Pazdziora <jpazdziora(a)redhat.com> - 0.8.11-4
- Revert the 1900816 workaround.
https://src.fedoraproject.org/rpms/swid-tools/c/6bd37f43e0a8a55bd720f7f3a...
3Â years, 2Â months
dcaratti pushed to wpa_supplicant (f34). "P2P: Fix a corner case in
peer addition based on PD Request (..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 09:53:04 UTC
From 2f6a30f529eb23d40bf46d157f2e0ae61814d7b6 Mon Sep 17 00:00:00 2001
From: Davide Caratti <dcaratti(a)redhat.com>
Date: Mar 01 2021 09:52:03 +0000
Subject: P2P: Fix a corner case in peer addition based on PD Request
CVE-2021-27803
Upstream advisory:
https://w1.fi/security/2021-1/wpa_supplicant-p2p-provision-discovery-proc...
Signed-off-by: Davide Caratti <dcaratti(a)redhat.com>
---
diff --git a/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch b/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
new file mode 100644
index 0000000..1942bb3
--- /dev/null
+++ b/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
@@ -0,0 +1,50 @@
+From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni(a)codeaurora.org>
+Date: Tue, 8 Dec 2020 23:52:50 +0200
+Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD Request
+
+p2p_add_device() may remove the oldest entry if there is no room in the
+peer table for a new peer. This would result in any pointer to that
+removed entry becoming stale. A corner case with an invalid PD Request
+frame could result in such a case ending up using (read+write) freed
+memory. This could only by triggered when the peer table has reached its
+maximum size and the PD Request frame is received from the P2P Device
+Address of the oldest remaining entry and the frame has incorrect P2P
+Device Address in the payload.
+
+Fix this by fetching the dev pointer again after having called
+p2p_add_device() so that the stale pointer cannot be used.
+
+Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
+Signed-off-by: Jouni Malinen <jouni(a)codeaurora.org>
+---
+ src/p2p/p2p_pd.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c
+index 3994ec03f86b..05fd593494ef 100644
+--- a/src/p2p/p2p_pd.c
++++ b/src/p2p/p2p_pd.c
+@@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2p_data *p2p, const u8 *sa,
+ goto out;
+ }
+
++ dev = p2p_get_device(p2p, sa);
+ if (!dev) {
+- dev = p2p_get_device(p2p, sa);
+- if (!dev) {
+- p2p_dbg(p2p,
+- "Provision Discovery device not found "
+- MACSTR, MAC2STR(sa));
+- goto out;
+- }
++ p2p_dbg(p2p,
++ "Provision Discovery device not found "
++ MACSTR, MAC2STR(sa));
++ goto out;
+ }
+ } else if (msg.wfd_subelems) {
+ wpabuf_free(dev->info.wfd_subelems);
+--
+2.25.1
+
diff --git a/wpa_supplicant.spec b/wpa_supplicant.spec
index 6fb8bc5..95aaa37 100644
--- a/wpa_supplicant.spec
+++ b/wpa_supplicant.spec
@@ -9,7 +9,7 @@ Summary: WPA/WPA2/IEEE 802.1X Supplicant
Name: wpa_supplicant
Epoch: 1
Version: 2.9
-Release: 11%{?dist}
+Release: 12%{?dist}
License: BSD
Source0: http://w1.fi/releases/%{name}-%{version}.tar.gz
Source1: wpa_supplicant.conf
@@ -46,6 +46,9 @@ Patch10: 0001-dbus-Export-OWE-capability-and-OWE-BSS-key_mgmt.patch
#fix for CVE-2021-0326
Patch11: 0001-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch
+#fix for CVE-2021-27803
+Patch12: 0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
+
URL: http://w1.fi/wpa_supplicant/
%if %with gui
@@ -205,6 +208,9 @@ chmod -R 0644 wpa_supplicant/examples/*.py
%changelog
+* Mon Mar 1 2021 Davide Caratti <dcaratti(a)redhat.com> - 1:2.9-12
+- Fix a corner case in peer addition based on PD Request (CVE-2021-27803)
+
* Thu Feb 4 2021 Davide Caratti <dcaratti(a)redhat.com> - 1:2.9-11
- Fix copying of secondary device types for P2P group client (CVE-2021-0326)
https://src.fedoraproject.org/rpms/wpa_supplicant/c/2f6a30f529eb23d40bf46...
3Â years, 2Â months