The following Fedora 31 Security updates need testing: Age URL 21 https://bodhi.fedoraproject.org/updates/FEDORA-2020-c5ec22e14f libuv-1.39.0-1.fc31 nodejs-12.18.4-1.fc31 6 https://bodhi.fedoraproject.org/updates/FEDORA-2020-e21bd401ad golang-github-andybalholm-brotli-1.0.1-1.fc31 3 https://bodhi.fedoraproject.org/updates/FEDORA-2020-07c5770aa1 thunderbird-78.3.1-1.fc31 1 https://bodhi.fedoraproject.org/updates/FEDORA-2020-90e2b01f4a claws-mail-3.17.7-1.fc31
The following Fedora 31 Critical Path updates have yet to be approved: Age URL 132 https://bodhi.fedoraproject.org/updates/FEDORA-2020-03e14f6120 dracut-050-61.git20200529.fc31 58 https://bodhi.fedoraproject.org/updates/FEDORA-2020-72bc7df001 libunwind-1.3.1-7.fc31 13 https://bodhi.fedoraproject.org/updates/FEDORA-2020-a8544190d2 pungi-4.2.5-1.fc31 13 https://bodhi.fedoraproject.org/updates/FEDORA-2020-9c5a0da89b python-productmd-1.28-1.fc31 10 https://bodhi.fedoraproject.org/updates/FEDORA-2020-87fbd4bb9b glusterfs-7.8-1.fc31 9 https://bodhi.fedoraproject.org/updates/FEDORA-2020-aa7e76a7eb vim-8.2.1770-1.fc31 7 https://bodhi.fedoraproject.org/updates/FEDORA-2020-aef226a2fb python-rpm-macros-3-59.fc31 3 https://bodhi.fedoraproject.org/updates/FEDORA-2020-9c331324e6 hwdata-0.340-1.fc31 3 https://bodhi.fedoraproject.org/updates/FEDORA-2020-07c5770aa1 thunderbird-78.3.1-1.fc31 1 https://bodhi.fedoraproject.org/updates/FEDORA-2020-421372e1e5 jasper-2.0.22-1.fc31 1 https://bodhi.fedoraproject.org/updates/FEDORA-2020-1eadf02f8d samba-4.11.14-0.fc31 0 https://bodhi.fedoraproject.org/updates/FEDORA-2020-e35fa0cfb3 kernel-5.8.14-100.fc31
The following builds have been pushed to Fedora 31 updates-testing
binaryen-97-1.fc31 brotli-1.0.9-3.fc31 clash-1.2.0-1.fc31 firefox-81.0.1-9.fc31 fuse-overlayfs-1.2.0-1.fc31 golang-github-dreamacro-shadowsocks2-0.1.6-1.fc31 kata-proxy-1.11.1-1.fc31.1 kata-runtime-1.11.1-3.fc31 php-phpmyadmin-sql-parser5-5.4.0-1.fc31 prelockd-0.7-2.fc31 prosody-0.11.7-2.fc31 qjackctl-0.6.3-2.fc31 rubygem-jekyll-feed-0.15.1-1.fc31 sane-backends-1.0.31-3.fc31 wireshark-3.2.7-1.fc31
Details about builds:
================================================================================ binaryen-97-1.fc31 (FEDORA-2020-c75f44306a) Compiler and toolchain infrastructure library for WebAssembly -------------------------------------------------------------------------------- Update Information:
v97 --- - Remove asm2wasm, which supported Emscripten's fastcomp backend, after fastcomp was removed. - The new feature flag `--enable-anyref` enables just the `anyref` type incl. basic subtyping of `externref`, `funcref` and `exnref` (if enabled). - Enabling the exception handling or anyref features without also enabling reference types is a validation error now. - The `Host` expression and its respective APIs have been refactored into separate `MemorySize` and `MemoryGrow` expressions to align with other memory instructions. -------------------------------------------------------------------------------- ChangeLog:
* Wed Oct 7 2020 Dominik Mierzejewski rpm@greysector.net 97-1 - update to 97 (#1880087) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1880087 - binaryen-97 is available https://bugzilla.redhat.com/show_bug.cgi?id=1880087 --------------------------------------------------------------------------------
================================================================================ brotli-1.0.9-3.fc31 (FEDORA-2020-bc9a739f0c) Lossless compression algorithm -------------------------------------------------------------------------------- Update Information:
Update to 1.0.9, fixes CVE-2020-8927 -------------------------------------------------------------------------------- ChangeLog:
* Thu Oct 1 2020 Travis Kendrick pouar@pouar.net - 1.0.9-3 - Apparently %autosetup calls %patch on its own * Thu Oct 1 2020 Travis Kendrick pouar@pouar.net - 1.0.9-2 - Fix pc file (#1884364) * Wed Sep 30 2020 Travis Kendrick pouar@pouar.net - 1.0.9-1 - Update to 1.0.9 (#1872932) * Wed Aug 12 2020 Carl George carl@george.computer - 1.0.7-14 - Update cmake invocation rhbz#1863298 * Sat Aug 1 2020 Fedora Release Engineering releng@fedoraproject.org - 1.0.7-13 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Mon Jul 27 2020 Fedora Release Engineering releng@fedoraproject.org - 1.0.7-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Sat May 23 2020 Miro Hron��ok mhroncok@redhat.com - 1.0.7-11 - Rebuilt for Python 3.9 * Tue Jan 28 2020 Fedora Release Engineering releng@fedoraproject.org - 1.0.7-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Sat Dec 7 2019 Peter Robinson pbrobinson@fedoraproject.org 1.0.7-9 - Splil out the libs to a separate package * Thu Oct 3 2019 Miro Hron��ok mhroncok@redhat.com - 1.0.7-8 - Rebuilt for Python 3.8.0rc1 (#1748018) * Sat Aug 17 2019 Miro Hron��ok mhroncok@redhat.com - 1.0.7-7 - Rebuilt for Python 3.8 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1879226 - CVE-2020-8927 brotli: buffer overflow when input chunk is larger than 2GiB [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1879226 --------------------------------------------------------------------------------
================================================================================ clash-1.2.0-1.fc31 (FEDORA-2020-df49021628) A rule-based tunnel in Go -------------------------------------------------------------------------------- Update Information:
update to 1.2.0 upstream release -------------------------------------------------------------------------------- ChangeLog:
* Fri Oct 9 2020 Qiyu Yan yanqiyu@fedoraproject.org - 1.2.0-1 - update to 1.2.0 upstream release --------------------------------------------------------------------------------
================================================================================ firefox-81.0.1-9.fc31 (FEDORA-2020-72d7c9c61c) Mozilla Firefox Web browser -------------------------------------------------------------------------------- Update Information:
- Fixed popup regression on Wayland ---- - Added a fix for Wayland (mzbz#1656727) when Firefox crashes during window operation. -------------------------------------------------------------------------------- ChangeLog:
* Thu Oct 8 2020 Martin Stransky stransky@redhat.com - 81.0.1-9 - Added an updated fix for mozbz#1656727 * Thu Oct 8 2020 Martin Stransky stransky@redhat.com - 81.0.1-8 - Added fixes for mozbz#1634404, mozbz#1669495 * Thu Oct 8 2020 Martin Stransky stransky@redhat.com - 81.0.1-7 - Removed mozbz#1656727 as it causes a regression rhbz#1886243 * Wed Oct 7 2020 Martin Stransky stransky@redhat.com - 81.0.1-6 - PGO patch update - Added fix for mzbz#1669442 (LTO builds) * Mon Oct 5 2020 Martin Stransky stransky@redhat.com - 81.0.1-5 - Added fix for mozbz#1656727 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1886643 - Mouse clicks don't always work on Firefox tabs/toolbars https://bugzilla.redhat.com/show_bug.cgi?id=1886643 --------------------------------------------------------------------------------
================================================================================ fuse-overlayfs-1.2.0-1.fc31 (FEDORA-2020-4e76c6f713) FUSE overlay+shiftfs implementation for rootless containers -------------------------------------------------------------------------------- Update Information:
Autobuilt v1.2.0 -------------------------------------------------------------------------------- ChangeLog:
* Fri Oct 9 2020 RH Container Bot rhcontainerbot@fedoraproject.org - 1.2.0-1 - autobuilt v1.2.0 --------------------------------------------------------------------------------
================================================================================ golang-github-dreamacro-shadowsocks2-0.1.6-1.fc31 (FEDORA-2020-a6dc9f6686) Experimental Shadowsocks in Go -------------------------------------------------------------------------------- Update Information:
update to 0.1.6 upstream release -------------------------------------------------------------------------------- ChangeLog:
* Fri Oct 9 2020 Qiyu Yan yanqiyu@fedoraproject.org - 0.1.6-1 - update to 0.1.6 upstream release --------------------------------------------------------------------------------
================================================================================ kata-proxy-1.11.1-1.fc31.1 (FEDORA-2020-2f5879aeb6) Proxy for Kata Containers -------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2020-2026 -------------------------------------------------------------------------------- ChangeLog:
* Tue Jul 28 2020 Fedora Release Engineering releng@fedoraproject.org - 1.11.1-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Fri Jun 26 2020 Pavel Mores pmores@redhat.com - 1.11.1-1 - Update to version 1.11.1 * Fri May 8 2020 Cole Robinson crobinso@redhat.com - 1.11.0-1 - Update to version 1.11.0 * Mon Apr 20 2020 Cole Robinson aintdiscole@gmail.com - 1.11.0-0.1.rc0 - Update to 1.11.0-rc0 * Mon Mar 23 2020 Fabiano Fid��ncio fidencio@redhat.com - 1.11.0-0.alpha1 - Update to release 1.11.0-alpha1 * Wed Jan 29 2020 Fedora Release Engineering releng@fedoraproject.org - 1.10.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Tue Jan 21 2020 Christophe de Dinechin dinechin@redhat.com - 1.10.0-1 - Update to release 1.10.0 + Overwrite PREFIX + Use xenial * Fri Jan 17 2020 Christophe de Dinechin dinechin@redhat.com - 1.9.3-1 - Update to release 1.9.3 (no changes upstream) * Fri Jan 17 2020 Christophe de Dinechin dinechin@redhat.com - 1.9.2-1 - Update to release 1.9.2 (no changes upstream) * Fri Nov 29 2019 Christophe de Dinechin dinechin@redhat.com - 1.9.1-1 - Update to release 1.9.1 * Fri Nov 29 2019 Christophe de Dinechin dinechin@redhat.com - 1.9.0-2 - Address rpmlint warning about macro in comment -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1848298 - CVE-2020-2026 kata-proxy: kata-containers: Possibility to mount untrusted container filesystem on any host path leads to Remote Code Execution [fedora-31] https://bugzilla.redhat.com/show_bug.cgi?id=1848298 --------------------------------------------------------------------------------
================================================================================ kata-runtime-1.11.1-3.fc31 (FEDORA-2020-7a0b6071a4) Kata runtime to run containers in virtual machines -------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2020-2026 -------------------------------------------------------------------------------- ChangeLog:
* Fri Oct 9 2020 Fabiano Fid��ncio fidencio@redhat.com - 1.11.1-3 - Set kata-shim as recommended - Don't reenable SELinux support for CentOS * Thu Jul 30 2020 Fabiano Fid��ncio fidencio@redhat.com - 1.11.1-2 - Reenable SELinux as podman 2.0 is already out * Tue Jul 28 2020 Fedora Release Engineering releng@fedoraproject.org - 1.11.1-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Fri Jun 26 2020 Pavel Mores pmores@redhat.com - 1.11.1-1 - Update to version 1.11.1 * Fri May 15 2020 Fabiano Fid��ncio fidencio@redhat.com - 1.11.0-3 - Use the right machine type according to the architecture - Removed non-used / non-tested configuration files - Use the right SharedFS type according ro the architecture * Wed May 13 2020 Cole Robinson crobinso@redhat.com - 1.11.0-2 - Disable selinux until new podman is available * Fri May 8 2020 Cole Robinson crobinso@redhat.com - 1.11.0-1 - Update to version 1.11.0 * Mon Apr 20 2020 Cole Robinson aintdiscole@gmail.com - 1.11.0-0.2.rc0 - Add libselinux-devel build dep * Mon Apr 20 2020 Cole Robinson aintdiscole@gmail.com - 1.11.0-0.1.rc0 - Update to 1.11.0-rc0 * Mon Mar 23 2020 Fabiano Fid��ncio fidencio@redhat.com - 1.11.0-0.alpha1 - Update to 1.11.0-alpha1 upstream release * Mon Feb 17 2020 Cole Robinson aintdiscole@gmail.com - 1.10.0-3 - Switch to virtio-fs default * Wed Jan 29 2020 Fedora Release Engineering releng@fedoraproject.org - 1.10.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Tue Jan 21 2020 Christophe de Dinechin dinechin@redhat.com - 1.10.0-1 - Update to release 1.10.0 Large number of changes * Fri Jan 17 2020 Christophe de Dinechin dinechin@redhat.com - 1.9.2-1 - Update to release 1.9.3 Include firecracker release v0.18.1 to address CVE-2019-18960 Several upstream bug fixes: 3d5e0db rootless: Disable vhost-net for rootless 71d6d22 release: Kata Containers 1.9.3 b7fa015 versions: bump fc version to v0.18.1 c46fdff virtcontainers: don't consider non-running container resources 2777cb2 virtcontainers: update resources after adding container to sandbox 9204973 virtcontainers/store: make VCStoreUUIDPath rootless c818711 vc: Don't adjust block index on error 10a977d vc: Persist file handle may leak in FS#ToDisk * Fri Jan 17 2020 Christophe de Dinechin dinechin@redhat.com - 1.9.2-1 - Update to release 1.9.2 - Fix rangeUID parsing - Fix cgroup creation logic for rootless * Fri Jan 17 2020 Christophe de Dinechin dinechin@redhat.com - 1.9.1-2 - Adjust paths to match fix in kata-osbuilder * Fri Nov 29 2019 Christophe de Dinechin dinechin@redhat.com - 1.9.1-1 - Update to release 1.9.1 * Tue Nov 19 2019 Christophe de Dinechin dinechin@redhat.com - 1.9.0-2 - Address rpmlint warning rpm-buildroot-usage -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1848300 - CVE-2020-2026 kata-runtime: kata-containers: Possibility to mount untrusted container filesystem on any host path leads to Remote Code Execution [fedora-31] https://bugzilla.redhat.com/show_bug.cgi?id=1848300 --------------------------------------------------------------------------------
================================================================================ php-phpmyadmin-sql-parser5-5.4.0-1.fc31 (FEDORA-2020-41aba66e67) A validating SQL lexer and parser with a focus on MySQL dialect -------------------------------------------------------------------------------- Update Information:
**Version 5.4.0** - 2020-10-08 * EXISTS is also a function. (#297) * Fix lexer to not allow numbers with letters (#300) * Add support for INVISIBLE keyword (#292) * Fix the "$" might be a character used in a name (#301) * Fix use stream_select instead of non-blocking STDIN (#309) * Add select validation to a create view statement (#310) -------------------------------------------------------------------------------- ChangeLog:
* Fri Oct 9 2020 Remi Collet remi@remirepo.net - 5.4.0-1 - update to 5.4.0 - switch to phpunit9 --------------------------------------------------------------------------------
================================================================================ prelockd-0.7-2.fc31 (FEDORA-2020-f3bd65c643) Lock binaries and libraries in memory to improve system responsiveness -------------------------------------------------------------------------------- Update Information:
Initial package -------------------------------------------------------------------------------- ChangeLog:
-------------------------------------------------------------------------------- References:
[ 1 ] Bug #1884983 - Review Request: prelockd - Lock binaries and libraries in memory to improve system responsiveness https://bugzilla.redhat.com/show_bug.cgi?id=1884983 --------------------------------------------------------------------------------
================================================================================ prosody-0.11.7-2.fc31 (FEDORA-2020-4151f52ad2) Flexible communications server for Jabber/XMPP -------------------------------------------------------------------------------- Update Information:
* Added upstream patches for better Lua 5.4 support (#1886456) -------------------------------------------------------------------------------- ChangeLog:
* Thu Oct 8 2020 Robert Scheck robert@fedoraproject.org 0.11.7-2 - Added upstream patches for better Lua 5.4 support (#1886456) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1886456 - prosody cannot find lua-socket/lua-bitopts https://bugzilla.redhat.com/show_bug.cgi?id=1886456 --------------------------------------------------------------------------------
================================================================================ qjackctl-0.6.3-2.fc31 (FEDORA-2020-041b6eeeed) Qt based JACK control application -------------------------------------------------------------------------------- Update Information:
Update to version 0.6.3 and some cleanup. -------------------------------------------------------------------------------- ChangeLog:
* Wed Oct 7 2020 Christoph Karl <pampelmuse [AT] gmx [DOT] at> - 0.6.3-2 - New version * Tue Oct 6 2020 Ankur Sinha <ankursinha AT fedoraproject DOT org> - 0.6.3-1 - Move check section after install section * Tue Sep 29 2020 Christoph Karl <pampelmuse [AT] gmx [DOT] at> - 0.6.3-1 - New version * Wed Jul 29 2020 Fedora Release Engineering releng@fedoraproject.org - 0.6.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Sun Jun 21 2020 Orcan Ogetbil <oget [DOT] fedora [AT] gmail [DOT] com> - 0.6.2-1 - New version * Thu Jan 30 2020 Fedora Release Engineering releng@fedoraproject.org - 0.5.5-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1862378 - qjackctl-0.6.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1862378 --------------------------------------------------------------------------------
================================================================================ rubygem-jekyll-feed-0.15.1-1.fc31 (FEDORA-2020-c89cbf8bd3) Jekyll plugin to generate an Atom feed of your Jekyll posts -------------------------------------------------------------------------------- Update Information:
Update to version 0.15.1. Release notes: https://github.com/jekyll/jekyll- feed/releases/tag/v0.15.1 -------------------------------------------------------------------------------- ChangeLog:
* Fri Oct 9 2020 Fabio Valentini decathorpe@gmail.com - 0.15.1-1 - Update to version 0.15.1. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1885049 - rubygem-jekyll-feed-0.15.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=1885049 --------------------------------------------------------------------------------
================================================================================ sane-backends-1.0.31-3.fc31 (FEDORA-2020-1d4412c037) Scanner access software -------------------------------------------------------------------------------- Update Information:
1750899 - CANOSCAN N650U scanner device not correctly detected via USB -------------------------------------------------------------------------------- ChangeLog:
* Fri Oct 9 2020 Zdenek Dohnal zdohnal@redhat.com - 1.0.31-3 - 1750899 - CANOSCAN N650U scanner device not correctly detected via USB -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1750899 - CANOSCAN N650U scanner device not correctly detected via USB https://bugzilla.redhat.com/show_bug.cgi?id=1750899 --------------------------------------------------------------------------------
================================================================================ wireshark-3.2.7-1.fc31 (FEDORA-2020-1b390bec14) Network traffic analyzer -------------------------------------------------------------------------------- Update Information:
New version 3.2.7 Security fix for CVE-2020-25862, CVE-2020-25863, CVE-2020-25866 -------------------------------------------------------------------------------- ChangeLog:
* Fri Oct 9 2020 Michal Ruprich mruprich@redhat.com - 1:3.2.7-1 - New version 3.2.7 - Fix for CVE-2020-25862, CVE-2020-25863, CVE-2020-25866 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1886041 - CVE-2020-25862 wireshark: TCP dissector crash (wnpa-sec-2020-12) https://bugzilla.redhat.com/show_bug.cgi?id=1886041 [ 2 ] Bug #1886044 - CVE-2020-25863 wireshark: MIME multipart dissector crash (wnpa-sec-2020-11) https://bugzilla.redhat.com/show_bug.cgi?id=1886044 [ 3 ] Bug #1886051 - CVE-2020-25866 wireshark: BLIP dissector crash (wnpa-sec-2020-13) https://bugzilla.redhat.com/show_bug.cgi?id=1886051 --------------------------------------------------------------------------------