The following Fedora 35 Security updates need testing: Age URL 278 https://bodhi.fedoraproject.org/updates/FEDORA-2022-dfc6924a11 mysql-connector-java-8.0.28-1.fc35 13 https://bodhi.fedoraproject.org/updates/FEDORA-2022-fcf5dbb447 libxml2-2.10.3-2.fc35 xmlsec1-1.2.29-5.fc35 12 https://bodhi.fedoraproject.org/updates/FEDORA-2022-8ac4104a02 systemd-249.13-6.fc35 10 https://bodhi.fedoraproject.org/updates/FEDORA-2022-de515f765f nodejs-16.18.1-1.fc35 8 https://bodhi.fedoraproject.org/updates/FEDORA-2022-5495b36bed xorg-x11-server-Xwayland-21.1.4-3.fc35 8 https://bodhi.fedoraproject.org/updates/FEDORA-2022-9100b7aafd xorg-x11-server-1.20.14-9.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-004b185fa4 python3.6-3.6.15-14.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-2004702d98 kubernetes-1.22.16-1.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-22d8ba36d0 js-jquery-ui-1.13.2-1.fc35 2 https://bodhi.fedoraproject.org/updates/FEDORA-2022-8cf76a9ceb xterm-375-1.fc35 2 https://bodhi.fedoraproject.org/updates/FEDORA-2022-7798bf3aa3 python3.8-3.8.15-2.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-f44dd1bec2 python3.10-3.10.8-3.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-760d1eac9b python3.7-3.7.15-2.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-e733724edb freerdp-2.8.1-1.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-c29b9ad5e5 grub2-2.06-12.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-74fe01686a drupal7-link-1.11-1.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-288e2fa22b drupal7-context-3.11-1.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-003403ec6b samba-4.15.12-0.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-14f11bfc73 ntfs-3g-2022.10.3-1.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-88cefef88c krb5-1.19.2-9.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-c6e50d409b heimdal-7.7.1-1.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-927df621df thunderbird-102.5.0-1.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-53a4a5dd11 xen-4.15.4-1.fc35
The following Fedora 35 Critical Path updates have yet to be approved: Age URL 97 https://bodhi.fedoraproject.org/updates/FEDORA-2022-bca7996d14 annobin-10.81-1.fc35 61 https://bodhi.fedoraproject.org/updates/FEDORA-2022-97f6c4fd2a libblockdev-2.28-2.fc35 13 https://bodhi.fedoraproject.org/updates/FEDORA-2022-fcf5dbb447 libxml2-2.10.3-2.fc35 xmlsec1-1.2.29-5.fc35 12 https://bodhi.fedoraproject.org/updates/FEDORA-2022-8ac4104a02 systemd-249.13-6.fc35 12 https://bodhi.fedoraproject.org/updates/FEDORA-2022-26c41f14c8 gnutls-3.7.8-3.fc35 8 https://bodhi.fedoraproject.org/updates/FEDORA-2022-91930d445c imath-3.1.6-1.fc35 8 https://bodhi.fedoraproject.org/updates/FEDORA-2022-9100b7aafd xorg-x11-server-1.20.14-9.fc35 8 https://bodhi.fedoraproject.org/updates/FEDORA-2022-5495b36bed xorg-x11-server-Xwayland-21.1.4-3.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-43fa48ce4e python-rpmautospec-0.3.1-1.fc35 3 https://bodhi.fedoraproject.org/updates/FEDORA-2022-7c21d5ade1 libxcrypt-4.4.31-1.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-08abe36a9e linux-firmware-20221109-144.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-c29b9ad5e5 grub2-2.06-12.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-0f700faae4 glibc-2.34-49.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-e733724edb freerdp-2.8.1-1.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-f44dd1bec2 python3.10-3.10.8-3.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-d20fb1c73d kernel-6.0.9-100.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-53a4a5dd11 xen-4.15.4-1.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-927df621df thunderbird-102.5.0-1.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-88cefef88c krb5-1.19.2-9.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-14f11bfc73 ntfs-3g-2022.10.3-1.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-003403ec6b samba-4.15.12-0.fc35
The following builds have been pushed to Fedora 35 updates-testing
baresip-2.9.0-4.fc35 icewm-3.2.2-1.fc35 php-manual-en-20221028-2.fc35 php-yoast-phpunit-polyfills-1.0.4-1.fc35 pypolicyd-spf-2.9.3-4.fc35 python-trimesh-3.16.4-1.fc35 python3.12-3.12.0~a2-1.fc35 root-6.26.10-1.fc35 varnish-6.6.2-3.fc35
Details about builds:
================================================================================ baresip-2.9.0-4.fc35 (FEDORA-2022-dd50bd2f5f) Modular SIP user-agent with audio and video support -------------------------------------------------------------------------------- Update Information:
- Added upstream patch to fix GTK+ dial history space error -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 17 2022 Robert Scheck robert@fedoraproject.org 2.9.0-4 - Added upstream patch to fix GTK+ dial history space error --------------------------------------------------------------------------------
================================================================================ icewm-3.2.2-1.fc35 (FEDORA-2022-64334f4513) Window manager designed for speed, usability, and consistency -------------------------------------------------------------------------------- Update Information:
Update to latest version -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 17 2022 Artem Polishchuk ego.cordatus@gmail.com 3.2.2-1 - chore: Update to 3.2.2 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2143480 - icewm-3.2.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2143480 --------------------------------------------------------------------------------
================================================================================ php-manual-en-20221028-2.fc35 (FEDORA-2022-10f12effd5) Documentation for the PHP programming language -------------------------------------------------------------------------------- Update Information:
Update and fix license expression -------------------------------------------------------------------------------- ChangeLog:
* Tue Nov 1 2022 Stephen Medina stephen@lilmail.xyz - 20221028-2 - Fix license expression * Fri Oct 28 2022 Stephen Medina stephen@lilmail.xyz - 20221028-1 - Update to latest on 2022-10-28 * Fri Jul 22 2022 Fedora Release Engineering releng@fedoraproject.org - 20201202-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild * Fri Jan 21 2022 Fedora Release Engineering releng@fedoraproject.org - 20201202-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ php-yoast-phpunit-polyfills-1.0.4-1.fc35 (FEDORA-2022-84aa16b42b) Set of polyfills for changed PHPUnit functionality -------------------------------------------------------------------------------- Update Information:
**Version 1.0.4** Changed * The Yoast\PHPUnitPolyfills\Autoload class is now final. PR #77. * README: clear up minor language confusion. Props @PhilETaylor and @fredericgboutin-yapla for pointing it out. * README: fix links which were broken due to an upstream branch rename. PR #80. * Verified PHP 8.2 compatibility. * General housekeeping. -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Remi Collet remi@remirepo.net - 1.0.4-1 - update to 1.0.4 --------------------------------------------------------------------------------
================================================================================ pypolicyd-spf-2.9.3-4.fc35 (FEDORA-2022-bf48bba014) SPF Policy Server for Postfix (Python implementation) -------------------------------------------------------------------------------- Update Information:
Split milter into its own sub-package. ---- Add python3-authres and python3-pymilter dependencies. **Note: EPEL9 still does not have those package - branches have been requested.** -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 17 2022 Bojan Smojver bojan@rexursive.com 2.9.3-4 - split milter into a sub-package * Tue Nov 15 2022 Bojan Smojver bojan@rexursive.com 2.9.3-3 - require python3-pymilter (bug #2142743) * Mon Nov 14 2022 Bojan Smojver bojan@rexursive.com 2.9.3-2 - require python3-authres (bug #2142476) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2142476 - pypolicyd-spf-2.9.3-1 missed requirement to python3-authres https://bugzilla.redhat.com/show_bug.cgi?id=2142476 [ 2 ] Bug #2142534 - pypolicyd-spf causing selinux errors https://bugzilla.redhat.com/show_bug.cgi?id=2142534 [ 3 ] Bug #2142743 - pypolicyd-spf-2.9.3-1 missed requirement to python3-pymilter https://bugzilla.redhat.com/show_bug.cgi?id=2142743 --------------------------------------------------------------------------------
================================================================================ python-trimesh-3.16.4-1.fc35 (FEDORA-2022-9e3c2e3d56) Import, export, process, analyze and view triangular meshes -------------------------------------------------------------------------------- Update Information:
Update to 3.16.4 -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 17 2022 Benjamin A. Beasley code@musicinmybrain.net 3.16.4-1 - Update to 3.16.4 (close RHBZ#2143778) * Thu Nov 17 2022 Benjamin A. Beasley code@musicinmybrain.net 3.16.3-1 - Update to 3.16.3 (close RHBZ#2143124) * Mon Nov 14 2022 Benjamin A. Beasley code@musicinmybrain.net 3.16.2-1 - Update to 3.16.2 (close RHBZ#2141880) * Fri Nov 11 2022 Benjamin A. Beasley code@musicinmybrain.net 3.16.1-1 - Update to 3.16.1 (close RHBZ#2140244) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2140244 - python-trimesh-3.16.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2140244 [ 2 ] Bug #2141880 - python-trimesh-3.16.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2141880 [ 3 ] Bug #2143124 - python-trimesh-3.16.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=2143124 [ 4 ] Bug #2143778 - python-trimesh-3.16.4 is available https://bugzilla.redhat.com/show_bug.cgi?id=2143778 --------------------------------------------------------------------------------
================================================================================ python3.12-3.12.0~a2-1.fc35 (FEDORA-2022-462312af1c) Version 3.12 of the Python interpreter -------------------------------------------------------------------------------- Update Information:
Python 3.12.0a2 -------------------------------------------------------------------------------- ChangeLog:
* Tue Nov 15 2022 Tom���� Hrn��iar thrnciar@redhat.com - 3.12.0~a2-1 - Update to 3.12.0a2 - Fixes: rhbz#2133847 --------------------------------------------------------------------------------
================================================================================ root-6.26.10-1.fc35 (FEDORA-2022-4149aee921) Numerical data analysis framework -------------------------------------------------------------------------------- Update Information:
ROOT 6.26.10 -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Mattias Ellert mattias.ellert@physics.uu.se - 6.26.10-1 - Update to 6.26.10 - Drop patches root-Fixes-for-garbage-collection-in-Python-3.11.patch and root-Guard-gInterpreterMutex-in-TClingClassInfo-IsEnum.patch (fixed upstream) - Use different filenames in io/loopdir tests - Update root-test-timeout.patch to address one more issue * Fri Oct 28 2022 Mattias Ellert mattias.ellert@physics.uu.se - 6.26.08-2 - Avoid race condition between C++ and Python version of a roofit test -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2143229 - root-6.26.10 is available https://bugzilla.redhat.com/show_bug.cgi?id=2143229 --------------------------------------------------------------------------------
================================================================================ varnish-6.6.2-3.fc35 (FEDORA-2022-99c5ddb2ae) High-performance HTTP accelerator -------------------------------------------------------------------------------- Update Information:
This is a security update adding fixes for the following issues * VSV00009 aka CVE-2022-38150: Denial of service * VSV00010 aka CVE-2022-45059: Request smuggling * VSV00011 aka CVE-2022-45060: Request forgery For details, see https://varnish-cache.org/security -------------------------------------------------------------------------------- ChangeLog:
* Mon Nov 14 2022 Ingvar Hagelund ingvar@redpill-linpro.com - 6.6.2-3 - Added patches for VSV00009 aka CVE-2022-38150, bz#2118570 - Added patches for VSV00010 aka CVE-2022-45059, bz#2141842 - Added patches for VSV00011 aka CVE-2022-45060, bz#2141847 - Added a bcond system_allocator, bz#1917697 - Removed comments referencing patches no longer in use -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2118570 - CVE-2022-38150 varnish: denial of service via colon-starting reason phrase [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2118570 [ 2 ] Bug #2141842 - CVE-2022-45059 varnish: Request Smuggling Vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2141842 [ 3 ] Bug #2141847 - CVE-2022-45060 varnish: Request Forgery Vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2141847 --------------------------------------------------------------------------------
test-reports@lists.fedoraproject.org