The following Fedora 36 Security updates need testing: Age URL 9 https://bodhi.fedoraproject.org/updates/FEDORA-2022-52dec6351a nodejs-16.18.1-1.fc36 6 https://bodhi.fedoraproject.org/updates/FEDORA-2022-dbe48a4bc7 sysstat-12.5.6-2.fc36 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-104076b1d8 python3.6-3.6.15-14.fc36 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-1a01ed37e2 js-jquery-ui-1.13.2-1.fc36 2 https://bodhi.fedoraproject.org/updates/FEDORA-2022-681bbe67b6 xterm-375-1.fc36 2 https://bodhi.fedoraproject.org/updates/FEDORA-2022-babfbc2622 varnish-7.0.3-2.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-462f39dd2f python3.10-3.10.8-3.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-45b9fbfcbe freerdp-2.8.1-1.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-5fd3e7f635 python3.8-3.8.15-2.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-385d2ea041 python3.7-3.7.15-2.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-31e61d51c5 grub2-2.06-55.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-d209710a36 drupal7-link-1.11-1.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-12b13cd79f drupal7-context-3.11-1.fc36
The following Fedora 36 Critical Path updates have yet to be approved: Age URL 11 https://bodhi.fedoraproject.org/updates/FEDORA-2022-edcd70289a gnutls-3.7.8-3.fc36 9 https://bodhi.fedoraproject.org/updates/FEDORA-2022-03f34f2943 avahi-0.8-16.fc36 9 https://bodhi.fedoraproject.org/updates/FEDORA-2022-1c5dc52592 pungi-4.3.6-2.fc36 7 https://bodhi.fedoraproject.org/updates/FEDORA-2022-35b9eff1e1 gnome-bluetooth-42.4-2.fc36 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-beaae40a8f python-rpmautospec-0.3.1-1.fc36 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-6c49fb07f9 s390utils-2.24.0-1.fc36 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-2305f92d83 firewalld-1.2.1-1.fc36 3 https://bodhi.fedoraproject.org/updates/FEDORA-2022-14ae37b5ba libxcrypt-4.4.31-1.fc36 2 https://bodhi.fedoraproject.org/updates/FEDORA-2022-4b6d66c74b bluez-5.66-2.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-56464a667b linux-firmware-20221109-144.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-31e61d51c5 grub2-2.06-55.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-effb41694e pipewire-0.3.60-4.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-ca291a78cf glibc-2.35-21.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-45b9fbfcbe freerdp-2.8.1-1.fc36 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-462f39dd2f python3.10-3.10.8-3.fc36
The following builds have been pushed to Fedora 36 updates-testing
cockpit-machines-278-1.fc36 cockpit-podman-57-1.fc36 electrum-4.3.2-1.fc36 heimdal-7.7.1-1.fc36 kernel-6.0.9-200.fc36 krb5-1.19.2-12.fc36 license-validate-14-1.fc36 lollypop-1.4.36-2.fc36 ntfs-3g-2022.10.3-1.fc36 osbuild-composer-68-1.fc36 packetdrill-2.0~20220927gitc556afb-3.fc36 passt-0^20221116.gace074c-1.fc36 perl-Getopt-Long-2.53-1.fc36 proxmark3-4.15864-3.fc36 python-hdmf-3.4.7-1.fc36 recoll-1.33.2-1.fc36 rsnapshot-1.4.4-1.fc36 thunderbird-102.5.0-1.fc36
Details about builds:
================================================================================ cockpit-machines-278-1.fc36 (FEDORA-2022-4f2d8b2f7c) Cockpit user interface for virtual machines -------------------------------------------------------------------------------- Update Information:
Automatic update for cockpit-machines-278-1.fc36. ##### **Changelog for cockpit-machines** ``` * Wed Nov 16 2022 Packit hello@packit.dev - 278-1 - Stability and performance improvements ``` -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Packit hello@packit.dev - 278-1 - Stability and performance improvements --------------------------------------------------------------------------------
================================================================================ cockpit-podman-57-1.fc36 (FEDORA-2022-1deef6511c) Cockpit component for Podman containers -------------------------------------------------------------------------------- Update Information:
Automatic update for cockpit-podman-57-1.fc36. ##### **Changelog for cockpit- podman** ``` * Wed Nov 16 2022 Packit hello@packit.dev - 57-1 - Performance and stability improvements ``` -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Packit hello@packit.dev - 57-1 - Performance and stability improvements --------------------------------------------------------------------------------
================================================================================ electrum-4.3.2-1.fc36 (FEDORA-2022-656fbbc9b6) A lightweight Bitcoin Client -------------------------------------------------------------------------------- Update Information:
Update to 4.3.2 -------------------------------------------------------------------------------- ChangeLog:
* Mon Nov 7 2022 Vitaly Zaitsev vitaly@easycoding.org - 4.3.2-1 - Updated to version 4.3.2. --------------------------------------------------------------------------------
================================================================================ heimdal-7.7.1-1.fc36 (FEDORA-2022-fbca84b938) A Kerberos 5 implementation without export restrictions -------------------------------------------------------------------------------- Update Information:
This release fixes the following Security Vulnerabilities: * CVE-2022-42898 PAC parse integer overflows * CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour * CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array * CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors * CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ * CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0 on the Common Vulnerability Scoring System (CVSS) v3. -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Alexander Bostr��m abo@root.snowtree.se - 7.7.1-1 - Update to 7.7.1 - Remove upstreamed patch - Replace patch with sed command * Thu Jul 21 2022 Fedora Release Engineering releng@fedoraproject.org - 7.7.0-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ kernel-6.0.9-200.fc36 (FEDORA-2022-58db008ef6) The Linux kernel -------------------------------------------------------------------------------- Update Information:
The 6.0.9 stable kernel update contains a number of important fixes across the tree. -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Justin M. Forbes jforbes@fedoraproject.org [6.0.9-0] - Linux v6.0.9 --------------------------------------------------------------------------------
================================================================================ krb5-1.19.2-12.fc36 (FEDORA-2022-78038a4441) The Kerberos network authentication system -------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2022-42898 -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 9 2022 Julien Rische jrische@redhat.com - 1.19.2-12 - Fix integer overflows in PAC parsing (CVE-2022-42898) - Resolves: rhbz#2143010 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2140960 - CVE-2022-42898 krb5: integer overflow vulnerabilities in PAC parsing https://bugzilla.redhat.com/show_bug.cgi?id=2140960 --------------------------------------------------------------------------------
================================================================================ license-validate-14-1.fc36 (FEDORA-2022-14cca51f2f) Validate SPEC license string -------------------------------------------------------------------------------- Update Information:
- stress the need to choose a license when there are more options ---- fixed duplicities in the output -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Miroslav Such�� msuchy@redhat.com 14-1 - stress the need to choose licesense when there is more options * Thu Nov 10 2022 Miroslav Such�� msuchy@redhat.com 13-1 - add variation only if it not there yet --------------------------------------------------------------------------------
================================================================================ lollypop-1.4.36-2.fc36 (FEDORA-2022-bece2d27ef) Music player for GNOME -------------------------------------------------------------------------------- Update Information:
Add libsoup-3.0 support ---- Update to 1.4.36-1 -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Martin Gansser martinkg@fedoraproject.org - 1.4.36-2 - replaced BR libsoup-2.4 by libsoup-3.0 * Mon Nov 14 2022 Martin Gansser martinkg@fedoraproject.org - 1.4.36-1 - Update to 1.4.36 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2142521 - lollypop-1.4.36 is available https://bugzilla.redhat.com/show_bug.cgi?id=2142521 --------------------------------------------------------------------------------
================================================================================ ntfs-3g-2022.10.3-1.fc36 (FEDORA-2022-4915124227) Linux NTFS userspace driver -------------------------------------------------------------------------------- Update Information:
Update to 2022.10.3. Fixes CVE-2022-40284 -------------------------------------------------------------------------------- ChangeLog:
* Thu Nov 3 2022 Gabriel Kihlman gk@sysctl.se - 2:2022.10.3-1 - New upstream version 2022.10.3 - Fixes: CVE-2022-40284 * Fri Jul 22 2022 Fedora Release Engineering releng@fedoraproject.org - 2:2022.5.17-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2090876 - ntfs-3g-2022.10.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=2090876 [ 2 ] Bug #2140031 - CVE-2022-40284: buffer overflow in NTFS-3G https://bugzilla.redhat.com/show_bug.cgi?id=2140031 --------------------------------------------------------------------------------
================================================================================ osbuild-composer-68-1.fc36 (FEDORA-2022-544f1b8aa6) An image building service based on osbuild -------------------------------------------------------------------------------- Update Information:
Automatic update for osbuild-composer-68-1.fc36. ##### **Changelog for osbuild- composer** ``` * Wed Nov 16 2022 Packit hello@packit.dev - 68-1 Changes with 68 ---------------- * Fix iot-installer build via the cloud API (#3132) * Fix issues reported by Coverity (#3092) * Fix loading cross distro compose results (#3090) * RHEL-8/9 EC2 image definitions fixes (#3135) * Refactor the RHEL 9 SAP config and packages to be useful on other platforms (#3100) * ci: add my SSH keys to the CI ssh keys (#3119) * ci: add tags to AWS instances (#3127) * cloudapi/v2: expose ostree contenturl and rhsm options (#3105) * dbjobqueue: acquire a new connection for each listen query (#3116) * diff- manifests.sh: Use shared_lib for greenprint and redprint (#3133) * distro: SELinux should be the last stage (#3117) * docker-compose: remove unavailable `--dnf-json` (#3124) * tools/provision.sh: copy RHEL repo overrides using wildcard (#3111) Contributions from: Brian C. Lane, Jakub Rusz, Ond��ej Budai, Paul Whalen, Sanne Raymaekers, Simon de Vlieger, Thomas Lavocat, Tom Gundersen, Tom���� Hozza ��� Somewhere on the Internet, 2022-11-16 ``` -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Packit hello@packit.dev - 68-1 Changes with 68 ---------------- * Fix iot-installer build via the cloud API (#3132) * Fix issues reported by Coverity (#3092) * Fix loading cross distro compose results (#3090) * RHEL-8/9 EC2 image definitions fixes (#3135) * Refactor the RHEL 9 SAP config and packages to be useful on other platforms (#3100) * ci: add my SSH keys to the CI ssh keys (#3119) * ci: add tags to AWS instances (#3127) * cloudapi/v2: expose ostree contenturl and rhsm options (#3105) * dbjobqueue: acquire a new connection for each listen query (#3116) * diff-manifests.sh: Use shared_lib for greenprint and redprint (#3133) * distro: SELinux should be the last stage (#3117) * docker-compose: remove unavailable `--dnf-json` (#3124) * tools/provision.sh: copy RHEL repo overrides using wildcard (#3111)
Contributions from: Brian C. Lane, Jakub Rusz, Ond��ej Budai, Paul Whalen, Sanne Raymaekers, Simon de Vlieger, Thomas Lavocat, Tom Gundersen, Tom���� Hozza
��� Somewhere on the Internet, 2022-11-16 --------------------------------------------------------------------------------
================================================================================ packetdrill-2.0~20220927gitc556afb-3.fc36 (FEDORA-2022-17ca738670) Quick, precise tests for entire TCP/UDP/IPv4/IPv6 network stacks -------------------------------------------------------------------------------- Update Information:
Backport upstream PR for Python 3 support -------------------------------------------------------------------------------- ChangeLog:
* Tue Nov 15 2022 Davide Cavalca dcavalca@fedoraproject.org 2.0~20220927gitc556afb-3 - Backport upstream PR for Python 3 support --------------------------------------------------------------------------------
================================================================================ passt-0^20221116.gace074c-1.fc36 (FEDORA-2022-5cb1543d5a) User-mode networking daemons for virtual machines and namespaces -------------------------------------------------------------------------------- Update Information:
Possibly visible user change: two patches reverted upstream might fix erratic behaviour with qemu unable to send TX frames after a given amount of packet flooding. ---- Visible user changes: * running with IPv6 disabled and sending IPv6 traffic from sockets, or IPv4 disabled and sending IPv4 from sockets doesn't result in passt/pasta to exit anymore * network mask for IPv4 is correctly reported in start-up messages -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Stefano Brivio sbrivio@redhat.com - 0^20221116.gace074c-1 - Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_11_10.4129764..2022_11_16.a... * Thu Nov 10 2022 Stefano Brivio sbrivio@redhat.com - 0^20221110.g4129764-1 - Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_11_04.e308018..2022_11_10.4... * Fri Nov 4 2022 Stefano Brivio sbrivio@redhat.com - 0^20221104.ge308018-1 - Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_10_26.f212044..2022_11_04.e... --------------------------------------------------------------------------------
================================================================================ perl-Getopt-Long-2.53-1.fc36 (FEDORA-2022-32f018e5f1) Extended processing of command line options -------------------------------------------------------------------------------- Update Information:
Changes in version 2.53 * Improve parsing of float numbers. * Fix Version/HelpMessage -message argument. * Added 'starter' method to the callback object. This method returns the starter (e.g. '--' or '-') of the option as used by the user. * Enhanced option:default spec to octal, hex and binary. -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Jitka Plesnikova jplesnik@redhat.com - 1:2.53-1 - 2.53 bump -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2142938 - perl-Getopt-Long-2.53 is available https://bugzilla.redhat.com/show_bug.cgi?id=2142938 --------------------------------------------------------------------------------
================================================================================ proxmark3-4.15864-3.fc36 (FEDORA-2022-b435a61ef8) The Swiss Army Knife of RFID Research - RRG/Iceman repo -------------------------------------------------------------------------------- Update Information:
Update to latest release v4.15864 (Radium) -------------------------------------------------------------------------------- ChangeLog:
* Mon Nov 14 2022 Marlin Soose marlin.soose@laro.se - 4.15864 - Bumping package to v4.15864 * Fri Jul 22 2022 Fedora Release Engineering releng@fedoraproject.org - 4.14831-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild * Mon Jun 13 2022 Python Maint python-maint@redhat.com - 4.14831-2 - Rebuilt for Python 3.11 --------------------------------------------------------------------------------
================================================================================ python-hdmf-3.4.7-1.fc36 (FEDORA-2022-a93ba33262) A package for standardizing hierarchical object data -------------------------------------------------------------------------------- Update Information:
## HDMF 3.4.7 (November 9, 2022) ### Minor improvements - Update CI, versioneer, and some requirements. ### Bug fixes - Fix an issue where not providing an optional argument to `__init__` of an auto-generated `MultiContainerInterface` class raised an error. - Fixed an issue with the `data_utils.GenericDataChunkIterator` where if the underlying dataset was such that the `numpy.product` of the `maxshape` exceeded the range of the default `int32`, buffer overflow would occur and cause the true buffer shape to exceed available memory. This has been resolved by dropping all `numpy` operations (which forced casting within the passed data type) in favor of the unlimited precision of Python builtin integer types. -------------------------------------------------------------------------------- ChangeLog:
* Tue Nov 15 2022 Benjamin A. Beasley code@musicinmybrain.net 3.4.7-1 - Update to 3.4.7 (close RHBZ#2142083) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2142083 - python-hdmf-3.4.7 is available https://bugzilla.redhat.com/show_bug.cgi?id=2142083 --------------------------------------------------------------------------------
================================================================================ recoll-1.33.2-1.fc36 (FEDORA-2022-c6c24cda79) Desktop full text search tool with Qt GUI -------------------------------------------------------------------------------- Update Information:
Update to latest upstream release recoll 1.33.2 -------------------------------------------------------------------------------- ChangeLog:
* Sat Nov 12 2022 Terje Rosten terje.rosten@ntnu.no - 1.33.2-1 - 1.33.2 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2141624 - recoll-1.33.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2141624 --------------------------------------------------------------------------------
================================================================================ rsnapshot-1.4.4-1.fc36 (FEDORA-2022-78993d3451) Local and remote filesystem snapshot utility -------------------------------------------------------------------------------- Update Information:
# rsnapshot 1.4.4 - Add sentence explaining rsync_long|short_args + sign to man page - Fix rsnapreport problems (incorrect header, fail when `rsync` present, fail with LVM) - Add notes about documentation, and link to the website repo - Fix for '`rsync_cleanup_after_native_cp_al()` only works on directories' fail when `sync_first on` and `cmd_cp` not set (#133), add test - Fix for `rm -rf` failing when the path contains `./` - Suppress noisy error from non-GNU `cp` on BSD-ish machines, including MacOS - Add CentOS 7 to successfully tested to docs - Minor tidy up rel `configure` options `--with-test-(true|false)` - Update travis build settings - Dont use `m4_esyscmd_s` in `configure.ac` - Update docs to remove dangling refs to HOWTO on rsnapshot.org - Skip both SSH tests (rather one) if SSH doesn't work - Use perl-5.30 for tests (used in Ubuntu 20.04 Focal) - Lower verbose level of `rsync` output to 1.3.x equivalent to work with `rsnapreport.pl` again - Fix location of true and false binaries on macOS -------------------------------------------------------------------------------- ChangeLog:
* Wed Nov 16 2022 Robert Scheck robert@fedoraproject.org - 1.4.4-1 - Upgrade to 1.4.4 (#1974006, thanks to Todd Zullinger) * Sat Jul 23 2022 Fedora Release Engineering releng@fedoraproject.org - 1.4.3-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1974006 - rsnapshot 1.4.4 is available. Please build for EPEL8 and Fedora34 https://bugzilla.redhat.com/show_bug.cgi?id=1974006 --------------------------------------------------------------------------------
================================================================================ thunderbird-102.5.0-1.fc36 (FEDORA-2022-05bdce3585) Mozilla Thunderbird mail/newsgroup client -------------------------------------------------------------------------------- Update Information:
Update to 102.5.0 ; https://www.mozilla.org/en- US/security/advisories/mfsa2022-49/ ; https://www.thunderbird.net/en- US/thunderbird/102.5.0/releasenotes/ ; https://www.thunderbird.net/en- US/thunderbird/102.4.2/releasenotes/ -------------------------------------------------------------------------------- ChangeLog:
* Tue Nov 15 2022 Eike Rathke erack@redhat.com - 102.5.0-1 - Update to 102.5.0 - Use SPDX license IDs in spec --------------------------------------------------------------------------------
test-reports@lists.fedoraproject.org