The following Fedora 38 Security updates need testing:
Age URL
38
https://bodhi.fedoraproject.org/updates/FEDORA-2023-3dc1f9ba12
cutter-re-2.2.1-1.fc38 rizin-0.5.2-1.fc38.2
6
https://bodhi.fedoraproject.org/updates/FEDORA-2023-c7f63322b5
kubernetes-1.26.6-1.fc38
4
https://bodhi.fedoraproject.org/updates/FEDORA-2023-7e952959f8
suricata-6.0.13-1.fc38
4
https://bodhi.fedoraproject.org/updates/FEDORA-2023-3ca351353f
moodle-4.1.4-1.fc38
2
https://bodhi.fedoraproject.org/updates/FEDORA-2023-b86fd9ad80 pcs-0.11.6-1.fc38
2
https://bodhi.fedoraproject.org/updates/FEDORA-2023-ac947ec260
sysstat-12.7.4-1.fc38
The following Fedora 38 Critical Path updates have yet to be approved:
Age URL
51
https://bodhi.fedoraproject.org/updates/FEDORA-2023-fb366d5ed5
binutils-2.39-12.fc38
13
https://bodhi.fedoraproject.org/updates/FEDORA-2023-1b6672bbe1
uboot-tools-2023.04-2.fc38
13
https://bodhi.fedoraproject.org/updates/FEDORA-2023-ef3b10d387
netcat-1.225-1.fc38
12
https://bodhi.fedoraproject.org/updates/FEDORA-2023-0ac8519750
lxsession-0.5.5-10.D20210419git82580e45.fc38
10
https://bodhi.fedoraproject.org/updates/FEDORA-2023-32b5bc8bdf
python3-docs-3.11.4-1.fc38 python3.11-3.11.4-1.fc38
4
https://bodhi.fedoraproject.org/updates/FEDORA-2023-5e2f30babb
perl-Net-HTTP-6.23-1.fc38
4
https://bodhi.fedoraproject.org/updates/FEDORA-2023-4cdf4fe0e5
libburn-1.5.6-1.fc38 libisoburn-1.5.6-1.fc38 libisofs-1.5.6-1.fc38
4
https://bodhi.fedoraproject.org/updates/FEDORA-2023-a4c4cb92bb
tomcat-9.0.76-2.fc38
2
https://bodhi.fedoraproject.org/updates/FEDORA-2023-9b7e08901a
kernel-6.3.9-200.fc38
The following builds have been pushed to Fedora 38 updates-testing
apache-commons-text-1.10.0-1.fc38
apache-ivy-2.5.1-3.fc38
bluez-5.66-6.fc38
ccdciel-0.9.84-1.fc38
ckb-next-0.6.0-1.fc38
corsix-th-0.67~beta1-1.fc38
flmsg-4.0.22-1.fc38
golang-github-schollz-croc-9.6.4-2.fc38
golang-github-schollz-mnemonicode-1.0.1-6.20230519git63fa713.fc38
jc-1.23.3-1.fc38
kjournald-23.04.2-1.fc38
python-trailrunner-1.4.0-1.fc38
qflipper-1.3.2-1.fc38
recoll-1.34.7-1.fc38
samba-4.18.3-4.fc38
sddm-0.20.0-1.fc38
Details about builds:
================================================================================
apache-commons-text-1.10.0-1.fc38 (FEDORA-2023-b8fe73ea37)
Apache Commons Text is a library focused on algorithms working on strings
--------------------------------------------------------------------------------
Update Information:
**Changelog** ``` * Sat Jun 24 2023 Didik Supriadi
<didiksupriadi41(a)fedoraproject.org> - 1.10.0-1 - Update to version 1.10.0 -
Disable tests ```
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jun 24 2023 Didik Supriadi <didiksupriadi41(a)fedoraproject.org> - 1.10.0-1
- Update to version 1.10.0
- Disable tests
* Sat Apr 29 2023 Didik Supriadi <didiksupriadi41(a)fedoraproject.org> - 1.9-5
- migrated to SPDX license
--------------------------------------------------------------------------------
================================================================================
apache-ivy-2.5.1-3.fc38 (FEDORA-2023-35f775fd6e)
Java-based dependency manager
--------------------------------------------------------------------------------
Update Information:
**Changelog** ``` * Sun Jun 25 2023 Didik Supriadi
<didiksupriadi41(a)fedoraproject.org> - 2.5.1-3 - Build with ivy instead of maven
```
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 25 2023 Didik Supriadi <didiksupriadi41(a)fedoraproject.org> - 2.5.1-3
- Build with ivy instead of maven
* Sat Apr 29 2023 Didik Supriadi <didiksupriadi41(a)fedoraproject.org> - 2.5.1-2
- migrated to SPDX license
* Wed Feb 22 2023 Didik Supriadi <didiksupriadi41(a)fedoraproject.org> - 2.5.1-1
- Update to version 2.5.1
- Remove alias for jayasoft:ivy
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2140083 - apache-ivy-2.5.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2140083
[ 2 ] Bug #2154282 - CVE-2022-37866 apache-ivy: : Apache Ivy: Ivy Path traversal
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2154282
[ 3 ] Bug #2182189 - CVE-2022-37865 apache-ivy: Directory Traversal [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2182189
--------------------------------------------------------------------------------
================================================================================
bluez-5.66-6.fc38 (FEDORA-2023-deb7bffeb8)
Bluetooth utilities
--------------------------------------------------------------------------------
Update Information:
This update fixes some devices not being visible when discovering them in
GNOME's Bluetooth Settings.
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 25 2023 Bastien Nocera <bnocera(a)redhat.com> - 5.66-6
- Add patch that fixes some devices not being discoverable in
GNOME's Bluetooth Settings
--------------------------------------------------------------------------------
================================================================================
ccdciel-0.9.84-1.fc38 (FEDORA-2023-9b9be3b417)
CCD capture software
--------------------------------------------------------------------------------
Update Information:
- Update to 0.9.84 - i686 builds have been disabled
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 25 2023 Mattia Verga <mattia.verga(a)proton.me> - 0.9.84-1
- Update to 0.9.84 (fedora#2216231)
* Sun Feb 19 2023 Mattia Verga <mattia.verga(a)proton.me> - 0.9.82-1
- Update to 0.9.82 (fedora#2167168)
--------------------------------------------------------------------------------
================================================================================
ckb-next-0.6.0-1.fc38 (FEDORA-2023-c6a18f2390)
Unofficial driver for Corsair RGB keyboards
--------------------------------------------------------------------------------
Update Information:
Update to v0.6.0
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 25 2023 Artur Frenszek-Iwicki <fedora(a)svgames.pl> - 0.6.0-1
- Update to v0.6.0
- Drop Patch0 (buffer overflow fix - backported from this release)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2216986 - ckb-next-0.6.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2216986
--------------------------------------------------------------------------------
================================================================================
corsix-th-0.67~beta1-1.fc38 (FEDORA-2023-9130c1c729)
Open source clone of Theme Hospital
--------------------------------------------------------------------------------
Update Information:
Update to 0.67-beta1
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 25 2023 Artem Polishchuk <ego.cordatus(a)gmail.com> - 0.67~beta1-1
- chore: Update to 0.67-beta1
--------------------------------------------------------------------------------
================================================================================
flmsg-4.0.22-1.fc38 (FEDORA-2023-663580766c)
Fast Light Message Amateur Radio Forms Manager
--------------------------------------------------------------------------------
Update Information:
Version 4.0.22 * maintenance release . 7b2f12e7: Expert dialog
window bar . 1c7a02ee: RAFAC F126 . 3fc1ac5a: fltk-1.4 mods
Expert dialog window bar * correct window bar name corruption RAFAC
F126 * add RAFAC F126 form fltk-1.4 mods Version 4.0.21 *
maintenance release Main Window Icon * Fix Fltk transpareny bug for
flrig icon. KNAME * correct KNAME define 64 build * update
for 64 bit build
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 25 2023 Richard Shaw <hobbes1069(a)gmail.com> - 4.0.22-1
- Update to 2.0.22.
- Update license tag to SPDX format.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2217249 - flmsg-4.0.22 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2217249
--------------------------------------------------------------------------------
================================================================================
golang-github-schollz-croc-9.6.4-2.fc38 (FEDORA-2023-ac4651c9b2)
Easily and securely send things from one computer to another
--------------------------------------------------------------------------------
Update Information:
croc 9.6.4
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 25 2023 Davide Cavalca <dcavalca(a)fedoraproject.org> - 9.6.4-2
- Gate out broken test on s390x for f38
* Fri May 19 2023 Mikel Olasagasti Uranga <mikel(a)olasagasti.info> - 9.6.4-1
- Update to 9.6.4 - Closes rhbz#2208585 rhbz#2171537 rhbz#2163218
* Thu Jan 19 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 9.5.2-4
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Thu Jul 21 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 9.5.2-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Tue Jul 19 2022 Maxwell G <gotmax(a)e.email> - 9.5.2-2
- Rebuild for
CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2163218 - CVE-2022-41717 golang-github-schollz-croc: golang: net/http: An
attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2163218
[ 2 ] Bug #2171537 - golang-github-schollz-croc: FTBFS in Fedora rawhide/f38
https://bugzilla.redhat.com/show_bug.cgi?id=2171537
[ 3 ] Bug #2208585 - golang-github-schollz-croc-9.6.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2208585
--------------------------------------------------------------------------------
================================================================================
golang-github-schollz-mnemonicode-1.0.1-6.20230519git63fa713.fc38
(FEDORA-2023-ac4651c9b2)
Method for encoding binary data into a sequence of words
--------------------------------------------------------------------------------
Update Information:
croc 9.6.4
--------------------------------------------------------------------------------
ChangeLog:
* Fri May 19 2023 Mikel Olasagasti Uranga <mikel(a)olasagasti.info> - 1.0.1-6
- Update to latest git
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2163218 - CVE-2022-41717 golang-github-schollz-croc: golang: net/http: An
attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2163218
[ 2 ] Bug #2171537 - golang-github-schollz-croc: FTBFS in Fedora rawhide/f38
https://bugzilla.redhat.com/show_bug.cgi?id=2171537
[ 3 ] Bug #2208585 - golang-github-schollz-croc-9.6.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2208585
--------------------------------------------------------------------------------
================================================================================
jc-1.23.3-1.fc38 (FEDORA-2023-225960da3c)
Serialize the output of CLI tools and file-types to structured JSON
--------------------------------------------------------------------------------
Update Information:
Update to v1.23.3
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 25 2023 Artur Frenszek-Iwicki <fedora(a)svgames.pl> - 1.23.3-1
- Update to v1.23.3
* Wed Jun 14 2023 Python Maint <python-maint(a)redhat.com> - 1.23.2-2
- Rebuilt for Python 3.12
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2216587 - jc-1.23.3 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2216587
--------------------------------------------------------------------------------
================================================================================
kjournald-23.04.2-1.fc38 (FEDORA-2023-42882354bc)
Framework for interacting with systemd-journald
--------------------------------------------------------------------------------
Update Information:
Initial release
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jun 8 2023 Steve Cossette <farchord(a)gmail.com> - 23.04.2-1
- Initial release
--------------------------------------------------------------------------------
================================================================================
python-trailrunner-1.4.0-1.fc38 (FEDORA-2023-2d2bd98256)
Walk paths and run things
--------------------------------------------------------------------------------
Update Information:
Update to 1.4.0; Fixes: RHBZ#2181995
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 25 2023 Davide Cavalca <dcavalca(a)fedoraproject.org> - 1.4.0-1
- Update to 1.4.0; Fixes: RHBZ#2181995
* Thu Jun 15 2023 Python Maint <python-maint(a)redhat.com> - 1.3.0-3
- Rebuilt for Python 3.12
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2181995 - python-trailrunner-1.4.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2181995
--------------------------------------------------------------------------------
================================================================================
qflipper-1.3.2-1.fc38 (FEDORA-2023-f0067422b1)
Desktop application for updating Flipper Zero firmware via PC
--------------------------------------------------------------------------------
Update Information:
Update to 1.3.2; Fixes: RHBZ#2209837
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 25 2023 Davide Cavalca <dcavalca(a)fedoraproject.org> - 1.3.2-1
- Update to 1.3.2; Fixes: RHBZ#2209837
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2209837 - qflipper-1.3.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2209837
--------------------------------------------------------------------------------
================================================================================
recoll-1.34.7-1.fc38 (FEDORA-2023-40af5dcf67)
Desktop full text search tool with Qt GUI
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream release recoll 1.34.7.
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jun 25 2023 Terje Rosten <terje.rosten(a)ntnu.no> - 1.34.7-1
- 1.34.7
- Add patch from upstream to fix bz#2213017 and bz#2203626
* Tue Jun 13 2023 Python Maint <python-maint(a)redhat.com> - 1.34.6-2
- Rebuilt for Python 3.12
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2203626 - [abrt] recoll: module():
rclaspell-sugg.py:54:<module>:aspell.AspellSpellerError: The file
"/home/christian/.recoll/aspdict.de.rws" can not be opened for reading.
https://bugzilla.redhat.com/show_bug.cgi?id=2203626
[ 2 ] Bug #2213017 - [abrt] recoll: module():
rclaspell-sugg.py:54:<module>:aspell.AspellSpellerError: The file
"/home/aaron/.recoll/aspdict.en.rws" can not be opened for reading.
https://bugzilla.redhat.com/show_bug.cgi?id=2213017
--------------------------------------------------------------------------------
================================================================================
samba-4.18.3-4.fc38 (FEDORA-2023-dea6c15882)
Server and Client software to interoperate with Windows machines
--------------------------------------------------------------------------------
Update Information:
This update makes the libwbclient %pre script that was added in the previous
update only run on updates (not fresh installs), avoiding a problem when it's
ordered before the installation of coreutils on fresh installs.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jun 26 2023 Adam Williamson <awilliam(a)redhat.com> - 4.18.3-4
- Only run libwbclient %pre on upgrade, not fresh install
--------------------------------------------------------------------------------
================================================================================
sddm-0.20.0-1.fc38 (FEDORA-2023-d555175828)
QML based desktop and login manager
--------------------------------------------------------------------------------
Update Information:
Update to final 0.20.0 version
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jun 23 2023 Neal Gompa <ngompa(a)fedoraproject.org> - 0.20.0-1
- Update to 0.20.0 final
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2217151 - sddm-0.20.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2217151
--------------------------------------------------------------------------------