The following Fedora 37 Security updates need testing:
Age URL
195
https://bodhi.fedoraproject.org/updates/FEDORA-2023-4b892d116d
cutter-re-2.2.1-1.fc37 rizin-0.5.2-1.fc37
94
https://bodhi.fedoraproject.org/updates/FEDORA-2023-5c4718e547
containerd-1.6.23-1.fc37
34
https://bodhi.fedoraproject.org/updates/FEDORA-2023-253212d414
thunderbird-115.4.1-1.fc37
8
https://bodhi.fedoraproject.org/updates/FEDORA-2023-f0be0daaa5
poppler-22.08.0-5.fc37
6
https://bodhi.fedoraproject.org/updates/FEDORA-2023-ce2836acfa
golang-github-openprinting-ipp-usb-0.9.23-5.fc37
3
https://bodhi.fedoraproject.org/updates/FEDORA-2023-b845c60d1c
java-latest-openjdk-21.0.1.0.12-1.rolling.fc37
2
https://bodhi.fedoraproject.org/updates/FEDORA-2023-8ff7f34eb0
java-17-openjdk-17.0.9.0.9-1.fc37
2
https://bodhi.fedoraproject.org/updates/FEDORA-2023-25329c196b
motif-2.3.4-30.fc37
2
https://bodhi.fedoraproject.org/updates/FEDORA-2023-dce9c4b01f
firefox-120.0-3.fc37
The following Fedora 37 Critical Path updates have yet to be approved:
Age URL
49
https://bodhi.fedoraproject.org/updates/FEDORA-2023-bc6bf2453f
container-selinux-2.224.0-1.fc37
34
https://bodhi.fedoraproject.org/updates/FEDORA-2023-253212d414
thunderbird-115.4.1-1.fc37
13
https://bodhi.fedoraproject.org/updates/FEDORA-2023-5c9b2b08f4
libxslt-1.1.39-1.fc37
8
https://bodhi.fedoraproject.org/updates/FEDORA-2023-09bad4af42
netcat-1.226-1.fc37
8
https://bodhi.fedoraproject.org/updates/FEDORA-2023-f0be0daaa5
poppler-22.08.0-5.fc37
6
https://bodhi.fedoraproject.org/updates/FEDORA-2023-b8b9c2ed1b crun-1.12-1.fc37
3
https://bodhi.fedoraproject.org/updates/FEDORA-2023-0200aecd54 ethtool-6.6-1.fc37
2
https://bodhi.fedoraproject.org/updates/FEDORA-2023-dce9c4b01f
firefox-120.0-3.fc37
2
https://bodhi.fedoraproject.org/updates/FEDORA-2023-1582a08b60
systemd-251.19-1.fc37
2
https://bodhi.fedoraproject.org/updates/FEDORA-2023-8ff7f34eb0
java-17-openjdk-17.0.9.0.9-1.fc37
2
https://bodhi.fedoraproject.org/updates/FEDORA-2023-f2b189966b
fedora-appstream-metadata-20231124-1.fc37
The following builds have been pushed to Fedora 37 updates-testing
chromium-119.0.6045.199-1.fc37
elfutils-0.190-2.fc37
kernel-6.5.13-100.fc37
osbuild-composer-95-1.fc37
python2.7-2.7.18-36.fc37
Details about builds:
================================================================================
chromium-119.0.6045.199-1.fc37 (FEDORA-2023-ceaa6b19c1)
A WebKit (Blink) powered web browser that Google doesn't want you to use
--------------------------------------------------------------------------------
Update Information:
update to 119.0.6045.199, upstream security release High CVE-2023-6345: Integer
overflow in Skia High CVE-2023-6347: Use after free in Mojo High
CVE-2023-6346: Use after free in WebAudio High CVE-2023-6350: Out of bounds
memory access in libavif High CVE-2023-6351: Use after free in libavif High
CVE-2023-6345: Integer overflow in Skia
--------------------------------------------------------------------------------
ChangeLog:
* Wed Nov 29 2023 Than Ngo <than(a)redhat.com> - 119.0.6045.199-1
- update to 119.0.6045.199
--------------------------------------------------------------------------------
================================================================================
elfutils-0.190-2.fc37 (FEDORA-2023-753a7b5278)
A collection of utilities and DSOs to handle ELF files and DWARF data
--------------------------------------------------------------------------------
Update Information:
This update modifies Fedora license tags to spdx license tags. It adds a patch
that fixes
https://sourceware.org/bugzilla/show_bug.cgi?id=30975. It also
removes a couple obscure tests in tests/run-strip-strmerge.sh that might fail on
i386. PR for this bug:
https://sourceware.org/bugzilla/show_bug.cgi?id=31097
--------------------------------------------------------------------------------
ChangeLog:
* Wed Nov 29 2023 Aaron Merey <amerey(a)fedoraproject.org> - 0.190-2
- Update Fedora license tags to spdx license tags
- Add elfutils-0.190-fix-core-noncontig.patch
- Add elfutils-0.190-remove-ET_REL-unstrip-test.patch
--------------------------------------------------------------------------------
================================================================================
kernel-6.5.13-100.fc37 (FEDORA-2023-222a27cc53)
The Linux kernel
--------------------------------------------------------------------------------
Update Information:
The 6.5.13 stable kernel update contains a number of important fixes across the
tree.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Nov 28 2023 Augusto Caringi <acaringi(a)redhat.com> [6.5.13-0]
- Drop F39 and F38 from the 6.5 release_targets (Justin M. Forbes)
- Linux v6.5.13
--------------------------------------------------------------------------------
================================================================================
osbuild-composer-95-1.fc37 (FEDORA-2023-098cbd978d)
An image building service based on osbuild
--------------------------------------------------------------------------------
Update Information:
Automatic update for osbuild-composer-95-1.fc37. ##### **Changelog for osbuild-
composer** ``` * Wed Nov 29 2023 Packit <hello(a)packit.dev> - 95-1 Changes with
95 ---------------- * :lock: Update `filesystem.sh` test case to reflect
update mountpoint policy (#3796) * Author: Tom���� Hozza, Reviewers: Brian C.
Lane * Cloud API: Support selecting multiple upload targets and add Pulp
OSTree uploads (#3744) * Author: Achilleas Koutsou, Reviewers: Sanne
Raymaekers * Fix rhel9 oscap test (#3816) * Author: Gianluca Zuccarelli,
Reviewers: Alexander Todorov, Jakub Rusz * Revert "containers/osbuild-
composer: wait for fluentd in entrypoint" (#3819) * Author: Diaa Sami,
Reviewers: Sanne Raymaekers * Switch testing to RHEL-8.10 and RHEL-9.4 nightly
(#3775) * Author: Jakub Rusz, Reviewers: Alexander Todorov * composer: use
logrus hook instead of k8s sidecar for splunk log forwa��� (#3795) * Author:
Diaa Sami, Reviewers: Sanne Raymaekers * deps: update images to v0.18.0
(#3635) * Author: Achilleas Koutsou, Reviewers: Simon de Vlieger *
pkg/splunk_logger: make it a module that can be imported seprately (#3799) *
Author: Diaa Sami, Reviewers: Achilleas Koutsou * schutzbot/terraform: aws
instance types rework (#3791) * Author: Sanne Raymaekers, Reviewers:
Achilleas Koutsou * test/cases/ubi-wsl: query Windows VM ip address via vm
show (#3800) * Author: Sanne Raymaekers, Reviewers: Jakub Rusz ��� Somewhere
on the Internet, 2023-11-29 ```
--------------------------------------------------------------------------------
ChangeLog:
* Wed Nov 29 2023 Packit <hello(a)packit.dev> - 95-1
Changes with 95
----------------
* :lock: Update `filesystem.sh` test case to reflect update mountpoint policy (#3796)
* Author: Tom���� Hozza, Reviewers: Brian C. Lane
* Cloud API: Support selecting multiple upload targets and add Pulp OSTree uploads
(#3744)
* Author: Achilleas Koutsou, Reviewers: Sanne Raymaekers
* Fix rhel9 oscap test (#3816)
* Author: Gianluca Zuccarelli, Reviewers: Alexander Todorov, Jakub Rusz
* Revert "containers/osbuild-composer: wait for fluentd in entrypoint"
(#3819)
* Author: Diaa Sami, Reviewers: Sanne Raymaekers
* Switch testing to RHEL-8.10 and RHEL-9.4 nightly (#3775)
* Author: Jakub Rusz, Reviewers: Alexander Todorov
* composer: use logrus hook instead of k8s sidecar for splunk log forwa��� (#3795)
* Author: Diaa Sami, Reviewers: Sanne Raymaekers
* deps: update images to v0.18.0 (#3635)
* Author: Achilleas Koutsou, Reviewers: Simon de Vlieger
* pkg/splunk_logger: make it a module that can be imported seprately (#3799)
* Author: Diaa Sami, Reviewers: Achilleas Koutsou
* schutzbot/terraform: aws instance types rework (#3791)
* Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou
* test/cases/ubi-wsl: query Windows VM ip address via vm show (#3800)
* Author: Sanne Raymaekers, Reviewers: Jakub Rusz
��� Somewhere on the Internet, 2023-11-29
--------------------------------------------------------------------------------
================================================================================
python2.7-2.7.18-36.fc37 (FEDORA-2023-35fb07d135)
Version 2.7 of the Python interpreter
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2022-48560
--------------------------------------------------------------------------------
ChangeLog:
* Mon Nov 27 2023 Lum��r Balhar <lbalhar(a)redhat.com> - 2.7.18-36
- Security fix for CVE-2022-48560
Resolves: rhbz#2250592
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2250592 - CVE-2022-48560 python2.7: python: use after free in heappushpop()
of heapq module [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2250592
--------------------------------------------------------------------------------