The following Fedora 37 Security updates need testing: Age URL 84 https://bodhi.fedoraproject.org/updates/FEDORA-2023-4b892d116d cutter-re-2.2.1-1.fc37 rizin-0.5.2-1.fc37 9 https://bodhi.fedoraproject.org/updates/FEDORA-2023-0873c38acd librsvg2-2.54.6-1.fc37 9 https://bodhi.fedoraproject.org/updates/FEDORA-2023-b7b87e4966 xen-4.16.4-4.fc37 8 https://bodhi.fedoraproject.org/updates/FEDORA-2023-19754c5a93 webkitgtk-2.40.5-1.fc37 5 https://bodhi.fedoraproject.org/updates/FEDORA-2023-243a20ce18 java-11-openjdk-portable-11.0.20.0.8-1.fc37 5 https://bodhi.fedoraproject.org/updates/FEDORA-2023-d1d4839202 java-17-openjdk-portable-17.0.8.0.7-1.fc37 5 https://bodhi.fedoraproject.org/updates/FEDORA-2023-ac752f8c37 java-1.8.0-openjdk-portable-1.8.0.382.b05-1.fc37 5 https://bodhi.fedoraproject.org/updates/FEDORA-2023-020d609edb java-latest-openjdk-portable-20.0.2.0.9-1.rolling.fc37 3 https://bodhi.fedoraproject.org/updates/FEDORA-2023-ba53233477 java-latest-openjdk-20.0.2.0.9-1.rolling.fc37 3 https://bodhi.fedoraproject.org/updates/FEDORA-2023-e643a71e0f java-11-openjdk-11.0.20.0.8-1.fc37 3 https://bodhi.fedoraproject.org/updates/FEDORA-2023-9ef4ec10da java-17-openjdk-17.0.8.0.7-1.fc37 3 https://bodhi.fedoraproject.org/updates/FEDORA-2023-d0ef677e6f ghostscript-9.56.1-9.fc37 3 https://bodhi.fedoraproject.org/updates/FEDORA-2023-9edf2145fb golang-github-opencontainers-runc-1.1.8-2.fc37 1 https://bodhi.fedoraproject.org/updates/FEDORA-2023-2afb831742 opensc-0.23.0-5.fc37 1 https://bodhi.fedoraproject.org/updates/FEDORA-2023-4824704a61 rust-1.71.1-1.fc37 1 https://bodhi.fedoraproject.org/updates/FEDORA-2023-105880e618 llhttp-8.1.1-1.fc37 python-aiohttp-3.8.5-1.fc37
The following Fedora 37 Critical Path updates have yet to be approved: Age URL 100 https://bodhi.fedoraproject.org/updates/FEDORA-2023-22c8575b95 glibc-2.36-10.fc37 77 https://bodhi.fedoraproject.org/updates/FEDORA-2023-84965ba750 mesa-23.0.3-2.fc37 11 https://bodhi.fedoraproject.org/updates/FEDORA-2023-ef7b7c2547 highway-1.0.5-1.fc37 10 https://bodhi.fedoraproject.org/updates/FEDORA-2023-63327b8675 python-productmd-1.36-1.fc37 9 https://bodhi.fedoraproject.org/updates/FEDORA-2023-b7b87e4966 xen-4.16.4-4.fc37 9 https://bodhi.fedoraproject.org/updates/FEDORA-2023-027b050610 smartmontools-7.4-1.fc37 9 https://bodhi.fedoraproject.org/updates/FEDORA-2023-0873c38acd librsvg2-2.54.6-1.fc37 9 https://bodhi.fedoraproject.org/updates/FEDORA-2023-435ef77b32 annobin-12.23-1.fc37 9 https://bodhi.fedoraproject.org/updates/FEDORA-2023-31fa4323d0 librepo-1.15.2-1.fc37 8 https://bodhi.fedoraproject.org/updates/FEDORA-2023-19754c5a93 webkitgtk-2.40.5-1.fc37 8 https://bodhi.fedoraproject.org/updates/FEDORA-2023-c6fce75fbc nss-3.92.0-1.fc37 7 https://bodhi.fedoraproject.org/updates/FEDORA-2023-30fd38f408 ndctl-78-1.fc37 7 https://bodhi.fedoraproject.org/updates/FEDORA-2023-4941b81f50 procps-ng-3.3.17-6.fc37.3 7 https://bodhi.fedoraproject.org/updates/FEDORA-2023-5ef5eb7f73 hwdata-0.373-1.fc37 5 https://bodhi.fedoraproject.org/updates/FEDORA-2023-f87f2ba702 libadwaita-1.2.5-1.fc37 5 https://bodhi.fedoraproject.org/updates/FEDORA-2023-f64ffff157 openexr-3.1.10-1.fc37 5 https://bodhi.fedoraproject.org/updates/FEDORA-2023-9d1cfe7a0b pipewire-0.3.77-1.fc37 5 https://bodhi.fedoraproject.org/updates/FEDORA-2023-0594ef094f 389-ds-base-2.2.9-1.fc37 3 https://bodhi.fedoraproject.org/updates/FEDORA-2023-dcb078b618 speech-dispatcher-0.11.5-1.fc37 3 https://bodhi.fedoraproject.org/updates/FEDORA-2023-9ef4ec10da java-17-openjdk-17.0.8.0.7-1.fc37 3 https://bodhi.fedoraproject.org/updates/FEDORA-2023-30a669384d audit-3.1.2-1.fc37 1 https://bodhi.fedoraproject.org/updates/FEDORA-2023-f3b3f454df cockpit-298-1.fc37 1 https://bodhi.fedoraproject.org/updates/FEDORA-2023-a7b180d862 lorax-37.12-1.fc37 1 https://bodhi.fedoraproject.org/updates/FEDORA-2023-48e0b00d86 mbedtls-2.28.4-1.fc37
The following builds have been pushed to Fedora 37 updates-testing
beakerlib-libraries-0.7-7.fc37 buildah-1.31.2-1.fc37 chromium-115.0.5790.170-2.fc37 cups-2.4.6-4.fc37 distribution-gpg-keys-1.91-1.fc37 gensio-2.7.1-1.fc37 gerbv-2.9.8-1.fc37 git-credential-oauth-0.10.0-1.fc37 gns3-gui-2.2.42-1.fc37 gns3-server-2.2.42-1.fc37 ibus-typing-booster-2.23.4-1.fc37 java-1.8.0-openjdk-1.8.0.382.b05-2.fc37 kiwi-9.25.12-1.fc37 kmymoney-5.1.3-4.fc37 linux-firmware-20230804-153.fc37 linux-system-roles-1.52.1-1.fc37 mock-5.0-1.fc37 mock-core-configs-39-1.fc37 nodejs16-16.20.2-1.fc37 nodejs18-18.17.1-1.fc37 nodejs20-20.5.1-1.fc37 obs-build-20230808-428.2.1.fc37 oneapi-level-zero-1.13.5-1.fc37 pgbouncer-1.20.1-1.fc37 podman-4.6.1-1.fc37 pspg-5.8.0-1.fc37 python3.12-3.12.0~rc1-1.fc37 rust-inferno-0.11.15-3.fc37 rust-plist-1.5.0-1.fc37 rust-quick-xml-0.30.0-1.fc37 rust-xcb-1.2.2-2.fc37 rust2rpm-24.4.0-1.fc37 skopeo-1.13.2-1.fc37 snakemake-7.32.3-1.fc37 systemtap-4.9-2.fc37 ugene-48.0-1.fc37
Details about builds:
================================================================================ beakerlib-libraries-0.7-7.fc37 (FEDORA-2023-c4d04d9e19) Beakerlib libraries -------------------------------------------------------------------------------- Update Information:
Update license in .spec -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Andrei Stepanov astepano@redhat.com - 0.7-7 - Tune License entry. * Wed Jul 19 2023 Fedora Release Engineering releng@fedoraproject.org - 0.7-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Wed Jan 18 2023 Fedora Release Engineering releng@fedoraproject.org - 0.7-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ buildah-1.31.2-1.fc37 (FEDORA-2023-74674a9ed7) A command line tool used for creating OCI Images -------------------------------------------------------------------------------- Update Information:
Automatic update for buildah-1.31.2-1.fc37. ##### **Changelog for buildah** ``` * Thu Aug 10 2023 Packit hello@packit.dev - 1.31.2-1 - [packit] 1.31.2 upstream release * Wed Aug 09 2023 Lokesh Mandvekar lsm5@fedoraproject.org - 1.31.1-1 - bump to v1.31.1 * Wed Jul 19 2023 Fedora Release Engineering releng@fedoraproject.org - 1.31.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Wed Jul 05 2023 Lokesh Mandvekar lsm5@fedoraproject.org - 1.31.0-1 - bump to v1.31.0 * Tue Apr 25 2023 Yaakov Selkowitz yselkowi@redhat.com - 1.30.0-2 - Disable btrfs in RHEL builds ``` ---- bump to v1.31.1 ---- bump to v1.31.0 -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Packit hello@packit.dev - 1.31.2-1 - [packit] 1.31.2 upstream release * Wed Aug 9 2023 Lokesh Mandvekar lsm5@fedoraproject.org - 1.31.1-1 - bump to v1.31.1 * Wed Jul 19 2023 Fedora Release Engineering releng@fedoraproject.org - 1.31.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Wed Jul 5 2023 Lokesh Mandvekar lsm5@fedoraproject.org - 1.31.0-1 - bump to v1.31.0 * Tue Apr 25 2023 Yaakov Selkowitz yselkowi@redhat.com - 1.30.0-2 - Disable btrfs in RHEL builds --------------------------------------------------------------------------------
================================================================================ chromium-115.0.5790.170-2.fc37 (FEDORA-2023-6c8de2cd15) A WebKit (Blink) powered web browser that Google doesn't want you to use -------------------------------------------------------------------------------- Update Information:
update to 115.0.5790.170. Fixes several security issues -------------------------------------------------------------------------------- ChangeLog:
* Wed Aug 9 2023 Than Ngo than@redhat.com - 115.0.5790.170-2 - set use_all_cpus=1 for aarch64 * Thu Aug 3 2023 Than Ngo than@redhat.com - 115.0.5790.170-1 - update to 115.0.5790.170 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2227630 - CVE-2022-3443 CVE-2022-3444 CVE-2022-4911 chromium: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227630 [ 2 ] Bug #2227631 - CVE-2022-3443 CVE-2022-3444 CVE-2022-4911 chromium: various flaws [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227631 [ 3 ] Bug #2227634 - CVE-2022-4912 CVE-2022-4913 chromium: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227634 [ 4 ] Bug #2227635 - CVE-2022-4912 CVE-2022-4913 chromium: various flaws [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227635 [ 5 ] Bug #2227637 - CVE-2022-4914 chromium: chromium-browser: Heap buffer overflow in PrintPreview [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227637 [ 6 ] Bug #2227638 - CVE-2022-4914 chromium: chromium-browser: Heap buffer overflow in PrintPreview [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227638 [ 7 ] Bug #2227646 - CVE-2022-2477 CVE-2022-2478 CVE-2022-2479 CVE-2022-2480 CVE-2022-2481 CVE-2022-4915 chromium: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227646 [ 8 ] Bug #2227647 - CVE-2022-2477 CVE-2022-2478 CVE-2022-2479 CVE-2022-2480 CVE-2022-2481 CVE-2022-4915 chromium: various flaws [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227647 [ 9 ] Bug #2227650 - CVE-2022-4916 CVE-2022-4917 chromium: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227650 [ 10 ] Bug #2227651 - CVE-2022-4916 CVE-2022-4917 chromium: various flaws [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227651 [ 11 ] Bug #2227653 - CVE-2022-4918 chromium: chromium-browser: Use after free in UI [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227653 [ 12 ] Bug #2227654 - CVE-2022-4918 chromium: chromium-browser: Use after free in UI [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227654 [ 13 ] Bug #2227658 - CVE-2022-1919 CVE-2022-4919 CVE-2022-4920 chromium: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2227658 --------------------------------------------------------------------------------
================================================================================ cups-2.4.6-4.fc37 (FEDORA-2023-6ad3df09c5) CUPS printing system -------------------------------------------------------------------------------- Update Information:
add upgrade script for setting authentication for CUPS-Get-Document operation -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Zdenek Dohnal zdohnal@redhat.com - 1:2.4.6-4 - add upgrade script for setting authentication for CUPS-Get-Document operation * Wed Jul 26 2023 Zdenek Dohnal zdohnal@redhat.com - 1:2.4.6-3 - SPDX migration completed * Wed Jul 19 2023 Fedora Release Engineering releng@fedoraproject.org - 1:2.4.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ distribution-gpg-keys-1.91-1.fc37 (FEDORA-2023-4c8c739aee) GPG keys of various Linux distributions -------------------------------------------------------------------------------- Update Information:
updated Google key, Coprs keys, added Fedora 41 key -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Miroslav Such�� msuchy@redhat.com 1.91-1 - update Google key * Thu Aug 10 2023 Miroslav Such�� msuchy@redhat.com 1.90-1 - add Fedora 41 key - Add source URL for AL2023 - update copr keys --------------------------------------------------------------------------------
================================================================================ gensio-2.7.1-1.fc37 (FEDORA-2023-e39b3b42db) General Stream I/O -------------------------------------------------------------------------------- Update Information:
Mostly internal fixes related to build system and linking -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Felix Kaechele felix@kaechele.ca - 2.7.1-1 - update to 2.7.1 * Mon Aug 7 2023 Felix Kaechele felix@kaechele.ca - 2.7.0-1 - update yo 2.7.0 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2231011 - gensio-2.7.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2231011 --------------------------------------------------------------------------------
================================================================================ gerbv-2.9.8-1.fc37 (FEDORA-2023-5f5bea627b) Gerber file viewer from the gEDA toolkit -------------------------------------------------------------------------------- Update Information:
update to 2.9.8 -------------------------------------------------------------------------------- ChangeLog:
* Wed Aug 2 2023 Filipe Rosset rosset.filipe@gmail.com - 2.9.8-1 - update to 2.9.8 * Wed Jul 19 2023 Fedora Release Engineering releng@fedoraproject.org - 2.9.5-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Thu Jan 19 2023 Fedora Release Engineering releng@fedoraproject.org - 2.9.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild * Sun Dec 11 2022 Alain Vigne avigne@fedoraproject.org - 2.9.5-1 - new upstream release - SPDX license identifier -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2075792 - gerbv project moved, new versions released https://bugzilla.redhat.com/show_bug.cgi?id=2075792 [ 2 ] Bug #2159185 - CVE-2021-40393 gerbv: Gerbv RS-274X format aperture macro variables out-of-bounds write vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2159185 --------------------------------------------------------------------------------
================================================================================ git-credential-oauth-0.10.0-1.fc37 (FEDORA-2023-7825103488) Git credential helper for GitHub and other forges using OAuth -------------------------------------------------------------------------------- Update Information:
Automatic update for git-credential-oauth-0.10.0-1.fc37. ##### **Changelog for git-credential-oauth** ``` * Thu Aug 10 2023 Packit hello@packit.dev - 0.10.0-1 - [packit] 0.10.0 upstream release ``` -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Packit hello@packit.dev - 0.10.0-1 - [packit] 0.10.0 upstream release --------------------------------------------------------------------------------
================================================================================ gns3-gui-2.2.42-1.fc37 (FEDORA-2023-db1deb3c45) GNS3 graphical user interface -------------------------------------------------------------------------------- Update Information:
Update to 2.2.42 -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Alexey Kurov nucleo@fedoraproject.org - 2.2.42-1 - Update to 2.2.42 * Wed Jul 19 2023 Fedora Release Engineering releng@fedoraproject.org - 2.2.41-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ gns3-server-2.2.42-1.fc37 (FEDORA-2023-db1deb3c45) Graphical Network Simulator 3 -------------------------------------------------------------------------------- Update Information:
Update to 2.2.42 -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Alexey Kurov nucleo@fedoraproject.org - 2.2.42-1 - Update to 2.2.42 * Wed Jul 19 2023 Fedora Release Engineering releng@fedoraproject.org - 2.2.41-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ ibus-typing-booster-2.23.4-1.fc37 (FEDORA-2023-7b330029b4) A completion input method -------------------------------------------------------------------------------- Update Information:
Update to 2.23.4 Support msymbol 'S-C-Return' as a commit to preedit key (Resolves https://github.com/mike-fabian/ibus-typing-booster/issues/457). Needed by hi-itrans.mim, hi-optitransv2.mim, kn-optitransv2.mim, mr-gamabhana.mim, sa- itrans.mim, sa-vedic-itrans.mim Remove useless m4/{Makefile.am,as-version.m4} Update emoji annotations from CLDR Update UnicodeData.txt to current Unicode 15.1.0 draft (https://www.unicode.org/Public/draft/UCD/ucd/UnicodeData.txt) Update emoji data files for current Unicode 15.1 DRAFT (https://www.unicode.org/Public/draft/UCD/ucd/emoji/emoji-data.txt https://www.unicode.org/Public/draft/UCD/ucd/emoji/emoji-variation- sequences.txt) ---- Update to 2.23.3 Translation update from Weblate (tr 100%) -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Mike FABIAN mfabian@redhat.com - 2.23.4-1 - Update to 2.23.4 - Support msymbol 'S-C-Return' as a commit to preedit key (Resolves https://github.com/mike-fabian/ibus-typing-booster/issues/457). Needed by hi-itrans.mim, hi-optitransv2.mim, kn-optitransv2.mim, mr-gamabhana.mim, sa-itrans.mim, sa-vedic-itrans.mim - Remove useless m4/{Makefile.am,as-version.m4} - Update emoji annotations from CLDR - Update UnicodeData.txt to current Unicode 15.1.0 draft (https://www.unicode.org/Public/draft/UCD/ucd/UnicodeData.txt) - Update emoji data files for current Unicode 15.1 DRAFT (https://www.unicode.org/Public/draft/UCD/ucd/emoji/emoji-data.txt https://www.unicode.org/Public/draft/UCD/ucd/emoji/emoji-variation-sequences...) * Thu Aug 3 2023 Mike FABIAN mfabian@redhat.com - 2.23.3-1 - Update to 2.23.3 - Translation update from Weblate (tr 100%) --------------------------------------------------------------------------------
================================================================================ java-1.8.0-openjdk-1.8.0.382.b05-2.fc37 (FEDORA-2023-a2922bf669) OpenJDK 8 Runtime Environment -------------------------------------------------------------------------------- Update Information:
respin of security cpu due to uninstallable sources subpkg ---- updatet to july security update 382.b05 -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Jiri Vanek jvanek@redhat.com - 1:1.8.0.382.b05-2 - removed .so files from full_sources - list executbales in same * Mon Jul 24 2023 Jayashree Huttanagoudar jhuttana@redhat.com - 1:1.8.0.382.b05-1 - updatet to july security update 382.b05 * Mon Jul 24 2023 Jayashree Huttanagoudar jhuttana@redhat.com - 1:1.8.0.372.b07-7 - Remove few more binaries from full_sources that were throwing missing build-id warnings - Resolves: rhbz#2222629 * Thu Jul 20 2023 Fedora Release Engineering releng@fedoraproject.org - 1:1.8.0.372.b07-6.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ kiwi-9.25.12-1.fc37 (FEDORA-2023-3e9a115cb1) Flexible operating system image builder -------------------------------------------------------------------------------- Update Information:
Update to add fix for issue where GRUB entries were doubled for legacy BIOS boot in ISO images -------------------------------------------------------------------------------- ChangeLog:
* Wed Aug 9 2023 Neal Gompa ngompa@fedoraproject.org - 9.25.12-1 - Update to 9.25.12 (RH#2227909) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2227909 - kiwi-9.25.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2227909 --------------------------------------------------------------------------------
================================================================================ kmymoney-5.1.3-4.fc37 (FEDORA-2023-48d17857a2) Personal finance -------------------------------------------------------------------------------- Update Information:
Rebuild. -------------------------------------------------------------------------------- ChangeLog:
* Thu Jul 20 2023 Fedora Release Engineering releng@fedoraproject.org - 5.1.3-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Fri Apr 7 2023 Vasiliy N. Glazov vascom2@gmail.com - 5.1.3-3 - Rebuild for new Akonadi lib name * Thu Jan 19 2023 Fedora Release Engineering releng@fedoraproject.org - 5.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2230052 - When I update, this package is preventing other packages from updating because of conflicts https://bugzilla.redhat.com/show_bug.cgi?id=2230052 --------------------------------------------------------------------------------
================================================================================ linux-firmware-20230804-153.fc37 (FEDORA-2023-eabbf4ca4d) Firmware files used by the Linux kernel -------------------------------------------------------------------------------- Update Information:
New firmware for AMD Zen CPUs to mitigate the AMD 'Inception' attack. Only needed for affected AMD users. ---- Update to upstream 20230804 release: * Split out QCom Arm IP firmware * Merge Marvell libertas WiFi firmware * Mellanox: Add new mlxsw_spectrum firmware xx.2012.1012 * Add URL for latest FW binaries for NXP BT chipsets * rtw89: 8851b: update firmware to v0.29.41.1 * qcom: sdm845: add RB3 sensors DSP firmware * amdgpu: Update DMCUB for DCN314 & Yellow Carp * ice: add LAG-supporting DDP package * i915: Update MTL DMC to v2.13 * i915: Update ADLP DMC to v2.20 * cirrus: Add CS35L41 firmware for Dell Oasis Models * copy-firmware: Fix linking directories when using compression * copy-firmware: Fix test: unexpected operator * qcom: sc8280xp: LENOVO: remove directory sym link * qcom: sc8280xp: LENOVO: Remove execute bits * amdgpu: update VCN 4.0.0 firmware * amdgpu: add initial SMU 13.0.10 firmware * amdgpu: add initial SDMA 6.0.3 firmware * amdgpu: add initial PSP 13.0.10 firmware * amdgpu: add initial GC 11.0.3 firmware * Update AMD fam17h cpu microcode * Update AMD cpu microcode * amdgpu: update various generation VCN firmware * amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs * Updated NXP SR150 UWB firmware * wfx: update to firmware 3.16.1 * mediatek: Update mt8195 SCP firmware to support 10bit mode * i915: update DG2 GuC to v70.8.0 * i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL * cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models * Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" * Update firmware for MT7922 WiFi/Bluetooth device * Update firmware file for Intel Bluetooth AX200/201/203/210/211 * Fix qcom ASoC tglp WHENCE entry * check_whence: Check link targets are valid * iwlwifi: add new FWs from core80-39 release * iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release * qcom: Add Audio firmware for SC8280XP X13s -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Peter Robinson pbrobinson@fedoraproject.org - 20230804-153 - Update AMD cpu microcode * Sun Aug 6 2023 Peter Robinson pbrobinson@fedoraproject.org - 20230804-152 - Update to upstream 20230804 release - Split out QCom Arm IP firmware - Merge Marvell libertas WiFi firmware - Mellanox: Add new mlxsw_spectrum firmware xx.2012.1012 - Add URL for latest FW binaries for NXP BT chipsets - rtw89: 8851b: update firmware to v0.29.41.1 - qcom: sdm845: add RB3 sensors DSP firmware - amdgpu: Update DMCUB for DCN314 & Yellow Carp - ice: add LAG-supporting DDP package - i915: Update MTL DMC to v2.13 - i915: Update ADLP DMC to v2.20 - cirrus: Add CS35L41 firmware for Dell Oasis Models - copy-firmware: Fix linking directories when using compression - copy-firmware: Fix test: unexpected operator - qcom: sc8280xp: LENOVO: remove directory sym link - qcom: sc8280xp: LENOVO: Remove execute bits - amdgpu: update VCN 4.0.0 firmware - amdgpu: add initial SMU 13.0.10 firmware - amdgpu: add initial SDMA 6.0.3 firmware - amdgpu: add initial PSP 13.0.10 firmware - amdgpu: add initial GC 11.0.3 firmware - Update AMD fam17h cpu microcode - Update AMD cpu microcode - amdgpu: update various generation VCN firmware - amdgpu: update DMCUB to v0.0.175.0 for various AMDGPU ASICs - Updated NXP SR150 UWB firmware - wfx: update to firmware 3.16.1 - mediatek: Update mt8195 SCP firmware to support 10bit mode - i915: update DG2 GuC to v70.8.0 - i915: update to GuC 70.8.0 and HuC 8.5.1 for MTL - cirrus: Add CS35L41 firmware for ASUS ROG 2023 Models - Partially revert "amdgpu: DMCUB updates for DCN 3.1.4 and 3.1.5" - Update firmware for MT7922 WiFi/Bluetooth device - Update firmware file for Intel Bluetooth AX200/201/203/210/211 - Fix qcom ASoC tglp WHENCE entry - check_whence: Check link targets are valid - iwlwifi: add new FWs from core80-39 release - iwlwifi: update cc/Qu/QuZ firmwares for core80-39 release - qcom: Add Audio firmware for SC8280XP X13s -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2145029 - /usr/lib/firmware/qcom/LENOVO/21BX.xz: broken symbolic link to ../sc8280xp/LENOVO/21BX.xz https://bugzilla.redhat.com/show_bug.cgi?id=2145029 [ 2 ] Bug #2178852 - split out qcom and intel firmwares so they can be left off arches for which they are useless https://bugzilla.redhat.com/show_bug.cgi?id=2178852 [ 3 ] Bug #2188674 - /usr/lib/firmware/qcom/sdm845/wlanmdsp.mbn.xz: broken symlink to ../../ath10k/WCN3990/hw1.0/wlanmdsp.mbn.xz https://bugzilla.redhat.com/show_bug.cgi?id=2188674 [ 4 ] Bug #2220888 - updating to kernel 6.3.11 breaks amd gpu drivers https://bugzilla.redhat.com/show_bug.cgi?id=2220888 --------------------------------------------------------------------------------
================================================================================ linux-system-roles-1.52.1-1.fc37 (FEDORA-2023-05ce8c9e6a) Set of interfaces for unified system management -------------------------------------------------------------------------------- Update Information:
Automatic update for linux-system-roles-1.52.1-1.fc37. ##### **Changelog for linux-system-roles** ``` * Thu Aug 10 2023 Packit hello@packit.dev - 1.52.1-1 - Update to upstream version 1.52.1 * Thu Aug 03 2023 Packit hello@packit.dev - 1.51.2-1 - Update to upstream version 1.51.2 * Tue Aug 01 2023 Packit hello@packit.dev - 1.51.0-1 - Update to upstream version 1.51.0 * Mon Jul 31 2023 Packit hello@packit.dev - 1.50.1-1 - Update to upstream version 1.50.1 * Fri Jul 28 2023 Packit hello@packit.dev - 1.50.0-1 - Update to upstream version 1.50.0 * Thu Jul 27 2023 Packit hello@packit.dev - 1.49.1-1 - Update to upstream version 1.49.1 * Sat Jul 22 2023 Packit hello@packit.dev - 1.48.1-1 - Update to upstream version 1.48.1 * Thu Jul 20 2023 Packit hello@packit.dev - 1.47.0-1 - Update to upstream version 1.47.0 ``` ---- Automatic update for linux-system-roles-1.51.2-1.fc37. ##### **Changelog for linux-system-roles** ``` * Thu Aug 03 2023 Packit hello@packit.dev - 1.51.2-1 - Update to upstream version 1.51.2 * Tue Aug 01 2023 Packit hello@packit.dev - 1.51.0-1 - Update to upstream version 1.51.0 * Mon Jul 31 2023 Packit hello@packit.dev - 1.50.1-1 - Update to upstream version 1.50.1 * Fri Jul 28 2023 Packit hello@packit.dev - 1.50.0-1 - Update to upstream version 1.50.0 * Thu Jul 27 2023 Packit hello@packit.dev - 1.49.1-1 - Update to upstream version 1.49.1 * Sat Jul 22 2023 Packit hello@packit.dev - 1.48.1-1 - Update to upstream version 1.48.1 * Thu Jul 20 2023 Packit hello@packit.dev - 1.47.0-1 - Update to upstream version 1.47.0 ``` ---- Automatic update for linux-system-roles-1.50.1-1.fc37. ##### **Changelog for linux-system-roles** ``` * Mon Jul 31 2023 Packit hello@packit.dev - 1.50.1-1 - Update to upstream version 1.50.1 * Fri Jul 28 2023 Packit hello@packit.dev - 1.50.0-1 - Update to upstream version 1.50.0 * Thu Jul 27 2023 Packit hello@packit.dev - 1.49.1-1 - Update to upstream version 1.49.1 * Sat Jul 22 2023 Packit hello@packit.dev - 1.48.1-1 - Update to upstream version 1.48.1 * Thu Jul 20 2023 Packit hello@packit.dev - 1.47.0-1 - Update to upstream version 1.47.0 ``` ---- Automatic update for linux-system-roles-1.50.0-1.fc37. ---- Automatic update for linux-system-roles-1.49.1-1.fc37. ##### **Changelog for linux-system-roles** ``` * Thu Jul 27 2023 Packit hello@packit.dev - 1.49.1-1 - Update to upstream version 1.49.1 * Sat Jul 22 2023 Packit hello@packit.dev - 1.48.1-1 - Update to upstream version 1.48.1 * Thu Jul 20 2023 Packit hello@packit.dev - 1.47.0-1 - Update to upstream version 1.47.0 ``` ---- Automatic update for linux-system-roles-1.48.1-1.fc37. ##### **Changelog for linux-system-roles** ``` * Sat Jul 22 2023 Packit hello@packit.dev - 1.48.1-1 - Update to upstream version 1.48.1 * Thu Jul 20 2023 Packit hello@packit.dev - 1.47.0-1 - Update to upstream version 1.47.0 ``` ---- Automatic update for linux-system-roles-1.47.0-1.fc37. ##### **Changelog for linux-system-roles** ``` * Thu Jul 20 2023 Packit hello@packit.dev - 1.47.0-1 - Update to upstream version 1.47.0 ``` -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Packit hello@packit.dev - 1.52.1-1 - Update to upstream version 1.52.1 * Thu Aug 3 2023 Packit hello@packit.dev - 1.51.2-1 - Update to upstream version 1.51.2 * Tue Aug 1 2023 Packit hello@packit.dev - 1.51.0-1 - Update to upstream version 1.51.0 * Mon Jul 31 2023 Packit hello@packit.dev - 1.50.1-1 - Update to upstream version 1.50.1 * Fri Jul 28 2023 Packit hello@packit.dev - 1.50.0-1 - Update to upstream version 1.50.0 * Thu Jul 27 2023 Packit hello@packit.dev - 1.49.1-1 - Update to upstream version 1.49.1 * Sat Jul 22 2023 Packit hello@packit.dev - 1.48.1-1 - Update to upstream version 1.48.1 * Thu Jul 20 2023 Packit hello@packit.dev - 1.47.0-1 - Update to upstream version 1.47.0 --------------------------------------------------------------------------------
================================================================================ mock-5.0-1.fc37 (FEDORA-2023-c65d483a5c) Builds packages inside chroots -------------------------------------------------------------------------------- Update Information:
new upstream release, per https://rpm-software- management.github.io/mock/Release-Notes-5.0 -------------------------------------------------------------------------------- ChangeLog:
* Wed Aug 9 2023 Pavel Raiskup praiskup@redhat.com 5.0-1 - new upstream release, per https://rpm-software-management.github.io/mock/Release-Notes-5.0 --------------------------------------------------------------------------------
================================================================================ mock-core-configs-39-1.fc37 (FEDORA-2023-c65d483a5c) Mock core config files basic chroots -------------------------------------------------------------------------------- Update Information:
new upstream release, per https://rpm-software- management.github.io/mock/Release-Notes-5.0 -------------------------------------------------------------------------------- ChangeLog:
* Wed Aug 9 2023 Pavel Raiskup praiskup@redhat.com 39-1 - new upstream release, per https://rpm-software-management.github.io/mock/Release-Notes-5.0 --------------------------------------------------------------------------------
================================================================================ nodejs16-16.20.2-1.fc37 (FEDORA-2023-18476abd7e) JavaScript runtime -------------------------------------------------------------------------------- Update Information:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases Security releases available Updates are now available for the v16.x, v18.x, and v20.x Node.js release lines for the following issues. Permissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002) The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Thank you, to mattaustin for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias for fixing it. Permission model bypass by specifying a path traversal sequence in a Buffer (HIGH)(CVE-2023-32004) A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it. process.binding() can bypass the permission model through path traversal (HIGH)(CVE-2023-32558) The use of the deprecated API process.binding() can bypass the permission model through path traversal. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you to Rafael Gonzaga for reporting and fixing this vulnerability. Permissions policies can impersonate other modules in using module.constructor.createRequire() (MEDIUM)(CVE-2023-32006) The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias for fixing it. Permissions policies can be bypassed via process.binding (MEDIUM)(CVE-2023-32559) The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. Impacts This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Thank you, to LeoDog896 for reporting this vulnerability and thank you Tobias Nie��en for fixing it. fs.statfs can retrive stats from files restricted by the Permission Model (LOW)(CVE-2023-32005) A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.statfs API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you to Rafael Gonzaga for reporting and fixing this vulnerability. fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (LOW)(CVE-2023-32003) fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it. Downloads and release details Node.js v16.20.2 (LTS) Node.js v18.17.1 (LTS) Node.js v20.5.1 (Current) (Update 08-Aug-2023) Security Release target August 9th The Node.js Security Releases will be available on, or shortly after, Wednesday, August 9th, 2023. Summary The Node.js project will release new versions of the 16.x, 18.x and 20.x releases lines on or shortly after, Tuesday August 8th 2023 in order to address: 3 high severity issues. 2 medium severity issues. 2 low severity issues. OpenSSL Security updates This security release includes the following OpenSSL security updates OpenSSL security advisory 14th July. OpenSSL security advisory 19th July. OpenSSL security advisory 31st July. Impact The 20.x release line of Node.js is vulnerable to 3 high severity issues, 2 medium severity issues, and 2 low severity issues. The 18.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues. The 16.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues. -------------------------------------------------------------------------------- ChangeLog:
* Wed Aug 9 2023 Stephen Gallagher sgallagh@redhat.com - 1:16.20.2-1 - Update to 16.20.2 * Wed Jul 12 2023 Stephen Gallagher sgallagh@redhat.com - 1:16.20.1-2 - Sync to latest nodejs-sources.sh --------------------------------------------------------------------------------
================================================================================ nodejs18-18.17.1-1.fc37 (FEDORA-2023-18476abd7e) JavaScript runtime -------------------------------------------------------------------------------- Update Information:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases Security releases available Updates are now available for the v16.x, v18.x, and v20.x Node.js release lines for the following issues. Permissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002) The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Thank you, to mattaustin for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias for fixing it. Permission model bypass by specifying a path traversal sequence in a Buffer (HIGH)(CVE-2023-32004) A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it. process.binding() can bypass the permission model through path traversal (HIGH)(CVE-2023-32558) The use of the deprecated API process.binding() can bypass the permission model through path traversal. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you to Rafael Gonzaga for reporting and fixing this vulnerability. Permissions policies can impersonate other modules in using module.constructor.createRequire() (MEDIUM)(CVE-2023-32006) The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias for fixing it. Permissions policies can be bypassed via process.binding (MEDIUM)(CVE-2023-32559) The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. Impacts This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Thank you, to LeoDog896 for reporting this vulnerability and thank you Tobias Nie��en for fixing it. fs.statfs can retrive stats from files restricted by the Permission Model (LOW)(CVE-2023-32005) A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.statfs API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you to Rafael Gonzaga for reporting and fixing this vulnerability. fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (LOW)(CVE-2023-32003) fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it. Downloads and release details Node.js v16.20.2 (LTS) Node.js v18.17.1 (LTS) Node.js v20.5.1 (Current) (Update 08-Aug-2023) Security Release target August 9th The Node.js Security Releases will be available on, or shortly after, Wednesday, August 9th, 2023. Summary The Node.js project will release new versions of the 16.x, 18.x and 20.x releases lines on or shortly after, Tuesday August 8th 2023 in order to address: 3 high severity issues. 2 medium severity issues. 2 low severity issues. OpenSSL Security updates This security release includes the following OpenSSL security updates OpenSSL security advisory 14th July. OpenSSL security advisory 19th July. OpenSSL security advisory 31st July. Impact The 20.x release line of Node.js is vulnerable to 3 high severity issues, 2 medium severity issues, and 2 low severity issues. The 18.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues. The 16.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues. -------------------------------------------------------------------------------- ChangeLog:
* Wed Aug 9 2023 Stephen Gallagher sgallagh@redhat.com - 1:18.17.1-1 - Update to 18.17.1 * Thu Jul 20 2023 Fedora Release Engineering releng@fedoraproject.org - 1:18.16.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Wed Jul 12 2023 Stephen Gallagher sgallagh@redhat.com - 1:18.16.1-2 - Sync to latest nodejs-sources.sh --------------------------------------------------------------------------------
================================================================================ nodejs20-20.5.1-1.fc37 (FEDORA-2023-18476abd7e) JavaScript runtime -------------------------------------------------------------------------------- Update Information:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases Security releases available Updates are now available for the v16.x, v18.x, and v20.x Node.js release lines for the following issues. Permissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002) The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Thank you, to mattaustin for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias for fixing it. Permission model bypass by specifying a path traversal sequence in a Buffer (HIGH)(CVE-2023-32004) A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it. process.binding() can bypass the permission model through path traversal (HIGH)(CVE-2023-32558) The use of the deprecated API process.binding() can bypass the permission model through path traversal. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you to Rafael Gonzaga for reporting and fixing this vulnerability. Permissions policies can impersonate other modules in using module.constructor.createRequire() (MEDIUM)(CVE-2023-32006) The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias for fixing it. Permissions policies can be bypassed via process.binding (MEDIUM)(CVE-2023-32559) The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. Impacts This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Thank you, to LeoDog896 for reporting this vulnerability and thank you Tobias Nie��en for fixing it. fs.statfs can retrive stats from files restricted by the Permission Model (LOW)(CVE-2023-32005) A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.statfs API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you to Rafael Gonzaga for reporting and fixing this vulnerability. fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (LOW)(CVE-2023-32003) fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental permission model in Node.js 20. Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it. Downloads and release details Node.js v16.20.2 (LTS) Node.js v18.17.1 (LTS) Node.js v20.5.1 (Current) (Update 08-Aug-2023) Security Release target August 9th The Node.js Security Releases will be available on, or shortly after, Wednesday, August 9th, 2023. Summary The Node.js project will release new versions of the 16.x, 18.x and 20.x releases lines on or shortly after, Tuesday August 8th 2023 in order to address: 3 high severity issues. 2 medium severity issues. 2 low severity issues. OpenSSL Security updates This security release includes the following OpenSSL security updates OpenSSL security advisory 14th July. OpenSSL security advisory 19th July. OpenSSL security advisory 31st July. Impact The 20.x release line of Node.js is vulnerable to 3 high severity issues, 2 medium severity issues, and 2 low severity issues. The 18.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues. The 16.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues. -------------------------------------------------------------------------------- ChangeLog:
* Wed Aug 9 2023 Stephen Gallagher sgallagh@redhat.com - 1:20.5.1-1 - Update to 20.5.1 * Thu Jul 20 2023 Fedora Release Engineering releng@fedoraproject.org - 1:20.4.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ obs-build-20230808-428.2.1.fc37 (FEDORA-2023-dae0786cc4) A generic package build script -------------------------------------------------------------------------------- Update Information:
New upstream release 20230808 -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Dan ��erm��k dan.cermak@cgc-instruments.com - 20230808-1 - New upstream release 20230808, fixes rhbz#2230752 * Thu Jul 20 2023 Fedora Release Engineering releng@fedoraproject.org - 20230628-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2230752 - obs-build-20230808 is available https://bugzilla.redhat.com/show_bug.cgi?id=2230752 --------------------------------------------------------------------------------
================================================================================ oneapi-level-zero-1.13.5-1.fc37 (FEDORA-2023-e3a93d6475) OneAPI Level Zero Specification Headers and Loader -------------------------------------------------------------------------------- Update Information:
- Update to 1.13.5 -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Franti��ek Zatloukal fzatlouk@redhat.com - 1.13.5-1 - Update to 1.13.5 (Fixes RHBZ#2230755) * Thu Jul 20 2023 Fedora Release Engineering releng@fedoraproject.org - 1.13.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ pgbouncer-1.20.1-1.fc37 (FEDORA-2023-16c273b20b) Lightweight connection pooler for PostgreSQL -------------------------------------------------------------------------------- Update Information:
Update to 1.20.1, per changes described at https://www.pgbouncer.org/changelog.html#pgbouncer-120x ---- Update to bugfix release 1.20.0. -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Devrim G��nd��z devrim@gunduz.org - 1.20.1-1 - Update to 1.20.1, per changes described at: https://www.pgbouncer.org/changelog.html#pgbouncer-120x * Mon Aug 7 2023 Simone Caronni negativo17@gmail.com - 1.20.0-1 - Update to 1.20.0. * Fri Jul 21 2023 Fedora Release Engineering releng@fedoraproject.org - 1.19.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ podman-4.6.1-1.fc37 (FEDORA-2023-13724c2ebb) Manage Pods, Containers and Container Images -------------------------------------------------------------------------------- Update Information:
Automatic update for podman-4.6.1-1.fc37. ##### **Changelog for podman** ``` * Thu Aug 10 2023 Packit hello@packit.dev - 5:4.6.1-1 - [packit] 4.6.1 upstream release ``` -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Packit hello@packit.dev - 5:4.6.1-1 - [packit] 4.6.1 upstream release --------------------------------------------------------------------------------
================================================================================ pspg-5.8.0-1.fc37 (FEDORA-2023-d8d4512c5d) A unix pager optimized for psql -------------------------------------------------------------------------------- Update Information:
https://github.com/okbob/pspg/releases/tag/5.8.0 -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Pavel Raiskup praiskup@redhat.com - 5.8.0-1 - https://github.com/okbob/pspg/releases/tag/5.8.0 * Fri Jul 21 2023 Fedora Release Engineering releng@fedoraproject.org - 5.7.8-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ python3.12-3.12.0~rc1-1.fc37 (FEDORA-2023-0897f27742) Version 3.12 of the Python interpreter -------------------------------------------------------------------------------- Update Information:
Update to 3.12.0rc1 -------------------------------------------------------------------------------- ChangeLog:
* Mon Aug 7 2023 Tom���� Hrn��iar thrnciar@redhat.com - 3.12.0~rc1-1 - Update to 3.12.0rc1 * Wed Aug 2 2023 Charalampos Stratakis cstratak@redhat.com - 3.12.0~b4-3 - Remove extra distro-applied CFLAGS passed to user built C extensions - https://fedoraproject.org/wiki/Changes/Python_Extension_Flags_Reduction * Fri Jul 21 2023 Fedora Release Engineering releng@fedoraproject.org - 3.12.0~b4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ rust-inferno-0.11.15-3.fc37 (FEDORA-2023-3391ede2fb) Rust port of the FlameGraph performance profiling tool suite -------------------------------------------------------------------------------- Update Information:
- Update the quick-xml crate to version 0.30.0. - Update the plist crate to version 1.5.0. - Port the inferno, plist, and xcb crates to quick-xml v0.30. -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Fabio Valentini decathorpe@gmail.com - 0.11.15-3 - Bump quick-xml dependency from 0.28 to 0.30 * Fri Jul 21 2023 Fedora Release Engineering releng@fedoraproject.org - 0.11.15-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ rust-plist-1.5.0-1.fc37 (FEDORA-2023-3391ede2fb) Rusty plist parser -------------------------------------------------------------------------------- Update Information:
- Update the quick-xml crate to version 0.30.0. - Update the plist crate to version 1.5.0. - Port the inferno, plist, and xcb crates to quick-xml v0.30. -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Fabio Valentini decathorpe@gmail.com - 1.5.0-1 - Update to version 1.5.0; Fixes RHBZ#2221496 * Fri Jul 21 2023 Fedora Release Engineering releng@fedoraproject.org - 1.4.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ rust-quick-xml-0.30.0-1.fc37 (FEDORA-2023-3391ede2fb) High performance xml reader and writer -------------------------------------------------------------------------------- Update Information:
- Update the quick-xml crate to version 0.30.0. - Update the plist crate to version 1.5.0. - Port the inferno, plist, and xcb crates to quick-xml v0.30. -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Fabio Valentini decathorpe@gmail.com - 0.30.0-1 - Update to version 0.30.0; Fixes RHBZ#2214395 * Fri Jul 21 2023 Fedora Release Engineering releng@fedoraproject.org - 0.28.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ rust-xcb-1.2.2-2.fc37 (FEDORA-2023-3391ede2fb) Rust safe bindings for XCB -------------------------------------------------------------------------------- Update Information:
- Update the quick-xml crate to version 0.30.0. - Update the plist crate to version 1.5.0. - Port the inferno, plist, and xcb crates to quick-xml v0.30. -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Fabio Valentini decathorpe@gmail.com - 1.2.2-2 - Bump quick-xml dependency from 0.28 to 0.30 --------------------------------------------------------------------------------
================================================================================ rust2rpm-24.4.0-1.fc37 (FEDORA-2023-ec494db153) Generate RPM spec files for Rust crates -------------------------------------------------------------------------------- Update Information:
Update to version 24.4.0. Release notes: https://pagure.io/fedora- rust/rust2rpm/blob/main/f/NEWS -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Fabio Valentini decathorpe@gmail.com - 24.4.0-1 - Update to version 24.4.0; Fixes RHBZ#2230003 * Sat Jul 22 2023 Fedora Release Engineering releng@fedoraproject.org - 24.3.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Wed Jun 14 2023 Python Maint python-maint@redhat.com - 24.3.3-2 - Rebuilt for Python 3.12 --------------------------------------------------------------------------------
================================================================================ skopeo-1.13.2-1.fc37 (FEDORA-2023-9b224b0782) Inspect container images and repositories on registries -------------------------------------------------------------------------------- Update Information:
Automatic update for skopeo-1.13.2-1.fc37. ##### **Changelog for skopeo** ``` * Thu Aug 10 2023 Packit hello@packit.dev - 1:1.13.2-1 - [packit] 1.13.2 upstream release ``` -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Packit hello@packit.dev - 1:1.13.2-1 - [packit] 1.13.2 upstream release --------------------------------------------------------------------------------
================================================================================ snakemake-7.32.3-1.fc37 (FEDORA-2023-51499885d5) Workflow management system to create reproducible and scalable data analyses -------------------------------------------------------------------------------- Update Information:
Update to 7.32.3 ---- Update to 7.32.0: https://github.com/snakemake/snakemake/releases/tag/v7.32.0 ---- Update to 7.31.1 (close RHBZ#2224675) https://github.com/snakemake/snakemake/compare/v7.30.1...v7.31.1 - https://github.com/snakemake/snakemake/releases/tag/v7.30.2 - https://github.com/snakemake/snakemake/releases/tag/v7.31.0 - https://github.com/snakemake/snakemake/releases/tag/v7.31.1 -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Benjamin A. Beasley code@musicinmybrain.net - 7.32.3-1 - Update to 7.32.3 * Thu Aug 10 2023 Packit hello@packit.dev - 7.32.2-1 - [packit] 7.32.2 upstream release * Fri Aug 4 2023 Benjamin A. Beasley code@musicinmybrain.net - 7.32.0-1 - Update to 7.32.0 (close RHBZ#2229001) * Wed Aug 2 2023 Benjamin A. Beasley code@musicinmybrain.net - 7.31.1-1 - Update to 7.31.1 (close RHBZ#2224675) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2224675 - snakemake-7.31.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2224675 [ 2 ] Bug #2229001 - snakemake-7.32.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2229001 [ 3 ] Bug #2229375 - snakemake-7.32.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=2229375 --------------------------------------------------------------------------------
================================================================================ systemtap-4.9-2.fc37 (FEDORA-2023-1fb197c4ff) Programmable system-wide instrumentation system -------------------------------------------------------------------------------- Update Information:
Support for linux 6.4 kernels (rhbz2230079). -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Will Cohen wcohen@redhat.com - 4.9-2 - Support for linux 6.4 kernels (rhbz2230079). --------------------------------------------------------------------------------
================================================================================ ugene-48.0-1.fc37 (FEDORA-2023-2682fcb66b) Integrated bioinformatics toolkit -------------------------------------------------------------------------------- Update Information:
New version 48.0 is released. -------------------------------------------------------------------------------- ChangeLog:
* Thu Aug 10 2023 Mamoru TASAKA mtasaka@fedoraproject.org - 48.0-1 - 48.0 * Sat Jul 22 2023 Mamoru TASAKA mtasaka@fedoraproject.org - 47.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild --------------------------------------------------------------------------------
test-reports@lists.fedoraproject.org