The following Fedora 28 Security updates need testing:
Age URL
162
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d510cfd7eb
jgraphx-3.6.0.0-6.fc28
111
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d7aeaa74da
nodejs-brace-expansion-1.1.11-1.fc28
110
https://bodhi.fedoraproject.org/updates/FEDORA-2018-bc073fdc1a
nodejs-atob-2.1.1-1.fc28
103
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9dd3f7c013
unrtf-0.21.9-8.fc28
71
https://bodhi.fedoraproject.org/updates/FEDORA-2018-28e9841baf
docker-latest-1.13.1-37.git9cb56fd.fc28
20
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4f0089c995
yum-utils-1.1.31-515.fc28
14
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1735cbc422 CImg-2.3.6-1.fc28
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-2bba84217a
php-tcpdf-6.2.22-1.fc28
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9fc46b45ab
visualboyadvance-m-2.1.0-2.fc28
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1758d97170
yaml-cpp-0.6.1-4.fc28
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e9821afbca
mozilla-noscript-10.1.9.6-1.fc28
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-690535d30b
moodle-3.4.5-1.fc28
2
https://bodhi.fedoraproject.org/updates/FEDORA-2018-37a27807e0
hylafax+-5.6.1-1.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-2062cd7548
libbson-1.9.5-3.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1e79c12af0
zchunk-0.9.10-1.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1cb4c4a6d8 lcms2-2.9-4.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e820fccd83
kernel-headers-4.18.9-200.fc28 kernel-4.18.9-200.fc28
The following Fedora 28 Critical Path updates have yet to be approved:
Age URL
20
https://bodhi.fedoraproject.org/updates/FEDORA-2018-4f0089c995
yum-utils-1.1.31-515.fc28
19
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9403743de2
edk2-20180815gitcb5f4f45ce-1.fc28
14
https://bodhi.fedoraproject.org/updates/FEDORA-2018-f06af0ec34 qemu-2.11.2-4.fc28
14
https://bodhi.fedoraproject.org/updates/FEDORA-2018-221c934152
perl-File-Path-2.16-1.fc28
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6a3d2795ab
pungi-4.1.28-1.fc28
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-b34ee01b0d
iproute-4.18.0-1.fc28
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8217a06c3a pcre2-10.32-1.fc28
perl-re-engine-PCRE2-0.14-4.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e820fccd83
kernel-headers-4.18.9-200.fc28 kernel-4.18.9-200.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6053f02a8d
opus-tools-0.2-1.fc28 opus-1.3-0.7.rc2.fc28 libopusenc-0.2-1.fc28 opusfile-0.11-1.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-81c6859230 chrony-3.4-1.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d1672574e5 cups-2.2.6-23.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-9ad881cf30 vim-8.1.408-1.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-33c28dc24f
dash-0.5.10.2-1.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-038d8f7b50
NetworkManager-1.10.12-1.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1cb4c4a6d8 lcms2-2.9-4.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-b26195ce1d
dmidecode-3.2-1.fc28
0
https://bodhi.fedoraproject.org/updates/FEDORA-2018-337910120d pcre2-10.32-2.fc28
The following builds have been pushed to Fedora 28 updates-testing
erlang-20.3.8.9-2.fc28
git-annex-6.20180913-1.fc28
klatexformula-4.0.0-3.fc28
nodejs-8.12.0-1.fc28
openas2-2.6.1-4.fc28
openssl-1.1.0i-1.fc28
orthanc-1.4.2-1.fc28
osinfo-db-20180920-1.fc28
spamassassin-3.4.2-2.fc28
standard-test-roles-2.17-1.fc28
usbip-4.18.9-2.fc28
Details about builds:
================================================================================
erlang-20.3.8.9-2.fc28 (FEDORA-2018-52e4892c54)
General-purpose programming language and runtime environment
--------------------------------------------------------------------------------
Update Information:
* Move man=pages into system-wide directories (based on a patch from Debian)
---- * Erlang ver. 20.8.3.9 * Fix for meck
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Peter Lemenkov <lemenkov(a)gmail.com> - 20.3.8.9-2
- Install man-pages into system-wide directories (as Debian already did).
* Tue Sep 18 2018 Peter Lemenkov <lemenkov(a)gmail.com> - 20.3.8.9-1
- Ver. 20.3.8.9
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1564591 - man erl fails with No manual entry for erl
https://bugzilla.redhat.com/show_bug.cgi?id=1564591
--------------------------------------------------------------------------------
================================================================================
git-annex-6.20180913-1.fc28 (FEDORA-2018-99e23f721c)
Manage files with git, without checking their contents into git
--------------------------------------------------------------------------------
Update Information:
update to 6.20180913
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Elliott Sales de Andrade <quantum.analyst(a)gmail.com> -
6.20180913-1
- update to 6.20180913
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1631160 - git-annex-6.20180913 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1631160
[ 2 ] Bug #1629035 - git-annex-6.20180807-1 fails with chdir: does not exist
https://bugzilla.redhat.com/show_bug.cgi?id=1629035
--------------------------------------------------------------------------------
================================================================================
klatexformula-4.0.0-3.fc28 (FEDORA-2018-be43dace45)
Application for easy image creating from a LaTeX equation
--------------------------------------------------------------------------------
Update Information:
- Fix FTBFS rhbz #1604508 (thanks to Juhani Numminen)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Filipe Rosset <rosset.filipe(a)gmail.com> - 4.0.0-3
- Fix FTBFS rhbz #1604508 (thanks to Juhani Numminen)
* Fri Jul 13 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.0.0-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1604508 - klatexformula: FTBFS in Fedora rawhide
https://bugzilla.redhat.com/show_bug.cgi?id=1604508
--------------------------------------------------------------------------------
================================================================================
nodejs-8.12.0-1.fc28 (FEDORA-2018-ffcf3f74d5)
JavaScript runtime
--------------------------------------------------------------------------------
Update Information:
Update to Node.js 10.11.0
https://nodejs.org/en/blog/release/v10.11.0/
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 11 2018 Stephen Gallagher <sgallagh(a)redhat.com> - -
- Update to 8.12.0
-
https://nodejs.org/en/blog/release/v8.12.0/
- Drop NPM symlinks
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1630937 - npm requires python2
https://bugzilla.redhat.com/show_bug.cgi?id=1630937
--------------------------------------------------------------------------------
================================================================================
openas2-2.6.1-4.fc28 (FEDORA-2018-c1754a58aa)
Java-based implementation of the EDIINT AS2 standard
--------------------------------------------------------------------------------
Update Information:
This is an open Java implementation of the AS2 EDI transport standard. To test,
you need to install multiple instances, or use actual EDI partners. For
instance, if you are an Amazon EDI vendor, you can create a TEST connection to
your openas2 instance and run Amazon tests. You need to use the Java keytool
to create and exchange public keys to identify EDI partners. At some point, I
need to add a Fedora README with more Fedora specific howtos. While this is an
application designed to exchange business EDI documents, you can test by
creating 2 or more instances, and exchanging any arbitrary files. AS2 doesn't
look at the contents of documents other than to compute the hash for signatures.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1478210 - Review Request: openas2 - Java implementation of EDIINT AS2
https://bugzilla.redhat.com/show_bug.cgi?id=1478210
--------------------------------------------------------------------------------
================================================================================
openssl-1.1.0i-1.fc28 (FEDORA-2018-520e4c5b4e)
Utilities from the general purpose cryptography library with TLS implementation
--------------------------------------------------------------------------------
Update Information:
Update to 1.1.0i version from upstream fixing minor security issues.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Tom���� Mr��z <tmraz(a)redhat.com> 1.1.0i-1
- update to upstream version 1.1.0i
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1568256 - CVE-2018-0737 openssl: RSA key generation cache timing
vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1568256
[ 2 ] Bug #1591101 - CVE-2018-0732 openssl: Malicious server can send large prime to
client during DH(E) TLS handshake causing the client to hang [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1591101
--------------------------------------------------------------------------------
================================================================================
orthanc-1.4.2-1.fc28 (FEDORA-2018-9304e41b46)
RESTful DICOM server for healthcare and medical research
--------------------------------------------------------------------------------
Update Information:
New upstream version
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Sebastien Jodogne <s.jodogne(a)gmail.com> - 1.4.2-1
- New upstream version
- Fix ambiguous Python shebang
--------------------------------------------------------------------------------
================================================================================
osinfo-db-20180920-1.fc28 (FEDORA-2018-7ecba4310e)
osinfo database files
--------------------------------------------------------------------------------
Update Information:
Update to new release
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Fabiano Fid��ncio <fabiano(a)fidencio.org> - 20180920-1
- Update to new release
--------------------------------------------------------------------------------
================================================================================
spamassassin-3.4.2-2.fc28 (FEDORA-2018-46d7a7f63e)
Spam filter for email which can be invoked from mail delivery agents
--------------------------------------------------------------------------------
Update Information:
Fixed some small bugs in the previous package: Initial rules now have the
correct version, sought channel config is dropped (since it doesn't exist
anymore) and build / runtime deps adjusted. ---- Update to 3.4.2. Fixes
CVE-2017-15705, CVE-2018-11780 and CVE-2018-11781 along with many other bugfixes
and improvements. See
https://www.mail-
archive.com/announce@apache.org/msg04823.html for more information.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Kevin Fenzi <kevin(a)scrye.com> - 3.4.2-2
- Misc small bug fixes and cleanups.
* Sun Sep 16 2018 Kevin Fenzi <kevin(a)scrye.com> - 3.4.2-1
- Update to 3.4.2
- Fixes: CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781
* Mon Jul 23 2018 Jaroslav ��karvada <jskarvad(a)redhat.com> - 3.4.1-25
- perl-Razor-Agent and perl-Net-Patricia not used on RHEL
* Sat Jul 14 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.4.1-24
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Tue Jul 10 2018 Tomas Korbar <tkorbar(a)redhat.com> - 3.4.1-23
- Fix daemonize subroutine
- See
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7594
* Fri Jun 29 2018 Jitka Plesnikova <jplesnik(a)redhat.com> - 3.4.1-22
- Perl 5.28 rebuild
* Wed Jun 20 2018 Kevin Fenzi <kevin(a)scrye.com> - 3.4.1-21
- Conditionalize Requires for /sbin/service and /sbin/chkconfig. Fixes bug #1592390
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1629537 - CVE-2018-11781 spamassassin: Local user code injection in the meta
rule syntax [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1629537
[ 2 ] Bug #1629534 - CVE-2018-11780 spamassassin: Potential remote code execution
vulnerability in PDFInfo plugin [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1629534
[ 3 ] Bug #1629522 - CVE-2017-15705 spamassassin: Certain unclosed tags in crafted
emails allow for scan timeouts and resulting denial of service [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1629522
[ 4 ] Bug #1629491 - SpamAssassin 3.4.2 released with CVE disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1629491
[ 5 ] Bug #1590592 - Need spamassassin release with patch for bug 7208 included
https://bugzilla.redhat.com/show_bug.cgi?id=1590592
--------------------------------------------------------------------------------
================================================================================
standard-test-roles-2.17-1.fc28 (FEDORA-2018-226cc21146)
Standard Test Interface Ansible roles
--------------------------------------------------------------------------------
Update Information:
Update to 2.17
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Andrei Stepanov <astepano(a)redhat.com> - 2.17-1
- Build with the latest merged PRs.
--------------------------------------------------------------------------------
================================================================================
usbip-4.18.9-2.fc28 (FEDORA-2018-75b15af646)
USB/IP user-space
--------------------------------------------------------------------------------
Update Information:
Fixes problem importing device when another directory is in
```/sys/devices/platform``` after ```vhci_hcd.0```
--------------------------------------------------------------------------------
ChangeLog:
* Thu Sep 20 2018 Jonathan Dieter <jdieter(a)gmail.com> - 4.18.9-1
- Update to 4.18.9
- Add patch to fix problem importing device when another device is in
/sys/devices/platform after vhci (#1631148)
- Fix missing period in patch
* Sat Jul 14 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 4.15.10-3
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Thu Jun 28 2018 Jonathan Dieter <jdieter(a)gmail.com> - 4.15.10-2
- Remove unneeded ldconfig scriptlets
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1631148 - usbip doesn't work
https://bugzilla.redhat.com/show_bug.cgi?id=1631148
--------------------------------------------------------------------------------