The following Fedora 35 Security updates need testing: Age URL 53 https://bodhi.fedoraproject.org/updates/FEDORA-2021-4c0f58bf07 mysql-connector-java-8.0.27-1.fc35 13 https://bodhi.fedoraproject.org/updates/FEDORA-2021-22594d9eb0 chromium-96.0.4664.110-3.fc35 6 https://bodhi.fedoraproject.org/updates/FEDORA-2022-7e94ba673b e00compr-1.0.1-28.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-96c79bf003 python-lxml-4.6.5-1.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-8472dd59ff wordpress-5.8.3-1.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-cfd0048127 mingw-uriparser-0.9.6-1.fc35 uriparser-0.9.6-1.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-1dae017601 python-celery-5.2.3-2.fc35 python-kombu-5.2.3-1.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-a66734e7a2 btrbk-0.31.3-1.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-0f1653e269 thefuck-3.32-1.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-201509474f zstd-1.5.1-6.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-ade480f201 kernel-5.15.14-200.fc35
The following Fedora 35 Critical Path updates have yet to be approved: Age URL 46 https://bodhi.fedoraproject.org/updates/FEDORA-2021-12f6c46ad8 qemu-6.1.0-13.fc35 6 https://bodhi.fedoraproject.org/updates/FEDORA-2022-a581f05398 breeze-icon-theme-5.90.0-1.fc35 extra-cmake-modules-5.90.0-1.fc35 kf5-5.90.0-1.fc35 kf5-attica-5.90.0-1.fc35 kf5-baloo-5.90.0-1.fc35 kf5-bluez-qt-5.90.0-1.fc35 kf5-frameworkintegration-5.90.0-1.fc35 kf5-kactivities-5.90.0-1.fc35 kf5-kactivities-stats-5.90.0-1.fc35 kf5-kapidox-5.90.0-1.fc35 kf5-karchive-5.90.0-1.fc35 kf5-kauth-5.90.0-1.fc35 kf5-kbookmarks-5.90.0-1.fc35 kf5-kcalendarcore-5.90.0-1.fc35 kf5-kcmutils-5.90.0-1.fc35 kf5-kcodecs-5.90.0-1.fc35 kf5-kcompletion-5.90.0-1.fc35 kf5-kconfig-5.90.0-1.fc35 kf5-kconfigwidgets-5.90.0-1.fc35 kf5-kcontacts-5.90.0-1.fc35 kf5-kcoreaddons-5.90.0-1.fc35 kf5-kcrash-5.90.0-1.fc35 kf5-kdav-5.90.0-1.fc35 kf5-kdbusaddons-5.90.0-1.fc35 kf5-kdeclarative-5.90.0-1.fc35 kf5-kded-5.90.0-1.fc35 kf5-kdelibs4support-5.90.0-1.fc35 kf5-kdesignerplugin-5.90.0-1.fc35 kf5-kdesu-5.90.0-1.fc35 kf5-kdewebkit-5.90.0-1.fc35 kf5-kdnssd-5.90.0-1.fc35 kf5-kdoctools-5.90.0-1.fc35 kf5-kemoticons-5.90 .0-1.fc35 kf5-kfilemetadata-5.90.0-1.fc35 kf5-kglobalaccel-5.90.0-1.fc35 kf5-kguiaddons-5.90.0-1.fc35 kf5-kholidays-5.90.0-1.fc35 kf5-khtml-5.90.0-1.fc35 kf5-ki18n-5.90.0-1.fc35 kf5-kiconthemes-5.90.0-1.fc35 kf5-kidletime-5.90.0-1.fc35 kf5-kimageformats-5.90.0-1.fc35 kf5-kinit-5.90.0-1.fc35 kf5-kio-5.90.0-1.fc35 kf5-kirigami2-5.90.0-1.fc35 kf5-kitemmodels-5.90.0-1.fc35 kf5-kitemviews-5.90.0-1.fc35 kf5-kjobwidgets-5.90.0-1.fc35 kf5-kjs-5.90.0-1.fc35 kf5-kjsembed-5.90.0-1.fc35 kf5-kmediaplayer-5.90.0-1.fc35 kf5-knewstuff-5.90.0-1.fc35 kf5-knotifications-5.90.0-1.fc35 kf5-knotifyconfig-5.90.0-1.fc35 kf5-kpackage-5.90.0-1.fc35 kf5-kparts-5.90.0-1.fc35 kf5-kpeople-5.90.0-1.fc35 kf5-kplotting-5.90.0-1.fc35 kf5-kpty-5.90.0-1.fc35 kf5-kquickcharts-5.90.0-1.fc35 kf5-kross-5.90.0-1.fc35 kf5-krunner-5.90.0-1.fc35 kf5-kservice-5.90.0-1.fc35 kf5-ktexteditor-5.90.0-1.fc35 kf5-ktextwidgets-5.90.0-1.fc35 kf5-kunitconversion-5.90.0-1.fc35 kf5-kwallet-5.90.0-1.fc35 kf5-kwayland-5.90.0-1.fc35 kf5-kwid getsaddons-5.90.0-1.fc35 kf5-kwindowsystem-5.90.0-1.fc35 kf5-kxmlgui-5.90.0-1.fc35 kf5-kxmlrpcclient-5.90.0-1.fc35 kf5-modemmanager-qt-5.90.0-1.fc35 kf5-networkmanager-qt-5.90.0-1.fc35 kf5-plasma-5.90.0-1.fc35 kf5-prison-5.90.0-1.fc35 kf5-purpose-5.90.0-1.fc35 kf5-solid-5.90.0-1.fc35 kf5-sonnet-5.90.0-1.fc35 kf5-syndication-5.90.0-1.fc35 kf5-syntax-highlighting-5.90.0-1.fc35 kf5-threadweaver-5.90.0-1.fc35 oxygen-icon-theme-5.90.0-1.fc35 qqc2-desktop-style-5.90.0-1.fc35 5 https://bodhi.fedoraproject.org/updates/FEDORA-2022-2561b43715 ndctl-72.1-1.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-39ffce84e3 gdb-11.1-6.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-f90519fad7 evolution-3.42.3-1.fc35 evolution-data-server-3.42.3-1.fc35 evolution-ews-3.42.3-1.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-96c79bf003 python-lxml-4.6.5-1.fc35 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-b0c2bacdfc libtpms-0.9.2-0.20220106gite81d634c27.fc35.0 4 https://bodhi.fedoraproject.org/updates/FEDORA-2022-54cc1415e1 rdma-core-38.1-1.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-f8c35c645e gstreamer1-plugins-bad-free-1.19.3-4.fc35 1 https://bodhi.fedoraproject.org/updates/FEDORA-2022-cfac35415b mtools-4.0.37-1.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-ade480f201 kernel-5.15.14-200.fc35 0 https://bodhi.fedoraproject.org/updates/FEDORA-2022-201509474f zstd-1.5.1-6.fc35
The following builds have been pushed to Fedora 35 updates-testing
argparse-manpage-2.1-1.fc35 augeas-1.13.0-1.fc35 binaryen-104-1.fc35 cfn-lint-0.56.4-1.fc35 egl-gbm-1.1.0-1.fc35 gdm-41.3-1.fc35 gh-2.4.0-3.fc35 gnome-session-41.3-1.fc35 golang-github-chromedp-cdproto-0-0.8.20220112git12edfde.fc35 golang-github-minio-7.0.20-1.fc35 golang-github-pkg-xattr-0.4.4-3.fc35 homebank-5.5.4-1.fc35 libmetalink-0.1.3-24.fc35 libreswan-4.6-1.fc35 lollypop-1.4.27-1.fc35 lprint-1.1.0-1.fc35 mirrorlist-server-3.0.6-1.fc35 moby-engine-20.10.12-1.fc35 nautilus-41.2-1.fc35 nodejs-16.13.2-1.fc35 notcurses-3.0.4-1.fc35 nv-codec-headers-11.1.5.1-1.fc35 osbuild-composer-42-1.fc35 perl-String-Interpolate-Named-1.02-1.fc35 php-doctrine-lexer-1.2.2-1.fc35 php-doctrine-orm-2.11.0-1.fc35 php-laminas-paginator-2.12.2-1.fc35 php-pecl-igbinary-3.2.7-1.fc35 php-pecl-imagick-3.7.0-1.fc35 pspg-5.5.3-1.fc35 python-bugzilla-3.2.0-1.fc35 python-editorconfig-0.12.3-4.fc35 python-journal-brief-1.1.8-1.fc35 python-pyqt-feedback-flow-0.1.1-1.fc35 python-testinfra-5.3.1-6.fc35 python-varlink-31.0.0-1.fc35 python-yfinance-0.1.69-1.fc35 python3.10-3.10.1-3.fc35 qgnomeplatform-0.8.4-1.fc35 resalloc-aws-1.1-1.fc35 rhino-1.7.14-1.fc35 rust-console-0.15.0-1.fc35 rust-console0.14-0.14.1-1.fc35 rust-hyperfine-1.12.0-1.fc35 rust-indicatif-0.16.2-1.fc35 rust-indicatif0.15-0.15.0-1.fc35 rust-ipnetwork-0.18.0-1.fc35 rust-ipnetwork0.17-0.17.0-1.fc35 rust-netlink-packet-generic-0.1.0-1.fc35 rust-roxmltree-0.14.1-1.fc35 rust-svg_metadata-0.4.2-4.fc35 seamonkey-2.53.10.2-1.fc35 systemd-249.9-1.fc35 tcpdump-4.99.1-3.fc35 texlive-base-20210325-44.fc35 thermald-2.4.8-1.fc35 touchegg-2.0.13-1.fc35 vim-8.2.4068-1.fc35 whois-5.5.11-1.fc35 wireplumber-0.4.6-1.fc35 wireshark-3.6.1-1.fc35 zeitgeist-1.0.4-1.fc35
Details about builds:
================================================================================ argparse-manpage-2.1-1.fc35 (FEDORA-2022-e8ec0933e8) Build manual page from Python ArgumentParser object -------------------------------------------------------------------------------- Update Information:
new upstream release -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Pavel Raiskup praiskup@redhat.com - 2.1-1 - new upstream release: https://github.com/praiskup/argparse-manpage/releases/tag/v2.1 --------------------------------------------------------------------------------
================================================================================ augeas-1.13.0-1.fc35 (FEDORA-2022-fb4358e686) A library for changing configuration files -------------------------------------------------------------------------------- Update Information:
New upstream version 1.13.0 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Richard W.M. Jones rjones@redhat.com - 1.13.0-1 - New upstream version 1.13.0 --------------------------------------------------------------------------------
================================================================================ binaryen-104-1.fc35 (FEDORA-2022-c0640fa82f) Compiler and toolchain infrastructure library for WebAssembly -------------------------------------------------------------------------------- Update Information:
Bugfix release including fix for CVE-2021-45290 and CVE-2021-45293. -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 11 2022 Dominik Mierzejewski rpm@greysector.net 104-1 - update to 104 (#2033827) - fixes CVE-2021-45290 (#2037323, #2037325) - fixes CVE-2021-45293 (#2037324, #2037326) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2033827 - binaryen-104 is available https://bugzilla.redhat.com/show_bug.cgi?id=2033827 [ 2 ] Bug #2037325 - CVE-2021-45290 binaryen: assertion abort in wasm::handle_unreachable [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2037325 [ 3 ] Bug #2037326 - CVE-2021-45293 binaryen: Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2037326 --------------------------------------------------------------------------------
================================================================================ cfn-lint-0.56.4-1.fc35 (FEDORA-2022-b0d104a615) CloudFormation Linter -------------------------------------------------------------------------------- Update Information:
Update to 0.56.4 - Update CloudFormation specs to 52.0.0 - Add region `ap- southeast-3` -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Benjamin A. Beasley code@musicinmybrain.net 0.56.4-1 - Update to 0.56.3 (close RHBZ#2039002) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2039002 - cfn-lint-0.56.4 is available https://bugzilla.redhat.com/show_bug.cgi?id=2039002 --------------------------------------------------------------------------------
================================================================================ egl-gbm-1.1.0-1.fc35 (FEDORA-2022-71c7e3c313) Nvidia egl gbm libary -------------------------------------------------------------------------------- Update Information:
- New package -------------------------------------------------------------------------------- ChangeLog:
* Wed Dec 22 2021 Leigh Scott leigh123linux@gmail.com - 1.1.0-1 - Initial build --------------------------------------------------------------------------------
================================================================================ gdm-41.3-1.fc35 (FEDORA-2022-063425fb12) The GNOME Display Manager -------------------------------------------------------------------------------- Update Information:
Update to 41.3 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 David King amigadave@amigadave.com - 1:41.3-1 - Update to 41.3 --------------------------------------------------------------------------------
================================================================================ gh-2.4.0-3.fc35 (FEDORA-2022-4d09bfd08f) GitHub���s official command line tool -------------------------------------------------------------------------------- Update Information:
Update to 2.4.0. Closes rhbz#2034689 Release notes: https://github.com/cli/cli/releases/tag/v2.4.0 Correct %goipath; generate manpages; fix dependencies ``` diff -%global goipath github.com/cli/cli +%global goipath github.com/cli/cli/v2 ``` **Please note that, due to the `%goipath` change, the devel package's name has changed from `golang-github- cli-devel` to `golang-github-cli-2-devel`. The new package appropriately obsoletes the old one.** -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Maxwell G gotmax@e.email 2.4.0-3 - Fix %goipath; generate manpages; fix dependencies * Thu Dec 30 2021 Mikel Olasagasti Uranga mikel@olasagasti.info 2.4.0-1 - Update to 2.4.0. Closes rhbz#2034689 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2034689 - gh-2.4.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2034689 --------------------------------------------------------------------------------
================================================================================ gnome-session-41.3-1.fc35 (FEDORA-2022-d6faf56ba8) GNOME session manager -------------------------------------------------------------------------------- Update Information:
Update to 41.3 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 David King amigadave@amigadave.com - 41.3-1 - Update to 41.3 --------------------------------------------------------------------------------
================================================================================ golang-github-chromedp-cdproto-0-0.8.20220112git12edfde.fc35 (FEDORA-2022-6ab22d76ab) Generated commands, types, and events for the Chrome DevTools Protocol domains -------------------------------------------------------------------------------- Update Information:
Update to latest commit; fix compatibility with latest Chromium -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Elliott Sales de Andrade quantum.analyst@gmail.com - 0-0.8.20220112git12edfde - Bump to commit 12edfdeb56f8221197015a2f3eb5ddf922b096d1 --------------------------------------------------------------------------------
================================================================================ golang-github-minio-7.0.20-1.fc35 (FEDORA-2022-9a66139308) MinIO Client SDK for Go -------------------------------------------------------------------------------- Update Information:
Update to latest upstream release 7.0.20 (closes rhbz#2004305) -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Steve Miller (copart) code@rellims.com - 7.0.20-1 - Update to latest upstream release 7.0.20 (closes rhbz#2004305) * Thu Sep 2 2021 Fabian Affolter mail@fabian-affolter.ch - 7.0.13-1 - Update to latest upstream release 7.0.13 (closes rhbz#1925390) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2004305 - golang-github-minio-7.0.20 is available https://bugzilla.redhat.com/show_bug.cgi?id=2004305 --------------------------------------------------------------------------------
================================================================================ golang-github-pkg-xattr-0.4.4-3.fc35 (FEDORA-2022-59e34bfaa6) Extended attribute support for Go -------------------------------------------------------------------------------- Update Information:
Update to latest upstream release 0.4.4 (closes rhbz#2014791) -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Steve Miller (copart) code@rellims.com - 0.4.4-1 - Update to latest upstream release 0.4.4 (closes rhbz#2014791) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2014791 - golang-github-pkg-xattr-0.4.4 is available https://bugzilla.redhat.com/show_bug.cgi?id=2014791 --------------------------------------------------------------------------------
================================================================================ homebank-5.5.4-1.fc35 (FEDORA-2022-0e021c380f) Free easy personal accounting for all -------------------------------------------------------------------------------- Update Information:
- Update to 5.5.4 -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 11 2022 Mukundan Ragavan nonamedotc@fedoraproject.org - 5.5.4-1 - Update to 5.5.4 (Fixes rhbz#1991241) --------------------------------------------------------------------------------
================================================================================ libmetalink-0.1.3-24.fc35 (FEDORA-2022-85e256e044) Metalink library written in C -------------------------------------------------------------------------------- Update Information:
Fix some [memory issues](https://bugs.launchpad.net/libmetalink/+bug/1784359) and generally improve packaging. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Benjamin A. Beasley code@musicinmybrain.net 0.1.3-24 - Package AUTHORS, ChangeLog, and NEWS files * Wed Jan 12 2022 Benjamin A. Beasley code@musicinmybrain.net 0.1.3-23 - Drop EPEL7 support in the spec file * Wed Jan 12 2022 Benjamin A. Beasley code@musicinmybrain.net - 0.1.3-16 - Switch to GitHub release archive; as a result, we must now run autoreconf - Patch additional allocation-related issues - Switch BR���s to pkgconfig(���) - Drop obsolete macros and workarounds - General tidying - Don���t glob over the .so version --------------------------------------------------------------------------------
================================================================================ libreswan-4.6-1.fc35 (FEDORA-2022-42e0892147) Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec -------------------------------------------------------------------------------- Update Information:
Resolves: CVE-2022-23094 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Paul Wouters paul.wouters@aiven.io - 4.6-1 - Resolves: CVE-2022-23094 - Resolves: rhbz#2039604 libreswan-4.6 is available - Add gpg key and signature check for build -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2039604 - libreswan-4.6 is available https://bugzilla.redhat.com/show_bug.cgi?id=2039604 --------------------------------------------------------------------------------
================================================================================ lollypop-1.4.27-1.fc35 (FEDORA-2022-7221cdfaad) Music player for GNOME -------------------------------------------------------------------------------- Update Information:
Update to 1.4.27-1 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Martin Gansser martinkg@fedoraproject.org - 1.4.27-1 - Update to 1.4.27 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2039738 - lollypop-1.4.27 is available https://bugzilla.redhat.com/show_bug.cgi?id=2039738 --------------------------------------------------------------------------------
================================================================================ lprint-1.1.0-1.fc35 (FEDORA-2022-536a2e456f) A Label Printer Application -------------------------------------------------------------------------------- Update Information:
2035381 - lprint-1.1.0 is available -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 4 2022 Zdenek Dohnal zdohnal@redhat.com - 1.1.0-1 - 2035381 - lprint-1.1.0 is available -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2035381 - lprint-1.1.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2035381 --------------------------------------------------------------------------------
================================================================================ mirrorlist-server-3.0.6-1.fc35 (FEDORA-2022-3b249d5030) Mirrorlist Server -------------------------------------------------------------------------------- Update Information:
- Update mirrorlist-server to version 3.0.6. - Update hyperfine to version 1.12.0. - Update the indicatif crate to version 0.16.2. - Introduce a compat package for indicatif versions 0.15.x. - Update the console crate to version 0.15.0. - Introduce a compat package for console versions 0.14.x. - Update the ipnetwork crate to version 0.18.0. - Introduce a compat package for ipnetwork versions 0.17.x. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Fabio Valentini decathorpe@gmail.com - 3.0.6-1 - Update to version 3.0.6. --------------------------------------------------------------------------------
================================================================================ moby-engine-20.10.12-1.fc35 (FEDORA-2022-9046be8780) The open-source application container engine -------------------------------------------------------------------------------- Update Information:
Update to 20.10.12. Fixes rhbz#2032534. Install zsh completions to the correct directory. Fixes rhbz#2038888. -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 11 2022 Maxwell G gotmax@e.email - 20.10.12-1 - Update to 20.10.12. Fixes rhbz#2032534. - Install zsh completions to the correct directory. Fixes rhbz#2038888. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2032534 - moby-engine-20.10.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2032534 [ 2 ] Bug #2038888 - moby-engine-zsh-completion installs in the wrong path https://bugzilla.redhat.com/show_bug.cgi?id=2038888 --------------------------------------------------------------------------------
================================================================================ nautilus-41.2-1.fc35 (FEDORA-2022-c58dfbd93f) File manager for GNOME -------------------------------------------------------------------------------- Update Information:
Update to 41.2 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 David King amigadave@amigadave.com - 41.2-1 - Update to 41.2 --------------------------------------------------------------------------------
================================================================================ nodejs-16.13.2-1.fc35 (FEDORA-2022-0eda327cb4) JavaScript runtime -------------------------------------------------------------------------------- Update Information:
## 2022-01-10, Version 16.13.2 'Gallium' (LTS), @danielleadams This is a security release. ### Notable changes #### Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531) Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly. Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the `--security-revert` command-line option. More details will be available at [CVE-2021-44531](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2021-44531) after publication. #### Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532) Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints. Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the `--security-revert` command-line option. More details will be available at [CVE-2021-44532](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2021-44532) after publication. #### Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533) Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification. Affected versions of Node.js do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable. More details will be available at [CVE-2021-44533](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2021-44533) after publication. #### Prototype pollution via `console.table` properties (Low)(CVE-2022-21824) Due to the formatting logic of the `console.table()` function it was not safe to allow user controlled input to be passed to the `properties` parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be `__proto__`. The prototype pollution has very limited control, in that it only allows an empty string to be assigned numerical keys of the object prototype. Versions of Node.js with the fix for this use a null protoype for the object these properties are being assigned to. More details will be available at [CVE-2022-21824](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2022-21824) after publication. Thanks to Patrik Oldsberg (rugvip) for reporting this vulnerability. -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 11 2022 Stephen Gallagher sgallagh@redhat.com - 1:16.13.2-1 - Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531) - Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532) - Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533) - Prototype pollution via `console.table` properties (Low)(CVE-2022-21824) * Thu Dec 2 2021 Stephen Gallagher sgallagh@redhat.com - 1:16.13.1-2 - Enable building for EPEL 8 modules * Thu Dec 2 2021 Stephen Gallagher sgallagh@redhat.com - 1:16.13.1-1 - Update to 16.13.1 - https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V16.md#1... --------------------------------------------------------------------------------
================================================================================ notcurses-3.0.4-1.fc35 (FEDORA-2022-f9d5c74b67) Character graphics and TUI library -------------------------------------------------------------------------------- Update Information:
New upstream https://github.com/dankamongmen/notcurses/releases/tag/v3.0.4 -------------------------------------------------------------------------------- ChangeLog:
* Mon Jan 10 2022 Nick Black dankamongmen@gmail.com 3.0.4-1 - update to new upstream 3.0.4 --------------------------------------------------------------------------------
================================================================================ nv-codec-headers-11.1.5.1-1.fc35 (FEDORA-2022-484a59c55e) FFmpeg version of Nvidia Codec SDK headers -------------------------------------------------------------------------------- Update Information:
- Update -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Leigh Scott leigh123linux@gmail.com - 11.1.5.1-1 - Update to 11.1.5.1 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1991249 - nv-codec-headers-11.1.5.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=1991249 --------------------------------------------------------------------------------
================================================================================ osbuild-composer-42-1.fc35 (FEDORA-2022-7ea757c1d0) An image building service based on osbuild -------------------------------------------------------------------------------- Update Information:
Update osbuild-composer to the latest version -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Packit Service user-cont-team+packit-service@redhat.com - 42-1 CHANGES WITH 42: ---------------- * RHEL-86/90: refactoring of `osPipeline` and its variants (#2139) * api/cloud: drop v1 API (#2163) * weldr: return an error if host distro wasn't found in distro registry (#2158) * dnf json cache cleaner (#2119) * Update terraform SHA (#2157) * build(deps): bump actions/setup-go from 2.1.4 to 2.1.5 (#2156)
Contributions from: Achilleas Koutsou, Jakub Rusz, Juan Abia, Ond��ej Budai, Thomas Lavocat, Tomas Hozza, Sanne Raymaekers
��� Grenoble, 2022-01-12 --------------------------------------------------------------------------------
================================================================================ perl-String-Interpolate-Named-1.02-1.fc35 (FEDORA-2022-4b8de83131) Interpolated named arguments in string -------------------------------------------------------------------------------- Update Information:
Upgrade to upstream. -------------------------------------------------------------------------------- ChangeLog:
* Thu Jan 13 2022 Johan Vromans jvromans@squirrel.nl - 1.02-1 - Upgrade to upstream. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2039707 - perl-String-Interpolate-Named-1.02 is available https://bugzilla.redhat.com/show_bug.cgi?id=2039707 --------------------------------------------------------------------------------
================================================================================ php-doctrine-lexer-1.2.2-1.fc35 (FEDORA-2022-327d67aab9) Base library for a lexer that can be used in top-down, recursive descent parsers -------------------------------------------------------------------------------- Update Information:
**Version 1.2.2** * 59: PHPStan 1.3, Doctrine Coding Standard 9 thanks to @derrabus * 58: Allow the installation on PHP 7.1 thanks to @derrabus -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Remi Collet remi@remirepo.net - 1.2.2-1 - update to 1.2.2 - switch to phpunit9 --------------------------------------------------------------------------------
================================================================================ php-doctrine-orm-2.11.0-1.fc35 (FEDORA-2022-c521a78c77) Doctrine Object-Relational-Mapper (ORM) -------------------------------------------------------------------------------- Update Information:
**Version 2.11.0** Improvement * 9356: Remove the composer/package- versions-deprecated package thanks to @derrabus * 9340: Use the readonly annotation thanks to @derrabus * 9319: Document LockMode enums thanks to @derrabus * 9316: Support readonly properties for read operations thanks to @derrabus * 9312: Leverage generic ObjectManagerDecorator thanks to @derrabus * 9275: Fix type errors in AbstractQuery and QueryBuilder thanks to @derrabus * 9274: Fix type errors in AnnotationDriver thanks to @derrabus * 9273: Fix docblocks on nullable EM properties thanks to @derrabus * 9271: Fix return types of cache interfaces thanks to @derrabus * 9203: Drop support for DBAL 3.1 thanks to @derrabus * 9202: Add SchemaIgnoreClasses property thanks to @simPod Bug * 9355: Relax assertion to include null as possible outcome thanks to @derrabus Deprecation * 9327: Added runtime deprecation to UnitOfWork::commit() and clear() thanks to @derrabus * 9309: [GH-9277] deprecate php driver thanks to @beberlei * 9249: Deprecate Setup::registerAutoloadDirectory() thanks to @derrabus * 9211: Add deprecation hints to orm:convert-mapping command thanks to @derrabus * 9206: Add missing deprecations for YAML metadata mapping thanks to @derrabus * 9074: Deprecate ensureProductionSettings() thanks to @derrabus * 9072: Deprecate AbstractHydrator::hydrateRow() thanks to @derrabus New Feature * 9326: Add support for custom types with requireSQLConversion and ResultSetMappingBuilder::generateSelectClause() thanks to @kimhemsoe * 9304: Add support for PHP 8.1 enums. thanks to @beberlei * 9149: Detect enums and use type string (PHP 8.1 only) thanks to @Nek- * 9133: Adding a setup helper for attribute metadata config thanks to @judahnator Deprecation, Improvement * 9325: Use EntityManagerInterface in type declarations thanks to @derrabus * 9322: PSR-6 second level cache thanks to @derrabus Bug ,DQL * 9266: Improve compatibility with Doctrine DBAL 4 thanks to @morozov DQL, New Feature * 9242: Allow arithmetic expressions within IN operator thanks to @webda2l DQL, Improvement * 6476: Allow arithmetic expressions within IN operator thanks to @astepin ---- **Version 2.10.5** Bug * 9339: Fix field mapping typing thanks to @greg0ire * 9285: Fix XML export for change-tracking-policy thanks to @Fedik * 9244: Put actual value instead of index inside $originalEntityData thanks to @Feolius Improvement * 9318: Document PHPUnit mocks with intersection types thanks to @derrabus -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Remi Collet remi@remirepo.net - 2.11.0-1 - update to 2.11.0 --------------------------------------------------------------------------------
================================================================================ php-laminas-paginator-2.12.2-1.fc35 (FEDORA-2022-0fdf1a714b) Laminas Framework Paginator component -------------------------------------------------------------------------------- Update Information:
**Version 2.12.2** Bug * 38: fix #37: pass previous exception code instead of null to the second argument of the exception's constructor thanks to @franzose -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Remi Collet remi@remirepo.net - 2.12.2-1 - update to 2.12.2 --------------------------------------------------------------------------------
================================================================================ php-pecl-igbinary-3.2.7-1.fc35 (FEDORA-2022-e6d441c111) Replacement for the standard PHP serializer -------------------------------------------------------------------------------- Update Information:
**Version 3.2.7** * Update test expectations for php 8.2.0-dev. Add `#[AllowDynamicProperties]` Attribute to some tests to avoid notices. * In php 8.1+, make igbinary_unserialize check to see if an equivalent interned string already exists when unserializing object property names, array keys, and class names and use that instead of creating a brand new string. * Avoid debug build assertion failure for `HT_ASSERT_RC1` the same way as PHP's unserialize - this is a case where ostensibly there are no other references to the array being unserialized. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Remi Collet remi@remirepo.net - 3.2.7-1 - update to 3.2.7 --------------------------------------------------------------------------------
================================================================================ php-pecl-imagick-3.7.0-1.fc35 (FEDORA-2022-9e9aaa0e8f) Provides a wrapper to the ImageMagick library -------------------------------------------------------------------------------- Update Information:
**Version 3.7.0** Added: * Imagick::COMPOSITE_SALIENCY_BLEND ---- **Version 3.7.0RC1** Added: * function Imagick::deleteOption(string $option): bool {} * function Imagick::getBackgroundColor(): ImagickPixel {} * function Imagick::getImageArtifacts(string $pattern = "*"): array {} * function Imagick::getImageKurtosis(): array {} * function Imagick::getImageMean(): array {} * function Imagick::getImageRange(): array {} * function Imagick::getInterpolateMethod(): int {} * function Imagick::getOptions(string $pattern = "*"): array {} * function Imagick::getOrientation(): int {} * function Imagick::getResolution(): array {} * function Imagick::getType(): int {} * function Imagick::implodeImageWithMethod(float $radius, int $pixel_interpolate_method): bool {} * function Imagick::oilPaintImageWithSigma(float $radius, float $sigma) * function Imagick::polaroidWithTextAndMethod(ImagickDraw $settings, float $angle, string $caption, int $method): bool {} * function Imagick::polynomialImage(array $terms): bool {} * function Imagick::setDepth(int $depth): bool {} * function Imagick::setExtract(string $geometry): bool {} * function Imagick::setInterpolateMethod(int $method): bool{} * function Imagick::setOrientation(int $orientation): bool {} * function Imagick::spreadImageWithMethod(float $radius, int $interpolate_method): bool {} * function Imagick::swirlImageWithMethod(float $degrees, int $interpolate_method): bool {} * function Imagick::waveImageWithMethod(float $amplitude, float $length, int $interpolate_method): bool {} * Imagick::IMAGE_TYPE_BILEVEL * Imagick::IMAGE_TYPE_GRAYSCALE * Imagick::IMAGE_TYPE_GRAYSCALE_ALPHA * Imagick::IMAGE_TYPE_PALETTE * Imagick::IMAGE_TYPE_PALETTE_ALPHA * Imagick::IMAGE_TYPE_TRUE_COLOR * Imagick::IMAGE_TYPE_TRUE_COLOR_ALPHA * Imagick::IMAGE_TYPE_COLOR_SEPARATION * Imagick::IMAGE_TYPE_COLOR_SEPARATION_ALPHA * Imagick::IMAGE_TYPE_OPTIMIZE * Imagick::IMAGE_TYPE_PALETTE_BILEVEL_ALPHA * Imagick::COMPOSITE_SEAMLESS_BLEND - Changed: * Imagick::setImageArtifact can now take null for the string value. * Return type for Imagick::getImageArtifact is string|null instead of string. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Remi Collet remi@remirepo.net - 3.7.0-1 - update to 3.7.0 --------------------------------------------------------------------------------
================================================================================ pspg-5.5.3-1.fc35 (FEDORA-2022-0b16f54470) A unix pager optimized for psql -------------------------------------------------------------------------------- Update Information:
new upstream release, per release notes: https://github.com/okbob/pspg/releases/tag/5.5.3 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Pavel Raiskup praiskup@redhat.com - 5.5.3-1 - new upstream release, per release notes: https://github.com/okbob/pspg/releases/tag/5.5.3 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2032870 - pspg-5.5.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=2032870 --------------------------------------------------------------------------------
================================================================================ python-bugzilla-3.2.0-1.fc35 (FEDORA-2022-7cb959b9be) Python library for interacting with Bugzilla -------------------------------------------------------------------------------- Update Information:
* Update to version 3.2.0 * Use soon-to-be-required Authorization header for RH bugzilla * Remove cookie auth support -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Cole Robinson crobinso@redhat.com - 3.2.0-1 - Update to version 3.2.0 - Use soon-to-be-required Authorization header for RH bugzilla - Remove cookie auth support --------------------------------------------------------------------------------
================================================================================ python-editorconfig-0.12.3-4.fc35 (FEDORA-2022-4a092c9b18) EditorConfig File Locator and Interpreter for Python -------------------------------------------------------------------------------- Update Information:
Update to 0.12.3 with assorted bugfixes and improvements. Build PDF documentation and add a `-doc` subpackage. Add more license files, run the tests, and generally improve packaging. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Benjamin A. Beasley code@musicinmybrain.net 0.12.3-4 - Port to pyproject-rpm-macros * Wed Jan 12 2022 Benjamin A. Beasley code@musicinmybrain.net 0.12.3-3 - Fix building with doc_pdf disabled * Wed Jan 12 2022 Benjamin A. Beasley code@musicinmybrain.net - 0.12.3-1 - Update to 0.12.3 (close RHBZ#1876235) - Modernize spec file (still under ���old guidelines��� for now) - Add a -doc subpackage and build PDF - Add more license files - Run the tests -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1876235 - python-editorconfig-0.12.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=1876235 --------------------------------------------------------------------------------
================================================================================ python-journal-brief-1.1.8-1.fc35 (FEDORA-2022-56f4ec2e3c) Find new systemd journal entries since last run -------------------------------------------------------------------------------- Update Information:
Latest upstream version. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Tim Waugh twaugh@redhat.com - 1.1.8-1 - 1.1.8 (bug #2039454). --------------------------------------------------------------------------------
================================================================================ python-pyqt-feedback-flow-0.1.1-1.fc35 (FEDORA-2022-d4f18e8516) Show feedbacks in toast-like notifications -------------------------------------------------------------------------------- Update Information:
New package -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 11 2022 Iztok Fister Jr. <iztokf AT fedoraproject DOT org> - 0.1.1-1 - Initial package --------------------------------------------------------------------------------
================================================================================ python-testinfra-5.3.1-6.fc35 (FEDORA-2022-2379557a65) Unit testing for config-managed server state -------------------------------------------------------------------------------- Update Information:
Fix ansible dependency https://src.fedoraproject.org/rpms/python- testinfra/pull-request/4 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Chedi Toueiti chedi.toueiti@gmail.com 5.3.1-6 - spec file modernization * Wed Jan 12 2022 Maxwell G gotmax@e.email - 5.3.1-5 - Fix ansible dependency --------------------------------------------------------------------------------
================================================================================ python-varlink-31.0.0-1.fc35 (FEDORA-2022-27a4cd932b) Python implementation of Varlink -------------------------------------------------------------------------------- Update Information:
This version of `python-varlink` adapts to python 3.10, which is breaking Collections. -------------------------------------------------------------------------------- ChangeLog:
* Tue Dec 7 2021 Harald Hoyer harald@hoyer.xyz - 31.0.0-1 - Update to 31.0.0 --------------------------------------------------------------------------------
================================================================================ python-yfinance-0.1.69-1.fc35 (FEDORA-2022-944c3c5179) Yahoo! Finance market data downloader -------------------------------------------------------------------------------- Update Information:
Update to 0.1.69 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Major Hayden major@mhtx.net 0.1.69-1 - Update to 0.1.69 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2039887 - python-yfinance-0.1.69 is available https://bugzilla.redhat.com/show_bug.cgi?id=2039887 --------------------------------------------------------------------------------
================================================================================ python3.10-3.10.1-3.fc35 (FEDORA-2022-2303439072) Version 3.10 of the Python interpreter -------------------------------------------------------------------------------- Update Information:
Fix two regressions in Python 3.10.0/3.10.1 wrt subinterpreters. -------------------------------------------------------------------------------- ChangeLog:
* Mon Jan 10 2022 Miro Hron��ok mhroncok@redhat.com - 3.10.1-3 - Backport fixes for two Python 3.10.1 regressions - Fixes: rhbz#2030621 - Fixes: rhbz#2034962 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2030621 - Python 3.10 ignores rewritten __init__() in subinterpreters https://bugzilla.redhat.com/show_bug.cgi?id=2030621 [ 2 ] Bug #2034962 - Regression: Broken subinterpreters affects Kodi and YouTube addon and others https://bugzilla.redhat.com/show_bug.cgi?id=2034962 --------------------------------------------------------------------------------
================================================================================ qgnomeplatform-0.8.4-1.fc35 (FEDORA-2022-c185c2b974) Qt5 Platform Theme aimed to accommodate Gnome settings -------------------------------------------------------------------------------- Update Information:
QGnomePlatform 0.8.4 bugfix release. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Jan Grulich jgrulich@redhat.com - 0.8.4-1 - 0.8.4 --------------------------------------------------------------------------------
================================================================================ resalloc-aws-1.1-1.fc35 (FEDORA-2022-07a45b1cc9) Resource allocator scripts for AWS -------------------------------------------------------------------------------- Update Information:
Helper scripts for spawning AWS copr builders -------------------------------------------------------------------------------- ChangeLog:
* Fri Oct 15 2021 Pavel Raiskup praiskup@redhat.com 1.1-1 - spec: package-review fixes (praiskup@redhat.com) * Tue Oct 12 2021 Pavel Raiskup praiskup@redhat.com 1-1 - new package built with tito -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2013336 - Review Request: resalloc-aws - Resource allocator scripts for AWS https://bugzilla.redhat.com/show_bug.cgi?id=2013336 --------------------------------------------------------------------------------
================================================================================ rhino-1.7.14-1.fc35 (FEDORA-2022-de7e9e410d) Rhino -------------------------------------------------------------------------------- Update Information:
- Update to 1.7.14 (#2024769) - Change package url - Add new test deps: mvn(jakarta.xml.soap:jakarta.xml.soap-api) - Write new description and summary - Remove POM properties (it's not used anymore) - Add Automatic-Module-Name and Bundle-SymbolicName to manifest attributes - Add different license for each subpackage -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Didik Supriadi didiksupriadi41@fedoraproject.org - 1.7.14-1 - Update to 1.7.14 (#2024769) - Change package url - Add new test deps: mvn(jakarta.xml.soap:jakarta.xml.soap-api) - Write new description and summary - Remove POM properties (it's not used anymore) - Add Automatic-Module-Name and Bundle-SymbolicName to manifest attributes - Add different license for each subpackage * Mon Jan 3 2022 Didik Supriadi didiksupriadi41@fedoraproject.org - 1.7.13-10 - Ignore tests for now due to unstable builds (VM crashes, tests took much time, etc.) * Wed Dec 1 2021 Didik Supriadi didiksupriadi41@fedoraproject.org - 1.7.13-9 - Change BR: maven-local-openjdk11 * Sat Oct 16 2021 Didik Supriadi didiksupriadi41@fedoraproject.org - 1.7.13-8 - Don't build in ix86 cpu architecture - Increase test's forkCount to 5x Cores -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2024769 - rhino-1.7.14 is available https://bugzilla.redhat.com/show_bug.cgi?id=2024769 --------------------------------------------------------------------------------
================================================================================ rust-console-0.15.0-1.fc35 (FEDORA-2022-3b249d5030) Terminal and console abstraction for Rust -------------------------------------------------------------------------------- Update Information:
- Update mirrorlist-server to version 3.0.6. - Update hyperfine to version 1.12.0. - Update the indicatif crate to version 0.16.2. - Introduce a compat package for indicatif versions 0.15.x. - Update the console crate to version 0.15.0. - Introduce a compat package for console versions 0.14.x. - Update the ipnetwork crate to version 0.18.0. - Introduce a compat package for ipnetwork versions 0.17.x. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Fabio Valentini decathorpe@gmail.com 0.15.0-1 - Update to version 0.15.0; Fixes RHBZ#2014317 --------------------------------------------------------------------------------
================================================================================ rust-console0.14-0.14.1-1.fc35 (FEDORA-2022-3b249d5030) Terminal and console abstraction for Rust -------------------------------------------------------------------------------- Update Information:
- Update mirrorlist-server to version 3.0.6. - Update hyperfine to version 1.12.0. - Update the indicatif crate to version 0.16.2. - Introduce a compat package for indicatif versions 0.15.x. - Update the console crate to version 0.15.0. - Introduce a compat package for console versions 0.14.x. - Update the ipnetwork crate to version 0.18.0. - Introduce a compat package for ipnetwork versions 0.17.x. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Fabio Valentini decathorpe@gmail.com 0.14.1-1 - Initial import (console 0.14 compat package) --------------------------------------------------------------------------------
================================================================================ rust-hyperfine-1.12.0-1.fc35 (FEDORA-2022-3b249d5030) Command-line benchmarking tool -------------------------------------------------------------------------------- Update Information:
- Update mirrorlist-server to version 3.0.6. - Update hyperfine to version 1.12.0. - Update the indicatif crate to version 0.16.2. - Introduce a compat package for indicatif versions 0.15.x. - Update the console crate to version 0.15.0. - Introduce a compat package for console versions 0.14.x. - Update the ipnetwork crate to version 0.18.0. - Introduce a compat package for ipnetwork versions 0.17.x. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Fabio Valentini decathorpe@gmail.com 1.12.0-1 - Update to version 1.12.0; Fixes RHBZ#2014895 --------------------------------------------------------------------------------
================================================================================ rust-indicatif-0.16.2-1.fc35 (FEDORA-2022-3b249d5030) Progress bar and cli reporting library for Rust -------------------------------------------------------------------------------- Update Information:
- Update mirrorlist-server to version 3.0.6. - Update hyperfine to version 1.12.0. - Update the indicatif crate to version 0.16.2. - Introduce a compat package for indicatif versions 0.15.x. - Update the console crate to version 0.15.0. - Introduce a compat package for console versions 0.14.x. - Update the ipnetwork crate to version 0.18.0. - Introduce a compat package for ipnetwork versions 0.17.x. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Fabio Valentini decathorpe@gmail.com 0.16.2-1 - Update to version 0.16.2; Fixes RHBZ#1955499 --------------------------------------------------------------------------------
================================================================================ rust-indicatif0.15-0.15.0-1.fc35 (FEDORA-2022-3b249d5030) Progress bar and cli reporting library for Rust -------------------------------------------------------------------------------- Update Information:
- Update mirrorlist-server to version 3.0.6. - Update hyperfine to version 1.12.0. - Update the indicatif crate to version 0.16.2. - Introduce a compat package for indicatif versions 0.15.x. - Update the console crate to version 0.15.0. - Introduce a compat package for console versions 0.14.x. - Update the ipnetwork crate to version 0.18.0. - Introduce a compat package for ipnetwork versions 0.17.x. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Fabio Valentini decathorpe@gmail.com 0.15.0-1 - Initial import (indicatif 0.15 compat package) --------------------------------------------------------------------------------
================================================================================ rust-ipnetwork-0.18.0-1.fc35 (FEDORA-2022-3b249d5030) Library to work with IP CIDRs in Rust -------------------------------------------------------------------------------- Update Information:
- Update mirrorlist-server to version 3.0.6. - Update hyperfine to version 1.12.0. - Update the indicatif crate to version 0.16.2. - Introduce a compat package for indicatif versions 0.15.x. - Update the console crate to version 0.15.0. - Introduce a compat package for console versions 0.14.x. - Update the ipnetwork crate to version 0.18.0. - Introduce a compat package for ipnetwork versions 0.17.x. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Fabio Valentini decathorpe@gmail.com 0.18.0-1 - Update to version 0.18.0; Fixes RHBZ#1949309 --------------------------------------------------------------------------------
================================================================================ rust-ipnetwork0.17-0.17.0-1.fc35 (FEDORA-2022-3b249d5030) Library to work with IP CIDRs in Rust -------------------------------------------------------------------------------- Update Information:
- Update mirrorlist-server to version 3.0.6. - Update hyperfine to version 1.12.0. - Update the indicatif crate to version 0.16.2. - Introduce a compat package for indicatif versions 0.15.x. - Update the console crate to version 0.15.0. - Introduce a compat package for console versions 0.14.x. - Update the ipnetwork crate to version 0.18.0. - Introduce a compat package for ipnetwork versions 0.17.x. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Fabio Valentini decathorpe@gmail.com 0.17.0-1 - Initial import (ipnetwork 0.17 compat package) --------------------------------------------------------------------------------
================================================================================ rust-netlink-packet-generic-0.1.0-1.fc35 (FEDORA-2022-06d540be48) Generic netlink packet types -------------------------------------------------------------------------------- Update Information:
Initial import https://bugzilla.redhat.com/show_bug.cgi?id=2033035 -------------------------------------------------------------------------------- ChangeLog:
* Wed Dec 15 2021 Fernando Fernandez Mancera ffmancera@riseup.net 0.1.0-1 - Initial commit --------------------------------------------------------------------------------
================================================================================ rust-roxmltree-0.14.1-1.fc35 (FEDORA-2022-47e27fbe1d) Represent an XML as a read-only tree -------------------------------------------------------------------------------- Update Information:
Update roxmltree, and patch svg_metadata to use it ## 0.14.1 - 2021-04-01 - The std feature is enabled by default now. ## 0.14.0 - 2020-12-27 Added - An ability to reject XML with DTD in it. - The library is no_std + alloc now. - ParsingOptions - Document::parse_with_options - Error::DtdDetected -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Michel Alexandre Salim salimma@fedoraproject.org 0.14.1-1 - Update to 0.14.1 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1911029 - rust-roxmltree-0.14.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=1911029 --------------------------------------------------------------------------------
================================================================================ rust-svg_metadata-0.4.2-4.fc35 (FEDORA-2022-47e27fbe1d) Extracts metadata (like the viewBox, width, and height) from SVG graphics -------------------------------------------------------------------------------- Update Information:
Update roxmltree, and patch svg_metadata to use it ## 0.14.1 - 2021-04-01 - The std feature is enabled by default now. ## 0.14.0 - 2020-12-27 Added - An ability to reject XML with DTD in it. - The library is no_std + alloc now. - ParsingOptions - Document::parse_with_options - Error::DtdDetected -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Michel Alexandre Salim salimma@fedoraproject.org - 0.4.2-4 - Rebuilt for roxmltree 0.14.x - Opt in to rpmautospec -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1911029 - rust-roxmltree-0.14.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=1911029 --------------------------------------------------------------------------------
================================================================================ seamonkey-2.53.10.2-1.fc35 (FEDORA-2022-cdf4bd2f3e) Web browser, e-mail, news, IRC client, HTML editor -------------------------------------------------------------------------------- Update Information:
Update to 2.53.10.2 Backport some fixes to improve compatibility with modern sites -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Dmitry Butskoy Dmitry@Butskoy.name 2.53.10.2-1 - update to 2.53.10.2 - backport nullish coalescing support (mozbz 1566141 and others) - backport optional chaining support (mozbz 1566143 and others) * Sat Jan 8 2022 Miro Hron��ok mhroncok@redhat.com - 2.53.10.1-2 - Rebuilt for https://fedoraproject.org/wiki/Changes/LIBFFI34 --------------------------------------------------------------------------------
================================================================================ systemd-249.9-1.fc35 (FEDORA-2022-f38f479b8f) System and Service Manager -------------------------------------------------------------------------------- Update Information:
- Create /etc/resolv.conf symlink if nothing is present yet (#2032085) - Add missing requirements for libfido2 and libtss2 (#1975827) - Allow mprotect(2), arch_prctl(2) in @default seccomp filter, bpf(2) and /proc for systemd-udev (#2027627) - Various documentation fixes (#1926323) - Fix sysusers without /proc (#2036217) - Various fixes to condition handling (#1919538) - Bugfixes for the manager, systemd-networkd, systemd-journald and journalctl, systemd-analyze, systemd-resolved, systemd-homed, shell completions, systemd-detect-virt on MS Hyper-V, nss modules - Ordering of various units during early boot and shutdown is adjusted to fix some corner cases - Maximum numbers of files are bumped for /dev and /tmp - fstab-generator now ignores root-on-nfs/cifs/iscsi and live (#2037233) - CVE-2021-3997, #2024639: systemd-tmpfiles would exhaust the stack and crash during excessive recursion on a very deeply nested directory structure. - Some minor documentation fixes and a fix for journalctl - Make systemd-xdg-autostart-service ignore missing condition check binary (related to #2038750, but does not fix it) No need to log out or reboot. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Zbigniew J��drzejewski-Szmek zbyszek@in.waw.pl - 249.9-1 - Revert the patches for (#1956022), hopefully fixing (#2039888) - Some minor documentation fixes and a fix for journalctl - Make systemd-xdg-autostart-service ignore missing condition check binary (related to #2038750, but does not fix it) * Tue Jan 11 2022 Zbigniew J��drzejewski-Szmek zbyszek@in.waw.pl - 249.8-1 - Create /etc/resolv.conf symlink if nothing is present yet (#2032085) - Add missing requirements for libfido2 and libtss2 (#1975827) - Allow mprotect(2), arch_prctl(2) in @default seccomp filter, bpf(2) and /proc for systemd-udev (#2027627) - Various documentation fixes (#1926323) - Introduce ExitType= service setting (#1956022) - Fix sysusers without /proc (#2036217) - Various fixes to condition handling (#1919538) - Bugfixes for the manager, systemd-networkd, systemd-journald and journalctl, systemd-analyze, systemd-resolved, systemd-homed, shell completions, systemd-detect-virt on MS Hyper-V, nss modules - Ordering of various units during early boot and shutdown is adjusted to fix some corner cases - Maximum numbers of files are bumped for /dev and /tmp - fstab-generator now ignores root-on-nfs/cifs/iscsi and live (#2037233) - CVE-2021-3997, #2039383: systemd-tmpfiles would exhaust the stack and crash during excessive recursion on a very deeply nested directory structure. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1926323 - Wrong default for DNSSEC in resolved.conf (in man page) https://bugzilla.redhat.com/show_bug.cgi?id=1926323 [ 2 ] Bug #1975827 - Additional requirements for LUKS2 + pkcs11 https://bugzilla.redhat.com/show_bug.cgi?id=1975827 [ 3 ] Bug #2022816 - Symbolic link for /etc/resolv.conf is not created during kickstart Fedora 35 https://bugzilla.redhat.com/show_bug.cgi?id=2022816 [ 4 ] Bug #2027627 - systemd-udevd syscall filtering blocks access to bpf() syscall https://bugzilla.redhat.com/show_bug.cgi?id=2027627 [ 5 ] Bug #2032085 - Some variants are missing /etc/resolv.conf symlink (use systemd-resolved) https://bugzilla.redhat.com/show_bug.cgi?id=2032085 [ 6 ] Bug #2036217 - Bare metal install @"minimal install" gives "Failed to change ownership .. : function not implemented" https://bugzilla.redhat.com/show_bug.cgi?id=2036217 [ 7 ] Bug #2037233 - generated sysroot.mount in nfsroot case (initramfs) is wrong https://bugzilla.redhat.com/show_bug.cgi?id=2037233 [ 8 ] Bug #2039383 - CVE-2021-3997 systemd: Uncontrolled recursion in systemd-tmpfiles when removing files [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2039383 --------------------------------------------------------------------------------
================================================================================ tcpdump-4.99.1-3.fc35 (FEDORA-2022-aa80c50ebe) A network traffic monitoring tool -------------------------------------------------------------------------------- Update Information:
New version of tcpslice-1.5 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Michal Ruprich mruprich@redhat.com - 14:4.99.1-3 - New version of tcpslice-1.5 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2033818 - update tcpslice to 1.4 https://bugzilla.redhat.com/show_bug.cgi?id=2033818 --------------------------------------------------------------------------------
================================================================================ texlive-base-20210325-44.fc35 (FEDORA-2022-639b9d2b85) TeX formatting system -------------------------------------------------------------------------------- Update Information:
Update to newer version of arara with newer log4j. Severity is low because exploiting this locally would be challenging. -------------------------------------------------------------------------------- ChangeLog:
* Tue Jan 11 2022 Tom Callaway spot@fedoraproject.org - 9:20210325-44 - update arara to address log4j CVEs * Wed Dec 15 2021 Tom Callaway spot@fedoraproject.org - 9:20210325-43 - rework the font map trigger logic * Mon Aug 16 2021 Stephen Gallagher sgallagh@redhat.com - 9:20210325-41 - Rebuild for libpoppler soname bump -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2039492 - arara embeds a vulnerable version of log4j https://bugzilla.redhat.com/show_bug.cgi?id=2039492 --------------------------------------------------------------------------------
================================================================================ thermald-2.4.8-1.fc35 (FEDORA-2022-f434e1ec58) Thermal Management daemon -------------------------------------------------------------------------------- Update Information:
Update to 2.4.8 (#2038523) -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Benjamin Berg bberg@redhat.com - 2.4.8-1 - Update to 2.4.8 (#2038523) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2038523 - thermald-2.4.7 is available https://bugzilla.redhat.com/show_bug.cgi?id=2038523 --------------------------------------------------------------------------------
================================================================================ touchegg-2.0.13-1.fc35 (FEDORA-2022-b1272e9b4e) Multi-touch gesture recognizer -------------------------------------------------------------------------------- Update Information:
Update to version 2.0.13. Release notes: https://github.com/JoseExposito/touchegg/blob/2.0.13/CHANGELOG.md ---- Perform initial import. Close rhbz#2035944. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Fabio Valentini decathorpe@gmail.com - 2.0.13-1 - Update to version 2.0.13; Fixes RHBZ#2038561 * Sun Dec 26 2021 Maxwell G gotmax@e.email - 2.0.12-1 - Perform initial import. Close rhbz#2035944. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2035944 - Review Request: touchegg - Multi-touch gesture recognizer https://bugzilla.redhat.com/show_bug.cgi?id=2035944 [ 2 ] Bug #2038561 - touchegg-2.0.13 is available https://bugzilla.redhat.com/show_bug.cgi?id=2038561 --------------------------------------------------------------------------------
================================================================================ vim-8.2.4068-1.fc35 (FEDORA-2022-20e66c6698) The VIM editor -------------------------------------------------------------------------------- Update Information:
Security fix for CVE-2021-46059, CVE-2022-0158, CVE-2022-0156 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Zdenek Dohnal zdohnal@redhat.com - 2:8.2.4068-1 - patchlevel 4068 * Mon Jan 10 2022 Zdenek Dohnal zdohnal@redhat.com - 2:8.2.4051-1 - patchlevel 4051 * Fri Jan 7 2022 Malcolm Inglis miinglis@amazon.com - 2:8.2.4006-2 - add 'gui' build condition for vim-X11 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2039843 - CVE-2022-0156 vim: vulnerable to Use After Free https://bugzilla.redhat.com/show_bug.cgi?id=2039843 [ 2 ] Bug #2039846 - CVE-2022-0158 vim: vulnerable to Heap-based Buffer Overflow https://bugzilla.redhat.com/show_bug.cgi?id=2039846 [ 3 ] Bug #2039850 - CVE-2021-46059 vim: pointer dereference vulnerability via the vim_regexec_multi function at regexp.c may lead to DoS https://bugzilla.redhat.com/show_bug.cgi?id=2039850 --------------------------------------------------------------------------------
================================================================================ whois-5.5.11-1.fc35 (FEDORA-2022-8fb8c98b32) Improved WHOIS client -------------------------------------------------------------------------------- Update Information:
- new TLD *music* - removed 7 TLDs - added --no-recursion option -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Petr Men����k pemensik@redhat.com - 5.5.11-1 - Update to 5.5.11 (#2036766) -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1982247 - whois "-r" option FAILs to disable role recursion query, instead invokes RIPE db query, like BSD whois https://bugzilla.redhat.com/show_bug.cgi?id=1982247 [ 2 ] Bug #2036766 - whois-5.5.11 is available https://bugzilla.redhat.com/show_bug.cgi?id=2036766 --------------------------------------------------------------------------------
================================================================================ wireplumber-0.4.6-1.fc35 (FEDORA-2022-84a720b46a) A modular session/policy manager for PipeWire -------------------------------------------------------------------------------- Update Information:
wireplumber 0.4.6 -------------------------------------------------------------------------------- ChangeLog:
* Fri Jan 7 2022 Wim Taymans wim.taymans@redhat.com - 0.4.6-1 - wireplumber 0.4.6 --------------------------------------------------------------------------------
================================================================================ wireshark-3.6.1-1.fc35 (FEDORA-2022-30411cb3c4) Network traffic analyzer -------------------------------------------------------------------------------- Update Information:
New version 3.6.1, Security fix for CVE-2021-4181, CVE-2021-4182, CVE-2021-4183, CVE-2021-4184, CVE-2021-4185, CVE-2021-4186, CVE-2021-4190 -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Michal Ruprich mruprich@redhat.com - 1:3.6.1-1 - New version 3.6.1 - Fix for CVE-2021-4181, CVE-2021-4182, CVE-2021-4183, CVE-2021-4184, CVE-2021-4185, CVE-2021-4190 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2039000 - CVE-2021-4181 wireshark: Sysdig Event dissector crash https://bugzilla.redhat.com/show_bug.cgi?id=2039000 [ 2 ] Bug #2039005 - CVE-2021-4182 wireshark: RFC 7468 file parser infinite loop https://bugzilla.redhat.com/show_bug.cgi?id=2039005 [ 3 ] Bug #2039009 - CVE-2021-4184 wireshark: BitTorrent DHT dissector infinite loop https://bugzilla.redhat.com/show_bug.cgi?id=2039009 [ 4 ] Bug #2039011 - CVE-2021-4185 wireshark: RTMPT dissector infinite loop https://bugzilla.redhat.com/show_bug.cgi?id=2039011 [ 5 ] Bug #2039013 - CVE-2021-4186 wireshark: Gryphon dissector crash https://bugzilla.redhat.com/show_bug.cgi?id=2039013 [ 6 ] Bug #2039027 - CVE-2021-4183 wireshark: pcapng file parser crash https://bugzilla.redhat.com/show_bug.cgi?id=2039027 [ 7 ] Bug #2039029 - CVE-2021-4190 wireshark: Kafka dissector infinite loop https://bugzilla.redhat.com/show_bug.cgi?id=2039029 --------------------------------------------------------------------------------
================================================================================ zeitgeist-1.0.4-1.fc35 (FEDORA-2022-4d24d988b5) Framework providing Desktop activity awareness -------------------------------------------------------------------------------- Update Information:
Update to version 1.0.4. This is mostly bug-fixes and patches we had already applied on top of 1.0.3. Release notes: https://gitlab.freedesktop.org/zeitgeist/zeitgeist/-/blob/v1.0.4/NEWS -------------------------------------------------------------------------------- ChangeLog:
* Wed Jan 12 2022 Fabio Valentini decathorpe@gmail.com - 1.0.4-1 - Update to version 1.0.4. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #2039967 - zeitgeist-1.0.4 is available https://bugzilla.redhat.com/show_bug.cgi?id=2039967 --------------------------------------------------------------------------------