The following Fedora 30 Security updates need testing:
Age URL
6
https://bodhi.fedoraproject.org/updates/FEDORA-2020-eb7a965fcf
abcm2ps-8.14.7-2.fc30
5
https://bodhi.fedoraproject.org/updates/FEDORA-2020-9fa7f4e25c php-7.3.18-1.fc30
4
https://bodhi.fedoraproject.org/updates/FEDORA-2020-d98d2cbae1
clamav-0.102.3-1.fc30
4
https://bodhi.fedoraproject.org/updates/FEDORA-2020-847ad856ab
json-c-0.13.1-12.fc30
3
https://bodhi.fedoraproject.org/updates/FEDORA-2020-bc22f06aa3
openconnect-8.10-1.fc30
3
https://bodhi.fedoraproject.org/updates/FEDORA-2020-7fd99ffae0
thunderbird-68.8.0-2.fc30
3
https://bodhi.fedoraproject.org/updates/FEDORA-2020-cfc319e067
log4net-2.0.8-10.fc30
2
https://bodhi.fedoraproject.org/updates/FEDORA-2020-3864f32b3d
python-markdown2-2.3.9-1.fc30
2
https://bodhi.fedoraproject.org/updates/FEDORA-2020-c807d02b1f
netdata-1.22.1-3.fc30
0
https://bodhi.fedoraproject.org/updates/FEDORA-2020-2d381e061b
libEMF-1.0.12-1.fc30
The following Fedora 30 Critical Path updates have yet to be approved:
Age URL
13
https://bodhi.fedoraproject.org/updates/FEDORA-2020-28da9b3f28
elfutils-0.179-2.fc30
9
https://bodhi.fedoraproject.org/updates/FEDORA-2020-51ce773eb5
firefox-76.0.1-1.fc30
6
https://bodhi.fedoraproject.org/updates/FEDORA-2020-eca786a240 ethtool-5.6-1.fc30
6
https://bodhi.fedoraproject.org/updates/FEDORA-2020-f57290bd78
dash-0.5.10.2-4.fc30
5
https://bodhi.fedoraproject.org/updates/FEDORA-2020-ac6f73c6fc pcre2-10.35-1.fc30
5
https://bodhi.fedoraproject.org/updates/FEDORA-2020-7db677a922
selinux-policy-3.14.3-58.fc30
4
https://bodhi.fedoraproject.org/updates/FEDORA-2020-847ad856ab
json-c-0.13.1-12.fc30
3
https://bodhi.fedoraproject.org/updates/FEDORA-2020-7fd99ffae0
thunderbird-68.8.0-2.fc30
3
https://bodhi.fedoraproject.org/updates/FEDORA-2020-2320e85ab1
osinfo-db-20200515-1.fc30
The following builds have been pushed to Fedora 30 updates-testing
abrt-2.14.2-1.fc30
abrt-java-connector-1.1.5-1.fc30
dovecot-2.3.10.1-1.fc30
gnome-abrt-1.3.2-2.fc30
gsequencer-3.3.3-0.fc30
knot-resolver-5.1.1-1.fc30
libreport-2.13.1-3.fc30
perl-Alien-pkgconf-0.17-1.fc30
python39-3.9.0~b1-1.fc30
reportd-0.7.4-1.fc30
ruby-2.6.6-125.fc30
terminator-1.92-3.fc30
vim-go-1.23-1.fc30
Details about builds:
================================================================================
abrt-2.14.2-1.fc30 (FEDORA-2020-1757bac9a0)
Automatic bug detection and reporting tool
--------------------------------------------------------------------------------
Update Information:
* libreport - Support new "time" and "time_for_children" kernel
namespaces
- client-python: Accomodate for multiple debug directories - gui-wizard-gtk:
Wrap event log messages * abrt - a-a-save-package-data: Add R and tcl to
interpreted langs - plugins: xorg-utils: Loopify parsing - CLI
enhancements and fixes - autogen.sh: Handle NOCONFIGURE per the Build API
- plugins: journal: Fix ci_mapping being overwritten - plugins: abrt-
journal-core: Don���t assume anything about uid_t - lib,plugins: Accomodate
for multiple debug directories * abrt-java-connector - compatibility
with libreport-2.13 * reportd - compatibility with libreport-2.13
* gnome-abrt - compatibility with libreport-2.13
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 12 2020 Michal Fabik <mfabik(a)redhat.com> - 2.14.2-1
- Fix broken builds with --enable-authenticated-autoreporting
* Fri Apr 24 2020 Michal Fabik <mfabik(a)redhat.com> - 2.14.1-1
- tests: Add perl, php R and tcl to dont-blame-interpret
- a-a-save-package-data: Add R and tcl to interpreted langs
- a-a-save-package-data: Use regexps to match interpreters
- .travis.yml: Update secret
- plugins: xorg-utils: Loopify parsing
- Add namespace to libreport function and global names
- cli: Correct debug directories in config
- cli: Show defaults in help output
- cli: Fix verbosity option
- cli: Fix descriptions for --since and --until
- autogen.sh: Handle NOCONFIGURE per the Build API
- plugins: journal: Fix ci_mapping being overwritten
- plugins: abrt-journal-core: Don���t assume anything about uid_t
- lib,plugins: Accomodate for multiple debug directories
- dbus: Drop bogus dependency
- dbus: Drop abrt_problems2
- Drop libcap dependency
- Drop Travis config
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1827873 - reportd-0.7.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1827873
--------------------------------------------------------------------------------
================================================================================
abrt-java-connector-1.1.5-1.fc30 (FEDORA-2020-1757bac9a0)
JNI Agent library converting Java exceptions to ABRT problems
--------------------------------------------------------------------------------
Update Information:
* libreport - Support new "time" and "time_for_children" kernel
namespaces
- client-python: Accomodate for multiple debug directories - gui-wizard-gtk:
Wrap event log messages * abrt - a-a-save-package-data: Add R and tcl to
interpreted langs - plugins: xorg-utils: Loopify parsing - CLI
enhancements and fixes - autogen.sh: Handle NOCONFIGURE per the Build API
- plugins: journal: Fix ci_mapping being overwritten - plugins: abrt-
journal-core: Don���t assume anything about uid_t - lib,plugins: Accomodate
for multiple debug directories * abrt-java-connector - compatibility
with libreport-2.13 * reportd - compatibility with libreport-2.13
* gnome-abrt - compatibility with libreport-2.13
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 13 2020 Michal Fabik <mfabik(a)redhat.com> - 1.1.5-1
- new upstream release: 1.1.5
* Tue May 12 2020 Packit Service <user-cont-team+packit-service(a)redhat.com> -
1.1.5-1
- new upstream release: 1.1.5
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1827873 - reportd-0.7.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1827873
--------------------------------------------------------------------------------
================================================================================
dovecot-2.3.10.1-1.fc30 (FEDORA-2020-c16c248013)
Secure imap and pop3 server
--------------------------------------------------------------------------------
Update Information:
- CVE-2020-10957: lmtp/submission: A client can crash the server by sending a
NOOP command with an invalid string parameter. This occurs particularly for a
parameter that doesn't start with a double quote. This applies to all SMTP
services, including submission-login, which makes it possible to crash the
submission service without authentication. - CVE-2020-10958: lmtp/submission:
Sending many invalid or unknown commands can cause the server to access freed
memory, which can lead to a server crash. This happens when the server closes
the connection with a "421 Too many invalid commands" error. The bad command
limit depends on the service (lmtp or submission) and varies between 10 to
20 bad commands. - CVE-2020-10967: lmtp/submission: Issuing the RCPT command
with an address that has the empty quoted string as local-part causes the
lmtp service to crash.
--------------------------------------------------------------------------------
ChangeLog:
* Mon May 18 2020 Michal Hlavinka <mhlavink(a)redhat.com> - 1:2.3.10.1-1
- dovecot updated to 2.3.10.1
- fixes CVE-2020-10967, CVE-2020-10958, CVE-2020-10957
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1834317 - CVE-2020-10957 dovecot: malformed NOOP commands leads to DoS
https://bugzilla.redhat.com/show_bug.cgi?id=1834317
[ 2 ] Bug #1834323 - CVE-2020-10958 dovecot: command followed by sufficient number of
newlines leads to use-after-free
https://bugzilla.redhat.com/show_bug.cgi?id=1834323
[ 3 ] Bug #1834326 - CVE-2020-10967 dovecot: sending mail with empty quoted localpart
leads to DoS
https://bugzilla.redhat.com/show_bug.cgi?id=1834326
--------------------------------------------------------------------------------
================================================================================
gnome-abrt-1.3.2-2.fc30 (FEDORA-2020-1757bac9a0)
A utility for viewing problems that have occurred with the system
--------------------------------------------------------------------------------
Update Information:
* libreport - Support new "time" and "time_for_children" kernel
namespaces
- client-python: Accomodate for multiple debug directories - gui-wizard-gtk:
Wrap event log messages * abrt - a-a-save-package-data: Add R and tcl to
interpreted langs - plugins: xorg-utils: Loopify parsing - CLI
enhancements and fixes - autogen.sh: Handle NOCONFIGURE per the Build API
- plugins: journal: Fix ci_mapping being overwritten - plugins: abrt-
journal-core: Don���t assume anything about uid_t - lib,plugins: Accomodate
for multiple debug directories * abrt-java-connector - compatibility
with libreport-2.13 * reportd - compatibility with libreport-2.13
* gnome-abrt - compatibility with libreport-2.13
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 19 2020 Ernestas Kulik <ekulik(a)redhat.com> - 1.3.2-2
- Add missing python3-beautifulsoup4 dependency
- Add patch for
https://bugzilla.redhat.com/show_bug.cgi?id=1836614
* Wed May 13 2020 Packit Service <user-cont-team+packit-service(a)redhat.com> -
1.3.2-1
- new upstream release: 1.3.2
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1827873 - reportd-0.7.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1827873
--------------------------------------------------------------------------------
================================================================================
gsequencer-3.3.3-0.fc30 (FEDORA-2020-a752ad4764)
Audio processing engine
--------------------------------------------------------------------------------
Update Information:
updated Source to point to new minor version directory
--------------------------------------------------------------------------------
ChangeLog:
* Mon May 18 2020 Jo��l Kr��hemann <jkraehemann(a)gmail.com> 3.3.1-0
- updated Source to point to new minor version directory
--------------------------------------------------------------------------------
================================================================================
knot-resolver-5.1.1-1.fc30 (FEDORA-2020-8a651e7466)
Caching full DNS Resolver
--------------------------------------------------------------------------------
Update Information:
- fixes CVE-2020-12667 ---- new upstream release
https://www.knot-
resolver.cz/2020-04-29-knot-resolver-5.1.0.html ---- - bugfix for 5.0.0
release --- - see
https://knot-
resolver.readthedocs.io/en/stable/upgrading.html - version 5.0 no longer support
network interface configuration via systemd sockets and manual upgrade of
configuration file is required for upgrades
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 19 2020 Tomas Krizek <tomas.krizek(a)nic.cz> - 5.1.1-1
- update to upstream version 5.1.1 (fixes CVE-2020-12667)
* Wed Apr 29 2020 Tomas Krizek <tomas.krizek(a)nic.cz> - 5.1.0-1
- update to upstream version 5.1.0
- make spec compatible with EPEL 8 (rhbz#1783252)
- support documentation build with Sphinx v3.0.0+ (rhbz#1823534)
* Thu Apr 2 2020 Tomas Krizek <tomas.krizek(a)nic.cz> - 5.0.1-2
- add patch to fix strict aliasing (!971) until next release
* Wed Feb 5 2020 Tomas Krizek <tomas.krizek(a)nic.cz> - 5.0.1-1
- update to upstream version 5.0.1
- ensure kres-cache-gc.service is restarted on upgrade
* Wed Jan 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 5.0.0-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Mon Jan 27 2020 Tomas Krizek <tomas.krizek(a)nic.cz> - 5.0.0-1
- update to new upstream version 5.0.0
- removed systemd socket files (no longer supported)
- add upgrade scriptlets for 5.x
- remove lua-sec, lua-socket, lua-filesystem dependencies
- create tmpfiles dirs with macro
--------------------------------------------------------------------------------
================================================================================
libreport-2.13.1-3.fc30 (FEDORA-2020-1757bac9a0)
Generic library for reporting various problems
--------------------------------------------------------------------------------
Update Information:
* libreport - Support new "time" and "time_for_children" kernel
namespaces
- client-python: Accomodate for multiple debug directories - gui-wizard-gtk:
Wrap event log messages * abrt - a-a-save-package-data: Add R and tcl to
interpreted langs - plugins: xorg-utils: Loopify parsing - CLI
enhancements and fixes - autogen.sh: Handle NOCONFIGURE per the Build API
- plugins: journal: Fix ci_mapping being overwritten - plugins: abrt-
journal-core: Don���t assume anything about uid_t - lib,plugins: Accomodate
for multiple debug directories * abrt-java-connector - compatibility
with libreport-2.13 * reportd - compatibility with libreport-2.13
* gnome-abrt - compatibility with libreport-2.13
--------------------------------------------------------------------------------
ChangeLog:
* Mon May 11 2020 Michal Fabik <mfabik(a)redhat.com> 2.13.1-1
- Fix broken abrt-vmcore.service due to bad namespacing
* Fri Apr 24 2020 Michal Fabik <mfabik(a)redhat.com> 2.13.0-2
- Support new "time" and "time_for_children" kernel namespaces
- Remove preprocessor namespacing in favor of function name prefixes
- client-python: Accomodate for multiple debug directories
- gui-wizard-gtk: Wrap event log messages
- lib: Drop D-Bus code
- plugins: reporter-rhtsupport: Drop unused debugging code
- Update translations
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1827873 - reportd-0.7.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1827873
--------------------------------------------------------------------------------
================================================================================
perl-Alien-pkgconf-0.17-1.fc30 (FEDORA-2020-f2d78505d8)
Discover pkgconf and libpkgconf
--------------------------------------------------------------------------------
Update Information:
This release adds support for Alpine Linux distribution. We only deliver it to
provide an up-to-date version string.
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 19 2020 Petr Pisar <ppisar(a)redhat.com> - 0.17-1
- 0.17 bump
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1837338 - perl-Alien-pkgconf-0.17 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1837338
--------------------------------------------------------------------------------
================================================================================
python39-3.9.0~b1-1.fc30 (FEDORA-2020-b6421f6222)
Version 3.9 of the Python interpreter
--------------------------------------------------------------------------------
Update Information:
## Python 3.9.0b1 ### This is a beta preview of Python 3.9 Python 3.9 is still
in development. This release, 3.9.0b1, is the first of four planned beta release
previews. Beta release previews are intended to give the wider community the
opportunity to test new features and bug fixes and to prepare their projects to
support the new feature release. ### Call to action We strongly encourage
maintainers of third-party Python projects to **test with 3.9** during the beta
phase and report issues found to [the Python bug
tracker](https://bugs.python.org/) as soon as possible. While the release is
planned to be feature complete entering the beta phase, it is possible that
features may be modified or, in rare cases, deleted up until the start of the
release candidate phase (2020-08-10). Our goal is have no ABI changes after beta
4 and as few code changes as possible after 3.9.0rc1, the first release
candidate. To achieve that, it will be extremely important to get as much
exposure for 3.9 as possible during the beta phase. Please keep in mind that
this is a preview release and its use is **not** recommended for production
environments.
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 19 2020 Miro Hron��ok <mhroncok(a)redhat.com> - 3.9.0~b1-1
- Update to Python 3.9.0b1
--------------------------------------------------------------------------------
================================================================================
reportd-0.7.4-1.fc30 (FEDORA-2020-1757bac9a0)
Service reporting org.freedesktop.Problems2 entries
--------------------------------------------------------------------------------
Update Information:
* libreport - Support new "time" and "time_for_children" kernel
namespaces
- client-python: Accomodate for multiple debug directories - gui-wizard-gtk:
Wrap event log messages * abrt - a-a-save-package-data: Add R and tcl to
interpreted langs - plugins: xorg-utils: Loopify parsing - CLI
enhancements and fixes - autogen.sh: Handle NOCONFIGURE per the Build API
- plugins: journal: Fix ci_mapping being overwritten - plugins: abrt-
journal-core: Don���t assume anything about uid_t - lib,plugins: Accomodate
for multiple debug directories * abrt-java-connector - compatibility
with libreport-2.13 * reportd - compatibility with libreport-2.13
* gnome-abrt - compatibility with libreport-2.13
--------------------------------------------------------------------------------
ChangeLog:
* Sat Apr 25 2020 Ernestas Kulik <ekulik(a)redhat.com> - 0.7.4-1
- new upstream release: 0.7.4
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1827873 - reportd-0.7.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1827873
--------------------------------------------------------------------------------
================================================================================
ruby-2.6.6-125.fc30 (FEDORA-2020-e783b43145)
An interpreter of object-oriented scripting language
--------------------------------------------------------------------------------
Update Information:
Update to Ruby 2.6.6. Also fixes CVE-2020-10933 and CVE-2020-10663.
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 7 2020 Pavel Valena <pvalena(a)redhat.com> - 2.6.6-125
- Upgrade to Ruby 2.6.6.
Resolves: rhbz#1833293
Resolves: rhbz#1827505
--------------------------------------------------------------------------------
================================================================================
terminator-1.92-3.fc30 (FEDORA-2020-9d200336b7)
Store and run multiple GNOME terminals in one window
--------------------------------------------------------------------------------
Update Information:
This update for Terminator includes a fix for middle clicking which was not
possible under some circumstances.
--------------------------------------------------------------------------------
ChangeLog:
* Mon May 18 2020 Dominic Hopf <dmaphy(a)fedoraproject.org> - 1.92-3
- Backport upstream patch for middle click issues on Wayland (RHBZ#1836812)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1836812 - Middle click does not paste selected text
https://bugzilla.redhat.com/show_bug.cgi?id=1836812
--------------------------------------------------------------------------------
================================================================================
vim-go-1.23-1.fc30 (FEDORA-2020-32b7e5eb33)
Go development plugin for Vim
--------------------------------------------------------------------------------
Update Information:
[Version 1.23
changelog](https://github.com/fatih/vim-
go/blob/v1.23/CHANGELOG.md#v123---may-16-2020)
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 19 2020 Nikola Forr�� <nforro(a)redhat.com> - 1.23-1
- Update to 1.23
Resolves: #1837081
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1837081 - vim-go-1.23 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1837081
--------------------------------------------------------------------------------