The following Fedora 29 Security updates need testing:
Age URL
227
https://bodhi.fedoraproject.org/updates/FEDORA-2019-fa5843e0e1
asterisk-16.2.1-1.fc29
214
https://bodhi.fedoraproject.org/updates/FEDORA-2019-c84f291592
WALinuxAgent-2.2.38-1.fc29
209
https://bodhi.fedoraproject.org/updates/FEDORA-2019-7528388823
chicken-5.0.0-2.fc29
168
https://bodhi.fedoraproject.org/updates/FEDORA-2019-9839aded3f
python-gnupg-0.4.4-1.fc29
164
https://bodhi.fedoraproject.org/updates/FEDORA-2019-35cb5a4785
kubernetes-1.13.5-1.fc29
102
https://bodhi.fedoraproject.org/updates/FEDORA-2019-32f7cd9b66
dosbox-0.74.3-2.fc29
6
https://bodhi.fedoraproject.org/updates/FEDORA-2019-8fcf21a816
python-ecdsa-0.13.3-1.fc29
6
https://bodhi.fedoraproject.org/updates/FEDORA-2019-b1586544bb
libnbd-1.0.3-1.fc29
3
https://bodhi.fedoraproject.org/updates/FEDORA-2019-65c33bdc2a
radare2-3.9.0-3.fc29.1
3
https://bodhi.fedoraproject.org/updates/FEDORA-2019-7ab0c9faf9
firefox-69.0.3-1.fc29
3
https://bodhi.fedoraproject.org/updates/FEDORA-2019-b92ce3144a
libpcap-1.9.1-1.fc29
2
https://bodhi.fedoraproject.org/updates/FEDORA-2019-d49c8ec32b scapy-2.4.3-2.fc29
The following Fedora 29 Critical Path updates have yet to be approved:
Age URL
140
https://bodhi.fedoraproject.org/updates/FEDORA-2019-06a2d1c7fb
anaconda-29.24.7-3.fc29
138
https://bodhi.fedoraproject.org/updates/FEDORA-2019-4cefd3161a
nfs-utils-2.3.3-4.rc2.fc29
111
https://bodhi.fedoraproject.org/updates/FEDORA-2019-583d9d5a56
mutter-3.30.2-3.fc29
97
https://bodhi.fedoraproject.org/updates/FEDORA-2019-6f13c38d0d
python-urllib3-1.24.3-2.fc29
95
https://bodhi.fedoraproject.org/updates/FEDORA-2019-62e681b68b ipset-7.2-1.fc29
27
https://bodhi.fedoraproject.org/updates/FEDORA-2019-3bdedf56fb sssd-2.2.2-1.fc29
13
https://bodhi.fedoraproject.org/updates/FEDORA-2019-f6802f80f7
hwdata-0.328-1.fc29
11
https://bodhi.fedoraproject.org/updates/FEDORA-2019-4bf63b7592
ibus-1.5.19-18.fc29
11
https://bodhi.fedoraproject.org/updates/FEDORA-2019-5468235704
openssl-1.1.1d-2.fc29
5
https://bodhi.fedoraproject.org/updates/FEDORA-2019-b54a9b5130 rsync-3.1.3-8.fc29
5
https://bodhi.fedoraproject.org/updates/FEDORA-2019-c15ad33a2a
glusterfs-5.10-1.fc29
3
https://bodhi.fedoraproject.org/updates/FEDORA-2019-0fc03df5c7 satyr-0.29-1.fc29
3
https://bodhi.fedoraproject.org/updates/FEDORA-2019-b92ce3144a
libpcap-1.9.1-1.fc29
3
https://bodhi.fedoraproject.org/updates/FEDORA-2019-7ab0c9faf9
firefox-69.0.3-1.fc29
1
https://bodhi.fedoraproject.org/updates/FEDORA-2019-fc68cd365a
python-rpm-macros-3-38.fc29
The following builds have been pushed to Fedora 29 updates-testing
GoldenCheetah-3.5-0.13.rc1gitd01fdf5.fc29
appstream-data-29-16.fc29
cobbler-2.8.5-0.3.fc29
cros-guest-tools-1.0-0.18.20191015gita93ea04.fc29
dnf-plugins-extras-4.0.7-1.fc29
group-service-1.2.0-1.fc29
kernel-5.3.6-100.fc29
kernel-headers-5.3.6-100.fc29
kernel-tools-5.3.6-100.fc29
libreoffice-6.1.6.3-6.fc29
mod_auth_openidc-2.4.0.3-1.fc29
octave-brain2mesh-0.5-1.fc29
perl-Test-TCP-2.22-1.fc29
python-colcon-package-information-0.2.4-1.fc29
sudo-1.8.28-1.fc29
vdr-tvguide-1.2.13-1.fc29
vte291-0.54.5-1.fc29
wordpress-5.2.4-1.fc29
yara-3.11.0-1.fc29
Details about builds:
================================================================================
GoldenCheetah-3.5-0.13.rc1gitd01fdf5.fc29 (FEDORA-2019-a4e3d38420)
Cycling Performance Software
--------------------------------------------------------------------------------
Update Information:
Update to 3.5-0.13.rc1gitd01fdf5
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 14 2019 Martin Gansser <martinkg(a)fedoraproject.org> -
3.5-0.13.rc1gitd01fdf5
- Update to 3.5-0.13.rc1gitd01fdf5
--------------------------------------------------------------------------------
================================================================================
appstream-data-29-16.fc29 (FEDORA-2019-a122d9c41c)
Fedora AppStream metadata
--------------------------------------------------------------------------------
Update Information:
New metadata version
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 14 2019 Kalev Lember <klember(a)redhat.com> - 29-16
- New metadata version
--------------------------------------------------------------------------------
================================================================================
cobbler-2.8.5-0.3.fc29 (FEDORA-2019-d251de1fb6)
Boot server configurator
--------------------------------------------------------------------------------
Update Information:
Make cobbler-web require python2-ipaddress ---- Require /sbin/service
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 14 2019 Orion Poplawski <orion(a)nwra.com> - 2.8.5-0.3
- Require python2-ipaddress
* Thu Oct 10 2019 Orion Poplawski <orion(a)nwra.com> - 2.8.5-0.2
- Require /sbin/service
--------------------------------------------------------------------------------
================================================================================
cros-guest-tools-1.0-0.18.20191015gita93ea04.fc29 (FEDORA-2019-5fb61faa1d)
Chromium OS integration meta package
--------------------------------------------------------------------------------
Update Information:
Update to latest master release
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 15 2019 Jason Montleon jmontleo(a)redhat.com 1.0-0.18.20191015gita93ea04
- Update to upstream master
- Removed cros-adapta theme for CentOS 8 due to missing dependencies
--------------------------------------------------------------------------------
================================================================================
dnf-plugins-extras-4.0.7-1.fc29 (FEDORA-2019-df11921f9a)
Extras Plugins for DNF
--------------------------------------------------------------------------------
Update Information:
dnf-plugins-extras - Add showvars plugin for showing what DNF vars are set for
the dnf runtime - [system-upgrade] Use --system-upgrade plymouth mode
(RhBug:1681584) - [system-upgrade] Fix traceback caused by setting gpgcheck
options (RhBug:1751103,1746346) - Fix kickstart plugin (RhBug:1649093) -
[system-upgrade] Ensure identical transaction in download and update steps
(RhBug:1758588) - [system-upgrade] Provide distro specific url for help with
system-upgrade
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 15 2019 Ales Matej <amatej(a)redhat.com> - 4.0.7-1
- Add showvars plugin for showing what DNF vars are set for the dnf runtime
- [system-upgrade] Use --system-upgrade plymouth mode (RhBug:1681584)
- [system-upgrade] Fix traceback caused by setting gpgcheck options
(RhBug:1751103,1746346)
- Fix kickstart plugin (RhBug:1649093)
- [system-upgrade] Ensure identical transaction in download and update steps
(RhBug:1758588)
- [system-upgrade] Provide distro specific url for help with system-upgrade
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1649093 - "dnf kickstart mykickstart.ks" crashes with
AttributeError: 'BaseCli' object has no attribute 'install_grouplist'
https://bugzilla.redhat.com/show_bug.cgi?id=1649093
--------------------------------------------------------------------------------
================================================================================
group-service-1.2.0-1.fc29 (FEDORA-2019-21a6e4276f)
Dbus Group management CLI tool
--------------------------------------------------------------------------------
Update Information:
- update to 1.2.0
--------------------------------------------------------------------------------
ChangeLog:
* Sun Oct 13 2019 Wolfgang Ulbrich <fedora(a)raveit.de> - 1.2.0-1
- update to 1.2.0
--------------------------------------------------------------------------------
================================================================================
kernel-5.3.6-100.fc29 (FEDORA-2019-41e28660ae)
The Linux kernel
--------------------------------------------------------------------------------
Update Information:
The 5.3.6 update contains a number of important fixes across the tree This is a
rebase to the 5.3 series ---- The 5.2.20 stable kernel update contains a
number of important fixes across the tree.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 14 2019 Laura Abbott <labbott(a)redhat.com> - 5.3.6-100
- Linux v5.3.6 Rebase
- Fix disappearing cursor issue (rhbz 1738614)
* Tue Oct 8 2019 Justin M. Forbes <jforbes(a)fedoraproject.org> - 5.2.20-100
- Linux v5.2.20
* Wed Oct 2 2019 Justin M. Forbes <jforbes(a)fedoraproject.org>
- Fix CVE-2019-17052 CVE-2019-17053 CVE-2019-17054 CVE-2019-17055 CVE-2019-17056
(rhbz 1758239 1758240 1758242 1758243 1758245 1758246 1758248 1758249 1758256 1758257)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1758256 - CVE-2019-17056 kernel: privilege escalation in llcp_sock_create in
net/nfc/llcp_sock.c in the AF_NFC network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758256
[ 2 ] Bug #1758248 - CVE-2019-17055 kernel: privilege escalation in base_sock_create in
drivers/isdn/mISDN/socket.c in the AF_ISDN network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758248
[ 3 ] Bug #1758245 - CVE-2019-17054 kernel: privilege escalation in atalk_create in
net/appletalk/ddp.c in the AF_APPLETALK network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758245
[ 4 ] Bug #1758242 - CVE-2019-17053 kernel: privilege escalation in ieee802154_create in
net/ieee802154/socket.c in the AF_IEEE802154 network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758242
[ 5 ] Bug #1758239 - CVE-2019-17052 kernel: privilege escalation in ax25_create in
net/ax25/af_ax25.c in the AF_AX25 network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758239
--------------------------------------------------------------------------------
================================================================================
kernel-headers-5.3.6-100.fc29 (FEDORA-2019-41e28660ae)
Header files for the Linux kernel for use by glibc
--------------------------------------------------------------------------------
Update Information:
The 5.3.6 update contains a number of important fixes across the tree This is a
rebase to the 5.3 series ---- The 5.2.20 stable kernel update contains a
number of important fixes across the tree.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 14 2019 Laura Abbott <labbott(a)redhat.com> - 5.3.6-100
- Linux v5.3.6
* Tue Oct 8 2019 Justin M. Forbes <jforbes(a)fedoraproject.org> - 5.2.20-100
- Linux v5.2.20
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1758256 - CVE-2019-17056 kernel: privilege escalation in llcp_sock_create in
net/nfc/llcp_sock.c in the AF_NFC network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758256
[ 2 ] Bug #1758248 - CVE-2019-17055 kernel: privilege escalation in base_sock_create in
drivers/isdn/mISDN/socket.c in the AF_ISDN network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758248
[ 3 ] Bug #1758245 - CVE-2019-17054 kernel: privilege escalation in atalk_create in
net/appletalk/ddp.c in the AF_APPLETALK network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758245
[ 4 ] Bug #1758242 - CVE-2019-17053 kernel: privilege escalation in ieee802154_create in
net/ieee802154/socket.c in the AF_IEEE802154 network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758242
[ 5 ] Bug #1758239 - CVE-2019-17052 kernel: privilege escalation in ax25_create in
net/ax25/af_ax25.c in the AF_AX25 network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758239
--------------------------------------------------------------------------------
================================================================================
kernel-tools-5.3.6-100.fc29 (FEDORA-2019-41e28660ae)
Assortment of tools for the Linux kernel
--------------------------------------------------------------------------------
Update Information:
The 5.3.6 update contains a number of important fixes across the tree This is a
rebase to the 5.3 series ---- The 5.2.20 stable kernel update contains a
number of important fixes across the tree.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 14 2019 Laura Abbott <labbott(a)redhat.com> - 5.3.6-100
- Linux v5.3.6 rebase
* Tue Oct 8 2019 Justin M. Forbes <jforbes(a)fedoraproject.org> - 5.2.20-100
- Linux v5.2.20
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1758256 - CVE-2019-17056 kernel: privilege escalation in llcp_sock_create in
net/nfc/llcp_sock.c in the AF_NFC network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758256
[ 2 ] Bug #1758248 - CVE-2019-17055 kernel: privilege escalation in base_sock_create in
drivers/isdn/mISDN/socket.c in the AF_ISDN network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758248
[ 3 ] Bug #1758245 - CVE-2019-17054 kernel: privilege escalation in atalk_create in
net/appletalk/ddp.c in the AF_APPLETALK network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758245
[ 4 ] Bug #1758242 - CVE-2019-17053 kernel: privilege escalation in ieee802154_create in
net/ieee802154/socket.c in the AF_IEEE802154 network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758242
[ 5 ] Bug #1758239 - CVE-2019-17052 kernel: privilege escalation in ax25_create in
net/ax25/af_ax25.c in the AF_AX25 network module
https://bugzilla.redhat.com/show_bug.cgi?id=1758239
--------------------------------------------------------------------------------
================================================================================
libreoffice-6.1.6.3-6.fc29 (FEDORA-2019-3e896d892b)
Free Software Productivity Suite
--------------------------------------------------------------------------------
Update Information:
- tdf#124729 fix opengl related crash
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 14 2019 Caol��n McNamara <caolanm(a)redhat.com> - 1:6.1.6.3-6
- tdf#124729 check error status before continuing
--------------------------------------------------------------------------------
================================================================================
mod_auth_openidc-2.4.0.3-1.fc29 (FEDORA-2019-23638d42f3)
OpenID Connect auth module for Apache HTTP Server
--------------------------------------------------------------------------------
Update Information:
Upgrade to latest upstream which fixes some CVEs
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 15 2019 Jakub Hrozek <jhrozek(a)redhat.com> - 2.4.0.3-1
- update to the latest upstream
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1425356 - CVE-2017-6059 CVE-2017-6062 CVE-2017-6413 mod_auth_openidc: various
flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1425356
[ 2 ] Bug #1760614 - CVE-2019-14857 mod_auth_openidc: Open redirect in logout url when
using URLs with backslashes [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1760614
[ 3 ] Bug #1757999 - mod_auth_openidc-2.4.0.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1757999
--------------------------------------------------------------------------------
================================================================================
octave-brain2mesh-0.5-1.fc29 (FEDORA-2019-78e2d9df3e)
A fully automated high-quality brain tetrahedral mesh generation toolbox
--------------------------------------------------------------------------------
Update Information:
Initial package
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1761011 - Review Request: octave-brain2mesh - A fully automated high-quality
brain tetrahedral mesh generation toolbox
https://bugzilla.redhat.com/show_bug.cgi?id=1761011
--------------------------------------------------------------------------------
================================================================================
perl-Test-TCP-2.22-1.fc29 (FEDORA-2019-07ab40db53)
Testing TCP program
--------------------------------------------------------------------------------
Update Information:
A very minor upstream update
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 15 2019 Ralf Cors��pius <corsepiu(a)fedoraproject.org> - 2.22-1
- Update to 2.22.
- Reflect Source0-URL having changed.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1761523 - Upgrade perl-Test-TCP to 2.22
https://bugzilla.redhat.com/show_bug.cgi?id=1761523
--------------------------------------------------------------------------------
================================================================================
python-colcon-package-information-0.2.4-1.fc29 (FEDORA-2019-21e6a58a36)
Extension for colcon to output package information
--------------------------------------------------------------------------------
Update Information:
Update to latest `colcon-package-information` release
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 14 2019 Scott K Logan <logans(a)cottsay.net> - 0.2.4-1
- Update to 0.2.4
--------------------------------------------------------------------------------
================================================================================
sudo-1.8.28-1.fc29 (FEDORA-2019-72755db9c7)
Allows restricted root access for specified users
--------------------------------------------------------------------------------
Update Information:
* Rebase to 1.8.28 * Fixed CVE-2019-14287
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 15 2019 Radovan Sroka <rsroka(a)redhat.com> - 1.8.28-1
- rebase to 1.8.28
Resolves: rhbz#1761533
- fixes CVE-2019-14287
- Privilege escalation via 'Runas' specification with 'ALL' keyword
Resolves: rhbz#1761584
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1761533 - sudo-1.8.28 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1761533
[ 2 ] Bug #1761584 - CVE-2019-14287 sudo: Privilege escalation via 'Runas'
specification with 'ALL' keyword [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1761584
--------------------------------------------------------------------------------
================================================================================
vdr-tvguide-1.2.13-1.fc29 (FEDORA-2019-8fb6795760)
TvGuide is a highly customizable 2D EPG viewer plugin
--------------------------------------------------------------------------------
Update Information:
Update to 1.2.13-1 ---- Update to vdr-tvguide-1.2.12-1
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 15 2019 Martin Gansser <martinkg(a)fedoraproject.org> - 1.2.13-1
- Update to 1.2.13
* Mon Oct 14 2019 Martin Gansser <martinkg(a)fedoraproject.org> - 1.2.12-1
- Update to 1.2.12
--------------------------------------------------------------------------------
================================================================================
vte291-0.54.5-1.fc29 (FEDORA-2019-4fb3314f2e)
Terminal emulator library
--------------------------------------------------------------------------------
Update Information:
vte 0.54.5 release. For details, see
https://mail.gnome.org/archives/ftp-
release-list/2019-October/msg00075.html
--------------------------------------------------------------------------------
ChangeLog:
* Mon Oct 14 2019 Kalev Lember <klember(a)redhat.com> - 0.54.5-1
- Update to 0.54.5
--------------------------------------------------------------------------------
================================================================================
wordpress-5.2.4-1.fc29 (FEDORA-2019-e70f89fa34)
Blog tool and publishing platform
--------------------------------------------------------------------------------
Update Information:
**WordPress 5.2.4 Security Release** WordPress versions 5.2.3 and earlier are
affected by these bugs, which are fixed in version 5.2.4. **Security Updates**
* Props to Evan Ricafort for finding an issue where stored XSS (cross-site
scripting) could be added via the Customizer. * Props to J.D. Grimes who
found and disclosed a method of viewing unauthenticated posts. * Props to
Weston Ruter for finding a way to create a stored XSS to inject Javascript into
style tags. * Props to David Newman for highlighting a method to poison the
cache of JSON GET requests via the Vary: Origin header. * Props to Eugene
Kolodenker who found a server-side request forgery in the way that URLs are
validated. * Props to Ben Bidner of the WordPress Security Team who
discovered issues related to referrer validation in the admin.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Oct 15 2019 Remi Collet <remi(a)remirepo.net> - 5.2.4-1
- WordPress 5.2.4 Security Release
--------------------------------------------------------------------------------
================================================================================
yara-3.11.0-1.fc29 (FEDORA-2019-7b103bd268)
Pattern matching Swiss knife for malware researchers
--------------------------------------------------------------------------------
Update Information:
update to bugfix version
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 11 2019 Michal Ambroz <rebus at, seznam.cz> - 3.11.0-1
- bump to 3.11.0 release (#1760678)
- BUGFIX: Some regexp character classes not matching correctly when used with ���nocase���
modifier (upstream #1117)
- BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors for certain hex pattern
containing large jumps (upstream #1107)
- BUGFIX: Buffer overrun in ���dotnet��� module (upstream #1108)
- BUGFIX: Memory leak while attaching to a process fails (upstream #1070)
* Sat Sep 28 2019 Michal Ambroz <rebus at, seznam.cz> - 3.10.0-3
- change the sphinx build dependency
* Sat Jul 27 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.10.0-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Fri May 3 2019 Michal Ambroz <rebus at, seznam.cz> - 3.10.0-1
- bump to 3.10.0 release (#1680204)
- Harden virtual machine against malicious code.
- BUGFIX: Regression bug in hex strings containing wildcards (upstream #1025).
- BUGFIX: Buffer overrun in ���elf��� module.
- BUGFIX: Buffer overrun in ���dotnet��� module.
* Sat Mar 16 2019 Michal Ambroz <rebus at, seznam.cz> - 3.9.0-1
- bump to 3.9.0 release (#1680203)
- switch from python-sphinx to python3-sphinx for generating the documentation for fc31+
- should fix also #1660398 (CVE-2018-19974 CVE-2018-19975 CVE-2018-19976),
but by design it might be always dangerous to run yara signatures compiled by 3rd
party,
so it is advised to re-compile yara rules instead
- BUGFIX: Denial of service when using "dex" module. Found by the Cisco Talos
team. (upstream #1023, CVE-2019-5020)
- BUGFIX: Buffer overflow in "dotnet" module.
- BUGFIX: Regexp regression when using nested quantifiers {x,y} for certain values of x
and y. (#1018)
* Sun Feb 3 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.8.1-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1760678 - yara-3.11.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1760678
--------------------------------------------------------------------------------