The following Fedora 34 Security updates need testing:
Age URL
55
https://bodhi.fedoraproject.org/updates/FEDORA-2022-6aba96e1b8
radare2-5.6.4-1.fc34
13
https://bodhi.fedoraproject.org/updates/FEDORA-2022-dbd2935e44 rsync-3.2.3-6.fc34
13
https://bodhi.fedoraproject.org/updates/FEDORA-2022-05918f0838
dhcp-4.4.2-12.b1.fc34
12
https://bodhi.fedoraproject.org/updates/FEDORA-2022-6b512ae9e5 gzip-1.10-5.fc34
10
https://bodhi.fedoraproject.org/updates/FEDORA-2022-64b2c02d29 xen-4.14.5-1.fc34
10
https://bodhi.fedoraproject.org/updates/FEDORA-2022-ec66ee6b59 xz-5.2.5-9.fc34
7
https://bodhi.fedoraproject.org/updates/FEDORA-2022-fef374d46f
zchunk-1.2.2-1.fc34
7
https://bodhi.fedoraproject.org/updates/FEDORA-2022-2fec5f30be git-2.34.3-1.fc34
7
https://bodhi.fedoraproject.org/updates/FEDORA-2022-63de6726ce
libinput-1.19.4-1.fc34
6
https://bodhi.fedoraproject.org/updates/FEDORA-2022-832689aa6b usd-21.08-19.fc34
6
https://bodhi.fedoraproject.org/updates/FEDORA-2022-5e637f6cc6
podman-3.4.7-1.fc34
6
https://bodhi.fedoraproject.org/updates/FEDORA-2022-22b85a45cb
epiphany-40.6-2.fc34
4
https://bodhi.fedoraproject.org/updates/FEDORA-2022-b605768c94
vim-8.2.4804-1.fc34
4
https://bodhi.fedoraproject.org/updates/FEDORA-2022-bc5c8ee61e esh-0.3.2-1.fc34
3
https://bodhi.fedoraproject.org/updates/FEDORA-2022-cc64b21327
CuraEngine-4.13.1-2.fc34
3
https://bodhi.fedoraproject.org/updates/FEDORA-2022-17aa1c62da
chromium-100.0.4896.127-1.fc34
2
https://bodhi.fedoraproject.org/updates/FEDORA-2022-b0a47f8060
freerdp-2.7.0-1.fc34
1
https://bodhi.fedoraproject.org/updates/FEDORA-2022-a2f0201723
suricata-6.0.5-1.fc34
0
https://bodhi.fedoraproject.org/updates/FEDORA-2022-82a9edac27
ruby-3.0.4-153.fc34
The following Fedora 34 Critical Path updates have yet to be approved:
Age URL
385
https://bodhi.fedoraproject.org/updates/FEDORA-2021-1300e131b6 ddpt-0.96-4.fc34
ledmon-0.95-4.fc34 libgpod-0.8.3-38.fc34 libzfcphbaapi-2.2.0-12.fc34 lsvpd-1.7.11-6.fc34
sg3_utils-1.46-1.fc34 udisks-1.0.5-18.fc34
107
https://bodhi.fedoraproject.org/updates/FEDORA-2022-e3b891fe11 gdb-11.1-7.fc34
55
https://bodhi.fedoraproject.org/updates/FEDORA-2022-8f3103b973
hwdata-0.357-1.fc34
37
https://bodhi.fedoraproject.org/updates/FEDORA-2022-dab75a01b8
gnome-shell-40.10-1.fc34 gnome-shell-extensions-40.7-1.fc34 mutter-40.10-1.fc34
23
https://bodhi.fedoraproject.org/updates/FEDORA-2022-eb1d10aba3 libldb-2.3.3-1.fc34
samba-4.14.13-0.fc34
13
https://bodhi.fedoraproject.org/updates/FEDORA-2022-05918f0838
dhcp-4.4.2-12.b1.fc34
13
https://bodhi.fedoraproject.org/updates/FEDORA-2022-dbd2935e44 rsync-3.2.3-6.fc34
13
https://bodhi.fedoraproject.org/updates/FEDORA-2022-18e43296f0
linux-firmware-20220411-131.fc34
12
https://bodhi.fedoraproject.org/updates/FEDORA-2022-6b512ae9e5 gzip-1.10-5.fc34
10
https://bodhi.fedoraproject.org/updates/FEDORA-2022-ec66ee6b59 xz-5.2.5-9.fc34
10
https://bodhi.fedoraproject.org/updates/FEDORA-2022-14b4ccfa1f gdisk-1.0.9-1.fc34
10
https://bodhi.fedoraproject.org/updates/FEDORA-2022-64b2c02d29 xen-4.14.5-1.fc34
10
https://bodhi.fedoraproject.org/updates/FEDORA-2022-eaef082697
container-selinux-2.173.1-2.fc34 flatpak-1.10.7-2.fc34 osbuild-54-2.fc34
selinux-policy-34.27-1.fc34 snapd-2.55.3-2.fc34
7
https://bodhi.fedoraproject.org/updates/FEDORA-2022-63de6726ce
libinput-1.19.4-1.fc34
7
https://bodhi.fedoraproject.org/updates/FEDORA-2022-2fec5f30be git-2.34.3-1.fc34
7
https://bodhi.fedoraproject.org/updates/FEDORA-2022-fef374d46f
zchunk-1.2.2-1.fc34
6
https://bodhi.fedoraproject.org/updates/FEDORA-2022-86a5792181
webkit2gtk3-2.36.1-1.fc34
6
https://bodhi.fedoraproject.org/updates/FEDORA-2022-13c91c9fef
langtable-0.0.58-1.fc34
4
https://bodhi.fedoraproject.org/updates/FEDORA-2022-41e16c6c1e annobin-9.79-5.fc34
gcc-11.3.1-2.fc34
4
https://bodhi.fedoraproject.org/updates/FEDORA-2022-681d2ee7ea rtkit-0.11-28.fc34
4
https://bodhi.fedoraproject.org/updates/FEDORA-2022-b605768c94
vim-8.2.4804-1.fc34
3
https://bodhi.fedoraproject.org/updates/FEDORA-2022-c17b776b17 inih-55-1.fc34
2
https://bodhi.fedoraproject.org/updates/FEDORA-2022-b0a47f8060
freerdp-2.7.0-1.fc34
1
https://bodhi.fedoraproject.org/updates/FEDORA-2022-095ac0abfb
livecd-tools-30.0-1.fc34
1
https://bodhi.fedoraproject.org/updates/FEDORA-2022-47554f7728
gnutls-3.7.4-1.fc34
The following builds have been pushed to Fedora 34 updates-testing
bitcoin-core-23.0-1.fc34
curl-7.76.1-13.fc34
knot-3.1.8-1.fc34
maven-shared-utils-3.2.1-0.9.fc34
redis-6.2.7-1.fc34
rstudio-2022.02.2+485-1.fc34
Details about builds:
================================================================================
bitcoin-core-23.0-1.fc34 (FEDORA-2022-40c4dad1f0)
Peer to Peer Cryptographic Currency
--------------------------------------------------------------------------------
Update Information:
Update to 23.0.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Apr 26 2022 Simone Caronni <negativo17(a)gmail.com> - 23.0-1
- Update to 23.0.
--------------------------------------------------------------------------------
================================================================================
curl-7.76.1-13.fc34 (FEDORA-2022-fc5776b142)
A utility for getting files from remote servers (FTP, HTTP, and others)
--------------------------------------------------------------------------------
Update Information:
- fix credential leak on redirect (CVE-2022-27774) - fix auth/cookie leak on
redirect (CVE-2022-27776) - fix bad local IPv6 connection reuse (CVE-2022-27775)
- fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 28 2022 Kamil Dudka <kdudka(a)redhat.com> - 7.76.1-13
- fix credential leak on redirect (CVE-2022-27774)
- fix auth/cookie leak on redirect (CVE-2022-27776)
- fix bad local IPv6 connection reuse (CVE-2022-27775)
- fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2079167 - CVE-2022-22576 curl: OAUTH2 bearer bypass in connection re-use
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2079167
[ 2 ] Bug #2079169 - CVE-2022-27774 curl: credential leak on redirect [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2079169
[ 3 ] Bug #2079171 - CVE-2022-27775 curl: bad local IPv6 connection reuse [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2079171
[ 4 ] Bug #2079174 - CVE-2022-27776 curl: auth/cookie leak on redirect [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2079174
--------------------------------------------------------------------------------
================================================================================
knot-3.1.8-1.fc34 (FEDORA-2022-b72d5d38b0)
High-performance authoritative DNS server
--------------------------------------------------------------------------------
Update Information:
Update to bugfix 3.1.8
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 28 2022 Jakub Ru��i��ka <jakub.ruzicka(a)nic.cz> - 3.1.8-1
- Update to 3.1.8
--------------------------------------------------------------------------------
================================================================================
maven-shared-utils-3.2.1-0.9.fc34 (FEDORA-2022-5d6aaab56e)
Maven shared utility classes
--------------------------------------------------------------------------------
Update Information:
Fixes an important security vulnerability - command injection via Commandline
class
--------------------------------------------------------------------------------
ChangeLog:
* Mon Apr 25 2022 Marian Koncek <mkoncek(a)redhat.com> - 3.2.1-0.9
- Fix commandline injection vulnerability
- Resolves: CVE-2022-29599
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2066480 - CVE-2022-29599 maven-shared-utils: Command injection via
Commandline class [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2066480
--------------------------------------------------------------------------------
================================================================================
redis-6.2.7-1.fc34 (FEDORA-2022-a0a4c7eb31)
A persistent key-value database
--------------------------------------------------------------------------------
Update Information:
**Redis 6.2.7** - Released Wed Apr 27 12:00:00 IDT 2022 Upgrade urgency:
**SECURITY**, contains fixes to security issues. Security Fixes: *
(CVE-2022-24736) An attacker attempting to load a specially crafted Lua script
can cause NULL pointer dereference which will result with a crash of the
redis-server process. This issue affects all versions of Redis. [reported by
Aviv Yahav]. * (CVE-2022-24735) By exploiting weaknesses in the Lua script
execution environment, an attacker with access to Redis can inject Lua code
that will execute with the (potentially higher) privileges of another Redis
user. [reported by Aviv Yahav]. Potentially Breaking Fixes * LPOP/RPOP with
count against non-existing list return null array (#10095) * LPOP/RPOP used to
produce wrong replies when count is 0 (#9692) Performance and resource
utilization improvements * Speed optimization in command execution pipeline
(#10502) * Fix regression in Z[REV]RANGE commands (by-rank) introduced in Redis
6.2 (#10337) Platform / toolchain support related improvements * Fix RSS
metrics on NetBSD and OpenBSD (#10116, #10149) * Fix OpenSSL 3.0.x related
issues (#10291) Bug Fixes * Lua: Add checks for min-slave-* configs when
evaluating Lua scripts (#10160) * Lua: fix crash on a script call with many
arguments, a regression in v6.2.6 (#9809) * Tracking: Make invalidation messages
always after command's reply (#9422) * Fix excessive stream trimming due to an
overflow (#10068) * Add missed error counting for INFO errorstats (#9646) * Fix
geo search bounding box check causing missing results (#10018) * Improve EXPIRE
TTL overflow detection (#9839) * Modules: Fix thread safety violation when a
module thread adds an error reply, broken in 6.2 (#10278) * Modules: Fix missing
and duplicate error stats (#10278) * Module APIs: release clients blocked on
module commands in cluster resharding and down state (#9483) * Sentinel: Fix
memory leak with TLS (#9753) * Sentinel: Fix issues with hostname support
(#10146) * Sentinel: Fix election failures on certain container environments
(#10197)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 28 2022 Remi Collet <remi(a)remirepo.net> - 6.2.7-1
- Upstream 6.2.7 release.
* Wed Nov 3 2021 Remi Collet <remi(a)remirepo.net> - 6.2.6-2
- use proper license in dec/devel sub-packages
--------------------------------------------------------------------------------
================================================================================
rstudio-2022.02.2+485-1.fc34 (FEDORA-2022-ff5f7de35a)
RStudio base package
--------------------------------------------------------------------------------
Update Information:
Update to 2022.02.2+485
--------------------------------------------------------------------------------
ChangeLog:
* Thu Apr 28 2022 I��aki ��car <iucar(a)fedoraproject.org> - 2022.02.2+485-1
- Update to 2022.02.2+485
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2079686 - rstudio-2022.02.2+485 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2079686
--------------------------------------------------------------------------------