The following Fedora 27 Security updates need testing:
Age URL
31
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1ec1cd6db3 bro-2.5.3-1.fc27
26
https://bodhi.fedoraproject.org/updates/FEDORA-2018-81e1618ab9
glibc-arm-linux-gnu-2.26-4.fc27
22
https://bodhi.fedoraproject.org/updates/FEDORA-2018-dc984c59e5
drupal7-7.57-1.fc27
18
https://bodhi.fedoraproject.org/updates/FEDORA-2018-de113aeac6
ntp-4.2.8p11-1.fc27
17
https://bodhi.fedoraproject.org/updates/FEDORA-2018-52d79f4f36
dovecot-2.2.34-1.fc27
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-e38f759144
python-bleach-2.1.3-1.fc27
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-8ff86925c3
memcached-1.5.6-1.fc27
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-96601292a2
php-simplesamlphp-saml2_1-1.10.6-1.fc27
7
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6db40b0c37
php-simplesamlphp-saml2-2.3.8-1.fc27
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-a2cc71c081
afflib-3.7.16-4.fc27
5
https://bodhi.fedoraproject.org/updates/FEDORA-2018-37e28670f2
php-simplesamlphp-saml2_3-3.1.4-3.fc27
5
https://bodhi.fedoraproject.org/updates/FEDORA-2018-c923533479
webkitgtk4-2.20.0-1.fc27
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-db9adf44c9 exim-4.90.1-3.fc27
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-cdf3f8e8b0
wireshark-2.4.5-3.fc27
4
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1724b6a0dc
monitorix-3.10.1-1.fc27
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-45d8b8ae21
puppet-4.10.10-1.fc27
3
https://bodhi.fedoraproject.org/updates/FEDORA-2018-6db2f7a02e
python-paramiko-2.3.2-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7c2e0a998d
acpica-tools-20180209-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-df1a571a34
slurm-17.02.10-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1b67b3a3a3
glpi-9.1.7.1-2.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-ad652798b8
mosquitto-1.4.15-1.fc27
The following Fedora 27 Critical Path updates have yet to be approved:
Age URL
17
https://bodhi.fedoraproject.org/updates/FEDORA-2018-1c31f1eccd
iptables-1.6.2-2.fc27 libnftnl-1.0.9-2.fc27 nftables-0.8.2-2.fc27
15
https://bodhi.fedoraproject.org/updates/FEDORA-2018-d4a2b7350f
xfce4-settings-4.12.2-2.fc27
13
https://bodhi.fedoraproject.org/updates/FEDORA-2018-7acb1065ee
lxpanel-0.9.3-7.D20180305gitb85c71a6.fc27
12
https://bodhi.fedoraproject.org/updates/FEDORA-2018-aa5edf1551 gsm-1.0.17-4.fc27
6
https://bodhi.fedoraproject.org/updates/FEDORA-2018-77fdb91f3e nss-3.36.0-1.0.fc27
nss-softokn-3.36.0-1.0.fc27 nss-util-3.36.0-1.0.fc27 nspr-4.19.0-1.fc27
5
https://bodhi.fedoraproject.org/updates/FEDORA-2018-c923533479
webkitgtk4-2.20.0-1.fc27
1
https://bodhi.fedoraproject.org/updates/FEDORA-2018-55a6726164
PackageKit-1.1.9-2.fc27 gnome-software-3.28.0-4.fc27 libappstream-glib-0.7.7-2.fc27
The following builds have been pushed to Fedora 27 updates-testing
apache-commons-compress-1.14-3.fc27
fts-rest-3.7.1-1.fc27
gns3-gui-2.1.4-1.fc27
gns3-server-2.1.4-2.fc27
golang-github-golang-sync-0-0.2.20171101gitfd80eb9.fc27
ibus-anthy-1.5.10-3.fc27
jetring-0.27-1.fc27
libmodulemd-1.1.3-1.fc27
mongodb-3.4.11-2.fc27
mrrescue-1.02e-8.fc27
nss-mdns-0.14.1-1.fc27
orthorobot-1.1.1-6.fc27
osinfo-db-20180318-1.fc27
perl-Mango-1.30-1.fc27
python-sqlalchemy-1.1.18-1.fc27
qmapshack-1.11.0-1.fc27
ravada-0.2.14-1.fc27
remmina-1.2.0-0.49.20180319.git.5f3cc40.fc27
rocksndiamonds-4.0.1.4-1.fc27
tomcat-8.0.50-1.fc27
topgit-0.19.10-1.fc27
translate-shell-0.9.6.7-1.fc27
ubridge-0.9.14-1.fc27
unboundid-ldapsdk-4.0.5-1.fc27
Details about builds:
================================================================================
apache-commons-compress-1.14-3.fc27 (FEDORA-2018-cf918d73cc)
Java API for working with compressed files and archivers
--------------------------------------------------------------------------------
Update Information:
Fix infinite loop security vulnerability (CVE-2018-1324)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1557542 - CVE-2018-1324 apache-commons-compress: Infinite loop via extra
field parser in ZipFile and ZipArchiveInputStream classes
https://bugzilla.redhat.com/show_bug.cgi?id=1557542
--------------------------------------------------------------------------------
================================================================================
fts-rest-3.7.1-1.fc27 (FEDORA-2018-187116fde6)
FTS3 Rest Interface
--------------------------------------------------------------------------------
Update Information:
* new upstream release
--------------------------------------------------------------------------------
================================================================================
gns3-gui-2.1.4-1.fc27 (FEDORA-2018-714905f112)
GNS3 graphical user interface
--------------------------------------------------------------------------------
Update Information:
Update GNS3
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1554316 - gns3-server-2.1.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1554316
[ 2 ] Bug #1554315 - gns3-gui-2.1.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1554315
--------------------------------------------------------------------------------
================================================================================
gns3-server-2.1.4-2.fc27 (FEDORA-2018-714905f112)
Graphical Network Simulator 3
--------------------------------------------------------------------------------
Update Information:
Update GNS3
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1554316 - gns3-server-2.1.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1554316
[ 2 ] Bug #1554315 - gns3-gui-2.1.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1554315
--------------------------------------------------------------------------------
================================================================================
golang-github-golang-sync-0-0.2.20171101gitfd80eb9.fc27 (FEDORA-2018-15173905f7)
Go concurrency primitives
--------------------------------------------------------------------------------
Update Information:
Add missing Provides
--------------------------------------------------------------------------------
================================================================================
ibus-anthy-1.5.10-3.fc27 (FEDORA-2018-47c7b4e3a5)
The Anthy engine for IBus input platform
--------------------------------------------------------------------------------
Update Information:
Bumped 1.5.10
--------------------------------------------------------------------------------
================================================================================
jetring-0.27-1.fc27 (FEDORA-2018-b8fd5d68d9)
GPG keyring maintenance using changesets
--------------------------------------------------------------------------------
Update Information:
Update to jetring-0.27, see
http://metadata.ftp-
master.debian.org/changelogs/main/j/jetring/jetring_0.27_changelog for details.
---- Update to jetring-0.26, see
http://metadata.ftp-
master.debian.org/changelogs/main/j/jetring/jetring_0.26_changelog for details.
--------------------------------------------------------------------------------
================================================================================
libmodulemd-1.1.3-1.fc27 (FEDORA-2018-7531c6122d)
Module metadata manipulation library
--------------------------------------------------------------------------------
Update Information:
- Fixes numerous memory-leak issues ---- - Revert backwards-incompatible
change to nsversion for GObject Introspection - Make default stream and profiles
optional - Fixes:
https://github.com/fedora-modularity/libmodulemd/issues/25 -
Fixes:
https://github.com/fedora-modularity/libmodulemd/issues/26 - Fixes:
https://github.com/fedora-modularity/libmodulemd/issues/27 ---- * Adds support
for handling modulemd-defaults YAML documents * Adds peek()/dup() routines to
all object properties * Adds Modulemd.Module.dup_nsvc() to retrieve the
canonical form of the unique module identifier. * Adds support for boolean types
in the XMD section
--------------------------------------------------------------------------------
================================================================================
mongodb-3.4.11-2.fc27 (FEDORA-2018-5b3a2c777d)
High-performance, schema-free document-oriented database
--------------------------------------------------------------------------------
Update Information:
Update to latest upstream version
--------------------------------------------------------------------------------
================================================================================
mrrescue-1.02e-8.fc27 (FEDORA-2018-a0121a8350)
Arcade-style fire fighting game
--------------------------------------------------------------------------------
Update Information:
Add readme docs, reduce redundant love binary size
--------------------------------------------------------------------------------
================================================================================
nss-mdns-0.14.1-1.fc27 (FEDORA-2018-41065569cf)
glibc plugin for .local name resolution
--------------------------------------------------------------------------------
Update Information:
nss-mdns is back after 10 years! * Moved to new GitHub location, docs migrated
to markdown * The long-deprecated LEGACY mode is removed * The long-deprecated
HONOUR_SEARCH_DOMAINS option is removed * Unit tests are now included, with make
check * nss-mdns now implements standard heuristics for detecting .local unicast
resolution and will automatically disable resolution when a local server
responds to .local requests (**no need to manually disable anything anymore when
the local network resolves with .local**) * _nss_mdns_gethostbyname3_r and
_nss_mdns_gethostbyname4_r are now implemented * Full dual-stack IPv4/IPv6
support is implemented See
https://github.com/lathiat/nss-
mdns/blob/master/NEWS.md
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #454453 - Provide _nss_mdns_gethostbyname4_r interface
https://bugzilla.redhat.com/show_bug.cgi?id=454453
[ 2 ] Bug #1366021 - New upstream location for nss-mdns
https://bugzilla.redhat.com/show_bug.cgi?id=1366021
[ 3 ] Bug #1544608 - nss-mdns outstanding issues
https://bugzilla.redhat.com/show_bug.cgi?id=1544608
--------------------------------------------------------------------------------
================================================================================
orthorobot-1.1.1-6.fc27 (FEDORA-2018-b4abac9986)
A perspective based puzzle game
--------------------------------------------------------------------------------
Update Information:
Reduce binary size
--------------------------------------------------------------------------------
================================================================================
osinfo-db-20180318-1.fc27 (FEDORA-2018-3c04a6145d)
osinfo database files
--------------------------------------------------------------------------------
Update Information:
Update to new release
--------------------------------------------------------------------------------
================================================================================
perl-Mango-1.30-1.fc27 (FEDORA-2018-c8e8a0db5d)
Pure-Perl non-blocking I/O MongoDB driver
--------------------------------------------------------------------------------
Update Information:
This release fixes a crash in SCRAM authentification, a possible null pointer
exception in find_and_modify(), and rendering negative epochs in
Mango::BSON::Time::to_datetime(). It also improves documentation and adds
support for TLS.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1557712 - perl-Mango-1.30 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1557712
--------------------------------------------------------------------------------
================================================================================
python-sqlalchemy-1.1.18-1.fc27 (FEDORA-2018-e5911cb3e7)
Modular and flexible ORM library for python
--------------------------------------------------------------------------------
Update Information:
This update contains a new upstream bugfix release. The upstream [changelog](ht
tp://docs.sqlalchemy.org/en/latest/changelog/changelog_11.html#change-1.1.18)
contains a list of all changes in version 1.1.18.
--------------------------------------------------------------------------------
================================================================================
qmapshack-1.11.0-1.fc27 (FEDORA-2018-693e412108)
GPS mapping and management tool
--------------------------------------------------------------------------------
Update Information:
- updated to 1.11.0 - introduce qmaptool subpackage - changelog
https://bitbucke
t.org/maproom/qmapshack/raw/b47d434915f32c5a8c1de3c4581c01d2ee5686e5/changelog.t
xt
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1551560 - qmapshack-1.11.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1551560
--------------------------------------------------------------------------------
================================================================================
ravada-0.2.14-1.fc27 (FEDORA-2018-d21a4d9c5c)
Remote Virtual Desktops Manager
--------------------------------------------------------------------------------
Update Information:
Release 0.2.14
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1551708 - ravada 0.2.15
https://bugzilla.redhat.com/show_bug.cgi?id=1551708
--------------------------------------------------------------------------------
================================================================================
remmina-1.2.0-0.49.20180319.git.5f3cc40.fc27 (FEDORA-2018-c71246ae99)
Remote Desktop Client
--------------------------------------------------------------------------------
Update Information:
Fixes missing icons.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1557572 - The Remmina icon disappeared
https://bugzilla.redhat.com/show_bug.cgi?id=1557572
[ 2 ] Bug #1556826 - Graphical interface is incomplete. Some properties are missing
https://bugzilla.redhat.com/show_bug.cgi?id=1556826
[ 3 ] Bug #1553098 - No icon for open Remmina application
https://bugzilla.redhat.com/show_bug.cgi?id=1553098
--------------------------------------------------------------------------------
================================================================================
rocksndiamonds-4.0.1.4-1.fc27 (FEDORA-2018-470c159eea)
Underground digging game
--------------------------------------------------------------------------------
Update Information:
Update to 4.0.1.4.
--------------------------------------------------------------------------------
================================================================================
tomcat-8.0.50-1.fc27 (FEDORA-2018-50f0da5d38)
Apache Servlet/JSP Engine, RI for Servlet 3.1/JSP 2.3 API
--------------------------------------------------------------------------------
Update Information:
This update includes a rebase from 8.0.49 up to 8.0.50 which resolves two CVEs
along with various other bugs/features: * rhbz#1548290 CVE-2018-1304 tomcat:
Incorrect handling of empty string URL in security constraints can lead to
unitended exposure of resources * rhbz#1548284 CVE-2018-1305 tomcat: Late
application of security constraints can lead to resource exposure for
unauthorised users
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1548284 - CVE-2018-1305 tomcat: Late application of security constraints can
lead to resource exposure for unauthorised users [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1548284
[ 2 ] Bug #1548290 - CVE-2018-1304 tomcat: Incorrect handling of empty string URL in
security constraints can lead to unitended exposure of resources [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1548290
--------------------------------------------------------------------------------
================================================================================
topgit-0.19.10-1.fc27 (FEDORA-2018-c89cd1f51e)
A different patch queue manager
--------------------------------------------------------------------------------
Update Information:
Switch to TopGit's new upstream. This version of TopGit contains everything
from its parent (including the parent���s new location) and then it���s Patched
Really Overall (PRO) to fix a number of bugs. A formatted ChangeLog and Manual
can be found [here](https://mackyle.github.io/topgit/).
--------------------------------------------------------------------------------
================================================================================
translate-shell-0.9.6.7-1.fc27 (FEDORA-2018-ddab88d9b2)
A command-line online translator
--------------------------------------------------------------------------------
Update Information:
Update to 0.9.6.7.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1557717 - translate-shell-v0.9.6.7 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1557717
--------------------------------------------------------------------------------
================================================================================
ubridge-0.9.14-1.fc27 (FEDORA-2018-714905f112)
Bridge for UDP tunnels, Ethernet, TAP and VMnet interfaces
--------------------------------------------------------------------------------
Update Information:
Update GNS3
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1554316 - gns3-server-2.1.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1554316
[ 2 ] Bug #1554315 - gns3-gui-2.1.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1554315
--------------------------------------------------------------------------------
================================================================================
unboundid-ldapsdk-4.0.5-1.fc27 (FEDORA-2018-0a473d6e7b)
UnboundID LDAP SDK for Java
--------------------------------------------------------------------------------
Update Information:
Rebase package(s) to version: 4.0.5 CVE-2018-1000134 has been fixed in 4.0.5
release of the UnboundID LDAP SDK for Java. A blog post has been written
covering the details of this CVE and is available at
https://nawilson.com/2018/03/19/cve-2018-1000134-and-the-unboundid-ldap-s...
java/ Further bugfixing and improvements are detailed in 4.0.5 release notes at
https://github.com/pingidentity/ldapsdk/releases/tag/4.0.5
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1557531 - CVE-2018-1000134 unboundid-ldapsdk: Incorrect Access Control
vulnerability in process function in SimpleBindRequest class
https://bugzilla.redhat.com/show_bug.cgi?id=1557531
--------------------------------------------------------------------------------