The following Fedora 31 Security updates need testing:
Age URL
55
https://bodhi.fedoraproject.org/updates/FEDORA-2020-fcd5fd47bd
qutebrowser-1.11.1-1.fc31
11
https://bodhi.fedoraproject.org/updates/FEDORA-2020-76cf2b0f0a xen-4.12.3-3.fc31
8
https://bodhi.fedoraproject.org/updates/FEDORA-2020-218ab035b1
knot-resolver-5.1.2-1.fc31
5
https://bodhi.fedoraproject.org/updates/FEDORA-2020-07f0a49a9e
mingw-LibRaw-0.19.5-4.fc31
5
https://bodhi.fedoraproject.org/updates/FEDORA-2020-62f2df3ca4
mailman-2.1.34-1.fc31
5
https://bodhi.fedoraproject.org/updates/FEDORA-2020-0fbd043bcf
php-horde-kronolith-4.2.29-1.fc31
3
https://bodhi.fedoraproject.org/updates/FEDORA-2020-7dddce530c cacti-1.2.13-1.fc31
cacti-spine-1.2.13-1.fc31
3
https://bodhi.fedoraproject.org/updates/FEDORA-2020-198fdb12a1
singularity-3.6.0-1.fc31
3
https://bodhi.fedoraproject.org/updates/FEDORA-2020-5b60029fe2
mbedtls-2.16.7-1.fc31
2
https://bodhi.fedoraproject.org/updates/FEDORA-2020-fe82e2a834
python38-3.8.4-1.fc31
2
https://bodhi.fedoraproject.org/updates/FEDORA-2020-45041afb19
evolution-data-server-3.34.4-2.fc31
2
https://bodhi.fedoraproject.org/updates/FEDORA-2020-e30a990f5a tor-0.4.3.6-1.fc31
2
https://bodhi.fedoraproject.org/updates/FEDORA-2020-16741ac7ff nspr-4.26.0-1.fc31
nss-3.54.0-1.fc31
2
https://bodhi.fedoraproject.org/updates/FEDORA-2020-54e4356732
bashtop-0.9.24-1.fc31
1
https://bodhi.fedoraproject.org/updates/FEDORA-2020-4e92a61688 glibc-2.30-13.fc31
1
https://bodhi.fedoraproject.org/updates/FEDORA-2020-dd0c20d985
clamav-0.102.4-1.fc31
The following Fedora 31 Critical Path updates have yet to be approved:
Age URL
49
https://bodhi.fedoraproject.org/updates/FEDORA-2020-03e14f6120
dracut-050-61.git20200529.fc31
34
https://bodhi.fedoraproject.org/updates/FEDORA-2020-5ccd452c8e
gnutls-3.6.14-2.fc31
16
https://bodhi.fedoraproject.org/updates/FEDORA-2020-56e5d11739
python3-3.7.8-1.fc31 python3-docs-3.7.8-1.fc31
11
https://bodhi.fedoraproject.org/updates/FEDORA-2020-76cf2b0f0a xen-4.12.3-3.fc31
11
https://bodhi.fedoraproject.org/updates/FEDORA-2020-e53a8f609e
net-snmp-5.8-23.fc31
11
https://bodhi.fedoraproject.org/updates/FEDORA-2020-ae00b3db48
perl-Socket-2.030-1.fc31
10
https://bodhi.fedoraproject.org/updates/FEDORA-2020-1f26a8f191
firewalld-0.7.5-2.fc31
8
https://bodhi.fedoraproject.org/updates/FEDORA-2020-8a6ee2aa06
thunderbird-68.10.0-1.fc31
7
https://bodhi.fedoraproject.org/updates/FEDORA-2020-025ab83d69 pam-1.3.1-25.fc31
5
https://bodhi.fedoraproject.org/updates/FEDORA-2020-83b2ee6e63
nfs-utils-2.5.1-0.fc31
5
https://bodhi.fedoraproject.org/updates/FEDORA-2020-54c4dc151a
perl-5.30.3-454.fc31
5
https://bodhi.fedoraproject.org/updates/FEDORA-2020-4567712788 tar-1.32-3.fc31
2
https://bodhi.fedoraproject.org/updates/FEDORA-2020-16741ac7ff nspr-4.26.0-1.fc31
nss-3.54.0-1.fc31
2
https://bodhi.fedoraproject.org/updates/FEDORA-2020-45041afb19
evolution-data-server-3.34.4-2.fc31
2
https://bodhi.fedoraproject.org/updates/FEDORA-2020-6502a12961 pcre2-10.35-4.fc31
1
https://bodhi.fedoraproject.org/updates/FEDORA-2020-4e92a61688 glibc-2.30-13.fc31
The following builds have been pushed to Fedora 31 updates-testing
java-1.8.0-openjdk-1.8.0.262.b10-1.fc31
perl-HTTP-Entity-Parser-0.23-1.fc31
python-dask-2.21.0-1.fc31~bootstrap
python-social-auth-core-3.3.3-1.fc31
zabbix-4.0.22-1.fc31
Details about builds:
================================================================================
java-1.8.0-openjdk-1.8.0.262.b10-1.fc31 (FEDORA-2020-508df53719)
OpenJDK Runtime Environment 8
--------------------------------------------------------------------------------
Update Information:
# July 2020 OpenJDK security update for OpenJDK 8. Full release notes:
https://bitly.com/oj8u262 ## New features *
[
JDK-8223147](https://bugs.openjdk.java.net/browse/JDK-8223147): JFR Backport
## Security fixes - JDK-8028431, CVE-2020-14579: NullPointerException in
DerValue.equals(DerValue) - JDK-8028591, CVE-2020-14578:
NegativeArraySizeException in
sun.security.util.DerInputStream.getUnalignedBitString() - JDK-8230613: Better
ASCII conversions - JDK-8231800: Better listing of arrays - JDK-8232014:
Expand DTD support - JDK-8233255: Better Swing Buttons - JDK-8234032:
Improve basic calendar services - JDK-8234042: Better factory production of
certificates - JDK-8234418: Better parsing with CertificateFactory -
JDK-8234836: Improve serialization handling - JDK-8236191: Enhance OID
processing - JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior -
JDK-8237592, CVE-2020-14577: Enhance certificate verification - JDK-8238002,
CVE-2020-14581: Better matrix operations - JDK-8238804: Enhance key handling
process - JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable -
JDK-8238843: Enhanced font handing - JDK-8238920, CVE-2020-14583: Better
Buffer support - JDK-8238925: Enhance WAV file playback - JDK-8240119,
CVE-2020-14593: Less Affine Transformations - JDK-8240482: Improved WAV file
playback - JDK-8241379: Update JCEKS support - JDK-8241522: Manifest
improved jar headers redux - JDK-8242136, CVE-2020-14621: Better XML namespace
handling ## [
JDK-8240687](https://bugs.openjdk.java.net/browse/JDK-8240687):
JDK Flight Recorder Integrated to OpenJDK 8u OpenJDK 8u now contains the
backport of JEP 328: Flight Recorder (
https://openjdk.java.net/jeps/328) from
later versions of OpenJDK. JFR is a low-overhead framework to collect and
provide data helpful to troubleshoot the performance of the OpenJDK runtime and
of Java applications. It consists of a new API to define custom events under the
jdk.jfr namespace and a JMX interface to interact with the framework. The
recording can also be initiated with the application startup using the
-XX:+FlightRecorder flag or via jcmd. JFR replaces the +XX:EnableTracing feature
introduced in JEP 167, providing a more efficient way to retrieve the same
information. For compatibility reasons, +XX:EnableTracing is still accepted,
however no data will be printed. While JFR is not built by default upstream, it
is included in Fedora binaries for supported architectures (x86_64, AArch64 &
PowerPC 64) ## [
JDK-8205622](https://bugs.openjdk.java.net/browse/JDK-8205622):
JFR Start Failure After AppCDS Archive Created with JFR StartFlightRecording
JFR will be disabled with a warning message if it is enabled during CDS dumping.
The user will see the following warning message: OpenJDK 64-Bit Server VM
warning: JFR will be disabled during CDS dumping if JFR is enabled during CDS
dumping such as in the following command line: $ java -Xshare:dump
-XX:StartFlightRecording=dumponexit=true ##
[
JDK-8244167](https://bugs.openjdk.java.net/browse/JDK-8244167): Removal of
Comodo Root CA Certificate The following expired Comodo root CA certificate was
removed from the `cacerts` keystore: + alias name "addtrustclass1ca [jdk]"
Distinguished Name: CN=AddTrust Class 1 CA Root, OU=AddTrust TTP Network,
O=AddTrust AB, C=SE ##
[
JDK-8244166](https://bugs.openjdk.java.net/browse/JDK-8244166): Removal of
DocuSign Root CA Certificate The following expired DocuSign root CA certificate
was removed from the `cacerts` keystore: + alias name "keynectisrootca [jdk]"
Distinguished Name: CN=KEYNECTIS ROOT CA, OU=ROOT, O=KEYNECTIS, C=FR ##
[
JDK-8240191](https://bugs.openjdk.java.net/browse/JDK-8240191): Allow SunPKCS11
initialization with NSS when external FIPS modules are present in the Security
Modules Database The SunPKCS11 security provider can now be initialized with
NSS when FIPS-enabled external modules are configured in the Security Modules
Database (NSSDB). Prior to this change, the SunPKCS11 provider would throw a
RuntimeException with the message: "FIPS flag set for non-internal module" when
such a library was configured for NSS in non-FIPS mode. This change allows the
JDK to work properly with recent NSS releases on GNU/Linux operating systems
when the system-wide FIPS policy is turned on. Further information can be found
in [
JDK-8238555](https://bugs.openjdk.java.net/browse/JDK-8238555).
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jul 13 2020 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.262.b10-1
- Set vendor property and vendor URLs
- Made URLs to be preconfigured by OS
* Sun Jul 12 2020 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.262.b10-0
- Update to aarch64-shenandoah-jdk8u262-b10.
- Update release notes for 8u262 release.
- Remove issues in NEWS file duplicated between 8u252 & 8u262 releases.
- Update generate_source_tarball.sh script to use the PR3756 patch and retain the
secp256k1 curve.
- Add the -'4curve' suffix to the tarball name.
- Adjust JDK-8143245/PR3548 patch following context changes due to JDK-8203287 for JFR
- Adjust RH1648644 following context changes due to introduction of JFR packages
- Split JDK-8042159 patch into per-repo patches as upstream.
- Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
- Enable JFR in our builds, ahead of upstream default.
- Only enable JFR for JIT builds, as it is not supported with Zero.
- Turn off JFR on x86 for now due to assert(SerializePageShiftCount == count) crash.
- Explicitly list jfr.jar, default.jfc & profile.jfc in the spec file.
- Introduce jfr_arches for architectures which support JFR.
- Fix typo in jfr_arches which leads to ppc64 being wrongly excluded.
- Add jfr binary to devel package and alternatives set
- With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures
without JFR.
- Require tzdata 2020a so system tzdata matches resource updates in b07
- Use sa_arches for libsaproc.so inclusion.
* Wed May 27 2020 Jiri Andrlik <jandrlik(a)redhat.com> - 1:1.8.0.252.b09-1
- backports of provides fixes from master
--------------------------------------------------------------------------------
================================================================================
perl-HTTP-Entity-Parser-0.23-1.fc31 (FEDORA-2020-d39c7b4a44)
PSGI compliant HTTP Entity Parser
--------------------------------------------------------------------------------
Update Information:
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jul 18 2020 Ralf Cors��pius <corsepiu(a)fedoraproject.org> - 0.23-1
- Update to 0.23.
* Thu Jan 30 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.22-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
--------------------------------------------------------------------------------
================================================================================
python-dask-2.21.0-1.fc31~bootstrap (FEDORA-2020-7d6e5e64b4)
Parallel PyData with Task Scheduling
--------------------------------------------------------------------------------
Update Information:
Update to latest version
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jul 18 2020 Elliott Sales de Andrade <quantum.analyst(a)gmail.com> - 2.21.0-1
- Update to latest version
* Fri Jul 10 2020 Miro Hron��ok <mhroncok(a)redhat.com> - 2.20.0-2
- Add metadata for Python extras subpackages
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1858429 - python-dask-2.21.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1858429
--------------------------------------------------------------------------------
================================================================================
python-social-auth-core-3.3.3-1.fc31 (FEDORA-2020-d7dbf8d85b)
Python Social Auth is an easy to setup social authentication/registration mechanism with
support for several frameworks and auth providers.
--------------------------------------------------------------------------------
Update Information:
Rebuilt for version 3.3.3
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jul 18 2020 Chenxiong Qi <qcxhome(a)gmail.com> - 3.3.3-1
- Rebuilt version 3.3.3
* Tue May 26 2020 Miro Hron��ok <mhroncok(a)redhat.com> - 1.7.0-11
- Rebuilt for Python 3.9
* Thu Jan 30 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.7.0-10
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Thu Jan 9 2020 Zbigniew J��drzejewski-Szmek <zbyszek(a)in.waw.pl> - 1.7.0-9
- Remove dependency on unittest2 (#1789200)
* Thu Oct 3 2019 Miro Hron��ok <mhroncok(a)redhat.com> - 1.7.0-8
- Rebuilt for Python 3.8.0rc1 (#1748018)
* Mon Aug 19 2019 Miro Hron��ok <mhroncok(a)redhat.com> - 1.7.0-7
- Rebuilt for Python 3.8
--------------------------------------------------------------------------------
================================================================================
zabbix-4.0.22-1.fc31 (FEDORA-2020-519516feec)
Open-source monitoring solution for your IT infrastructure
--------------------------------------------------------------------------------
Update Information:
Update to 4.0.22
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jul 18 2020 Orion Poplawski <orion(a)nwra.com> - 1:4.0.22-1
- Update to 4.0.22 (bz#1858259) CVE-2020-15803
- Fix alert/external scripts directories
* Mon Apr 20 2020 Orion Poplawski <orion(a)nwra.com> - 1:4.0.19-3
- Fix chmod/chown in scriptlet
* Mon Apr 20 2020 Vit Mojzis <vmojzis(a)redhat.com> - 1:4.0.19-2
- Add SELinux subpackage
* Sun Apr 19 2020 Orion Poplawski <orion(a)nwra.com> - 1:4.0.19-1
- Update to 4.0.19
- Upstream now uses jquery 3, so link to that
* Thu Apr 2 2020 Bj��rn Esser <besser82(a)fedoraproject.org> - 1:4.0.16-3
- Fix string quoting for rpm >= 4.16
* Fri Jan 31 2020 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:4.0.16-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Mon Dec 23 2019 Volker Froehlich <volker27(a)gmx.at> - 1:4.0.16-1
- New upstream release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1858259 - CVE-2020-15803 zabbix: stored XSS in the URL Widget [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1858259
--------------------------------------------------------------------------------