The following Fedora 31 Security updates need testing:
Age URL
21
https://bodhi.fedoraproject.org/updates/FEDORA-2020-c5ec22e14f libuv-1.39.0-1.fc31
nodejs-12.18.4-1.fc31
6
https://bodhi.fedoraproject.org/updates/FEDORA-2020-e21bd401ad
golang-github-andybalholm-brotli-1.0.1-1.fc31
3
https://bodhi.fedoraproject.org/updates/FEDORA-2020-07c5770aa1
thunderbird-78.3.1-1.fc31
1
https://bodhi.fedoraproject.org/updates/FEDORA-2020-90e2b01f4a
claws-mail-3.17.7-1.fc31
The following Fedora 31 Critical Path updates have yet to be approved:
Age URL
132
https://bodhi.fedoraproject.org/updates/FEDORA-2020-03e14f6120
dracut-050-61.git20200529.fc31
58
https://bodhi.fedoraproject.org/updates/FEDORA-2020-72bc7df001
libunwind-1.3.1-7.fc31
13
https://bodhi.fedoraproject.org/updates/FEDORA-2020-a8544190d2 pungi-4.2.5-1.fc31
13
https://bodhi.fedoraproject.org/updates/FEDORA-2020-9c5a0da89b
python-productmd-1.28-1.fc31
10
https://bodhi.fedoraproject.org/updates/FEDORA-2020-87fbd4bb9b
glusterfs-7.8-1.fc31
9
https://bodhi.fedoraproject.org/updates/FEDORA-2020-aa7e76a7eb
vim-8.2.1770-1.fc31
7
https://bodhi.fedoraproject.org/updates/FEDORA-2020-aef226a2fb
python-rpm-macros-3-59.fc31
3
https://bodhi.fedoraproject.org/updates/FEDORA-2020-9c331324e6
hwdata-0.340-1.fc31
3
https://bodhi.fedoraproject.org/updates/FEDORA-2020-07c5770aa1
thunderbird-78.3.1-1.fc31
1
https://bodhi.fedoraproject.org/updates/FEDORA-2020-421372e1e5
jasper-2.0.22-1.fc31
1
https://bodhi.fedoraproject.org/updates/FEDORA-2020-1eadf02f8d
samba-4.11.14-0.fc31
0
https://bodhi.fedoraproject.org/updates/FEDORA-2020-e35fa0cfb3
kernel-5.8.14-100.fc31
The following builds have been pushed to Fedora 31 updates-testing
binaryen-97-1.fc31
brotli-1.0.9-3.fc31
clash-1.2.0-1.fc31
firefox-81.0.1-9.fc31
fuse-overlayfs-1.2.0-1.fc31
golang-github-dreamacro-shadowsocks2-0.1.6-1.fc31
kata-proxy-1.11.1-1.fc31.1
kata-runtime-1.11.1-3.fc31
php-phpmyadmin-sql-parser5-5.4.0-1.fc31
prelockd-0.7-2.fc31
prosody-0.11.7-2.fc31
qjackctl-0.6.3-2.fc31
rubygem-jekyll-feed-0.15.1-1.fc31
sane-backends-1.0.31-3.fc31
wireshark-3.2.7-1.fc31
Details about builds:
================================================================================
binaryen-97-1.fc31 (FEDORA-2020-c75f44306a)
Compiler and toolchain infrastructure library for WebAssembly
--------------------------------------------------------------------------------
Update Information:
v97 --- - Remove asm2wasm, which supported Emscripten's fastcomp backend, after
fastcomp was removed. - The new feature flag `--enable-anyref` enables just
the `anyref` type incl. basic subtyping of `externref`, `funcref` and `exnref`
(if enabled). - Enabling the exception handling or anyref features without also
enabling reference types is a validation error now. - The `Host` expression
and its respective APIs have been refactored into separate `MemorySize` and
`MemoryGrow` expressions to align with other memory instructions.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 7 2020 Dominik Mierzejewski <rpm(a)greysector.net> 97-1
- update to 97 (#1880087)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1880087 - binaryen-97 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1880087
--------------------------------------------------------------------------------
================================================================================
brotli-1.0.9-3.fc31 (FEDORA-2020-bc9a739f0c)
Lossless compression algorithm
--------------------------------------------------------------------------------
Update Information:
Update to 1.0.9, fixes CVE-2020-8927
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 1 2020 Travis Kendrick <pouar(a)pouar.net> - 1.0.9-3
- Apparently %autosetup calls %patch on its own
* Thu Oct 1 2020 Travis Kendrick <pouar(a)pouar.net> - 1.0.9-2
- Fix pc file (#1884364)
* Wed Sep 30 2020 Travis Kendrick <pouar(a)pouar.net> - 1.0.9-1
- Update to 1.0.9 (#1872932)
* Wed Aug 12 2020 Carl George <carl(a)george.computer> - 1.0.7-14
- Update cmake invocation rhbz#1863298
* Sat Aug 1 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.0.7-13
- Second attempt - Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Mon Jul 27 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.0.7-12
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Sat May 23 2020 Miro Hron��ok <mhroncok(a)redhat.com> - 1.0.7-11
- Rebuilt for Python 3.9
* Tue Jan 28 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.0.7-10
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Sat Dec 7 2019 Peter Robinson <pbrobinson(a)fedoraproject.org> 1.0.7-9
- Splil out the libs to a separate package
* Thu Oct 3 2019 Miro Hron��ok <mhroncok(a)redhat.com> - 1.0.7-8
- Rebuilt for Python 3.8.0rc1 (#1748018)
* Sat Aug 17 2019 Miro Hron��ok <mhroncok(a)redhat.com> - 1.0.7-7
- Rebuilt for Python 3.8
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1879226 - CVE-2020-8927 brotli: buffer overflow when input chunk is larger
than 2GiB [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1879226
--------------------------------------------------------------------------------
================================================================================
clash-1.2.0-1.fc31 (FEDORA-2020-df49021628)
A rule-based tunnel in Go
--------------------------------------------------------------------------------
Update Information:
update to 1.2.0 upstream release
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 9 2020 Qiyu Yan <yanqiyu(a)fedoraproject.org> - 1.2.0-1
- update to 1.2.0 upstream release
--------------------------------------------------------------------------------
================================================================================
firefox-81.0.1-9.fc31 (FEDORA-2020-72d7c9c61c)
Mozilla Firefox Web browser
--------------------------------------------------------------------------------
Update Information:
- Fixed popup regression on Wayland ---- - Added a fix for Wayland
(mzbz#1656727) when Firefox crashes during window operation.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 8 2020 Martin Stransky <stransky(a)redhat.com> - 81.0.1-9
- Added an updated fix for mozbz#1656727
* Thu Oct 8 2020 Martin Stransky <stransky(a)redhat.com> - 81.0.1-8
- Added fixes for mozbz#1634404, mozbz#1669495
* Thu Oct 8 2020 Martin Stransky <stransky(a)redhat.com> - 81.0.1-7
- Removed mozbz#1656727 as it causes a regression rhbz#1886243
* Wed Oct 7 2020 Martin Stransky <stransky(a)redhat.com> - 81.0.1-6
- PGO patch update
- Added fix for mzbz#1669442 (LTO builds)
* Mon Oct 5 2020 Martin Stransky <stransky(a)redhat.com> - 81.0.1-5
- Added fix for mozbz#1656727
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1886643 - Mouse clicks don't always work on Firefox tabs/toolbars
https://bugzilla.redhat.com/show_bug.cgi?id=1886643
--------------------------------------------------------------------------------
================================================================================
fuse-overlayfs-1.2.0-1.fc31 (FEDORA-2020-4e76c6f713)
FUSE overlay+shiftfs implementation for rootless containers
--------------------------------------------------------------------------------
Update Information:
Autobuilt v1.2.0
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 9 2020 RH Container Bot <rhcontainerbot(a)fedoraproject.org> - 1.2.0-1
- autobuilt v1.2.0
--------------------------------------------------------------------------------
================================================================================
golang-github-dreamacro-shadowsocks2-0.1.6-1.fc31 (FEDORA-2020-a6dc9f6686)
Experimental Shadowsocks in Go
--------------------------------------------------------------------------------
Update Information:
update to 0.1.6 upstream release
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 9 2020 Qiyu Yan <yanqiyu(a)fedoraproject.org> - 0.1.6-1
- update to 0.1.6 upstream release
--------------------------------------------------------------------------------
================================================================================
kata-proxy-1.11.1-1.fc31.1 (FEDORA-2020-2f5879aeb6)
Proxy for Kata Containers
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2020-2026
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 28 2020 Fedora Release Engineering <releng(a)fedoraproject.org> -
1.11.1-1.1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Fri Jun 26 2020 Pavel Mores <pmores(a)redhat.com> - 1.11.1-1
- Update to version 1.11.1
* Fri May 8 2020 Cole Robinson <crobinso(a)redhat.com> - 1.11.0-1
- Update to version 1.11.0
* Mon Apr 20 2020 Cole Robinson <aintdiscole(a)gmail.com> - 1.11.0-0.1.rc0
- Update to 1.11.0-rc0
* Mon Mar 23 2020 Fabiano Fid��ncio <fidencio(a)redhat.com> - 1.11.0-0.alpha1
- Update to release 1.11.0-alpha1
* Wed Jan 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.10.0-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Tue Jan 21 2020 Christophe de Dinechin <dinechin(a)redhat.com> - 1.10.0-1
- Update to release 1.10.0
+ Overwrite PREFIX
+ Use xenial
* Fri Jan 17 2020 Christophe de Dinechin <dinechin(a)redhat.com> - 1.9.3-1
- Update to release 1.9.3 (no changes upstream)
* Fri Jan 17 2020 Christophe de Dinechin <dinechin(a)redhat.com> - 1.9.2-1
- Update to release 1.9.2 (no changes upstream)
* Fri Nov 29 2019 Christophe de Dinechin <dinechin(a)redhat.com> - 1.9.1-1
- Update to release 1.9.1
* Fri Nov 29 2019 Christophe de Dinechin <dinechin(a)redhat.com> - 1.9.0-2
- Address rpmlint warning about macro in comment
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1848298 - CVE-2020-2026 kata-proxy: kata-containers: Possibility to mount
untrusted container filesystem on any host path leads to Remote Code Execution
[fedora-31]
https://bugzilla.redhat.com/show_bug.cgi?id=1848298
--------------------------------------------------------------------------------
================================================================================
kata-runtime-1.11.1-3.fc31 (FEDORA-2020-7a0b6071a4)
Kata runtime to run containers in virtual machines
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2020-2026
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 9 2020 Fabiano Fid��ncio <fidencio(a)redhat.com> - 1.11.1-3
- Set kata-shim as recommended
- Don't reenable SELinux support for CentOS
* Thu Jul 30 2020 Fabiano Fid��ncio <fidencio(a)redhat.com> - 1.11.1-2
- Reenable SELinux as podman 2.0 is already out
* Tue Jul 28 2020 Fedora Release Engineering <releng(a)fedoraproject.org> -
1.11.1-1.1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Fri Jun 26 2020 Pavel Mores <pmores(a)redhat.com> - 1.11.1-1
- Update to version 1.11.1
* Fri May 15 2020 Fabiano Fid��ncio <fidencio(a)redhat.com> - 1.11.0-3
- Use the right machine type according to the architecture
- Removed non-used / non-tested configuration files
- Use the right SharedFS type according ro the architecture
* Wed May 13 2020 Cole Robinson <crobinso(a)redhat.com> - 1.11.0-2
- Disable selinux until new podman is available
* Fri May 8 2020 Cole Robinson <crobinso(a)redhat.com> - 1.11.0-1
- Update to version 1.11.0
* Mon Apr 20 2020 Cole Robinson <aintdiscole(a)gmail.com> - 1.11.0-0.2.rc0
- Add libselinux-devel build dep
* Mon Apr 20 2020 Cole Robinson <aintdiscole(a)gmail.com> - 1.11.0-0.1.rc0
- Update to 1.11.0-rc0
* Mon Mar 23 2020 Fabiano Fid��ncio <fidencio(a)redhat.com> - 1.11.0-0.alpha1
- Update to 1.11.0-alpha1 upstream release
* Mon Feb 17 2020 Cole Robinson <aintdiscole(a)gmail.com> - 1.10.0-3
- Switch to virtio-fs default
* Wed Jan 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.10.0-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Tue Jan 21 2020 Christophe de Dinechin <dinechin(a)redhat.com> - 1.10.0-1
- Update to release 1.10.0
Large number of changes
* Fri Jan 17 2020 Christophe de Dinechin <dinechin(a)redhat.com> - 1.9.2-1
- Update to release 1.9.3
Include firecracker release v0.18.1 to address CVE-2019-18960
Several upstream bug fixes:
3d5e0db rootless: Disable vhost-net for rootless
71d6d22 release: Kata Containers 1.9.3
b7fa015 versions: bump fc version to v0.18.1
c46fdff virtcontainers: don't consider non-running container resources
2777cb2 virtcontainers: update resources after adding container to sandbox
9204973 virtcontainers/store: make VCStoreUUIDPath rootless
c818711 vc: Don't adjust block index on error
10a977d vc: Persist file handle may leak in FS#ToDisk
* Fri Jan 17 2020 Christophe de Dinechin <dinechin(a)redhat.com> - 1.9.2-1
- Update to release 1.9.2
- Fix rangeUID parsing
- Fix cgroup creation logic for rootless
* Fri Jan 17 2020 Christophe de Dinechin <dinechin(a)redhat.com> - 1.9.1-2
- Adjust paths to match fix in kata-osbuilder
* Fri Nov 29 2019 Christophe de Dinechin <dinechin(a)redhat.com> - 1.9.1-1
- Update to release 1.9.1
* Tue Nov 19 2019 Christophe de Dinechin <dinechin(a)redhat.com> - 1.9.0-2
- Address rpmlint warning rpm-buildroot-usage
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1848300 - CVE-2020-2026 kata-runtime: kata-containers: Possibility to mount
untrusted container filesystem on any host path leads to Remote Code Execution
[fedora-31]
https://bugzilla.redhat.com/show_bug.cgi?id=1848300
--------------------------------------------------------------------------------
================================================================================
php-phpmyadmin-sql-parser5-5.4.0-1.fc31 (FEDORA-2020-41aba66e67)
A validating SQL lexer and parser with a focus on MySQL dialect
--------------------------------------------------------------------------------
Update Information:
**Version 5.4.0** - 2020-10-08 * EXISTS is also a function. (#297) * Fix lexer
to not allow numbers with letters (#300) * Add support for INVISIBLE keyword
(#292) * Fix the "$" might be a character used in a name (#301) * Fix use
stream_select instead of non-blocking STDIN (#309) * Add select validation to a
create view statement (#310)
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 9 2020 Remi Collet <remi(a)remirepo.net> - 5.4.0-1
- update to 5.4.0
- switch to phpunit9
--------------------------------------------------------------------------------
================================================================================
prelockd-0.7-2.fc31 (FEDORA-2020-f3bd65c643)
Lock binaries and libraries in memory to improve system responsiveness
--------------------------------------------------------------------------------
Update Information:
Initial package
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1884983 - Review Request: prelockd - Lock binaries and libraries in memory to
improve system responsiveness
https://bugzilla.redhat.com/show_bug.cgi?id=1884983
--------------------------------------------------------------------------------
================================================================================
prosody-0.11.7-2.fc31 (FEDORA-2020-4151f52ad2)
Flexible communications server for Jabber/XMPP
--------------------------------------------------------------------------------
Update Information:
* Added upstream patches for better Lua 5.4 support (#1886456)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 8 2020 Robert Scheck <robert(a)fedoraproject.org> 0.11.7-2
- Added upstream patches for better Lua 5.4 support (#1886456)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1886456 - prosody cannot find lua-socket/lua-bitopts
https://bugzilla.redhat.com/show_bug.cgi?id=1886456
--------------------------------------------------------------------------------
================================================================================
qjackctl-0.6.3-2.fc31 (FEDORA-2020-041b6eeeed)
Qt based JACK control application
--------------------------------------------------------------------------------
Update Information:
Update to version 0.6.3 and some cleanup.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 7 2020 Christoph Karl <pampelmuse [AT] gmx [DOT] at> - 0.6.3-2
- New version
* Tue Oct 6 2020 Ankur Sinha <ankursinha AT fedoraproject DOT org> - 0.6.3-1
- Move check section after install section
* Tue Sep 29 2020 Christoph Karl <pampelmuse [AT] gmx [DOT] at> - 0.6.3-1
- New version
* Wed Jul 29 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.6.2-2
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Sun Jun 21 2020 Orcan Ogetbil <oget [DOT] fedora [AT] gmail [DOT] com> - 0.6.2-1
- New version
* Thu Jan 30 2020 Fedora Release Engineering <releng(a)fedoraproject.org> - 0.5.5-5
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1862378 - qjackctl-0.6.3 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1862378
--------------------------------------------------------------------------------
================================================================================
rubygem-jekyll-feed-0.15.1-1.fc31 (FEDORA-2020-c89cbf8bd3)
Jekyll plugin to generate an Atom feed of your Jekyll posts
--------------------------------------------------------------------------------
Update Information:
Update to version 0.15.1. Release notes:
https://github.com/jekyll/jekyll-
feed/releases/tag/v0.15.1
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 9 2020 Fabio Valentini <decathorpe(a)gmail.com> - 0.15.1-1
- Update to version 0.15.1.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1885049 - rubygem-jekyll-feed-0.15.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1885049
--------------------------------------------------------------------------------
================================================================================
sane-backends-1.0.31-3.fc31 (FEDORA-2020-1d4412c037)
Scanner access software
--------------------------------------------------------------------------------
Update Information:
1750899 - CANOSCAN N650U scanner device not correctly detected via USB
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 9 2020 Zdenek Dohnal <zdohnal(a)redhat.com> - 1.0.31-3
- 1750899 - CANOSCAN N650U scanner device not correctly detected via USB
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1750899 - CANOSCAN N650U scanner device not correctly detected via USB
https://bugzilla.redhat.com/show_bug.cgi?id=1750899
--------------------------------------------------------------------------------
================================================================================
wireshark-3.2.7-1.fc31 (FEDORA-2020-1b390bec14)
Network traffic analyzer
--------------------------------------------------------------------------------
Update Information:
New version 3.2.7 Security fix for CVE-2020-25862, CVE-2020-25863,
CVE-2020-25866
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 9 2020 Michal Ruprich <mruprich(a)redhat.com> - 1:3.2.7-1
- New version 3.2.7
- Fix for CVE-2020-25862, CVE-2020-25863, CVE-2020-25866
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1886041 - CVE-2020-25862 wireshark: TCP dissector crash (wnpa-sec-2020-12)
https://bugzilla.redhat.com/show_bug.cgi?id=1886041
[ 2 ] Bug #1886044 - CVE-2020-25863 wireshark: MIME multipart dissector crash
(wnpa-sec-2020-11)
https://bugzilla.redhat.com/show_bug.cgi?id=1886044
[ 3 ] Bug #1886051 - CVE-2020-25866 wireshark: BLIP dissector crash (wnpa-sec-2020-13)
https://bugzilla.redhat.com/show_bug.cgi?id=1886051
--------------------------------------------------------------------------------