November 2022 - Epel-packagers-sig - Fedora mailing-lists

[Bug 2069364] New: CVE-2021-43085 openssl: Insecure permissions vulnerability due to an error in the implementation of the CMAC_Final() function
by bugzilla＠redhat.com 08 Jan '25

08 Jan '25

https://bugzilla.redhat.com/show_bug.cgi?id=2069364 Bug ID: 2069364 Summary: CVE-2021-43085 openssl: Insecure permissions vulnerability due to an error in the implementation of the CMAC_Final() function Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: aos-bugs(a)redhat.com, asoldano(a)redhat.com, bbaranow(a)redhat.com, bdettelb(a)redhat.com, berrange(a)redhat.com, bmaxwell(a)redhat.com, bootloader-eng-team(a)redhat.com, brian.stansberry(a)redhat.com, caswilli(a)redhat.com, cdewolf(a)redhat.com, cfergeau(a)redhat.com, chazlett(a)redhat.com, crobinso(a)redhat.com, crypto-team(a)lists.fedoraproject.org, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dbelyavs(a)redhat.com, dhalasz(a)redhat.com, dkreling(a)redhat.com, dkuc(a)redhat.com, dosoudil(a)redhat.com, dueno(a)redhat.com, elima(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, erik-fedora(a)vanpienbroek.nl, f4bug(a)amsat.org, fjansen(a)redhat.com, fjuma(a)redhat.com, fmartine(a)redhat.com, gparvin(a)redhat.com, gzaronik(a)redhat.com, iweiss(a)redhat.com, jburrell(a)redhat.com, jclere(a)redhat.com, jkoehler(a)redhat.com, jochrist(a)redhat.com, jramanat(a)redhat.com, jwong(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, krathod(a)redhat.com, kraxel(a)redhat.com, ktietz(a)redhat.com, lgao(a)redhat.com, marcandre.lureau(a)redhat.com, michal.skrivanek(a)redhat.com, michel(a)michel-slm.name, micjohns(a)redhat.com, mjg59(a)srcf.ucam.org, mosmerov(a)redhat.com, mperina(a)redhat.com, msochure(a)redhat.com, mspacek(a)redhat.com, msvehla(a)redhat.com, mturk(a)redhat.com, njean(a)redhat.com, nobody(a)redhat.com, nwallace(a)redhat.com, pahickey(a)redhat.com, pbonzini(a)redhat.com, pjindal(a)redhat.com, pjones(a)redhat.com, pmackay(a)redhat.com, redhat-bugzilla(a)linuxnetz.de, rfreiman(a)redhat.com, rharwood(a)redhat.com, rh-spice-bugs(a)redhat.com, rjones(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, sahana(a)redhat.com, sbonazzo(a)redhat.com, smaestri(a)redhat.com, stcannon(a)redhat.com, sthirugn(a)redhat.com, szappis(a)redhat.com, tmeszaro(a)redhat.com, tm(a)t8m.info, tom.jenkinson(a)redhat.com, virt-maint(a)lists.fedoraproject.org, virt-maint(a)redhat.com, vkrizan(a)redhat.com, vkumar(a)redhat.com, vmugicag(a)redhat.com Target Milestone: --- Classification: Other An Insecure Permissions vulnerability exists in the OpenSSL Project 3.0 due to an error in the implementation of the CMAC_Final() function. Upstream issue: https://github.com/openssl/openssl/issues/16873 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2069364

1 4

[Bug 2139778] New: Please branch and build matplotlib for python3.8 in EPEL 8
by bugzilla＠redhat.com 09 Nov '24

09 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2139778 Bug ID: 2139778 Summary: Please branch and build matplotlib for python3.8 in EPEL 8 Product: Fedora EPEL Version: epel8 Status: NEW Component: python-matplotlib Assignee: quantum.analyst(a)gmail.com Reporter: cquike(a)arcor.de QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, jonathan.underwood(a)gmail.com, paulo.cesar.pereira.de.andrade(a)gmail.com, python-packagers-sig(a)lists.fedoraproject.org, quantum.analyst(a)gmail.com, thibault(a)north.li, tomspur(a)fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: Application streams in Centos 8 Stream include a python 3.8 stack that can be used in parallel to the standard python 3.6 stack. However the matplotlib package for python 3.8 is not available. It would be great if EPEL includes also package python38-matplotlib for EPEL 8. Version-Release number of selected component (if applicable): In principle it can be the same version as in the python 3.6 stack, i.e. 3.0.3, but there might be constraints that imply a higher version is needed, depending on the rest of the dependencies. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2139778

1 4

[Bug 2140488] New: python-mistune-3.0.0a3 is available
by bugzilla＠redhat.com 16 Sep '24

16 Sep '24

https://bugzilla.redhat.com/show_bug.cgi?id=2140488 Bug ID: 2140488 Summary: python-mistune-3.0.0a3 is available Product: Fedora Version: rawhide Status: NEW Component: python-mistune Keywords: FutureFeature, Triaged Assignee: lupinix.fedora(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, lupinix.fedora(a)gmail.com, python-packagers-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Releases retrieved: 3.0.0rc2 Upstream release that is considered latest: 3.0.0a3 Current version/release in rawhide: 2.0.4-1.fc38 URL: https://github.com/lepture/mistune Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/6189/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-mistune -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2140488

1 13

[Bug 2121894] New: builtins.h requires mpc.h from libmpc-devel
by bugzilla＠redhat.com 13 Aug '24

13 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=2121894 Bug ID: 2121894 Summary: builtins.h requires mpc.h from libmpc-devel Product: Fedora Version: 36 Hardware: x86_64 OS: Linux Status: NEW Component: cross-gcc Severity: medium Assignee: dhowells(a)redhat.com Reporter: elliott(a)hpe.com QA Contact: extras-qa(a)fedoraproject.org CC: dan(a)danny.cz, dhowells(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, lkundrak(a)v3.sk Target Milestone: --- Classification: Fedora Description of problem: Cross compiles of the linux kernel 6.0-rc1 allmodconfig fail for arm, arm64, mips, powerpc, and s390. This originates in scripts/gcc-plugins/Kconfig, which has this entry: menuconfig GCC_PLUGINS bool "GCC plugins" depends on HAVE_GCC_PLUGINS depends on CC_IS_GCC depends on $(success,test -e $(shell,$(CC) -print-file-name=plugin)/include/plugin-version.h) default y depends on $(success,test -e $(shell,$(CC) -print-file-name=plugin)/include/plugin-version.h) arch/sparc/Kconfig does not include select HAVE_GCC_PLUGINS but all the others do. The -print-file-name tests passes for all the cross-compilers, but does not for native x86: $ gcc -print-file-name=plugin plugin $ powerpc64-linux-gnu-gcc -print-file-name=plugin /usr/lib/gcc/powerpc64-linux-gnu/12/plugin $ aarch64-linux-gnu-gcc -print-file-name=plugin /usr/lib/gcc/aarch64-linux-gnu/12/plugin $ find /usr/lib/gcc -name plugin-version.h /usr/lib/gcc/s390x-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/aarch64-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/powerpc64-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/sparc64-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/arm-linux-gnueabi/12/plugin/include/plugin-version.h /usr/lib/gcc/mips64-linux-gnu/12/plugin/include/plugin-version.h so the .x86 .config file only gets: CONFIG_HAVE_GCC_PLUGINS=y while the others get that, CONFIG_GCC_PLUGINS, and a several specific plugins: build-arm64/.config:CONFIG_HAVE_GCC_PLUGINS=y build-arm64/.config:CONFIG_GCC_PLUGINS=y build-arm64/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-arm64/.config:CONFIG_GCC_PLUGIN_STACKLEAK=y build-arm64/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-arm/.config:CONFIG_HAVE_GCC_PLUGINS=y build-arm/.config:CONFIG_GCC_PLUGINS=y build-arm/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-arm/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-mips/.config:CONFIG_HAVE_GCC_PLUGINS=y build-mips/.config:CONFIG_GCC_PLUGINS=y build-mips/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-mips/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-powerpc/.config:CONFIG_HAVE_GCC_PLUGINS=y build-powerpc/.config:CONFIG_GCC_PLUGINS=y build-powerpc/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-powerpc/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-s390/.config:CONFIG_HAVE_GCC_PLUGINS=y build-s390/.config:CONFIG_GCC_PLUGINS=y build-s390/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-s390/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-x86/.config:CONFIG_HAVE_GCC_PLUGINS=y A header included by each of the plugins, scripts/gcc-plugins/gcc-common.h, includes a GCC header file called builtins.h that includes <mpc.h>, which does not exist anywhere on my system. That causes errors early in the build on all of those architectures. Version-Release number of selected component (if applicable): gcc-[each architecture]-linux-gnu 12.1.1 How reproducible: 100% Steps to Reproduce: Example for arm 32-bit: 1. make ARCH=arm O=build-arm CROSS_COMPILE=arm-linux-gnu- allmodconfig 2. make ARCH=arm O=build-arm CROSS_COMPILE=arm-linux-gnu- -j 55 Actual results: For each "GCC plugin", an error like this terminates the make: In file included from ../scripts/gcc-plugins/gcc-common.h:95, from ../scripts/gcc-plugins/latent_entropy_plugin.c:78: /usr/lib/gcc/aarch64-linux-gnu/12/plugin/include/builtins.h:23:10: fatal error: mpc.h: No such file or directory 23 | #include <mpc.h> | ^~~~~~~ compilation terminated. Expected results: no errors Additional info: That mpc.h file is provided by the libmpc-devel package. 1. Please add a dependency for the libmpc-devel package from each gcc cross-compiler package that includes a builtins.h file 2. Please investigate whether the native gcc package not having plugins is correct, despite the kernel x86 allmodconfig expecting them by specifying CONFIG_HAVE_GCC_PLUGINS=y -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2121894

1 6

[Bug 2128335] New: Please port your pcre dependency to pcre2. Pcre has been deprecated
by bugzilla＠redhat.com 09 Aug '24

09 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=2128335 Bug ID: 2128335 Summary: Please port your pcre dependency to pcre2. Pcre has been deprecated Product: Fedora Version: rawhide Status: NEW Component: ngrep Assignee: dcavalca(a)fb.com Reporter: ljavorsk(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: cickumqt(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, me(a)fale.io Target Milestone: --- Classification: Fedora Pcre has been deprecated since Fedora 38. Please consider porting to the new pcre2 version. Fedora change that describes the pcre deprecation is located here: https://fedoraproject.org/wiki/PcreDeprecation FESCo approval is located here: https://pagure.io/fesco/issue/2862 If your component has already ported to pcre2 or you don't Require/BuildRequire any pcre subpackage, feel free to close this Bugzilla. This Bugzilla was created automatically and some issues might have occurred along the way. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2128335

1 8

[Bug 2143996] New: FTBFS: ncrack on rawhide
by bugzilla＠redhat.com 09 Aug '24

09 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=2143996 Bug ID: 2143996 Summary: FTBFS: ncrack on rawhide Product: Fedora Version: rawhide Status: NEW Component: ncrack Assignee: rebus(a)seznam.cz Reporter: davide(a)cavalca.name QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, rebus(a)seznam.cz, smilner(a)redhat.com Target Milestone: --- Classification: Fedora configure: creating ./config.status config.status: creating Makefile config.status: WARNING: 'Makefile.in' seems to ignore the --datarootdir setting config.status: creating modules/Makefile config.status: creating ncrack_config.h === configuring in nbase (/builddir/build/BUILD/ncrack-0.7/nbase) configure: running /bin/sh ./configure --disable-option-checking '--prefix=/usr' '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--localstatedir=/var' '--runstatedir=/run' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CC=gcc' 'CFLAGS=-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -fcommon' 'LDFLAGS=-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes' 'CXX=g++' 'CXXFLAGS=-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection' '--with-libpcap=no' --cache-file=/dev/null --srcdir=. configure: error: unrecognized option: `--runstatedir=/run' Try `./configure --help' for more information configure: error: ./configure failed for nbase -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2143996

1 15

[Bug 2052682] New: CVE-2022-24303 python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related action
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2052682 Bug ID: 2052682 Summary: CVE-2022-24303 python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related action Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other If the path to the temporary directory on Linux or macOS contained a space, this would break removal of the temporary image file after im.show() (and related actions), and potentially remove an unrelated file. This been present since PIL. Reference: https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2052682

1 11

[Bug 2042527] New: CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2042527 Bug ID: 2042527 Summary: CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. Reference: https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-bu… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042527

1 23

[Bug 2042522] New: CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2042522 Bug ID: 2042522 Summary: CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. References: https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1da… https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-image… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

1 22

[Bug 2042511] New: CVE-2022-22815 python-pillow: improperly initializes ImagePath.Path in path_getbbox() in path.c
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2042511 Bug ID: 2042511 Summary: CVE-2022-22815 python-pillow: improperly initializes ImagePath.Path in path_getbbox() in path.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. References: https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1da… https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-image… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042511

1 19

2025

2024

2023

2022

2021

Epel-packagers-sig November 2022