May 2022 - Epel-packagers-sig - Fedora mailing-lists

[Bug 2087911] CVE-2022-1343 openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS
by bugzilla＠redhat.com 23 May '22

23 May '22

1 0

[Bug 2089367] New: [python-typing-extensions][epel]: please build python-typing-extensions in epel9
by bugzilla＠redhat.com 23 May '22

23 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2089367 Bug ID: 2089367 Summary: [python-typing-extensions][epel]: please build python-typing-extensions in epel9 Product: Fedora Version: rawhide Status: NEW Component: python-typing-extensions Assignee: hegjon(a)gmail.com Reporter: kkeithle(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: code(a)musicinmybrain.net, epel-packagers-sig(a)lists.fedoraproject.org, hegjon(a)gmail.com, mail(a)fabian-affolter.ch, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora Description of problem: python-typing-extensions is a BR for python-twisted->python-tblib->->python-python-django->python-opentelemetry->python-xds-protos->grpc->libarrow, which in turn is a BR ceph quincy (17.2.x). While ceph itself will not (ever) be built in EPEL, there are Ceph developers who want to use CentOS Stream or RHEL with EPEL. Note: libarrow and all its dependencies, including python-typing-extenions, are already available from the CentOS Storage SIG. I'm told though that many Ceph devs prefer to use EPEL over the CentOS Storage SIG. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: It builds as is from the rawhide sources (https://koji.fedoraproject.org/koji/taskinfo?taskID=87406597) If you don't wish to build python-typing-extensions in EPEL yourself, please add the epel-packagers-sig group as collaborator for epel* branches, or (less preferable) add me (FAS: kkeithle) as a collaborator for epel* branches. Thanks -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2089367

1 1

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 23 May '22

23 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 Derrick Ornelas <dornelas(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(dornelas(a)redhat.c | |om) | -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2080958] New: CVE-2022-28391 busybox: remote attackers may execute arbitrary code if netstat is used
by bugzilla＠redhat.com 23 May '22

23 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2080958 Bug ID: 2080958 Summary: CVE-2022-28391 busybox: remote attackers may execute arbitrary code if netstat is used Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: mrehak(a)redhat.com CC: admiller(a)redhat.com, caswilli(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, fjansen(a)redhat.com, jburrell(a)redhat.com, kaycoth(a)redhat.com, spotrh(a)gmail.com, tfister(a)redhat.com Target Milestone: --- Classification: Other BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors. Reference: https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2080958

1 4

[Bug 2058882] New: ipython-8.1.0 is available
by bugzilla＠redhat.com 23 May '22

23 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2058882 Bug ID: 2058882 Summary: ipython-8.1.0 is available Product: Fedora Version: rawhide Status: NEW Component: ipython Keywords: FutureFeature, Triaged Assignee: lbalhar(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dcantrell(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, lbalhar(a)redhat.com, mhroncok(a)redhat.com, michel(a)michel-slm.name, mrunge(a)redhat.com, orion(a)nwra.com, python-sig(a)lists.fedoraproject.org, tomspur(a)fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 8.1.0 Current version/release in rawhide: 8.0.1-1.fc36 URL: https://ipython.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1399/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2058882

1 6

[Bug 2088014] [python-sphinx-issues][epel]: please build python-sphinx-issues in epel9
by bugzilla＠redhat.com 21 May '22

21 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2088014 Kaleb KEITHLEY <kkeithle(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|epel-packagers-sig(a)lists.fe |kkeithle(a)redhat.com |doraproject.org | -- You are receiving this mail because: You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2088014

1 0

[Bug 2087610] New: CVE-2022-30595 python-pillow: heap buffer overflow in crafted TGA file [fedora-35]
by bugzilla＠redhat.com 20 May '22

20 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087610 Bug ID: 2087610 Summary: CVE-2022-30595 python-pillow: heap buffer overflow in crafted TGA file [fedora-35] Product: Fedora Version: 35 Status: NEW Component: python-pillow Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: manisandro(a)gmail.com Reporter: saroy(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, python-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-35. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087610

1 3

[Bug 2087612] New: CVE-2022-30595 python-pillow: heap buffer overflow in crafted TGA file [fedora-34]
by bugzilla＠redhat.com 20 May '22

20 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087612 Bug ID: 2087612 Summary: CVE-2022-30595 python-pillow: heap buffer overflow in crafted TGA file [fedora-34] Product: Fedora Version: 34 Status: NEW Component: python-pillow Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: manisandro(a)gmail.com Reporter: saroy(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, python-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-34. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087612

1 3

[Bug 2087261] New: python-pillow-9.1.1 is available
by bugzilla＠redhat.com 20 May '22

20 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087261 Bug ID: 2087261 Summary: python-pillow-9.1.1 is available Product: Fedora Version: rawhide Status: NEW Component: python-pillow Keywords: FutureFeature, Triaged Assignee: manisandro(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, python-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 9.1.1 Current version/release in rawhide: 9.1.0-1.fc37 URL: http://python-pillow.github.io/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/7974/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087261

1 3

[Bug 2088014] [python-sphinx-issues][epel]: please build python-sphinx-issues in epel9
by bugzilla＠redhat.com 19 May '22

19 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2088014 Elliott Sales de Andrade <quantum.analyst(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|quantum.analyst(a)gmail.com |epel-packagers-sig(a)lists.fe | |doraproject.org --- Comment #1 from Elliott Sales de Andrade <quantum.analyst(a)gmail.com> --- I don't, so I've added the group. -- You are receiving this mail because: You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2088014

1 0

2024

2023

2022

2021

Epel-packagers-sig May 2022