May 2022 - Epel-packagers-sig - Fedora Mailing-Lists

[Bug 2088233] New: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2088233 Bug ID: 2088233 Summary: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: saroy(a)redhat.com CC: admiller(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, spotrh(a)gmail.com Target Milestone: --- Classification: Other A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. https://bugs.busybox.net/show_bug.cgi?id=14781 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2088233

1 year, 4 months

1
9
0 / 0

[Bug 2089281] New: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service [fedora-35]

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2089281 Bug ID: 2089281 Summary: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service [fedora-35] Product: Fedora Version: 35 Status: NEW Component: busybox Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: spotrh(a)gmail.com Reporter: saroy(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: admiller(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, spotrh(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-35. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2089281

1 year, 4 months

1
4
0 / 0

[Bug 2082465] New: CVE-2022-29167 yarnpkg: hawk: REDoS in hawk.utils.parseHost() when parsing Host header [fedora-all]

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2082465 Bug ID: 2082465 Summary: CVE-2022-29167 yarnpkg: hawk: REDoS in hawk.utils.parseHost() when parsing Host header [fedora-all] Product: Fedora Version: 35 Status: NEW Component: yarnpkg Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: zsvetlik(a)redhat.com Reporter: ahanwate(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2082465

1 year, 4 months

1
4
0 / 0

[Bug 2070960] New: CVE-2022-0841 yarnpkg: npm-lockfile: os command injection [fedora-all]

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2070960 Bug ID: 2070960 Summary: CVE-2022-0841 yarnpkg: npm-lockfile: os command injection [fedora-all] Product: Fedora Version: 35 Status: NEW Component: yarnpkg Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: zsvetlik(a)redhat.com Reporter: mcascell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2070960

1 year, 4 months

1
4
0 / 0

[Bug 2059360] New: yarnpkg for fedora 35 installs binary '/usr/bin/%{fc_name}'

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2059360 Bug ID: 2059360 Summary: yarnpkg for fedora 35 installs binary '/usr/bin/%{fc_name}' Product: Fedora Version: 35 Status: NEW Component: yarnpkg Assignee: zsvetlik(a)redhat.com Reporter: martin.kuehl(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora Description of problem: the current yarnpkg rpm installs a binary at the path '/usr/bin/%{fc_name}' this is also visible at: https://packages.fedoraproject.org/pkgs/yarnpkg/yarnpkg/fedora-35.html#files Version-Release number of selected component (if applicable): yarnpkg-1.22.10-3.fc35 How reproducible: always Steps to Reproduce: 1. dnf repoquery --list yarnpkg | grep /usr/bin or look at https://packages.fedoraproject.org/pkgs/yarnpkg/yarnpkg/fedora-35.html#files Actual results: /usr/bin/%{fc_name} /usr/bin/yarn /usr/bin/yarnpkg Expected results: judging by the package for fedora 36: /usr/bin/nodejs-yarn /usr/bin/yarn /usr/bin/yarnpkg Additional info: if i remember correctly that's rpm spec template syntax so there might be some stray escaping or something? it's also apparently fixed for f36 so backporting that package would be just fine. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2059360

1 year, 4 months

1
3
0 / 0

[Bug 2072386] New: Remove xmlstarlet from epel8

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2072386 Bug ID: 2072386 Summary: Remove xmlstarlet from epel8 Product: Fedora EPEL Version: epel8 Status: NEW Component: xmlstarlet Assignee: stickster(a)gmail.com Reporter: rhel-process-autobot(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: daltonminer(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, stickster(a)gmail.com Target Milestone: --- Classification: Fedora -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2072386

1 year, 5 months

1
6
0 / 0

[Bug 2084488] New: Remove xmlstarlet from epel9

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2084488 Bug ID: 2084488 Summary: Remove xmlstarlet from epel9 Product: Fedora EPEL Version: epel9 Status: NEW Component: xmlstarlet Assignee: stickster(a)gmail.com Reporter: rhel-process-autobot(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: daltonminer(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, stickster(a)gmail.com Target Milestone: --- Classification: Fedora -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2084488

1 year, 5 months

1
5
0 / 0

[Bug 2091263] New: Please update it to 0.23.90 and enable pdf417 support

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2091263 Bug ID: 2091263 Summary: Please update it to 0.23.90 and enable pdf417 support Product: Fedora Version: 35 Status: NEW Component: zbar Assignee: gwync(a)protonmail.com Reporter: bugzilla(a)terrortux.de QA Contact: extras-qa(a)fedoraproject.org CC: dougsland(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, mchehab(a)infradead.org, mr.marcelo.barbosa(a)gmail.com, negativo17(a)gmail.com Target Milestone: --- Classification: Fedora Changes see: https://github.com/mchehab/zbar/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2091263

1 year, 5 months

1
5
0 / 0

[Bug 2081540] New: crc32 and compressions are not supported

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2081540 Bug ID: 2081540 Summary: crc32 and compressions are not supported Product: Fedora Version: rawhide Status: NEW Component: rocksdb Assignee: hegjon(a)gmail.com Reporter: socketpair(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, hegjon(a)gmail.com, mmuzila(a)redhat.com Target Milestone: --- Classification: Fedora Opening (Creating) any RocksDB shows this in the log: 2022/05/04-03:33:21.189455 7f14b298eac0 Compression algorithms supported: 2022/05/04-03:33:21.189459 7f14b298eac0 <------>kZSTD supported: 0 2022/05/04-03:33:21.189463 7f14b298eac0 <------>kXpressCompression supported: 0 2022/05/04-03:33:21.189466 7f14b298eac0 <------>kBZip2Compression supported: 0 2022/05/04-03:33:21.189511 7f14b298eac0 <------>kZSTDNotFinalCompression supported: 0 2022/05/04-03:33:21.189515 7f14b298eac0 <------>kLZ4Compression supported: 0 2022/05/04-03:33:21.189518 7f14b298eac0 <------>kZlibCompression supported: 0 2022/05/04-03:33:21.189521 7f14b298eac0 <------>kLZ4HCCompression supported: 0 2022/05/04-03:33:21.189524 7f14b298eac0 <------>kSnappyCompression supported: 0 2022/05/04-03:33:21.189530 7f14b298eac0 Fast CRC32 supported: Not supported on x86 I think it is wrong. At least, CRC32 offloading SHOULD be enabled on all targets where it exists (I guess not only x86, but also AARCH64). Regarding compression - I would enable them all. Except, possibly, bzip2. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2081540

1 year, 5 months

1
4
0 / 0

[Bug 2083013] New: python-shortuuid-1.0.9 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2083013 Bug ID: 2083013 Summary: python-shortuuid-1.0.9 is available Product: Fedora Version: rawhide Status: NEW Component: python-shortuuid Keywords: FutureFeature, Triaged Assignee: michel(a)michel-slm.name Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, python-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 1.0.9 Current version/release in rawhide: 1.0.8-2.fc36 URL: https://github.com/stochastic-technologies/shortuuid/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/12823/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2083013

1 year, 5 months

1
6
0 / 0

2024

2023

2022

2021

Epel-packagers-sig May 2022