August 2022 - Epel-packagers-sig - Fedora mailing-lists

[Bug 2093308] New: CVE-2022-30783 ntfs-3g-system-compression: ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2093308 Bug ID: 2093308 Summary: CVE-2022-30783 ntfs-3g-system-compression: ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093308

1 4

[Bug 2093305] New: CVE-2022-30783 ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2093305 Bug ID: 2093305 Summary: CVE-2022-30783 ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58 https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093305

1 13

[Bug 2093333] New: CVE-2022-30787 ntfs-3g: integer underflow in fuse_lib_readdir enables arbitrary memory read operations
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2093333 Bug ID: 2093333 Summary: CVE-2022-30787 ntfs-3g: integer underflow in fuse_lib_readdir enables arbitrary memory read operations Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58 https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093333

1 13

[Bug 2093336] New: CVE-2022-30787 ntfs-3g-system-compression: ntfs-3g: integer underflow in fuse_lib_readdir enables arbitrary memory read operations [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2093336 Bug ID: 2093336 Summary: CVE-2022-30787 ntfs-3g-system-compression: ntfs-3g: integer underflow in fuse_lib_readdir enables arbitrary memory read operations [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093336

1 4

[Bug 2093320] New: CVE-2022-30785 ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2093320 Bug ID: 2093320 Summary: CVE-2022-30785 ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58 https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093320

1 13

[Bug 2093323] New: CVE-2022-30785 ntfs-3g-system-compression: ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations [epel-all]
by bugzilla＠redhat.com 11 Mar '25

11 Mar '25

https://bugzilla.redhat.com/show_bug.cgi?id=2093323 Bug ID: 2093323 Summary: CVE-2022-30785 ntfs-3g-system-compression: ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093323

1 4

[Bug 2097004] New: stalonetray-0.8.4 is available
by bugzilla＠redhat.com 13 Feb '25

13 Feb '25

https://bugzilla.redhat.com/show_bug.cgi?id=2097004 Bug ID: 2097004 Summary: stalonetray-0.8.4 is available Product: Fedora Version: rawhide Status: NEW Component: stalonetray Keywords: FutureFeature, Triaged Assignee: fedora(a)me.benboeckel.net Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)me.benboeckel.net Target Milestone: --- Classification: Fedora Releases retrieved: 0.8.4 Upstream release that is considered latest: 0.8.4 Current version/release in rawhide: 0.8.3-16.fc36 URL: https://github.com/kolbusa/stalonetray Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/5713/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/stalonetray -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097004

1 4

[Bug 2069364] New: CVE-2021-43085 openssl: Insecure permissions vulnerability due to an error in the implementation of the CMAC_Final() function
by bugzilla＠redhat.com 08 Jan '25

08 Jan '25

https://bugzilla.redhat.com/show_bug.cgi?id=2069364 Bug ID: 2069364 Summary: CVE-2021-43085 openssl: Insecure permissions vulnerability due to an error in the implementation of the CMAC_Final() function Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: aos-bugs(a)redhat.com, asoldano(a)redhat.com, bbaranow(a)redhat.com, bdettelb(a)redhat.com, berrange(a)redhat.com, bmaxwell(a)redhat.com, bootloader-eng-team(a)redhat.com, brian.stansberry(a)redhat.com, caswilli(a)redhat.com, cdewolf(a)redhat.com, cfergeau(a)redhat.com, chazlett(a)redhat.com, crobinso(a)redhat.com, crypto-team(a)lists.fedoraproject.org, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dbelyavs(a)redhat.com, dhalasz(a)redhat.com, dkreling(a)redhat.com, dkuc(a)redhat.com, dosoudil(a)redhat.com, dueno(a)redhat.com, elima(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, erik-fedora(a)vanpienbroek.nl, f4bug(a)amsat.org, fjansen(a)redhat.com, fjuma(a)redhat.com, fmartine(a)redhat.com, gparvin(a)redhat.com, gzaronik(a)redhat.com, iweiss(a)redhat.com, jburrell(a)redhat.com, jclere(a)redhat.com, jkoehler(a)redhat.com, jochrist(a)redhat.com, jramanat(a)redhat.com, jwong(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, krathod(a)redhat.com, kraxel(a)redhat.com, ktietz(a)redhat.com, lgao(a)redhat.com, marcandre.lureau(a)redhat.com, michal.skrivanek(a)redhat.com, michel(a)michel-slm.name, micjohns(a)redhat.com, mjg59(a)srcf.ucam.org, mosmerov(a)redhat.com, mperina(a)redhat.com, msochure(a)redhat.com, mspacek(a)redhat.com, msvehla(a)redhat.com, mturk(a)redhat.com, njean(a)redhat.com, nobody(a)redhat.com, nwallace(a)redhat.com, pahickey(a)redhat.com, pbonzini(a)redhat.com, pjindal(a)redhat.com, pjones(a)redhat.com, pmackay(a)redhat.com, redhat-bugzilla(a)linuxnetz.de, rfreiman(a)redhat.com, rharwood(a)redhat.com, rh-spice-bugs(a)redhat.com, rjones(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, sahana(a)redhat.com, sbonazzo(a)redhat.com, smaestri(a)redhat.com, stcannon(a)redhat.com, sthirugn(a)redhat.com, szappis(a)redhat.com, tmeszaro(a)redhat.com, tm(a)t8m.info, tom.jenkinson(a)redhat.com, virt-maint(a)lists.fedoraproject.org, virt-maint(a)redhat.com, vkrizan(a)redhat.com, vkumar(a)redhat.com, vmugicag(a)redhat.com Target Milestone: --- Classification: Other An Insecure Permissions vulnerability exists in the OpenSSL Project 3.0 due to an error in the implementation of the CMAC_Final() function. Upstream issue: https://github.com/openssl/openssl/issues/16873 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2069364

1 4

[Bug 2121894] New: builtins.h requires mpc.h from libmpc-devel
by bugzilla＠redhat.com 13 Aug '24

13 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=2121894 Bug ID: 2121894 Summary: builtins.h requires mpc.h from libmpc-devel Product: Fedora Version: 36 Hardware: x86_64 OS: Linux Status: NEW Component: cross-gcc Severity: medium Assignee: dhowells(a)redhat.com Reporter: elliott(a)hpe.com QA Contact: extras-qa(a)fedoraproject.org CC: dan(a)danny.cz, dhowells(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, lkundrak(a)v3.sk Target Milestone: --- Classification: Fedora Description of problem: Cross compiles of the linux kernel 6.0-rc1 allmodconfig fail for arm, arm64, mips, powerpc, and s390. This originates in scripts/gcc-plugins/Kconfig, which has this entry: menuconfig GCC_PLUGINS bool "GCC plugins" depends on HAVE_GCC_PLUGINS depends on CC_IS_GCC depends on $(success,test -e $(shell,$(CC) -print-file-name=plugin)/include/plugin-version.h) default y depends on $(success,test -e $(shell,$(CC) -print-file-name=plugin)/include/plugin-version.h) arch/sparc/Kconfig does not include select HAVE_GCC_PLUGINS but all the others do. The -print-file-name tests passes for all the cross-compilers, but does not for native x86: $ gcc -print-file-name=plugin plugin $ powerpc64-linux-gnu-gcc -print-file-name=plugin /usr/lib/gcc/powerpc64-linux-gnu/12/plugin $ aarch64-linux-gnu-gcc -print-file-name=plugin /usr/lib/gcc/aarch64-linux-gnu/12/plugin $ find /usr/lib/gcc -name plugin-version.h /usr/lib/gcc/s390x-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/aarch64-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/powerpc64-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/sparc64-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/arm-linux-gnueabi/12/plugin/include/plugin-version.h /usr/lib/gcc/mips64-linux-gnu/12/plugin/include/plugin-version.h so the .x86 .config file only gets: CONFIG_HAVE_GCC_PLUGINS=y while the others get that, CONFIG_GCC_PLUGINS, and a several specific plugins: build-arm64/.config:CONFIG_HAVE_GCC_PLUGINS=y build-arm64/.config:CONFIG_GCC_PLUGINS=y build-arm64/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-arm64/.config:CONFIG_GCC_PLUGIN_STACKLEAK=y build-arm64/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-arm/.config:CONFIG_HAVE_GCC_PLUGINS=y build-arm/.config:CONFIG_GCC_PLUGINS=y build-arm/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-arm/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-mips/.config:CONFIG_HAVE_GCC_PLUGINS=y build-mips/.config:CONFIG_GCC_PLUGINS=y build-mips/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-mips/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-powerpc/.config:CONFIG_HAVE_GCC_PLUGINS=y build-powerpc/.config:CONFIG_GCC_PLUGINS=y build-powerpc/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-powerpc/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-s390/.config:CONFIG_HAVE_GCC_PLUGINS=y build-s390/.config:CONFIG_GCC_PLUGINS=y build-s390/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-s390/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-x86/.config:CONFIG_HAVE_GCC_PLUGINS=y A header included by each of the plugins, scripts/gcc-plugins/gcc-common.h, includes a GCC header file called builtins.h that includes <mpc.h>, which does not exist anywhere on my system. That causes errors early in the build on all of those architectures. Version-Release number of selected component (if applicable): gcc-[each architecture]-linux-gnu 12.1.1 How reproducible: 100% Steps to Reproduce: Example for arm 32-bit: 1. make ARCH=arm O=build-arm CROSS_COMPILE=arm-linux-gnu- allmodconfig 2. make ARCH=arm O=build-arm CROSS_COMPILE=arm-linux-gnu- -j 55 Actual results: For each "GCC plugin", an error like this terminates the make: In file included from ../scripts/gcc-plugins/gcc-common.h:95, from ../scripts/gcc-plugins/latent_entropy_plugin.c:78: /usr/lib/gcc/aarch64-linux-gnu/12/plugin/include/builtins.h:23:10: fatal error: mpc.h: No such file or directory 23 | #include <mpc.h> | ^~~~~~~ compilation terminated. Expected results: no errors Additional info: That mpc.h file is provided by the libmpc-devel package. 1. Please add a dependency for the libmpc-devel package from each gcc cross-compiler package that includes a builtins.h file 2. Please investigate whether the native gcc package not having plugins is correct, despite the kernel x86 allmodconfig expecting them by specifying CONFIG_HAVE_GCC_PLUGINS=y -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2121894

1 6

[Bug 2052682] New: CVE-2022-24303 python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related action
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2052682 Bug ID: 2052682 Summary: CVE-2022-24303 python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related action Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other If the path to the temporary directory on Linux or macOS contained a space, this would break removal of the temporary image file after im.show() (and related actions), and potentially remove an unrelated file. This been present since PIL. Reference: https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2052682

1 11

[Bug 2042527] New: CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2042527 Bug ID: 2042527 Summary: CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. Reference: https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-bu… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042527

1 23

[Bug 2042522] New: CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2042522 Bug ID: 2042522 Summary: CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. References: https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1da… https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-image… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

1 22

[Bug 2042511] New: CVE-2022-22815 python-pillow: improperly initializes ImagePath.Path in path_getbbox() in path.c
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2042511 Bug ID: 2042511 Summary: CVE-2022-22815 python-pillow: improperly initializes ImagePath.Path in path_getbbox() in path.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. References: https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1da… https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-image… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042511

1 19

[Bug 2093731] New: zbarimg does not read a Code 128 barcode
by bugzilla＠redhat.com 25 May '24

25 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2093731 Bug ID: 2093731 Summary: zbarimg does not read a Code 128 barcode Product: Fedora Version: 36 Status: NEW Component: zbar Severity: high Assignee: gwync(a)protonmail.com Reporter: cristian.ciupitu(a)yahoo.com QA Contact: extras-qa(a)fedoraproject.org CC: dougsland(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, mchehab(a)infradead.org, mr.marcelo.barbosa(a)gmail.com, negativo17(a)gmail.com Target Milestone: --- Classification: Fedora Created attachment 1886898 --> https://bugzilla.redhat.com/attachment.cgi?id=1886898&action=edit Code 128 barcode Description of problem: zbarimg does not read a Code 128 barcode Version-Release number of selected component (if applicable): zbar-0.23.90-1.fc36.x86_64 How reproducible: Every time Steps to Reproduce: 1. zbarimg barcode.png Actual results: scanned 0 barcode symbols from 1 images in 0 seconds WARNING: barcode data was not detected in some image(s) Things to check: - is the barcode type supported? Currently supported symbologies are: . EAN/UPC (EAN-13, EAN-8, EAN-2, EAN-5, UPC-A, UPC-E, ISBN-10, ISBN-13) . DataBar, DataBar Expanded . Code 128 . Code 93 . Code 39 . Codabar . Interleaved 2 of 5 . QR code . SQ code . PDF 417 - is the barcode large enough in the image? - is the barcode mostly in focus? - is there sufficient contrast/illumination? - If the symbol is split in several barcodes, are they combined in one image? - Did you enable the barcode type? some EAN/UPC codes are disabled by default. To enable all, use: $ zbarimg -S*.enable <files> Please also notice that some variants take precedence over others. Due to that, if you want, for example, ISBN-10, you should do: $ zbarimg -Sisbn10.enable <files> Expected results: (Code 128) 755897201062022179.73 Additional info: -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093731

1 7

[Bug 2120537] New: 'bodhi updates new' does not report error/warning when setting karma limit below minimal value for package in critical path
by bugzilla＠redhat.com 21 May '24

21 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2120537 Bug ID: 2120537 Summary: 'bodhi updates new' does not report error/warning when setting karma limit below minimal value for package in critical path Product: Fedora Version: rawhide Status: NEW Component: bodhi-client Assignee: thrcka(a)redhat.com Reporter: zdohnal(a)redhat.com CC: aurelien(a)bompard.org, epel-packagers-sig(a)lists.fedoraproject.org, lenka(a)sepu.cz, thrcka(a)redhat.com Target Milestone: --- Classification: Fedora Hi, I was surprised why my bodhi update ( https://bodhi.fedoraproject.org/updates/FEDORA-2022-6f5e420e52 ) doesn't show an option for pushing into stable or why the update is not in stable already, because the positive karma limit (1) is reached. On #fedora-devel IRC channel kalev answered: (09:34:34 AM) zdohnal: Hi all, do you have an idea what blocks this update https://bodhi.fedoraproject.org/updates/FEDORA-2022-6f5e420e52 from being pushed to the stable? (09:38:32 AM) kalev: zdohnal: looks like it's marked as critical path and because of that, it needs minimum of +2 karma to be pushed to stable (09:40:19 AM) GrannyGoose left the room (quit: Quit: Going offline, see ya! (www.adiirc.com)) (09:41:00 AM) zdohnal: kalev: aha - good to know. However bodhi-client should give me error when I set karma below this limit... According to the conversation, there is karma limit for components in critical path and it is higher - 2 - than the limit set by me - 1, which causes confusion. I use 'bodhi updates new' CLI command for creating updates, and I didn't see any error/warning regarding setting the karma limit too low. IMHO CLI command has to fail if user tries to set the limit too low, and bodhi web UI should handle this in some way as well. Would you mind looking into it? Version-Release number of selected component (if applicable): bodhi-client-6.0.1-4.fc37 How reproducible: always Steps to Reproduce: 1. $ bodhi updates new --type bugfix --close-bugs --request testing --autokarma --autotime --stable-karma 1 --unstable-karma -1 --notes "Update for component in critical path" <critical-component-1.2.3-1.fc37> Actual results: No error or warning, bodhi web ui shows user defined limit and the update has karma to fulfill the limit, but the update is not pushed into stable. Expected results: Give error (in both interfaces - CLI and Web UI) if user wants to set lower karma limit than it is required on the package. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2120537

1 2

[Bug 2065645] New: Gmime 3.2.9 is available
by bugzilla＠redhat.com 01 Dec '23

01 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2065645 Bug ID: 2065645 Summary: Gmime 3.2.9 is available Product: Fedora Version: rawhide Hardware: All Status: NEW Component: gmime30 Severity: medium Assignee: klember(a)redhat.com Reporter: mjg(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, klember(a)redhat.com Target Milestone: --- Link ID: Github jstedfast/gmime/releases/tag/3.2.9 Classification: Fedora Description of problem: Gmime 3.2.7 as packaged is outdated (Mar 2020). Version-Release number of selected component (if applicable): 3.2.7-5 How reproducible: always Steps to Reproduce: 1. dnf list gmime30 Actual results: gmime30-3.2.7 Expected results: gmime30-3.2.9 Additional info: The real upstream has been at https://github.com/jstedfast/gmime/ for quite some time now (not on gnome any more, and never on gitlab). -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2065645

1 12

[Bug 2078238] New: gssdp-1.5.0 is available
by bugzilla＠redhat.com 22 Nov '23

22 Nov '23

https://bugzilla.redhat.com/show_bug.cgi?id=2078238 Bug ID: 2078238 Summary: gssdp-1.5.0 is available Product: Fedora Version: rawhide Status: NEW Component: gssdp Keywords: FutureFeature, Triaged Assignee: klember(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, klember(a)redhat.com, zeenix(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 1.5.0 Current version/release in rawhide: 1.4.0.1-2.fc36 URL: https://developer.gnome.org/gssdp/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1262/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2078238

1 27

[Bug 2081494] New: CVE-2022-1292 openssl: c_rehash script allows command injection
by bugzilla＠redhat.com 08 Nov '23

08 Nov '23

https://bugzilla.redhat.com/show_bug.cgi?id=2081494 Bug ID: 2081494 Summary: CVE-2022-1292 openssl: c_rehash script allows command injection Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: pdelbell(a)redhat.com CC: aos-bugs(a)redhat.com, asoldano(a)redhat.com, bbaranow(a)redhat.com, bdettelb(a)redhat.com, berrange(a)redhat.com, bmaxwell(a)redhat.com, bootloader-eng-team(a)redhat.com, brian.stansberry(a)redhat.com, caswilli(a)redhat.com, cdewolf(a)redhat.com, cfergeau(a)redhat.com, chazlett(a)redhat.com, crobinso(a)redhat.com, crypto-team(a)lists.fedoraproject.org, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dbelyavs(a)redhat.com, ddepaula(a)redhat.com, dhalasz(a)redhat.com, dkreling(a)redhat.com, dkuc(a)redhat.com, dosoudil(a)redhat.com, dueno(a)redhat.com, elima(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, erik-fedora(a)vanpienbroek.nl, f4bug(a)amsat.org, fjansen(a)redhat.com, fjuma(a)redhat.com, fmartine(a)redhat.com, gparvin(a)redhat.com, gzaronik(a)redhat.com, iweiss(a)redhat.com, jburrell(a)redhat.com, jclere(a)redhat.com, jferlan(a)redhat.com, jkoehler(a)redhat.com, jochrist(a)redhat.com, jramanat(a)redhat.com, jwong(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, krathod(a)redhat.com, kraxel(a)redhat.com, ktietz(a)redhat.com, lgao(a)redhat.com, marcandre.lureau(a)redhat.com, michal.skrivanek(a)redhat.com, michel(a)michel-slm.name, micjohns(a)redhat.com, mjg59(a)srcf.ucam.org, mosmerov(a)redhat.com, mperina(a)redhat.com, msochure(a)redhat.com, mspacek(a)redhat.com, msvehla(a)redhat.com, mturk(a)redhat.com, njean(a)redhat.com, nwallace(a)redhat.com, pahickey(a)redhat.com, pbonzini(a)redhat.com, pjindal(a)redhat.com, pjones(a)redhat.com, pmackay(a)redhat.com, redhat-bugzilla(a)linuxnetz.de, rfreiman(a)redhat.com, rharwood(a)redhat.com, rh-spice-bugs(a)redhat.com, rjones(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, sahana(a)redhat.com, sbonazzo(a)redhat.com, smaestri(a)redhat.com, stcannon(a)redhat.com, sthirugn(a)redhat.com, szappis(a)redhat.com, tmeszaro(a)redhat.com, tm(a)t8m.info, tom.jenkinson(a)redhat.com, virt-maint(a)lists.fedoraproject.org, virt-maint(a)redhat.com, vkrizan(a)redhat.com, vkumar(a)redhat.com, vmugicag(a)redhat.com Target Milestone: --- Classification: Other The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. OpenSSL 1.0.2 users should upgrade to 1.0.2ze OpenSSL 1.1.1 users should upgrade to 1.1.1o OpenSSL 3.0 users should upgrade to 3.0.3 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2081494

1 53

[Bug 2090572] New: CVE-2022-21680 thrift: marked: regular expression block.def may lead Denial of Service [epel-all]
by bugzilla＠redhat.com 16 Jun '23

16 Jun '23

https://bugzilla.redhat.com/show_bug.cgi?id=2090572 Bug ID: 2090572 Summary: CVE-2022-21680 thrift: marked: regular expression block.def may lead Denial of Service [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: thrift Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: ctubbsii(a)fedoraproject.org Reporter: saroy(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: ctubbsii(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, milleruntime(a)gmail.com, orion(a)nwra.com, willb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2090572

1 3

[Bug 2092715] New: CVE-2022-21681 thrift: marked: regular expression inline.reflinkSearch may lead Denial of Service [epel-all]
by bugzilla＠redhat.com 16 Jun '23

16 Jun '23

https://bugzilla.redhat.com/show_bug.cgi?id=2092715 Bug ID: 2092715 Summary: CVE-2022-21681 thrift: marked: regular expression inline.reflinkSearch may lead Denial of Service [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: thrift Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: ctubbsii(a)fedoraproject.org Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: ctubbsii(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, milleruntime(a)gmail.com, orion(a)nwra.com, willb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2092715

1 3

[Bug 2094052] New: CVE-2021-4231 angular: XSS vulnerability
by bugzilla＠redhat.com 15 Jun '23

15 Jun '23

https://bugzilla.redhat.com/show_bug.cgi?id=2094052 Bug ID: 2094052 Summary: CVE-2021-4231 angular: XSS vulnerability Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aileenc(a)redhat.com, amctagga(a)redhat.com, amurdaca(a)redhat.com, andrew.slice(a)redhat.com, aoconnor(a)redhat.com, asm(a)redhat.com, bniver(a)redhat.com, bodavis(a)redhat.com, branto(a)redhat.com, chazlett(a)redhat.com, danmick(a)gmail.com, david(a)gnsa.us, dbhole(a)redhat.com, decathorpe(a)gmail.com, deparker(a)redhat.com, dwd(a)fedoraproject.org, eduardo.ramalho(a)gmail.com, epel-packagers-sig(a)lists.fedoraproject.org, erack(a)redhat.com, fedora(a)zaniyah.org, flucifre(a)redhat.com, fmuellner(a)redhat.com, fzatlouk(a)redhat.com, gecko-bugs-nobody(a)fedoraproject.org, gmalinko(a)redhat.com, gmeno(a)redhat.com, go-sig(a)lists.fedoraproject.org, i(a)stingr.net, janstey(a)redhat.com, jcajka(a)cajka.dev, jhorak(a)redhat.com, jochrist(a)redhat.com, josef(a)toxicpanda.com, jwon(a)redhat.com, kai-engert-fedora(a)kuix.de, kanderso(a)redhat.com, kkeithle(a)redhat.com, klaas(a)demter.de, klember(a)redhat.com, lemenkov(a)gmail.com, loic(a)dachary.org, lvaleeva(a)redhat.com, madam(a)redhat.com, mbenjamin(a)redhat.com, mhackett(a)redhat.com, muagarwa(a)redhat.com, ngompa13(a)gmail.com, ocs-bugs(a)redhat.com, omajid(a)redhat.com, pdelbell(a)redhat.com, pjasicek(a)redhat.com, polkit-devel(a)redhat.com, ramkrsna(a)gmail.com, rhughes(a)redhat.com, rstrode(a)redhat.com, rwagner(a)redhat.com, sandmann(a)redhat.com, sostapov(a)redhat.com, steve(a)silug.org, stransky(a)redhat.com, thofmann(a)fedoraproject.org, tpopela(a)redhat.com, trpost(a)rocketmail.com, vereddy(a)redhat.com, zebob.m(a)gmail.com, zsvetlik(a)redhat.com Blocks: 2094048 Target Milestone: --- Classification: Other A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component. References: https://vuldb.com/?id.181356 https://github.com/angular/angular/issues/40136 https://security.snyk.io/vuln/SNYK-JS-ANGULARCORE-1070902 https://github.com/angular/angular/commit/ba8da742e3b243e8f43d4c63aa842b44e… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2094052

1 9

[Bug 2032607] New: F36FailsToInstall: hyperkitty
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2032607 Bug ID: 2032607 Summary: F36FailsToInstall: hyperkitty Product: Fedora Version: rawhide Status: NEW Component: python-hyperkitty Assignee: michel(a)michel-slm.name Reporter: mhroncok(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, python-sig(a)lists.fedoraproject.org Blocks: 1992487 (F36FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically. If you feel that this output has mistakes, please contact me via email (mhroncok(a)redhat.com) Your package (python-hyperkitty) Fails To Install in Fedora 36: can't install hyperkitty: - nothing provides python3.10dist(flufl-lock) >= 4 needed by hyperkitty-1.3.5-1.fc36.noarch - nothing provides python3.10dist(mistune) >= 2~rc1 needed by hyperkitty-1.3.5-1.fc36.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1992487 [Bug 1992487] Fedora 36 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2032607

1 19

[Bug 2063508] New: authentication recquired The password you use does not match
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2063508 Bug ID: 2063508 Summary: authentication recquired The password you use does not match Product: Fedora Version: 36 OS: Linux Status: NEW Component: keyrings-filesystem Severity: high Assignee: manisandro(a)gmail.com Reporter: jjb(a)xs4all.nl QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, sergio(a)serjux.com Target Milestone: --- Classification: Fedora Description of problem: Keyring is locked. (in Passwords and Keys, Seahorse) try to solve error message "authentication required, the password you use to log in to your computer no longer match that of your login keyring" The known password is not accepted. Version-Release number of selected component (if applicable): How reproducible: try to Get Geary (email program) at work. At login to the computer the password is working all right. Steps to Reproduce: 1. 2. 3. Actual results: cannot authenticate password. Expected results: no question of authentication Additional info: do not know how to solve this problem. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2063508

1 5

[Bug 2090622] New: [abrt] xmlstarlet: xmlXPathCompUnaryExpr(): xmlstarlet killed by SIGSEGV
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2090622 Bug ID: 2090622 Summary: [abrt] xmlstarlet: xmlXPathCompUnaryExpr(): xmlstarlet killed by SIGSEGV Product: Fedora Version: 36 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:fae15203a4426ff6ea89539d9cb4c1ae9473b845;VAR IANT_ID=workstation; Component: xmlstarlet Assignee: stickster(a)gmail.com Reporter: mf.flip(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: daltonminer(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, stickster(a)gmail.com Target Milestone: --- Classification: Fedora Version-Release number of selected component: xmlstarlet-1.6.1-18.fc36 Additional info: reporter: libreport-2.17.1 backtrace_rating: 4 cgroup: 0::/user.slice/user-1000.slice/user@1000.service/app.slice/vte-spawn-b6417f15-9599-4249-82d4-24ff704344e1.scope cmdline: xmlstarlet ed --without-comments activemq.xml crash_function: xmlXPathCompUnaryExpr executable: /usr/bin/xmlstarlet journald_cursor: s=952f321409164e31aecdcfe29dabfc09;i=2c2dd8;b=d8a42405eec240a19c823e14d4731d5c;m=7ac1a3fe9;t=5dfd855906ebd;x=1c1ad98bbbf498bf kernel: 5.17.9-300.fc36.x86_64 rootdir: / runlevel: N 5 type: CCpp uid: 1000 Truncated backtrace: Thread no. 1 (10 frames) #0 xmlXPathCompUnaryExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10736 #1 xmlXPathCompMultiplicativeExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10769 #2 xmlXPathCompAdditiveExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10810 #3 xmlXPathCompRelationalExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10848 #4 xmlXPathCompEqualityExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10887 #5 xmlXPathCompAndExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10918 #6 xmlXPathCompileExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10956 #7 xmlXPathEvalExpr__internal_alias at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:14426 #9 xmlXPathEval__internal_alias at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:14466 #10 xmlXPathEvalExpression__internal_alias at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:14541 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2090622

1 2

[Bug 2107574] New: fortune(6) man page indentation is messed up for -o and -s options
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2107574 Bug ID: 2107574 Summary: fortune(6) man page indentation is messed up for -o and -s options Product: Fedora Version: 36 Status: NEW Component: fortune-mod Severity: low Assignee: sheltren(a)fedoraproject.org Reporter: rhbugs(a)n-dimensional.de QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, sergio(a)serjux.com, sheltren(a)fedoraproject.org, shlomif(a)shlomifish.org Target Milestone: --- Classification: Fedora Created attachment 1897376 --> https://bugzilla.redhat.com/attachment.cgi?id=1897376&action=edit Quick fix patch to the fortune.6 file, copying the formatting -i and -n Description of problem: In the fortune(6) man page, the indentation for the description of the options -o and -s is wrong. Version-Release number of selected component (if applicable): fortune-mod-3.12.0-2.fc36.x86_64 How reproducible: 100% Steps to Reproduce: 1. man fortune 2. type /record or scroll down Actual results: filename-record will precede the records from the file it names. -n length Set the longest fortune length (in characters) considered to be “short” (the default is 160). All fortunes longer than this are considered “long”. Be careful! If you set the length too short and ask for short fortunes, or too long and ask for long ones, fortune goes into a never-ending thrash loop. -o Choose only from potentially offensive aphorisms. The -o option is ignored if a fortune directory is specified. Please, please, please request a potentially offensive fortune if and only if you believe, deep in your heart, that you are willing to be offended. (And that you'll just quit using -o rather than give us grief about it, okay?) ... let us keep in mind the basic governing philosophy of The Brotherhood, as handsomely summarized in these words: we believe in healthy, hearty laughter -- at the expense of the whole human race, if needs be. Needs be. --H. Allen Smith, "Rude Jokes" -s Short apothegms only. See -n on which fortunes are considered “short”. -i Ignore case for -m patterns. Expected results: filename-record will precede the records from the file it names. -n length Set the longest fortune length (in characters) considered to be “short” (the default is 160). All fortunes longer than this are considered “long”. Be careful! If you set the length too short and ask for short fortunes, or too long and ask for long ones, fortune goes into a never-ending thrash loop. -o Choose only from potentially offensive aphorisms. The -o option is ignored if a fortune directory is specified. Please, please, please request a potentially offensive fortune if and only if you believe, deep in your heart, that you are willing to be offended. (And that you'll just quit using -o rather than give us grief about it, okay?) ... let us keep in mind the basic governing philosophy of The Brotherhood, as handsomely summarized in these words: we believe in healthy, hearty laughter -- at the expense of the whole human race, if needs be. Needs be. --H. Allen Smith, "Rude Jokes" -s Short apothegms only. See -n on which fortunes are considered “short”. -i Ignore case for -m patterns. Additional info: The attached patch only fixes the symptoms, not the root cause. This should probably be fixed somewhere upstream deep inside the mass of perl scripts building the man pages. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107574

1 4

[Bug 2104905] New: CVE-2022-2097 openssl: AES OCB fails to encrypt some bytes
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2104905 Bug ID: 2104905 Summary: CVE-2022-2097 openssl: AES OCB fails to encrypt some bytes Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mcascell(a)redhat.com CC: bdettelb(a)redhat.com, berrange(a)redhat.com, bootloader-eng-team(a)redhat.com, caswilli(a)redhat.com, cfergeau(a)redhat.com, cllang(a)redhat.com, crobinso(a)redhat.com, crypto-team(a)lists.fedoraproject.org, csutherl(a)redhat.com, dbelyavs(a)redhat.com, ddepaula(a)redhat.com, dffrench(a)redhat.com, dhalasz(a)redhat.com, dkuc(a)redhat.com, dueno(a)redhat.com, elima(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, erik-fedora(a)vanpienbroek.nl, f4bug(a)amsat.org, fjansen(a)redhat.com, fmartine(a)redhat.com, gzaronik(a)redhat.com, jary(a)redhat.com, jburrell(a)redhat.com, jclere(a)redhat.com, jferlan(a)redhat.com, jkoehler(a)redhat.com, jwong(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, krathod(a)redhat.com, kraxel(a)redhat.com, kshier(a)redhat.com, ktietz(a)redhat.com, marcandre.lureau(a)redhat.com, michal.skrivanek(a)redhat.com, michel(a)michel-slm.name, micjohns(a)redhat.com, mjg59(a)srcf.ucam.org, mmadzin(a)redhat.com, mperina(a)redhat.com, mspacek(a)redhat.com, mturk(a)redhat.com, ngough(a)redhat.com, pbonzini(a)redhat.com, peholase(a)redhat.com, pjindal(a)redhat.com, pjones(a)redhat.com, plodge(a)redhat.com, redhat-bugzilla(a)linuxnetz.de, rgodfrey(a)redhat.com, rharwood(a)redhat.com, rh-spice-bugs(a)redhat.com, rjones(a)redhat.com, sahana(a)redhat.com, sbonazzo(a)redhat.com, stcannon(a)redhat.com, sthirugn(a)redhat.com, szappis(a)redhat.com, tfister(a)redhat.com, tm(a)t8m.info, virt-maint(a)lists.fedoraproject.org, virt-maint(a)redhat.com, vkrizan(a)redhat.com, vkumar(a)redhat.com, vmugicag(a)redhat.com Blocks: 2104175 Target Milestone: --- Classification: Other AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. OpenSSL security advisory: https://www.openssl.org/news/secadv/20220705.txt Upstream fix: https://github.com/openssl/openssl/commit/6ebf6d51596f51d23ccbc17930778d104… [master] https://github.com/openssl/openssl/commit/919925673d6c9cfed3c1085497f5dfbbe… [1_1_1-stable] https://github.com/openssl/openssl/commit/a98f339ddd7e8f487d6e0088d4a9a4232… [openssl-3.0] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2104905

1 20

[Bug 2119663] New: [abrt] ImageMagick: MagickSignalHandler(): convert killed by SIGABRT
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2119663 Bug ID: 2119663 Summary: [abrt] ImageMagick: MagickSignalHandler(): convert killed by SIGABRT Product: Fedora Version: 36 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:99097730e8acace0088df17b6d8c7e8cabcd7117;VAR IANT_ID=workstation; Component: ImageMagick Assignee: luya_tfz(a)thefinalzone.net Reporter: EldarK(a)outlook.com QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora Version-Release number of selected component: ImageMagick-1:6.9.12.52-1.fc36 Additional info: reporter: libreport-2.17.1 backtrace_rating: 4 cgroup: 0::/user.slice/user-1000.slice/user@1000.service/app.slice/app-gnome-variety-4755.scope cmdline: convert /home/eldar/.config/variety/Downloaded/Unsplash/photo-1659782682835-bf57d0f0bee4.jpg -auto-orient /home/eldar/.config/variety/wallpaper/wallpaper-auto-rotated-620c47dc4cdbd5f227b0e1d753b50b2f.jpg crash_function: MagickSignalHandler executable: /usr/bin/convert journald_cursor: s=9340a345271846d3b1e89d8cb69dd7b7;i=3a5f;b=30c3a79f23984832a0bb195d5db5f7f8;m=17c174a0f;t=5e68547d57561;x=a5e9921b867075a9 kernel: 5.18.17-200.fc36.x86_64 rootdir: / runlevel: N 5 type: CCpp uid: 1000 Truncated backtrace: Thread no. 1 (10 frames) #10 MagickSignalHandler at magick/magick.c:1191 #12 __memmove_sse2_unaligned_erms at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:273 #13 memcpy at /usr/include/bits/string_fortified.h:29 #14 ReadBlob at magick/blob.c:3310 #15 FillInputBuffer at coders/jpeg.c:256 #16 jpeg_fill_bit_buffer at /usr/src/debug/libjpeg-turbo-2.1.2-2.fc36.x86_64/jdhuff.c:305 #17 decode_mcu_AC_first at /usr/src/debug/libjpeg-turbo-2.1.2-2.fc36.x86_64/jdphuff.c:402 #18 consume_data at /usr/src/debug/libjpeg-turbo-2.1.2-2.fc36.x86_64/jdcoefct.c:235 #19 jpeg_start_decompress at /usr/src/debug/libjpeg-turbo-2.1.2-2.fc36.x86_64/jdapistd.c:67 #20 ReadJPEGImage_ at coders/jpeg.c:1437 Potential duplicate: bug 1644520 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2119663

1 2

[Bug 2117860] New: Please branch and build libappindicator-devel in epel8.
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2117860 Bug ID: 2117860 Summary: Please branch and build libappindicator-devel in epel8. Product: Fedora Version: 36 Status: NEW Component: libappindicator Assignee: echevemaster(a)gmail.com Reporter: markus.muckhoff(a)softwaretechnik-und-mehr.de QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, echevemaster(a)gmail.com, epel-packagers-sig(a)lists.fedoraproject.org, mailinglists(a)tpokorra.de, michel(a)michel-slm.name, ngompa13(a)gmail.com, oliver(a)redhat.com, philip.wyett(a)kathenas.org Target Milestone: --- Classification: Fedora Please branch and build libappindicator-devel in epel8. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2117860

1 7

[Bug 2092724] New: CVE-2022-21681 thrift: marked: regular expression inline.reflinkSearch may lead Denial of Service [fedora-all]
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2092724 Bug ID: 2092724 Summary: CVE-2022-21681 thrift: marked: regular expression inline.reflinkSearch may lead Denial of Service [fedora-all] Product: Fedora Version: 36 Status: NEW Component: thrift Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: ctubbsii(a)fedoraproject.org Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: ctubbsii(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, milleruntime(a)gmail.com, orion(a)nwra.com, willb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2092724

1 4

[Bug 2090581] New: CVE-2022-21680 thrift: marked: regular expression block.def may lead Denial of Service [fedora-all]
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2090581 Bug ID: 2090581 Summary: CVE-2022-21680 thrift: marked: regular expression block.def may lead Denial of Service [fedora-all] Product: Fedora Version: 36 Status: NEW Component: thrift Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: ctubbsii(a)fedoraproject.org Reporter: saroy(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: ctubbsii(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, milleruntime(a)gmail.com, orion(a)nwra.com, willb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2090581

1 4

[Bug 2093358] New: CVE-2021-46790 ntfs-3g: heap-based buffer overflow in ntfsck
by bugzilla＠redhat.com 16 May '23

16 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093358 Bug ID: 2093358 Summary: CVE-2021-46790 ntfs-3g: heap-based buffer overflow in ntfsck Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the upstream position is that ntfsck is deprecated; however, it is shipped by some Linux distributions. References: https://github.com/tuxera/ntfs-3g/issues/16 http://www.openwall.com/lists/oss-security/2022/05/26/1 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093358

1 16

[Bug 2093348] New: CVE-2022-30789 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array
by bugzilla＠redhat.com 16 May '23

16 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093348 Bug ID: 2093348 Summary: CVE-2022-30789 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093348

1 16

[Bug 2093340] New: CVE-2022-30788 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc
by bugzilla＠redhat.com 16 May '23

16 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093340 Bug ID: 2093340 Summary: CVE-2022-30788 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093340

1 16

[Bug 2093326] New: CVE-2022-30786 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate
by bugzilla＠redhat.com 16 May '23

16 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093326 Bug ID: 2093326 Summary: CVE-2022-30786 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093326

1 16

[Bug 2093314] New: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value
by bugzilla＠redhat.com 16 May '23

16 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093314 Bug ID: 2093314 Summary: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093314

1 16

[Bug 2120929] New: python-bcrypt-4.0.0 is available
by bugzilla＠redhat.com 01 May '23

01 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2120929 Bug ID: 2120929 Summary: python-bcrypt-4.0.0 is available Product: Fedora Version: rawhide Status: NEW Component: python-bcrypt Keywords: FutureFeature, Triaged Assignee: pingou(a)pingoured.fr Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, mhayden(a)redhat.com, pingou(a)pingoured.fr, python-sig(a)lists.fedoraproject.org, williamjmorenor(a)gmail.com Target Milestone: --- Classification: Fedora Releases retrieved: 4.0.0 Upstream release that is considered latest: 4.0.0 Current version/release in rawhide: 3.2.2-4.fc37 URL: http://pypi.python.org/pypi/bcrypt Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/9047/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-bcrypt -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2120929

1 14

[Bug 2082587] New: Busybox 1.35.0-2 crashes
by bugzilla＠redhat.com 25 Apr '23

25 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=2082587 Bug ID: 2082587 Summary: Busybox 1.35.0-2 crashes Product: Fedora Version: 36 Status: NEW Component: busybox Severity: high Assignee: spotrh(a)gmail.com Reporter: stefanb(a)us.ibm.com QA Contact: extras-qa(a)fedoraproject.org CC: admiller(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, spotrh(a)gmail.com Target Milestone: --- Classification: Fedora Description of problem: Busybox 1.35.0-2 is crashing for me Version-Release number of selected component (if applicable): 1.35.0-2 How reproducible: I need to downgrade busybox to have it working ... [stefanb@test ~]$ busybox sh Segmentation fault (core dumped) [stefanb@test ~]$ gdb --args busybox sh GNU gdb (GDB) Fedora 11.2-3.fc36 Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from busybox... This GDB supports auto-downloading debuginfo from the following URLs: https://debuginfod.fedoraproject.org/ Enable debuginfod for this session? (y or [n]) y Debuginfod has been enabled. To make this setting permanent, add 'set debuginfod enabled on' to .gdbinit. Reading symbols from /home/stefanb/.cache/debuginfod_client/88baa87c0a47de9361e9abdbea1d01d5ee79f832/debuginfo... (gdb) r Starting program: /usr/sbin/busybox sh Downloading separate debug info for /home/stefanb/system-supplied DSO at 0x7ffff7ffd000... Program received signal SIGSEGV, Segmentation fault. 0x0000000000409597 in parse_config_file () at libbb/appletlib.c:329 329 { (gdb) q A debugging session is active. Inferior 1 [process 3691] will be killed. Quit anyway? (y or n) y [stefanb@test ~]$ sudo su - [root@test ~]# busybox sh Segmentation fault (core dumped) [root@test ~]# sudo dnf -y reinstall busybox Last metadata expiration check: 3:08:06 ago on Fri 06 May 2022 06:09:36 AM. Dependencies resolved. =========================================================================================================================================================== Package Architecture Version Repository Size =========================================================================================================================================================== Reinstalling: busybox x86_64 1:1.35.0-2.fc36 fedora 775 k Transaction Summary =========================================================================================================================================================== Total download size: 775 k Installed size: 1.5 M Downloading Packages: busybox-1.35.0-2.fc36.x86_64.rpm 4.9 MB/s | 775 kB 00:00 ----------------------------------------------------------------------------------------------------------------------------------------------------------- Total 2.0 MB/s | 775 kB 00:00 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Reinstalling : busybox-1:1.35.0-2.fc36.x86_64 1/2 Cleanup : busybox-1:1.35.0-2.fc36.x86_64 2/2 Running scriptlet: busybox-1:1.35.0-2.fc36.x86_64 2/2 Verifying : busybox-1:1.35.0-2.fc36.x86_64 1/2 Verifying : busybox-1:1.35.0-2.fc36.x86_64 2/2 Reinstalled: busybox-1:1.35.0-2.fc36.x86_64 Complete! [root@test ~]# busybox ls Segmentation fault (core dumped) [root@test ~]# dnf remove busybox Dependencies resolved. =========================================================================================================================================================== Package Architecture Version Repository Size =========================================================================================================================================================== Removing: busybox x86_64 1:1.35.0-2.fc36 @fedora 1.5 M Transaction Summary =========================================================================================================================================================== Remove 1 Package Freed space: 1.5 M Is this ok [y/N]: y Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Erasing : busybox-1:1.35.0-2.fc36.x86_64 1/1 Running scriptlet: busybox-1:1.35.0-2.fc36.x86_64 1/1 Verifying : busybox-1:1.35.0-2.fc36.x86_64 1/1 Removed: busybox-1:1.35.0-2.fc36.x86_64 Complete! [root@test ~]# rpm -Uvh https://kojipkgs.fedoraproject.org//packages/busybox/1.34.1/1.fc36/x86_64/b… Retrieving https://kojipkgs.fedoraproject.org//packages/busybox/1.34.1/1.fc36/x86_64/b… Verifying... ################################# [100%] Preparing... ################################# [100%] Updating / installing... 1:busybox-1:1.34.1-1.fc36 ################################# [100%] [root@test ~]# busybox sh ~ # [root@test ~]# logout [stefanb@test ~]$ busybox sh ~ $ Expected results: Busybox should work. Additional info: -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2082587

1 4

[Bug 2113645] New: python-postorius: FTBFS in Fedora rawhide/f37
by bugzilla＠redhat.com 12 Mar '23

12 Mar '23

https://bugzilla.redhat.com/show_bug.cgi?id=2113645 Bug ID: 2113645 Summary: python-postorius: FTBFS in Fedora rawhide/f37 Product: Fedora Version: rawhide Status: NEW Component: python-postorius Assignee: michel(a)michel-slm.name Reporter: releng(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, python-sig(a)lists.fedoraproject.org Blocks: 2045102 (F37FTBFS,RAWHIDEFTBFS) Target Milestone: --- Classification: Fedora python-postorius failed to build from source in Fedora rawhide/f37 https://koji.fedoraproject.org/koji/taskinfo?taskID=89886097 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Please fix python-postorius at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, python-postorius will be orphaned. Before branching of Fedora 38, python-postorius will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails… Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2045102 [Bug 2045102] Fedora 37 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2113645

1 15

[Bug 2046878] New: python-hyperkitty: FTBFS in Fedora rawhide/f36
by bugzilla＠redhat.com 12 Mar '23

12 Mar '23

https://bugzilla.redhat.com/show_bug.cgi?id=2046878 Bug ID: 2046878 Summary: python-hyperkitty: FTBFS in Fedora rawhide/f36 Product: Fedora Version: rawhide Status: NEW Component: python-hyperkitty Assignee: michel(a)michel-slm.name Reporter: releng(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, python-sig(a)lists.fedoraproject.org Blocks: 1992484 (F36FTBFS) Target Milestone: --- Classification: Fedora python-hyperkitty failed to build from source in Fedora rawhide/f36 https://koji.fedoraproject.org/koji/taskinfo?taskID=81985454 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Please fix python-hyperkitty at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, python-hyperkitty will be orphaned. Before branching of Fedora 37, python-hyperkitty will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails… Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1992484 [Bug 1992484] Fedora 36 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2046878

1 10

[Bug 2049668] New: libimagequant-4.0.0 is available
by bugzilla＠redhat.com 12 Mar '23

12 Mar '23

https://bugzilla.redhat.com/show_bug.cgi?id=2049668 Bug ID: 2049668 Summary: libimagequant-4.0.0 is available Product: Fedora Version: rawhide Status: NEW Component: libimagequant Keywords: FutureFeature, Triaged Assignee: manisandro(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, python-sig(a)lists.fedoraproject.org, sergio(a)serjux.com Target Milestone: --- Classification: Fedora Latest upstream release: 4.0.0 Current version/release in rawhide: 2.17.0-2.fc36 URL: https://pngquant.org/lib/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/12768/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2049668

1 18

[Bug 2044963] New: F36FailsToInstall: postorius
by bugzilla＠redhat.com 07 Mar '23

07 Mar '23

https://bugzilla.redhat.com/show_bug.cgi?id=2044963 Bug ID: 2044963 Summary: F36FailsToInstall: postorius Product: Fedora Version: rawhide Status: NEW Component: python-postorius Assignee: michel(a)michel-slm.name Reporter: mhroncok(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, python-sig(a)lists.fedoraproject.org Blocks: 1992487 (F36FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically. If you feel that this output has mistakes, please contact me via email (mhroncok(a)redhat.com) Your package (python-postorius) Fails To Install in Fedora 36: can't install postorius: - nothing provides (python3.10dist(django) < 3.3~~ with python3.10dist(django) >= 2.2) needed by postorius-1.3.6-1.fc36.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1992487 [Bug 1992487] Fedora 36 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2044963

1 16

[Bug 2073097] New: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF
by bugzilla＠redhat.com 28 Feb '23

28 Feb '23

https://bugzilla.redhat.com/show_bug.cgi?id=2073097 Bug ID: 2073097 Summary: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: andreas(a)bawue.net, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, rdieter(a)gmail.com Target Milestone: --- Classification: Other In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. References: https://sourceforge.net/p/graphicsmagick/bugs/664/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2073097

1 8

[Bug 2073098] New: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF [epel-all]
by bugzilla＠redhat.com 28 Feb '23

28 Feb '23

https://bugzilla.redhat.com/show_bug.cgi?id=2073098 Bug ID: 2073098 Summary: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: GraphicsMagick Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: rdieter(a)gmail.com Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: andreas(a)bawue.net, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, rdieter(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2073098

1 3

[Bug 2073099] New: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF [fedora-all]
by bugzilla＠redhat.com 28 Feb '23

28 Feb '23

https://bugzilla.redhat.com/show_bug.cgi?id=2073099 Bug ID: 2073099 Summary: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF [fedora-all] Product: Fedora Version: 35 Status: NEW Component: GraphicsMagick Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: andreas(a)bawue.net Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: andreas(a)bawue.net, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, rdieter(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2073099

1 5

[Bug 2077383] New: F37FailsToInstall: python3-tmuxp
by bugzilla＠redhat.com 20 Feb '23

20 Feb '23

https://bugzilla.redhat.com/show_bug.cgi?id=2077383 Bug ID: 2077383 Summary: F37FailsToInstall: python3-tmuxp Product: Fedora Version: rawhide Status: NEW Component: python-tmuxp Assignee: igor.raits(a)gmail.com Reporter: mhroncok(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, igor.raits(a)gmail.com Blocks: 2045109 (F37FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically. If you feel that this output has mistakes, please contact me via email (mhroncok(a)redhat.com) Your package (python-tmuxp) Fails To Install in Fedora 37: can't install python3-tmuxp: - nothing provides (python3.10dist(click) < 8.1~~ with python3.10dist(click) >= 7) needed by python3-tmuxp-1.9.2-2.fc37.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. To reproduce, use the koji/local repo only, e.g. in mock: $ mock -r fedora-37-x86_64 --disablerepo='*' --enablerepo=local install python3-tmuxp P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2045109 [Bug 2045109] Fedora 37 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2077383

1 9

[Bug 2063475] New: python-libtmux-0.11.0b2 is available
by bugzilla＠redhat.com 20 Feb '23

20 Feb '23

https://bugzilla.redhat.com/show_bug.cgi?id=2063475 Bug ID: 2063475 Summary: python-libtmux-0.11.0b2 is available Product: Fedora Version: rawhide Status: NEW Component: python-libtmux Keywords: FutureFeature, Triaged Assignee: mail(a)fabian-affolter.ch Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, mail(a)fabian-affolter.ch Target Milestone: --- Classification: Fedora Latest upstream release: 0.11.0b2 Current version/release in rawhide: 0.10.3-1.fc37 URL: https://pypi.python.org/pypi/libtmux Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/13040/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2063475

1 7

[Bug 2079295] New: Busybox requires ld-musl-x86_64.so.1, but must be static
by bugzilla＠redhat.com 19 Jan '23

19 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2079295 Bug ID: 2079295 Summary: Busybox requires ld-musl-x86_64.so.1, but must be static Product: Fedora Version: rawhide OS: Linux Status: NEW Component: busybox Severity: medium Assignee: spotrh(a)gmail.com Reporter: atu(a)nmetau.edu.ua QA Contact: extras-qa(a)fedoraproject.org CC: admiller(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, spotrh(a)gmail.com Target Milestone: --- Classification: Fedora Description of problem: Busybox is a special binary, which must be static. However, it requires so from musl library. Version-Release number of selected component (if applicable): busybox-1:1.35.0-4.fc37.x86_64 How reproducible: Always Steps to Reproduce: 1. rpm -Uvh --test busybox-1.35.0-4.fc37.x86_64.rpm Actual results: error: Failed dependencies: ld-musl-x86_64.so.1()(64bit) is needed by busybox-1:1.35.0-4.fc37.x86_64 Expected results: Clean install without dependencies from any library. Additional info: -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2079295

1 11

[Bug 2091183] New: Remove tesseract from epel9 - RHEL9 conflict
by bugzilla＠redhat.com 11 Jan '23

11 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2091183 Bug ID: 2091183 Summary: Remove tesseract from epel9 - RHEL9 conflict Product: Fedora EPEL Version: epel9 Status: NEW Component: tesseract Assignee: manisandro(a)gmail.com Reporter: tdawson(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, karlikt(a)gmail.com, manisandro(a)gmail.com Target Milestone: --- Classification: Fedora tesseract and tesseract-tessdata are in RHEL 9.0 Remove them from epel9. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2091183

1 5

[Bug 2102923] New: CVE-2022-33987 yarnpkg: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all]
by bugzilla＠redhat.com 11 Jan '23

11 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2102923 Bug ID: 2102923 Summary: CVE-2022-33987 yarnpkg: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] Product: Fedora Version: 36 Status: NEW Component: yarnpkg Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: zsvetlik(a)redhat.com Reporter: askrabec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102923

1 3

[Bug 2107442] New: Add HDRI support in future versions.
by bugzilla＠redhat.com 06 Jan '23

06 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2107442 Bug ID: 2107442 Summary: Add HDRI support in future versions. Product: Fedora Version: rawhide Hardware: All OS: All Status: NEW Component: ImageMagick Severity: low Assignee: luya_tfz(a)thefinalzone.net Reporter: mesat(a)telusplanet.net QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora Description of problem: ImageMagick has progressed to process modern images and many people have access to HDR images via their cellphones. ImageMagick has added the ability to process HDR images but the present Fedora release on F35 doesn't include that option. Fedora shouldn't be limiting the ability to process images to their best quality. Version-Release number of selected component (if applicable): 7.1 How reproducible: Always Steps to Reproduce: 1. Take an HDR image 2. Process it in the present copy of ImageMagick 3. Open image to find colour depth has changed. Actual results: Lose colour depth on HDR images. Expected results: Maintain colour depth on HDR images when processing with ImageMagick Additional info: Info on HDR in ImageMagick. https://imagemagick.org/script/high-dynamic-range.php -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107442

1 6

[Bug 2113770] New: yarnpkg: FTBFS in Fedora rawhide/f37
by bugzilla＠redhat.com 03 Jan '23

03 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2113770 Bug ID: 2113770 Summary: yarnpkg: FTBFS in Fedora rawhide/f37 Product: Fedora Version: rawhide Status: NEW Component: yarnpkg Assignee: zsvetlik(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Blocks: 2045102 (F37FTBFS,RAWHIDEFTBFS) Target Milestone: --- Classification: Fedora yarnpkg failed to build from source in Fedora rawhide/f37 https://koji.fedoraproject.org/koji/taskinfo?taskID=89932998 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Please fix yarnpkg at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, yarnpkg will be orphaned. Before branching of Fedora 38, yarnpkg will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails… Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2045102 [Bug 2045102] Fedora 37 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2113770

1 4

[Bug 2069264] New: [abrt] notmuch: notmuch_tags_valid(): notmuch killed by SIGSEGV
by bugzilla＠redhat.com 02 Jan '23

02 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2069264 Bug ID: 2069264 Summary: [abrt] notmuch: notmuch_tags_valid(): notmuch killed by SIGSEGV Product: Fedora Version: 35 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:984ab0912b2464ac1bdc7a4ed0314cd31128b91d;VAR IANT_ID=xfce; Component: notmuch Assignee: mjg(a)fedoraproject.org Reporter: jhutar(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, lewk(a)openmailbox.org, mjg(a)fedoraproject.org, rbean(a)redhat.com Target Milestone: --- Classification: Fedora Description of problem: Some email have to be causing that :-/ neomutt is failing because of that as well when I have virtual-mailboxes configuerd. Command I have used in this case was: notmuch search "tag:zsdidaktis OR from:@zsdidaktis.cz" Version-Release number of selected component: notmuch-0.35-2.fc35 Additional info: reporter: libreport-2.15.2 backtrace_rating: 4 cgroup: 0::/user.slice/user-1000.slice/session-2.scope cmdline: notmuch search $'tag:zsdidaktis OR from:@zsdidaktis.cz' crash_function: notmuch_tags_valid executable: /usr/bin/notmuch journald_cursor: s=2b2e17a38b1e4b81b5a9d1b5dc73c207;i=4a10;b=b9117c89319c46bfb4da24d1af361aae;m=36b1505a0a;t=5db48d2887322;x=3e305f1fd4ce2258 kernel: 5.16.15-201.fc35.x86_64 rootdir: / runlevel: N 5 type: CCpp uid: 1000 Truncated backtrace: Thread no. 1 (6 frames) #0 notmuch_tags_valid at lib/tags.c:51 #1 _thread_add_message at lib/thread.cc:254 #2 _notmuch_thread_create at lib/thread.cc:631 #3 notmuch_threads_get at lib/query.cc:671 #4 do_search_threads at /usr/src/debug/notmuch-0.35-2.fc35.x86_64/notmuch-search.c:150 #5 notmuch_search_command at /usr/src/debug/notmuch-0.35-2.fc35.x86_64/notmuch-search.c:845 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2069264

1 10

[Bug 2088233] New: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service
by bugzilla＠redhat.com 13 Dec '22

13 Dec '22

https://bugzilla.redhat.com/show_bug.cgi?id=2088233 Bug ID: 2088233 Summary: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: saroy(a)redhat.com CC: admiller(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, spotrh(a)gmail.com Target Milestone: --- Classification: Other A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. https://bugs.busybox.net/show_bug.cgi?id=14781 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2088233

1 9

[Bug 2089281] New: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service [fedora-35]
by bugzilla＠redhat.com 13 Dec '22

13 Dec '22

https://bugzilla.redhat.com/show_bug.cgi?id=2089281 Bug ID: 2089281 Summary: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service [fedora-35] Product: Fedora Version: 35 Status: NEW Component: busybox Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: spotrh(a)gmail.com Reporter: saroy(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: admiller(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, spotrh(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-35. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2089281

1 4

[Bug 2082465] New: CVE-2022-29167 yarnpkg: hawk: REDoS in hawk.utils.parseHost() when parsing Host header [fedora-all]
by bugzilla＠redhat.com 13 Dec '22

13 Dec '22

https://bugzilla.redhat.com/show_bug.cgi?id=2082465 Bug ID: 2082465 Summary: CVE-2022-29167 yarnpkg: hawk: REDoS in hawk.utils.parseHost() when parsing Host header [fedora-all] Product: Fedora Version: 35 Status: NEW Component: yarnpkg Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: zsvetlik(a)redhat.com Reporter: ahanwate(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2082465

1 4

[Bug 2070960] New: CVE-2022-0841 yarnpkg: npm-lockfile: os command injection [fedora-all]
by bugzilla＠redhat.com 13 Dec '22

13 Dec '22

https://bugzilla.redhat.com/show_bug.cgi?id=2070960 Bug ID: 2070960 Summary: CVE-2022-0841 yarnpkg: npm-lockfile: os command injection [fedora-all] Product: Fedora Version: 35 Status: NEW Component: yarnpkg Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: zsvetlik(a)redhat.com Reporter: mcascell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2070960

1 4

[Bug 2059360] New: yarnpkg for fedora 35 installs binary '/usr/bin/%{fc_name}'
by bugzilla＠redhat.com 13 Dec '22

13 Dec '22

https://bugzilla.redhat.com/show_bug.cgi?id=2059360 Bug ID: 2059360 Summary: yarnpkg for fedora 35 installs binary '/usr/bin/%{fc_name}' Product: Fedora Version: 35 Status: NEW Component: yarnpkg Assignee: zsvetlik(a)redhat.com Reporter: martin.kuehl(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora Description of problem: the current yarnpkg rpm installs a binary at the path '/usr/bin/%{fc_name}' this is also visible at: https://packages.fedoraproject.org/pkgs/yarnpkg/yarnpkg/fedora-35.html#files Version-Release number of selected component (if applicable): yarnpkg-1.22.10-3.fc35 How reproducible: always Steps to Reproduce: 1. dnf repoquery --list yarnpkg | grep /usr/bin or look at https://packages.fedoraproject.org/pkgs/yarnpkg/yarnpkg/fedora-35.html#files Actual results: /usr/bin/%{fc_name} /usr/bin/yarn /usr/bin/yarnpkg Expected results: judging by the package for fedora 36: /usr/bin/nodejs-yarn /usr/bin/yarn /usr/bin/yarnpkg Additional info: if i remember correctly that's rpm spec template syntax so there might be some stray escaping or something? it's also apparently fixed for f36 so backporting that package would be just fine. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2059360

1 3

[Bug 2118244] New: Remove xmlstarlet from epel8
by bugzilla＠redhat.com 30 Nov '22

30 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2118244 Bug ID: 2118244 Summary: Remove xmlstarlet from epel8 Product: Fedora EPEL Version: epel8 Status: NEW Component: xmlstarlet Assignee: stickster(a)gmail.com Reporter: rhel-process-autobot(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: daltonminer(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, stickster(a)gmail.com Target Milestone: --- Classification: Fedora -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2118244

1 7

[Bug 2072386] New: Remove xmlstarlet from epel8
by bugzilla＠redhat.com 30 Nov '22

30 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2072386 Bug ID: 2072386 Summary: Remove xmlstarlet from epel8 Product: Fedora EPEL Version: epel8 Status: NEW Component: xmlstarlet Assignee: stickster(a)gmail.com Reporter: rhel-process-autobot(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: daltonminer(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, stickster(a)gmail.com Target Milestone: --- Classification: Fedora -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2072386

1 6

[Bug 2084488] New: Remove xmlstarlet from epel9
by bugzilla＠redhat.com 30 Nov '22

30 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2084488 Bug ID: 2084488 Summary: Remove xmlstarlet from epel9 Product: Fedora EPEL Version: epel9 Status: NEW Component: xmlstarlet Assignee: stickster(a)gmail.com Reporter: rhel-process-autobot(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: daltonminer(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, stickster(a)gmail.com Target Milestone: --- Classification: Fedora -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2084488

1 5

[Bug 2122358] New: CVE-2020-35533 LibRaw: Out-of-bounds read in LibRaw::adobe_copy_pixel() function
by bugzilla＠redhat.com 29 Nov '22

29 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2122358 Bug ID: 2122358 Summary: CVE-2020-35533 LibRaw: Out-of-bounds read in LibRaw::adobe_copy_pixel() function Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: dchen(a)redhat.com, debarshir(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, hobbes1069(a)gmail.com, jridky(a)redhat.com, manisandro(a)gmail.com, mattdm(a)redhat.com, mattia.verga(a)proton.me, michel(a)michel-slm.name, ngompa13(a)gmail.com, nphilipp(a)redhat.com, sebastian(a)sdziallas.com, sergio(a)serjux.com, siddharth.kde(a)gmail.com, sipoyare(a)redhat.com, thibault(a)north.li Target Milestone: --- Classification: Other In LibRaw, an out-of-bounds read vulnerability exists within the "LibRaw::adobe_copy_pixel()" function (libraw\src\decoders\dng.cpp) when reading data from the image file. Upstream issue: https://github.com/LibRaw/LibRaw/issues/273 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2122358

1 9

[Bug 2122357] New: CVE-2020-35532 LibRaw: Out-of-bounds read in simple_decode_row() function
by bugzilla＠redhat.com 29 Nov '22

29 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2122357 Bug ID: 2122357 Summary: CVE-2020-35532 LibRaw: Out-of-bounds read in simple_decode_row() function Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: dchen(a)redhat.com, debarshir(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, hobbes1069(a)gmail.com, jridky(a)redhat.com, manisandro(a)gmail.com, mattdm(a)redhat.com, mattia.verga(a)proton.me, michel(a)michel-slm.name, ngompa13(a)gmail.com, nphilipp(a)redhat.com, sebastian(a)sdziallas.com, sergio(a)serjux.com, siddharth.kde(a)gmail.com, sipoyare(a)redhat.com, thibault(a)north.li Target Milestone: --- Classification: Other In LibRaw, an out-of-bounds read vulnerability exists within the "simple_decode_row()" function (libraw\src\x3f\x3f_utils_patched.cpp) which can be triggered via an image with a large row_stride field. Upstream issue: https://github.com/LibRaw/LibRaw/issues/271 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2122357

1 9

[Bug 2122356] New: CVE-2020-35531 LibRaw: Out-of-bounds read in get_huffman_diff() function
by bugzilla＠redhat.com 29 Nov '22

29 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2122356 Bug ID: 2122356 Summary: CVE-2020-35531 LibRaw: Out-of-bounds read in get_huffman_diff() function Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: dchen(a)redhat.com, debarshir(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, hobbes1069(a)gmail.com, jridky(a)redhat.com, manisandro(a)gmail.com, mattdm(a)redhat.com, mattia.verga(a)proton.me, michel(a)michel-slm.name, ngompa13(a)gmail.com, nphilipp(a)redhat.com, sebastian(a)sdziallas.com, sergio(a)serjux.com, siddharth.kde(a)gmail.com, sipoyare(a)redhat.com, thibault(a)north.li Target Milestone: --- Classification: Other In LibRaw, an out-of-bounds read vulnerability exists within the get_huffman_diff() function (libraw\src\x3f\x3f_utils_patched.cpp) when reading data from an image file. Upstream issue: https://github.com/LibRaw/LibRaw/issues/270 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2122356

1 9

[Bug 2117998] New: Non-responsive maintainer check for raineforest
by bugzilla＠redhat.com 29 Nov '22

29 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2117998 Bug ID: 2117998 Summary: Non-responsive maintainer check for raineforest Product: Fedora Version: rawhide Hardware: All OS: Linux Status: NEW Component: asio Severity: medium Priority: medium Assignee: uwog(a)uwog.net Reporter: belegdol(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, me(a)fale.io, raineforest(a)raineforest.me, uwog(a)uwog.net Target Milestone: --- Classification: Fedora This bug is part of the non-responsive maintainer procedure for raineforest, following https://docs.fedoraproject.org/en-US/fesco/Policy_for_nonresponsive_package…. Please respond if you are still active in Fedora and want to maintain asio. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2117998

1 2

[Bug 2117995] New: Non-responsive maintainer check for uwog
by bugzilla＠redhat.com 29 Nov '22

29 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2117995 Bug ID: 2117995 Summary: Non-responsive maintainer check for uwog Product: Fedora Version: rawhide Hardware: All OS: Linux Status: NEW Component: asio Severity: medium Priority: medium Assignee: uwog(a)uwog.net Reporter: belegdol(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, me(a)fale.io, raineforest(a)raineforest.me, uwog(a)uwog.net Target Milestone: --- Classification: Fedora This bug is part of the non-responsive maintainer procedure for uwog, following https://docs.fedoraproject.org/en-US/fesco/Policy_for_nonresponsive_package…. Please respond if you are still active in Fedora and want to maintain asio. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2117995

1 2

[Bug 2110169] New: 'zbar' Python bindings are unusable in Fedora 36.
by bugzilla＠redhat.com 28 Nov '22

28 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2110169 Bug ID: 2110169 Summary: 'zbar' Python bindings are unusable in Fedora 36. Product: Fedora Version: 36 Hardware: x86_64 Status: NEW Component: zbar Severity: urgent Assignee: gwync(a)protonmail.com Reporter: august(a)schwerdfeger.name QA Contact: extras-qa(a)fedoraproject.org CC: dougsland(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, mchehab(a)infradead.org, mr.marcelo.barbosa(a)gmail.com, negativo17(a)gmail.com Target Milestone: --- Classification: Fedora Created attachment 1898987 --> https://bugzilla.redhat.com/attachment.cgi?id=1898987&action=edit Backtrace of segfault when attempting to import the 'zbar' module. Description of problem: Any attempt to import the 'zbar' module within Python causes the interpreter to crash with a segfault (backtrace attached). This did not occur with Fedora 35 or earlier. Version-Release number of selected component (if applicable): zbar-python3-0.23-14.fc36.x86_64 Steps to Reproduce: 1. Start the Python interpreter. 2. Type 'import zbar' at the REPL loop. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2110169

1 2

[Bug 2091263] New: Please update it to 0.23.90 and enable pdf417 support
by bugzilla＠redhat.com 28 Nov '22

28 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2091263 Bug ID: 2091263 Summary: Please update it to 0.23.90 and enable pdf417 support Product: Fedora Version: 35 Status: NEW Component: zbar Assignee: gwync(a)protonmail.com Reporter: bugzilla(a)terrortux.de QA Contact: extras-qa(a)fedoraproject.org CC: dougsland(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, mchehab(a)infradead.org, mr.marcelo.barbosa(a)gmail.com, negativo17(a)gmail.com Target Milestone: --- Classification: Fedora Changes see: https://github.com/mchehab/zbar/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2091263

1 5

[Bug 2081540] New: crc32 and compressions are not supported
by bugzilla＠redhat.com 14 Nov '22

14 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2081540 Bug ID: 2081540 Summary: crc32 and compressions are not supported Product: Fedora Version: rawhide Status: NEW Component: rocksdb Assignee: hegjon(a)gmail.com Reporter: socketpair(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, hegjon(a)gmail.com, mmuzila(a)redhat.com Target Milestone: --- Classification: Fedora Opening (Creating) any RocksDB shows this in the log: 2022/05/04-03:33:21.189455 7f14b298eac0 Compression algorithms supported: 2022/05/04-03:33:21.189459 7f14b298eac0 <------>kZSTD supported: 0 2022/05/04-03:33:21.189463 7f14b298eac0 <------>kXpressCompression supported: 0 2022/05/04-03:33:21.189466 7f14b298eac0 <------>kBZip2Compression supported: 0 2022/05/04-03:33:21.189511 7f14b298eac0 <------>kZSTDNotFinalCompression supported: 0 2022/05/04-03:33:21.189515 7f14b298eac0 <------>kLZ4Compression supported: 0 2022/05/04-03:33:21.189518 7f14b298eac0 <------>kZlibCompression supported: 0 2022/05/04-03:33:21.189521 7f14b298eac0 <------>kLZ4HCCompression supported: 0 2022/05/04-03:33:21.189524 7f14b298eac0 <------>kSnappyCompression supported: 0 2022/05/04-03:33:21.189530 7f14b298eac0 Fast CRC32 supported: Not supported on x86 I think it is wrong. At least, CRC32 offloading SHOULD be enabled on all targets where it exists (I guess not only x86, but also AARCH64). Regarding compression - I would enable them all. Except, possibly, bzip2. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2081540

1 4

[Bug 2083013] New: python-shortuuid-1.0.9 is available
by bugzilla＠redhat.com 10 Nov '22

10 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2083013 Bug ID: 2083013 Summary: python-shortuuid-1.0.9 is available Product: Fedora Version: rawhide Status: NEW Component: python-shortuuid Keywords: FutureFeature, Triaged Assignee: michel(a)michel-slm.name Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, python-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 1.0.9 Current version/release in rawhide: 1.0.8-2.fc36 URL: https://github.com/stochastic-technologies/shortuuid/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/12823/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2083013

1 6

[Bug 2121958] New: fennel-1.2.0 is available
by bugzilla＠redhat.com 10 Nov '22

10 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2121958 Bug ID: 2121958 Summary: fennel-1.2.0 is available Product: Fedora Version: rawhide Status: NEW Component: fennel Keywords: FutureFeature, Triaged Assignee: michel(a)michel-slm.name Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, lua-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora Releases retrieved: 1.2.0 Upstream release that is considered latest: 1.2.0 Current version/release in rawhide: 1.1.0-2.fc37 URL: https://fennel-lang.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/22691/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/fennel -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2121958

1 14

[Bug 2122362] New: CVE-2020-35535 LibRaw: Out-of-bounds read in LibRaw::parseSonySRF() function
by bugzilla＠redhat.com 28 Oct '22

28 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2122362 Bug ID: 2122362 Summary: CVE-2020-35535 LibRaw: Out-of-bounds read in LibRaw::parseSonySRF() function Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: dchen(a)redhat.com, debarshir(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, hobbes1069(a)gmail.com, jridky(a)redhat.com, manisandro(a)gmail.com, mattdm(a)redhat.com, mattia.verga(a)proton.me, michel(a)michel-slm.name, ngompa13(a)gmail.com, nphilipp(a)redhat.com, sebastian(a)sdziallas.com, sergio(a)serjux.com, siddharth.kde(a)gmail.com, sipoyare(a)redhat.com, thibault(a)north.li Target Milestone: --- Classification: Other In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF()" function (libraw\src\metadata\sony.cpp) when processing srf files. Upstream issue: https://github.com/LibRaw/LibRaw/issues/283 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2122362

1 8

[Bug 2122360] New: CVE-2020-35534 LibRaw: Memory corruption in "crxFreeSubbandData()" function
by bugzilla＠redhat.com 28 Oct '22

28 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2122360 Bug ID: 2122360 Summary: CVE-2020-35534 LibRaw: Memory corruption in "crxFreeSubbandData()" function Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: dchen(a)redhat.com, debarshir(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, hobbes1069(a)gmail.com, jridky(a)redhat.com, manisandro(a)gmail.com, mattdm(a)redhat.com, mattia.verga(a)proton.me, michel(a)michel-slm.name, ngompa13(a)gmail.com, nphilipp(a)redhat.com, sebastian(a)sdziallas.com, sergio(a)serjux.com, siddharth.kde(a)gmail.com, sipoyare(a)redhat.com, thibault(a)north.li Target Milestone: --- Classification: Other In LibRaw, there is a memory corruption vulnerability within the "crxFreeSubbandData()" function (libraw\src\decoders\crx.cpp) when processing cr3 files. Upstream issue: https://github.com/LibRaw/LibRaw/issues/279 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2122360

1 7

[Bug 2122159] New: xmlstarlet missing in EPEL8
by bugzilla＠redhat.com 26 Oct '22

26 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2122159 Bug ID: 2122159 Summary: xmlstarlet missing in EPEL8 Product: Fedora EPEL Version: epel8 Hardware: All OS: Linux Status: NEW Component: xmlstarlet Severity: high Assignee: stickster(a)gmail.com Reporter: vashastr(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: adeza(a)redhat.com, bhubbard(a)redhat.com, daltonminer(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, extras-qa(a)fedoraproject.org, ghenadii.batalski(a)conitas.de, guenther.reim(a)allianz.at, michel(a)michel-slm.name, ngompa13(a)gmail.com, olivier.lahaye1(a)free.fr, skimeer(a)gmail.com, stickster(a)gmail.com Depends On: 1757000 Target Milestone: --- Classification: Fedora +++ This bug was initially created as a clone of Bug #1757000 +++ Description of problem: xmlstarlet is missing in EPEL8 As there is no alternative to this tool (validate or query xml files from cmdline), it's important to have it on EPEL-8 --- Additional comment from Alfredo Deza on 2019-10-18 19:26:22 UTC --- The Ceph project depends on this missing package for builds, we've had to install it directly from the commandline (!) as a workaround. Any progress on this would be greatly appreciated. --- Additional comment from Fedora Update System on 2019-11-09 20:02:11 UTC --- FEDORA-EPEL-2019-3b10f1dd23 has been submitted as an update to Fedora EPEL 8. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-3b10f1dd23 --- Additional comment from Paul W. Frields on 2019-11-09 20:02:59 UTC --- @Brad, @Alfredo -- if you'd like to see this available sooner, please encourage people to test the update from the link above. --- Additional comment from Brad Hubbard on 2019-11-10 00:06:58 UTC --- (In reply to Paul W. Frields from comment #3) > @Brad, @Alfredo -- if you'd like to see this available sooner, please > encourage people to test the update from the link above. ACK. Thanks Paul. --- Additional comment from Fedora Update System on 2019-11-11 03:15:37 UTC --- xmlstarlet-1.6.1-11.el8 has been pushed to the Fedora EPEL 8 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-3b10f1dd23 --- Additional comment from Gena on 2019-11-15 14:43:41 UTC --- Could you please provide this package in a UBI8 repo. We use the keycloak image from now based on ubi8 and need to adapt the xml configuration on image build. Thank you and kind regards, Gena --- Additional comment from Paul W. Frields on 2019-11-15 17:44:58 UTC --- @Gena: Is there a reason a package in the EPEL 8 repository won't work for this purpose? --- Additional comment from Gena on 2019-11-19 08:01:54 UTC --- (In reply to Paul W. Frields from comment #7) > @Gena: Is there a reason a package in the EPEL 8 repository won't work for > this purpose? May be, but i only have 2 repositories available: sh-4.4# dnf repolist repo id repo name ubi-8-appstream Red Hat Universal Base Image 8 (RPMs) - AppStream ubi-8-baseos Red Hat Universal Base Image 8 (RPMs) - BaseOS EPEL is not listed there --- Additional comment from Fedora Update System on 2019-11-27 01:03:39 UTC --- xmlstarlet-1.6.1-11.el8 has been pushed to the Fedora EPEL 8 stable repository. If problems still persist, please make note of it in this bug report. --- Additional comment from Paul W. Frields on 2019-12-03 01:41:32 UTC --- Please refer to the UBI FAQ for info: https://developers.redhat.com/articles/ubi-faq/#community --- Additional comment from Gena on 2019-12-05 09:10:00 UTC --- (In reply to Paul W. Frields from comment #10) > Please refer to the UBI FAQ for info: > https://developers.redhat.com/articles/ubi-faq/#community thank you for the hint, but it says nothing about, how to use the UBI8 image outside the playground: i prefer to install my packages from approved repos. The simple enablement of EPEL via microdnf is not described. The only library to work with xml from the console is the xmlstarlet, so, in my opinion, it should be put into default repo just like it's done by alpine, debian, ubuntu... --- Additional comment from Paul W. Frields on 2019-12-06 16:28:23 UTC --- To enable EPEL on UBI Standard or Multi-service, simply use the instructions at https://fedoraproject.org/wiki/EPEL and you can `yum install xmlstarlet`. To enable with microdnf, you must create a suitable .repo file in your UBI environment. At a minimum: [epel] name=EPEL 8 baseurl=https://download.fedoraproject.org/pub/epel/8/Everything/x86_64 failovermethod=priority enabled=1 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-8 And grab the GPG key from the epel-release source repo: $ curl -o /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-8 https://src.fedoraproject.org/rpms/epel-release/raw/epel8/f/RPM-GPG-KEY-EPE… You can then `microdnf install xmlstarlet`. --- Additional comment from Shailesh on 2022-08-29 08:12:22 UTC --- We are facing an issue again with rockylinux:8.6 container image. Steps followed are as below - 1. Create a container from rockylinux:8.6 [root@ssc-vm-rhev4-0707 ~]# docker run --rm -it rockylinux:8.6 2. Enable powertools and install epel-release package [root@acb8441a9bb1 /]# dnf install dnf-plugin-config-manager -y ;dnf config-manager --set-enabled powertools Rocky Linux 8 - AppStream 9.2 MB/s | 9.6 MB 00:01 Rocky Linux 8 - BaseOS 4.1 MB/s | 6.7 MB 00:01 Rocky Linux 8 - Extras 28 kB/s | 11 kB 00:00 Dependencies resolved. ========================================================================================================================================================================================= Package Architecture Version Repository Size ========================================================================================================================================================================================= Installing: dnf-plugins-core noarch 4.0.21-11.el8 baseos 70 k Installing dependencies: dbus-glib x86_64 0.110-2.el8 baseos 126 k python3-dateutil noarch 1:2.6.1-6.el8 baseos 250 k python3-dbus x86_64 1.2.4-15.el8 baseos 133 k python3-dnf-plugins-core noarch 4.0.21-11.el8 baseos 239 k python3-six noarch 1.11.0-8.el8 baseos 37 k Transaction Summary ========================================================================================================================================================================================= Install 6 Packages Total download size: 854 k Installed size: 2.3 M Downloading Packages: (1/6): dnf-plugins-core-4.0.21-11.el8.noarch.rpm 268 kB/s | 70 kB 00:00 (2/6): dbus-glib-0.110-2.el8.x86_64.rpm 430 kB/s | 126 kB 00:00 (3/6): python3-dbus-1.2.4-15.el8.x86_64.rpm 1.2 MB/s | 133 kB 00:00 (4/6): python3-dateutil-2.6.1-6.el8.noarch.rpm 656 kB/s | 250 kB 00:00 (5/6): python3-dnf-plugins-core-4.0.21-11.el8.noarch.rpm 2.0 MB/s | 239 kB 00:00 (6/6): python3-six-1.11.0-8.el8.noarch.rpm 690 kB/s | 37 kB 00:00 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Total 1.5 MB/s | 854 kB 00:00 Rocky Linux 8 - BaseOS 1.6 MB/s | 1.6 kB 00:00 Importing GPG key 0x6D745A60: Userid : "Release Engineering <infrastructure(a)rockylinux.org>" Fingerprint: 7051 C470 A929 F454 CEBE 37B7 15AF 5DAC 6D74 5A60 From : /etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial Key imported successfully Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : python3-six-1.11.0-8.el8.noarch 1/6 Installing : python3-dateutil-1:2.6.1-6.el8.noarch 2/6 Installing : dbus-glib-0.110-2.el8.x86_64 3/6 Running scriptlet: dbus-glib-0.110-2.el8.x86_64 3/6 Installing : python3-dbus-1.2.4-15.el8.x86_64 4/6 Installing : python3-dnf-plugins-core-4.0.21-11.el8.noarch 5/6 Installing : dnf-plugins-core-4.0.21-11.el8.noarch 6/6 Running scriptlet: dnf-plugins-core-4.0.21-11.el8.noarch 6/6 Verifying : dbus-glib-0.110-2.el8.x86_64 1/6 Verifying : dnf-plugins-core-4.0.21-11.el8.noarch 2/6 Verifying : python3-dateutil-1:2.6.1-6.el8.noarch 3/6 Verifying : python3-dbus-1.2.4-15.el8.x86_64 4/6 Verifying : python3-dnf-plugins-core-4.0.21-11.el8.noarch 5/6 Verifying : python3-six-1.11.0-8.el8.noarch 6/6 Installed: dbus-glib-0.110-2.el8.x86_64 dnf-plugins-core-4.0.21-11.el8.noarch python3-dateutil-1:2.6.1-6.el8.noarch python3-dbus-1.2.4-15.el8.x86_64 python3-dnf-plugins-core-4.0.21-11.el8.noarch python3-six-1.11.0-8.el8.noarch Complete! [root@acb8441a9bb1 /]# yum install epel-release -y Rocky Linux 8 - PowerTools 1.5 MB/s | 2.4 MB 00:01 Last metadata expiration check: 0:00:02 ago on Mon Aug 29 07:59:48 2022. Dependencies resolved. ========================================================================================================================================================================================= Package Architecture Version Repository Size ========================================================================================================================================================================================= Installing: epel-release noarch 8-17.el8 extras 24 k Transaction Summary ========================================================================================================================================================================================= Install 1 Package Total download size: 24 k Installed size: 34 k Downloading Packages: epel-release-8-17.el8.noarch.rpm 216 kB/s | 24 kB 00:00 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Total 119 kB/s | 24 kB 00:00 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : epel-release-8-17.el8.noarch 1/1 Running scriptlet: epel-release-8-17.el8.noarch 1/1 Many EPEL packages require the CodeReady Builder (CRB) repository. It is recommended that you run /usr/bin/crb enable to enable the CRB repository. Verifying : epel-release-8-17.el8.noarch 1/1 Installed: epel-release-8-17.el8.noarch Complete! [root@acb8441a9bb1 /]# 3. Test installation of xmlstarlet [root@acb8441a9bb1 /]# yum list xmlstarlet Extra Packages for Enterprise Linux 8 - x86_64 2.4 MB/s | 13 MB 00:05 Extra Packages for Enterprise Linux Modular 8 - x86_64 340 kB/s | 734 kB 00:02 Last metadata expiration check: 0:00:01 ago on Mon Aug 29 08:01:40 2022. Error: No matching Packages to list [root@acb8441a9bb1 /]# --- Additional comment from Shailesh on 2022-08-29 08:13:43 UTC --- We are facing an issue again with rockylinux:8.6 container image. Steps followed are as below - 1. Create a container from rockylinux:8.6 [root@test-node ~]# docker run --rm -it rockylinux:8.6 2. Enable powertools and install epel-release package [root@acb8441a9bb1 /]# dnf install dnf-plugin-config-manager -y ;dnf config-manager --set-enabled powertools Rocky Linux 8 - AppStream 9.2 MB/s | 9.6 MB 00:01 Rocky Linux 8 - BaseOS 4.1 MB/s | 6.7 MB 00:01 Rocky Linux 8 - Extras 28 kB/s | 11 kB 00:00 Dependencies resolved. ========================================================================================================================================================================================= Package Architecture Version Repository Size ========================================================================================================================================================================================= Installing: dnf-plugins-core noarch 4.0.21-11.el8 baseos 70 k Installing dependencies: dbus-glib x86_64 0.110-2.el8 baseos 126 k python3-dateutil noarch 1:2.6.1-6.el8 baseos 250 k python3-dbus x86_64 1.2.4-15.el8 baseos 133 k python3-dnf-plugins-core noarch 4.0.21-11.el8 baseos 239 k python3-six noarch 1.11.0-8.el8 baseos 37 k Transaction Summary ========================================================================================================================================================================================= Install 6 Packages Total download size: 854 k Installed size: 2.3 M Downloading Packages: (1/6): dnf-plugins-core-4.0.21-11.el8.noarch.rpm 268 kB/s | 70 kB 00:00 (2/6): dbus-glib-0.110-2.el8.x86_64.rpm 430 kB/s | 126 kB 00:00 (3/6): python3-dbus-1.2.4-15.el8.x86_64.rpm 1.2 MB/s | 133 kB 00:00 (4/6): python3-dateutil-2.6.1-6.el8.noarch.rpm 656 kB/s | 250 kB 00:00 (5/6): python3-dnf-plugins-core-4.0.21-11.el8.noarch.rpm 2.0 MB/s | 239 kB 00:00 (6/6): python3-six-1.11.0-8.el8.noarch.rpm 690 kB/s | 37 kB 00:00 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Total 1.5 MB/s | 854 kB 00:00 Rocky Linux 8 - BaseOS 1.6 MB/s | 1.6 kB 00:00 Importing GPG key 0x6D745A60: Userid : "Release Engineering <infrastructure(a)rockylinux.org>" Fingerprint: 7051 C470 A929 F454 CEBE 37B7 15AF 5DAC 6D74 5A60 From : /etc/pki/rpm-gpg/RPM-GPG-KEY-rockyofficial Key imported successfully Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : python3-six-1.11.0-8.el8.noarch 1/6 Installing : python3-dateutil-1:2.6.1-6.el8.noarch 2/6 Installing : dbus-glib-0.110-2.el8.x86_64 3/6 Running scriptlet: dbus-glib-0.110-2.el8.x86_64 3/6 Installing : python3-dbus-1.2.4-15.el8.x86_64 4/6 Installing : python3-dnf-plugins-core-4.0.21-11.el8.noarch 5/6 Installing : dnf-plugins-core-4.0.21-11.el8.noarch 6/6 Running scriptlet: dnf-plugins-core-4.0.21-11.el8.noarch 6/6 Verifying : dbus-glib-0.110-2.el8.x86_64 1/6 Verifying : dnf-plugins-core-4.0.21-11.el8.noarch 2/6 Verifying : python3-dateutil-1:2.6.1-6.el8.noarch 3/6 Verifying : python3-dbus-1.2.4-15.el8.x86_64 4/6 Verifying : python3-dnf-plugins-core-4.0.21-11.el8.noarch 5/6 Verifying : python3-six-1.11.0-8.el8.noarch 6/6 Installed: dbus-glib-0.110-2.el8.x86_64 dnf-plugins-core-4.0.21-11.el8.noarch python3-dateutil-1:2.6.1-6.el8.noarch python3-dbus-1.2.4-15.el8.x86_64 python3-dnf-plugins-core-4.0.21-11.el8.noarch python3-six-1.11.0-8.el8.noarch Complete! [root@acb8441a9bb1 /]# yum install epel-release -y Rocky Linux 8 - PowerTools 1.5 MB/s | 2.4 MB 00:01 Last metadata expiration check: 0:00:02 ago on Mon Aug 29 07:59:48 2022. Dependencies resolved. ========================================================================================================================================================================================= Package Architecture Version Repository Size ========================================================================================================================================================================================= Installing: epel-release noarch 8-17.el8 extras 24 k Transaction Summary ========================================================================================================================================================================================= Install 1 Package Total download size: 24 k Installed size: 34 k Downloading Packages: epel-release-8-17.el8.noarch.rpm 216 kB/s | 24 kB 00:00 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Total 119 kB/s | 24 kB 00:00 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : epel-release-8-17.el8.noarch 1/1 Running scriptlet: epel-release-8-17.el8.noarch 1/1 Many EPEL packages require the CodeReady Builder (CRB) repository. It is recommended that you run /usr/bin/crb enable to enable the CRB repository. Verifying : epel-release-8-17.el8.noarch 1/1 Installed: epel-release-8-17.el8.noarch Complete! [root@acb8441a9bb1 /]# 3. Test installation of xmlstarlet [root@acb8441a9bb1 /]# yum list xmlstarlet Extra Packages for Enterprise Linux 8 - x86_64 2.4 MB/s | 13 MB 00:05 Extra Packages for Enterprise Linux Modular 8 - x86_64 340 kB/s | 734 kB 00:02 Last metadata expiration check: 0:00:01 ago on Mon Aug 29 08:01:40 2022. Error: No matching Packages to list [root@acb8441a9bb1 /]# --- Additional comment from Guenther on 2022-08-29 11:00:42 UTC --- i´m facing the same issue. seems that xmlstarlet is no longer available in epel... can`t find it here: https://dl.fedoraproject.org/pub/epel/8/Everything/x86_64/Packages/x/ Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1757000 [Bug 1757000] xmlstarlet missing in EPEL8 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2122159

1 14

[Bug 2085998] New: python-utils-3.2.0 is available
by bugzilla＠redhat.com 21 Oct '22

21 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2085998 Bug ID: 2085998 Summary: python-utils-3.2.0 is available Product: Fedora Version: rawhide Status: NEW Component: python-utils Keywords: FutureFeature, Triaged Assignee: mhroncok(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, mhroncok(a)redhat.com, python-sig(a)lists.fedoraproject.org, thomas.andrejak(a)gmail.com Target Milestone: --- Classification: Fedora Latest upstream release: 3.2.0 Current version/release in rawhide: 3.1.0-1.fc37 URL: https://github.com/WoLpH/python-utils Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/12707/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2085998

1 20

[Bug 2095982] New: rocksdb-7.3.1 is available
by bugzilla＠redhat.com 17 Oct '22

17 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2095982 Bug ID: 2095982 Summary: rocksdb-7.3.1 is available Product: Fedora Version: rawhide Status: NEW Component: rocksdb Keywords: FutureFeature, Triaged Assignee: hegjon(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, hegjon(a)gmail.com, mmuzila(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 7.3.1 Upstream release that is considered latest: 7.3.1 Current version/release in rawhide: 7.2.2-3.fc37 URL: https://github.com/facebook/rocksdb Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/15560/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/rocksdb -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2095982

1 21

[Bug 2067022] New: ImageMagick: heap-buffer-overflow in PushShortPixel of quantum-private.h
by bugzilla＠redhat.com 07 Oct '22

07 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2067022 Bug ID: 2067022 Summary: ImageMagick: heap-buffer-overflow in PushShortPixel of quantum-private.h Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: trathi(a)redhat.com CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, jhorak(a)redhat.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Other A heap-buffer-overflow flaw was found in PushShortPixel function of quantum-private.h References: https://github.com/ImageMagick/ImageMagick/issues/4974 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2067022

1 10

[Bug 2111245] New: dd_rescue-1.99.12 is available
by bugzilla＠redhat.com 05 Oct '22

05 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2111245 Bug ID: 2111245 Summary: dd_rescue-1.99.12 is available Product: Fedora Version: rawhide Status: NEW Component: dd_rescue Keywords: FutureFeature, Triaged Assignee: rebus(a)seznam.cz Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: andreas(a)bawue.net, epel-packagers-sig(a)lists.fedoraproject.org, rebus(a)seznam.cz, rhbugs(a)n-dimensional.de, steve(a)silug.org, susi.lehtola(a)iki.fi Target Milestone: --- Classification: Fedora Releases retrieved: 1.99.12 Upstream release that is considered latest: 1.99.12 Current version/release in rawhide: 1.99.11-4.fc37 URL: http://www.garloff.de/kurt/linux/ddrescue/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/406/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/dd_rescue -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2111245

1 3

[Bug 2105033] New: CVE-2022-2097 openssl3: openssl: AES OCB fails to encrypt some bytes [epel-8]
by bugzilla＠redhat.com 05 Oct '22

05 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2105033 Bug ID: 2105033 Summary: CVE-2022-2097 openssl3: openssl: AES OCB fails to encrypt some bytes [epel-8] Product: Fedora EPEL Version: epel8 Status: NEW Component: openssl3 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: michel(a)michel-slm.name Reporter: mcascell(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-8. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2105033

1 5

[Bug 2099970] New: CVE-2022-2068 openssl3: openssl: the c_rehash script allows command injection [epel-8]
by bugzilla＠redhat.com 05 Oct '22

05 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2099970 Bug ID: 2099970 Summary: CVE-2022-2068 openssl3: openssl: the c_rehash script allows command injection [epel-8] Product: Fedora EPEL Version: epel8 Status: NEW Component: openssl3 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: michel(a)michel-slm.name Reporter: mrehak(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-8. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2099970

1 5

[Bug 2095814] New: CVE-2022-1292 openssl3: openssl: c_rehash script allows command injection [epel-8]
by bugzilla＠redhat.com 05 Oct '22

05 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2095814 Bug ID: 2095814 Summary: CVE-2022-1292 openssl3: openssl: c_rehash script allows command injection [epel-8] Product: Fedora EPEL Version: epel8 Status: NEW Component: openssl3 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: michel(a)michel-slm.name Reporter: mcascell(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-8. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2095814

1 5

[Bug 2089472] New: CVE-2022-1343 openssl3: openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS [epel-8]
by bugzilla＠redhat.com 05 Oct '22

05 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2089472 Bug ID: 2089472 Summary: CVE-2022-1343 openssl3: openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS [epel-8] Product: Fedora EPEL Version: epel8 Status: NEW Component: openssl3 Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: michel(a)michel-slm.name Reporter: tcullum(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-8. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2089472

1 6

[Bug 2105826] New: Please branch and build nptyping for EPEL 9
by bugzilla＠redhat.com 05 Oct '22

05 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2105826 Bug ID: 2105826 Summary: Please branch and build nptyping for EPEL 9 Product: Fedora Version: rawhide Status: NEW Component: python-nptyping Assignee: mail(a)fabian-affolter.ch Reporter: zebob.m(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, mail(a)fabian-affolter.ch, python-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Please branch and build nptyping for EPEL 9. Thanks. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2105826

1 4

[Bug 2116447] New: papirus-icon-theme-20220808 is available
by bugzilla＠redhat.com 05 Oct '22

05 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2116447 Bug ID: 2116447 Summary: papirus-icon-theme-20220808 is available Product: Fedora Version: rawhide Status: NEW Component: papirus-icon-theme Keywords: FutureFeature, Triaged Assignee: zebob.m(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, zebob.m(a)gmail.com Target Milestone: --- Classification: Fedora Releases retrieved: 20220808 Upstream release that is considered latest: 20220808 Current version/release in rawhide: 20220710-2.fc37 URL: https://github.com/PapirusDevelopmentTeam/papirus-icon-theme/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/18645/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/papirus-icon-theme -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2116447

1 20

[Bug 2110285] New: python-executing-0.9.0 is available
by bugzilla＠redhat.com 03 Oct '22

03 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2110285 Bug ID: 2110285 Summary: python-executing-0.9.0 is available Product: Fedora Version: rawhide Status: NEW Component: python-executing Keywords: FutureFeature, Triaged Assignee: rominf(a)aiven.io Reporter: upstream-release-monitoring(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, lbalhar(a)redhat.com, paul.wouters(a)aiven.io, rominf(a)aiven.io Target Milestone: --- Classification: Fedora Releases retrieved: 0.9.0 Upstream release that is considered latest: 0.9.0 Current version/release in rawhide: 0.8.2-3.fc37 URL: https://pypi.org/project/executing/0.3.1 Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/24668/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-executing -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2110285

1 21

[Bug 2104744] New: CVE-2022-33099 compat-lua: lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling [epel-all]
by bugzilla＠redhat.com 03 Oct '22

03 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2104744 Bug ID: 2104744 Summary: CVE-2022-33099 compat-lua: lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: compat-lua Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: hdegoede(a)redhat.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, hdegoede(a)redhat.com, michel(a)michel-slm.name, moceap(a)hotmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2104744

1 3

[Bug 2104745] New: CVE-2022-33099 compat-lua: lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling [fedora-all]
by bugzilla＠redhat.com 03 Oct '22

03 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2104745 Bug ID: 2104745 Summary: CVE-2022-33099 compat-lua: lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling [fedora-all] Product: Fedora Version: 36 Status: NEW Component: compat-lua Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: hdegoede(a)redhat.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, hdegoede(a)redhat.com, michel(a)michel-slm.name, moceap(a)hotmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2104745

1 3

[Bug 2121905] New: python-pikepdf-5.6.0 is available
by bugzilla＠redhat.com 02 Oct '22

02 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2121905 Bug ID: 2121905 Summary: python-pikepdf-5.6.0 is available Product: Fedora Version: rawhide Status: NEW Component: python-pikepdf Keywords: FutureFeature, Triaged Assignee: quantum.analyst(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, python-sig(a)lists.fedoraproject.org, quantum.analyst(a)gmail.com, zdohnal(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 5.6.0 Upstream release that is considered latest: 5.6.0 Current version/release in rawhide: 5.3.0-1.fc37 URL: https://github.com/pikepdf/pikepdf Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/17724/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-pikepdf -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2121905

1 16

[Bug 2121962] New: ImageMagick-6.9.12.62 is available
by bugzilla＠redhat.com 28 Sep '22

28 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2121962 Bug ID: 2121962 Summary: ImageMagick-6.9.12.62 is available Product: Fedora Version: rawhide Status: NEW Component: ImageMagick Keywords: FutureFeature, Triaged Assignee: luya_tfz(a)thefinalzone.net Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora Releases retrieved: 6.9.12.62 Upstream release that is considered latest: 6.9.12.62 Current version/release in rawhide: 6.9.12.61-1.fc38 URL: https://legacy.imagemagick.org Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/258035/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/ImageMagick -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2121962

1 21

[Bug 2116541] New: CVE-2022-2719 ImageMagick: Assertion Failure could lead to DoS due to attempted writing of NULL image list [epel-all]
by bugzilla＠redhat.com 28 Sep '22

28 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2116541 Bug ID: 2116541 Summary: CVE-2022-2719 ImageMagick: Assertion Failure could lead to DoS due to attempted writing of NULL image list [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ImageMagick Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: luya_tfz(a)thefinalzone.net Reporter: tcullum(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2116541

1 6

[Bug 2088754] New: python-libtmux-0.12.0a0 is available
by bugzilla＠redhat.com 25 Sep '22

25 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2088754 Bug ID: 2088754 Summary: python-libtmux-0.12.0a0 is available Product: Fedora Version: rawhide Status: NEW Component: python-libtmux Keywords: FutureFeature, Triaged Assignee: mail(a)fabian-affolter.ch Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, mail(a)fabian-affolter.ch Target Milestone: --- Classification: Fedora Latest upstream release: 0.12.0a0 Current version/release in rawhide: 0.11.0-1.fc37 URL: https://pypi.python.org/pypi/libtmux Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/13040/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2088754

1 64

[Bug 2120679] New: gsv3 syntax highlighting breaks with the pcre2 transition
by bugzilla＠redhat.com 22 Sep '22

22 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2120679 Bug ID: 2120679 Summary: gsv3 syntax highlighting breaks with the pcre2 transition Product: Fedora Version: rawhide OS: Linux Status: NEW Component: gtksourceview3 Severity: high Assignee: mclasen(a)redhat.com Reporter: fedora(a)lyes.eu QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, gnome-sig(a)lists.fedoraproject.org, icq(a)gnome.org, mclasen(a)redhat.com Target Milestone: --- Classification: Fedora Note: this also happens with gsv4, but, here, I am only concerned with gsv3 which is no longer maintained, and will then probably not be fixed upstream. Description of problem: I am the packager of notekit which depends on gtksourceviewmm3, and thus gtksourceview3. A port to gsv4 is impossible due to the unavailability of the mm bindings for gsv4. We noticed that the recent glib2 move to pcre2 broke notekit entirely on f37/rawhide (it relies on gsv3 to do Markdown formatting and syntax highlighting), and disabling syntax highlighting solves Markdown formatting (as it is not broken by the pcre2 change), but leaves us without syntax highlighting, a relatively important part of the software. The regex issues will probably be fixed in gsv4, so I'm asking if it would be possible to backport these to gsv3? The files which seems to need patching are asp.lang, html.lang and css.lang. Version-Release number of selected component (if applicable): ~ ❯ rpm -q gtksourceview3 gtksourceview3-3.24.11-8.fc37.x86_64 ~ ❯ rpm -q gtksourceviewmm3 gtksourceviewmm3-3.18.0-15.fc37.x86_64 How reproducible: Always Steps to Reproduce: 1. Open NoteKit 2. No Markdown formatting 3. Disable syntax highlighting and restarting NoteKit 4. Markdown formatting is back, but no syntax highlighting Actual results: ``` (notekit:307145): GtkSourceView-WARNING **: 14:09:18.135: Failed to load '/usr/share/notekit/sourceview/markdown.lang': In file '/tmp/notekit.gsv/markdownlisting.lang' referenced from '/usr/share/notekit/sourceview/markdown.lang': In file '/usr/share/gtksourceview-3.0/language-specs/asp.lang' referenced from '/usr/share/notekit/sourceview/markdown.lang': In file '/usr/share/gtksourceview-3.0/language-specs/html.lang' referenced from '/usr/share/notekit/sourceview/markdown.lang': In file '/usr/share/gtksourceview-3.0/language-specs/css.lang' referenced from '/usr/share/notekit/sourceview/markdown.lang': Error while compiling regular expression (?i-x)(?:(?ix) (?: (?: -- | -? (?:(?ix) (?: [a-z_] | (?:(?i-x)[\x{80}-\x{10ffff}]) | (?:(?ix) (?: \\ # backslash (?: [^\n\r\f0-9a-f] | # not newline or hex digit; or [0-9a-f]{1,6} \s? # 1-6 hex digits, trailing whitespace (not necessary in some cases) ) ) ) ) ) ) (?:(?ix) (?> (?: [a-z0-9_-]+ | (?:(?i-x)[\x{80}-\x{10ffff}])+ | (?:(?ix) (?: \\ # backslash (?: [^\n\r\f0-9a-f] | # not newline or hex digit; or [0-9a-f]{1,6} \s? # 1-6 hex digits, trailing whitespace (not necessary in some cases) ) ) )+ )+ ) )? ) ) at char 127: plage déclassée dans la classe de caractère ``` Expected results: It works. Additional info: The same issues are encountered in gsv4. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2120679

1 2

[Bug 2116540] New: CVE-2022-2719 ImageMagick: Assertion Failure could lead to DoS due to attempted writing of NULL image list [fedora-all]
by bugzilla＠redhat.com 21 Sep '22

21 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2116540 Bug ID: 2116540 Summary: CVE-2022-2719 ImageMagick: Assertion Failure could lead to DoS due to attempted writing of NULL image list [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ImageMagick Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: luya_tfz(a)thefinalzone.net Reporter: tcullum(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2116540

1 6

[Bug 2116537] New: ImageMagick: Assertion Failure could lead to DoS due to attempted writing of NULL image list
by bugzilla＠redhat.com 21 Sep '22

21 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2116537 Bug ID: 2116537 Summary: ImageMagick: Assertion Failure could lead to DoS due to attempted writing of NULL image list Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: tcullum(a)redhat.com CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, jhorak(a)redhat.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Other In ImageMagick 7.1.0-29, a crafted file could trigger an assertion failure when a call to WriteImages was made in MagickWand/operation.c, due to a NULL image list. This could potentially cause a denial of service. This was fixed in upstream ImageMagick version 7.1.0-30. References: https://github.com/ImageMagick/ImageMagick/commit/716496e6df0add89e9679d6da… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2116537

1 8

[Bug 2118163] New: F37FailsToInstall: mkdocs
by bugzilla＠redhat.com 17 Sep '22

17 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2118163 Bug ID: 2118163 Summary: F37FailsToInstall: mkdocs Product: Fedora Version: 37 Status: NEW Component: mkdocs Assignee: manisandro(a)gmail.com Reporter: mhroncok(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, rcallicotte(a)mailbox.org, williamjmorenor(a)gmail.com Blocks: 2045109 (F37FailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically. If you feel that this output has mistakes, please contact me via email (mhroncok(a)redhat.com) Your package (mkdocs) Fails To Install in Fedora 37: can't install mkdocs: - nothing provides (python3.11dist(markdown) < 3.4~~ with python3.11dist(markdown) >= 3.2.1) needed by mkdocs-1.3.1-2.fc37.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. To reproduce, use the koji/local repo only, e.g. in mock: $ mock -r fedora-37-x86_64 --config-opts mirrored=False install mkdocs P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2045109 [Bug 2045109] Fedora 37 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2118163

1 5

[Bug 2118159] New: F38FailsToInstall: mkdocs
by bugzilla＠redhat.com 17 Sep '22

17 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2118159 Bug ID: 2118159 Summary: F38FailsToInstall: mkdocs Product: Fedora Version: rawhide Status: NEW Component: mkdocs Assignee: manisandro(a)gmail.com Reporter: mhroncok(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, rcallicotte(a)mailbox.org, williamjmorenor(a)gmail.com Blocks: 2117177 (F38FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically. If you feel that this output has mistakes, please contact me via email (mhroncok(a)redhat.com) Your package (mkdocs) Fails To Install in Fedora 38: can't install mkdocs: - nothing provides (python3.11dist(markdown) < 3.4~~ with python3.11dist(markdown) >= 3.2.1) needed by mkdocs-1.3.1-2.fc37.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. To reproduce, use the koji/local repo only, e.g. in mock: $ mock -r fedora-38-x86_64 --config-opts mirrored=False install mkdocs P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2117177 [Bug 2117177] Fedora 38 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2118159

1 12

[Bug 2120360] New: /usr/bin/meld is not executable
by bugzilla＠redhat.com 14 Sep '22

14 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2120360 Bug ID: 2120360 Summary: /usr/bin/meld is not executable Product: Fedora Version: rawhide OS: Linux Status: NEW Component: meld Severity: high Assignee: dmaphy(a)fedoraproject.org Reporter: fedora(a)lyes.eu QA Contact: extras-qa(a)fedoraproject.org CC: cwickert(a)fedoraproject.org, dmaphy(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, lkundrak(a)v3.sk, michel(a)michel-slm.name, oliver(a)linux-kernel.at Target Milestone: --- Classification: Fedora Description of problem: When installing meld, /usr/bin/meld was not executable. Version-Release number of selected component (if applicable): 3.21.3-1.fc38 How reproducible: Always Steps to Reproduce: 1. sudo dnf install meld 2. bash: /usr/bin/meld: Permission denied Actual results: /usr/bin/meld is not executable. Meld cannot be launched from overview, command line, or git mergetool. Expected results: /usr/bin/meld is executable. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2120360

1 13

[Bug 2119958] New: python-matplotlib-3.6.0rc1 is available
by bugzilla＠redhat.com 12 Sep '22

12 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2119958 Bug ID: 2119958 Summary: python-matplotlib-3.6.0rc1 is available Product: Fedora Version: rawhide Status: NEW Component: python-matplotlib Keywords: FutureFeature, Triaged Assignee: quantum.analyst(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, jonathan.underwood(a)gmail.com, paulo.cesar.pereira.de.andrade(a)gmail.com, python-sig(a)lists.fedoraproject.org, quantum.analyst(a)gmail.com, thibault(a)north.li, tomspur(a)fedoraproject.org Target Milestone: --- Classification: Fedora Releases retrieved: 3.6.0rc1 Upstream release that is considered latest: 3.6.0rc1 Current version/release in rawhide: 3.5.3-3.fc38 URL: https://pypi.python.org/pypi/matplotlib Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/3919/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-matplotlib -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2119958

1 4

[Bug 2116188] New: perl-Text-CSV-2.02 is available
by bugzilla＠redhat.com 12 Sep '22

12 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2116188 Bug ID: 2116188 Summary: perl-Text-CSV-2.02 is available Product: Fedora Version: rawhide Status: NEW Component: perl-Text-CSV Keywords: FutureFeature, Triaged Assignee: jvromans(a)squirrel.nl Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, jvromans(a)squirrel.nl, lkundrak(a)v3.sk, mi(a)v3.sk, perl-devel(a)lists.fedoraproject.org, redhat-bugzilla(a)linuxnetz.de Target Milestone: --- Classification: Fedora Releases retrieved: 2.02 Upstream release that is considered latest: 2.02 Current version/release in rawhide: 2.01-5.fc37 URL: http://search.cpan.org/dist/Text-CSV/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/3433/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/perl-Text-CSV -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2116188

1 6

[Bug 2107201] New: convert foo.jpg json: aborts with 6.9.12-58
by bugzilla＠redhat.com 08 Sep '22

08 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107201 Bug ID: 2107201 Summary: convert foo.jpg json: aborts with 6.9.12-58 Product: Fedora Version: rawhide Status: NEW Component: ImageMagick Assignee: luya_tfz(a)thefinalzone.net Reporter: mtasaka(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Blocks: 1988079 Target Milestone: --- Classification: Fedora Description of problem: convert foo.jpg json: aborts with 6.9.12-58 as reported on https://github.com/ImageMagick/ImageMagick6/issues/191 Version-Release number of selected component (if applicable): ImageMagick-6.9.12.58-1.fc37.x86_64 How reproducible: 100% Steps to Reproduce: 1. convert foo.jpg json: Actual results: aborts Expected results: Should work, as with ImageMagick-6.9.12.52-1.fc36.x86_64 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1988079 [Bug 1988079] rubygem-image_processing: FTBFS in Fedora rawhide/f35 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107201

1 15

[Bug 2105662] New: ImageMagick-6.9.12.56 is available
by bugzilla＠redhat.com 08 Sep '22

08 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2105662 Bug ID: 2105662 Summary: ImageMagick-6.9.12.56 is available Product: Fedora Version: rawhide Status: NEW Component: ImageMagick Keywords: FutureFeature, Triaged Assignee: luya_tfz(a)thefinalzone.net Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora Releases retrieved: 6.9.12.53, 6.9.12.54, 6.9.12.55, 6.9.12.56 Upstream release that is considered latest: 6.9.12.56 Current version/release in rawhide: 6.9.12.52-1.fc37 URL: https://legacy.imagemagick.org Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/258035/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/ImageMagick -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2105662

1 18

[Bug 2120851] New: xsimd-9.0.0 is available
by bugzilla＠redhat.com 07 Sep '22

07 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2120851 Bug ID: 2120851 Summary: xsimd-9.0.0 is available Product: Fedora Version: rawhide Status: NEW Component: xsimd Keywords: FutureFeature, Triaged Assignee: mhroncok(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kkeithle(a)redhat.com, mhroncok(a)redhat.com, sguelton(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 9.0.0 Upstream release that is considered latest: 9.0.0 Current version/release in rawhide: 8.1.0-2.fc38 URL: https://github.com/xtensor-stack/xsimd Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/138109/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/xsimd -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2120851

1 4

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 31 Aug '22

31 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6283 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 31 Aug '22

31 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6283 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 31 Aug '22

31 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 --- Comment #38 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: OSSM-2.2-RHEL-8 Via RHSA-2022:6283 https://access.redhat.com/errata/RHSA-2022:6283 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 31 Aug '22

31 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 --- Comment #42 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: OSSM-2.2-RHEL-8 Via RHSA-2022:6283 https://access.redhat.com/errata/RHSA-2022:6283 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2122935] New: Please branch and build python-pillow for EPEL 8
by bugzilla＠redhat.com 31 Aug '22

31 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2122935 Bug ID: 2122935 Summary: Please branch and build python-pillow for EPEL 8 Product: Fedora EPEL Version: epel8 Status: NEW Component: python-pillow Assignee: manisandro(a)gmail.com Reporter: gigeti2945(a)yubua.com CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, python-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Please can you branch and build python-pillow for EPEL 8 thanks -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2122935

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 30 Aug '22

30 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6224 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 30 Aug '22

30 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 --- Comment #19 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:6224 https://access.redhat.com/errata/RHSA-2022:6224 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2087911] CVE-2022-1343 openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS
by bugzilla＠redhat.com 30 Aug '22

30 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087911 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6224 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087911

1 0

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 30 Aug '22

30 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087913 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6224 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087913

1 0

[Bug 2087911] CVE-2022-1343 openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS
by bugzilla＠redhat.com 30 Aug '22

30 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087911 --- Comment #6 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:6224 https://access.redhat.com/errata/RHSA-2022:6224 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087911

1 0

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 30 Aug '22

30 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087913 --- Comment #9 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:6224 https://access.redhat.com/errata/RHSA-2022:6224 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087913

1 0

[Bug 2120124] New: notmuch-0.37 is available
by bugzilla＠redhat.com 30 Aug '22

30 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2120124 Bug ID: 2120124 Summary: notmuch-0.37 is available Product: Fedora Version: rawhide Status: NEW Component: notmuch Keywords: FutureFeature, Triaged Assignee: mjg(a)fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, lewk(a)openmailbox.org, mjg(a)fedoraproject.org, rbean(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 0.37 Upstream release that is considered latest: 0.37 Current version/release in rawhide: 0.37~rc0-1.fc38 URL: http://notmuchmail.org/releases/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/2498/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/notmuch -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2120124

1 9

[Bug 2102943] CVE-2022-2274 openssl: AVX-512-specific heap buffer overflow
by bugzilla＠redhat.com 30 Aug '22

30 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102943 Mauro Matteo Cascella <mcascell(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(mcascell(a)redhat.c | |om) | -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102943

1 0

[Bug 2122339] CVE-2020-35530 LibRaw: Out of bounds write in new_node() function
by bugzilla＠redhat.com 29 Aug '22

29 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2122339 Pedro Sampaio <psampaio(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Comment|0 |updated --- Comment #0 has been edited --- In LibRaw, there is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file. Upstream issue: https://github.com/LibRaw/LibRaw/issues/272 Upstream fix: https://github.com/LibRaw/LibRaw/commit/11c4db253ef2c9bb44247b578f5caa57c66… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2122339

1 0

[Bug 2122339] CVE-2020-35530 LibRaw: Out of bounds write in new_node() function
by bugzilla＠redhat.com 29 Aug '22

29 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2122339 Pedro Sampaio <psampaio(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Comment|0 |updated --- Comment #0 has been edited --- There is an out-of-bounds write vulnerability within the "new_node()" function (libraw\src\x3f\x3f_utils_patched.cpp) that can be triggered via a crafted X3F file. Upstream issue: https://github.com/LibRaw/LibRaw/issues/272 Upstream fix: https://github.com/LibRaw/LibRaw/commit/11c4db253ef2c9bb44247b578f5caa57c66… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2122339

1 0

[Bug 2122339] CVE-2020-35530 LibRaw: Out of bounds write in new_node() function
by bugzilla＠redhat.com 29 Aug '22

29 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2122339 Pedro Sampaio <psampaio(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2122363 Fixed In Version| |LibRaw 0.21-Beta1, LibRaw | |0.20.2, LibRaw 0.20.1, | |LibRaw 0.20.0, LibRaw | |0.20-RC2 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2122339

1 0

[Bug 2102943] CVE-2022-2274 openssl: AVX-512-specific heap buffer overflow
by bugzilla＠redhat.com 29 Aug '22

29 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102943 Product Security DevOps Team <prodsec-dev(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mcascell(a)redhat.com Flags|needinfo?(security-response |needinfo?(mcascell(a)redhat.c |-team(a)redhat.com) |om) -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102943

1 0

[Bug 2122339] CVE-2020-35530 LibRaw: Out of bounds write in new_node() function
by bugzilla＠redhat.com 29 Aug '22

29 Aug '22

1 0

[Bug 2121934] New: python-stack-data-0.5.0 is available
by bugzilla＠redhat.com 27 Aug '22

27 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2121934 Bug ID: 2121934 Summary: python-stack-data-0.5.0 is available Product: Fedora Version: rawhide Status: NEW Component: python-stack-data Keywords: FutureFeature, Triaged Assignee: lbalhar(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, lbalhar(a)redhat.com, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora Releases retrieved: 0.5.0 Upstream release that is considered latest: 0.5.0 Current version/release in rawhide: 0.4.0-1.fc38 URL: https://pypi.org/project/stack-data/0.0.7 Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/90020/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-stack-data -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2121934

1 2

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 25 Aug '22

25 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6188 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 25 Aug '22

25 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 --- Comment #37 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Node Maintenance Operator 4.11 for RHEL 8 Via RHSA-2022:6188 https://access.redhat.com/errata/RHSA-2022:6188 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 25 Aug '22

25 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6188 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 25 Aug '22

25 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 --- Comment #41 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Node Maintenance Operator 4.11 for RHEL 8 Via RHSA-2022:6188 https://access.redhat.com/errata/RHSA-2022:6188 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 22 Aug '22

22 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:6131 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 22 Aug '22

22 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:6131 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2117483] New: python-matplotlib-3.5.3 is available
by bugzilla＠redhat.com 21 Aug '22

21 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2117483 Bug ID: 2117483 Summary: python-matplotlib-3.5.3 is available Product: Fedora Version: rawhide Status: NEW Component: python-matplotlib Keywords: FutureFeature, Triaged Assignee: quantum.analyst(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, jonathan.underwood(a)gmail.com, paulo.cesar.pereira.de.andrade(a)gmail.com, python-sig(a)lists.fedoraproject.org, quantum.analyst(a)gmail.com, thibault(a)north.li, tomspur(a)fedoraproject.org Target Milestone: --- Classification: Fedora Releases retrieved: 3.5.3 Upstream release that is considered latest: 3.5.3 Current version/release in rawhide: 3.5.2-8.fc37 URL: https://pypi.python.org/pypi/matplotlib Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/3919/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-matplotlib -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2117483

1 6

[Bug 2117997] New: Non-responsive maintainer check for fale
by bugzilla＠redhat.com 20 Aug '22

20 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2117997 Bug ID: 2117997 Summary: Non-responsive maintainer check for fale Product: Fedora Version: rawhide Hardware: All OS: Linux Status: NEW Component: asio Severity: medium Priority: medium Assignee: uwog(a)uwog.net Reporter: belegdol(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, me(a)fale.io, raineforest(a)raineforest.me, uwog(a)uwog.net Target Milestone: --- Classification: Fedora This bug is part of the non-responsive maintainer procedure for fale, following https://docs.fedoraproject.org/en-US/fesco/Policy_for_nonresponsive_package…. Please respond if you are still active in Fedora and want to maintain <package>. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2117997

1 10

[Bug 2119450] New: python-pygraphviz-1.10rc1 is available
by bugzilla＠redhat.com 20 Aug '22

20 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2119450 Bug ID: 2119450 Summary: python-pygraphviz-1.10rc1 is available Product: Fedora Version: rawhide Status: NEW Component: python-pygraphviz Keywords: FutureFeature, Triaged Assignee: zbyszek(a)in.waw.pl Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, logans(a)cottsay.net, python-sig(a)lists.fedoraproject.org, zbyszek(a)in.waw.pl Target Milestone: --- Classification: Fedora Releases retrieved: 1.10rc1 Upstream release that is considered latest: 1.10rc1 Current version/release in rawhide: 1.9-4.fc37 URL: https://github.com/pygraphviz/pygraphviz Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/15839/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-pygraphviz -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2119450

1 9

[Bug 2118075] New: meld-3.21.3 is available
by bugzilla＠redhat.com 19 Aug '22

19 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2118075 Bug ID: 2118075 Summary: meld-3.21.3 is available Product: Fedora Version: rawhide Status: NEW Component: meld Keywords: FutureFeature, Triaged Assignee: dmaphy(a)fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: cwickert(a)fedoraproject.org, dmaphy(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, lkundrak(a)v3.sk, michel(a)michel-slm.name, oliver(a)linux-kernel.at Target Milestone: --- Classification: Fedora Releases retrieved: 3.21.3 Upstream release that is considered latest: 3.21.3 Current version/release in rawhide: 3.21.2-2.fc37 URL: http://meldmerge.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/5520/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/meld -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2118075

1 7

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 18 Aug '22

18 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6113 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 18 Aug '22

18 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 --- Comment #36 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Application Interconnect 1 for RHEL 8 Via RHSA-2022:6113 https://access.redhat.com/errata/RHSA-2022:6113 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 18 Aug '22

18 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6113 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 18 Aug '22

18 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 --- Comment #40 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Application Interconnect 1 for RHEL 8 Via RHSA-2022:6113 https://access.redhat.com/errata/RHSA-2022:6113 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 17 Aug '22

17 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 --- Doc Text *updated* by Anten Skrabec <askrabec(a)redhat.com> --- A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2116423] New: python-asttokens-2.0.6 is available
by bugzilla＠redhat.com 17 Aug '22

17 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2116423 Bug ID: 2116423 Summary: python-asttokens-2.0.6 is available Product: Fedora Version: rawhide Status: NEW Component: python-asttokens Keywords: FutureFeature, Triaged Assignee: zbyszek(a)in.waw.pl Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, zbyszek(a)in.waw.pl Target Milestone: --- Classification: Fedora Releases retrieved: 2.0.6 Upstream release that is considered latest: 2.0.6 Current version/release in rawhide: 2.0.5-8.fc37 URL: https://pypi.python.org/pypi/asttokens Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/19936/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-asttokens -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2116423

1 6

[Bug 2118116] New: notmuch-0.37~rc0 is available
by bugzilla＠redhat.com 14 Aug '22

14 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2118116 Bug ID: 2118116 Summary: notmuch-0.37~rc0 is available Product: Fedora Version: rawhide Status: NEW Component: notmuch Keywords: FutureFeature, Triaged Assignee: mjg(a)fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, lewk(a)openmailbox.org, mjg(a)fedoraproject.org, rbean(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 0.37~rc0 Upstream release that is considered latest: 0.37~rc0 Current version/release in rawhide: 0.36-5.fc37 URL: http://notmuchmail.org/releases/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/2498/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/notmuch -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2118116

1 3

[Bug 2118061] Please branch and build mingw-libxslt for EPEL 9
by bugzilla＠redhat.com 14 Aug '22

14 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2118061 Kalev Lember <klember(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Doc Type|--- |If docs needed, set a value Assignee|klember(a)redhat.com |epel-packagers-sig(a)lists.fe | |doraproject.org --- Comment #1 from Kalev Lember <klember(a)redhat.com> --- I've added both you and epel-packagers-sig. Feel free to go ahead and build it :) Thanks! -- You are receiving this mail because: You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2118061

1 0

[Bug 2117996] New: Non-responsive maintainer check for dcavalca
by bugzilla＠redhat.com 13 Aug '22

13 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2117996 Bug ID: 2117996 Summary: Non-responsive maintainer check for dcavalca Product: Fedora Version: rawhide Hardware: All OS: Linux Status: NEW Component: asio Severity: medium Priority: medium Assignee: uwog(a)uwog.net Reporter: belegdol(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, me(a)fale.io, raineforest(a)raineforest.me, uwog(a)uwog.net Target Milestone: --- Classification: Fedora This bug is part of the non-responsive maintainer procedure for dcavalca, following https://docs.fedoraproject.org/en-US/fesco/Policy_for_nonresponsive_package…. Please respond if you are still active in Fedora and want to maintain <package>. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2117996

1 2

[Bug 2118041] New: python-stack-data-0.4.0 is available
by bugzilla＠redhat.com 13 Aug '22

13 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2118041 Bug ID: 2118041 Summary: python-stack-data-0.4.0 is available Product: Fedora Version: rawhide Status: NEW Component: python-stack-data Keywords: FutureFeature, Triaged Assignee: lbalhar(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, lbalhar(a)redhat.com, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora Releases retrieved: 0.4.0 Upstream release that is considered latest: 0.4.0 Current version/release in rawhide: 0.3.0-3.fc37 URL: https://pypi.org/project/stack-data/0.0.7 Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/90020/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-stack-data -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2118041

1 2

[Bug 2102019] New: CVE-2022-34299 libdwarf: heap buffer over-read in dwarf_global_formref_b() in dwarf_form.c
by bugzilla＠redhat.com 12 Aug '22

12 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102019 Bug ID: 2102019 Summary: CVE-2022-34299 libdwarf: heap buffer over-read in dwarf_global_formref_b() in dwarf_form.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: trathi(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, jitesh.1337(a)gmail.com, michel(a)michel-slm.name, orion(a)nwra.com, tom(a)compton.nu Target Milestone: --- Classification: Other There is a heap-based buffer over-read in libdwarf 0.4.0. This issue is related to dwarf_global_formref_b. https://github.com/davea42/libdwarf-code/issues/119 https://github.com/davea42/libdwarf-code/commit/7ef09e1fc9ba07653dd078edb24… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102019

1 9

[Bug 2117393] New: pyelftools-0.29 is available
by bugzilla＠redhat.com 11 Aug '22

11 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2117393 Bug ID: 2117393 Summary: pyelftools-0.29 is available Product: Fedora Version: rawhide Status: NEW Component: pyelftools Keywords: FutureFeature, Triaged Assignee: dominik(a)greysector.net Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: besser82(a)fedoraproject.org, dcavalca(a)fb.com, dominik(a)greysector.net, epel-packagers-sig(a)lists.fedoraproject.org, mail(a)kushaldas.in, moez.roy(a)gmail.com, terjeros(a)phys.ntnu.no Target Milestone: --- Classification: Fedora Releases retrieved: 0.29 Upstream release that is considered latest: 0.29 Current version/release in rawhide: 0.28-3.fc37 URL: https://pypi.python.org/pypi/pyelftools Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/16219/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/pyelftools -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2117393

1 3

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 10 Aug '22

10 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6040 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 10 Aug '22

10 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 --- Comment #35 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Openshift Serveless 1.24 Via RHSA-2022:6040 https://access.redhat.com/errata/RHSA-2022:6040 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 10 Aug '22

10 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6040 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 10 Aug '22

10 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 --- Comment #38 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Openshift Serveless 1.24 Via RHSA-2022:6040 https://access.redhat.com/errata/RHSA-2022:6040 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 10 Aug '22

10 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6042 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 10 Aug '22

10 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 --- Comment #34 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Openshift Serverless 1 on RHEL 8 Via RHSA-2022:6042 https://access.redhat.com/errata/RHSA-2022:6042 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 10 Aug '22

10 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:6042 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 10 Aug '22

10 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 --- Comment #37 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Openshift Serverless 1 on RHEL 8 Via RHSA-2022:6042 https://access.redhat.com/errata/RHSA-2022:6042 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 09 Aug '22

09 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 Bug 2107371 depends on bug 2110355, which changed state. Bug 2110355 Summary: CVE-2022-30630 golang: io/fs: stack exhaustion in Glob [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2110355 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 09 Aug '22

09 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 Bug 2107386 depends on bug 2110336, which changed state. Bug 2110336 Summary: CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2110336 What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2116586] New: python-flask-2.2.2 is available
by bugzilla＠redhat.com 09 Aug '22

09 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2116586 Bug ID: 2116586 Summary: python-flask-2.2.2 is available Product: Fedora Version: rawhide Status: NEW Component: python-flask Keywords: FutureFeature, Triaged Assignee: fzatlouk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: danielmyoung(a)gmail.com, epel-packagers-sig(a)lists.fedoraproject.org, fzatlouk(a)redhat.com, hushan.jia(a)gmail.com, karlthered(a)gmail.com, puiterwijk(a)redhat.com, python-sig(a)lists.fedoraproject.org, tdawson(a)redhat.com, tflink(a)tirfa.us Target Milestone: --- Classification: Fedora Releases retrieved: 2.2.2 Upstream release that is considered latest: 2.2.2 Current version/release in rawhide: 2.2.1-1.fc37 URL: https://pypi.python.org/pypi/Flask Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/3867/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-flask -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2116586

1 4

[Bug 2116571] New: python-werkzeug-2.2.2 is available
by bugzilla＠redhat.com 09 Aug '22

09 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2116571 Bug ID: 2116571 Summary: python-werkzeug-2.2.2 is available Product: Fedora Version: rawhide Status: NEW Component: python-werkzeug Keywords: FutureFeature, Triaged Assignee: fzatlouk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: aurelien(a)bompard.org, danielmyoung(a)gmail.com, epel-packagers-sig(a)lists.fedoraproject.org, fzatlouk(a)redhat.com, karlthered(a)gmail.com, python-sig(a)lists.fedoraproject.org, tdawson(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 2.2.2 Upstream release that is considered latest: 2.2.2 Current version/release in rawhide: 2.2.1-1.fc37 URL: https://pypi.python.org/pypi/Werkzeug Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/4092/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-werkzeug -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2116571

1 3

[Bug 2082387] CVE-2022-29167 hawk: REDoS in hawk.utils.parseHost() when parsing Host header
by bugzilla＠redhat.com 08 Aug '22

08 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2082387 Bug 2082387 depends on bug 2082458, which changed state. Bug 2082458 Summary: CVE-2022-29167 dotnet3.1: hawk: REDoS in hawk.utils.parseHost() when parsing Host header [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2082458 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2082387

1 0

[Bug 2113688] New: rubygem-asciidoctor: FTBFS in Fedora rawhide/f37
by bugzilla＠redhat.com 07 Aug '22

07 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2113688 Bug ID: 2113688 Summary: rubygem-asciidoctor: FTBFS in Fedora rawhide/f37 Product: Fedora Version: rawhide Status: NEW Component: rubygem-asciidoctor Assignee: dan.j.allen(a)gmail.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dan.j.allen(a)gmail.com, epel-packagers-sig(a)lists.fedoraproject.org, ktdreyer(a)ktdreyer.com, logans(a)cottsay.net, mjg(a)fedoraproject.org, tmz(a)pobox.com Blocks: 2045102 (F37FTBFS,RAWHIDEFTBFS) Target Milestone: --- Classification: Fedora rubygem-asciidoctor failed to build from source in Fedora rawhide/f37 https://koji.fedoraproject.org/koji/taskinfo?taskID=89897599 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Please fix rubygem-asciidoctor at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, rubygem-asciidoctor will be orphaned. Before branching of Fedora 38, rubygem-asciidoctor will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails… Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2045102 [Bug 2045102] Fedora 37 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2113688

1 6

[Bug 2039354] Need EPEL8 version for mkdocs package.
by bugzilla＠redhat.com 05 Aug '22

05 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2039354 Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|manisandro(a)gmail.com |epel-packagers-sig(a)lists.fe | |doraproject.org --- Comment #1 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> --- This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component. -- You are receiving this mail because: You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2039354

1 0

[Bug 2011941] CVE-2021-40978 mkdocs: Directory traversal in dev-server [epel-7]
by bugzilla＠redhat.com 05 Aug '22

05 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2011941 Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|manisandro(a)gmail.com |epel-packagers-sig(a)lists.fe | |doraproject.org --- Comment #2 from Fedora Admin user for bugzilla script actions <fedora-admin-xmlrpc(a)fedoraproject.org> --- This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component. -- You are receiving this mail because: You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2011941

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 05 Aug '22

05 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 amctagga(a)redhat.com changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2115944, 2115952, 2115939, | |2115950, 2115942, 2115935, | |2115934, 2115943, 2115936, | |2115932, 2115948, 2115949, | |2115945, 2115937, 2115946, | |2115933, 2115941, 2115940, | |2115938, 2115947, 2115951 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 05 Aug '22

05 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 --- Doc Text *updated* by amctagga(a)redhat.com --- A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to impact availability. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 04 Aug '22

04 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 amctagga(a)redhat.com changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2115538, 2115541, 2115545, | |2115551, 2115544, 2115547, | |2115536, 2115550, 2115537, | |2115549, 2115533, 2115546, | |2115534, 2115535, 2115543, | |2115530, 2115532, 2115540, | |2115548, 2115539, 2115531 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 04 Aug '22

04 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 --- Doc Text *updated* by amctagga(a)redhat.com --- A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2113719] New: python-flask-2.2.0 is available
by bugzilla＠redhat.com 04 Aug '22

04 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2113719 Bug ID: 2113719 Summary: python-flask-2.2.0 is available Product: Fedora Version: rawhide Status: NEW Component: python-flask Keywords: FutureFeature, Triaged Assignee: fzatlouk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: danielmyoung(a)gmail.com, epel-packagers-sig(a)lists.fedoraproject.org, fzatlouk(a)redhat.com, hushan.jia(a)gmail.com, karlthered(a)gmail.com, puiterwijk(a)redhat.com, python-sig(a)lists.fedoraproject.org, tdawson(a)redhat.com, tflink(a)tirfa.us Target Milestone: --- Classification: Fedora Releases retrieved: 2.2.0 Upstream release that is considered latest: 2.2.0 Current version/release in rawhide: 2.1.3-2.fc37 URL: https://pypi.python.org/pypi/Flask Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/3867/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-flask -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2113719

1 7

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 03 Aug '22

03 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 Przemyslaw Roguski <proguski(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On|2098089 | -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 03 Aug '22

03 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5818 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 03 Aug '22

03 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 --- Comment #18 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5818 https://access.redhat.com/errata/RHSA-2022:5818 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2105253] New: python-pikepdf depends on package that won't support Sphinx 5 (FTBFS)
by bugzilla＠redhat.com 02 Aug '22

02 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2105253 Bug ID: 2105253 Summary: python-pikepdf depends on package that won't support Sphinx 5 (FTBFS) Product: Fedora Version: rawhide Status: NEW Component: python-pikepdf Assignee: quantum.analyst(a)gmail.com Reporter: ksurma(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, python-sig(a)lists.fedoraproject.org, quantum.analyst(a)gmail.com, zdohnal(a)redhat.com Target Milestone: --- Classification: Fedora Description of problem: python-pikepdf won't build with Sphinx 5, because it depends on python-sphinx-panels. Upstream developers of the package deprecated it and proposed migration to sphinx-design. Upstream developers of pikepdf have already migrated to this new dependency in the latest released version 5.3.1: https://github.com/pikepdf/pikepdf/blob/v5.3.1/setup.cfg#L66 Please update the package in Rawhide to make it work with Sphinx 5. Version-Release number of selected component (if applicable): 5.1.3-2 How reproducible: Always Steps to Reproduce: $ mock -r fedora-rawhide-x86_64 --addrepo=https://download.copr.fedorainfracloud.org/results/ksurma/sphinx-5/fedora-rawhide-x86_64/ --no-clean <your.src.rpm> $ mock -r fedora-rawhide-x86_64 --addrepo=https://download.copr.fedorainfracloud.org/results/ksurma/sphinx-5/fedora-rawhide-x86_64/ shell Actual results: FTBFS -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2105253

1 4

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 02 Aug '22

02 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5866 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 02 Aug '22

02 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 --- Comment #32 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Developer Tools Via RHSA-2022:5866 https://access.redhat.com/errata/RHSA-2022:5866 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 02 Aug '22

02 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5866 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 02 Aug '22

02 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 --- Comment #35 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Developer Tools Via RHSA-2022:5866 https://access.redhat.com/errata/RHSA-2022:5866 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2104113] New: native zbar depends on to be removed i686 java-openjdk packages
by bugzilla＠redhat.com 01 Aug '22

01 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2104113 Bug ID: 2104113 Summary: native zbar depends on to be removed i686 java-openjdk packages Product: Fedora Version: rawhide Status: NEW Component: zbar Severity: high Assignee: gwync(a)protonmail.com Reporter: jvanek(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dougsland(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, java-maint-sig(a)lists.fedoraproject.org, jhuttana(a)redhat.com, jvanek(a)redhat.com, mchehab(a)infradead.org, mr.marcelo.barbosa(a)gmail.com, negativo17(a)gmail.com, pmikova(a)redhat.com, sgehwolf(a)redhat.com, zzambers(a)redhat.com Blocks: 2083750 Target Milestone: --- Classification: Fedora Dear maintainer, we are going to drop i686 java packages in f37 - https://fedoraproject.org/wiki/Changes/Drop_i686_JDKs your package (or maybe jsut some subpackage) is directly depending on java and is native. Please take care, and adapt your package to exclude java on i686. For your convenience, there was added macro %{java_arches}, including all arches java is available on, which you can use to ifarch-out java specific features out in i686 (on non-java arches). Although for plain java package, the change is as simple as https://src.fedoraproject.org/rpms/maven/c/520942645bfd1e4721dacd536a6ccbf8…, you can not use it. The ExclusiveArch: %{java_arches} is not going to work for you, because your package is not simple java application, and also non-java world depends on it. See exemplar PR: https://src.fedoraproject.org/rpms/graphviz/pull-request/9#request_diff See more details eg in:: https://bugzilla.redhat.com/show_bug.cgi?id=2102298 See why in : https://pagure.io/fesco/issue/2772 Please read carefully proposal: https://fedoraproject.org/wiki/Changes/Drop_i686_JDKs Please see tracking bug for most up to date informations: https://bugzilla.redhat.com/show_bug.cgi?id=2083750 I'm terribly sorry to report this bug so late in f37 lifecycle. If you can, please handle this with priority. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2083750 [Bug 2083750] Drop i686 builds of jdk8,11,17 and latest (18) rpms from f37 onwards -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2104113

1 1

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 01 Aug '22

01 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5799 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 01 Aug '22

01 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 --- Comment #31 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:5799 https://access.redhat.com/errata/RHSA-2022:5799 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 01 Aug '22

01 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5799 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 01 Aug '22

01 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 --- Comment #34 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:5799 https://access.redhat.com/errata/RHSA-2022:5799 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 01 Aug '22

01 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:5800 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 01 Aug '22

01 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:5800 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 01 Aug '22

01 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5775 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107386] CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
by bugzilla＠redhat.com 01 Aug '22

01 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107386 --- Comment #30 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5775 https://access.redhat.com/errata/RHSA-2022:5775 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107386

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 01 Aug '22

01 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5775 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

[Bug 2107371] CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
by bugzilla＠redhat.com 01 Aug '22

01 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2107371 --- Comment #33 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5775 https://access.redhat.com/errata/RHSA-2022:5775 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2107371

1 0

2025

2024

2023

2022

2021

Epel-packagers-sig August 2022