The following Fedora 29 Security updates need testing: Age URL 247 https://bodhi.fedoraproject.org/updates/FEDORA-2019-fa5843e0e1 asterisk-16.2.1-1.fc29 233 https://bodhi.fedoraproject.org/updates/FEDORA-2019-c84f291592 WALinuxAgent-2.2.38-1.fc29 228 https://bodhi.fedoraproject.org/updates/FEDORA-2019-7528388823 chicken-5.0.0-2.fc29 188 https://bodhi.fedoraproject.org/updates/FEDORA-2019-9839aded3f python-gnupg-0.4.4-1.fc29 184 https://bodhi.fedoraproject.org/updates/FEDORA-2019-35cb5a4785 kubernetes-1.13.5-1.fc29 122 https://bodhi.fedoraproject.org/updates/FEDORA-2019-32f7cd9b66 dosbox-0.74.3-2.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-758824a3ff python2-2.7.17-1.fc29 python2-docs-2.7.17-1.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-d2856deb1f firefox-70.0-1.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-e4c45e113c nspr-4.23.0-1.fc29 nss-3.47.0-2.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-18036b898e file-5.34-15.fc29 4 https://bodhi.fedoraproject.org/updates/FEDORA-2019-8952d0f014 thunderbird-68.2.0-1.fc29 4 https://bodhi.fedoraproject.org/updates/FEDORA-2019-bfb407659e rssh-2.3.4-15.fc29 4 https://bodhi.fedoraproject.org/updates/FEDORA-2019-703e299870 samba-4.9.15-0.fc29 4 https://bodhi.fedoraproject.org/updates/FEDORA-2019-65509aac53 wpa_supplicant-2.7-2.fc29 2 https://bodhi.fedoraproject.org/updates/FEDORA-2019-d202cda4f8 python35-3.5.8-2.fc29 2 https://bodhi.fedoraproject.org/updates/FEDORA-2019-cdc04140c4 chromium-78.0.3904.70-1.fc29 2 https://bodhi.fedoraproject.org/updates/FEDORA-2019-d7f8995451 gd-2.2.5-8.fc29 2 https://bodhi.fedoraproject.org/updates/FEDORA-2019-865bb16900 xen-4.11.2-2.fc29
The following Fedora 29 Critical Path updates have yet to be approved: Age URL 160 https://bodhi.fedoraproject.org/updates/FEDORA-2019-06a2d1c7fb anaconda-29.24.7-3.fc29 157 https://bodhi.fedoraproject.org/updates/FEDORA-2019-4cefd3161a nfs-utils-2.3.3-4.rc2.fc29 131 https://bodhi.fedoraproject.org/updates/FEDORA-2019-583d9d5a56 mutter-3.30.2-3.fc29 117 https://bodhi.fedoraproject.org/updates/FEDORA-2019-6f13c38d0d python-urllib3-1.24.3-2.fc29 114 https://bodhi.fedoraproject.org/updates/FEDORA-2019-62e681b68b ipset-7.2-1.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-18036b898e file-5.34-15.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-5c6a86b128 libldb-1.4.8-1.fc29 samba-4.9.14-0.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-e4c45e113c nspr-4.23.0-1.fc29 nss-3.47.0-2.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-186f908f45 linux-firmware-20191022-103.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-3a920ca5ea pungi-4.1.40-1.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-a746c4f59d libreport-2.11.2-1.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-d2856deb1f firefox-70.0-1.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-70f23a7a7d vim-8.1.2198-1.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-758824a3ff python2-2.7.17-1.fc29 python2-docs-2.7.17-1.fc29 9 https://bodhi.fedoraproject.org/updates/FEDORA-2019-3bdedf56fb sssd-2.2.2-3.fc29 5 https://bodhi.fedoraproject.org/updates/FEDORA-2019-3fcb3b1627 zlib-1.2.11-18.fc29 4 https://bodhi.fedoraproject.org/updates/FEDORA-2019-65509aac53 wpa_supplicant-2.7-2.fc29 4 https://bodhi.fedoraproject.org/updates/FEDORA-2019-458490f1d7 kernel-5.3.8-100.fc29 4 https://bodhi.fedoraproject.org/updates/FEDORA-2019-703e299870 samba-4.9.15-0.fc29 4 https://bodhi.fedoraproject.org/updates/FEDORA-2019-885b33bcfd pcre2-10.33-15.fc29 4 https://bodhi.fedoraproject.org/updates/FEDORA-2019-8952d0f014 thunderbird-68.2.0-1.fc29 2 https://bodhi.fedoraproject.org/updates/FEDORA-2019-c77daad60e koji-1.19.0-1.fc29 2 https://bodhi.fedoraproject.org/updates/FEDORA-2019-865bb16900 xen-4.11.2-2.fc29 2 https://bodhi.fedoraproject.org/updates/FEDORA-2019-e5d246aa34 redhat-rpm-config-121-1.fc29
The following builds have been pushed to Fedora 29 updates-testing
389-ds-base-1.4.0.30-1.fc29 ansible-2.8.6-1.fc29 ansible-lint-4.1.1a0-4.fc29 balsa-2.5.9-1.fc29 community-mysql-8.0.18-1.fc29 geany-1.36-1.fc29 geany-plugins-1.36-1.fc29 libmp4v2-2.1.0-0.18.trunkREV507.fc29 pspg-2.5.2-1.fc29 python-paho-mqtt-1.5.0-1.fc29
Details about builds:
================================================================================ 389-ds-base-1.4.0.30-1.fc29 (FEDORA-2019-01a5328b48) 389 Directory Server (base) -------------------------------------------------------------------------------- Update Information:
Bump version to 1.4.0.30 -------------------------------------------------------------------------------- ChangeLog:
* Fri Nov 1 2019 Mark Reynolds mreynolds@redhat.com - 1.4.0.30-1 - Bump version to 1.4.0.30 - Issue 50592 - Fix cherry-pick error * Fri Nov 1 2019 Mark Reynolds mreynolds@redhat.com - 1.4.0.29-1 - Bump version to 1.4.0.29 - Issue 50592 - Port Replication Tab to ReactJS - Issue 50067 - Fix krb5 dependency in a specfile - Issue 50545 - Port repl-monitor.pl to lib389 CLI - Issue 50497 - Port cl-dump.pl tool to Python using lib389 - Issue 49850 - cont -fix crash in ldbm_non_leaf - Issue 50634 - Clean up CLI errors output - Fix wrong exception - Issue 50634 - Clean up CLI errors output - Issue 49850 - ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries - Issue 50655 - access log etime is not properly formatted - Issue 50653 - objectclass parsing fails to log error message text - Issue 50646 - Improve task handling during shutdowns - Issue 50622 - ds_selinux_enabled may crash on suse --------------------------------------------------------------------------------
================================================================================ ansible-2.8.6-1.fc29 (FEDORA-2019-5f9a9b20f3) SSH-based configuration management, deployment, and task execution system -------------------------------------------------------------------------------- Update Information:
Uppdate to bugfix release 2.8.6. -------------------------------------------------------------------------------- ChangeLog:
* Thu Oct 17 2019 Kevin Fenzi kevin@scrye.com - 2.8.6-1 - Update to 2.8.6. - Rework spec file to drop old conditionals. * Thu Oct 10 2019 Kevin Fenzi kevin@scrye.com - 2.8.5-2 - Make python3-paramiko and python3-winrm Recommended so they install on Fedora and not RHEL8 * Fri Sep 13 2019 Kevin Fenzi kevin@scrye.com - 2.8.5-1 - Update to 2.8.5. * Mon Aug 19 2019 Miro Hron��ok mhroncok@redhat.com - 2.8.4-2 - Rebuilt for Python 3.8 * Fri Aug 16 2019 Kevin Fenzi kevin@scrye.com - 2.8.4-1 - Update to 2.8.4. Fixes CVE-2019-10217 and CVE-2019-10206 * Thu Jul 25 2019 Kevin Fenzi kevin@scrye.com - 2.8.3-1 - Update to 2.8.3. * Wed Jul 24 2019 Fedora Release Engineering releng@fedoraproject.org - 2.8.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1679254 - [abrt] ansible: default(): encoder.py:179:default:TypeError: Object of type AnsibleVaultEncryptedUnicode is not JSON serializable https://bugzilla.redhat.com/show_bug.cgi?id=1679254 [ 2 ] Bug #1727813 - TypeError: argument of type 'int' is not iterable, as vlanid (int) is not changed into string https://bugzilla.redhat.com/show_bug.cgi?id=1727813 --------------------------------------------------------------------------------
================================================================================ ansible-lint-4.1.1a0-4.fc29 (FEDORA-2019-5f9a9b20f3) Best practices checker for Ansible -------------------------------------------------------------------------------- Update Information:
Uppdate to bugfix release 2.8.6. -------------------------------------------------------------------------------- ChangeLog:
* Sat Nov 2 2019 Parag Nemade <pnemade AT redhat DOT com> - 4.1.1a0-4 - Fix dependency ansible-python3 to ansible * Thu Oct 3 2019 Miro Hron��ok mhroncok@redhat.com - 4.1.1a0-3 - Rebuilt for Python 3.8.0rc1 (#1748018) * Mon Aug 19 2019 Miro Hron��ok mhroncok@redhat.com - 4.1.1a0-2 - Rebuilt for Python 3.8 * Sat Aug 17 2019 Parag Nemade <pnemade AT redhat DOT com> - 4.1.1a0-1 - Update to 4.1.1a0 version (#1742505) * Wed Jul 24 2019 Fedora Release Engineering releng@fedoraproject.org - 4.1.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Wed Feb 13 2019 Parag Nemade <pnemade AT redhat DOT com> - 4.1.0-1 - Update to 4.1.0 version (#1674307) * Thu Jan 31 2019 Fedora Release Engineering releng@fedoraproject.org - 3.4.23-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1679254 - [abrt] ansible: default(): encoder.py:179:default:TypeError: Object of type AnsibleVaultEncryptedUnicode is not JSON serializable https://bugzilla.redhat.com/show_bug.cgi?id=1679254 [ 2 ] Bug #1727813 - TypeError: argument of type 'int' is not iterable, as vlanid (int) is not changed into string https://bugzilla.redhat.com/show_bug.cgi?id=1727813 --------------------------------------------------------------------------------
================================================================================ balsa-2.5.9-1.fc29 (FEDORA-2019-a4499e1328) Mail Client -------------------------------------------------------------------------------- Update Information:
Update to upstream balsa-2.5.9 -------------------------------------------------------------------------------- ChangeLog:
* Sat Nov 2 2019 Pawel Salek pawsa0@gmail.com - 2.5.9-1 - update to upstream balsa-2.5.9 --------------------------------------------------------------------------------
================================================================================ community-mysql-8.0.18-1.fc29 (FEDORA-2019-c1fab3f139) MySQL client programs and shared libraries -------------------------------------------------------------------------------- Update Information:
**MySQL 8.0.18** Release notes: https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-18.html CVEs fixed: CVE-2019-2911 CVE-2019-2914 CVE-2019-2938 CVE-2019-2946 CVE-2019-2957 CVE-2019-2960 CVE-2019-2963 CVE-2019-2966 CVE-2019-2967 CVE-2019-2968 CVE-2019-2974 CVE-2019-2982 CVE-2019-2991 CVE-2019-2993 CVE-2019-2997 CVE-2019-2998 CVE-2019-3004 CVE-2019-3009 CVE-2019-3011 CVE-2019-3018 https://bugzilla.redhat.com/show_bug.cgi?id=1768175 https://www.oracle.com/security-alerts/cpuoct2019.html Maintainer notes: linking with GOLD disabled on armv7hl, because of https://bugs.mysql.com/bug.php?id=96698 -------------------------------------------------------------------------------- ChangeLog:
* Mon Oct 14 2019 Lars Tangvald lars.tangvald@oracle.com - 8.0.18-1 - Update to MySQL 8.0.18 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1761354 - community-mysql-8.0.18 is available https://bugzilla.redhat.com/show_bug.cgi?id=1761354 [ 2 ] Bug #1768175 - CVE-2019-2911 CVE-2019-2914 CVE-2019-2938 CVE-2019-2946 CVE-2019-2957 CVE-2019-2960 CVE-2019-2963 CVE-2019-2966 CVE-2019-2967 CVE-2019-2968 CVE-2019-2974 CVE-2019-2982 CVE-2019-2991 CVE-2019-2993 ... community-mysql: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1768175 --------------------------------------------------------------------------------
================================================================================ geany-1.36-1.fc29 (FEDORA-2019-94cc4ccc94) A fast and lightweight IDE using GTK3 -------------------------------------------------------------------------------- Update Information:
This update brings the latest Geany and Geany-Plugins in version 1.36 to a Fedora box near you. For more details about this release, see the release notes at https://geany.org/news/geany-136-is-out/ and https://geany.org/news/geany- plugins-136-are-out/ -------------------------------------------------------------------------------- ChangeLog:
* Sun Sep 29 2019 Dominic Hopf dmaphy@fedoraproject.org - 1.36-1 - New upstream release: Geany 1.36 * Thu Jul 25 2019 Fedora Release Engineering releng@fedoraproject.org - 1.35-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1703816 - geany-plugins-1.36.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1703816 --------------------------------------------------------------------------------
================================================================================ geany-plugins-1.36-1.fc29 (FEDORA-2019-94cc4ccc94) Plugins for Geany -------------------------------------------------------------------------------- Update Information:
This update brings the latest Geany and Geany-Plugins in version 1.36 to a Fedora box near you. For more details about this release, see the release notes at https://geany.org/news/geany-136-is-out/ and https://geany.org/news/geany- plugins-136-are-out/ -------------------------------------------------------------------------------- ChangeLog:
* Sun Nov 3 2019 Dominic Hopf dmaphy@fedoraproject.org 1.36-1 - New upstream release: Geany-Plugins 1.36 - Re-enable debugger plugin * Thu Jul 25 2019 Fedora Release Engineering releng@fedoraproject.org - 1.35-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Thu Jun 6 2019 Igor Gnatenko ignatenkobrain@fedoraproject.org - 1.35-2 - Rebuild for libgit2 0.28.x -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1703816 - geany-plugins-1.36.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1703816 --------------------------------------------------------------------------------
================================================================================ libmp4v2-2.1.0-0.18.trunkREV507.fc29 (FEDORA-2019-07598ce28e) Library for working with files using the mp4 container format -------------------------------------------------------------------------------- Update Information:
Fix https://nvd.nist.gov/vuln/detail/CVE-2018-14446 https://nvd.nist.gov/vuln/detail/CVE-2018-14403 https://nvd.nist.gov/vuln/detail/CVE-2018-14379 https://nvd.nist.gov/vuln/detail/CVE-2018-14326 https://nvd.nist.gov/vuln/detail/CVE-2018-14325 https://nvd.nist.gov/vuln/detail/CVE-2018-14054 based on https://github.com/TechSmith/mp4v2/pull/27 and https://github.com/sergiomb2/libmp4v2/ -------------------------------------------------------------------------------- ChangeLog:
* Sat Nov 2 2019 S��rgio Basto sergio@serjux.com - 2.1.0-0.18.trunkREV507 - Fix https://nvd.nist.gov/vuln/detail/CVE-2018-14446 https://nvd.nist.gov/vuln/detail/CVE-2018-14403 https://nvd.nist.gov/vuln/detail/CVE-2018-14379 https://nvd.nist.gov/vuln/detail/CVE-2018-14326 https://nvd.nist.gov/vuln/detail/CVE-2018-14325 https://nvd.nist.gov/vuln/detail/CVE-2018-14054 based on https://github.com/TechSmith/mp4v2/pull/27 and https://github.com/sergiomb2/libmp4v2/ - Update spec - Fix build on epel7 * Thu Jul 25 2019 Fedora Release Engineering releng@fedoraproject.org - 2.1.0-0.17.trunkREV507 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Tue Feb 19 2019 FeRD (Frank Dana) <ferdnyc AT gmail com> - 2.1.0-0.16.trunkREV507 - Add BuildRequires for help2man, fixes manpage generation * Fri Feb 1 2019 Fedora Release Engineering releng@fedoraproject.org - 2.1.0-0.15.trunkREV507 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild * Sun Nov 18 2018 Zbigniew J��drzejewski-Szmek zbyszek@in.waw.pl - 2.1.0-0.14.trunkREV507 - Add BR:glibc-langpack-en See https://fedoraproject.org/wiki/Changes/Remove_glibc-langpacks-all_from_build... -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1603296 - CVE-2018-14054 libmp4v2: Double free in the MP4StringProperty class in mp4property.cpp [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1603296 [ 2 ] Bug #1603236 - CVE-2018-14379 libmp4v2: Type confusion in MP4Atom::factory in mp4atom.cpp [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1603236 [ 3 ] Bug #1603224 - CVE-2018-14403 libmp4v2: Out-of-bounds read in MP4NameFirstMatches in mp4util.cpp [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1603224 [ 4 ] Bug #1601679 - CVE-2018-14325 libmp4v2: Integer underflow in when parsing MP4Atom in mp4atom.cpp [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1601679 [ 5 ] Bug #1601675 - CVE-2018-14326 libmp4v2: Missing check for integer overflow in mp4array.h:Resize() allows for denial of service via crafted MP4 [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1601675 --------------------------------------------------------------------------------
================================================================================ pspg-2.5.2-1.fc29 (FEDORA-2019-b60827a2af) A unix pager optimized for psql -------------------------------------------------------------------------------- Update Information:
new upstream release, per release notes: - https://github.com/okbob/pspg/releases/tag/2.5.2 - https://github.com/okbob/pspg/releases/tag/2.5.0 - https://github.com/okbob/pspg/releases/tag/2.1.8 - https://github.com/okbob/pspg/releases/tag/2.1.7 -------------------------------------------------------------------------------- ChangeLog:
* Sun Nov 3 2019 Pavel Raiskup praiskup@redhat.com - 2.5.2-1 - new upstream release, per release notes: https://github.com/okbob/pspg/releases/tag/2.5.2 https://github.com/okbob/pspg/releases/tag/2.5.0 https://github.com/okbob/pspg/releases/tag/2.1.8 https://github.com/okbob/pspg/releases/tag/2.1.7 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1760951 - pspg-2.5.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=1760951 --------------------------------------------------------------------------------
================================================================================ python-paho-mqtt-1.5.0-1.fc29 (FEDORA-2019-c69b096ea4) A Python MQTT version 3.1/3.1.1/5.0 client class -------------------------------------------------------------------------------- Update Information:
v1.5.0 ===== * Add support for clean_session on subscribe helper. Closes #219 * Add support for non-standard bridge connection. Closes #282 * Fix hang with QoS 2 message and clean_session = False. The fix replace hang with message DROP. See README for known limitation. Closes #284 and #286 * Fix connection establishement timeout. Closes #291 and #288 * Add support for connecting through a proxy. Closes #315 * Add MQTT v5 support. Closes #334 * Improve error message when sending queue is full. Closes #378 * Improve error handling during initialization on edge case. Closes #387 and #388 * Allow to specify local client port used (similar to bind_address). Closes #390 * Add method is_connected to know if MQTT connection is established. Closes #414 * Set connection timeout to keepalive. Closes #425 -------------------------------------------------------------------------------- ChangeLog:
* Fri Nov 1 2019 Peter Robinson pbrobinson@fedoraproject.org 1.5.0-1 - Update to 1.5.0 with MQTT 5.0 support * Thu Oct 3 2019 Miro Hron��ok mhroncok@redhat.com - 1.4.0-6 - Rebuilt for Python 3.8.0rc1 (#1748018) * Mon Aug 19 2019 Miro Hron��ok mhroncok@redhat.com - 1.4.0-5 - Rebuilt for Python 3.8 * Fri Jul 26 2019 Fedora Release Engineering releng@fedoraproject.org - 1.4.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Sat Feb 2 2019 Fedora Release Engineering releng@fedoraproject.org - 1.4.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild * Thu Oct 11 2018 Zbigniew J��drzejewski-Szmek zbyszek@in.waw.pl - 1.4.0-2 - Python2 binary package has been removed See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal --------------------------------------------------------------------------------