The following Fedora 31 Security updates need testing: Age URL 55 https://bodhi.fedoraproject.org/updates/FEDORA-2020-fcd5fd47bd qutebrowser-1.11.1-1.fc31 11 https://bodhi.fedoraproject.org/updates/FEDORA-2020-76cf2b0f0a xen-4.12.3-3.fc31 8 https://bodhi.fedoraproject.org/updates/FEDORA-2020-218ab035b1 knot-resolver-5.1.2-1.fc31 5 https://bodhi.fedoraproject.org/updates/FEDORA-2020-07f0a49a9e mingw-LibRaw-0.19.5-4.fc31 5 https://bodhi.fedoraproject.org/updates/FEDORA-2020-62f2df3ca4 mailman-2.1.34-1.fc31 5 https://bodhi.fedoraproject.org/updates/FEDORA-2020-0fbd043bcf php-horde-kronolith-4.2.29-1.fc31 3 https://bodhi.fedoraproject.org/updates/FEDORA-2020-7dddce530c cacti-1.2.13-1.fc31 cacti-spine-1.2.13-1.fc31 3 https://bodhi.fedoraproject.org/updates/FEDORA-2020-198fdb12a1 singularity-3.6.0-1.fc31 3 https://bodhi.fedoraproject.org/updates/FEDORA-2020-5b60029fe2 mbedtls-2.16.7-1.fc31 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-fe82e2a834 python38-3.8.4-1.fc31 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-45041afb19 evolution-data-server-3.34.4-2.fc31 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-e30a990f5a tor-0.4.3.6-1.fc31 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-16741ac7ff nspr-4.26.0-1.fc31 nss-3.54.0-1.fc31 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-54e4356732 bashtop-0.9.24-1.fc31 1 https://bodhi.fedoraproject.org/updates/FEDORA-2020-4e92a61688 glibc-2.30-13.fc31 1 https://bodhi.fedoraproject.org/updates/FEDORA-2020-dd0c20d985 clamav-0.102.4-1.fc31
The following Fedora 31 Critical Path updates have yet to be approved: Age URL 49 https://bodhi.fedoraproject.org/updates/FEDORA-2020-03e14f6120 dracut-050-61.git20200529.fc31 34 https://bodhi.fedoraproject.org/updates/FEDORA-2020-5ccd452c8e gnutls-3.6.14-2.fc31 16 https://bodhi.fedoraproject.org/updates/FEDORA-2020-56e5d11739 python3-3.7.8-1.fc31 python3-docs-3.7.8-1.fc31 11 https://bodhi.fedoraproject.org/updates/FEDORA-2020-76cf2b0f0a xen-4.12.3-3.fc31 11 https://bodhi.fedoraproject.org/updates/FEDORA-2020-e53a8f609e net-snmp-5.8-23.fc31 11 https://bodhi.fedoraproject.org/updates/FEDORA-2020-ae00b3db48 perl-Socket-2.030-1.fc31 10 https://bodhi.fedoraproject.org/updates/FEDORA-2020-1f26a8f191 firewalld-0.7.5-2.fc31 8 https://bodhi.fedoraproject.org/updates/FEDORA-2020-8a6ee2aa06 thunderbird-68.10.0-1.fc31 7 https://bodhi.fedoraproject.org/updates/FEDORA-2020-025ab83d69 pam-1.3.1-25.fc31 5 https://bodhi.fedoraproject.org/updates/FEDORA-2020-83b2ee6e63 nfs-utils-2.5.1-0.fc31 5 https://bodhi.fedoraproject.org/updates/FEDORA-2020-54c4dc151a perl-5.30.3-454.fc31 5 https://bodhi.fedoraproject.org/updates/FEDORA-2020-4567712788 tar-1.32-3.fc31 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-16741ac7ff nspr-4.26.0-1.fc31 nss-3.54.0-1.fc31 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-45041afb19 evolution-data-server-3.34.4-2.fc31 2 https://bodhi.fedoraproject.org/updates/FEDORA-2020-6502a12961 pcre2-10.35-4.fc31 1 https://bodhi.fedoraproject.org/updates/FEDORA-2020-4e92a61688 glibc-2.30-13.fc31
The following builds have been pushed to Fedora 31 updates-testing
java-1.8.0-openjdk-1.8.0.262.b10-1.fc31 perl-HTTP-Entity-Parser-0.23-1.fc31 python-dask-2.21.0-1.fc31~bootstrap python-social-auth-core-3.3.3-1.fc31 zabbix-4.0.22-1.fc31
Details about builds:
================================================================================ java-1.8.0-openjdk-1.8.0.262.b10-1.fc31 (FEDORA-2020-508df53719) OpenJDK Runtime Environment 8 -------------------------------------------------------------------------------- Update Information:
# July 2020 OpenJDK security update for OpenJDK 8. Full release notes: https://bitly.com/oj8u262 ## New features * [JDK-8223147](https://bugs.openjdk.java.net/browse/JDK-8223147): JFR Backport ## Security fixes - JDK-8028431, CVE-2020-14579: NullPointerException in DerValue.equals(DerValue) - JDK-8028591, CVE-2020-14578: NegativeArraySizeException in sun.security.util.DerInputStream.getUnalignedBitString() - JDK-8230613: Better ASCII conversions - JDK-8231800: Better listing of arrays - JDK-8232014: Expand DTD support - JDK-8233255: Better Swing Buttons - JDK-8234032: Improve basic calendar services - JDK-8234042: Better factory production of certificates - JDK-8234418: Better parsing with CertificateFactory - JDK-8234836: Improve serialization handling - JDK-8236191: Enhance OID processing - JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior - JDK-8237592, CVE-2020-14577: Enhance certificate verification - JDK-8238002, CVE-2020-14581: Better matrix operations - JDK-8238804: Enhance key handling process - JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable - JDK-8238843: Enhanced font handing - JDK-8238920, CVE-2020-14583: Better Buffer support - JDK-8238925: Enhance WAV file playback - JDK-8240119, CVE-2020-14593: Less Affine Transformations - JDK-8240482: Improved WAV file playback - JDK-8241379: Update JCEKS support - JDK-8241522: Manifest improved jar headers redux - JDK-8242136, CVE-2020-14621: Better XML namespace handling ## [JDK-8240687](https://bugs.openjdk.java.net/browse/JDK-8240687): JDK Flight Recorder Integrated to OpenJDK 8u OpenJDK 8u now contains the backport of JEP 328: Flight Recorder (https://openjdk.java.net/jeps/328) from later versions of OpenJDK. JFR is a low-overhead framework to collect and provide data helpful to troubleshoot the performance of the OpenJDK runtime and of Java applications. It consists of a new API to define custom events under the jdk.jfr namespace and a JMX interface to interact with the framework. The recording can also be initiated with the application startup using the -XX:+FlightRecorder flag or via jcmd. JFR replaces the +XX:EnableTracing feature introduced in JEP 167, providing a more efficient way to retrieve the same information. For compatibility reasons, +XX:EnableTracing is still accepted, however no data will be printed. While JFR is not built by default upstream, it is included in Fedora binaries for supported architectures (x86_64, AArch64 & PowerPC 64) ## [JDK-8205622](https://bugs.openjdk.java.net/browse/JDK-8205622): JFR Start Failure After AppCDS Archive Created with JFR StartFlightRecording JFR will be disabled with a warning message if it is enabled during CDS dumping. The user will see the following warning message: OpenJDK 64-Bit Server VM warning: JFR will be disabled during CDS dumping if JFR is enabled during CDS dumping such as in the following command line: $ java -Xshare:dump -XX:StartFlightRecording=dumponexit=true ## [JDK-8244167](https://bugs.openjdk.java.net/browse/JDK-8244167): Removal of Comodo Root CA Certificate The following expired Comodo root CA certificate was removed from the `cacerts` keystore: + alias name "addtrustclass1ca [jdk]" Distinguished Name: CN=AddTrust Class 1 CA Root, OU=AddTrust TTP Network, O=AddTrust AB, C=SE ## [JDK-8244166](https://bugs.openjdk.java.net/browse/JDK-8244166): Removal of DocuSign Root CA Certificate The following expired DocuSign root CA certificate was removed from the `cacerts` keystore: + alias name "keynectisrootca [jdk]" Distinguished Name: CN=KEYNECTIS ROOT CA, OU=ROOT, O=KEYNECTIS, C=FR ## [JDK-8240191](https://bugs.openjdk.java.net/browse/JDK-8240191): Allow SunPKCS11 initialization with NSS when external FIPS modules are present in the Security Modules Database The SunPKCS11 security provider can now be initialized with NSS when FIPS-enabled external modules are configured in the Security Modules Database (NSSDB). Prior to this change, the SunPKCS11 provider would throw a RuntimeException with the message: "FIPS flag set for non-internal module" when such a library was configured for NSS in non-FIPS mode. This change allows the JDK to work properly with recent NSS releases on GNU/Linux operating systems when the system-wide FIPS policy is turned on. Further information can be found in [JDK-8238555](https://bugs.openjdk.java.net/browse/JDK-8238555). -------------------------------------------------------------------------------- ChangeLog:
* Mon Jul 13 2020 Jiri Vanek jvanek@redhat.com - 1:1.8.0.262.b10-1 - Set vendor property and vendor URLs - Made URLs to be preconfigured by OS * Sun Jul 12 2020 Andrew Hughes gnu.andrew@redhat.com - 1:1.8.0.262.b10-0 - Update to aarch64-shenandoah-jdk8u262-b10. - Update release notes for 8u262 release. - Remove issues in NEWS file duplicated between 8u252 & 8u262 releases. - Update generate_source_tarball.sh script to use the PR3756 patch and retain the secp256k1 curve. - Add the -'4curve' suffix to the tarball name. - Adjust JDK-8143245/PR3548 patch following context changes due to JDK-8203287 for JFR - Adjust RH1648644 following context changes due to introduction of JFR packages - Split JDK-8042159 patch into per-repo patches as upstream. - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk - Enable JFR in our builds, ahead of upstream default. - Only enable JFR for JIT builds, as it is not supported with Zero. - Turn off JFR on x86 for now due to assert(SerializePageShiftCount == count) crash. - Explicitly list jfr.jar, default.jfc & profile.jfc in the spec file. - Introduce jfr_arches for architectures which support JFR. - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded. - Add jfr binary to devel package and alternatives set - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR. - Require tzdata 2020a so system tzdata matches resource updates in b07 - Use sa_arches for libsaproc.so inclusion. * Wed May 27 2020 Jiri Andrlik jandrlik@redhat.com - 1:1.8.0.252.b09-1 - backports of provides fixes from master --------------------------------------------------------------------------------
================================================================================ perl-HTTP-Entity-Parser-0.23-1.fc31 (FEDORA-2020-d39c7b4a44) PSGI compliant HTTP Entity Parser -------------------------------------------------------------------------------- Update Information:
-------------------------------------------------------------------------------- ChangeLog:
* Sat Jul 18 2020 Ralf Cors��pius corsepiu@fedoraproject.org - 0.23-1 - Update to 0.23. * Thu Jan 30 2020 Fedora Release Engineering releng@fedoraproject.org - 0.22-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild --------------------------------------------------------------------------------
================================================================================ python-dask-2.21.0-1.fc31~bootstrap (FEDORA-2020-7d6e5e64b4) Parallel PyData with Task Scheduling -------------------------------------------------------------------------------- Update Information:
Update to latest version -------------------------------------------------------------------------------- ChangeLog:
* Sat Jul 18 2020 Elliott Sales de Andrade quantum.analyst@gmail.com - 2.21.0-1 - Update to latest version * Fri Jul 10 2020 Miro Hron��ok mhroncok@redhat.com - 2.20.0-2 - Add metadata for Python extras subpackages -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1858429 - python-dask-2.21.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=1858429 --------------------------------------------------------------------------------
================================================================================ python-social-auth-core-3.3.3-1.fc31 (FEDORA-2020-d7dbf8d85b) Python Social Auth is an easy to setup social authentication/registration mechanism with support for several frameworks and auth providers. -------------------------------------------------------------------------------- Update Information:
Rebuilt for version 3.3.3 -------------------------------------------------------------------------------- ChangeLog:
* Sat Jul 18 2020 Chenxiong Qi qcxhome@gmail.com - 3.3.3-1 - Rebuilt version 3.3.3 * Tue May 26 2020 Miro Hron��ok mhroncok@redhat.com - 1.7.0-11 - Rebuilt for Python 3.9 * Thu Jan 30 2020 Fedora Release Engineering releng@fedoraproject.org - 1.7.0-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Thu Jan 9 2020 Zbigniew J��drzejewski-Szmek zbyszek@in.waw.pl - 1.7.0-9 - Remove dependency on unittest2 (#1789200) * Thu Oct 3 2019 Miro Hron��ok mhroncok@redhat.com - 1.7.0-8 - Rebuilt for Python 3.8.0rc1 (#1748018) * Mon Aug 19 2019 Miro Hron��ok mhroncok@redhat.com - 1.7.0-7 - Rebuilt for Python 3.8 --------------------------------------------------------------------------------
================================================================================ zabbix-4.0.22-1.fc31 (FEDORA-2020-519516feec) Open-source monitoring solution for your IT infrastructure -------------------------------------------------------------------------------- Update Information:
Update to 4.0.22 -------------------------------------------------------------------------------- ChangeLog:
* Sat Jul 18 2020 Orion Poplawski orion@nwra.com - 1:4.0.22-1 - Update to 4.0.22 (bz#1858259) CVE-2020-15803 - Fix alert/external scripts directories * Mon Apr 20 2020 Orion Poplawski orion@nwra.com - 1:4.0.19-3 - Fix chmod/chown in scriptlet * Mon Apr 20 2020 Vit Mojzis vmojzis@redhat.com - 1:4.0.19-2 - Add SELinux subpackage * Sun Apr 19 2020 Orion Poplawski orion@nwra.com - 1:4.0.19-1 - Update to 4.0.19 - Upstream now uses jquery 3, so link to that * Thu Apr 2 2020 Bj��rn Esser besser82@fedoraproject.org - 1:4.0.16-3 - Fix string quoting for rpm >= 4.16 * Fri Jan 31 2020 Fedora Release Engineering releng@fedoraproject.org - 1:4.0.16-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild * Mon Dec 23 2019 Volker Froehlich volker27@gmx.at - 1:4.0.16-1 - New upstream release -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1858259 - CVE-2020-15803 zabbix: stored XSS in the URL Widget [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1858259 --------------------------------------------------------------------------------