Fedora 39 Update: scap-security-guide-0.1.73-1.fc39
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-c2b3fe51a5
2024-05-31 02:13:07.316202
--------------------------------------------------------------------------------
Name : scap-security-guide
Product : Fedora 39
Version : 0.1.73
Release : 1.fc39
URL : https://github.com/ComplianceAsCode/content/
Summary : Security guidance and baselines in SCAP formats
Description :
The scap-security-guide project provides a guide for configuration of the
system from the final system's security point of view. The guidance is specified
in the Security Content Automation Protocol (SCAP) format and constitutes
a catalog of practical hardening advice, linked to government requirements
where applicable. The project bridges the gap between generalized policy
requirements and specific implementation guidelines. The system
administrator can use the oscap CLI tool from openscap-scanner package, or the
scap-workbench GUI tool from scap-workbench package to verify that the system
conforms to provided guideline. Refer to scap-security-guide(8) manual page for
further information.
--------------------------------------------------------------------------------
Update Information:
Important Highlights
CMP 2417: Implement PCI-DSS v4.0 outline for OpenShift (#11651)
Update all RHEL ANSSI BP028 profiles to be aligned with configuration
recommendations version 2.0
Generate rule references from control files (#11540)
Initial implementation of STIG V1R1 profile for Ubuntu 22.04 LTS (#11820)
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 22 2024 Jan ��ern�� <jcerny(a)redhat.com> - 0.1.73-1
- Update to latest upstream release
https://github.com/ComplianceAsCode/content/releases/tag/v0.1.73
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-c2b3fe51a5' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
3 days, 11 hours
[SECURITY] Fedora 39 Update: roundcubemail-1.6.7-1.fc39
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-a591b4dc74
2024-05-31 02:13:07.316189
--------------------------------------------------------------------------------
Name : roundcubemail
Product : Fedora 39
Version : 1.6.7
Release : 1.fc39
URL : http://www.roundcube.net
Summary : Round Cube Webmail is a browser-based multilingual IMAP client
Description :
RoundCube Webmail is a browser-based multilingual IMAP client
with an application-like user interface. It provides full
functionality you expect from an e-mail client, including MIME
support, address book, folder manipulation, message searching
and spell checking. RoundCube Webmail is written in PHP and
requires a database: MySQL, PostgreSQL and SQLite are known to
work. The user interface is fully skinnable using XHTML and
CSS 2.
--------------------------------------------------------------------------------
Update Information:
Release 1.6.7
Makefile: Use phpDocumentor v3.4 for the Framework docs (#9313)
Fix bug where HTML entities in URLs were not decoded on HTML to plain text
conversion (#9312)
Fix bug in collapsing/expanding folders with some special characters in names
(#9324)
Fix PHP8 warnings (#9363, #9365, #9429)
Fix missing field labels in CSV import, for some locales (#9393)
Fix command injection via crafted im_convert_path/im_identify_path on Windows
Fix cross-site scripting (XSS) vulnerability in handling list columns from user
preferences
Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
--------------------------------------------------------------------------------
ChangeLog:
* Mon May 20 2024 Remi Collet <remi(a)remirepo.net> - 1.6.7-1
- update to 1.6.7
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2281597 - roundcubemail: fix for several security vulnerabilities
https://bugzilla.redhat.com/show_bug.cgi?id=2281597
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-a591b4dc74' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
3 days, 11 hours
Fedora 39 Update: osbuild-119-1.fc39
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-e84972c09a
2024-05-31 02:13:07.316196
--------------------------------------------------------------------------------
Name : osbuild
Product : Fedora 39
Version : 119
Release : 1.fc39
URL : https://github.com/osbuild/osbuild
Summary : A build system for OS images
Description :
A build system for OS images
--------------------------------------------------------------------------------
Update Information:
Automatic update for osbuild-119-1.fc39.
Changelog for osbuild
* Wed May 22 2024 Packit <hello(a)packit.dev> - 119-1
Changes with 119
----------------
* Add user force password reset (#1778)
* Author: andremarianiello, Reviewers: Brian C. Lane, Pawe�� Po��awski
* Tests: Add unit tests for org.osbuild.mkfs.fat stage (#1677)
* Author: Pawe�� Po��awski, Reviewers: Brian C. Lane, Michael Vogt
* Update snapshots to 20240514 (#1784)
* Author: SchutzBot, Reviewers: Achilleas Koutsou, Brian C. Lane
* runners: revert "runners: clean up temp files before exiting the runner"
(#1788)
* Author: Michael Vogt, Reviewers: Achilleas Koutsou, Tom���� Hozza
* stage/systemd.unit.create: add Before option (#1782)
* Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Michael Vogt
* stages/systemd.unit.create: update schema to support [Mount] (#1748)
* Author: Achilleas Koutsou, Reviewers: Gianluca Zuccarelli, Michael Vogt
* test/buildroot: fix checking /var/tmp mode (#1787)
* Author: Tom���� Hozza, Reviewers: Michael Vogt, Ond��ej Budai
* tests: update stage tests readme (#1738)
* Author: Pawe�� Po��awski, Reviewers: Michael Vogt, Ond��ej Budai, Tom���� Hozza
��� Somewhere on the Internet, 2024-05-22
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 22 2024 Packit <hello(a)packit.dev> - 119-1
Changes with 119
----------------
* Add user force password reset (#1778)
* Author: andremarianiello, Reviewers: Brian C. Lane, Pawe�� Po��awski
* Tests: Add unit tests for org.osbuild.mkfs.fat stage (#1677)
* Author: Pawe�� Po��awski, Reviewers: Brian C. Lane, Michael Vogt
* Update snapshots to 20240514 (#1784)
* Author: SchutzBot, Reviewers: Achilleas Koutsou, Brian C. Lane
* runners: revert "runners: clean up temp files before exiting the runner" (#1788)
* Author: Michael Vogt, Reviewers: Achilleas Koutsou, Tom���� Hozza
* stage/systemd.unit.create: add Before option (#1782)
* Author: Achilleas Koutsou, Reviewers: Brian C. Lane, Michael Vogt
* stages/systemd.unit.create: update schema to support [Mount] (#1748)
* Author: Achilleas Koutsou, Reviewers: Gianluca Zuccarelli, Michael Vogt
* test/buildroot: fix checking /var/tmp mode (#1787)
* Author: Tom���� Hozza, Reviewers: Michael Vogt, Ond��ej Budai
* tests: update stage tests readme (#1738)
* Author: Pawe�� Po��awski, Reviewers: Michael Vogt, Ond��ej Budai, Tom���� Hozza
��� Somewhere on the Internet, 2024-05-22
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-e84972c09a' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
3 days, 11 hours
Fedora 39 Update: redis-7.2.5-1.fc39
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-9f63ed0f3d
2024-05-31 02:13:07.316182
--------------------------------------------------------------------------------
Name : redis
Product : Fedora 39
Version : 7.2.5
Release : 1.fc39
URL : https://redis.io
Summary : A persistent key-value database
Description :
Redis is an advanced key-value store. It is often referred to as a data
structure server since keys can contain strings, hashes, lists, sets and
sorted sets.
You can run atomic operations on these types, like appending to a string;
incrementing the value in a hash; pushing to a list; computing set
intersection, union and difference; or getting the member with highest
ranking in a sorted set.
In order to achieve its outstanding performance, Redis works with an
in-memory dataset. Depending on your use case, you can persist it either
by dumping the dataset to disk every once in a while, or by appending
each command to a log.
Redis also supports trivial-to-setup master-slave replication, with very
fast non-blocking first synchronization, auto-reconnection on net split
and so forth.
Other features include Transactions, Pub/Sub, Lua scripting, Keys with a
limited time-to-live, and configuration settings to make Redis behave like
a cache.
You can use Redis from most programming languages also.
--------------------------------------------------------------------------------
Update Information:
Redis 7.2.5 Released Thu 16 May 2024 12:00:00 IST
Upgrade urgency MODERATE: Program an upgrade of the server, but it's not urgent.
Bug fixes
A single shard cluster leaves failed replicas in CLUSTER SLOTS instead of
removing them (#12824)
Crash in LSET command when replacing small items and exceeding 4GB (#12955)
Blocking commands timeout is reset due to re-processing command (#13004)
Conversion of numbers in Lua args to redis args can fail. Bug introduced in
7.2.0 (#13115)
Bug fixes in CLI tools
redis-cli: --count (for --scan, --bigkeys, etc) was ignored unless --pattern was
also used (#13092)
redis-check-aof: incorrectly considering data in manifest format as MP-AOF
(#12958)
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 22 2024 Remi Collet <remi(a)remirepo.net> - 7.2.5-1
- Upstream 7.2.5 release
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-9f63ed0f3d' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
3 days, 11 hours
Fedora 39 Update: qgis-3.34.7-1.fc39
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-09d42f4f9c
2024-05-31 02:13:07.316175
--------------------------------------------------------------------------------
Name : qgis
Product : Fedora 39
Version : 3.34.7
Release : 1.fc39
URL : http://www.qgis.org
Summary : A user friendly Open Source Geographic Information System
Description :
Geographic Information System (GIS) manages, analyzes, and displays
databases of geographic information. QGIS supports shape file
viewing and editing, spatial data storage with PostgreSQL/PostGIS, projection
on-the-fly, map composition, and a number of other features via a plugin
interface. QGIS also supports display of various geo-referenced raster and
Digital Elevation Model (DEM) formats including GeoTIFF, Arc/Info ASCII Grid,
and USGS ASCII DEM.
--------------------------------------------------------------------------------
Update Information:
Update to qgis-3.34.7.
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 21 2024 Sandro Mani <manisandro(a)gmail.com> - 3.34.7-1
- Update to 3.34.7
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-09d42f4f9c' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
3 days, 11 hours
Fedora 39 Update: linux-system-roles-1.78.2-1.fc39
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-7f91f5e5fd
2024-05-31 02:13:07.316168
--------------------------------------------------------------------------------
Name : linux-system-roles
Product : Fedora 39
Version : 1.78.2
Release : 1.fc39
URL : https://github.com/linux-system-roles
Summary : Set of interfaces for unified system management
Description :
Collection of Ansible roles and modules that provide a stable and
consistent configuration interface for managing multiple versions
of Fedora, Red Hat Enterprise Linux & CentOS.
--------------------------------------------------------------------------------
Update Information:
Automatic update for linux-system-roles-1.78.2-1.fc39.
Changelog for linux-system-roles
* Wed May 22 2024 Packit <hello(a)packit.dev> - 1.78.2-1
- Update to upstream version 1.78.2
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 22 2024 Packit <hello(a)packit.dev> - 1.78.2-1
- Update to upstream version 1.78.2
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-7f91f5e5fd' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
3 days, 11 hours
[SECURITY] Fedora 39 Update: cacti-1.2.27-1.fc39
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-27a594f71d
2024-05-31 02:13:07.316161
--------------------------------------------------------------------------------
Name : cacti
Product : Fedora 39
Version : 1.2.27
Release : 1.fc39
URL : https://www.cacti.net/
Summary : An rrd based graphing tool
Description :
Cacti is a complete frontend to RRDTool. It stores all of the
necessary information to create graphs and populate them with
data in a MySQL database. The frontend is completely PHP
driven.
--------------------------------------------------------------------------------
Update Information:
Update cacti and cacti-spine to version 1.2.27. This includes the upstream fixes
for many CVEs, including a critical remote code execution bug.
https://github.com/Cacti/cacti/blob/release/1.2.27/CHANGELOG
https://github.com/Cacti/spine/blob/release/1.2.27/CHANGELOG
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 21 2024 Carl George <carlwgeorge(a)fedoraproject.org> - 1.2.27-1
- Update to version 1.2.27
- CVE-2024-25641, CVE-2024-29894, CVE-2024-31443, CVE-2024-31444, CVE-2024-31445, CVE-2024-31458, CVE-2024-31459, CVE-2024-31460, CVE-2024-34340
* Tue May 21 2024 Carl George <carlwgeorge(a)fedoraproject.org> - 1.2.26-1
- Update to version 1.2.26
- CVE-2023-49084, CVE-2023-49085, CVE-2023-49086, CVE-2023-49088, CVE-2023-50250, CVE-2023-51448
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2255602 - CVE-2023-49084 cacti: RCE when managing links [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2255602
[ 2 ] Bug #2255606 - CVE-2023-49086 cacti: XSS when adding new devices [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2255606
[ 3 ] Bug #2255667 - CVE-2023-49085 CVE-2023-49088 CVE-2023-50250 CVE-2023-51448 cacti: Multiple vulnerabilities [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2255667
[ 4 ] Bug #2280482 - CVE-2024-34340 cacti: authentication bypass when using older password hashes [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280482
[ 5 ] Bug #2280497 - CVE-2024-29894 cacti: XSS vulnerability when using JavaScript based messaging API [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280497
[ 6 ] Bug #2280500 - CVE-2024-31458 CVE-2024-31459 CVE-2024-31460 cacti: multiple vulnerabilities [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280500
[ 7 ] Bug #2280503 - CVE-2024-31443 CVE-2024-31444 CVE-2024-31445 cacti: multiple vulnerabilties [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280503
[ 8 ] Bug #2280506 - CVE-2024-25641 cacti: remote code execution vulnerability [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280506
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-27a594f71d' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
3 days, 11 hours
Fedora 39 Update: mock-5.6-1.fc39
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-95b3c15bef
2024-05-31 02:13:07.316153
--------------------------------------------------------------------------------
Name : mock
Product : Fedora 39
Version : 5.6
Release : 1.fc39
URL : https://github.com/rpm-software-management/mock/
Summary : Builds packages inside chroots
Description :
Mock takes an SRPM and builds it in a chroot.
--------------------------------------------------------------------------------
Update Information:
https://rpm-software-management.github.io/mock/Release-Notes-5.6
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 14 2024 Jakub Kadlcik <frostyx(a)email.cz> 5.6-1
- scm: Open stdout in text mode for Git timestamp subprocesses
(fedora.dm0(a)gmail.com)
- always set ownership of homedir (but not recursively) (msuchy(a)redhat.com)
- Do not create temporary Buildroot.tmpdir for disabled nosync
(praiskup(a)redhat.com)
- bash-completion: add mock-parse-buildlog (pastalian46(a)gmail.com)
- Rewrites "original_name" method to check if "cls" has a "backmap"
(nikitych(a)yandex.ru)
- Don't use --allowerasing for more DNF commands (frostyx(a)email.cz)
- bash-completion: pre-build the list of mock known options
(praiskup(a)redhat.com)
- Avoid Traceback for resultdir ENOSPC (praiskup(a)redhat.com)
- Post-release administrivia (praiskup(a)redhat.com)
- Fix Version in %changelogs (praiskup(a)redhat.com)
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-95b3c15bef' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
3 days, 11 hours
Fedora 39 Update: mock-core-configs-40.4-1.fc39
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2024-e927925b96
2024-05-31 02:13:07.316144
--------------------------------------------------------------------------------
Name : mock-core-configs
Product : Fedora 39
Version : 40.4
Release : 1.fc39
URL : https://github.com/rpm-software-management/mock/
Summary : Mock core config files basic chroots
Description :
Mock configuration files which allow you to create chroots for Alma Linux,
Amazon Linux, CentOS, CentOS Stream, Circle Linux, EuroLinux, Fedora, Fedora EPEL, Mageia,
Navy Linux, OpenMandriva Lx, openSUSE, Oracle Linux, Red Hat Enterprise Linux,
Rocky Linux and various other specific or combined chroots.
--------------------------------------------------------------------------------
Update Information:
https://rpm-software-management.github.io/mock/Release-Notes-5.6#mock-core-
configs-changes
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 14 2024 Jakub Kadlcik <frostyx(a)email.cz> 40.4-1
- configs: BuildWithDNF5 for ELN (praiskup(a)redhat.com)
- Add Circle Linux 9 configs (bella(a)cclinux.org)
- configs: Replace Mageia 10 and Cauldron i586 configs with i686
(wally(a)mageia.org)
- Post-release administrivia (frostyx(a)email.cz)
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2024-e927925b96' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
3 days, 11 hours