June 2022 - Epel-packagers-sig - Fedora mailing-lists

[Bug 2069364] New: CVE-2021-43085 openssl: Insecure permissions vulnerability due to an error in the implementation of the CMAC_Final() function
by bugzilla＠redhat.com 09 Jan '25

09 Jan '25

https://bugzilla.redhat.com/show_bug.cgi?id=2069364 Bug ID: 2069364 Summary: CVE-2021-43085 openssl: Insecure permissions vulnerability due to an error in the implementation of the CMAC_Final() function Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: aos-bugs(a)redhat.com, asoldano(a)redhat.com, bbaranow(a)redhat.com, bdettelb(a)redhat.com, berrange(a)redhat.com, bmaxwell(a)redhat.com, bootloader-eng-team(a)redhat.com, brian.stansberry(a)redhat.com, caswilli(a)redhat.com, cdewolf(a)redhat.com, cfergeau(a)redhat.com, chazlett(a)redhat.com, crobinso(a)redhat.com, crypto-team(a)lists.fedoraproject.org, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dbelyavs(a)redhat.com, dhalasz(a)redhat.com, dkreling(a)redhat.com, dkuc(a)redhat.com, dosoudil(a)redhat.com, dueno(a)redhat.com, elima(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, erik-fedora(a)vanpienbroek.nl, f4bug(a)amsat.org, fjansen(a)redhat.com, fjuma(a)redhat.com, fmartine(a)redhat.com, gparvin(a)redhat.com, gzaronik(a)redhat.com, iweiss(a)redhat.com, jburrell(a)redhat.com, jclere(a)redhat.com, jkoehler(a)redhat.com, jochrist(a)redhat.com, jramanat(a)redhat.com, jwong(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, krathod(a)redhat.com, kraxel(a)redhat.com, ktietz(a)redhat.com, lgao(a)redhat.com, marcandre.lureau(a)redhat.com, michal.skrivanek(a)redhat.com, michel(a)michel-slm.name, micjohns(a)redhat.com, mjg59(a)srcf.ucam.org, mosmerov(a)redhat.com, mperina(a)redhat.com, msochure(a)redhat.com, mspacek(a)redhat.com, msvehla(a)redhat.com, mturk(a)redhat.com, njean(a)redhat.com, nobody(a)redhat.com, nwallace(a)redhat.com, pahickey(a)redhat.com, pbonzini(a)redhat.com, pjindal(a)redhat.com, pjones(a)redhat.com, pmackay(a)redhat.com, redhat-bugzilla(a)linuxnetz.de, rfreiman(a)redhat.com, rharwood(a)redhat.com, rh-spice-bugs(a)redhat.com, rjones(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, sahana(a)redhat.com, sbonazzo(a)redhat.com, smaestri(a)redhat.com, stcannon(a)redhat.com, sthirugn(a)redhat.com, szappis(a)redhat.com, tmeszaro(a)redhat.com, tm(a)t8m.info, tom.jenkinson(a)redhat.com, virt-maint(a)lists.fedoraproject.org, virt-maint(a)redhat.com, vkrizan(a)redhat.com, vkumar(a)redhat.com, vmugicag(a)redhat.com Target Milestone: --- Classification: Other An Insecure Permissions vulnerability exists in the OpenSSL Project 3.0 due to an error in the implementation of the CMAC_Final() function. Upstream issue: https://github.com/openssl/openssl/issues/16873 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2069364

1 4

[Bug 2052682] New: CVE-2022-24303 python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related action
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2052682 Bug ID: 2052682 Summary: CVE-2022-24303 python-pillow: temporary directory with a space character allows removal of unrelated file after im.show() and related action Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other If the path to the temporary directory on Linux or macOS contained a space, this would break removal of the temporary image file after im.show() (and related actions), and potentially remove an unrelated file. This been present since PIL. Reference: https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2052682

1 11

[Bug 2042527] New: CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2042527 Bug ID: 2042527 Summary: CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. Reference: https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-bu… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042527

1 23

[Bug 2042522] New: CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2042522 Bug ID: 2042522 Summary: CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. References: https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1da… https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-image… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

1 22

[Bug 2042511] New: CVE-2022-22815 python-pillow: improperly initializes ImagePath.Path in path_getbbox() in path.c
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2042511 Bug ID: 2042511 Summary: CVE-2022-22815 python-pillow: improperly initializes ImagePath.Path in path_getbbox() in path.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. References: https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1da… https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-image… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042511

1 19

[Bug 2093731] New: zbarimg does not read a Code 128 barcode
by bugzilla＠redhat.com 25 May '24

25 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2093731 Bug ID: 2093731 Summary: zbarimg does not read a Code 128 barcode Product: Fedora Version: 36 Status: NEW Component: zbar Severity: high Assignee: gwync(a)protonmail.com Reporter: cristian.ciupitu(a)yahoo.com QA Contact: extras-qa(a)fedoraproject.org CC: dougsland(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, mchehab(a)infradead.org, mr.marcelo.barbosa(a)gmail.com, negativo17(a)gmail.com Target Milestone: --- Classification: Fedora Created attachment 1886898 --> https://bugzilla.redhat.com/attachment.cgi?id=1886898&action=edit Code 128 barcode Description of problem: zbarimg does not read a Code 128 barcode Version-Release number of selected component (if applicable): zbar-0.23.90-1.fc36.x86_64 How reproducible: Every time Steps to Reproduce: 1. zbarimg barcode.png Actual results: scanned 0 barcode symbols from 1 images in 0 seconds WARNING: barcode data was not detected in some image(s) Things to check: - is the barcode type supported? Currently supported symbologies are: . EAN/UPC (EAN-13, EAN-8, EAN-2, EAN-5, UPC-A, UPC-E, ISBN-10, ISBN-13) . DataBar, DataBar Expanded . Code 128 . Code 93 . Code 39 . Codabar . Interleaved 2 of 5 . QR code . SQ code . PDF 417 - is the barcode large enough in the image? - is the barcode mostly in focus? - is there sufficient contrast/illumination? - If the symbol is split in several barcodes, are they combined in one image? - Did you enable the barcode type? some EAN/UPC codes are disabled by default. To enable all, use: $ zbarimg -S*.enable <files> Please also notice that some variants take precedence over others. Due to that, if you want, for example, ISBN-10, you should do: $ zbarimg -Sisbn10.enable <files> Expected results: (Code 128) 755897201062022179.73 Additional info: -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093731

1 7

[Bug 2065645] New: Gmime 3.2.9 is available
by bugzilla＠redhat.com 01 Dec '23

01 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2065645 Bug ID: 2065645 Summary: Gmime 3.2.9 is available Product: Fedora Version: rawhide Hardware: All Status: NEW Component: gmime30 Severity: medium Assignee: klember(a)redhat.com Reporter: mjg(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, klember(a)redhat.com Target Milestone: --- Link ID: Github jstedfast/gmime/releases/tag/3.2.9 Classification: Fedora Description of problem: Gmime 3.2.7 as packaged is outdated (Mar 2020). Version-Release number of selected component (if applicable): 3.2.7-5 How reproducible: always Steps to Reproduce: 1. dnf list gmime30 Actual results: gmime30-3.2.7 Expected results: gmime30-3.2.9 Additional info: The real upstream has been at https://github.com/jstedfast/gmime/ for quite some time now (not on gnome any more, and never on gitlab). -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2065645

1 12

[Bug 2078238] New: gssdp-1.5.0 is available
by bugzilla＠redhat.com 22 Nov '23

22 Nov '23

https://bugzilla.redhat.com/show_bug.cgi?id=2078238 Bug ID: 2078238 Summary: gssdp-1.5.0 is available Product: Fedora Version: rawhide Status: NEW Component: gssdp Keywords: FutureFeature, Triaged Assignee: klember(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, klember(a)redhat.com, zeenix(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 1.5.0 Current version/release in rawhide: 1.4.0.1-2.fc36 URL: https://developer.gnome.org/gssdp/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1262/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2078238

1 27

[Bug 2081494] New: CVE-2022-1292 openssl: c_rehash script allows command injection
by bugzilla＠redhat.com 08 Nov '23

08 Nov '23

https://bugzilla.redhat.com/show_bug.cgi?id=2081494 Bug ID: 2081494 Summary: CVE-2022-1292 openssl: c_rehash script allows command injection Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: pdelbell(a)redhat.com CC: aos-bugs(a)redhat.com, asoldano(a)redhat.com, bbaranow(a)redhat.com, bdettelb(a)redhat.com, berrange(a)redhat.com, bmaxwell(a)redhat.com, bootloader-eng-team(a)redhat.com, brian.stansberry(a)redhat.com, caswilli(a)redhat.com, cdewolf(a)redhat.com, cfergeau(a)redhat.com, chazlett(a)redhat.com, crobinso(a)redhat.com, crypto-team(a)lists.fedoraproject.org, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dbelyavs(a)redhat.com, ddepaula(a)redhat.com, dhalasz(a)redhat.com, dkreling(a)redhat.com, dkuc(a)redhat.com, dosoudil(a)redhat.com, dueno(a)redhat.com, elima(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, erik-fedora(a)vanpienbroek.nl, f4bug(a)amsat.org, fjansen(a)redhat.com, fjuma(a)redhat.com, fmartine(a)redhat.com, gparvin(a)redhat.com, gzaronik(a)redhat.com, iweiss(a)redhat.com, jburrell(a)redhat.com, jclere(a)redhat.com, jferlan(a)redhat.com, jkoehler(a)redhat.com, jochrist(a)redhat.com, jramanat(a)redhat.com, jwong(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, krathod(a)redhat.com, kraxel(a)redhat.com, ktietz(a)redhat.com, lgao(a)redhat.com, marcandre.lureau(a)redhat.com, michal.skrivanek(a)redhat.com, michel(a)michel-slm.name, micjohns(a)redhat.com, mjg59(a)srcf.ucam.org, mosmerov(a)redhat.com, mperina(a)redhat.com, msochure(a)redhat.com, mspacek(a)redhat.com, msvehla(a)redhat.com, mturk(a)redhat.com, njean(a)redhat.com, nwallace(a)redhat.com, pahickey(a)redhat.com, pbonzini(a)redhat.com, pjindal(a)redhat.com, pjones(a)redhat.com, pmackay(a)redhat.com, redhat-bugzilla(a)linuxnetz.de, rfreiman(a)redhat.com, rharwood(a)redhat.com, rh-spice-bugs(a)redhat.com, rjones(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, sahana(a)redhat.com, sbonazzo(a)redhat.com, smaestri(a)redhat.com, stcannon(a)redhat.com, sthirugn(a)redhat.com, szappis(a)redhat.com, tmeszaro(a)redhat.com, tm(a)t8m.info, tom.jenkinson(a)redhat.com, virt-maint(a)lists.fedoraproject.org, virt-maint(a)redhat.com, vkrizan(a)redhat.com, vkumar(a)redhat.com, vmugicag(a)redhat.com Target Milestone: --- Classification: Other The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. OpenSSL 1.0.2 users should upgrade to 1.0.2ze OpenSSL 1.1.1 users should upgrade to 1.1.1o OpenSSL 3.0 users should upgrade to 3.0.3 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2081494

1 53

[Bug 2090572] New: CVE-2022-21680 thrift: marked: regular expression block.def may lead Denial of Service [epel-all]
by bugzilla＠redhat.com 16 Jun '23

16 Jun '23

https://bugzilla.redhat.com/show_bug.cgi?id=2090572 Bug ID: 2090572 Summary: CVE-2022-21680 thrift: marked: regular expression block.def may lead Denial of Service [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: thrift Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: ctubbsii(a)fedoraproject.org Reporter: saroy(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: ctubbsii(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, milleruntime(a)gmail.com, orion(a)nwra.com, willb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2090572

1 3

[Bug 2092715] New: CVE-2022-21681 thrift: marked: regular expression inline.reflinkSearch may lead Denial of Service [epel-all]
by bugzilla＠redhat.com 16 Jun '23

16 Jun '23

https://bugzilla.redhat.com/show_bug.cgi?id=2092715 Bug ID: 2092715 Summary: CVE-2022-21681 thrift: marked: regular expression inline.reflinkSearch may lead Denial of Service [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: thrift Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: ctubbsii(a)fedoraproject.org Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: ctubbsii(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, milleruntime(a)gmail.com, orion(a)nwra.com, willb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2092715

1 3

[Bug 2094052] New: CVE-2021-4231 angular: XSS vulnerability
by bugzilla＠redhat.com 15 Jun '23

15 Jun '23

https://bugzilla.redhat.com/show_bug.cgi?id=2094052 Bug ID: 2094052 Summary: CVE-2021-4231 angular: XSS vulnerability Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aileenc(a)redhat.com, amctagga(a)redhat.com, amurdaca(a)redhat.com, andrew.slice(a)redhat.com, aoconnor(a)redhat.com, asm(a)redhat.com, bniver(a)redhat.com, bodavis(a)redhat.com, branto(a)redhat.com, chazlett(a)redhat.com, danmick(a)gmail.com, david(a)gnsa.us, dbhole(a)redhat.com, decathorpe(a)gmail.com, deparker(a)redhat.com, dwd(a)fedoraproject.org, eduardo.ramalho(a)gmail.com, epel-packagers-sig(a)lists.fedoraproject.org, erack(a)redhat.com, fedora(a)zaniyah.org, flucifre(a)redhat.com, fmuellner(a)redhat.com, fzatlouk(a)redhat.com, gecko-bugs-nobody(a)fedoraproject.org, gmalinko(a)redhat.com, gmeno(a)redhat.com, go-sig(a)lists.fedoraproject.org, i(a)stingr.net, janstey(a)redhat.com, jcajka(a)cajka.dev, jhorak(a)redhat.com, jochrist(a)redhat.com, josef(a)toxicpanda.com, jwon(a)redhat.com, kai-engert-fedora(a)kuix.de, kanderso(a)redhat.com, kkeithle(a)redhat.com, klaas(a)demter.de, klember(a)redhat.com, lemenkov(a)gmail.com, loic(a)dachary.org, lvaleeva(a)redhat.com, madam(a)redhat.com, mbenjamin(a)redhat.com, mhackett(a)redhat.com, muagarwa(a)redhat.com, ngompa13(a)gmail.com, ocs-bugs(a)redhat.com, omajid(a)redhat.com, pdelbell(a)redhat.com, pjasicek(a)redhat.com, polkit-devel(a)redhat.com, ramkrsna(a)gmail.com, rhughes(a)redhat.com, rstrode(a)redhat.com, rwagner(a)redhat.com, sandmann(a)redhat.com, sostapov(a)redhat.com, steve(a)silug.org, stransky(a)redhat.com, thofmann(a)fedoraproject.org, tpopela(a)redhat.com, trpost(a)rocketmail.com, vereddy(a)redhat.com, zebob.m(a)gmail.com, zsvetlik(a)redhat.com Blocks: 2094048 Target Milestone: --- Classification: Other A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component. References: https://vuldb.com/?id.181356 https://github.com/angular/angular/issues/40136 https://security.snyk.io/vuln/SNYK-JS-ANGULARCORE-1070902 https://github.com/angular/angular/commit/ba8da742e3b243e8f43d4c63aa842b44e… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2094052

1 9

[Bug 2032607] New: F36FailsToInstall: hyperkitty
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2032607 Bug ID: 2032607 Summary: F36FailsToInstall: hyperkitty Product: Fedora Version: rawhide Status: NEW Component: python-hyperkitty Assignee: michel(a)michel-slm.name Reporter: mhroncok(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, python-sig(a)lists.fedoraproject.org Blocks: 1992487 (F36FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically. If you feel that this output has mistakes, please contact me via email (mhroncok(a)redhat.com) Your package (python-hyperkitty) Fails To Install in Fedora 36: can't install hyperkitty: - nothing provides python3.10dist(flufl-lock) >= 4 needed by hyperkitty-1.3.5-1.fc36.noarch - nothing provides python3.10dist(mistune) >= 2~rc1 needed by hyperkitty-1.3.5-1.fc36.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1992487 [Bug 1992487] Fedora 36 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2032607

1 19

[Bug 2063508] New: authentication recquired The password you use does not match
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2063508 Bug ID: 2063508 Summary: authentication recquired The password you use does not match Product: Fedora Version: 36 OS: Linux Status: NEW Component: keyrings-filesystem Severity: high Assignee: manisandro(a)gmail.com Reporter: jjb(a)xs4all.nl QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, sergio(a)serjux.com Target Milestone: --- Classification: Fedora Description of problem: Keyring is locked. (in Passwords and Keys, Seahorse) try to solve error message "authentication required, the password you use to log in to your computer no longer match that of your login keyring" The known password is not accepted. Version-Release number of selected component (if applicable): How reproducible: try to Get Geary (email program) at work. At login to the computer the password is working all right. Steps to Reproduce: 1. 2. 3. Actual results: cannot authenticate password. Expected results: no question of authentication Additional info: do not know how to solve this problem. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2063508

1 5

[Bug 2090622] New: [abrt] xmlstarlet: xmlXPathCompUnaryExpr(): xmlstarlet killed by SIGSEGV
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2090622 Bug ID: 2090622 Summary: [abrt] xmlstarlet: xmlXPathCompUnaryExpr(): xmlstarlet killed by SIGSEGV Product: Fedora Version: 36 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:fae15203a4426ff6ea89539d9cb4c1ae9473b845;VAR IANT_ID=workstation; Component: xmlstarlet Assignee: stickster(a)gmail.com Reporter: mf.flip(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: daltonminer(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, stickster(a)gmail.com Target Milestone: --- Classification: Fedora Version-Release number of selected component: xmlstarlet-1.6.1-18.fc36 Additional info: reporter: libreport-2.17.1 backtrace_rating: 4 cgroup: 0::/user.slice/user-1000.slice/user@1000.service/app.slice/vte-spawn-b6417f15-9599-4249-82d4-24ff704344e1.scope cmdline: xmlstarlet ed --without-comments activemq.xml crash_function: xmlXPathCompUnaryExpr executable: /usr/bin/xmlstarlet journald_cursor: s=952f321409164e31aecdcfe29dabfc09;i=2c2dd8;b=d8a42405eec240a19c823e14d4731d5c;m=7ac1a3fe9;t=5dfd855906ebd;x=1c1ad98bbbf498bf kernel: 5.17.9-300.fc36.x86_64 rootdir: / runlevel: N 5 type: CCpp uid: 1000 Truncated backtrace: Thread no. 1 (10 frames) #0 xmlXPathCompUnaryExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10736 #1 xmlXPathCompMultiplicativeExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10769 #2 xmlXPathCompAdditiveExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10810 #3 xmlXPathCompRelationalExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10848 #4 xmlXPathCompEqualityExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10887 #5 xmlXPathCompAndExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10918 #6 xmlXPathCompileExpr at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:10956 #7 xmlXPathEvalExpr__internal_alias at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:14426 #9 xmlXPathEval__internal_alias at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:14466 #10 xmlXPathEvalExpression__internal_alias at /usr/src/debug/libxml2-2.9.14-1.fc36.x86_64/xpath.c:14541 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2090622

1 2

[Bug 2092724] New: CVE-2022-21681 thrift: marked: regular expression inline.reflinkSearch may lead Denial of Service [fedora-all]
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2092724 Bug ID: 2092724 Summary: CVE-2022-21681 thrift: marked: regular expression inline.reflinkSearch may lead Denial of Service [fedora-all] Product: Fedora Version: 36 Status: NEW Component: thrift Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: ctubbsii(a)fedoraproject.org Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: ctubbsii(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, milleruntime(a)gmail.com, orion(a)nwra.com, willb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2092724

1 4

[Bug 2090581] New: CVE-2022-21680 thrift: marked: regular expression block.def may lead Denial of Service [fedora-all]
by bugzilla＠redhat.com 25 May '23

25 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2090581 Bug ID: 2090581 Summary: CVE-2022-21680 thrift: marked: regular expression block.def may lead Denial of Service [fedora-all] Product: Fedora Version: 36 Status: NEW Component: thrift Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: ctubbsii(a)fedoraproject.org Reporter: saroy(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: ctubbsii(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, milleruntime(a)gmail.com, orion(a)nwra.com, willb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2090581

1 4

[Bug 2093358] New: CVE-2021-46790 ntfs-3g: heap-based buffer overflow in ntfsck
by bugzilla＠redhat.com 16 May '23

16 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093358 Bug ID: 2093358 Summary: CVE-2021-46790 ntfs-3g: heap-based buffer overflow in ntfsck Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the upstream position is that ntfsck is deprecated; however, it is shipped by some Linux distributions. References: https://github.com/tuxera/ntfs-3g/issues/16 http://www.openwall.com/lists/oss-security/2022/05/26/1 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093358

1 16

[Bug 2093348] New: CVE-2022-30789 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array
by bugzilla＠redhat.com 16 May '23

16 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093348 Bug ID: 2093348 Summary: CVE-2022-30789 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093348

1 16

[Bug 2093340] New: CVE-2022-30788 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc
by bugzilla＠redhat.com 16 May '23

16 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093340 Bug ID: 2093340 Summary: CVE-2022-30788 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093340

1 16

[Bug 2093326] New: CVE-2022-30786 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate
by bugzilla＠redhat.com 16 May '23

16 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093326 Bug ID: 2093326 Summary: CVE-2022-30786 ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093326

1 16

[Bug 2093314] New: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value
by bugzilla＠redhat.com 16 May '23

16 May '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093314 Bug ID: 2093314 Summary: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093314

1 16

[Bug 2082587] New: Busybox 1.35.0-2 crashes
by bugzilla＠redhat.com 25 Apr '23

25 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=2082587 Bug ID: 2082587 Summary: Busybox 1.35.0-2 crashes Product: Fedora Version: 36 Status: NEW Component: busybox Severity: high Assignee: spotrh(a)gmail.com Reporter: stefanb(a)us.ibm.com QA Contact: extras-qa(a)fedoraproject.org CC: admiller(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, spotrh(a)gmail.com Target Milestone: --- Classification: Fedora Description of problem: Busybox 1.35.0-2 is crashing for me Version-Release number of selected component (if applicable): 1.35.0-2 How reproducible: I need to downgrade busybox to have it working ... [stefanb@test ~]$ busybox sh Segmentation fault (core dumped) [stefanb@test ~]$ gdb --args busybox sh GNU gdb (GDB) Fedora 11.2-3.fc36 Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from busybox... This GDB supports auto-downloading debuginfo from the following URLs: https://debuginfod.fedoraproject.org/ Enable debuginfod for this session? (y or [n]) y Debuginfod has been enabled. To make this setting permanent, add 'set debuginfod enabled on' to .gdbinit. Reading symbols from /home/stefanb/.cache/debuginfod_client/88baa87c0a47de9361e9abdbea1d01d5ee79f832/debuginfo... (gdb) r Starting program: /usr/sbin/busybox sh Downloading separate debug info for /home/stefanb/system-supplied DSO at 0x7ffff7ffd000... Program received signal SIGSEGV, Segmentation fault. 0x0000000000409597 in parse_config_file () at libbb/appletlib.c:329 329 { (gdb) q A debugging session is active. Inferior 1 [process 3691] will be killed. Quit anyway? (y or n) y [stefanb@test ~]$ sudo su - [root@test ~]# busybox sh Segmentation fault (core dumped) [root@test ~]# sudo dnf -y reinstall busybox Last metadata expiration check: 3:08:06 ago on Fri 06 May 2022 06:09:36 AM. Dependencies resolved. =========================================================================================================================================================== Package Architecture Version Repository Size =========================================================================================================================================================== Reinstalling: busybox x86_64 1:1.35.0-2.fc36 fedora 775 k Transaction Summary =========================================================================================================================================================== Total download size: 775 k Installed size: 1.5 M Downloading Packages: busybox-1.35.0-2.fc36.x86_64.rpm 4.9 MB/s | 775 kB 00:00 ----------------------------------------------------------------------------------------------------------------------------------------------------------- Total 2.0 MB/s | 775 kB 00:00 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Reinstalling : busybox-1:1.35.0-2.fc36.x86_64 1/2 Cleanup : busybox-1:1.35.0-2.fc36.x86_64 2/2 Running scriptlet: busybox-1:1.35.0-2.fc36.x86_64 2/2 Verifying : busybox-1:1.35.0-2.fc36.x86_64 1/2 Verifying : busybox-1:1.35.0-2.fc36.x86_64 2/2 Reinstalled: busybox-1:1.35.0-2.fc36.x86_64 Complete! [root@test ~]# busybox ls Segmentation fault (core dumped) [root@test ~]# dnf remove busybox Dependencies resolved. =========================================================================================================================================================== Package Architecture Version Repository Size =========================================================================================================================================================== Removing: busybox x86_64 1:1.35.0-2.fc36 @fedora 1.5 M Transaction Summary =========================================================================================================================================================== Remove 1 Package Freed space: 1.5 M Is this ok [y/N]: y Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Erasing : busybox-1:1.35.0-2.fc36.x86_64 1/1 Running scriptlet: busybox-1:1.35.0-2.fc36.x86_64 1/1 Verifying : busybox-1:1.35.0-2.fc36.x86_64 1/1 Removed: busybox-1:1.35.0-2.fc36.x86_64 Complete! [root@test ~]# rpm -Uvh https://kojipkgs.fedoraproject.org//packages/busybox/1.34.1/1.fc36/x86_64/b… Retrieving https://kojipkgs.fedoraproject.org//packages/busybox/1.34.1/1.fc36/x86_64/b… Verifying... ################################# [100%] Preparing... ################################# [100%] Updating / installing... 1:busybox-1:1.34.1-1.fc36 ################################# [100%] [root@test ~]# busybox sh ~ # [root@test ~]# logout [stefanb@test ~]$ busybox sh ~ $ Expected results: Busybox should work. Additional info: -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2082587

1 4

[Bug 2046878] New: python-hyperkitty: FTBFS in Fedora rawhide/f36
by bugzilla＠redhat.com 12 Mar '23

12 Mar '23

https://bugzilla.redhat.com/show_bug.cgi?id=2046878 Bug ID: 2046878 Summary: python-hyperkitty: FTBFS in Fedora rawhide/f36 Product: Fedora Version: rawhide Status: NEW Component: python-hyperkitty Assignee: michel(a)michel-slm.name Reporter: releng(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, python-sig(a)lists.fedoraproject.org Blocks: 1992484 (F36FTBFS) Target Milestone: --- Classification: Fedora python-hyperkitty failed to build from source in Fedora rawhide/f36 https://koji.fedoraproject.org/koji/taskinfo?taskID=81985454 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Please fix python-hyperkitty at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, python-hyperkitty will be orphaned. Before branching of Fedora 37, python-hyperkitty will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails… Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1992484 [Bug 1992484] Fedora 36 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2046878

1 10

[Bug 2049668] New: libimagequant-4.0.0 is available
by bugzilla＠redhat.com 12 Mar '23

12 Mar '23

https://bugzilla.redhat.com/show_bug.cgi?id=2049668 Bug ID: 2049668 Summary: libimagequant-4.0.0 is available Product: Fedora Version: rawhide Status: NEW Component: libimagequant Keywords: FutureFeature, Triaged Assignee: manisandro(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, python-sig(a)lists.fedoraproject.org, sergio(a)serjux.com Target Milestone: --- Classification: Fedora Latest upstream release: 4.0.0 Current version/release in rawhide: 2.17.0-2.fc36 URL: https://pngquant.org/lib/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/12768/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2049668

1 18

[Bug 2044963] New: F36FailsToInstall: postorius
by bugzilla＠redhat.com 07 Mar '23

07 Mar '23

https://bugzilla.redhat.com/show_bug.cgi?id=2044963 Bug ID: 2044963 Summary: F36FailsToInstall: postorius Product: Fedora Version: rawhide Status: NEW Component: python-postorius Assignee: michel(a)michel-slm.name Reporter: mhroncok(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, python-sig(a)lists.fedoraproject.org Blocks: 1992487 (F36FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically. If you feel that this output has mistakes, please contact me via email (mhroncok(a)redhat.com) Your package (python-postorius) Fails To Install in Fedora 36: can't install postorius: - nothing provides (python3.10dist(django) < 3.3~~ with python3.10dist(django) >= 2.2) needed by postorius-1.3.6-1.fc36.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1992487 [Bug 1992487] Fedora 36 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2044963

1 16

[Bug 2073097] New: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF
by bugzilla＠redhat.com 28 Feb '23

28 Feb '23

https://bugzilla.redhat.com/show_bug.cgi?id=2073097 Bug ID: 2073097 Summary: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: andreas(a)bawue.net, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, rdieter(a)gmail.com Target Milestone: --- Classification: Other In GraphicsMagick, a heap buffer overflow was found when parsing MIFF. References: https://sourceforge.net/p/graphicsmagick/bugs/664/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2073097

1 8

[Bug 2073098] New: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF [epel-all]
by bugzilla＠redhat.com 28 Feb '23

28 Feb '23

https://bugzilla.redhat.com/show_bug.cgi?id=2073098 Bug ID: 2073098 Summary: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: GraphicsMagick Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: rdieter(a)gmail.com Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: andreas(a)bawue.net, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, rdieter(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2073098

1 3

[Bug 2073099] New: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF [fedora-all]
by bugzilla＠redhat.com 28 Feb '23

28 Feb '23

https://bugzilla.redhat.com/show_bug.cgi?id=2073099 Bug ID: 2073099 Summary: CVE-2022-1270 GraphicsMagick: Heap buffer overflow when parsing MIFF [fedora-all] Product: Fedora Version: 35 Status: NEW Component: GraphicsMagick Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: andreas(a)bawue.net Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: andreas(a)bawue.net, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, rdieter(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2073099

1 5

[Bug 2077383] New: F37FailsToInstall: python3-tmuxp
by bugzilla＠redhat.com 20 Feb '23

20 Feb '23

https://bugzilla.redhat.com/show_bug.cgi?id=2077383 Bug ID: 2077383 Summary: F37FailsToInstall: python3-tmuxp Product: Fedora Version: rawhide Status: NEW Component: python-tmuxp Assignee: igor.raits(a)gmail.com Reporter: mhroncok(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, igor.raits(a)gmail.com Blocks: 2045109 (F37FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically. If you feel that this output has mistakes, please contact me via email (mhroncok(a)redhat.com) Your package (python-tmuxp) Fails To Install in Fedora 37: can't install python3-tmuxp: - nothing provides (python3.10dist(click) < 8.1~~ with python3.10dist(click) >= 7) needed by python3-tmuxp-1.9.2-2.fc37.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. To reproduce, use the koji/local repo only, e.g. in mock: $ mock -r fedora-37-x86_64 --disablerepo='*' --enablerepo=local install python3-tmuxp P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2045109 [Bug 2045109] Fedora 37 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2077383

1 9

[Bug 2063475] New: python-libtmux-0.11.0b2 is available
by bugzilla＠redhat.com 20 Feb '23

20 Feb '23

https://bugzilla.redhat.com/show_bug.cgi?id=2063475 Bug ID: 2063475 Summary: python-libtmux-0.11.0b2 is available Product: Fedora Version: rawhide Status: NEW Component: python-libtmux Keywords: FutureFeature, Triaged Assignee: mail(a)fabian-affolter.ch Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, mail(a)fabian-affolter.ch Target Milestone: --- Classification: Fedora Latest upstream release: 0.11.0b2 Current version/release in rawhide: 0.10.3-1.fc37 URL: https://pypi.python.org/pypi/libtmux Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/13040/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2063475

1 7

[Bug 2079295] New: Busybox requires ld-musl-x86_64.so.1, but must be static
by bugzilla＠redhat.com 19 Jan '23

19 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2079295 Bug ID: 2079295 Summary: Busybox requires ld-musl-x86_64.so.1, but must be static Product: Fedora Version: rawhide OS: Linux Status: NEW Component: busybox Severity: medium Assignee: spotrh(a)gmail.com Reporter: atu(a)nmetau.edu.ua QA Contact: extras-qa(a)fedoraproject.org CC: admiller(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, spotrh(a)gmail.com Target Milestone: --- Classification: Fedora Description of problem: Busybox is a special binary, which must be static. However, it requires so from musl library. Version-Release number of selected component (if applicable): busybox-1:1.35.0-4.fc37.x86_64 How reproducible: Always Steps to Reproduce: 1. rpm -Uvh --test busybox-1.35.0-4.fc37.x86_64.rpm Actual results: error: Failed dependencies: ld-musl-x86_64.so.1()(64bit) is needed by busybox-1:1.35.0-4.fc37.x86_64 Expected results: Clean install without dependencies from any library. Additional info: -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2079295

1 11

[Bug 2093333] New: CVE-2022-30787 ntfs-3g: integer underflow in fuse_lib_readdir enables arbitrary memory read operations
by bugzilla＠redhat.com 16 Jan '23

16 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093333 Bug ID: 2093333 Summary: CVE-2022-30787 ntfs-3g: integer underflow in fuse_lib_readdir enables arbitrary memory read operations Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58 https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093333

1 11

[Bug 2093320] New: CVE-2022-30785 ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations
by bugzilla＠redhat.com 16 Jan '23

16 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093320 Bug ID: 2093320 Summary: CVE-2022-30785 ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58 https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093320

1 11

[Bug 2093305] New: CVE-2022-30783 ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic
by bugzilla＠redhat.com 16 Jan '23

16 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2093305 Bug ID: 2093305 Summary: CVE-2022-30783 ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58 https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093305

1 11

[Bug 2091183] New: Remove tesseract from epel9 - RHEL9 conflict
by bugzilla＠redhat.com 11 Jan '23

11 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2091183 Bug ID: 2091183 Summary: Remove tesseract from epel9 - RHEL9 conflict Product: Fedora EPEL Version: epel9 Status: NEW Component: tesseract Assignee: manisandro(a)gmail.com Reporter: tdawson(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, karlikt(a)gmail.com, manisandro(a)gmail.com Target Milestone: --- Classification: Fedora tesseract and tesseract-tessdata are in RHEL 9.0 Remove them from epel9. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2091183

1 5

[Bug 2069264] New: [abrt] notmuch: notmuch_tags_valid(): notmuch killed by SIGSEGV
by bugzilla＠redhat.com 02 Jan '23

02 Jan '23

https://bugzilla.redhat.com/show_bug.cgi?id=2069264 Bug ID: 2069264 Summary: [abrt] notmuch: notmuch_tags_valid(): notmuch killed by SIGSEGV Product: Fedora Version: 35 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:984ab0912b2464ac1bdc7a4ed0314cd31128b91d;VAR IANT_ID=xfce; Component: notmuch Assignee: mjg(a)fedoraproject.org Reporter: jhutar(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, lewk(a)openmailbox.org, mjg(a)fedoraproject.org, rbean(a)redhat.com Target Milestone: --- Classification: Fedora Description of problem: Some email have to be causing that :-/ neomutt is failing because of that as well when I have virtual-mailboxes configuerd. Command I have used in this case was: notmuch search "tag:zsdidaktis OR from:@zsdidaktis.cz" Version-Release number of selected component: notmuch-0.35-2.fc35 Additional info: reporter: libreport-2.15.2 backtrace_rating: 4 cgroup: 0::/user.slice/user-1000.slice/session-2.scope cmdline: notmuch search $'tag:zsdidaktis OR from:@zsdidaktis.cz' crash_function: notmuch_tags_valid executable: /usr/bin/notmuch journald_cursor: s=2b2e17a38b1e4b81b5a9d1b5dc73c207;i=4a10;b=b9117c89319c46bfb4da24d1af361aae;m=36b1505a0a;t=5db48d2887322;x=3e305f1fd4ce2258 kernel: 5.16.15-201.fc35.x86_64 rootdir: / runlevel: N 5 type: CCpp uid: 1000 Truncated backtrace: Thread no. 1 (6 frames) #0 notmuch_tags_valid at lib/tags.c:51 #1 _thread_add_message at lib/thread.cc:254 #2 _notmuch_thread_create at lib/thread.cc:631 #3 notmuch_threads_get at lib/query.cc:671 #4 do_search_threads at /usr/src/debug/notmuch-0.35-2.fc35.x86_64/notmuch-search.c:150 #5 notmuch_search_command at /usr/src/debug/notmuch-0.35-2.fc35.x86_64/notmuch-search.c:845 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2069264

1 10

[Bug 2097004] New: stalonetray-0.8.4 is available
by bugzilla＠redhat.com 20 Dec '22

20 Dec '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097004 Bug ID: 2097004 Summary: stalonetray-0.8.4 is available Product: Fedora Version: rawhide Status: NEW Component: stalonetray Keywords: FutureFeature, Triaged Assignee: fedora(a)me.benboeckel.net Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)me.benboeckel.net Target Milestone: --- Classification: Fedora Releases retrieved: 0.8.4 Upstream release that is considered latest: 0.8.4 Current version/release in rawhide: 0.8.3-16.fc36 URL: https://github.com/kolbusa/stalonetray Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/5713/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/stalonetray -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097004

1 3

[Bug 2088233] New: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service
by bugzilla＠redhat.com 13 Dec '22

13 Dec '22

https://bugzilla.redhat.com/show_bug.cgi?id=2088233 Bug ID: 2088233 Summary: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: saroy(a)redhat.com CC: admiller(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, spotrh(a)gmail.com Target Milestone: --- Classification: Other A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. https://bugs.busybox.net/show_bug.cgi?id=14781 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2088233

1 9

[Bug 2089281] New: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service [fedora-35]
by bugzilla＠redhat.com 13 Dec '22

13 Dec '22

https://bugzilla.redhat.com/show_bug.cgi?id=2089281 Bug ID: 2089281 Summary: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service [fedora-35] Product: Fedora Version: 35 Status: NEW Component: busybox Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: spotrh(a)gmail.com Reporter: saroy(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: admiller(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, spotrh(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-35. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2089281

1 4

[Bug 2082465] New: CVE-2022-29167 yarnpkg: hawk: REDoS in hawk.utils.parseHost() when parsing Host header [fedora-all]
by bugzilla＠redhat.com 13 Dec '22

13 Dec '22

https://bugzilla.redhat.com/show_bug.cgi?id=2082465 Bug ID: 2082465 Summary: CVE-2022-29167 yarnpkg: hawk: REDoS in hawk.utils.parseHost() when parsing Host header [fedora-all] Product: Fedora Version: 35 Status: NEW Component: yarnpkg Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: zsvetlik(a)redhat.com Reporter: ahanwate(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2082465

1 4

[Bug 2070960] New: CVE-2022-0841 yarnpkg: npm-lockfile: os command injection [fedora-all]
by bugzilla＠redhat.com 13 Dec '22

13 Dec '22

https://bugzilla.redhat.com/show_bug.cgi?id=2070960 Bug ID: 2070960 Summary: CVE-2022-0841 yarnpkg: npm-lockfile: os command injection [fedora-all] Product: Fedora Version: 35 Status: NEW Component: yarnpkg Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: zsvetlik(a)redhat.com Reporter: mcascell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2070960

1 4

[Bug 2059360] New: yarnpkg for fedora 35 installs binary '/usr/bin/%{fc_name}'
by bugzilla＠redhat.com 13 Dec '22

13 Dec '22

https://bugzilla.redhat.com/show_bug.cgi?id=2059360 Bug ID: 2059360 Summary: yarnpkg for fedora 35 installs binary '/usr/bin/%{fc_name}' Product: Fedora Version: 35 Status: NEW Component: yarnpkg Assignee: zsvetlik(a)redhat.com Reporter: martin.kuehl(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora Description of problem: the current yarnpkg rpm installs a binary at the path '/usr/bin/%{fc_name}' this is also visible at: https://packages.fedoraproject.org/pkgs/yarnpkg/yarnpkg/fedora-35.html#files Version-Release number of selected component (if applicable): yarnpkg-1.22.10-3.fc35 How reproducible: always Steps to Reproduce: 1. dnf repoquery --list yarnpkg | grep /usr/bin or look at https://packages.fedoraproject.org/pkgs/yarnpkg/yarnpkg/fedora-35.html#files Actual results: /usr/bin/%{fc_name} /usr/bin/yarn /usr/bin/yarnpkg Expected results: judging by the package for fedora 36: /usr/bin/nodejs-yarn /usr/bin/yarn /usr/bin/yarnpkg Additional info: if i remember correctly that's rpm spec template syntax so there might be some stray escaping or something? it's also apparently fixed for f36 so backporting that package would be just fine. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2059360

1 3

[Bug 2072386] New: Remove xmlstarlet from epel8
by bugzilla＠redhat.com 30 Nov '22

30 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2072386 Bug ID: 2072386 Summary: Remove xmlstarlet from epel8 Product: Fedora EPEL Version: epel8 Status: NEW Component: xmlstarlet Assignee: stickster(a)gmail.com Reporter: rhel-process-autobot(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: daltonminer(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, stickster(a)gmail.com Target Milestone: --- Classification: Fedora -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2072386

1 6

[Bug 2084488] New: Remove xmlstarlet from epel9
by bugzilla＠redhat.com 30 Nov '22

30 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2084488 Bug ID: 2084488 Summary: Remove xmlstarlet from epel9 Product: Fedora EPEL Version: epel9 Status: NEW Component: xmlstarlet Assignee: stickster(a)gmail.com Reporter: rhel-process-autobot(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: daltonminer(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, stickster(a)gmail.com Target Milestone: --- Classification: Fedora -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2084488

1 5

[Bug 2091263] New: Please update it to 0.23.90 and enable pdf417 support
by bugzilla＠redhat.com 28 Nov '22

28 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2091263 Bug ID: 2091263 Summary: Please update it to 0.23.90 and enable pdf417 support Product: Fedora Version: 35 Status: NEW Component: zbar Assignee: gwync(a)protonmail.com Reporter: bugzilla(a)terrortux.de QA Contact: extras-qa(a)fedoraproject.org CC: dougsland(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, mchehab(a)infradead.org, mr.marcelo.barbosa(a)gmail.com, negativo17(a)gmail.com Target Milestone: --- Classification: Fedora Changes see: https://github.com/mchehab/zbar/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2091263

1 5

[Bug 2081540] New: crc32 and compressions are not supported
by bugzilla＠redhat.com 14 Nov '22

14 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2081540 Bug ID: 2081540 Summary: crc32 and compressions are not supported Product: Fedora Version: rawhide Status: NEW Component: rocksdb Assignee: hegjon(a)gmail.com Reporter: socketpair(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, hegjon(a)gmail.com, mmuzila(a)redhat.com Target Milestone: --- Classification: Fedora Opening (Creating) any RocksDB shows this in the log: 2022/05/04-03:33:21.189455 7f14b298eac0 Compression algorithms supported: 2022/05/04-03:33:21.189459 7f14b298eac0 <------>kZSTD supported: 0 2022/05/04-03:33:21.189463 7f14b298eac0 <------>kXpressCompression supported: 0 2022/05/04-03:33:21.189466 7f14b298eac0 <------>kBZip2Compression supported: 0 2022/05/04-03:33:21.189511 7f14b298eac0 <------>kZSTDNotFinalCompression supported: 0 2022/05/04-03:33:21.189515 7f14b298eac0 <------>kLZ4Compression supported: 0 2022/05/04-03:33:21.189518 7f14b298eac0 <------>kZlibCompression supported: 0 2022/05/04-03:33:21.189521 7f14b298eac0 <------>kLZ4HCCompression supported: 0 2022/05/04-03:33:21.189524 7f14b298eac0 <------>kSnappyCompression supported: 0 2022/05/04-03:33:21.189530 7f14b298eac0 Fast CRC32 supported: Not supported on x86 I think it is wrong. At least, CRC32 offloading SHOULD be enabled on all targets where it exists (I guess not only x86, but also AARCH64). Regarding compression - I would enable them all. Except, possibly, bzip2. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2081540

1 4

[Bug 2083013] New: python-shortuuid-1.0.9 is available
by bugzilla＠redhat.com 10 Nov '22

10 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2083013 Bug ID: 2083013 Summary: python-shortuuid-1.0.9 is available Product: Fedora Version: rawhide Status: NEW Component: python-shortuuid Keywords: FutureFeature, Triaged Assignee: michel(a)michel-slm.name Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, python-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 1.0.9 Current version/release in rawhide: 1.0.8-2.fc36 URL: https://github.com/stochastic-technologies/shortuuid/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/12823/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2083013

1 6

[Bug 2085998] New: python-utils-3.2.0 is available
by bugzilla＠redhat.com 21 Oct '22

21 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2085998 Bug ID: 2085998 Summary: python-utils-3.2.0 is available Product: Fedora Version: rawhide Status: NEW Component: python-utils Keywords: FutureFeature, Triaged Assignee: mhroncok(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, mhroncok(a)redhat.com, python-sig(a)lists.fedoraproject.org, thomas.andrejak(a)gmail.com Target Milestone: --- Classification: Fedora Latest upstream release: 3.2.0 Current version/release in rawhide: 3.1.0-1.fc37 URL: https://github.com/WoLpH/python-utils Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/12707/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2085998

1 20

[Bug 2095982] New: rocksdb-7.3.1 is available
by bugzilla＠redhat.com 17 Oct '22

17 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2095982 Bug ID: 2095982 Summary: rocksdb-7.3.1 is available Product: Fedora Version: rawhide Status: NEW Component: rocksdb Keywords: FutureFeature, Triaged Assignee: hegjon(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, hegjon(a)gmail.com, mmuzila(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 7.3.1 Upstream release that is considered latest: 7.3.1 Current version/release in rawhide: 7.2.2-3.fc37 URL: https://github.com/facebook/rocksdb Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/15560/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/rocksdb -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2095982

1 21

[Bug 2067022] New: ImageMagick: heap-buffer-overflow in PushShortPixel of quantum-private.h
by bugzilla＠redhat.com 07 Oct '22

07 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2067022 Bug ID: 2067022 Summary: ImageMagick: heap-buffer-overflow in PushShortPixel of quantum-private.h Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: trathi(a)redhat.com CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, jhorak(a)redhat.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Other A heap-buffer-overflow flaw was found in PushShortPixel function of quantum-private.h References: https://github.com/ImageMagick/ImageMagick/issues/4974 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2067022

1 10

[Bug 2099970] New: CVE-2022-2068 openssl3: openssl: the c_rehash script allows command injection [epel-8]
by bugzilla＠redhat.com 05 Oct '22

05 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2099970 Bug ID: 2099970 Summary: CVE-2022-2068 openssl3: openssl: the c_rehash script allows command injection [epel-8] Product: Fedora EPEL Version: epel8 Status: NEW Component: openssl3 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: michel(a)michel-slm.name Reporter: mrehak(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-8. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2099970

1 5

[Bug 2095814] New: CVE-2022-1292 openssl3: openssl: c_rehash script allows command injection [epel-8]
by bugzilla＠redhat.com 05 Oct '22

05 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2095814 Bug ID: 2095814 Summary: CVE-2022-1292 openssl3: openssl: c_rehash script allows command injection [epel-8] Product: Fedora EPEL Version: epel8 Status: NEW Component: openssl3 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: michel(a)michel-slm.name Reporter: mcascell(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-8. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2095814

1 5

[Bug 2089472] New: CVE-2022-1343 openssl3: openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS [epel-8]
by bugzilla＠redhat.com 05 Oct '22

05 Oct '22

https://bugzilla.redhat.com/show_bug.cgi?id=2089472 Bug ID: 2089472 Summary: CVE-2022-1343 openssl3: openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS [epel-8] Product: Fedora EPEL Version: epel8 Status: NEW Component: openssl3 Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: michel(a)michel-slm.name Reporter: tcullum(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-8. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2089472

1 6

[Bug 2088754] New: python-libtmux-0.12.0a0 is available
by bugzilla＠redhat.com 25 Sep '22

25 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2088754 Bug ID: 2088754 Summary: python-libtmux-0.12.0a0 is available Product: Fedora Version: rawhide Status: NEW Component: python-libtmux Keywords: FutureFeature, Triaged Assignee: mail(a)fabian-affolter.ch Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, mail(a)fabian-affolter.ch Target Milestone: --- Classification: Fedora Latest upstream release: 0.12.0a0 Current version/release in rawhide: 0.11.0-1.fc37 URL: https://pypi.python.org/pypi/libtmux Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/13040/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2088754

1 64

[Bug 2102019] New: CVE-2022-34299 libdwarf: heap buffer over-read in dwarf_global_formref_b() in dwarf_form.c
by bugzilla＠redhat.com 12 Aug '22

12 Aug '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102019 Bug ID: 2102019 Summary: CVE-2022-34299 libdwarf: heap buffer over-read in dwarf_global_formref_b() in dwarf_form.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: trathi(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, jitesh.1337(a)gmail.com, michel(a)michel-slm.name, orion(a)nwra.com, tom(a)compton.nu Target Milestone: --- Classification: Other There is a heap-based buffer over-read in libdwarf 0.4.0. This issue is related to dwarf_global_formref_b. https://github.com/davea42/libdwarf-code/issues/119 https://github.com/davea42/libdwarf-code/commit/7ef09e1fc9ba07653dd078edb24… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102019

1 9

[Bug 2095649] New: Error Install ImageMagick and Imagemagick-perl together on RH8 (EPEL8 repository)
by bugzilla＠redhat.com 25 Jul '22

25 Jul '22

https://bugzilla.redhat.com/show_bug.cgi?id=2095649 Bug ID: 2095649 Summary: Error Install ImageMagick and Imagemagick-perl together on RH8 (EPEL8 repository) Product: Fedora Version: rawhide Hardware: x86_64 OS: Linux Status: NEW Component: ImageMagick Assignee: luya_tfz(a)thefinalzone.net Reporter: bartlomiej(a)kida.info QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora Description of problem: ImageMagick and ImageMagick-perl on RH8 (EPEL 8 repository) Version-Release number of selected component (if applicable): Newest: 6.9.12.50-1.el8 How reproducible: Cannot install ImageMagick and ImageMagick-perl from EPEL repository - package conflict occurs. Steps to Reproduce: 1. Update EPEL8 cache repository 2. Probe install ImageMagick and ImageMagick-perl together Actual results: # dnf install ImageMagick ImageMagick-perl Ostatnio sprawdzono ważność metadanych: 1:49:26 temu w dniu Fri Jun 10 06:33:50 2022. Błąd: Problem: package ImageMagick-perl-6.9.12.50-1.el8.x86_64 requires perl(:MODULE_COMPAT_5.32.1), but none of the providers can be installed - package ImageMagick-perl-6.9.12.50-1.el8.x86_64 requires libperl.so.5.32()(64bit), but none of the providers can be installed - conflicting requests - package perl-libs-4:5.32.1-471.module_el8.6.0+2766+8bf0b7ce.x86_64 is filtered out by modular filtering Expected results: Installing both packages is correct Additional info: The error appears to have appeared after the latest ImageMagick update -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2095649

1 11

[Bug 2100830] New: [abrt] meld: _get_pixbuf(): emblemcellrenderer.py:64:_get_pixbuf:gi.repository.GLib.GError: gtk-icon-theme-error-quark: Ikonet “emblem-new” er ikke tilgængeligt i temaet Adwaita (0)
by bugzilla＠redhat.com 08 Jul '22

08 Jul '22

https://bugzilla.redhat.com/show_bug.cgi?id=2100830 Bug ID: 2100830 Summary: [abrt] meld: _get_pixbuf(): emblemcellrenderer.py:64:_get_pixbuf:gi.repository.GLi b.GError: gtk-icon-theme-error-quark: Ikonet “emblem-new” er ikke tilgængeligt i temaet Adwaita (0) Product: Fedora Version: 36 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:b16d3ab6af6101bd0bfe20b8f8186a6bf3a31350;VAR IANT_ID=workstation; Component: meld Assignee: dmaphy(a)fedoraproject.org Reporter: magnusmj(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: cwickert(a)fedoraproject.org, dmaphy(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, lkundrak(a)v3.sk, michel(a)michel-slm.name, oliver(a)linux-kernel.at Target Milestone: --- Classification: Fedora Description of problem: I was diffing a git file with its origin/main branch. The view didn't update correctly and only when hovering the mouse over each line in the view could i see its content. Version-Release number of selected component: meld-3.21.0-9.fc36 Additional info: reporter: libreport-2.17.1 cgroup: 0::/user.slice/user-1000.slice/user@1000.service/app.slice/app-gnome-org.gnome.Meld-36001.scope cmdline: /usr/bin/python3 /usr/bin/meld crash_function: _get_pixbuf exception_type: gi.repository.GLib.GError executable: /usr/bin/meld interpreter: python3-3.10.5-2.fc36.x86_64 kernel: 5.18.5-200.fc36.x86_64 runlevel: N 5 type: Python3 uid: 1000 Truncated backtrace: emblemcellrenderer.py:64:_get_pixbuf:gi.repository.GLib.GError: gtk-icon-theme-error-quark: Ikonet “emblem-new” er ikke tilgængeligt i temaet Adwaita (0) Traceback (most recent call last): File "/usr/lib/python3.10/site-packages/meld/ui/emblemcellrenderer.py", line 100, in do_render pixbuf = self._get_pixbuf(self.emblem_name, self._emblem_size) File "/usr/lib/python3.10/site-packages/meld/ui/emblemcellrenderer.py", line 64, in _get_pixbuf pixbuf = icon_theme.load_icon(name, size, 0).copy() gi.repository.GLib.GError: gtk-icon-theme-error-quark: Ikonet “emblem-new” er ikke tilgængeligt i temaet Adwaita (0) Local variables in innermost frame: self: <emblemcellrenderer.EmblemCellRenderer object at 0x7f3901c94cc0 (EmblemCellRenderer at 0x5560c54b7960)> name: 'emblem-new' size: 8 icon_theme: <Gtk.IconTheme object at 0x7f3901c7afc0 (GtkIconTheme at 0x5560c3e1aa60)> -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2100830

1 6

[Bug 2097805] New: [abrt] meld: _get_pixbuf(): emblemcellrenderer.py:64:_get_pixbuf:gi.repository.GLib.GError: gtk-icon-theme-error-quark: Icon 'emblem-new' not present in theme breeze-dark (0)
by bugzilla＠redhat.com 08 Jul '22

08 Jul '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097805 Bug ID: 2097805 Summary: [abrt] meld: _get_pixbuf(): emblemcellrenderer.py:64:_get_pixbuf:gi.repository.GLi b.GError: gtk-icon-theme-error-quark: Icon 'emblem-new' not present in theme breeze-dark (0) Product: Fedora Version: 36 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:6263b8a5fef4e03a93083a515f5dcc06754587dd;VAR IANT_ID=kde; Component: meld Assignee: dmaphy(a)fedoraproject.org Reporter: paulo.fidalgo.pt(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: cwickert(a)fedoraproject.org, dmaphy(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, lkundrak(a)v3.sk, michel(a)michel-slm.name, oliver(a)linux-kernel.at Target Milestone: --- Classification: Fedora Description of problem: I was invoking meld as a git difftool using `git difftool --dir-diff develop` and the git configuration for my system is [core] editor = vim attributesfile = ~/.gitattributes [diff] tool = meld [commit] gpgsign = true [fetch] prune = true [pull] rebase = true [push] default = current [diff "rspec"] xfuncname = "^[ \t]*((RSpec|describe|context|it|before|after|around|feature|scenario)[ \t].*)$" [diff "javascript"] xfuncname = "^[\t ]*(constructor|public|private|protected).*$" wordRegex = "^[\t ]*(const|let|var)[^()]*=[\t ]*\$[^()]*\$[\t ]*=>*$" Version-Release number of selected component: meld-3.21.0-9.fc36 Additional info: reporter: libreport-2.17.1 cgroup: 0::/user.slice/user-1000.slice/user@1000.service/app.slice/app-org.kde.konsole-a846c1b88b9f4d0d9c8e7efc6995e5d0.scope cmdline: /usr/bin/python3 /usr/bin/meld /tmp/git-difftool.fASuzC/left/ /tmp/git-difftool.fASuzC/right/ crash_function: _get_pixbuf exception_type: gi.repository.GLib.GError executable: /usr/bin/meld interpreter: python3-3.10.4-1.fc36.x86_64 kernel: 5.17.13-300.fc36.x86_64 runlevel: N 5 type: Python3 uid: 1000 Truncated backtrace: emblemcellrenderer.py:64:_get_pixbuf:gi.repository.GLib.GError: gtk-icon-theme-error-quark: Icon 'emblem-new' not present in theme breeze-dark (0) Traceback (most recent call last): File "/usr/lib/python3.10/site-packages/meld/ui/emblemcellrenderer.py", line 100, in do_render pixbuf = self._get_pixbuf(self.emblem_name, self._emblem_size) File "/usr/lib/python3.10/site-packages/meld/ui/emblemcellrenderer.py", line 64, in _get_pixbuf pixbuf = icon_theme.load_icon(name, size, 0).copy() gi.repository.GLib.GError: gtk-icon-theme-error-quark: Icon 'emblem-new' not present in theme breeze-dark (0) Local variables in innermost frame: self: <emblemcellrenderer.EmblemCellRenderer object at 0x7f63e9a62a40 (EmblemCellRenderer at 0x556559fcf680)> name: 'emblem-new' size: 8 icon_theme: <Gtk.IconTheme object at 0x7f63e839f240 (GtkIconTheme at 0x556559692410)> -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097805

1 6

[Bug 2087609] New: CVE-2022-30595 python-pillow: heap buffer overflow in crafted TGA file
by bugzilla＠redhat.com 01 Jul '22

01 Jul '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087609 Bug ID: 2087609 Summary: CVE-2022-30595 python-pillow: heap buffer overflow in crafted TGA file Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: saroy(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, python-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Other "CVE-2022-30595: When reading a TGA file with RLE packets that cross scan lines, Pillow reads the information past the end of the first line without deducting that from the length of the remaining file data. This vulnerability was introduced in Pillow 9.1.0, and can cause a heap buffer overflow." Introduced in 9.1.0, so only unstable is affected. Please bump to 9.1.1. https://bugs.gentoo.org/845192 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087609

1 11

[Bug 2102001] CVE-2022-33987 got: missing verification of requested URLs allows redirects to UNIX sockets
by bugzilla＠redhat.com 30 Jun '22

30 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102001 Anten Skrabec <askrabec(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2102899, 2102900, 2102897, | |2102901, 2102898 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102001

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 30 Jun '22

30 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 Bug 2097310 depends on bug 2099975, which changed state. Bug 2099975 Summary: CVE-2022-2068 openssl1.1: openssl: the c_rehash script allows command injection [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2099975 What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |CLOSED Resolution|--- |ERRATA -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2102268] New: python-breathe FTBFS with Sphinx 5 in Rawhide
by bugzilla＠redhat.com 30 Jun '22

30 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102268 Bug ID: 2102268 Summary: python-breathe FTBFS with Sphinx 5 in Rawhide Product: Fedora Version: rawhide Status: NEW Component: python-breathe Assignee: dan.cermak(a)cgc-instruments.com Reporter: ksurma(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dan.cermak(a)cgc-instruments.com, epel-packagers-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: python-breathe FTBFS with Sphinx 5, because it pins the supported version to < 5. This causes a build failure for at least 10 packages that BR python-breathe. Version-Release number of selected component (if applicable): 4.33.1-2 How reproducible: Always Steps to Reproduce: $ mock -r fedora-rawhide-x86_64 --addrepo=https://download.copr.fedorainfracloud.org/results/ksurma/sphinx-5/fedora-rawhide-x86_64/ --no-clean <your.src.rpm> $ mock -r fedora-rawhide-x86_64 --addrepo=https://download.copr.fedorainfracloud.org/results/ksurma/sphinx-5/fedora-rawhide-x86_64/ shell If you open a PR to dist-git, the build will be automatically triggered here: https://copr.fedorainfracloud.org/coprs/ksurma/sphinx-5/builds/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102268

1 3

[Bug 2102021] New: CVE-2022-34299 libdwarf: heap buffer over-read in dwarf_global_formref_b() in dwarf_form.c [fedora-all]
by bugzilla＠redhat.com 29 Jun '22

29 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102021 Bug ID: 2102021 Summary: CVE-2022-34299 libdwarf: heap buffer over-read in dwarf_global_formref_b() in dwarf_form.c [fedora-all] Product: Fedora Version: 36 Status: NEW Component: libdwarf Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: tom(a)compton.nu Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, jitesh.1337(a)gmail.com, michel(a)michel-slm.name, orion(a)nwra.com, tom(a)compton.nu Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102021

1 3

[Bug 2101117] New: libdwarf-0.4.1 is available
by bugzilla＠redhat.com 29 Jun '22

29 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2101117 Bug ID: 2101117 Summary: libdwarf-0.4.1 is available Product: Fedora Version: rawhide Status: NEW Component: libdwarf Keywords: FutureFeature, Triaged Assignee: tom(a)compton.nu Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, jitesh.1337(a)gmail.com, michel(a)michel-slm.name, orion(a)nwra.com, tom(a)compton.nu Target Milestone: --- Classification: Fedora Releases retrieved: 0.4.1 Upstream release that is considered latest: 0.4.1 Current version/release in rawhide: 0.4.0-1.fc37 URL: http://www.prevanders.net/dwarf.html Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1597/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/libdwarf -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2101117

1 3

[Bug 2102001] CVE-2022-33987 got: missing verification of requested URLs allows redirects to UNIX sockets
by bugzilla＠redhat.com 29 Jun '22

29 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102001 juneau(a)redhat.com changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2102193 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102001

1 0

[Bug 2102001] CVE-2022-33987 got: missing verification of requested URLs allows redirects to UNIX sockets
by bugzilla＠redhat.com 29 Jun '22

29 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102001 TEJ RATHI <trathi(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2099261 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102001

1 0

[Bug 2102001] CVE-2022-33987 got: missing verification of requested URLs allows redirects to UNIX sockets
by bugzilla＠redhat.com 29 Jun '22

29 Jun '22

1 0

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 28 Jun '22

28 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:5326 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 28 Jun '22

28 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 --- Comment #85 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5326 https://access.redhat.com/errata/RHSA-2022:5326 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2101268] New: [EPEL9] Please branch and build libappindicator-gtk3 in epel9
by bugzilla＠redhat.com 27 Jun '22

27 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2101268 Bug ID: 2101268 Summary: [EPEL9] Please branch and build libappindicator-gtk3 in epel9 Product: Fedora EPEL Version: epel9 Hardware: x86_64 OS: Linux Status: NEW Component: libappindicator Severity: low Assignee: oliver(a)redhat.com Reporter: zzongaone(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: dcavalca(a)fb.com, echevemaster(a)gmail.com, epel-packagers-sig(a)lists.fedoraproject.org, mailinglists(a)tpokorra.de, michel(a)michel-slm.name, ngompa13(a)gmail.com, oliver(a)redhat.com, philip.wyett(a)kathenas.org Target Milestone: --- Classification: Fedora libappindicator-gtk3 has been removed from RHEL/CentOS since RHEL9/CentOS Stream 9 and is blocking el9 branch of some tools like transmission. Please branch and build libappindicator-gtk3 in epel9. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2101268

1 2

[Bug 2092110] New: ImageMagick-6.9.12-51 is available
by bugzilla＠redhat.com 25 Jun '22

25 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2092110 Bug ID: 2092110 Summary: ImageMagick-6.9.12-51 is available Product: Fedora Version: rawhide Status: NEW Component: ImageMagick Keywords: FutureFeature, Triaged Assignee: luya_tfz(a)thefinalzone.net Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora Latest upstream release: 6.9.12-51 Current version/release in rawhide: 6.9.12.50-1.fc37 URL: https://legacy.imagemagick.org Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/16253/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2092110

1 13

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 25 Jun '22

25 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087913 Product Security DevOps Team <prodsec-dev(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG Last Closed| |2022-06-25 20:09:35 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087913

1 0

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 25 Jun '22

25 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087913 --- Comment #8 from Product Security DevOps Team <prodsec-dev(a)redhat.com> --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-1473 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087913

1 0

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 25 Jun '22

25 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087913 --- Comment #7 from Nick Tait <ntait(a)redhat.com> --- After extensive testing by hkario/ssorce (and probably others too) we've determined this flaw is not exploitable. I've set all product's to not affected and closed trackers. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087913

1 0

[Bug 2093361] New: CVE-2021-46790 ntfs-3g-system-compression: ntfs-3g: heap-based buffer overflow in ntfsck [fedora-all]
by bugzilla＠redhat.com 23 Jun '22

23 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093361 Bug ID: 2093361 Summary: CVE-2021-46790 ntfs-3g-system-compression: ntfs-3g: heap-based buffer overflow in ntfsck [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093361

1 8

[Bug 2093352] New: CVE-2022-30789 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array [fedora-all]
by bugzilla＠redhat.com 23 Jun '22

23 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093352 Bug ID: 2093352 Summary: CVE-2022-30789 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093352

1 8

[Bug 2093345] New: CVE-2022-30788 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc [fedora-all]
by bugzilla＠redhat.com 23 Jun '22

23 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093345 Bug ID: 2093345 Summary: CVE-2022-30788 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093345

1 8

[Bug 2093338] New: CVE-2022-30787 ntfs-3g-system-compression: ntfs-3g: integer underflow in fuse_lib_readdir enables arbitrary memory read operations [fedora-all]
by bugzilla＠redhat.com 23 Jun '22

23 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093338 Bug ID: 2093338 Summary: CVE-2022-30787 ntfs-3g-system-compression: ntfs-3g: integer underflow in fuse_lib_readdir enables arbitrary memory read operations [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093338

1 8

[Bug 2093331] New: CVE-2022-30786 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate [fedora-all]
by bugzilla＠redhat.com 23 Jun '22

23 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093331 Bug ID: 2093331 Summary: CVE-2022-30786 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093331

1 8

[Bug 2093325] New: CVE-2022-30785 ntfs-3g-system-compression: ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations [fedora-all]
by bugzilla＠redhat.com 23 Jun '22

23 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093325 Bug ID: 2093325 Summary: CVE-2022-30785 ntfs-3g-system-compression: ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093325

1 8

[Bug 2093319] New: CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [fedora-all]
by bugzilla＠redhat.com 23 Jun '22

23 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093319 Bug ID: 2093319 Summary: CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093319

1 8

[Bug 2093310] New: CVE-2022-30783 ntfs-3g-system-compression: ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic [fedora-all]
by bugzilla＠redhat.com 23 Jun '22

23 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093310 Bug ID: 2093310 Summary: CVE-2022-30783 ntfs-3g-system-compression: ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093310

1 8

[Bug 2097095] New: python-pillow fails to build with the latest setuptools version
by bugzilla＠redhat.com 23 Jun '22

23 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097095 Bug ID: 2097095 Summary: python-pillow fails to build with the latest setuptools version Product: Fedora Version: rawhide Status: NEW Component: python-pillow Assignee: manisandro(a)gmail.com Reporter: cstratak(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, python-sig(a)lists.fedoraproject.org Blocks: 2064842 Target Milestone: --- Classification: Fedora python-pillow fails to build with the latest setuptools version. This report is automated and not very verbose, but we'll try to get back here with details. For the build logs, see: https://copr-be.cloud.fedoraproject.org/results/cstratak/setuptools-62.4.0-… For all our attempts to build python-pillow with the latest setuptools, see: https://copr.fedorainfracloud.org/coprs/cstratak/setuptools-62.4.0-final/pa… Testing and rebuild of packages is happening in copr. You can follow these instructions to test locally in mock if your package builds with latest setuptools version: https://copr.fedorainfracloud.org/coprs/cstratak/setuptools-62.4.0-final/ Let us know here if you have any questions. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2064842 [Bug 2064842] python-setuptools-62.4.0 is available -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097095

1 3

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 Mauro Matteo Cascella <mcascell(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(mcascell(a)redhat.c | |om) | -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 --- Comment #13 from Mauro Matteo Cascella <mcascell(a)redhat.com> --- Follow-up commit: https://github.com/openssl/openssl/commit/8a3579a7b7067a983e69a4eda839ac408… [OpenSSL 3.0.4] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 juneau(a)redhat.com changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2100097, 2100098 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2069709] New: python-stack-data fails to build with Python 3.11: executing.executing.NotOneValueFound: Expected one value, found 0
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2069709 Bug ID: 2069709 Summary: python-stack-data fails to build with Python 3.11: executing.executing.NotOneValueFound: Expected one value, found 0 Product: Fedora Version: rawhide Status: NEW Component: python-stack-data Assignee: lbalhar(a)redhat.com Reporter: thrnciar(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, lbalhar(a)redhat.com, mhroncok(a)redhat.com, michel(a)michel-slm.name, thrnciar(a)redhat.com Blocks: 2016048 (PYTHON3.11) Target Milestone: --- Classification: Fedora python-stack-data fails to build with Python 3.11.0a6. =================================== FAILURES =================================== _________________________________ test_example _________________________________ def test_example(): from .samples.example import bar > result = bar() tests/test_core.py:573: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ tests/samples/example.py:27: in bar exec("result = foo()", globals(), names) <string>:1: in <module> ??? tests/samples/example.py:20: in foo result = print_stack( tests/samples/example.py:35: in print_stack for frame_info in list(FrameInfo.stack_data(frame, options))[-3:]: /usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__ return self.send(None) /usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send value = self.__wrapped.send(obj) stack_data/core.py:565: in stack_data yield from collapse_repeated( stack_data/utils.py:84: in collapse_repeated yield from map(mapper, original_group) stack_data/core.py:555: in mapper return cls(f, options) /usr/lib/python3.11/site-packages/typeguard/__init__.py:1033: in wrapper retval = func(*args, **kwargs) stack_data/core.py:520: in __init__ self.executing = Source.executing(frame_or_tb) /usr/lib/python3.11/site-packages/executing/executing.py:335: in executing node = find_node(lasti) /usr/lib/python3.11/site-packages/executing/executing.py:321: in find_node return only( _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ it = <generator object Source.executing.<locals>.find_node.<locals>.<genexpr> at 0x7f8a614b36a0> def only(it): if hasattr(it, '__len__'): if len(it) != 1: raise NotOneValueFound('Expected one value, found %s' % len(it)) # noinspection PyTypeChecker return list(it)[0] lst = tuple(islice(it, 2)) if len(lst) == 0: > raise NotOneValueFound('Expected one value, found 0') E executing.executing.NotOneValueFound: Expected one value, found 0 /usr/lib/python3.11/site-packages/executing/executing.py:164: NotOneValueFound ____________________________ test_pygments_example _____________________________ def test_pygments_example(): from .samples.pygments_example import bar > result = bar() tests/test_core.py:618: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ tests/samples/pygments_example.py:17: in bar @deco tests/samples/pygments_example.py:26: in deco f.result = print_stack() tests/samples/pygments_example.py:43: in print_stack for frame_info in list(FrameInfo.stack_data(frame, options))[-2:]: /usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__ return self.send(None) /usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send value = self.__wrapped.send(obj) stack_data/core.py:565: in stack_data yield from collapse_repeated( stack_data/utils.py:84: in collapse_repeated yield from map(mapper, original_group) stack_data/core.py:555: in mapper return cls(f, options) /usr/lib/python3.11/site-packages/typeguard/__init__.py:1033: in wrapper retval = func(*args, **kwargs) stack_data/core.py:520: in __init__ self.executing = Source.executing(frame_or_tb) /usr/lib/python3.11/site-packages/executing/executing.py:354: in executing opname(index - 2) == "PRECALL_FUNCTION" _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ i = 44 def opname(i): > return bc_list[i // 2].opname E IndexError: list index out of range /usr/lib/python3.11/site-packages/executing/executing.py:346: IndexError _________________________________ test_example _________________________________ n = 0 def foo(n=5): if n > 0: return foo(n - 1) x = 1 lst = ( [ x, ] + [] + [] + [] + [] + [] ) try: > return int(str(lst)) E ValueError: invalid literal for int() with base 10: '[1]' tests/samples/formatter_example.py:21: ValueError During handling of the above exception, another exception occurred: n = 0 def foo(n=5): if n > 0: return foo(n - 1) x = 1 lst = ( [ x, ] + [] + [] + [] + [] + [] ) try: return int(str(lst)) except: try: > return 1 / 0 E ZeroDivisionError: division by zero tests/samples/formatter_example.py:24: ZeroDivisionError The above exception was the direct cause of the following exception: capsys = <_pytest.capture.CaptureFixture object at 0x7f8a618fc490> def test_example(capsys): from .samples.formatter_example import bar, print_stack1, format_stack1, format_frame, f_string @contextmanager def check_example(name): yield stderr = capsys.readouterr().err compare_to_file(stderr, name) with check_example("variables"): try: > bar() tests/test_formatter.py:40: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ def bar(): > exec("foo()") tests/samples/formatter_example.py:30: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ > ??? <string>:1: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ n = 5 def foo(n=5): if n > 0: > return foo(n - 1) tests/samples/formatter_example.py:8: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ n = 4 def foo(n=5): if n > 0: > return foo(n - 1) tests/samples/formatter_example.py:8: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ n = 3 def foo(n=5): if n > 0: > return foo(n - 1) tests/samples/formatter_example.py:8: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ n = 2 def foo(n=5): if n > 0: > return foo(n - 1) tests/samples/formatter_example.py:8: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ n = 1 def foo(n=5): if n > 0: > return foo(n - 1) tests/samples/formatter_example.py:8: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ n = 0 def foo(n=5): if n > 0: return foo(n - 1) x = 1 lst = ( [ x, ] + [] + [] + [] + [] + [] ) try: return int(str(lst)) except: try: return 1 / 0 except Exception as e: > raise TypeError from e E TypeError tests/samples/formatter_example.py:26: TypeError During handling of the above exception, another exception occurred: capsys = <_pytest.capture.CaptureFixture object at 0x7f8a618fc490> def test_example(capsys): from .samples.formatter_example import bar, print_stack1, format_stack1, format_frame, f_string @contextmanager def check_example(name): yield stderr = capsys.readouterr().err compare_to_file(stderr, name) with check_example("variables"): try: bar() except Exception: > MyFormatter(show_variables=True).print_exception() tests/test_formatter.py:42: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ stack_data/formatting.py:72: in print_exception self.print_lines(self.format_exception(e), file=file) stack_data/formatting.py:83: in print_lines for line in lines: /usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__ return self.send(None) /usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send value = self.__wrapped.send(obj) stack_data/formatting.py:100: in format_exception yield from self.format_stack(e.__traceback__) /usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__ return self.send(None) /usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send value = self.__wrapped.send(obj) stack_data/formatting.py:107: in format_stack yield from self.format_stack_data( /usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__ return self.send(None) /usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send value = self.__wrapped.send(obj) stack_data/formatting.py:118: in format_stack_data for item in stack: /usr/lib/python3.11/site-packages/typeguard/__init__.py:897: in __next__ return self.send(None) /usr/lib/python3.11/site-packages/typeguard/__init__.py:915: in send value = self.__wrapped.send(obj) stack_data/core.py:565: in stack_data yield from collapse_repeated( stack_data/utils.py:84: in collapse_repeated yield from map(mapper, original_group) stack_data/core.py:555: in mapper return cls(f, options) /usr/lib/python3.11/site-packages/typeguard/__init__.py:1033: in wrapper retval = func(*args, **kwargs) stack_data/core.py:520: in __init__ self.executing = Source.executing(frame_or_tb) /usr/lib/python3.11/site-packages/executing/executing.py:335: in executing node = find_node(lasti) /usr/lib/python3.11/site-packages/executing/executing.py:321: in find_node return only( _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ it = <generator object Source.executing.<locals>.find_node.<locals>.<genexpr> at 0x7f8a5ef609a0> def only(it): if hasattr(it, '__len__'): if len(it) != 1: raise NotOneValueFound('Expected one value, found %s' % len(it)) # noinspection PyTypeChecker return list(it)[0] lst = tuple(islice(it, 2)) if len(lst) == 0: > raise NotOneValueFound('Expected one value, found 0') E executing.executing.NotOneValueFound: Expected one value, found 0 /usr/lib/python3.11/site-packages/executing/executing.py:164: NotOneValueFound ----------------------------- Captured stderr call ----------------------------- Traceback (most recent call last): File "formatter_example.py", line 21, in foo 9 | x = 1 10 | lst = ( 11 | [ 12 | x, (...) 18 | + [] 19 | ) 20 | try: --> 21 | return int(str(lst)) ^^^^^^^^^^^^^ 22 | except: [ x, ] = [1] [ x, ] + [] = [1] [ x, ] + [] + [] = [1] [ x, ] + [] + [] + [] = [1] [ x, ] + [] + [] + [] + [] = [1] [ x, ] + [] + [] + [] + [] + [] = [1] lst = [1] n = 0 n - 1 = -1 n > 0 = False str(lst) = '[1]' x = 1 ValueError: invalid literal for int() with base 10: '[1]' During handling of the above exception, another exception occurred: Traceback (most recent call last): File "formatter_example.py", line 24, in foo 21 | return int(str(lst)) 22 | except: 23 | try: --> 24 | return 1 / 0 ^^^^^ 25 | except Exception as e: [ x, ] = [1] [ x, ] + [] = [1] [ x, ] + [] + [] = [1] [ x, ] + [] + [] + [] = [1] [ x, ] + [] + [] + [] + [] = [1] [ x, ] + [] + [] + [] + [] + [] = [1] lst = [1] n = 0 n - 1 = -1 n > 0 = False str(lst) = '[1]' x = 1 ZeroDivisionError: division by zero The above exception was the direct cause of the following exception: Traceback (most recent call last): File "formatter_example.py", line 30, in bar 29 | def bar(): --> 30 | exec("foo()") ^^^^^^^^^^^^^ =============================== warnings summary =============================== ../../../../usr/lib64/python3.11/site-packages/pyximport/pyximport.py:51 /usr/lib64/python3.11/site-packages/pyximport/pyximport.py:51: DeprecationWarning: the imp module is deprecated in favour of importlib and slated for removal in Python 3.12; see the module's documentation for alternative uses import imp -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html =========================== short test summary info ============================ FAILED tests/test_core.py::test_example - executing.executing.NotOneValueFoun... FAILED tests/test_core.py::test_pygments_example - IndexError: list index out... FAILED tests/test_formatter.py::test_example - executing.executing.NotOneValu... =================== 3 failed, 13 passed, 1 warning in 3.03s ==================== ERROR: InvocationError for command /usr/bin/pytest (exited with code 1) ___________________________________ summary ____________________________________ ERROR: py311: commands failed https://docs.python.org/3.11/whatsnew/3.11.html For the build logs, see: https://copr-be.cloud.fedoraproject.org/results/@python/python3.11/fedora-r… For all our attempts to build python-stack-data with Python 3.11, see: https://copr.fedorainfracloud.org/coprs/g/python/python3.11/package/python-… Testing and mass rebuild of packages is happening in copr. You can follow these instructions to test locally in mock if your package builds with Python 3.11: https://copr.fedorainfracloud.org/coprs/g/python/python3.11/ Let us know here if you have any questions. Python 3.11 is planned to be included in Fedora 37. To make that update smoother, we're building Fedora packages with all pre-releases of Python 3.11. A build failure prevents us from testing all dependent packages (transitive [Build]Requires), so if this package is required a lot, it's important for us to get it fixed soon. We'd appreciate help from the people who know this package best, but if you don't want to work on this now, let us know so we can try to work around it on our side. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2016048 [Bug 2016048] Python 3.11 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2069709

1 9

[Bug 2094398] New: F37FailsToInstall: perl-thrift
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2094398 Bug ID: 2094398 Summary: F37FailsToInstall: perl-thrift Product: Fedora Version: rawhide Status: NEW Component: thrift Assignee: ctubbsii(a)fedoraproject.org Reporter: mhroncok(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: ctubbsii(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, milleruntime(a)gmail.com, orion(a)nwra.com, willb(a)redhat.com Blocks: 2045109 (F37FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically. If you feel that this output has mistakes, please contact me via email (mhroncok(a)redhat.com) Your package (thrift) Fails To Install in Fedora 37: can't install perl-thrift: - nothing provides perl(:MODULE_COMPAT_5.34.0) needed by perl-thrift-0.14.0-6.fc36.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. To reproduce, use the koji/local repo only, e.g. in mock: $ mock -r fedora-37-x86_64 --disablerepo='*' --enablerepo=local install perl-thrift P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2045109 [Bug 2045109] Fedora 37 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2094398

1 6

[Bug 2068421] New: python-executing fails to build with Python 3.11: InvocationError: self.get_executing(inspect.currentframe().f_back)
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2068421 Bug ID: 2068421 Summary: python-executing fails to build with Python 3.11: InvocationError: self.get_executing(inspect.currentframe().f_back) Product: Fedora Version: rawhide Status: NEW Component: python-executing Assignee: rominf(a)aiven.io Reporter: thrnciar(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, lbalhar(a)redhat.com, mhroncok(a)redhat.com, paul.wouters(a)aiven.io, rominf(a)aiven.io, thrnciar(a)redhat.com Blocks: 2016048 (PYTHON3.11) Target Milestone: --- Link ID: Github alexmojaki/executing/pull/31 Classification: Fedora python-executing fails to build with Python 3.11.0a6. + /usr/bin/python3 -m tox --current-env -q --recreate -e py311 Traceback (most recent call last): File "/builddir/build/BUILDROOT/python-executing-0.8.2-2.fc37.x86_64/usr/lib/python3.11/site-packages/executing/executing.py", line 317, in executing args = executing_cache[key] ~~~~~~~~~~~~~~~^^^^^ KeyError: (<code object <module> at 0x7fb5361790d0, file "/builddir/build/BUILD/executing-0.8.2/tests/test_main.py", line 1>, 140416273322192, 552) During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/builddir/build/BUILD/executing-0.8.2/tests/test_main.py", line 682, in <module> assert tester([1, 2, 3]) == [1, 2, 3] ^^^^^^^^^^^^^^^^^ File "/builddir/build/BUILD/executing-0.8.2/tests/utils.py", line 40, in __call__ ex = self.get_executing(inspect.currentframe().f_back) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/builddir/build/BUILD/executing-0.8.2/tests/utils.py", line 28, in get_executing return Source.executing(frame) ^^^^^^^^^^^^^^^^^^^^^^^ File "/builddir/build/BUILDROOT/python-executing-0.8.2-2.fc37.x86_64/usr/lib/python3.11/site-packages/executing/executing.py", line 372, in executing args = find(source=cls.for_frame(frame), retry_cache=True) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/builddir/build/BUILDROOT/python-executing-0.8.2-2.fc37.x86_64/usr/lib/python3.11/site-packages/executing/executing.py", line 349, in find node_finder = NodeFinder(frame, stmts, tree, lasti) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/builddir/build/BUILDROOT/python-executing-0.8.2-2.fc37.x86_64/usr/lib/python3.11/site-packages/executing/executing.py", line 626, in __init__ raise RuntimeError(op_name) ^^^^^^^^^^^^^^^^^^^^^^^^^^^ RuntimeError: CALL ERROR: InvocationError for command /builddir/build/BUILD/executing-0.8.2/.tox/py311/bin/python tests/test_main.py (exited with code 1) ___________________________________ summary ____________________________________ ERROR: py311: commands failed error: Bad exit status from /var/tmp/rpm-tmp.m2JoFZ (%check) Bad exit status from /var/tmp/rpm-tmp.m2JoFZ (%check) Upstream has WIP PR for Python 3.11 suport. The PyFrameObject structure member has been moved to the internal C API headers. While the documentation notes that the PyFrameObject fields are subject to change at any time, they have been stable for a long time and were used in several popular extensions. In Python 3.11, the frame struct was reorganized to allow performance optimizations. Some fields were removed entirely, as they were details of the old implementation. PyFrameObject fields: f_back: use PyFrame_GetBack(). f_blockstack: removed. f_builtins: use PyObject_GetAttrString((PyObject*)frame, "f_builtins"). f_code: use PyFrame_GetCode(). f_gen: removed. f_globals: use PyObject_GetAttrString((PyObject*)frame, "f_globals"). f_iblock: removed. f_lasti: use PyObject_GetAttrString((PyObject*)frame, "f_lasti"). Code using f_lasti with PyCode_Addr2Line() must use PyFrame_GetLineNumber() instead. f_lineno: use PyFrame_GetLineNumber() f_locals: use PyObject_GetAttrString((PyObject*)frame, "f_locals"). f_stackdepth: removed. f_state: no public API (renamed to f_frame.f_state). f_trace: no public API. f_trace_lines: use PyObject_GetAttrString((PyObject*)frame, "f_trace_lines") (it also be modified). f_trace_opcodes: use PyObject_GetAttrString((PyObject*)frame, "f_trace_opcodes") (it also be modified). f_localsplus: no public API (renamed to f_frame.localsplus). f_valuestack: removed. The Python frame object is now created lazily. A side effect is that the f_back member must not be accessed directly, since its value is now also computed lazily. The PyFrame_GetBack() function must be called instead. https://docs.python.org/3.11/whatsnew/3.11.html For the build logs, see: https://copr-be.cloud.fedoraproject.org/results/@python/python3.11/fedora-r… For all our attempts to build python-executing with Python 3.11, see: https://copr.fedorainfracloud.org/coprs/g/python/python3.11/package/python-… Testing and mass rebuild of packages is happening in copr. You can follow these instructions to test locally in mock if your package builds with Python 3.11: https://copr.fedorainfracloud.org/coprs/g/python/python3.11/ Let us know here if you have any questions. Python 3.11 is planned to be included in Fedora 37. To make that update smoother, we're building Fedora packages with all pre-releases of Python 3.11. A build failure prevents us from testing all dependent packages (transitive [Build]Requires), so if this package is required a lot, it's important for us to get it fixed soon. We'd appreciate help from the people who know this package best, but if you don't want to work on this now, let us know so we can try to work around it on our side. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2016048 [Bug 2016048] Python 3.11 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2068421

1 5

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 Dmitry Belyavskiy <dbelyavs(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mcascell(a)redhat.com Flags| |needinfo?(mcascell(a)redhat.c | |om) -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 Mauro Matteo Cascella <mcascell(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Comment|0 |updated --- Comment #0 has been edited --- When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 --- Comment #10 from Mauro Matteo Cascella <mcascell(a)redhat.com> --- OpenSSL Security Advisory: https://www.openssl.org/news/secadv/20220621.txt Upstream commits: https://github.com/openssl/openssl/commit/2c9c35870601b4a44d86ddbf512b38df3… [OpenSSL 3.0.4] https://github.com/openssl/openssl/commit/9639817dac8bbbaa64d09efad7464ccc4… [OpenSSL 1.1.1p] https://github.com/openssl/openssl/commit/7a9c027159fe9e1bbc2cd38a8a2914bff… [OpenSSL 1.0.2zf] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 Marian Rehak <mrehak(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(mrehak(a)redhat.com | |) | --- Comment #9 from Marian Rehak <mrehak(a)redhat.com> --- Created edk2 tracking bugs for this issue: Affects: fedora-all [bug 2099974] Created mingw-openssl tracking bugs for this issue: Affects: fedora-all [bug 2099971] Created openssl tracking bugs for this issue: Affects: fedora-all [bug 2099972] Created openssl1.1 tracking bugs for this issue: Affects: fedora-all [bug 2099975] Created openssl11 tracking bugs for this issue: Affects: epel-7 [bug 2099969] Created openssl3 tracking bugs for this issue: Affects: epel-8 [bug 2099970] Created shim tracking bugs for this issue: Affects: fedora-all [bug 2099973] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 Marian Rehak <mrehak(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(mrehak(a)redhat.com | |) | -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097310 Marian Rehak <mrehak(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2099971, 2099974, 2099973, | |2099972, 2099975, 2099969, | |2099970 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2099969 [Bug 2099969] CVE-2022-2068 openssl11: openssl: the c_rehash script allows command injection [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=2099970 [Bug 2099970] CVE-2022-2068 openssl3: openssl: the c_rehash script allows command injection [epel-8] https://bugzilla.redhat.com/show_bug.cgi?id=2099971 [Bug 2099971] CVE-2022-2068 mingw-openssl: openssl: the c_rehash script allows command injection [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2099972 [Bug 2099972] CVE-2022-2068 openssl: the c_rehash script allows command injection [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2099973 [Bug 2099973] CVE-2022-2068 shim: openssl: the c_rehash script allows command injection [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2099974 [Bug 2099974] CVE-2022-2068 edk2: openssl: the c_rehash script allows command injection [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2099975 [Bug 2099975] CVE-2022-2068 openssl1.1: openssl: the c_rehash script allows command injection [fedora-all] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097310

1 0

[Bug 2097310] CVE-2022-2068 openssl: the c_rehash script allows command injection
by bugzilla＠redhat.com 22 Jun '22

22 Jun '22

1 0

[Bug 2098889] New: F37FailsToInstall: python3-django-q
by bugzilla＠redhat.com 20 Jun '22

20 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2098889 Bug ID: 2098889 Summary: F37FailsToInstall: python3-django-q Product: Fedora Version: rawhide Status: NEW Component: python-django-q Assignee: michel(a)michel-slm.name Reporter: mhroncok(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name, ngompa13(a)gmail.com, python-sig(a)lists.fedoraproject.org Blocks: 2045109 (F37FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically. If you feel that this output has mistakes, please contact me via email (mhroncok(a)redhat.com) Your package (python-django-q) Fails To Install in Fedora 37: can't install python3-django-q: - nothing provides python(abi) = 3.10 needed by python3-django-q-1.3.9-3.fc36.noarch - nothing provides python3.10dist(django) >= 2.2 needed by python3-django-q-1.3.9-3.fc36.noarch - nothing provides (python3.10dist(blessed) < 2~~ with python3.10dist(blessed) >= 1.17.6) needed by python3-django-q-1.3.9-3.fc36.noarch - nothing provides (python3.10dist(django-picklefield) < 4~~ with python3.10dist(django-picklefield) >= 3.0.1) needed by python3-django-q-1.3.9-3.fc36.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. To reproduce, use the koji/local repo only, e.g. in mock: $ mock -r fedora-37-x86_64 --disablerepo='*' --enablerepo=local install python3-django-q P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2045109 [Bug 2045109] Fedora 37 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2098889

1 1

[Bug 2091812] New: ImageMagick: outside the range of representable values of type 'unsigned long' at coders/pcl.c
by bugzilla＠redhat.com 16 Jun '22

16 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2091812 Bug ID: 2091812 Summary: ImageMagick: outside the range of representable values of type 'unsigned long' at coders/pcl.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: trathi(a)redhat.com CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Other In ImageMagick version < 7.1.0-29, there is an outside the range of representable values of type 'unsigned long' at coders/pcl.c. References: https://github.com/ImageMagick/ImageMagick/issues/4985 https://github.com/ImageMagick/ImageMagick/pull/4986 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2091812

1 12

[Bug 2095122] New: CVE-2022-32546 ImageMagick: outside the range of representable values of type 'unsigned long' at coders/pcl.c [fedora-all]
by bugzilla＠redhat.com 16 Jun '22

16 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2095122 Bug ID: 2095122 Summary: CVE-2022-32546 ImageMagick: outside the range of representable values of type 'unsigned long' at coders/pcl.c [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ImageMagick Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: luya_tfz(a)thefinalzone.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2095122

1 3

[Bug 2095123] New: CVE-2022-32546 ImageMagick: outside the range of representable values of type 'unsigned long' at coders/pcl.c [epel-all]
by bugzilla＠redhat.com 16 Jun '22

16 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2095123 Bug ID: 2095123 Summary: CVE-2022-32546 ImageMagick: outside the range of representable values of type 'unsigned long' at coders/pcl.c [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ImageMagick Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: luya_tfz(a)thefinalzone.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2095123

1 3

[Bug 2091811] New: ImageMagick: outside the range of representable values of type 'unsigned char' at coders/psd.c
by bugzilla＠redhat.com 16 Jun '22

16 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2091811 Bug ID: 2091811 Summary: ImageMagick: outside the range of representable values of type 'unsigned char' at coders/psd.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: trathi(a)redhat.com CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Other In ImageMagick version < 7.1.0-28, there is an outside the range of representable values of type 'unsigned char' at coders/psd.c. References: https://github.com/ImageMagick/ImageMagick/issues/4962 https://github.com/ImageMagick/ImageMagick/pull/4963 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2091811

1 12

[Bug 2096516] New: CVE-2022-32545 ImageMagick: outside the range of representable values of type 'unsigned char' at coders/psd.c [epel-all]
by bugzilla＠redhat.com 16 Jun '22

16 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2096516 Bug ID: 2096516 Summary: CVE-2022-32545 ImageMagick: outside the range of representable values of type 'unsigned char' at coders/psd.c [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ImageMagick Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: luya_tfz(a)thefinalzone.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2096516

1 3

[Bug 2096515] New: CVE-2022-32545 ImageMagick: outside the range of representable values of type 'unsigned char' at coders/psd.c [fedora-all]
by bugzilla＠redhat.com 16 Jun '22

16 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2096515 Bug ID: 2096515 Summary: CVE-2022-32545 ImageMagick: outside the range of representable values of type 'unsigned char' at coders/psd.c [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ImageMagick Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: luya_tfz(a)thefinalzone.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2096515

1 3

[Bug 2091813] New: ImageMagick: load of misaligned address at MagickCore/property.c
by bugzilla＠redhat.com 16 Jun '22

16 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2091813 Bug ID: 2091813 Summary: ImageMagick: load of misaligned address at MagickCore/property.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: trathi(a)redhat.com CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Other In ImageMagick version < 7.1.0-30, there are runtime errors: * load of misaligned address 0x62300000714d for type 'double', which requires 8 byte alignment * load of misaligned address 0x62300000710b for type 'float', which requires 4 byte alignment References: https://github.com/ImageMagick/ImageMagick/issues/5033 https://github.com/ImageMagick/ImageMagick/pull/5034 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2091813

1 12

[Bug 2097361] New: python-stack-data-0.3.0 is available
by bugzilla＠redhat.com 16 Jun '22

16 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2097361 Bug ID: 2097361 Summary: python-stack-data-0.3.0 is available Product: Fedora Version: rawhide Status: NEW Component: python-stack-data Keywords: FutureFeature, Triaged Assignee: lbalhar(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, lbalhar(a)redhat.com, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora Releases retrieved: 0.3.0 Upstream release that is considered latest: 0.3.0 Current version/release in rawhide: 0.2.0-2.fc37 URL: https://pypi.org/project/stack-data/0.0.7 Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/90020/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/python-stack-data -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097361

1 2

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 14 Jun '22

14 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 Derrick Ornelas <dornelas(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(dornelas(a)redhat.c | |om) | -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 14 Jun '22

14 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087913 Todd Cullum <tcullum(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(tcullum(a)redhat.co | |m) | -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087913

1 0

[Bug 2089474] New: CVE-2022-1473 openssl3: openssl: OPENSSL_LH_flush() breaks reuse of memory [epel-8]
by bugzilla＠redhat.com 14 Jun '22

14 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2089474 Bug ID: 2089474 Summary: CVE-2022-1473 openssl3: openssl: OPENSSL_LH_flush() breaks reuse of memory [epel-8] Product: Fedora EPEL Version: epel8 Status: NEW Component: openssl3 Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: michel(a)michel-slm.name Reporter: tcullum(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-8. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2089474

1 3

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 14 Jun '22

14 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087913 Todd Cullum <tcullum(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|high |medium Priority|high |medium -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087913

1 0

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 14 Jun '22

14 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087913 Patrick Del Bello <pdelbell(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tcullum(a)redhat.com Flags|needinfo?(pdelbell(a)redhat.c |needinfo?(tcullum(a)redhat.co |om) |m) -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087913

1 0

[Bug 2080868] New: python-typing-extensions fails to build with Python 3.11: AttributeError: <module 'typing' from '/usr/lib64/python3.11/typing.py'> does not have the attribute '_overload_registry'
by bugzilla＠redhat.com 13 Jun '22

13 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2080868 Bug ID: 2080868 Summary: python-typing-extensions fails to build with Python 3.11: AttributeError: <module 'typing' from '/usr/lib64/python3.11/typing.py'> does not have the attribute '_overload_registry' Product: Fedora Version: rawhide Status: NEW Component: python-typing-extensions Assignee: hegjon(a)gmail.com Reporter: thrnciar(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, hegjon(a)gmail.com, mail(a)fabian-affolter.ch, mhroncok(a)redhat.com, michel(a)michel-slm.name, thrnciar(a)redhat.com Blocks: 2016048 (PYTHON3.11) Target Milestone: --- Classification: Fedora python-typing-extensions fails to build with Python 3.11.0a7. =================================== FAILURES =================================== _____________________ OverloadTests.test_overload_registry _____________________ /usr/lib64/python3.11/unittest/mock.py:1356: in patched with self.decoration_helper(patched, /usr/lib64/python3.11/contextlib.py:137: in __enter__ return next(self.gen) /usr/lib64/python3.11/unittest/mock.py:1338: in decoration_helper arg = exit_stack.enter_context(patching) /usr/lib64/python3.11/contextlib.py:499: in enter_context result = _enter(cm) /usr/lib64/python3.11/unittest/mock.py:1427: in __enter__ original, local = self.get_original() _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = <unittest.mock._patch object at 0x7fb2d2b3a490> def get_original(self): target = self.getter() name = self.attribute original = DEFAULT local = False try: original = target.__dict__[name] except (AttributeError, KeyError): original = getattr(target, name, DEFAULT) else: local = True if name in _builtins and isinstance(target, ModuleType): self.create = True if not self.create and original is DEFAULT: > raise AttributeError( "%s does not have the attribute %r" % (target, name) ) E AttributeError: <module 'typing' from '/usr/lib64/python3.11/typing.py'> does not have the attribute '_overload_registry' /usr/lib64/python3.11/unittest/mock.py:1400: AttributeError =========================== short test summary info ============================ FAILED src/test_typing_extensions.py::OverloadTests::test_overload_registry =================== 1 failed, 224 passed, 1 skipped in 0.44s =================== https://docs.python.org/3.11/whatsnew/3.11.html For the build logs, see: https://copr-be.cloud.fedoraproject.org/results/@python/python3.11/fedora-r… For all our attempts to build python-typing-extensions with Python 3.11, see: https://copr.fedorainfracloud.org/coprs/g/python/python3.11/package/python-… Testing and mass rebuild of packages is happening in copr. You can follow these instructions to test locally in mock if your package builds with Python 3.11: https://copr.fedorainfracloud.org/coprs/g/python/python3.11/ Let us know here if you have any questions. Python 3.11 is planned to be included in Fedora 37. To make that update smoother, we're building Fedora packages with all pre-releases of Python 3.11. A build failure prevents us from testing all dependent packages (transitive [Build]Requires), so if this package is required a lot, it's important for us to get it fixed soon. We'd appreciate help from the people who know this package best, but if you don't want to work on this now, let us know so we can try to work around it on our side. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2016048 [Bug 2016048] Python 3.11 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2080868

1 3

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 11 Jun '22

11 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 Product Security DevOps Team <prodsec-dev(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(security-response |needinfo?(mcascell(a)redhat.c |-team(a)redhat.com) |om) -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 11 Jun '22

11 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 Asmita <agawand(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(security-response | |-team(a)redhat.com) -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 09 Jun '22

09 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087913 Hubert Kario <hkario(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(pdelbell(a)redhat.c | |om) CC| |hkario(a)redhat.com -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087913

1 0

[Bug 2095116] New: CVE-2022-32547 ImageMagick: load of misaligned address at MagickCore/property.c [fedora-all]
by bugzilla＠redhat.com 09 Jun '22

09 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2095116 Bug ID: 2095116 Summary: CVE-2022-32547 ImageMagick: load of misaligned address at MagickCore/property.c [fedora-all] Product: Fedora Version: 36 Status: NEW Component: ImageMagick Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: luya_tfz(a)thefinalzone.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2095116

1 3

[Bug 2095117] New: CVE-2022-32547 ImageMagick: load of misaligned address at MagickCore/property.c [epel-all]
by bugzilla＠redhat.com 09 Jun '22

09 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2095117 Bug ID: 2095117 Summary: CVE-2022-32547 ImageMagick: load of misaligned address at MagickCore/property.c [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ImageMagick Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: luya_tfz(a)thefinalzone.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2095117

1 3

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 08 Jun '22

08 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:4956 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 08 Jun '22

08 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 --- Comment #80 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 Via RHSA-2022:4956 https://access.redhat.com/errata/RHSA-2022:4956 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2087046] New: ImageMagick-6.9.12-49 is available
by bugzilla＠redhat.com 08 Jun '22

08 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087046 Bug ID: 2087046 Summary: ImageMagick-6.9.12-49 is available Product: Fedora Version: rawhide Status: NEW Component: ImageMagick Keywords: FutureFeature, Triaged Assignee: luya_tfz(a)thefinalzone.net Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, dcavalca(a)fb.com, epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)famillecollet.com, luya_tfz(a)thefinalzone.net, michel(a)michel-slm.name, ngompa13(a)gmail.com, pampelmuse(a)gmx.at, sergio(a)serjux.com, troy(a)troycurtisjr.com Target Milestone: --- Classification: Fedora Latest upstream release: 6.9.12-49 Current version/release in rawhide: 6.9.12.48-2.fc37 URL: https://legacy.imagemagick.org Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/16253/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087046

1 18

[Bug 2089282] New: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service [fedora-34]
by bugzilla＠redhat.com 07 Jun '22

07 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2089282 Bug ID: 2089282 Summary: CVE-2022-30065 busybox: A use-after-free in Busybox's awk applet leads to denial of service [fedora-34] Product: Fedora Version: 34 Status: NEW Component: busybox Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: spotrh(a)gmail.com Reporter: saroy(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: admiller(a)redhat.com, dcavalca(a)fb.com, dvlasenk(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, spotrh(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-34. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2089282

1 3

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 07 Jun '22

07 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 Mauro Matteo Cascella <mcascell(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(mcascell(a)redhat.c | |om) | -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2082387] CVE-2022-29167 hawk: REDoS in hawk.utils.parseHost() when parsing Host header
by bugzilla＠redhat.com 04 Jun '22

04 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2082387 Bug 2082387 depends on bug 2082463, which changed state. Bug 2082463 Summary: CVE-2022-29167 seamonkey: hawk: REDoS in hawk.utils.parseHost() when parsing Host header [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2082463 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |INSUFFICIENT_DATA -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2082387

1 0

[Bug 2082387] CVE-2022-29167 hawk: REDoS in hawk.utils.parseHost() when parsing Host header
by bugzilla＠redhat.com 04 Jun '22

04 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2082387 Bug 2082387 depends on bug 2082456, which changed state. Bug 2082456 Summary: CVE-2022-29167 seamonkey: hawk: REDoS in hawk.utils.parseHost() when parsing Host header [epel-8] https://bugzilla.redhat.com/show_bug.cgi?id=2082456 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |INSUFFICIENT_DATA -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2082387

1 0

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:4899 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 --- Comment #76 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:4899 https://access.redhat.com/errata/RHSA-2022:4899 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2093363] New: CVE-2021-46790 ntfs-3g-system-compression: ntfs-3g: heap-based buffer overflow in ntfsck [epel-all]
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093363 Bug ID: 2093363 Summary: CVE-2021-46790 ntfs-3g-system-compression: ntfs-3g: heap-based buffer overflow in ntfsck [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093363

1 2

[Bug 2093353] New: CVE-2022-30789 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array [epel-all]
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093353 Bug ID: 2093353 Summary: CVE-2022-30789 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093353

1 2

[Bug 2093343] New: CVE-2022-30788 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc [epel-all]
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093343 Bug ID: 2093343 Summary: CVE-2022-30788 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093343

1 2

[Bug 2093336] New: CVE-2022-30787 ntfs-3g-system-compression: ntfs-3g: integer underflow in fuse_lib_readdir enables arbitrary memory read operations [epel-all]
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093336 Bug ID: 2093336 Summary: CVE-2022-30787 ntfs-3g-system-compression: ntfs-3g: integer underflow in fuse_lib_readdir enables arbitrary memory read operations [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093336

1 2

[Bug 2093327] New: CVE-2022-30786 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate [epel-all]
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093327 Bug ID: 2093327 Summary: CVE-2022-30786 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093327

1 1

[Bug 2093323] New: CVE-2022-30785 ntfs-3g-system-compression: ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations [epel-all]
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093323 Bug ID: 2093323 Summary: CVE-2022-30785 ntfs-3g-system-compression: ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093323

1 2

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:4896 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 --- Comment #75 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Via RHSA-2022:4896 https://access.redhat.com/errata/RHSA-2022:4896 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2093315] New: CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [epel-all]
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093315 Bug ID: 2093315 Summary: CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093315

1 2

[Bug 2093308] New: CVE-2022-30783 ntfs-3g-system-compression: ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic [epel-all]
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2093308 Bug ID: 2093308 Summary: CVE-2022-30783 ntfs-3g-system-compression: ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093308

1 2

[Bug 2084311] New: F37FailsToInstall: heaptrack
by bugzilla＠redhat.com 03 Jun '22

03 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2084311 Bug ID: 2084311 Summary: F37FailsToInstall: heaptrack Product: Fedora Version: rawhide Status: NEW Component: heaptrack Assignee: jgrulich(a)redhat.com Reporter: mhroncok(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, jgrulich(a)redhat.com, kde-sig(a)lists.fedoraproject.org Blocks: 2045109 (F37FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically. If you feel that this output has mistakes, please contact me via email (mhroncok(a)redhat.com) Your package (heaptrack) Fails To Install in Fedora 37: can't install heaptrack: - nothing provides libboost_program_options.so.1.76.0()(64bit) needed by heaptrack-1.2.0-6.fc35.x86_64 - nothing provides libboost_iostreams.so.1.76.0()(64bit) needed by heaptrack-1.2.0-6.fc35.x86_64 If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. To reproduce, use the koji/local repo only, e.g. in mock: $ mock -r fedora-37-x86_64 --disablerepo='*' --enablerepo=local install heaptrack P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2045109 [Bug 2045109] Fedora 37 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2084311

1 4

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 02 Jun '22

02 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 Kaushal Sathe <ksathe(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(dornelas(a)redhat.c | |om) | |needinfo?(mcascell(a)redhat.c | |om) -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2091308] New: ipython-8.4.0 is available
by bugzilla＠redhat.com 01 Jun '22

01 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2091308 Bug ID: 2091308 Summary: ipython-8.4.0 is available Product: Fedora Version: rawhide Status: NEW Component: ipython Keywords: FutureFeature, Triaged Assignee: lbalhar(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dcantrell(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, lbalhar(a)redhat.com, mhroncok(a)redhat.com, michel(a)michel-slm.name, mrunge(a)redhat.com, orion(a)nwra.com, python-sig(a)lists.fedoraproject.org, tomspur(a)fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 8.4.0 Current version/release in rawhide: 8.3.0-1.fc37 URL: https://ipython.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1399/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2091308

1 4

2025

2024

2023

2022

2021

Epel-packagers-sig June 2022