The following Fedora EPEL 7 Security updates need testing:
Age URL
13 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-93d78fa1a6
perl-Net-CIDR-Lite-0.22-1.el7
10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-f08dc6b4c1
gnuchess-6.2.7-5.el7
10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-3f9b6786f4
clamav-0.103.2-1.el7
10 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-13ed778e19
singularity-3.7.3-1.el7
8 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-9daa9fc0b1
seamonkey-2.53.7-3.el7
4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-fe3075d537
wordpress-5.1.9-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
libjwt-1.12.1-7.el7
rust-1.51.0-3.el7
Details about builds:
================================================================================
libjwt-1.12.1-7.el7 (FEDORA-EPEL-2021-b8c4714317)
A Javascript Web Token library in C
--------------------------------------------------------------------------------
Update Information:
Same version, 1.12.1, but removed example programs ---- Add libjwt to EPEL7
--------------------------------------------------------------------------------
ChangeLog:
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1940198 - Request to add libjwt to epel7
https://bugzilla.redhat.com/show_bug.cgi?id=1940198
--------------------------------------------------------------------------------
================================================================================
rust-1.51.0-3.el7 (FEDORA-EPEL-2021-044df87bd4)
The Rust Programming Language
--------------------------------------------------------------------------------
Update Information:
Security fixes for CVE-2020-36323, CVE-2021-28876, CVE-2021-28878,
CVE-2021-28879, and CVE-2021-31162. These are memory safety bugs in the Rust
standard library. Because it is statically linked, affected applications will
need to be rebuilt to benefit from the fixes. The actual security implications
will depend on how these APIs are used in each particular case.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Apr 16 2021 Josh Stone <jist...@redhat.com> - 1.51.0-3
- Security fixes for CVE-2020-36323, CVE-2021-31162
* Wed Apr 14 2021 Josh Stone <jist...@redhat.com> - 1.51.0-2
- Security fixes for CVE-2021-28876, CVE-2021-28878, CVE-2021-28879
- Fix bootstrap for stage0 rust 1.51
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1949198 - CVE-2021-28876 rust: panic safety issue in Zip
implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1949198
[ 2 ] Bug #1949207 - CVE-2021-28878 rust: memory safety violation in Zip
implementation when next_back() and next() are used together
https://bugzilla.redhat.com/show_bug.cgi?id=1949207
[ 3 ] Bug #1949211 - CVE-2021-28879 rust: integer overflow in the Zip
implementation can lead to a buffer overflow
https://bugzilla.redhat.com/show_bug.cgi?id=1949211
[ 4 ] Bug #1950396 - CVE-2020-36323 rust: optimization for joining strings
can cause uninitialized bytes to be exposed
https://bugzilla.redhat.com/show_bug.cgi?id=1950396
[ 5 ] Bug #1950398 - CVE-2021-31162 rust: double free in Vec::from_iter
function if freeing the element panics
https://bugzilla.redhat.com/show_bug.cgi?id=1950398
--------------------------------------------------------------------------------
_______________________________________________
epel-devel mailing list -- epel-devel@lists.fedoraproject.org
To unsubscribe send an email to epel-devel-le...@lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/epel-devel@lists.fedoraproject.org
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
