The following Fedora EPEL 9 Security updates need testing:
Age URL
6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-4894f0196b
trafficserver-9.2.11-1.el9
6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-6c475f1e10
perl-CryptX-0.087-2.el9
6 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-bb27e120f9
clamav-1.0.9-1.el9
The following builds have been pushed to Fedora EPEL 9 updates-testing
guacamole-server-1.6.0-1.el9
python-collectd_puppet-2.0.0-18.el9
python-reportlab-4.4.1-2.el9
yarnpkg-1.22.22-9.el9
Details about builds:
================================================================================
guacamole-server-1.6.0-1.el9 (FEDORA-EPEL-2025-a680e4b9b7)
Server-side native components that form the Guacamole proxy
--------------------------------------------------------------------------------
Update Information:
Apache Guacamole 1.6.0
User interface / platform
Add the ability to specify separate permissions for âHistoryâ and âActive
sessionsâ tabs (GUACAMOLE-538)
Support batch import of connections from CSV (GUACAMOLE-926)
Add parameter token for connection name (GUACAMOLE-1177)
Provide audit log for system modifications (GUACAMOLE-1224)
Configurable username case sensitivity (GUACAMOLE-1239)
Provide chunked file upload mechanism (GUACAMOLE-1320)
Display whether user groups are disabled in group list (GUACAMOLE-1479)
Support for true fullscreen mode and keyboard lock (GUACAMOLE-1525)
Allow branding/customization of the section headers on the user home page
(GUACAMOLE-1584)
Add support for specifying VNC âencodingsâ parameter in webapp UI
(GUACAMOLE-1642)
Automatically clear view if session expires in background (GUACAMOLE-1744)
Base64 encoding of image/binary data results in excessive syscalls that can
degrade performance (GUACAMOLE-1776)
Update session recording playback progress during large frame gaps
(GUACAMOLE-1803)
Enable viewing / searching of key events in session recording playback
(GUACAMOLE-1820)
Improvements to the âRecent connectionsâ section (GUACAMOLE-1866)
History Recording Player should indicate points of interest (GUACAMOLE-1876)
Enhance client custom field functionality (GUACAMOLE-1904)
Provide notification, jump-to-top of page for a clone operation (GUACAMOLE-1916)
Bug: Logging of request details fails with recent Tomcat (GUACAMOLE-2052)
Authentication, integration, and storage
Ensure GUAC_DATE/GUAC_TIME tokens match connection startDate (GUACAMOLE-61)
Add Proxy Hostname and Port to LDAP Extension (GUACAMOLE-577)
Add webapp support for smart card authentication (GUACAMOLE-839)
Enforce rate limit on authentication attempts (GUACAMOLE-990)
Broadly configurable time limits for user logins and connection usage
(GUACAMOLE-1020)
Randomize generation of TOTP key until enrollment is confirmed (GUACAMOLE-1068)
Allow TOTP to be disabled by group membership (GUACAMOLE-1219)
Update guacamole-auth-duo to âDuo Web v4 SDKâ (GUACAMOLE-1289)
SAML module should be able to encrypt and sign requests (GUACAMOLE-1372)
Allow LDAP extension to configure TLS level (GUACAMOLE-1488)
Clarify TOTP reset/status logic (GUACAMOLE-1550)
Allow JDBC Auth Extensions to track history for external connections
(GUACAMOLE-1616)
Allow extraction of âdomainâ token from vault extensions (GUACAMOLE-1623)
Enable more granular vault associations (GUACAMOLE-1629)
Allow use of KSM one-time tokens in guacamole-vault-ksm extension
(GUACAMOLE-1643)
Allow per-user KSM Vault configurations (GUACAMOLE-1656)
KSM vault extension should allow searching records by domain (GUACAMOLE-1661)
Allow user to configure Keeper Secrets Manager call frequency (GUACAMOLE-1722)
Enforce user access windows even when already logged in (GUACAMOLE-1723)
Add SSO providers list to UI at most once (GUACAMOLE-1757)
Allow TOTP and SAML auth to be used together (GUACAMOLE-1780)
Bug: KSM Vault extension doesnât support private key from âPAM Userâ
record type
(GUACAMOLE-1795)
Map JWT claims from OpenID Connect as parameter tokens (GUACAMOLE-1844)
Allow MFA to be bypassed or enforced based on client IP (GUACAMOLE-1855)
Add parameter token for domain of LDAP user (GUACAMOLE-1881)
Disable autofill on TOTP verification code field (GUACAMOLE-1946)
Provide a comprehensive error message for input exceeding database column
(GUACAMOLE-1948)
Protocol support / guacd
Allow selection of whole words by double-clicking (GUACAMOLE-192)
Improve efficiency of streaming complex/large changes (Graphics Pipeline
Extension, RemoteFX) (GUACAMOLE-377)
Allow specifying connection timeout (GUACAMOLE-600)
Add support for FreeRDP 3.0.0 (GUACAMOLE-1026)
Bug: Connecting to unpublished RemoteApp results in black screen
(GUACAMOLE-1084)
Bug: Add support for right modifier keys to SSH/Telnet (GUACAMOLE-1113)
Add auto resize to VNC sessions (GUACAMOLE-1196)
RemoteApp windows become inaccessible after being minimized (GUACAMOLE-1231)
Bug: Lines of file gets broken when navigating back and forth using a text
editor (GUACAMOLE-1256)
Add option to the vnc protocol to disable remote input (GUACAMOLE-1267)
Add support for SSH certificates (GUACAMOLE-1290)
Add parameter for specifying known RDP server certificate/fingerprint
(GUACAMOLE-1332)
Bug: âAltGrâ received as âAltâ if remote keyboard layout lacks
âAltGrâ
(GUACAMOLE-1473)
Bug: Terminal emulator adds newlines when copying a wrapped line of text
(GUACAMOLE-1586)
Add small margins to SSH sessions (GUACAMOLE-1622)
Bug: Text copied from terminal emulator may incorrectly omit indentation
(GUACAMOLE-1632)
Add terminal support for alternate screen buffer (GUACAMOLE-1633)
Bug: SFTP+VNC broken when built with OpenSSL versions >= 1.1.0 (GUACAMOLE-1652)
Clipboard normalization support for SSH connections (GUACAMOLE-1682)
Test machine availability when sending Wake-on-LAN packet (GUACAMOLE-1686)
Bug: Japanese characters display garbled in terminal when using guacd docker
image (GUACAMOLE-1726)
Add parameters for VNC compression and quality levels (GUACAMOLE-1760)
Terminal protocols should support mac-style cmd+v paste shortcut
(GUACAMOLE-1804)
Ignore Ctrl+Shift+C within terminal emulator (GUACAMOLE-1805)
Allow writing recordings to existing files (GUACAMOLE-1931)
Bug: RDP connection fails when microphone input is enabled (GUACAMOLE-1940)
Bug: Selected text in SSH is offset from cursor position (GUACAMOLE-1944)
Bug: Multiple wheel events per mouse wheel tick (GUACAMOLE-1967)
Bug: FreeRDP may invoke EndPaint without BeginPaint as of 3.8.0 (GUACAMOLE-1997)
Internationalization
Bug: Japanese keyboard layout for RDP incorrect (GUACAMOLE-520)
Add support for Canadian french keyboard layout (GUACAMOLE-1312)
Update French translations (GUACAMOLE-1611)
Fix some typos in italian translation and improve it (GUACAMOLE-1612)
Updated czech translation (GUACAMOLE-1664)
Updated german translation (GUACAMOLE-1692)
Add Czech keyboard layout (GUACAMOLE-1708)
Polish translation (GUACAMOLE-1730)
Updated czech translation (GUACAMOLE-1758)
Add Romanian keymap to RDP protocol (GUACAMOLE-1770)
Add Portuguese keymap to RDP protocol (GUACAMOLE-1771)
Update the Simplified Chinese translation (GUACAMOLE-1778)
Update the Simplified Chinese translation for totp auth extension
(GUACAMOLE-1781)
Updated czech translation (GUACAMOLE-1792)
Bug: Mac Firefox repeats composed characters (GUACAMOLE-1810)
Documentation
Add missing WEBAPP_CONTEXT variable in docker setup documentation
(GUACAMOLE-1680)
Document RemoteIPValve to cover IPv4 and IPv6 (GUACAMOLE-1861)
General housekeeping and cleanup
Provide GuacamoleProperty List Implementations (GUACAMOLE-1006)
Expose client state enum values (GUACAMOLE-1402)
Guacamole manual: Makefile: find uses non-POSIX arguments (GUACAMOLE-1501)
Bug: Phantomjs build issues on ubuntu 22.04 (GUACAMOLE-1614)
Remove usage of AccessController (GUACAMOLE-1716)
Bug: Correct autoconf issues that result in odd build results (GUACAMOLE-1719)
Stop storing unnecessary auth response data in local storage (GUACAMOLE-1721)
Bug: Projects outside scope of 1.5.0 fail to build following merge of version
number bump (GUACAMOLE-1731)
Bug: Projects outside scope of 1.5.1 fail to build following merge of version
number bump (GUACAMOLE-1767)
Bug: SQLSERVER_BATCH_SIZE defined twice in SQLServerGuacamoleProperties
(GUACAMOLE-1789)
Bug: Projects outside scope of 1.5.2 fail to build following merge of version
number bump (GUACAMOLE-1790)
Bug: Projects outside scope of 1.5.3 fail to build following merge of version
number bump (GUACAMOLE-1829)
Bug: Merge conflict markers left in guacamole-manual source (GUACAMOLE-1833)
KSM Vault extension should support new PAM Hostname field type (GUACAMOLE-1868)
Align libraries on âLibrary statusâ output (GUACAMOLE-1869)
Check return values of WebP API functions (GUACAMOLE-1875)
Bug: Projects outside scope of 1.5.4 fail to build following merge of version
number bump (GUACAMOLE-1887)
Bump versions for projects outside the 1.5.5 scope (GUACAMOLE-1915)
Add support for FFmpeg 7.0 (GUACAMOLE-1952)
Update dependencies to latest stable and compatible versions (GUACAMOLE-1956)
Bump versions to 1.6.0 (GUACAMOLE-1980)
Bug: Compile error in src/protocols/rdp/channels/rail.c (GUACAMOLE-1982)
Upgrade KSM SDK to latest (v16.6.5) (GUACAMOLE-1984)
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jun 24 2025 Robert Scheck <rob...@fedoraproject.org> - 1.6.0-1
- Update to 1.6.0 (#2363860, thanks to W. Michael Petullo)
- Add upstream patch for src/libguac/wol.c to fix inet_pton being
called with a destination buffer size too small (GUACAMOLE-2087)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2363860 - guacamole-server-1.6.0-RC1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2363860
--------------------------------------------------------------------------------
================================================================================
python-collectd_puppet-2.0.0-18.el9 (FEDORA-EPEL-2025-65f12ac446)
Collectd plugin to monitor puppet agents
--------------------------------------------------------------------------------
Update Information:
Automatic update for python-collectd_puppet-2.0.0-18.el9.
Changelog for python-collectd_puppet
* Tue Jun 24 2025 Steve Traylen <steve.tray...@cern.ch> - 2.0.0-18
- Switch to source from github
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jun 24 2025 Steve Traylen <steve.tray...@cern.ch> - 2.0.0-18
- Switch to source from github
--------------------------------------------------------------------------------
================================================================================
python-reportlab-4.4.1-2.el9 (FEDORA-EPEL-2025-ebed33873a)
Library for generating PDFs and graphics
--------------------------------------------------------------------------------
Update Information:
New EPEL packages
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jun 3 2025 Python Maint <python-ma...@redhat.com> - 4.4.1-2
- Rebuilt for Python 3.14
* Thu May 15 2025 Antonio Trande <sagit...@fedoraproject.org> - 4.4.1-1
- Release 4.4.1 (rhbz#2366456)
* Tue Apr 22 2025 Antonio Trande <sagit...@fedoraproject.org> - 4.4.0-1
- Release 4.4.0
* Fri Feb 14 2025 Antonio Trande <sagit...@fedoraproject.org> - 4.3.1-1
- Release 4.3.1
* Tue Feb 4 2025 Antonio Trande <sagit...@fedoraproject.org> - 4.3.0-1
- Release 4.3.0 (rhbz#2343518)
* Sat Jan 18 2025 Fedora Release Engineering <rel...@fedoraproject.org> -
4.2.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Thu Oct 3 2024 Antonio Trande <sagit...@fedoraproject.org> - 4.2.5-1
- Release 4.2.5
* Sun Sep 29 2024 Antonio Trande <sagit...@fedoraproject.org> - 4.2.4-1
- Release 4.2.4
* Fri Jul 19 2024 Fedora Release Engineering <rel...@fedoraproject.org> -
4.2.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Sun Jun 30 2024 Antonio Trande <sagit...@fedoraproject.org> - 4.2.2-1
- Release 4.2.2 (rhbz#2294198)
* Sat Jun 8 2024 Python Maint <python-ma...@redhat.com> - 4.2.0-2
- Rebuilt for Python 3.13
* Fri Apr 19 2024 Antonio Trande <sagit...@fedoraproject.org> - 4.2.0-1
- Release 4.2.0
* Sat Feb 24 2024 Antonio Trande <sagit...@fedoraproject.org> - 4.1.0-2
- Rebuild for f41 mass rebuild
* Tue Feb 13 2024 Antonio Trande <sagit...@fedoraproject.org> - 4.1.0-1
- Release 4.1.0
* Fri Jan 26 2024 Fedora Release Engineering <rel...@fedoraproject.org> -
4.0.9-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Mon Jan 22 2024 Fedora Release Engineering <rel...@fedoraproject.org> -
4.0.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Tue Jan 16 2024 Antonio Trande <sagit...@fedoraproject.org> - 4.0.9-1
- Release 4.0.9
* Thu Dec 14 2023 Antonio Trande <sagit...@fedoraproject.org> - 4.0.8-2
- Add missing BR package
* Thu Dec 14 2023 Antonio Trande <sagit...@fedoraproject.org> - 4.0.8-1
- Release 4.0.8
* Sat Nov 11 2023 Antonio Trande <sagit...@fedoraproject.org> - 4.0.7-1
- Release 4.0.7
* Fri Oct 13 2023 Antonio Trande <sagit...@fedoraproject.org> - 4.0.6-1
- Release 4.0.6
* Tue Sep 26 2023 Antonio Trande <sagit...@fedoraproject.org> - 4.0.5-1
- Release 4.0.5
* Fri Jul 21 2023 Fedora Release Engineering <rel...@fedoraproject.org> -
4.0.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Fri Jun 16 2023 Python Maint <python-ma...@redhat.com> - 4.0.4-2
- Rebuilt for Python 3.12
* Thu Jun 15 2023 Antonio Trande <sagit...@fedoraproject.org> - 4.0.4-1
- Release 4.0.4
--------------------------------------------------------------------------------
================================================================================
yarnpkg-1.22.22-9.el9 (FEDORA-EPEL-2025-7168a5211b)
Fast, reliable, and secure dependency management.
--------------------------------------------------------------------------------
Update Information:
Update bundled pbkdf2 library.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jun 24 2025 Sandro Mani <manisan...@gmail.com> - 1.22.22-9
- Add CVE-2025-6545_6547.prebundle.patch and regenerate bundle. Fixes
CVE-2025-6545 and CVE-2025-6547.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2374429 - CVE-2025-6547 yarnpkg: pbkdf2 silently returns static
keys [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2374429
[ 2 ] Bug #2374433 - CVE-2025-6545 yarnpkg: pbkdf2 silently returns
predictable key material [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2374433
[ 3 ] Bug #2374438 - CVE-2025-6547 yarnpkg: pbkdf2 silently returns static
keys [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2374438
[ 4 ] Bug #2374443 - CVE-2025-6545 yarnpkg: pbkdf2 silently returns
predictable key material [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2374443
[ 5 ] Bug #2374450 - CVE-2025-6547 yarnpkg: pbkdf2 silently returns static
keys [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2374450
[ 6 ] Bug #2374455 - CVE-2025-6545 yarnpkg: pbkdf2 silently returns
predictable key material [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2374455
[ 7 ] Bug #2374462 - CVE-2025-6547 yarnpkg: pbkdf2 silently returns static
keys [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2374462
[ 8 ] Bug #2374465 - CVE-2025-6545 yarnpkg: pbkdf2 silently returns
predictable key material [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2374465
--------------------------------------------------------------------------------
--
_______________________________________________
epel-devel mailing list -- epel-devel@lists.fedoraproject.org
To unsubscribe send an email to epel-devel-le...@lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/epel-devel@lists.fedoraproject.org
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
