The following Fedora EPEL 7 Security updates need testing:
Age URL
2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-07403ba3a8
chromium-125.0.6422.60-3.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
cacti-1.2.27-1.el7
cacti-spine-1.2.27-1.el7
copr-cli-1.112-1.el7
python-copr-1.132-1.el7
Details about builds:
================================================================================
cacti-1.2.27-1.el7 (FEDORA-EPEL-2024-d0445178a9)
An rrd based graphing tool
--------------------------------------------------------------------------------
Update Information:
Update cacti and cacti-spine to version 1.2.27. This includes the upstream fixes
for many CVEs, including a critical remote code execution bug.
https://github.com/Cacti/cacti/blob/release/1.2.27/CHANGELOG
https://github.com/Cacti/spine/blob/release/1.2.27/CHANGELOG
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 21 2024 Carl George <carlwgeo...@fedoraproject.org> - 1.2.27-1
- Update to version 1.2.27
- CVE-2024-25641, CVE-2024-29894, CVE-2024-31443, CVE-2024-31444,
CVE-2024-31445, CVE-2024-31458, CVE-2024-31459, CVE-2024-31460, CVE-2024-34340
* Tue May 21 2024 Carl George <carlwgeo...@fedoraproject.org> - 1.2.26-1
- Update to version 1.2.26
- CVE-2023-49084, CVE-2023-49085, CVE-2023-49086, CVE-2023-49088,
CVE-2023-50250, CVE-2023-51448
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2255603 - CVE-2023-49084 cacti: RCE when managing links [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2255603
[ 2 ] Bug #2255607 - CVE-2023-49086 cacti: XSS when adding new devices
[epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2255607
[ 3 ] Bug #2255668 - CVE-2023-49085 CVE-2023-49088 CVE-2023-50250
CVE-2023-51448 cacti: Multiple vulnerabilities [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2255668
[ 4 ] Bug #2280481 - CVE-2024-34340 cacti: authentication bypass when using
older password hashes [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280481
[ 5 ] Bug #2280496 - CVE-2024-29894 cacti: XSS vulnerability when using
JavaScript based messaging API [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280496
[ 6 ] Bug #2280499 - CVE-2024-31458 CVE-2024-31459 CVE-2024-31460 cacti:
multiple vulnerabilities [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280499
[ 7 ] Bug #2280502 - CVE-2024-31443 CVE-2024-31444 CVE-2024-31445 cacti:
multiple vulnerabilties [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280502
[ 8 ] Bug #2280505 - CVE-2024-25641 cacti: remote code execution
vulnerability [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280505
--------------------------------------------------------------------------------
================================================================================
cacti-spine-1.2.27-1.el7 (FEDORA-EPEL-2024-d0445178a9)
Threaded poller for Cacti written in C
--------------------------------------------------------------------------------
Update Information:
Update cacti and cacti-spine to version 1.2.27. This includes the upstream fixes
for many CVEs, including a critical remote code execution bug.
https://github.com/Cacti/cacti/blob/release/1.2.27/CHANGELOG
https://github.com/Cacti/spine/blob/release/1.2.27/CHANGELOG
--------------------------------------------------------------------------------
ChangeLog:
* Wed May 22 2024 Carl George <carlwgeo...@fedoraproject.org> - 1.2.27-1
- Update to version 1.2.27
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2255603 - CVE-2023-49084 cacti: RCE when managing links [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2255603
[ 2 ] Bug #2255607 - CVE-2023-49086 cacti: XSS when adding new devices
[epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2255607
[ 3 ] Bug #2255668 - CVE-2023-49085 CVE-2023-49088 CVE-2023-50250
CVE-2023-51448 cacti: Multiple vulnerabilities [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2255668
[ 4 ] Bug #2280481 - CVE-2024-34340 cacti: authentication bypass when using
older password hashes [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280481
[ 5 ] Bug #2280496 - CVE-2024-29894 cacti: XSS vulnerability when using
JavaScript based messaging API [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280496
[ 6 ] Bug #2280499 - CVE-2024-31458 CVE-2024-31459 CVE-2024-31460 cacti:
multiple vulnerabilities [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280499
[ 7 ] Bug #2280502 - CVE-2024-31443 CVE-2024-31444 CVE-2024-31445 cacti:
multiple vulnerabilties [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280502
[ 8 ] Bug #2280505 - CVE-2024-25641 cacti: remote code execution
vulnerability [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2280505
--------------------------------------------------------------------------------
================================================================================
copr-cli-1.112-1.el7 (FEDORA-EPEL-2024-473133d592)
Command line interface for COPR
--------------------------------------------------------------------------------
Update Information:
https://docs.pagure.org/copr.copr/release-notes/2024-05-22.html
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 21 2024 Jakub Kadlcik <fros...@email.cz> 1.112-1
- Add per package timeout option
- Remove dependency on simplejson
--------------------------------------------------------------------------------
================================================================================
python-copr-1.132-1.el7 (FEDORA-EPEL-2024-473133d592)
Python interface for Copr
--------------------------------------------------------------------------------
Update Information:
https://docs.pagure.org/copr.copr/release-notes/2024-05-22.html
--------------------------------------------------------------------------------
ChangeLog:
* Tue May 21 2024 Jakub Kadlcik <fros...@email.cz> 1.132-1
- Discourage from deleting objects while paginating over them
- Suggest pagination only when a GET request timeouts
--------------------------------------------------------------------------------
--
_______________________________________________
epel-devel mailing list -- epel-devel@lists.fedoraproject.org
To unsubscribe send an email to epel-devel-le...@lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/epel-devel@lists.fedoraproject.org
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
