The following Fedora EPEL 7 Security updates need testing: Age URL 2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-07403ba3a8 chromium-125.0.6422.60-3.el7 The following builds have been pushed to Fedora EPEL 7 updates-testing cacti-1.2.27-1.el7 cacti-spine-1.2.27-1.el7 copr-cli-1.112-1.el7 python-copr-1.132-1.el7 Details about builds: ================================================================================ cacti-1.2.27-1.el7 (FEDORA-EPEL-2024-d0445178a9) An rrd based graphing tool -------------------------------------------------------------------------------- Update Information: Update cacti and cacti-spine to version 1.2.27. This includes the upstream fixes for many CVEs, including a critical remote code execution bug. https://github.com/Cacti/cacti/blob/release/1.2.27/CHANGELOG https://github.com/Cacti/spine/blob/release/1.2.27/CHANGELOG -------------------------------------------------------------------------------- ChangeLog: * Tue May 21 2024 Carl George <carlwgeorge@xxxxxxxxxxxxxxxxx> - 1.2.27-1 - Update to version 1.2.27 - CVE-2024-25641, CVE-2024-29894, CVE-2024-31443, CVE-2024-31444, CVE-2024-31445, CVE-2024-31458, CVE-2024-31459, CVE-2024-31460, CVE-2024-34340 * Tue May 21 2024 Carl George <carlwgeorge@xxxxxxxxxxxxxxxxx> - 1.2.26-1 - Update to version 1.2.26 - CVE-2023-49084, CVE-2023-49085, CVE-2023-49086, CVE-2023-49088, CVE-2023-50250, CVE-2023-51448 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2255603 - CVE-2023-49084 cacti: RCE when managing links [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2255603 [ 2 ] Bug #2255607 - CVE-2023-49086 cacti: XSS when adding new devices [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2255607 [ 3 ] Bug #2255668 - CVE-2023-49085 CVE-2023-49088 CVE-2023-50250 CVE-2023-51448 cacti: Multiple vulnerabilities [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2255668 [ 4 ] Bug #2280481 - CVE-2024-34340 cacti: authentication bypass when using older password hashes [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280481 [ 5 ] Bug #2280496 - CVE-2024-29894 cacti: XSS vulnerability when using JavaScript based messaging API [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280496 [ 6 ] Bug #2280499 - CVE-2024-31458 CVE-2024-31459 CVE-2024-31460 cacti: multiple vulnerabilities [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280499 [ 7 ] Bug #2280502 - CVE-2024-31443 CVE-2024-31444 CVE-2024-31445 cacti: multiple vulnerabilties [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280502 [ 8 ] Bug #2280505 - CVE-2024-25641 cacti: remote code execution vulnerability [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280505 -------------------------------------------------------------------------------- ================================================================================ cacti-spine-1.2.27-1.el7 (FEDORA-EPEL-2024-d0445178a9) Threaded poller for Cacti written in C -------------------------------------------------------------------------------- Update Information: Update cacti and cacti-spine to version 1.2.27. This includes the upstream fixes for many CVEs, including a critical remote code execution bug. https://github.com/Cacti/cacti/blob/release/1.2.27/CHANGELOG https://github.com/Cacti/spine/blob/release/1.2.27/CHANGELOG -------------------------------------------------------------------------------- ChangeLog: * Wed May 22 2024 Carl George <carlwgeorge@xxxxxxxxxxxxxxxxx> - 1.2.27-1 - Update to version 1.2.27 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2255603 - CVE-2023-49084 cacti: RCE when managing links [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2255603 [ 2 ] Bug #2255607 - CVE-2023-49086 cacti: XSS when adding new devices [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2255607 [ 3 ] Bug #2255668 - CVE-2023-49085 CVE-2023-49088 CVE-2023-50250 CVE-2023-51448 cacti: Multiple vulnerabilities [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2255668 [ 4 ] Bug #2280481 - CVE-2024-34340 cacti: authentication bypass when using older password hashes [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280481 [ 5 ] Bug #2280496 - CVE-2024-29894 cacti: XSS vulnerability when using JavaScript based messaging API [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280496 [ 6 ] Bug #2280499 - CVE-2024-31458 CVE-2024-31459 CVE-2024-31460 cacti: multiple vulnerabilities [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280499 [ 7 ] Bug #2280502 - CVE-2024-31443 CVE-2024-31444 CVE-2024-31445 cacti: multiple vulnerabilties [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280502 [ 8 ] Bug #2280505 - CVE-2024-25641 cacti: remote code execution vulnerability [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2280505 -------------------------------------------------------------------------------- ================================================================================ copr-cli-1.112-1.el7 (FEDORA-EPEL-2024-473133d592) Command line interface for COPR -------------------------------------------------------------------------------- Update Information: https://docs.pagure.org/copr.copr/release-notes/2024-05-22.html -------------------------------------------------------------------------------- ChangeLog: * Tue May 21 2024 Jakub Kadlcik <frostyx@xxxxxxxx> 1.112-1 - Add per package timeout option - Remove dependency on simplejson -------------------------------------------------------------------------------- ================================================================================ python-copr-1.132-1.el7 (FEDORA-EPEL-2024-473133d592) Python interface for Copr -------------------------------------------------------------------------------- Update Information: https://docs.pagure.org/copr.copr/release-notes/2024-05-22.html -------------------------------------------------------------------------------- ChangeLog: * Tue May 21 2024 Jakub Kadlcik <frostyx@xxxxxxxx> 1.132-1 - Discourage from deleting objects while paginating over them - Suggest pagination only when a GET request timeouts -------------------------------------------------------------------------------- -- _______________________________________________ epel-devel mailing list -- epel-devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to epel-devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/epel-devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
