We have released OpenBGPD 8.8, which will be arriving in the
OpenBGPD directory of your local OpenBSD mirror soon.
This release includes the following changes to the previous release:
* Improve default multiproto capability announcement selection.
The default MP capability is only set if no other capability is
configured on the neighbor.
* The `reject as-set` configuration option now defaults to yes.
Route announcements with AS_SET segments in the AS_PATH Attribute
will be rejected. See draft-ietf-idr-deprecate-as-set-confed-set
for more information.
* The RFC 8654 Extended Message configuration changed from
"announce extended (yes|no|enforce)" to
"announce extended message (yes|no|enforce)"
* RFC 8950 - Extended nexthop encoding support in the RIB.
* Preliminary support for EVPN in the RIB.
* When "transparent-as yes" is set, well-known BGP communities are
passed on according to RFC 7947. This means that IX Route Servers
transparently pass through NO_EXPORT, NO_ADVERTISE, etc.
* Fix an error introduced in the previous release that prevented
sessions from staying down.
* Fix add-path send support using best, ecmp, or as-wide-best mode
which was not working correctly in the previous release.
* Fix FIB handling on FreeBSD when an interface is destroyed.
* Make the example bgpd.conf work out of the box with 4byte ASN.
OpenBGPD-portable is known to compile and run on FreeBSD and the
Linux distributions Alpine, Debian, Fedora, RHEL/CentOS and Ubuntu.
It is our hope that packagers take interest and help adapt OpenBGPD-portable
to more distributions.
We welcome feedback and improvements from the broader community.
Thanks to all of the contributors who helped make this release
possible.
Thursday, February 6, 2025
F43 Change Proposal: Remove el, jsp and servlet packages from tomcat
Wiki - https://fedoraproject.org/wiki/Changes/Remove_el,_jsp_and_servlet_packages_from_tomcat
Discussion Thread -
https://discussion.fedoraproject.org/t/f43-change-proposal-remove-el-jsp-and-servlet-packages-from-tomcat-self-contained/144199
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
This change involves removing the tomcat-servlet-api, tomcat-el-api,
and tomcat-jsp-api packages. These APIs are already provided by the
primary Tomcat package, eliminating the need for standalone packages.
== Owner ==
* Name: [[User:dsoumis| Dimitris Soumis]]
* Email: dsoumis@redhat.com
== Detailed Description ==
These separate packages, tomcat-servlet-api, tomcat-el-api and
tomcat-jsp-api were intended for developers who required the
individual servlet, EL, and JSP APIs independently, without the need
to install the full Tomcat server. Standalone usage of these APIs is
rare, and they are primarily bundled with application servers or web
containers (like Tomcat itself).
The primary Tomcat package already provides these APIs, eliminating
the need for separate packages. Developers and users can directly
depend on Tomcat for these functionalities.
These packages introduce unnecessary complexity and file conflicts
during upgrades, as seen with overlapping files (e.g.,
tomcat-servlet-api.jar, tomcat-el-api.jar).
Managing these conflicts requires additional work without providing
significant benefits.
== Feedback ==
No feedback is received.
== Benefit to Fedora ==
Removing these standalone API packages simplifies package management,
reduces file conflicts, and avoids confusion for users and
maintainers.
== Scope ==
* Proposal owners:
** Remove tomcat-servlet-api, tomcat-el-api, and tomcat-jsp-api
** Update any references or dependencies that explicitly rely on these
packages to point to the main Tomcat package.
* Other developers: Ensure that any software previously depending on
these standalone packages uses the main tomcat-lib package instead.
* Release engineering: N/A
* Policies and guidelines: N/A
* Trademark approval: N/A
* Alignment with the Fedora Strategy: Yes
== Upgrade/compatibility impact ==
* Any existing installations of tomcat-servlet-api, tomcat-el-api, or
tomcat-jsp-api will be removed.
* Applications or development setups depending on these packages
should switch to depending on the main tomcat package.
There should be no functional impact on end-users or developers, as
the main tomcat package continues to supply the servlet, EL, and JSP
APIs. In rare cases where a project explicitly references these
packages, a small update to dependency declarations may be necessary.
== Early Testing (Optional) ==
== How To Test ==
Check for Removed Packages: Verify that tomcat-servlet-api,
tomcat-el-api, and tomcat-jsp-api are no longer available in the
repositories.
== User Experience ==
For most Fedora users and developers, this change will be largely invisible.
== Dependencies ==
None.
== Contingency Plan ==
Revert the update.
* Blocks release? No
== Documentation ==
N/A (not a System Wide Change)
== Release Notes ==
Remove el, jsp and servlet packages from tomcat
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Discussion Thread -
https://discussion.fedoraproject.org/t/f43-change-proposal-remove-el-jsp-and-servlet-packages-from-tomcat-self-contained/144199
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
This change involves removing the tomcat-servlet-api, tomcat-el-api,
and tomcat-jsp-api packages. These APIs are already provided by the
primary Tomcat package, eliminating the need for standalone packages.
== Owner ==
* Name: [[User:dsoumis| Dimitris Soumis]]
* Email: dsoumis@redhat.com
== Detailed Description ==
These separate packages, tomcat-servlet-api, tomcat-el-api and
tomcat-jsp-api were intended for developers who required the
individual servlet, EL, and JSP APIs independently, without the need
to install the full Tomcat server. Standalone usage of these APIs is
rare, and they are primarily bundled with application servers or web
containers (like Tomcat itself).
The primary Tomcat package already provides these APIs, eliminating
the need for separate packages. Developers and users can directly
depend on Tomcat for these functionalities.
These packages introduce unnecessary complexity and file conflicts
during upgrades, as seen with overlapping files (e.g.,
tomcat-servlet-api.jar, tomcat-el-api.jar).
Managing these conflicts requires additional work without providing
significant benefits.
== Feedback ==
No feedback is received.
== Benefit to Fedora ==
Removing these standalone API packages simplifies package management,
reduces file conflicts, and avoids confusion for users and
maintainers.
== Scope ==
* Proposal owners:
** Remove tomcat-servlet-api, tomcat-el-api, and tomcat-jsp-api
** Update any references or dependencies that explicitly rely on these
packages to point to the main Tomcat package.
* Other developers: Ensure that any software previously depending on
these standalone packages uses the main tomcat-lib package instead.
* Release engineering: N/A
* Policies and guidelines: N/A
* Trademark approval: N/A
* Alignment with the Fedora Strategy: Yes
== Upgrade/compatibility impact ==
* Any existing installations of tomcat-servlet-api, tomcat-el-api, or
tomcat-jsp-api will be removed.
* Applications or development setups depending on these packages
should switch to depending on the main tomcat package.
There should be no functional impact on end-users or developers, as
the main tomcat package continues to supply the servlet, EL, and JSP
APIs. In rare cases where a project explicitly references these
packages, a small update to dependency declarations may be necessary.
== Early Testing (Optional) ==
== How To Test ==
Check for Removed Packages: Verify that tomcat-servlet-api,
tomcat-el-api, and tomcat-jsp-api are no longer available in the
repositories.
== User Experience ==
For most Fedora users and developers, this change will be largely invisible.
== Dependencies ==
None.
== Contingency Plan ==
Revert the update.
* Blocks release? No
== Documentation ==
N/A (not a System Wide Change)
== Release Notes ==
Remove el, jsp and servlet packages from tomcat
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
F43 Change Proposal: Retire python-nose (self-contained)
Wiki - https://fedoraproject.org/wiki/Changes/RetirePythonNose
Discussion Thread -
https://discussion.fedoraproject.org/t/f43-change-proposal-retire-python-nose-self-contained/144198
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
The python-nose package is dead upstream and has been
[[Changes/DeprecateNose|deprecated for 5 years in Fedora]]. It
[https://bugzilla.redhat.com/show_bug.cgi?id=2323163 no longer builds
with Python 3.14] and it will be retired (removed) from Fedora Linux
43 without replacement.
== Owner ==
* Name: [[User:Churchyard|Miro Hrončok]]
* Email: mhroncok@redhat.com
== Detailed Description ==
Several dependents on python-nose have been fixed before filing this
change. See some progress in
https://bugzilla.redhat.com/show_bug.cgi?id=2323163 and
https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/GMXMFW52CWUOYUJA4PGS3GDPESU3EPG5/
== https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/GMXMFW52CWUOYUJA4PGS3GDPESU3EPG5/
python-nose will be retired (removed from) Fedora Linux 43 after this
change is approved but not before Fedora Linux 42 is branched from
rawhide.
When we retire python-nose, the following packages will fail to build:
$ repoquery -q --repo=rawhide{,-source} --whatrequires python3-nose
--recursive | grep src$
ProDy-0:2.4.1-11.fc42.src
bmap-tools-0:3.7-7.fc42.src
hgsvn-0:0.6.0-17.fc42.src
nova-agent-0:2.1.25-11.fc42.src
openms-2:3.3.0-1.fc42.src
python-agate-0:1.12.0-2.fc42.src
python-agate-dbf-0:0.2.3-3.fc42.src
python-agate-excel-0:0.4.1-3.fc42.src
python-agate-sql-0:0.7.2-3.fc42.src
python-axolotl-0:0.2.3-13.fc42.src
python-binstruct-0:1.0.1-30.fc42.src
python-blessings-0:1.7-26.fc42.src
python-colorspacious-0:1.1.2-25.fc42.src
python-curtsies-0:0.4.2-7.fc42.src
python-epc-0:0.0.5-16.fc42.src
python-eyed3-0:0.9.7-8.fc42.src
python-flask-xml-rpc-0:0.1.2-34.fc41.src
python-hglib-0:2.6.2-17.fc42.src
python-ifcfg-0:0.21-17.fc42.src
python-leather-0:0.4.0-3.fc42.src
python-migrate-0:0.13.0-20.fc42.src
python-moksha-common-0:1.2.5-35.fc42.src
python-neurosynth-0:0.3.8-16.fc42.src
python-pygeoip-0:0.2.6-40.fc42.src
python-pytest7-0:7.4.3-4.fc42.src
python-queuelib-0:1.5.0-23.fc42.src
python-rows-0:0.4.1-24.fc42.src
python-simplebayes-0:1.5.8-27.fc42.src
python-spec-0:1.4.1-19.fc42.src
python-statsd-0:3.2.1-32.fc41.src
python-supersmoother-0:0.4-30.fc42.src
python-tilestache-0:1.51.14-19.fc42.src
python-xvfbwrapper-0:0.2.9-26.fc42.src
And the following packages will fail to install:
$ repoquery -q --repo=rawhide --whatrequires python3-nose --recursive
python3-bmaptools-0:3.7-7.fc42.noarch
python3-neurosynth-0:0.3.8-16.fc42.noarch
python3-nose-testconfig-0:0.10-35.fc42.noarch
python3-spec-0:1.4.1-19.fc42.noarch
$ (repoquery -q --repo=rawhide --whatrequires python3-nose
--recursive --source; repoquery -q --repo=rawhide{,-source}
--whatrequires python3-nose --recursive | grep src$) | pkgname | sort
| uniq | python find-package-maintainers
Maintainers by package:
ProDy sagitter
bmap-tools aekoroglu
hgsvn terjeros
nova-agent survient tonyskapunk
openms sagitter
python-agate jujens
python-agate-dbf jujens
python-agate-excel jujens
python-agate-sql jujens
python-axolotl principis
python-binstruct besser82
python-blessings salimma
python-colorspacious fed500
python-curtsies salimma terjeros
python-epc melmorabity
python-eyed3 amigadave cicku pjp
python-flask-xml-rpc orphan
python-hglib terjeros
python-ifcfg cottsay
python-leather jujens
python-migrate jcapitao
python-moksha-common lbalhar
python-neurosynth lbazan
python-nose-testconfig dshea
python-pygeoip kevin
python-pytest7 thrnciar
python-queuelib fab
python-rows fab
python-simplebayes qulogic
python-spec mhayden pghmcfc
python-statsd orphan
python-supersmoother sergiopr
python-tilestache cottsay
python-xvfbwrapper mrunge totol
Packages by maintainer:
aekoroglu bmap-tools
amigadave python-eyed3
besser82 python-binstruct
cicku python-eyed3
cottsay python-ifcfg python-tilestache
dshea python-nose-testconfig
fab python-queuelib python-rows
fed500 python-colorspacious
jcapitao python-migrate
jujens python-agate python-agate-dbf python-agate-excel
python-agate-sql python-leather
kevin python-pygeoip
lbalhar python-moksha-common
lbazan python-neurosynth
melmorabity python-epc
mhayden python-spec
mrunge python-xvfbwrapper
orphan python-flask-xml-rpc python-statsd
pghmcfc python-spec
pjp python-eyed3
principis python-axolotl
qulogic python-simplebayes
sagitter ProDy openms
salimma python-blessings python-curtsies
sergiopr python-supersmoother
survient nova-agent
terjeros hgsvn python-curtsies python-hglib
thrnciar python-pytest7
tonyskapunk nova-agent
totol python-xvfbwrapper
Fails To Build and Fails To Install bugzillas will be filled for the
affected packages. Some of them such as (nose-testconfig) will be
retired.
Packages that will fail to build will not be able to be rebuilt for
Python 3.14 and if not fixed, will eventually also fail to install.
Change owners can offer assistance on how to remove the dependency on
nose. See some examples linked from
https://bugzilla.redhat.com/show_bug.cgi?id=2323163
== Feedback ==
No or positive feedback in
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/GMXMFW52CWUOYUJA4PGS3GDPESU3EPG5/
== Benefit to Fedora ==
No more kicking the dead nose.
== Scope ==
* Proposal owners:
** Retire python-nose
** File bugzillas for dependent packages
* Other developers:
** Drop the dependency or retire the dependents
* Release engineering: N/A (not needed for this Change)
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy:
== Upgrade/compatibility impact ==
== Early Testing (Optional) ==
Do you require 'QA Blueprint' support? N
== How To Test ==
dnf install python3-nose # should fail on Fedora 43+
repoquery -q --repo=fedora --releasever=43 python3-nose # should
list nothing (can only be tested after branching)
repoquery -q --repo=fedora-source --releasever=43 python-nose #
should list nothing (can only be tested after branching)
== User Experience ==
Users of Fedora will no longer be able to install python3-nose via
dnf. They can try installing it via pip instead, but should seriously
consider not using it.
== Dependencies ==
The [[Changes/Python3.14|Python 3.14 upgrade]] would retire this
package anyway. This change proposal is just a courtesy.
== Contingency Plan ==
* Contingency mechanism: N/A (not a System Wide Change)
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? No
== Documentation ==
N/A (not a System Wide Change)
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Discussion Thread -
https://discussion.fedoraproject.org/t/f43-change-proposal-retire-python-nose-self-contained/144198
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
The python-nose package is dead upstream and has been
[[Changes/DeprecateNose|deprecated for 5 years in Fedora]]. It
[https://bugzilla.redhat.com/show_bug.cgi?id=2323163 no longer builds
with Python 3.14] and it will be retired (removed) from Fedora Linux
43 without replacement.
== Owner ==
* Name: [[User:Churchyard|Miro Hrončok]]
* Email: mhroncok@redhat.com
== Detailed Description ==
Several dependents on python-nose have been fixed before filing this
change. See some progress in
https://bugzilla.redhat.com/show_bug.cgi?id=2323163 and
https://lists.fedoraproject.org/archives/list/python-devel@lists.fedoraproject.org/thread/GMXMFW52CWUOYUJA4PGS3GDPESU3EPG5/
== https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/GMXMFW52CWUOYUJA4PGS3GDPESU3EPG5/
python-nose will be retired (removed from) Fedora Linux 43 after this
change is approved but not before Fedora Linux 42 is branched from
rawhide.
When we retire python-nose, the following packages will fail to build:
$ repoquery -q --repo=rawhide{,-source} --whatrequires python3-nose
--recursive | grep src$
ProDy-0:2.4.1-11.fc42.src
bmap-tools-0:3.7-7.fc42.src
hgsvn-0:0.6.0-17.fc42.src
nova-agent-0:2.1.25-11.fc42.src
openms-2:3.3.0-1.fc42.src
python-agate-0:1.12.0-2.fc42.src
python-agate-dbf-0:0.2.3-3.fc42.src
python-agate-excel-0:0.4.1-3.fc42.src
python-agate-sql-0:0.7.2-3.fc42.src
python-axolotl-0:0.2.3-13.fc42.src
python-binstruct-0:1.0.1-30.fc42.src
python-blessings-0:1.7-26.fc42.src
python-colorspacious-0:1.1.2-25.fc42.src
python-curtsies-0:0.4.2-7.fc42.src
python-epc-0:0.0.5-16.fc42.src
python-eyed3-0:0.9.7-8.fc42.src
python-flask-xml-rpc-0:0.1.2-34.fc41.src
python-hglib-0:2.6.2-17.fc42.src
python-ifcfg-0:0.21-17.fc42.src
python-leather-0:0.4.0-3.fc42.src
python-migrate-0:0.13.0-20.fc42.src
python-moksha-common-0:1.2.5-35.fc42.src
python-neurosynth-0:0.3.8-16.fc42.src
python-pygeoip-0:0.2.6-40.fc42.src
python-pytest7-0:7.4.3-4.fc42.src
python-queuelib-0:1.5.0-23.fc42.src
python-rows-0:0.4.1-24.fc42.src
python-simplebayes-0:1.5.8-27.fc42.src
python-spec-0:1.4.1-19.fc42.src
python-statsd-0:3.2.1-32.fc41.src
python-supersmoother-0:0.4-30.fc42.src
python-tilestache-0:1.51.14-19.fc42.src
python-xvfbwrapper-0:0.2.9-26.fc42.src
And the following packages will fail to install:
$ repoquery -q --repo=rawhide --whatrequires python3-nose --recursive
python3-bmaptools-0:3.7-7.fc42.noarch
python3-neurosynth-0:0.3.8-16.fc42.noarch
python3-nose-testconfig-0:0.10-35.fc42.noarch
python3-spec-0:1.4.1-19.fc42.noarch
$ (repoquery -q --repo=rawhide --whatrequires python3-nose
--recursive --source; repoquery -q --repo=rawhide{,-source}
--whatrequires python3-nose --recursive | grep src$) | pkgname | sort
| uniq | python find-package-maintainers
Maintainers by package:
ProDy sagitter
bmap-tools aekoroglu
hgsvn terjeros
nova-agent survient tonyskapunk
openms sagitter
python-agate jujens
python-agate-dbf jujens
python-agate-excel jujens
python-agate-sql jujens
python-axolotl principis
python-binstruct besser82
python-blessings salimma
python-colorspacious fed500
python-curtsies salimma terjeros
python-epc melmorabity
python-eyed3 amigadave cicku pjp
python-flask-xml-rpc orphan
python-hglib terjeros
python-ifcfg cottsay
python-leather jujens
python-migrate jcapitao
python-moksha-common lbalhar
python-neurosynth lbazan
python-nose-testconfig dshea
python-pygeoip kevin
python-pytest7 thrnciar
python-queuelib fab
python-rows fab
python-simplebayes qulogic
python-spec mhayden pghmcfc
python-statsd orphan
python-supersmoother sergiopr
python-tilestache cottsay
python-xvfbwrapper mrunge totol
Packages by maintainer:
aekoroglu bmap-tools
amigadave python-eyed3
besser82 python-binstruct
cicku python-eyed3
cottsay python-ifcfg python-tilestache
dshea python-nose-testconfig
fab python-queuelib python-rows
fed500 python-colorspacious
jcapitao python-migrate
jujens python-agate python-agate-dbf python-agate-excel
python-agate-sql python-leather
kevin python-pygeoip
lbalhar python-moksha-common
lbazan python-neurosynth
melmorabity python-epc
mhayden python-spec
mrunge python-xvfbwrapper
orphan python-flask-xml-rpc python-statsd
pghmcfc python-spec
pjp python-eyed3
principis python-axolotl
qulogic python-simplebayes
sagitter ProDy openms
salimma python-blessings python-curtsies
sergiopr python-supersmoother
survient nova-agent
terjeros hgsvn python-curtsies python-hglib
thrnciar python-pytest7
tonyskapunk nova-agent
totol python-xvfbwrapper
Fails To Build and Fails To Install bugzillas will be filled for the
affected packages. Some of them such as (nose-testconfig) will be
retired.
Packages that will fail to build will not be able to be rebuilt for
Python 3.14 and if not fixed, will eventually also fail to install.
Change owners can offer assistance on how to remove the dependency on
nose. See some examples linked from
https://bugzilla.redhat.com/show_bug.cgi?id=2323163
== Feedback ==
No or positive feedback in
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/GMXMFW52CWUOYUJA4PGS3GDPESU3EPG5/
== Benefit to Fedora ==
No more kicking the dead nose.
== Scope ==
* Proposal owners:
** Retire python-nose
** File bugzillas for dependent packages
* Other developers:
** Drop the dependency or retire the dependents
* Release engineering: N/A (not needed for this Change)
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy:
== Upgrade/compatibility impact ==
== Early Testing (Optional) ==
Do you require 'QA Blueprint' support? N
== How To Test ==
dnf install python3-nose # should fail on Fedora 43+
repoquery -q --repo=fedora --releasever=43 python3-nose # should
list nothing (can only be tested after branching)
repoquery -q --repo=fedora-source --releasever=43 python-nose #
should list nothing (can only be tested after branching)
== User Experience ==
Users of Fedora will no longer be able to install python3-nose via
dnf. They can try installing it via pip instead, but should seriously
consider not using it.
== Dependencies ==
The [[Changes/Python3.14|Python 3.14 upgrade]] would retire this
package anyway. This change proposal is just a courtesy.
== Contingency Plan ==
* Contingency mechanism: N/A (not a System Wide Change)
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? No
== Documentation ==
N/A (not a System Wide Change)
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
[USN-7259-1] GNU C Library vulnerability
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEELOLXZEFYQHcSWEHiyfW2m9Ldu6sFAmek82cFAwAAAAAACgkQyfW2m9Ldu6tD
KQ//X+fG8IAbwVrrIbno1do04R0dENQ2XKmTNqRaACnhU/8Jn29OINPd+VCXqxcWdjhlpoQ7VxN2
iiDOCOuLLQER94OZiU5DAiilTfMRIzI4vq+dc78Tc1l34mGBOng7sv2VqsrsTY2e/EzUt2hiJMeQ
mZgyaFwSq14cYRkWjskg0m/1vkAUCditM3HpeJ1ESZQElNqQ1z8+X48C8ot4QEKat11S9TwCZwCc
jANchjObnilj19DQX4bgEz6IvmdElXMJ/Dvv7UuYM36JLfeVc8V+StUNtLQxMLpSVK56KrNIeurC
1prkeVLYqsaWP9L2SOyMXmvtuFI4GctVWV9br92rTgwjYRFLxT9gjDzR4wnzFtwDATiHu9P83m2h
pz1JOq4OKb5uEb9NBIKYOcEBDhkmqjeROSDnB1XUBBdsa60hSmiXuBdpyiQ8kfQeAVKFYNjY+wWO
KStopatflim/hES9iC0q0mJLWy4UrOz1KqxOzh7YOuxV01R17YsdCQyxduaX6J6kVwFZgxVJGRb2
gKpJbesspaVyxn3IC3FTe/7SZGgobBfQGT7Mh1aaLhLrr5Chy9I5jMVXYds5Gu7qqWlRNFpAgx7M
GPILLI4C2m9B0aPjMfpPf+N7H3Vkqd8VNYPlpw/Alo3IpzngnKorgl95BCQDeLm5rtfSXs/JWHwO
RHM=
=zQiU
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7259-1
February 06, 2025
glibc vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
GNU C Library could be made to crash or run programs if it received
specially crafted input.
Software Description:
- glibc: GNU C Library
Details:
It was discovered that GNU C Library incorrectly handled memory when using
the assert function. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
libc6 2.40-1ubuntu3.1
Ubuntu 24.04 LTS
libc6 2.39-0ubuntu8.4
Ubuntu 22.04 LTS
libc6 2.35-0ubuntu3.9
Ubuntu 20.04 LTS
libc6 2.31-0ubuntu9.17
Ubuntu 18.04 LTS
libc6 2.27-3ubuntu1.6+esm4
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7259-1
CVE-2025-0395
Package Information:
https://launchpad.net/ubuntu/+source/glibc/2.40-1ubuntu3.1
https://launchpad.net/ubuntu/+source/glibc/2.39-0ubuntu8.4
https://launchpad.net/ubuntu/+source/glibc/2.35-0ubuntu3.9
https://launchpad.net/ubuntu/+source/glibc/2.31-0ubuntu9.17
wsF5BAABCAAjFiEELOLXZEFYQHcSWEHiyfW2m9Ldu6sFAmek82cFAwAAAAAACgkQyfW2m9Ldu6tD
KQ//X+fG8IAbwVrrIbno1do04R0dENQ2XKmTNqRaACnhU/8Jn29OINPd+VCXqxcWdjhlpoQ7VxN2
iiDOCOuLLQER94OZiU5DAiilTfMRIzI4vq+dc78Tc1l34mGBOng7sv2VqsrsTY2e/EzUt2hiJMeQ
mZgyaFwSq14cYRkWjskg0m/1vkAUCditM3HpeJ1ESZQElNqQ1z8+X48C8ot4QEKat11S9TwCZwCc
jANchjObnilj19DQX4bgEz6IvmdElXMJ/Dvv7UuYM36JLfeVc8V+StUNtLQxMLpSVK56KrNIeurC
1prkeVLYqsaWP9L2SOyMXmvtuFI4GctVWV9br92rTgwjYRFLxT9gjDzR4wnzFtwDATiHu9P83m2h
pz1JOq4OKb5uEb9NBIKYOcEBDhkmqjeROSDnB1XUBBdsa60hSmiXuBdpyiQ8kfQeAVKFYNjY+wWO
KStopatflim/hES9iC0q0mJLWy4UrOz1KqxOzh7YOuxV01R17YsdCQyxduaX6J6kVwFZgxVJGRb2
gKpJbesspaVyxn3IC3FTe/7SZGgobBfQGT7Mh1aaLhLrr5Chy9I5jMVXYds5Gu7qqWlRNFpAgx7M
GPILLI4C2m9B0aPjMfpPf+N7H3Vkqd8VNYPlpw/Alo3IpzngnKorgl95BCQDeLm5rtfSXs/JWHwO
RHM=
=zQiU
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7259-1
February 06, 2025
glibc vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
GNU C Library could be made to crash or run programs if it received
specially crafted input.
Software Description:
- glibc: GNU C Library
Details:
It was discovered that GNU C Library incorrectly handled memory when using
the assert function. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
libc6 2.40-1ubuntu3.1
Ubuntu 24.04 LTS
libc6 2.39-0ubuntu8.4
Ubuntu 22.04 LTS
libc6 2.35-0ubuntu3.9
Ubuntu 20.04 LTS
libc6 2.31-0ubuntu9.17
Ubuntu 18.04 LTS
libc6 2.27-3ubuntu1.6+esm4
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7259-1
CVE-2025-0395
Package Information:
https://launchpad.net/ubuntu/+source/glibc/2.40-1ubuntu3.1
https://launchpad.net/ubuntu/+source/glibc/2.39-0ubuntu8.4
https://launchpad.net/ubuntu/+source/glibc/2.35-0ubuntu3.9
https://launchpad.net/ubuntu/+source/glibc/2.31-0ubuntu9.17
[USN-7256-1] Ruby vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7256-1
February 06, 2025
ruby2.7 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Ruby.
Software Description:
- ruby2.7: Object-oriented scripting language
Details:
It was discovered that Ruby incorrectly handled parsing of an XML document
that has specific XML characters in an attribute value using REXML gem. An
attacker could use this issue to cause Ruby to crash, resulting in a
denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
libruby2.7 2.7.0-5ubuntu1.16
ruby2.7 2.7.0-5ubuntu1.16
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7256-1
CVE-2024-39908, CVE-2024-43398
Package Information:
https://launchpad.net/ubuntu/+source/ruby2.7/2.7.0-5ubuntu1.16
Ubuntu Security Notice USN-7256-1
February 06, 2025
ruby2.7 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Ruby.
Software Description:
- ruby2.7: Object-oriented scripting language
Details:
It was discovered that Ruby incorrectly handled parsing of an XML document
that has specific XML characters in an attribute value using REXML gem. An
attacker could use this issue to cause Ruby to crash, resulting in a
denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
libruby2.7 2.7.0-5ubuntu1.16
ruby2.7 2.7.0-5ubuntu1.16
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7256-1
CVE-2024-39908, CVE-2024-43398
Package Information:
https://launchpad.net/ubuntu/+source/ruby2.7/2.7.0-5ubuntu1.16
Wednesday, February 5, 2025
[USN-7258-1] CKEditor vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsD5BAABCAAjFiEEkd98mdFcnQdP7vQkuGrtzot7pOcFAmekMVMFAwAAAAAACgkQuGrtzot7pOct
Ywv8Cw/MmWpWkrsf7g1AVbzPEgmvHGj59hfs8kfEkcKEieSsc9hPOxbetY9KTGyvvggRPjT/g8qR
PHJtyZG0vPz9vdMHwCkBBsNi4PLU9XjOavZOokV8BzKylisRC0fN7i8Py7XvrjzkCPyf+F9oOf0/
9HK7qweEuEjDSuL7leECguU3dkhIJ12W5JHDXQSC9hQSUMnuaaTVL8FwJ9vsZlF330c9m11N8c8r
1NFP8cQI8weqPKQWL0opv146RCLJ0+ChGp1AeZrfu2KPD0/iMB3LfVKA5xUGDDZrc8qf7KE/WetI
l8UFHWd7TvTgAtFZ+i0eThpt40DHEzezsbdkWGwk37OC3qPObZ2r4Ac0EqqLbr1qK1N/N+H68U5r
tHcIk5yDvf8L1+g5EqzsvSRt4Y50Hk5I3ZPg54lIIvZ24K9KZ18Tbo9iTppBnKSYw3RN7OZrctwm
6JbVMk7Y6yO7ZYUJFyXTT7bZgf95V3ZSVwWgWUcmMGlGKeECeVmqgKb0Ojkj
=A/yI
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7258-1
February 06, 2025
ckeditor vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in CKEditor.
Software Description:
- ckeditor: Text editor which can be embedded into web pages
Details:
Kevin Backhouse discovered that CKEditor did not properly sanitize HTML
content. An attacker could possibly use this issue to perform cross site
scripting and obtain sensitive information. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-24728)
It was discovered that CKEditor did not properly handle the creation of
editor instances in the Iframe Dialog and Media Embed packages. An
attacker could possibly use this issue to perform cross site scripting
and obtain sensitive information. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2023-28439)
It was discovered that CKEditor did not properly handle parsing HTML
content. An attacker could possibly use this issue to perform cross site
scripting and obtain sensitive information.
(CVE-2024-24815, CVE-2024-24816)
It was discovered that CKEditor did not properly sanitize version
notifications. An attacker could possibly use this issue to perform cross
site scripting and obtain sensitive information. This issue only affected
Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-43411)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
ckeditor 4.22.1+dfsg1-2ubuntu0.24.10.1
Ubuntu 24.04 LTS
ckeditor 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1
Available with Ubuntu Pro
Ubuntu 22.04 LTS
ckeditor 4.16.2+dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
ckeditor 4.12.1+dfsg-1ubuntu0.1+esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
ckeditor 4.5.7+dfsg-2ubuntu0.18.04.1+esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
ckeditor 4.5.7+dfsg-2ubuntu0.16.04.1~esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7258-1
CVE-2022-24728, CVE-2023-28439, CVE-2024-24815, CVE-2024-24816,
CVE-2024-43411
Package Information:
https://launchpad.net/ubuntu/+source/ckeditor/4.22.1+dfsg1-2ubuntu0.24.10.1
wsD5BAABCAAjFiEEkd98mdFcnQdP7vQkuGrtzot7pOcFAmekMVMFAwAAAAAACgkQuGrtzot7pOct
Ywv8Cw/MmWpWkrsf7g1AVbzPEgmvHGj59hfs8kfEkcKEieSsc9hPOxbetY9KTGyvvggRPjT/g8qR
PHJtyZG0vPz9vdMHwCkBBsNi4PLU9XjOavZOokV8BzKylisRC0fN7i8Py7XvrjzkCPyf+F9oOf0/
9HK7qweEuEjDSuL7leECguU3dkhIJ12W5JHDXQSC9hQSUMnuaaTVL8FwJ9vsZlF330c9m11N8c8r
1NFP8cQI8weqPKQWL0opv146RCLJ0+ChGp1AeZrfu2KPD0/iMB3LfVKA5xUGDDZrc8qf7KE/WetI
l8UFHWd7TvTgAtFZ+i0eThpt40DHEzezsbdkWGwk37OC3qPObZ2r4Ac0EqqLbr1qK1N/N+H68U5r
tHcIk5yDvf8L1+g5EqzsvSRt4Y50Hk5I3ZPg54lIIvZ24K9KZ18Tbo9iTppBnKSYw3RN7OZrctwm
6JbVMk7Y6yO7ZYUJFyXTT7bZgf95V3ZSVwWgWUcmMGlGKeECeVmqgKb0Ojkj
=A/yI
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7258-1
February 06, 2025
ckeditor vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in CKEditor.
Software Description:
- ckeditor: Text editor which can be embedded into web pages
Details:
Kevin Backhouse discovered that CKEditor did not properly sanitize HTML
content. An attacker could possibly use this issue to perform cross site
scripting and obtain sensitive information. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-24728)
It was discovered that CKEditor did not properly handle the creation of
editor instances in the Iframe Dialog and Media Embed packages. An
attacker could possibly use this issue to perform cross site scripting
and obtain sensitive information. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2023-28439)
It was discovered that CKEditor did not properly handle parsing HTML
content. An attacker could possibly use this issue to perform cross site
scripting and obtain sensitive information.
(CVE-2024-24815, CVE-2024-24816)
It was discovered that CKEditor did not properly sanitize version
notifications. An attacker could possibly use this issue to perform cross
site scripting and obtain sensitive information. This issue only affected
Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-43411)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
ckeditor 4.22.1+dfsg1-2ubuntu0.24.10.1
Ubuntu 24.04 LTS
ckeditor 4.22.1+dfsg1-2ubuntu0.24.04.1~esm1
Available with Ubuntu Pro
Ubuntu 22.04 LTS
ckeditor 4.16.2+dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
ckeditor 4.12.1+dfsg-1ubuntu0.1+esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
ckeditor 4.5.7+dfsg-2ubuntu0.18.04.1+esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
ckeditor 4.5.7+dfsg-2ubuntu0.16.04.1~esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7258-1
CVE-2022-24728, CVE-2023-28439, CVE-2024-24815, CVE-2024-24816,
CVE-2024-43411
Package Information:
https://launchpad.net/ubuntu/+source/ckeditor/4.22.1+dfsg1-2ubuntu0.24.10.1
Fedora Linux 42 Has Been Branched!
Hi All,
Fedora Linux 42 has now been branched! Please be sure to run
git fetch -v to pick up the new branch.
As a reminder, Rawhide and Fedora Linux 42 are now completely isolated
from previous releases.
This means that any changes you make for Fedora 42 should also be
applied in the Rawhide branch, and a corresponding build should be
done there.
A Fedora Linux 42 compose will be generated and will appear in [1]
once complete.
Bodhi is currently enabled in the Fedora Linux 42 branch, similar to
Rawhide, with automatic update creation. When we reach the Beta Change
Freeze in the Fedora Linux 42 schedule [2],
updates-testing will be enabled, and manual Bodhi updates will be
required, as is the case for all stable releases.
The Fedora 42 Branched release is currently frozen until we achieve a
successful composition. Please expect that your Fedora 42 builds will
not be available immediately.
Additionally, the following package updates were unpushed at the time
of mass branching to avoid placing them in an inconsistent state.
Maintainers should verify their updates and push them as needed:
Unpushed/Revoked Updates:
FEDORA-2025-1df6d10dfc - nodejs22-22.13.1-1.fc42
FEDORA-2025-326f30cbd8 - httpd-2.4.63-1.fc42
FEDORA-2025-4217a95b13 - openwsman-2.7.2-14.fc42
FEDORA-2025-436275a69d - iscsi-initiator-utils-6.2.1.10-0.gitd0f04ae.fc42.3
FEDORA-2025-63cd1b3f96 - fcitx5-lua-5.0.14-1.fc42
FEDORA-2025-679a0f5501 - binutils-2.44-1.fc42
FEDORA-2025-7fcd6c3f4c - libsecret-0.21.6-1.fc42
FEDORA-2025-8c6212f8f8 - vsftpd-3.0.5-10.fc42
FEDORA-2025-9eb31c83d9 - dracut-105-1.fc42
FEDORA-2025-ab13571cc1 - osbuild-139-1.fc42
FEDORA-2025-ae9bfeedff - mysql-connector-java-8.0.30-15.fc42
FEDORA-2025-b0fe175865 - cpio-2.15-4.fc42
FEDORA-2025-bacda91d23 - tmt-1.42.1-1.fc42
FEDORA-2025-c1d22427c2 - bluedevil-6.2.91-1.fc42,
breeze-gtk-6.2.91-1.fc42, .... (etc)
FEDORA-2025-c3119a8ebb - llvm-19.1.7-5.fc42
FEDORA-2025-ded532ce7d - weldr-client-35.14-3.fc42
FEDORA-2025-e42ccc4c9b - util-linux-2.40.4-4.fc42
FEDORA-2025-eae56b1c0a - frr-10.2.1-1.fc42, libnetconf2-3.5.5-1.fc42,
libyang-3.7.8-1.fc42, netopeer2-2.2.35-1.fc42, sysrepo-3.3.10-1.fc42
FEDORA-2025-ed82d7584e - tomcat-10.1.34-3.fc42
FEDORA-2025-fccba7057c - criu-4.0-4.fc42
In most cases, submitting a new build for Rawhide (now Fedora 43) and
Fedora 42 should work (assuming any gating failures are resolved).
Thanks for your understanding.
Regards,
Samyak Jain
Fedora Release Engineering
[1] https://dl.fedoraproject.org/pub/fedora/linux/development/42/
[2] https://fedorapeople.org/groups/schedule/f-42/f-42-key-tasks.html
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Fedora Linux 42 has now been branched! Please be sure to run
git fetch -v to pick up the new branch.
As a reminder, Rawhide and Fedora Linux 42 are now completely isolated
from previous releases.
This means that any changes you make for Fedora 42 should also be
applied in the Rawhide branch, and a corresponding build should be
done there.
A Fedora Linux 42 compose will be generated and will appear in [1]
once complete.
Bodhi is currently enabled in the Fedora Linux 42 branch, similar to
Rawhide, with automatic update creation. When we reach the Beta Change
Freeze in the Fedora Linux 42 schedule [2],
updates-testing will be enabled, and manual Bodhi updates will be
required, as is the case for all stable releases.
The Fedora 42 Branched release is currently frozen until we achieve a
successful composition. Please expect that your Fedora 42 builds will
not be available immediately.
Additionally, the following package updates were unpushed at the time
of mass branching to avoid placing them in an inconsistent state.
Maintainers should verify their updates and push them as needed:
Unpushed/Revoked Updates:
FEDORA-2025-1df6d10dfc - nodejs22-22.13.1-1.fc42
FEDORA-2025-326f30cbd8 - httpd-2.4.63-1.fc42
FEDORA-2025-4217a95b13 - openwsman-2.7.2-14.fc42
FEDORA-2025-436275a69d - iscsi-initiator-utils-6.2.1.10-0.gitd0f04ae.fc42.3
FEDORA-2025-63cd1b3f96 - fcitx5-lua-5.0.14-1.fc42
FEDORA-2025-679a0f5501 - binutils-2.44-1.fc42
FEDORA-2025-7fcd6c3f4c - libsecret-0.21.6-1.fc42
FEDORA-2025-8c6212f8f8 - vsftpd-3.0.5-10.fc42
FEDORA-2025-9eb31c83d9 - dracut-105-1.fc42
FEDORA-2025-ab13571cc1 - osbuild-139-1.fc42
FEDORA-2025-ae9bfeedff - mysql-connector-java-8.0.30-15.fc42
FEDORA-2025-b0fe175865 - cpio-2.15-4.fc42
FEDORA-2025-bacda91d23 - tmt-1.42.1-1.fc42
FEDORA-2025-c1d22427c2 - bluedevil-6.2.91-1.fc42,
breeze-gtk-6.2.91-1.fc42, .... (etc)
FEDORA-2025-c3119a8ebb - llvm-19.1.7-5.fc42
FEDORA-2025-ded532ce7d - weldr-client-35.14-3.fc42
FEDORA-2025-e42ccc4c9b - util-linux-2.40.4-4.fc42
FEDORA-2025-eae56b1c0a - frr-10.2.1-1.fc42, libnetconf2-3.5.5-1.fc42,
libyang-3.7.8-1.fc42, netopeer2-2.2.35-1.fc42, sysrepo-3.3.10-1.fc42
FEDORA-2025-ed82d7584e - tomcat-10.1.34-3.fc42
FEDORA-2025-fccba7057c - criu-4.0-4.fc42
In most cases, submitting a new build for Rawhide (now Fedora 43) and
Fedora 42 should work (assuming any gating failures are resolved).
Thanks for your understanding.
Regards,
Samyak Jain
Fedora Release Engineering
[1] https://dl.fedoraproject.org/pub/fedora/linux/development/42/
[2] https://fedorapeople.org/groups/schedule/f-42/f-42-key-tasks.html
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
[USN-7255-1] OpenJDK 23 vulnerability
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmejB/wFAwAAAAAACgkQWNrRIKaTkWfA
5Q/+IxnBQvlFAYL6mHwppJW+YwEayYCDm/WfkfY6ordBvLBNMkvEdj0l+WBI7QKGfpt/3WbdLF2l
tp+/8Rwo1PQDAgzF5q96p/BM4BUVTq+/3c8MdB/Hy4/EVwDXL8ubm0twDcFYg79lMi+E0VQ+PEUW
8OY4E9KIf27cFiDOTkgo8hd8I551NUJHl3fJ8NPTMKle0lViz50Msw68EbvZH9RPsQy6mbmkrho6
DCwJpg1OAvv8jsdaOR+bQ/v0Nog1S9b6iG5GunTd8wkS3dmHFLwHQdgNB/3Ik0XaL6nPzaFq7lmA
+LdDUU/klFtAvUpRKm6EM6WYVIzAxw5lPRbEUdA0KkKvrzdhHGAcAjf6hV9DNRJa5aEDJK5Dsg+q
kvbR73RbExT77/irclvlYkDgyGBRonvVyFX2DpCZDrR5u+jCl8nifsoJzrZgfIFBaTho6plPSvyb
HwdzzY4y7QzKFo0q1Co6NV2SLmog4rfeV3qzs9ypQ9NXCtwtFabPPb15xomkqXSJq6tGtNXZhlkU
ja1e+vgc3NCWmUg0NFpRKFfdo0Gmx9hf1gDceNgEEVxjQvgWh6/ub2Rgc2tvUGfvB6HI3P9KCoXu
RD6aG3y7Ds02ZUnLfsDc4k2ErctT+bRKeCTPnmoOrymyKNcZy7mNELWBHU1oYpSOja2+zP7Xgjvl
Xoc=
=5I18
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7255-1
February 05, 2025
openjdk-23 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
Summary:
OpenJDK 23 could be made to expose sensitive information over the
network.
Software Description:
- openjdk-23: Open Source Java implementation
Details:
It was discovered that the Hotspot component of OpenJDK 23 did not properly
handle API access under certain circumstances. An unauthenticated attacker
could possibly use this issue to access unauthorized resources and expose
sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
openjdk-23-jdk 23.0.2+7-1ubuntu1~24.10
openjdk-23-jdk-headless 23.0.2+7-1ubuntu1~24.10
openjdk-23-jre 23.0.2+7-1ubuntu1~24.10
openjdk-23-jre-headless 23.0.2+7-1ubuntu1~24.10
openjdk-23-jre-zero 23.0.2+7-1ubuntu1~24.10
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7255-1
CVE-2025-21502
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-23/23.0.2+7-1ubuntu1~24.10
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmejB/wFAwAAAAAACgkQWNrRIKaTkWfA
5Q/+IxnBQvlFAYL6mHwppJW+YwEayYCDm/WfkfY6ordBvLBNMkvEdj0l+WBI7QKGfpt/3WbdLF2l
tp+/8Rwo1PQDAgzF5q96p/BM4BUVTq+/3c8MdB/Hy4/EVwDXL8ubm0twDcFYg79lMi+E0VQ+PEUW
8OY4E9KIf27cFiDOTkgo8hd8I551NUJHl3fJ8NPTMKle0lViz50Msw68EbvZH9RPsQy6mbmkrho6
DCwJpg1OAvv8jsdaOR+bQ/v0Nog1S9b6iG5GunTd8wkS3dmHFLwHQdgNB/3Ik0XaL6nPzaFq7lmA
+LdDUU/klFtAvUpRKm6EM6WYVIzAxw5lPRbEUdA0KkKvrzdhHGAcAjf6hV9DNRJa5aEDJK5Dsg+q
kvbR73RbExT77/irclvlYkDgyGBRonvVyFX2DpCZDrR5u+jCl8nifsoJzrZgfIFBaTho6plPSvyb
HwdzzY4y7QzKFo0q1Co6NV2SLmog4rfeV3qzs9ypQ9NXCtwtFabPPb15xomkqXSJq6tGtNXZhlkU
ja1e+vgc3NCWmUg0NFpRKFfdo0Gmx9hf1gDceNgEEVxjQvgWh6/ub2Rgc2tvUGfvB6HI3P9KCoXu
RD6aG3y7Ds02ZUnLfsDc4k2ErctT+bRKeCTPnmoOrymyKNcZy7mNELWBHU1oYpSOja2+zP7Xgjvl
Xoc=
=5I18
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7255-1
February 05, 2025
openjdk-23 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
Summary:
OpenJDK 23 could be made to expose sensitive information over the
network.
Software Description:
- openjdk-23: Open Source Java implementation
Details:
It was discovered that the Hotspot component of OpenJDK 23 did not properly
handle API access under certain circumstances. An unauthenticated attacker
could possibly use this issue to access unauthorized resources and expose
sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
openjdk-23-jdk 23.0.2+7-1ubuntu1~24.10
openjdk-23-jdk-headless 23.0.2+7-1ubuntu1~24.10
openjdk-23-jre 23.0.2+7-1ubuntu1~24.10
openjdk-23-jre-headless 23.0.2+7-1ubuntu1~24.10
openjdk-23-jre-zero 23.0.2+7-1ubuntu1~24.10
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7255-1
CVE-2025-21502
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-23/23.0.2+7-1ubuntu1~24.10
[USN-7254-1] OpenJDK 21 vulnerability
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmejB2kFAwAAAAAACgkQWNrRIKaTkWdC
NBAAunzlRxl7gu0jQ8J/CzVSJM5pXDq/evW2JYiwQxtCqEuwXIa8h5OHDUVxe3k0Eafy/dK0qhv9
mFmO+/npxRvc7kO1Bslj0OFcU0V67Q4gJ6jtub39rLkBSn+U9c44Tcj1+JDerbyZ2jY+iZoxEvim
S1tzlKSm7i9KyZkYpZPZrWT5yWx0zgSFUXo748oS2ogAAv8XSYjZDNywvjU3MdPTTpUfeOwMkU3a
IbGD3bYHkwGJmSfHv+2OqIeQOyvddyNrEGJ8JUD1ekGXeiqF/ug+5lm5WE4rSetLHhxGOdKqyZ22
YN2LMizZInBz3PSKXC5UH1qmJ/7w3wGKdZ2wOC/chK8aezvGoST7lF2kwIKzJtdOw6tZ2IrnysnE
eDWLwlTo46la3wzyWTqiopC+V0dD2aYnjlBcSYM6VxlbB93BDWtC1X6SnGH8bQzdCxcI0eln2o0q
vFfUThABQfgw7c8ID+WtKeq9qnFbSL0RNonncSVUfVDI5Ago4EKdok1gT37akjgq9dDWV4YnLsiy
bSoqdMV6vJvHhFfzxl7fy3UwXw8vBXCuNJOliP+nJoqqXPfE58lYUpUDAr7Rbms/vUykLDAG8Zas
HWfRBmmqV2iokIPNe3KLmIk9j3OyMzGMt2HJ/PT0kGSi/+zLfvgNTe/NOxFgnRpLDv+rIAASuN52
Z6U=
=UTXf
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7254-1
February 05, 2025
openjdk-21 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
OpenJDK 21 could be made to expose sensitive information over the
network.
Software Description:
- openjdk-21: Open Source Java implementation
Details:
It was discovered that the Hotspot component of OpenJDK 21 did not properly
handle API access under certain circumstances. An unauthenticated attacker
could possibly use this issue to access unauthorized resources and expose
sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
openjdk-21-jdk 21.0.6+7-1~24.10.1
openjdk-21-jdk-headless 21.0.6+7-1~24.10.1
openjdk-21-jre 21.0.6+7-1~24.10.1
openjdk-21-jre-headless 21.0.6+7-1~24.10.1
openjdk-21-jre-zero 21.0.6+7-1~24.10.1
Ubuntu 24.04 LTS
openjdk-21-jdk 21.0.6+7-1~24.04.1
openjdk-21-jdk-headless 21.0.6+7-1~24.04.1
openjdk-21-jre 21.0.6+7-1~24.04.1
openjdk-21-jre-headless 21.0.6+7-1~24.04.1
openjdk-21-jre-zero 21.0.6+7-1~24.04.1
Ubuntu 22.04 LTS
openjdk-21-jdk 21.0.6+7-1~22.04.1
openjdk-21-jdk-headless 21.0.6+7-1~22.04.1
openjdk-21-jre 21.0.6+7-1~22.04.1
openjdk-21-jre-headless 21.0.6+7-1~22.04.1
openjdk-21-jre-zero 21.0.6+7-1~22.04.1
Ubuntu 20.04 LTS
openjdk-21-jdk 21.0.6+7-1~20.04.1
openjdk-21-jdk-headless 21.0.6+7-1~20.04.1
openjdk-21-jre 21.0.6+7-1~20.04.1
openjdk-21-jre-headless 21.0.6+7-1~20.04.1
openjdk-21-jre-zero 21.0.6+7-1~20.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7254-1
CVE-2025-21502
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.6+7-1~24.10.1
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.6+7-1~24.04.1
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.6+7-1~22.04.1
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.6+7-1~20.04.1
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmejB2kFAwAAAAAACgkQWNrRIKaTkWdC
NBAAunzlRxl7gu0jQ8J/CzVSJM5pXDq/evW2JYiwQxtCqEuwXIa8h5OHDUVxe3k0Eafy/dK0qhv9
mFmO+/npxRvc7kO1Bslj0OFcU0V67Q4gJ6jtub39rLkBSn+U9c44Tcj1+JDerbyZ2jY+iZoxEvim
S1tzlKSm7i9KyZkYpZPZrWT5yWx0zgSFUXo748oS2ogAAv8XSYjZDNywvjU3MdPTTpUfeOwMkU3a
IbGD3bYHkwGJmSfHv+2OqIeQOyvddyNrEGJ8JUD1ekGXeiqF/ug+5lm5WE4rSetLHhxGOdKqyZ22
YN2LMizZInBz3PSKXC5UH1qmJ/7w3wGKdZ2wOC/chK8aezvGoST7lF2kwIKzJtdOw6tZ2IrnysnE
eDWLwlTo46la3wzyWTqiopC+V0dD2aYnjlBcSYM6VxlbB93BDWtC1X6SnGH8bQzdCxcI0eln2o0q
vFfUThABQfgw7c8ID+WtKeq9qnFbSL0RNonncSVUfVDI5Ago4EKdok1gT37akjgq9dDWV4YnLsiy
bSoqdMV6vJvHhFfzxl7fy3UwXw8vBXCuNJOliP+nJoqqXPfE58lYUpUDAr7Rbms/vUykLDAG8Zas
HWfRBmmqV2iokIPNe3KLmIk9j3OyMzGMt2HJ/PT0kGSi/+zLfvgNTe/NOxFgnRpLDv+rIAASuN52
Z6U=
=UTXf
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7254-1
February 05, 2025
openjdk-21 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
OpenJDK 21 could be made to expose sensitive information over the
network.
Software Description:
- openjdk-21: Open Source Java implementation
Details:
It was discovered that the Hotspot component of OpenJDK 21 did not properly
handle API access under certain circumstances. An unauthenticated attacker
could possibly use this issue to access unauthorized resources and expose
sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
openjdk-21-jdk 21.0.6+7-1~24.10.1
openjdk-21-jdk-headless 21.0.6+7-1~24.10.1
openjdk-21-jre 21.0.6+7-1~24.10.1
openjdk-21-jre-headless 21.0.6+7-1~24.10.1
openjdk-21-jre-zero 21.0.6+7-1~24.10.1
Ubuntu 24.04 LTS
openjdk-21-jdk 21.0.6+7-1~24.04.1
openjdk-21-jdk-headless 21.0.6+7-1~24.04.1
openjdk-21-jre 21.0.6+7-1~24.04.1
openjdk-21-jre-headless 21.0.6+7-1~24.04.1
openjdk-21-jre-zero 21.0.6+7-1~24.04.1
Ubuntu 22.04 LTS
openjdk-21-jdk 21.0.6+7-1~22.04.1
openjdk-21-jdk-headless 21.0.6+7-1~22.04.1
openjdk-21-jre 21.0.6+7-1~22.04.1
openjdk-21-jre-headless 21.0.6+7-1~22.04.1
openjdk-21-jre-zero 21.0.6+7-1~22.04.1
Ubuntu 20.04 LTS
openjdk-21-jdk 21.0.6+7-1~20.04.1
openjdk-21-jdk-headless 21.0.6+7-1~20.04.1
openjdk-21-jre 21.0.6+7-1~20.04.1
openjdk-21-jre-headless 21.0.6+7-1~20.04.1
openjdk-21-jre-zero 21.0.6+7-1~20.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7254-1
CVE-2025-21502
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.6+7-1~24.10.1
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.6+7-1~24.04.1
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.6+7-1~22.04.1
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.6+7-1~20.04.1
[USN-7253-1] OpenJDK 17 vulnerability
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmejBd8FAwAAAAAACgkQWNrRIKaTkWcE
8hAAgl7YK5ikkGpNFeu/+m9dbeYH8oPpFYXMFqchsFi5vaiYn5THDKbAs41+kCXSn8lvPhEmdUAV
bBWbqIH8rK8EkTNQcKea//ssE8mD8iewiiu/VpkWAUGyHfcFFOtHT/MBanBOxaTcy06AerLJhTjw
hdNSMbH+niI57YZnf82yHqv1qBS/opLL6upia1Ip79f1mxNYYf68udqZu+IeVguj0LPtX8CVEIST
FEclcgzrAZ+MSdLL+IyNM4pSxwTGjvtunOvV/HE7p96ylQnuG3Us4JGM6Ag1TsQHEjWNOOgbi/aB
mMftUx7CzorZEYzyXqQVWnP1yGcdrHjia+ZkQnGoJgRO01nXO6LyFHCe8N6CA9uw9EYILwNtfnG6
HhNqP99VrssxCZZTn6ir6EXjSn6nBNhs/hlL1wcHe/hQdo/Y+GUHR2JS8JuS5dVd1dOR1YryCXn1
a88eTAWCqG1OJT7W3iFxR9d/h5NZeDOS84+U/gCinRBMY4wqlG8yL4Kt9Lb4rvpdYsVwHWsw236Y
v2Yvpmkw4TC3gm1Xcg2uAwj25uWbcAREYs3ivkU7288zzroB+qYS4chYbU3D3Rk/PxyCnXBJ9H0B
Qx5ydYmrw8JUS6bYinqXTrPK4ic7t7aszn8OjXn0S8ZZC+UquCLneImXr54G3MMyGA1cF9jwSwu+
tr0=
=gItC
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7253-1
February 05, 2025
openjdk-17 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
OpenJDK 17 could be made to expose sensitive information over the
network.
Software Description:
- openjdk-17: Open Source Java implementation
Details:
It was discovered that the Hotspot component of OpenJDK 17 did not properly
handle API access under certain circumstances. An unauthenticated attacker
could possibly use this issue to access unauthorized resources and expose
sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
openjdk-17-jdk 17.0.14+7-1~24.10
openjdk-17-jdk-headless 17.0.14+7-1~24.10
openjdk-17-jre 17.0.14+7-1~24.10
openjdk-17-jre-headless 17.0.14+7-1~24.10
openjdk-17-jre-zero 17.0.14+7-1~24.10
Ubuntu 24.04 LTS
openjdk-17-jdk 17.0.14+7-1~24.04
openjdk-17-jdk-headless 17.0.14+7-1~24.04
openjdk-17-jre 17.0.14+7-1~24.04
openjdk-17-jre-headless 17.0.14+7-1~24.04
openjdk-17-jre-zero 17.0.14+7-1~24.04
Ubuntu 22.04 LTS
openjdk-17-jdk 17.0.14+7-1~22.04.1
openjdk-17-jdk-headless 17.0.14+7-1~22.04.1
openjdk-17-jre 17.0.14+7-1~22.04.1
openjdk-17-jre-headless 17.0.14+7-1~22.04.1
openjdk-17-jre-zero 17.0.14+7-1~22.04.1
Ubuntu 20.04 LTS
openjdk-17-jdk 17.0.14+7-1~20.04
openjdk-17-jdk-headless 17.0.14+7-1~20.04
openjdk-17-jre 17.0.14+7-1~20.04
openjdk-17-jre-headless 17.0.14+7-1~20.04
openjdk-17-jre-zero 17.0.14+7-1~20.04
Ubuntu 18.04 LTS
openjdk-17-jdk 17.0.14+7-1~18.04
Available with Ubuntu Pro
openjdk-17-jdk-headless 17.0.14+7-1~18.04
Available with Ubuntu Pro
openjdk-17-jre 17.0.14+7-1~18.04
Available with Ubuntu Pro
openjdk-17-jre-headless 17.0.14+7-1~18.04
Available with Ubuntu Pro
openjdk-17-jre-zero 17.0.14+7-1~18.04
Available with Ubuntu Pro
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7253-1
CVE-2025-21502
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.14+7-1~24.10
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.14+7-1~24.04
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.14+7-1~22.04.1
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.14+7-1~20.04
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmejBd8FAwAAAAAACgkQWNrRIKaTkWcE
8hAAgl7YK5ikkGpNFeu/+m9dbeYH8oPpFYXMFqchsFi5vaiYn5THDKbAs41+kCXSn8lvPhEmdUAV
bBWbqIH8rK8EkTNQcKea//ssE8mD8iewiiu/VpkWAUGyHfcFFOtHT/MBanBOxaTcy06AerLJhTjw
hdNSMbH+niI57YZnf82yHqv1qBS/opLL6upia1Ip79f1mxNYYf68udqZu+IeVguj0LPtX8CVEIST
FEclcgzrAZ+MSdLL+IyNM4pSxwTGjvtunOvV/HE7p96ylQnuG3Us4JGM6Ag1TsQHEjWNOOgbi/aB
mMftUx7CzorZEYzyXqQVWnP1yGcdrHjia+ZkQnGoJgRO01nXO6LyFHCe8N6CA9uw9EYILwNtfnG6
HhNqP99VrssxCZZTn6ir6EXjSn6nBNhs/hlL1wcHe/hQdo/Y+GUHR2JS8JuS5dVd1dOR1YryCXn1
a88eTAWCqG1OJT7W3iFxR9d/h5NZeDOS84+U/gCinRBMY4wqlG8yL4Kt9Lb4rvpdYsVwHWsw236Y
v2Yvpmkw4TC3gm1Xcg2uAwj25uWbcAREYs3ivkU7288zzroB+qYS4chYbU3D3Rk/PxyCnXBJ9H0B
Qx5ydYmrw8JUS6bYinqXTrPK4ic7t7aszn8OjXn0S8ZZC+UquCLneImXr54G3MMyGA1cF9jwSwu+
tr0=
=gItC
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7253-1
February 05, 2025
openjdk-17 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
OpenJDK 17 could be made to expose sensitive information over the
network.
Software Description:
- openjdk-17: Open Source Java implementation
Details:
It was discovered that the Hotspot component of OpenJDK 17 did not properly
handle API access under certain circumstances. An unauthenticated attacker
could possibly use this issue to access unauthorized resources and expose
sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
openjdk-17-jdk 17.0.14+7-1~24.10
openjdk-17-jdk-headless 17.0.14+7-1~24.10
openjdk-17-jre 17.0.14+7-1~24.10
openjdk-17-jre-headless 17.0.14+7-1~24.10
openjdk-17-jre-zero 17.0.14+7-1~24.10
Ubuntu 24.04 LTS
openjdk-17-jdk 17.0.14+7-1~24.04
openjdk-17-jdk-headless 17.0.14+7-1~24.04
openjdk-17-jre 17.0.14+7-1~24.04
openjdk-17-jre-headless 17.0.14+7-1~24.04
openjdk-17-jre-zero 17.0.14+7-1~24.04
Ubuntu 22.04 LTS
openjdk-17-jdk 17.0.14+7-1~22.04.1
openjdk-17-jdk-headless 17.0.14+7-1~22.04.1
openjdk-17-jre 17.0.14+7-1~22.04.1
openjdk-17-jre-headless 17.0.14+7-1~22.04.1
openjdk-17-jre-zero 17.0.14+7-1~22.04.1
Ubuntu 20.04 LTS
openjdk-17-jdk 17.0.14+7-1~20.04
openjdk-17-jdk-headless 17.0.14+7-1~20.04
openjdk-17-jre 17.0.14+7-1~20.04
openjdk-17-jre-headless 17.0.14+7-1~20.04
openjdk-17-jre-zero 17.0.14+7-1~20.04
Ubuntu 18.04 LTS
openjdk-17-jdk 17.0.14+7-1~18.04
Available with Ubuntu Pro
openjdk-17-jdk-headless 17.0.14+7-1~18.04
Available with Ubuntu Pro
openjdk-17-jre 17.0.14+7-1~18.04
Available with Ubuntu Pro
openjdk-17-jre-headless 17.0.14+7-1~18.04
Available with Ubuntu Pro
openjdk-17-jre-zero 17.0.14+7-1~18.04
Available with Ubuntu Pro
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7253-1
CVE-2025-21502
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.14+7-1~24.10
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.14+7-1~24.04
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.14+7-1~22.04.1
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.14+7-1~20.04
[USN-7252-1] OpenJDK 11 vulnerability
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmejBZwFAwAAAAAACgkQWNrRIKaTkWfw
gA//e7MKY/iNQcr5hJQ4x8JcNEm+T+4+0rFE6u3ibe5N5nNkmuItwas/hri5U8h83YdZ70CKB5nU
rGQAgzH+idjISaFFF9nSxhCnzVttZ5KXSmdhjm6j6me8HHhzmswWlot8tvR/CXNiOiBL1EYgZbi9
oVKcrGaHSmOSTW5eP5wG9XPd4Tq3VfPp34WKMWrCGWWQhhB5xPN2itjmQpJ2HR9g6JWEynve0syK
xrzSJ+Z6KllrcIreHW/AFAsOGHTGnORvCEvp5tvS6+aHOaOlRcA0H390x8k8N5/9hFK9t1kn5TPi
X2ZYcI6gWlXoSSt8kzMc+Hnj5cDcxdFF+0eui/pTMTrT4ECxXK6vZPBHmNm02p7bg1HGBEI1Ub5b
pAdCq2xtNrzxBQ/3luhLUk8ZUWs1R/qOYpTXGCGuI4ai4PsNIOl03nMWvPxG2clnd//MSY/zzWjm
jfXvKRr0gMr07XgOazpUF/YD5ipKiv56Gxh1XI2zKfnLhJWAbDq6E6ntXh/14rbdsWIYBg8LOnZ1
xN28iGb52VQccTLhHpCHsMm26wgm+6kLsQiHXYrI0kf3XofMqXbLDb/4qcuXSijqh0BRQSinSHqs
m1zVR87TJGP0x2eJnrcuk0KnRlfEZfYgivQ0w/3ox7GKgg2H/bfsoqOMPCZ6RIqVN+N8ZcrejxN9
tEM=
=/URW
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7252-1
February 05, 2025
openjdk-lts vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
OpenJDK 11 could be made to expose sensitive information over the
network.
Software Description:
- openjdk-lts: Open Source Java implementation
Details:
It was discovered that the Hotspot component of OpenJDK 11 did not properly
handle API access under certain circumstances. An unauthenticated attacker
could possibly use this issue to access unauthorized resources and expose
sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
openjdk-11-jdk 11.0.26+4-1ubuntu1~24.10
openjdk-11-jdk-headless 11.0.26+4-1ubuntu1~24.10
openjdk-11-jre 11.0.26+4-1ubuntu1~24.10
openjdk-11-jre-headless 11.0.26+4-1ubuntu1~24.10
openjdk-11-jre-zero 11.0.26+4-1ubuntu1~24.10
Ubuntu 24.04 LTS
openjdk-11-jdk 11.0.26+4-1ubuntu1~24.04
openjdk-11-jdk-headless 11.0.26+4-1ubuntu1~24.04
openjdk-11-jre 11.0.26+4-1ubuntu1~24.04
openjdk-11-jre-headless 11.0.26+4-1ubuntu1~24.04
openjdk-11-jre-zero 11.0.26+4-1ubuntu1~24.04
Ubuntu 22.04 LTS
openjdk-11-jdk 11.0.26+4-1ubuntu1~22.04
openjdk-11-jdk-headless 11.0.26+4-1ubuntu1~22.04
openjdk-11-jre 11.0.26+4-1ubuntu1~22.04
openjdk-11-jre-headless 11.0.26+4-1ubuntu1~22.04
openjdk-11-jre-zero 11.0.26+4-1ubuntu1~22.04
Ubuntu 20.04 LTS
openjdk-11-jdk 11.0.26+4-1ubuntu1~20.04
openjdk-11-jdk-headless 11.0.26+4-1ubuntu1~20.04
openjdk-11-jre 11.0.26+4-1ubuntu1~20.04
openjdk-11-jre-headless 11.0.26+4-1ubuntu1~20.04
openjdk-11-jre-zero 11.0.26+4-1ubuntu1~20.04
Ubuntu 18.04 LTS
openjdk-11-jdk 11.0.26+4-1ubuntu1~18.04
Available with Ubuntu Pro
openjdk-11-jdk-headless 11.0.26+4-1ubuntu1~18.04
Available with Ubuntu Pro
openjdk-11-jre 11.0.26+4-1ubuntu1~18.04
Available with Ubuntu Pro
openjdk-11-jre-headless 11.0.26+4-1ubuntu1~18.04
Available with Ubuntu Pro
openjdk-11-jre-zero 11.0.26+4-1ubuntu1~18.04
Available with Ubuntu Pro
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7252-1
CVE-2025-21502
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.26+4-1ubuntu1~24.10
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.26+4-1ubuntu1~24.04
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.26+4-1ubuntu1~22.04
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.26+4-1ubuntu1~20.04
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmejBZwFAwAAAAAACgkQWNrRIKaTkWfw
gA//e7MKY/iNQcr5hJQ4x8JcNEm+T+4+0rFE6u3ibe5N5nNkmuItwas/hri5U8h83YdZ70CKB5nU
rGQAgzH+idjISaFFF9nSxhCnzVttZ5KXSmdhjm6j6me8HHhzmswWlot8tvR/CXNiOiBL1EYgZbi9
oVKcrGaHSmOSTW5eP5wG9XPd4Tq3VfPp34WKMWrCGWWQhhB5xPN2itjmQpJ2HR9g6JWEynve0syK
xrzSJ+Z6KllrcIreHW/AFAsOGHTGnORvCEvp5tvS6+aHOaOlRcA0H390x8k8N5/9hFK9t1kn5TPi
X2ZYcI6gWlXoSSt8kzMc+Hnj5cDcxdFF+0eui/pTMTrT4ECxXK6vZPBHmNm02p7bg1HGBEI1Ub5b
pAdCq2xtNrzxBQ/3luhLUk8ZUWs1R/qOYpTXGCGuI4ai4PsNIOl03nMWvPxG2clnd//MSY/zzWjm
jfXvKRr0gMr07XgOazpUF/YD5ipKiv56Gxh1XI2zKfnLhJWAbDq6E6ntXh/14rbdsWIYBg8LOnZ1
xN28iGb52VQccTLhHpCHsMm26wgm+6kLsQiHXYrI0kf3XofMqXbLDb/4qcuXSijqh0BRQSinSHqs
m1zVR87TJGP0x2eJnrcuk0KnRlfEZfYgivQ0w/3ox7GKgg2H/bfsoqOMPCZ6RIqVN+N8ZcrejxN9
tEM=
=/URW
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7252-1
February 05, 2025
openjdk-lts vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
OpenJDK 11 could be made to expose sensitive information over the
network.
Software Description:
- openjdk-lts: Open Source Java implementation
Details:
It was discovered that the Hotspot component of OpenJDK 11 did not properly
handle API access under certain circumstances. An unauthenticated attacker
could possibly use this issue to access unauthorized resources and expose
sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
openjdk-11-jdk 11.0.26+4-1ubuntu1~24.10
openjdk-11-jdk-headless 11.0.26+4-1ubuntu1~24.10
openjdk-11-jre 11.0.26+4-1ubuntu1~24.10
openjdk-11-jre-headless 11.0.26+4-1ubuntu1~24.10
openjdk-11-jre-zero 11.0.26+4-1ubuntu1~24.10
Ubuntu 24.04 LTS
openjdk-11-jdk 11.0.26+4-1ubuntu1~24.04
openjdk-11-jdk-headless 11.0.26+4-1ubuntu1~24.04
openjdk-11-jre 11.0.26+4-1ubuntu1~24.04
openjdk-11-jre-headless 11.0.26+4-1ubuntu1~24.04
openjdk-11-jre-zero 11.0.26+4-1ubuntu1~24.04
Ubuntu 22.04 LTS
openjdk-11-jdk 11.0.26+4-1ubuntu1~22.04
openjdk-11-jdk-headless 11.0.26+4-1ubuntu1~22.04
openjdk-11-jre 11.0.26+4-1ubuntu1~22.04
openjdk-11-jre-headless 11.0.26+4-1ubuntu1~22.04
openjdk-11-jre-zero 11.0.26+4-1ubuntu1~22.04
Ubuntu 20.04 LTS
openjdk-11-jdk 11.0.26+4-1ubuntu1~20.04
openjdk-11-jdk-headless 11.0.26+4-1ubuntu1~20.04
openjdk-11-jre 11.0.26+4-1ubuntu1~20.04
openjdk-11-jre-headless 11.0.26+4-1ubuntu1~20.04
openjdk-11-jre-zero 11.0.26+4-1ubuntu1~20.04
Ubuntu 18.04 LTS
openjdk-11-jdk 11.0.26+4-1ubuntu1~18.04
Available with Ubuntu Pro
openjdk-11-jdk-headless 11.0.26+4-1ubuntu1~18.04
Available with Ubuntu Pro
openjdk-11-jre 11.0.26+4-1ubuntu1~18.04
Available with Ubuntu Pro
openjdk-11-jre-headless 11.0.26+4-1ubuntu1~18.04
Available with Ubuntu Pro
openjdk-11-jre-zero 11.0.26+4-1ubuntu1~18.04
Available with Ubuntu Pro
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7252-1
CVE-2025-21502
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.26+4-1ubuntu1~24.10
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.26+4-1ubuntu1~24.04
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.26+4-1ubuntu1~22.04
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.26+4-1ubuntu1~20.04
[USN-7096-2] OpenJDK 8 regressions
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmejBWIFAwAAAAAACgkQWNrRIKaTkWfP
FA//aN1dcmZUVv1DP3RAd4ZfXT2MckS7JcHM1gwA6aPy8OLPU69oiUnhpZsrRHH9C/RY8cUfnosS
0wXBPNagrx8CXxuQF3z+lxCrji9+x+1SkiH4UpxanazKKNqvS8P4DECwy70xm9jCUvE1Hhkvq8Qx
qOioSnxVRLdhmAlBakTGoLVdr9LMiWmGW6KCmGupMv3wUSpW4OMEeKHculDjBl0oudXHUKqWIYdd
Fq5W4Pvyexoiy1kdr6qgjADG/5BqgFSilpvBAmW/LeLlnUjRwWvGi98DaQ7AIv8wKE9MZDURjhS6
k4HTmmgjDwjj6+boI4/JHHo2bIgklEghLsIve0qrTlBjnHXkJsV256EloGrcDVqtV7N9GT5EfVOe
R8fcKdYFunvWPGXKStkWUYWsMd+RY2E/Nk06AlIGQKNUfJXyJFR6omJFilvLMIk24D0uOOD4WG9e
c6cVGqjrBKfDtPc2wWmwbEO+3X793wh3xmWBQ7hxeDKejhuIrQVqUKMWf/Kw0Hz2vMGGhM1IX99a
uHeCUyhBn3sB5NP/wL02XsEY+rf5h7OQdYJfP4n5+KcKJ6kHwpsPMtHHiA7PS1RWScZtHOUv8l/o
/N+Bv2AC9G7DTPynNe7FYbqLPLSSIaMIIeU5nM+YVMSbRV1oqBbqb6I/WiJjMWIShdVSefAPfix8
ofg=
=WJyG
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7096-2
February 05, 2025
openjdk-8 regressions
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
USN-7096-1 caused some minor regressions in OpenJDK 8.
Software Description:
- openjdk-8: Open Source Java implementation
Details:
USN-7096-1 fixed vulnerabilities in OpenJDK 8. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Andy Boothe discovered that the Networking component of OpenJDK 8 did not
properly handle access under certain circumstances. An unauthenticated
attacker could possibly use this issue to cause a denial of service.
(CVE-2024-21208)
It was discovered that the Hotspot component of OpenJDK 8 did not properly
handle vectorization under certain circumstances. An unauthenticated
attacker could possibly use this issue to access unauthorized resources
and expose sensitive information. (CVE-2024-21210, CVE-2024-21235)
It was discovered that the Serialization component of OpenJDK 8 did not
properly handle deserialization under certain circumstances. An
unauthenticated attacker could possibly use this issue to cause a denial
of service. (CVE-2024-21217)
It was discovered that the Hotspot component of OpenJDK 8 was not properly
bounding certain UTF-8 strings, which could lead to a buffer overflow. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue was only addressed in Ubuntu 16.04 LTS.
(CVE-2024-21131)
It was discovered that the Hotspot component of OpenJDK 8 could be made to
run into an infinite loop. If an automated system were tricked into
processing excessively large symbols, an attacker could possibly use this
issue to cause a denial of service. This issue was only addressed in
Ubuntu 16.04 LTS. (CVE-2024-21138)
It was discovered that the Hotspot component of OpenJDK 8 did not properly
perform range check elimination. An attacker could possibly use this issue
to cause a denial of service, execute arbitrary code or bypass Java
sandbox restrictions. This issue was only addressed in Ubuntu 16.04 LTS.
(CVE-2024-21140)
Yakov Shafranovich discovered that the Concurrency component of OpenJDK 8
incorrectly performed header validation in the Pack200 archive format. An
attacker could possibly use this issue to cause a denial of service. This
issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21144)
Sergey Bylokhov discovered that OpenJDK 8 did not properly manage memory
when handling 2D images. An attacker could possibly use this issue to
obtain sensitive information. This issue was only addressed in Ubuntu
16.04 LTS. (CVE-2024-21145)
It was discovered that the Hotspot component of OpenJDK 8 incorrectly
handled memory when performing range check elimination under certain
circumstances. An attacker could possibly use this issue to cause a
denial of service, execute arbitrary code or bypass Java sandbox
restrictions. This issue was only addressed in Ubuntu 16.04 LTS.
(CVE-2024-21147)
It was discovered that the Hotspot component of OpenJDK 8 incorrectly
handled certain exceptions with specially crafted long messages. An
attacker could possibly use this issue to cause a denial of service.
This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21011)
Vladimir Kondratyev discovered that the Hotspot component of OpenJDK 8
incorrectly handled address offset calculations in the C1 compiler. An
attacker could possibly use this issue to cause a denial of service
or execute arbitrary code. This issue was only addressed in Ubuntu
16.04 LTS. (CVE-2024-21068)
Yakov Shafranovich discovered that OpenJDK 8 did not properly manage
memory in the Pack200 archive format. An attacker could possibly use this
issue to cause a denial of service. This issue was only addressed in
Ubuntu 16.04 LTS. (CVE-2024-21085)
It was discovered that the Hotspot component of OpenJDK 8 incorrectly
handled array accesses in the C2 compiler. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code. This
issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21094)
Yi Yang discovered that the Hotspot component of OpenJDK 8 incorrectly
handled array accesses in the C1 compiler. An attacker could possibly
use this issue to cause a denial of service, execute arbitrary code or
bypass Java sandbox restrictions. This issue was only addressed in Ubuntu
16.04 LTS. (CVE-2024-20918)
It was discovered that the Hotspot component of OpenJDK 8 did not
properly verify bytecode in certain situations. An attacker could
possibly use this issue to bypass Java sandbox restrictions. This
issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-20919)
It was discovered that the Hotspot component of OpenJDK 8 had an
optimization flaw when generating range check loop predicates. An attacker
could possibly use this issue to cause a denial of service, execute
arbitrary code or bypass Java sandbox restrictions. This issue was only
addressed in Ubuntu 16.04 LTS. (CVE-2024-20921)
Valentin Eudeline discovered that OpenJDK 8 incorrectly handled certain
options in the Nashorn JavaScript subcomponent. An attacker could
possibly use this issue to execute arbitrary code. This issue was only
addressed in Ubuntu 16.04 LTS. (CVE-2024-20926)
It was discovered that OpenJDK 8 could produce debug logs that contained
private keys used for digital signatures. An attacker could possibly use
this issue to obtain sensitive information. This issue was only addressed
in Ubuntu 16.04 LTS. (CVE-2024-20945)
Hubert Kario discovered that the TLS implementation in OpenJDK 8 had a
timing side-channel and incorrectly handled RSA padding. A remote attacker
could possibly use this issue to recover sensitive information. This
issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-20952)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~24.10
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~24.10
openjdk-8-jre 8u442-b06~us1-0ubuntu1~24.10
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~24.10
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~24.10
Ubuntu 24.04 LTS
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~24.04
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~24.04
openjdk-8-jre 8u442-b06~us1-0ubuntu1~24.04
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~24.04
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~24.04
Ubuntu 22.04 LTS
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~22.04
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~22.04
openjdk-8-jre 8u442-b06~us1-0ubuntu1~22.04
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~22.04
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~22.04
Ubuntu 20.04 LTS
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~20.04
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~20.04
openjdk-8-jre 8u442-b06~us1-0ubuntu1~20.04
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~20.04
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~20.04
Ubuntu 18.04 LTS
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~18.04
Available with Ubuntu Pro
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~18.04
Available with Ubuntu Pro
openjdk-8-jre 8u442-b06~us1-0ubuntu1~18.04
Available with Ubuntu Pro
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~18.04
Available with Ubuntu Pro
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~18.04
Available with Ubuntu Pro
Ubuntu 16.04 LTS
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
openjdk-8-jre 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
openjdk-8-jre-jamvm 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7096-2
https://ubuntu.com/security/notices/USN-7096-1
https://launchpad.net/bugs/2097400
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-8/8u442-b06~us1-0ubuntu1~24.10
https://launchpad.net/ubuntu/+source/openjdk-8/8u442-b06~us1-0ubuntu1~24.04
https://launchpad.net/ubuntu/+source/openjdk-8/8u442-b06~us1-0ubuntu1~22.04
https://launchpad.net/ubuntu/+source/openjdk-8/8u442-b06~us1-0ubuntu1~20.04
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmejBWIFAwAAAAAACgkQWNrRIKaTkWfP
FA//aN1dcmZUVv1DP3RAd4ZfXT2MckS7JcHM1gwA6aPy8OLPU69oiUnhpZsrRHH9C/RY8cUfnosS
0wXBPNagrx8CXxuQF3z+lxCrji9+x+1SkiH4UpxanazKKNqvS8P4DECwy70xm9jCUvE1Hhkvq8Qx
qOioSnxVRLdhmAlBakTGoLVdr9LMiWmGW6KCmGupMv3wUSpW4OMEeKHculDjBl0oudXHUKqWIYdd
Fq5W4Pvyexoiy1kdr6qgjADG/5BqgFSilpvBAmW/LeLlnUjRwWvGi98DaQ7AIv8wKE9MZDURjhS6
k4HTmmgjDwjj6+boI4/JHHo2bIgklEghLsIve0qrTlBjnHXkJsV256EloGrcDVqtV7N9GT5EfVOe
R8fcKdYFunvWPGXKStkWUYWsMd+RY2E/Nk06AlIGQKNUfJXyJFR6omJFilvLMIk24D0uOOD4WG9e
c6cVGqjrBKfDtPc2wWmwbEO+3X793wh3xmWBQ7hxeDKejhuIrQVqUKMWf/Kw0Hz2vMGGhM1IX99a
uHeCUyhBn3sB5NP/wL02XsEY+rf5h7OQdYJfP4n5+KcKJ6kHwpsPMtHHiA7PS1RWScZtHOUv8l/o
/N+Bv2AC9G7DTPynNe7FYbqLPLSSIaMIIeU5nM+YVMSbRV1oqBbqb6I/WiJjMWIShdVSefAPfix8
ofg=
=WJyG
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7096-2
February 05, 2025
openjdk-8 regressions
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
USN-7096-1 caused some minor regressions in OpenJDK 8.
Software Description:
- openjdk-8: Open Source Java implementation
Details:
USN-7096-1 fixed vulnerabilities in OpenJDK 8. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Andy Boothe discovered that the Networking component of OpenJDK 8 did not
properly handle access under certain circumstances. An unauthenticated
attacker could possibly use this issue to cause a denial of service.
(CVE-2024-21208)
It was discovered that the Hotspot component of OpenJDK 8 did not properly
handle vectorization under certain circumstances. An unauthenticated
attacker could possibly use this issue to access unauthorized resources
and expose sensitive information. (CVE-2024-21210, CVE-2024-21235)
It was discovered that the Serialization component of OpenJDK 8 did not
properly handle deserialization under certain circumstances. An
unauthenticated attacker could possibly use this issue to cause a denial
of service. (CVE-2024-21217)
It was discovered that the Hotspot component of OpenJDK 8 was not properly
bounding certain UTF-8 strings, which could lead to a buffer overflow. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue was only addressed in Ubuntu 16.04 LTS.
(CVE-2024-21131)
It was discovered that the Hotspot component of OpenJDK 8 could be made to
run into an infinite loop. If an automated system were tricked into
processing excessively large symbols, an attacker could possibly use this
issue to cause a denial of service. This issue was only addressed in
Ubuntu 16.04 LTS. (CVE-2024-21138)
It was discovered that the Hotspot component of OpenJDK 8 did not properly
perform range check elimination. An attacker could possibly use this issue
to cause a denial of service, execute arbitrary code or bypass Java
sandbox restrictions. This issue was only addressed in Ubuntu 16.04 LTS.
(CVE-2024-21140)
Yakov Shafranovich discovered that the Concurrency component of OpenJDK 8
incorrectly performed header validation in the Pack200 archive format. An
attacker could possibly use this issue to cause a denial of service. This
issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21144)
Sergey Bylokhov discovered that OpenJDK 8 did not properly manage memory
when handling 2D images. An attacker could possibly use this issue to
obtain sensitive information. This issue was only addressed in Ubuntu
16.04 LTS. (CVE-2024-21145)
It was discovered that the Hotspot component of OpenJDK 8 incorrectly
handled memory when performing range check elimination under certain
circumstances. An attacker could possibly use this issue to cause a
denial of service, execute arbitrary code or bypass Java sandbox
restrictions. This issue was only addressed in Ubuntu 16.04 LTS.
(CVE-2024-21147)
It was discovered that the Hotspot component of OpenJDK 8 incorrectly
handled certain exceptions with specially crafted long messages. An
attacker could possibly use this issue to cause a denial of service.
This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21011)
Vladimir Kondratyev discovered that the Hotspot component of OpenJDK 8
incorrectly handled address offset calculations in the C1 compiler. An
attacker could possibly use this issue to cause a denial of service
or execute arbitrary code. This issue was only addressed in Ubuntu
16.04 LTS. (CVE-2024-21068)
Yakov Shafranovich discovered that OpenJDK 8 did not properly manage
memory in the Pack200 archive format. An attacker could possibly use this
issue to cause a denial of service. This issue was only addressed in
Ubuntu 16.04 LTS. (CVE-2024-21085)
It was discovered that the Hotspot component of OpenJDK 8 incorrectly
handled array accesses in the C2 compiler. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code. This
issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21094)
Yi Yang discovered that the Hotspot component of OpenJDK 8 incorrectly
handled array accesses in the C1 compiler. An attacker could possibly
use this issue to cause a denial of service, execute arbitrary code or
bypass Java sandbox restrictions. This issue was only addressed in Ubuntu
16.04 LTS. (CVE-2024-20918)
It was discovered that the Hotspot component of OpenJDK 8 did not
properly verify bytecode in certain situations. An attacker could
possibly use this issue to bypass Java sandbox restrictions. This
issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-20919)
It was discovered that the Hotspot component of OpenJDK 8 had an
optimization flaw when generating range check loop predicates. An attacker
could possibly use this issue to cause a denial of service, execute
arbitrary code or bypass Java sandbox restrictions. This issue was only
addressed in Ubuntu 16.04 LTS. (CVE-2024-20921)
Valentin Eudeline discovered that OpenJDK 8 incorrectly handled certain
options in the Nashorn JavaScript subcomponent. An attacker could
possibly use this issue to execute arbitrary code. This issue was only
addressed in Ubuntu 16.04 LTS. (CVE-2024-20926)
It was discovered that OpenJDK 8 could produce debug logs that contained
private keys used for digital signatures. An attacker could possibly use
this issue to obtain sensitive information. This issue was only addressed
in Ubuntu 16.04 LTS. (CVE-2024-20945)
Hubert Kario discovered that the TLS implementation in OpenJDK 8 had a
timing side-channel and incorrectly handled RSA padding. A remote attacker
could possibly use this issue to recover sensitive information. This
issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-20952)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~24.10
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~24.10
openjdk-8-jre 8u442-b06~us1-0ubuntu1~24.10
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~24.10
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~24.10
Ubuntu 24.04 LTS
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~24.04
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~24.04
openjdk-8-jre 8u442-b06~us1-0ubuntu1~24.04
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~24.04
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~24.04
Ubuntu 22.04 LTS
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~22.04
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~22.04
openjdk-8-jre 8u442-b06~us1-0ubuntu1~22.04
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~22.04
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~22.04
Ubuntu 20.04 LTS
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~20.04
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~20.04
openjdk-8-jre 8u442-b06~us1-0ubuntu1~20.04
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~20.04
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~20.04
Ubuntu 18.04 LTS
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~18.04
Available with Ubuntu Pro
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~18.04
Available with Ubuntu Pro
openjdk-8-jre 8u442-b06~us1-0ubuntu1~18.04
Available with Ubuntu Pro
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~18.04
Available with Ubuntu Pro
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~18.04
Available with Ubuntu Pro
Ubuntu 16.04 LTS
openjdk-8-jdk 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
openjdk-8-jdk-headless 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
openjdk-8-jre 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
openjdk-8-jre-headless 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
openjdk-8-jre-jamvm 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
openjdk-8-jre-zero 8u442-b06~us1-0ubuntu1~16.04
Available with Ubuntu Pro
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7096-2
https://ubuntu.com/security/notices/USN-7096-1
https://launchpad.net/bugs/2097400
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-8/8u442-b06~us1-0ubuntu1~24.10
https://launchpad.net/ubuntu/+source/openjdk-8/8u442-b06~us1-0ubuntu1~24.04
https://launchpad.net/ubuntu/+source/openjdk-8/8u442-b06~us1-0ubuntu1~22.04
https://launchpad.net/ubuntu/+source/openjdk-8/8u442-b06~us1-0ubuntu1~20.04
Subscribe to:
Posts (Atom)