https://fedoraproject.org/wiki/Changes/golang1.17
== Summary ==
Rebase of Golang package to upcoming version 1.17 in Fedora 35,
including the rebuild of all dependent packages(the pre-release
version of Go will be used for the rebuild if released version will
not be available at the time of the mass rebuild).
== Owner ==
* Name: [[User:alexsaezm| Alejandro Sáez Morollón]], [[User:Jcajka|
Jakub Čajka]]
* Email: asm@redhat.com, jcajka@redhat.com
== Detailed Description ==
Rebase of Golang package to upcoming version 1.17 in Fedora 35. Golang
1.17 is scheduled to be released in August 2021.
Due to Go packages' current nature and state, the rebuild of dependent
packages will be required.
== Benefit to Fedora ==
Stay closely behind upstream by providing the latest release of Go,
which includes improved support of the risc-v processor architecture
and added support for aarch64 based darwin(macOS) machines, among
other bug fixes, enhancements and new features. For a complete list of
changes, see upstream change notes at
https://tip.golang.org/doc/go1.17 . Therefore Fedora will be providing
a reliable development platform for Go language and projects written
in it.
== Scope ==
* Proposal owners: Rebase Golang package in Fedora 35, help resolve
possible issues found during package rebuilds.
* Other developers: Fix possible issues, with help from Golang maintainers.
* Release engineering: Rebuild of dependent packages as part of
planned mass-rebuild.
* Policies and guidelines: N/A
* Trademark approval: N/A
== Upgrade/compatibility impact ==
None
== How To Test ==
;0.
:a) Install golang 1.17 from rawhide and use it to build your
application(s)/package(s).
:b) Scratch build against rawhide.
;1.
:Your application/package built using golang 1.17 should work as expected.
== User Experience ==
None
== Dependencies ==
<pre>
dnf repoquery -q --releasever=rawhide --disablerepo='*'
--qf='%{name}' --enablerepo=fedora-source --enablerepo=updates-source
--enablerepo=updates-testing-source --archlist=src --whatrequires
'golang'
dnf repoquery -q --releasever=rawhide --disablerepo='*'
--qf='%{name}' --enablerepo=fedora-source --enablerepo=updates-source
--enablerepo=updates-testing-source --archlist=src --whatrequires
'compiler(go-compiler)'
dnf repoquery -q --releasever=rawhide --disablerepo='*'
--qf='%{name}' --enablerepo=fedora-source --enablerepo=updates-source
--enablerepo=updates-testing-source --archlist=src --whatrequires
'compiler(golang)'
dnf repoquery -q --releasever=rawhide --disablerepo='*'
--qf='%{name}' --enablerepo=fedora-source --enablerepo=updates-source
--enablerepo=updates-testing-source --archlist=src --whatrequires
'go-rpm-macros'
</pre>
<pre>
Omitted due to the number of packages listed ~1600.
</pre>
Not all of listed require re-build as they might not ship binaries
and/or do not use golang compiler during build, but only use Go rpm
macros that pull it in to every build root.
== Contingency Plan ==
* Contingency mechanism:Reverting to golang version 1.16.X if
significant issues are discovered.
* Contingency deadline: Beta Freeze
* Blocks release? No
* Blocks product? No
== Documentation ==
https://tip.golang.org/doc/go1.17
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
Monday, June 28, 2021
F35 Change: Rebase firewalld to upstream v1.0.0 (System-Wide Change proposal)
https://fedoraproject.org/wiki/Changes/firewalld-1.0.0
== Summary ==
Firewalld upstream is about to release v1.0.0. As indicated by the
major version bump this includes behavioral changes.
== Owner ==
* Name: [[User:erig0| Eric Garver]]
* Email: egarver@redhat.com
== Detailed Description ==
Firewalld v1.0.0 includes breaking changes meant to improve the
overall health of the project. The majority of the changes are
centered around improving and strengthening the zone concept. All
breaking changes are detailed in depth in the
[https://firewalld.org/2021/06/the-upcoming-1-0-0 upstream blog].
Major changes:
* Reduced dependencies
* Intra-zone forwarding by default
* NAT rules moved to inet family (reduced rule set)
* Default target is now similar to reject
* ICMP blocks and block inversion only apply to input, not forward
* tftp-client service has been removed
* iptables backend is deprecated
* Direct interface is deprecated
* CleanupModulesOnExit defaults to no (kernel modules not unloaded)
== Benefit to Fedora ==
The major benefit to Fedora is more predictability in the stock
firewall. In particular, "Default target is now similar to reject"
addresses many subtle issues encountered by users. "NAT rules moved to
inet family" also significantly reduces the rule set size for users of
`ipset`s.
== Scope ==
* Proposal owners: Changes are isolated to firewalld, but given
firewalld is core a System Wide Change is being filed.
* Other developers: None. Isolated change.
* Release engineering:
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
* Most configurations will migrate. No intervention required.
** Exceptions
*** configurations that utilize `tftp-client` service will have
firewalld start in `failed` state because the service has been
removed. As noted in the upstream blog this service has ''never''
worked properly.
* Zones that users have not modified will now have intra-zone
forwarding enabled.
** for this to occur the user must ''not'' have added an interface,
service, port, etc. to the zone
** minimal concern because this also means the zone was not in use,
the exception being an unmodified default zone, e.g.
`FedoraWorkstation`
== How To Test ==
Testing for this rebase should revolve around integrations.
* libvirt
** verify VMs still have network access
* podman
** verify containers still have network access
** verify forwarding ports via podman still works
* NetworkManager
** verify connection sharing still works
== User Experience ==
N/A
== Dependencies ==
firewalld has yet to release v1.0.0. It is expected in early July.
== Contingency Plan ==
* Contingency mechanism: revert package to v0.9.z (what f34 uses)
* Contingency deadline: July 27, 2021
* Blocks release? No
== Documentation ==
https://firewalld.org/2021/06/the-upcoming-1-0-0
== Release Notes ==
firewalld has been rebased to v1.0.0. This includes some breaking
changes that may affect users.
Major changes:
* Reduced dependencies
* Intra-zone forwarding by default
* NAT rules moved to inet family (reduced rule set)
* Default target is now similar to reject
* ICMP blocks and block inversion only apply to input, not forward
* tftp-client service has been removed
* iptables backend is deprecated
* Direct interface is deprecated
* CleanupModulesOnExit defaults to no (kernel modules not unloaded)
Full details on the upstream blog:
https://firewalld.org/2021/06/the-upcoming-1-0-0
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
== Summary ==
Firewalld upstream is about to release v1.0.0. As indicated by the
major version bump this includes behavioral changes.
== Owner ==
* Name: [[User:erig0| Eric Garver]]
* Email: egarver@redhat.com
== Detailed Description ==
Firewalld v1.0.0 includes breaking changes meant to improve the
overall health of the project. The majority of the changes are
centered around improving and strengthening the zone concept. All
breaking changes are detailed in depth in the
[https://firewalld.org/2021/06/the-upcoming-1-0-0 upstream blog].
Major changes:
* Reduced dependencies
* Intra-zone forwarding by default
* NAT rules moved to inet family (reduced rule set)
* Default target is now similar to reject
* ICMP blocks and block inversion only apply to input, not forward
* tftp-client service has been removed
* iptables backend is deprecated
* Direct interface is deprecated
* CleanupModulesOnExit defaults to no (kernel modules not unloaded)
== Benefit to Fedora ==
The major benefit to Fedora is more predictability in the stock
firewall. In particular, "Default target is now similar to reject"
addresses many subtle issues encountered by users. "NAT rules moved to
inet family" also significantly reduces the rule set size for users of
`ipset`s.
== Scope ==
* Proposal owners: Changes are isolated to firewalld, but given
firewalld is core a System Wide Change is being filed.
* Other developers: None. Isolated change.
* Release engineering:
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
* Most configurations will migrate. No intervention required.
** Exceptions
*** configurations that utilize `tftp-client` service will have
firewalld start in `failed` state because the service has been
removed. As noted in the upstream blog this service has ''never''
worked properly.
* Zones that users have not modified will now have intra-zone
forwarding enabled.
** for this to occur the user must ''not'' have added an interface,
service, port, etc. to the zone
** minimal concern because this also means the zone was not in use,
the exception being an unmodified default zone, e.g.
`FedoraWorkstation`
== How To Test ==
Testing for this rebase should revolve around integrations.
* libvirt
** verify VMs still have network access
* podman
** verify containers still have network access
** verify forwarding ports via podman still works
* NetworkManager
** verify connection sharing still works
== User Experience ==
N/A
== Dependencies ==
firewalld has yet to release v1.0.0. It is expected in early July.
== Contingency Plan ==
* Contingency mechanism: revert package to v0.9.z (what f34 uses)
* Contingency deadline: July 27, 2021
* Blocks release? No
== Documentation ==
https://firewalld.org/2021/06/the-upcoming-1-0-0
== Release Notes ==
firewalld has been rebased to v1.0.0. This includes some breaking
changes that may affect users.
Major changes:
* Reduced dependencies
* Intra-zone forwarding by default
* NAT rules moved to inet family (reduced rule set)
* Default target is now similar to reject
* ICMP blocks and block inversion only apply to input, not forward
* tftp-client service has been removed
* iptables backend is deprecated
* Direct interface is deprecated
* CleanupModulesOnExit defaults to no (kernel modules not unloaded)
Full details on the upstream blog:
https://firewalld.org/2021/06/the-upcoming-1-0-0
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
F35 Change: LLVM 13 (Self-Contained Change proposal)
https://fedoraproject.org/wiki/Changes/LLVM-13
== Summary ==
Update all llvm sub-projects in Fedora to version 13.
== Owner ==
* Name: [[User:tstellar| Tom Stellard]]
* Email: <tstellar@redhat.com>
== Detailed Description ==
All llvm sub-projects in Fedora will be updated to version 13, and
there will be a soname version change for the llvm libraries.
Compatibility packages clang12 and llvm12 will be added to ensure that
packages that currently depend on clang and llvm version 12 libraries
will continue to work.
== Benefit to Fedora ==
New features and bug fixes provided by the latest version of LLVM.
== Scope ==
* Proposal owners:
** Review existing llvm and clang compatibility packages and orphan
any packages that are no longer used.
** Request a side-tag.
** Build llvm12 and clang12 into the side-tag.
** When the upstream LLVM project releases version 12.0.0-rc1 (Late
July 2021), package this and build it into the side tag.
** Merge side-tag into rawhide prior to the f35 branch date.
** Continue packaging newer release candidates into rawhide and f35
until the final release is complete (Late September 2021)
* Other developers:
** Maintainers of packages that depend on clang-libs or llvm-libs will
need to update their spec files to depend on the clang12 and llvm12
compatibility packages if they want to rebuild their package and it
does not work with LLVM 13 yet. The key point here is that spec file
changes are only needed if a package is going to be rebuilt after LLVM
13 is added to Fedora. The compatibility packages will ensure that
already built packages continue to work.
* Release engineering: [https://pagure.io/releng/issues/10179]
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
This change should not impact upgradeability.
== How To Test ==
The CI tests for the llvm sub-packages in Fedora will be used to catch
regressions that might be potentially introduced by the update to LLVM
13.
== User Experience ==
Users will benefit from new features and bug-fixes in the latest
version of LLVM.
== Dependencies ==
This change can be made without updating any other packages. However,
as mention before, packages that need to use LLVM 12 will need to
update their spec file on their first rebuild after this change.
== Contingency Plan ==
* Contingency mechanism: (What to do? Who will do it?): If there are
major problems with LLVM 13, the compatibility package provide a way
for other packages to continue using LLVM 12.
* Contingency deadline: Final Freeze
* Blocks release? No
== Documentation ==
Release notes will be added for this change.
== Release Notes ==
LLVM sub-projects in Fedora have been updated to version 13:
* llvm
* clang
* lld
* lldb
* compiler-rt
* libomp
* llvm-test-suite
* libcxx
* libcxxabi
* python-lit
* flang
* mlir
* polly
* libclc
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
== Summary ==
Update all llvm sub-projects in Fedora to version 13.
== Owner ==
* Name: [[User:tstellar| Tom Stellard]]
* Email: <tstellar@redhat.com>
== Detailed Description ==
All llvm sub-projects in Fedora will be updated to version 13, and
there will be a soname version change for the llvm libraries.
Compatibility packages clang12 and llvm12 will be added to ensure that
packages that currently depend on clang and llvm version 12 libraries
will continue to work.
== Benefit to Fedora ==
New features and bug fixes provided by the latest version of LLVM.
== Scope ==
* Proposal owners:
** Review existing llvm and clang compatibility packages and orphan
any packages that are no longer used.
** Request a side-tag.
** Build llvm12 and clang12 into the side-tag.
** When the upstream LLVM project releases version 12.0.0-rc1 (Late
July 2021), package this and build it into the side tag.
** Merge side-tag into rawhide prior to the f35 branch date.
** Continue packaging newer release candidates into rawhide and f35
until the final release is complete (Late September 2021)
* Other developers:
** Maintainers of packages that depend on clang-libs or llvm-libs will
need to update their spec files to depend on the clang12 and llvm12
compatibility packages if they want to rebuild their package and it
does not work with LLVM 13 yet. The key point here is that spec file
changes are only needed if a package is going to be rebuilt after LLVM
13 is added to Fedora. The compatibility packages will ensure that
already built packages continue to work.
* Release engineering: [https://pagure.io/releng/issues/10179]
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
This change should not impact upgradeability.
== How To Test ==
The CI tests for the llvm sub-packages in Fedora will be used to catch
regressions that might be potentially introduced by the update to LLVM
13.
== User Experience ==
Users will benefit from new features and bug-fixes in the latest
version of LLVM.
== Dependencies ==
This change can be made without updating any other packages. However,
as mention before, packages that need to use LLVM 12 will need to
update their spec file on their first rebuild after this change.
== Contingency Plan ==
* Contingency mechanism: (What to do? Who will do it?): If there are
major problems with LLVM 13, the compatibility package provide a way
for other packages to continue using LLVM 12.
* Contingency deadline: Final Freeze
* Blocks release? No
== Documentation ==
Release notes will be added for this change.
== Release Notes ==
LLVM sub-projects in Fedora have been updated to version 13:
* llvm
* clang
* lld
* lldb
* compiler-rt
* libomp
* llvm-test-suite
* libcxx
* libcxxabi
* python-lit
* flang
* mlir
* polly
* libclc
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
[announce] Next NYC*BUG: July 7th Why Privacy/Security (usually) Needs Anonymity,
Why Privacy/Security (usually) Needs Anonymity,
by NYC*Bug's own George Rosamond.
2021-07-07 @ 18:45 EDT via Zoom
In an uncensored and unleashed version of an ISSA Privacy SIG presentation from June, George will be making a strong declaration relevant to the times: why privacy and security (usually) need anonymity.
As privacy finally becomes an acceptable and even popular service and product feature, its sibling anonymity is still carries nefarious connotations. Privacy advocates onced faced questions like "do you have something to hide?" Similar retorts are now posed to anonymity advocates.
But creating privacy solutions without anonymity means ignoring a core aspect of (corporate,nation-state) surveillance: metadata. Knowing who talked to whom, when did they talk and for how long, makes the actual content of the communications less relevant in an era of mass surveillance.
Cut down to the basics and unfettered, we'll look at the changing environment of privacy, relating it to anonymity then approach some of the basic ingredients necessary for adapting anonymity to technical solutions today.
And yes, the relevance of BSD Unix will be woven throughout, somehow, someway.
We encourage questions and even wildly incorrect opinions before the meeting on the talk@ mailing list and on IRC at libera.net#nycbug.
For Zoom meeting details, email to rsvp AT lists.nycbug.org, and details will be sent on the day of the meeting. Q&A will be via IRC on libera.chat, channel #nycbug
Friday, June 25, 2021
[USN-4997-2] Linux kernel (KVM) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4997-2
June 25, 2021
linux-kvm vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 21.04
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-kvm: Linux kernel for cloud environments
Details:
USN-4997-1 fixed vulnerabilities in the Linux kernel for Ubuntu 21.04.
This update provides the corresponding updates for the Linux KVM
kernel for Ubuntu 21.04.
Norbert Slusarek discovered a race condition in the CAN BCM networking
protocol of the Linux kernel leading to multiple use-after-free
vulnerabilities. A local attacker could use this issue to execute arbitrary
code. (CVE-2021-3609)
Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel
did not properly enforce limits for pointer operations. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2021-33200)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation did
not properly clear received fragments from memory in some situations. A
physically proximate attacker could possibly use this issue to inject
packets or expose sensitive information. (CVE-2020-24586)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled encrypted fragments. A physically proximate attacker
could possibly use this issue to decrypt fragments. (CVE-2020-24587)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled certain malformed frames. If a user were tricked into
connecting to a malicious server, a physically proximate attacker could use
this issue to inject packets. (CVE-2020-24588)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled EAPOL frames from unauthenticated senders. A physically
proximate attacker could inject malicious packets to cause a denial of
service (system crash). (CVE-2020-26139)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation did
not properly verify certain fragmented frames. A physically proximate
attacker could possibly use this issue to inject or decrypt packets.
(CVE-2020-26141)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
accepted plaintext fragments in certain situations. A physically proximate
attacker could use this issue to inject packets. (CVE-2020-26145)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation could
reassemble mixed encrypted and plaintext fragments. A physically proximate
attacker could possibly use this issue to inject packets or exfiltrate
selected fragments. (CVE-2020-26147)
Or Cohen discovered that the SCTP implementation in the Linux kernel
contained a race condition in some situations, leading to a use-after-free
condition. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-23133)
Or Cohen and Nadav Markus discovered a use-after-free vulnerability in the
nfc implementation in the Linux kernel. A privileged local attacker could
use this issue to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2021-23134)
Manfred Paul discovered that the extended Berkeley Packet Filter (eBPF)
implementation in the Linux kernel contained an out-of-bounds
vulnerability. A local attacker could use this issue to execute arbitrary
code. (CVE-2021-31440)
Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel
did not properly prevent speculative loads in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2021-31829)
It was discovered that a race condition in the kernel Bluetooth subsystem
could lead to use-after-free of slab objects. An attacker could use this
issue to possibly execute arbitrary code. (CVE-2021-32399)
It was discovered that a use-after-free existed in the Bluetooth HCI driver
of the Linux kernel. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-33034)
It was discovered that an out-of-bounds (OOB) memory access flaw existed in
the f2fs module of the Linux kernel. A local attacker could use this issue
to cause a denial of service (system crash). (CVE-2021-3506)
Mathias Krause discovered that a null pointer dereference existed in the
Nitro Enclaves kernel driver of the Linux kernel. A local attacker could
use this issue to cause a denial of service or possibly execute arbitrary
code. (CVE-2021-3543)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 21.04:
linux-image-5.11.0-1009-kvm 5.11.0-1009.9
linux-image-kvm 5.11.0.1009.9
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-4997-2
https://ubuntu.com/security/notices/USN-4997-1
CVE-2020-24586, CVE-2020-24587, CVE-2020-24588, CVE-2020-26139,
CVE-2020-26141, CVE-2020-26145, CVE-2020-26147, CVE-2021-23133,
CVE-2021-23134, CVE-2021-31440, CVE-2021-31829, CVE-2021-32399,
CVE-2021-33034, CVE-2021-33200, CVE-2021-3506, CVE-2021-3543,
CVE-2021-3609
Package Information:
https://launchpad.net/ubuntu/+source/linux-kvm/5.11.0-1009.9
Ubuntu Security Notice USN-4997-2
June 25, 2021
linux-kvm vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 21.04
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-kvm: Linux kernel for cloud environments
Details:
USN-4997-1 fixed vulnerabilities in the Linux kernel for Ubuntu 21.04.
This update provides the corresponding updates for the Linux KVM
kernel for Ubuntu 21.04.
Norbert Slusarek discovered a race condition in the CAN BCM networking
protocol of the Linux kernel leading to multiple use-after-free
vulnerabilities. A local attacker could use this issue to execute arbitrary
code. (CVE-2021-3609)
Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel
did not properly enforce limits for pointer operations. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2021-33200)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation did
not properly clear received fragments from memory in some situations. A
physically proximate attacker could possibly use this issue to inject
packets or expose sensitive information. (CVE-2020-24586)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled encrypted fragments. A physically proximate attacker
could possibly use this issue to decrypt fragments. (CVE-2020-24587)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled certain malformed frames. If a user were tricked into
connecting to a malicious server, a physically proximate attacker could use
this issue to inject packets. (CVE-2020-24588)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled EAPOL frames from unauthenticated senders. A physically
proximate attacker could inject malicious packets to cause a denial of
service (system crash). (CVE-2020-26139)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation did
not properly verify certain fragmented frames. A physically proximate
attacker could possibly use this issue to inject or decrypt packets.
(CVE-2020-26141)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
accepted plaintext fragments in certain situations. A physically proximate
attacker could use this issue to inject packets. (CVE-2020-26145)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation could
reassemble mixed encrypted and plaintext fragments. A physically proximate
attacker could possibly use this issue to inject packets or exfiltrate
selected fragments. (CVE-2020-26147)
Or Cohen discovered that the SCTP implementation in the Linux kernel
contained a race condition in some situations, leading to a use-after-free
condition. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-23133)
Or Cohen and Nadav Markus discovered a use-after-free vulnerability in the
nfc implementation in the Linux kernel. A privileged local attacker could
use this issue to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2021-23134)
Manfred Paul discovered that the extended Berkeley Packet Filter (eBPF)
implementation in the Linux kernel contained an out-of-bounds
vulnerability. A local attacker could use this issue to execute arbitrary
code. (CVE-2021-31440)
Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel
did not properly prevent speculative loads in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2021-31829)
It was discovered that a race condition in the kernel Bluetooth subsystem
could lead to use-after-free of slab objects. An attacker could use this
issue to possibly execute arbitrary code. (CVE-2021-32399)
It was discovered that a use-after-free existed in the Bluetooth HCI driver
of the Linux kernel. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-33034)
It was discovered that an out-of-bounds (OOB) memory access flaw existed in
the f2fs module of the Linux kernel. A local attacker could use this issue
to cause a denial of service (system crash). (CVE-2021-3506)
Mathias Krause discovered that a null pointer dereference existed in the
Nitro Enclaves kernel driver of the Linux kernel. A local attacker could
use this issue to cause a denial of service or possibly execute arbitrary
code. (CVE-2021-3543)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 21.04:
linux-image-5.11.0-1009-kvm 5.11.0-1009.9
linux-image-kvm 5.11.0.1009.9
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-4997-2
https://ubuntu.com/security/notices/USN-4997-1
CVE-2020-24586, CVE-2020-24587, CVE-2020-24588, CVE-2020-26139,
CVE-2020-26141, CVE-2020-26145, CVE-2020-26147, CVE-2021-23133,
CVE-2021-23134, CVE-2021-31440, CVE-2021-31829, CVE-2021-32399,
CVE-2021-33034, CVE-2021-33200, CVE-2021-3506, CVE-2021-3543,
CVE-2021-3609
Package Information:
https://launchpad.net/ubuntu/+source/linux-kvm/5.11.0-1009.9
[USN-5000-2] Linux kernel (KVM) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-5000-2
June 25, 2021
linux-kvm vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-kvm: Linux kernel for cloud environments
Details:
USN-5000-1 fixed vulnerabilities in the Linux kernel for Ubuntu
20.04 LTS and the Linux HWE kernel for Ubuntu 18.04 LTS. This update
provides the corresponding updates for the Linux KVM kernel for Ubuntu
20.04 LTS.
Norbert Slusarek discovered a race condition in the CAN BCM networking
protocol of the Linux kernel leading to multiple use-after-free
vulnerabilities. A local attacker could use this issue to execute arbitrary
code. (CVE-2021-3609)
Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel
did not properly enforce limits for pointer operations. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2021-33200)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation did
not properly clear received fragments from memory in some situations. A
physically proximate attacker could possibly use this issue to inject
packets or expose sensitive information. (CVE-2020-24586)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled encrypted fragments. A physically proximate attacker
could possibly use this issue to decrypt fragments. (CVE-2020-24587)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled certain malformed frames. If a user were tricked into
connecting to a malicious server, a physically proximate attacker could use
this issue to inject packets. (CVE-2020-24588)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled EAPOL frames from unauthenticated senders. A physically
proximate attacker could inject malicious packets to cause a denial of
service (system crash). (CVE-2020-26139)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation did
not properly verify certain fragmented frames. A physically proximate
attacker could possibly use this issue to inject or decrypt packets.
(CVE-2020-26141)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
accepted plaintext fragments in certain situations. A physically proximate
attacker could use this issue to inject packets. (CVE-2020-26145)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation could
reassemble mixed encrypted and plaintext fragments. A physically proximate
attacker could possibly use this issue to inject packets or exfiltrate
selected fragments. (CVE-2020-26147)
Or Cohen discovered that the SCTP implementation in the Linux kernel
contained a race condition in some situations, leading to a use-after-free
condition. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-23133)
Or Cohen and Nadav Markus discovered a use-after-free vulnerability in the
nfc implementation in the Linux kernel. A privileged local attacker could
use this issue to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2021-23134)
Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel
did not properly prevent speculative loads in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2021-31829)
It was discovered that a race condition in the kernel Bluetooth subsystem
could lead to use-after-free of slab objects. An attacker could use this
issue to possibly execute arbitrary code. (CVE-2021-32399)
It was discovered that a use-after-free existed in the Bluetooth HCI driver
of the Linux kernel. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-33034)
It was discovered that an out-of-bounds (OOB) memory access flaw existed in
the f2fs module of the Linux kernel. A local attacker could use this issue
to cause a denial of service (system crash). (CVE-2021-3506)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.4.0-1041-kvm 5.4.0-1041.42
linux-image-kvm 5.4.0.1041.39
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-5000-2
https://ubuntu.com/security/notices/USN-5000-1
CVE-2020-24586, CVE-2020-24587, CVE-2020-24588, CVE-2020-26139,
CVE-2020-26141, CVE-2020-26145, CVE-2020-26147, CVE-2021-23133,
CVE-2021-23134, CVE-2021-31829, CVE-2021-32399, CVE-2021-33034,
CVE-2021-33200, CVE-2021-3506, CVE-2021-3609
Package Information:
https://launchpad.net/ubuntu/+source/linux-kvm/5.4.0-1041.42
Ubuntu Security Notice USN-5000-2
June 25, 2021
linux-kvm vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-kvm: Linux kernel for cloud environments
Details:
USN-5000-1 fixed vulnerabilities in the Linux kernel for Ubuntu
20.04 LTS and the Linux HWE kernel for Ubuntu 18.04 LTS. This update
provides the corresponding updates for the Linux KVM kernel for Ubuntu
20.04 LTS.
Norbert Slusarek discovered a race condition in the CAN BCM networking
protocol of the Linux kernel leading to multiple use-after-free
vulnerabilities. A local attacker could use this issue to execute arbitrary
code. (CVE-2021-3609)
Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel
did not properly enforce limits for pointer operations. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2021-33200)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation did
not properly clear received fragments from memory in some situations. A
physically proximate attacker could possibly use this issue to inject
packets or expose sensitive information. (CVE-2020-24586)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled encrypted fragments. A physically proximate attacker
could possibly use this issue to decrypt fragments. (CVE-2020-24587)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled certain malformed frames. If a user were tricked into
connecting to a malicious server, a physically proximate attacker could use
this issue to inject packets. (CVE-2020-24588)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
incorrectly handled EAPOL frames from unauthenticated senders. A physically
proximate attacker could inject malicious packets to cause a denial of
service (system crash). (CVE-2020-26139)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation did
not properly verify certain fragmented frames. A physically proximate
attacker could possibly use this issue to inject or decrypt packets.
(CVE-2020-26141)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation
accepted plaintext fragments in certain situations. A physically proximate
attacker could use this issue to inject packets. (CVE-2020-26145)
Mathy Vanhoef discovered that the Linux kernel's WiFi implementation could
reassemble mixed encrypted and plaintext fragments. A physically proximate
attacker could possibly use this issue to inject packets or exfiltrate
selected fragments. (CVE-2020-26147)
Or Cohen discovered that the SCTP implementation in the Linux kernel
contained a race condition in some situations, leading to a use-after-free
condition. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-23133)
Or Cohen and Nadav Markus discovered a use-after-free vulnerability in the
nfc implementation in the Linux kernel. A privileged local attacker could
use this issue to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2021-23134)
Piotr Krysiuk discovered that the eBPF implementation in the Linux kernel
did not properly prevent speculative loads in certain situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2021-31829)
It was discovered that a race condition in the kernel Bluetooth subsystem
could lead to use-after-free of slab objects. An attacker could use this
issue to possibly execute arbitrary code. (CVE-2021-32399)
It was discovered that a use-after-free existed in the Bluetooth HCI driver
of the Linux kernel. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-33034)
It was discovered that an out-of-bounds (OOB) memory access flaw existed in
the f2fs module of the Linux kernel. A local attacker could use this issue
to cause a denial of service (system crash). (CVE-2021-3506)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.4.0-1041-kvm 5.4.0-1041.42
linux-image-kvm 5.4.0.1041.39
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-5000-2
https://ubuntu.com/security/notices/USN-5000-1
CVE-2020-24586, CVE-2020-24587, CVE-2020-24588, CVE-2020-26139,
CVE-2020-26141, CVE-2020-26145, CVE-2020-26147, CVE-2021-23133,
CVE-2021-23134, CVE-2021-31829, CVE-2021-32399, CVE-2021-33034,
CVE-2021-33200, CVE-2021-3506, CVE-2021-3609
Package Information:
https://launchpad.net/ubuntu/+source/linux-kvm/5.4.0-1041.42
F35 Change: Optimal LUKS Encryption Sector Size (Self-Contained Change proposal)
https://fedoraproject.org/wiki/Changes/LUKSEncryptionSectorSize
== Summary ==
Autodetect optimal encryption sector size during Fedora installation
with LUKS/dm-crypt encryption. On devices with 4k (physical) sector
size, this will make sure we use 4096 sector size which is optimal for
these devices.
== Owner ==
* Name: [[User:okozina|Ondrej Kozina]], [[User:vtrefny|Vojtech Trefny]]
* Email: okozina AT redhat.com, vtrefny AT redhat.com
== Detailed Description ==
Anaconda installer (or to be more precise, the libraries Anaconda uses
for storage configuration) currently sets sector size for LUKS devices
to 512 regardless the of actual physical sector size of the underlying
disk device. The latest cryptsetup release added an option to let
cryptsetup automatically detect the optimal sector size based on the
(physical) sector size of the backing device. By using this new option
we can make sure that Anaconda uses the optimal sector size for newly
created LUKS devices during installation. This means we will use
sector size of 4096 for devices with 4k physical sector size
increasing IO performance with these devices.
== Scope ==
* Proposal owners: Changes for both cryptsetup and libblockdev
(low-level storage library used by Anaconda) are already merged
([https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests/135
cryptsetup]) or submitted
([https://github.com/storaged-project/libblockdev/pull/638
libblockdev]) upstream. We only need to package new versions of these
two projects for Fedora 35. No changes will be needed in Anaconda.
* Other developers: No work from other developers is needed.
* Release engineering:
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
Upgraded systems will not be affected by this change, this affects
only new LUKS containers created during Fedora installation.
Support for specifying custom sector size is one of the features
available in LUKS2 ([[Changes/SwitchCryptsetupDefaultToLUKS2|default
since Fedora 30]]), no additional changes or special support is needed
when working with LUKS2 devices with sector sizes different than 512.
== How To Test ==
Disk with 4k physical sectors is required for testing this change. You
can check block size of your drive using `blockdev` from `util-linux`
package:
# blockdev --getpbsz /dev/nvme0n1
4096
This can be also tested in a virtual machine. You can configure any
disk to appear as 4k block size disk in libvirt by adding the
following option to the disk XML specification:
<blockio logical_block_size="4096" physical_block_size="4096"/>
Install Fedora with disk encryption enabled. Using automatic partition
with '''Encrypt my data''' enabled is enough for testing.
In the installed system use `cryptsetup luksDump /dev/<device>` to
check that correct sector size was selected for your device (4096 for
disks with 4096 physical sector size):
# cryptsetup luksDump /dev/nvme0n1p1
LUKS header information
Version: 2
...
Data segments:
0: crypt
offset: 16777216 [bytes]
length: (whole device)
cipher: aes-xts-plain64
'''sector: 4096 [bytes]'''
== User Experience ==
Fedora users shouldn't notice the change, other than a small IO
performance boost (IO testing on a 4k sectors NVMe shows around 2-3 %
gain when using 4k sectors instead of 512 sectors).
== Dependencies ==
None.
== Contingency Plan ==
* Contingency mechanism: Keep existing behaviour (512 sector size for
all devices)
* Contingency deadline: Beta Freeze
* Blocks release? No
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
== Summary ==
Autodetect optimal encryption sector size during Fedora installation
with LUKS/dm-crypt encryption. On devices with 4k (physical) sector
size, this will make sure we use 4096 sector size which is optimal for
these devices.
== Owner ==
* Name: [[User:okozina|Ondrej Kozina]], [[User:vtrefny|Vojtech Trefny]]
* Email: okozina AT redhat.com, vtrefny AT redhat.com
== Detailed Description ==
Anaconda installer (or to be more precise, the libraries Anaconda uses
for storage configuration) currently sets sector size for LUKS devices
to 512 regardless the of actual physical sector size of the underlying
disk device. The latest cryptsetup release added an option to let
cryptsetup automatically detect the optimal sector size based on the
(physical) sector size of the backing device. By using this new option
we can make sure that Anaconda uses the optimal sector size for newly
created LUKS devices during installation. This means we will use
sector size of 4096 for devices with 4k physical sector size
increasing IO performance with these devices.
== Scope ==
* Proposal owners: Changes for both cryptsetup and libblockdev
(low-level storage library used by Anaconda) are already merged
([https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests/135
cryptsetup]) or submitted
([https://github.com/storaged-project/libblockdev/pull/638
libblockdev]) upstream. We only need to package new versions of these
two projects for Fedora 35. No changes will be needed in Anaconda.
* Other developers: No work from other developers is needed.
* Release engineering:
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
Upgraded systems will not be affected by this change, this affects
only new LUKS containers created during Fedora installation.
Support for specifying custom sector size is one of the features
available in LUKS2 ([[Changes/SwitchCryptsetupDefaultToLUKS2|default
since Fedora 30]]), no additional changes or special support is needed
when working with LUKS2 devices with sector sizes different than 512.
== How To Test ==
Disk with 4k physical sectors is required for testing this change. You
can check block size of your drive using `blockdev` from `util-linux`
package:
# blockdev --getpbsz /dev/nvme0n1
4096
This can be also tested in a virtual machine. You can configure any
disk to appear as 4k block size disk in libvirt by adding the
following option to the disk XML specification:
<blockio logical_block_size="4096" physical_block_size="4096"/>
Install Fedora with disk encryption enabled. Using automatic partition
with '''Encrypt my data''' enabled is enough for testing.
In the installed system use `cryptsetup luksDump /dev/<device>` to
check that correct sector size was selected for your device (4096 for
disks with 4096 physical sector size):
# cryptsetup luksDump /dev/nvme0n1p1
LUKS header information
Version: 2
...
Data segments:
0: crypt
offset: 16777216 [bytes]
length: (whole device)
cipher: aes-xts-plain64
'''sector: 4096 [bytes]'''
== User Experience ==
Fedora users shouldn't notice the change, other than a small IO
performance boost (IO testing on a 4k sectors NVMe shows around 2-3 %
gain when using 4k sectors instead of 512 sectors).
== Dependencies ==
None.
== Contingency Plan ==
* Contingency mechanism: Keep existing behaviour (512 sector size for
all devices)
* Contingency deadline: Beta Freeze
* Blocks release? No
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
[USN-4995-2] Thunderbird vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4995-2
June 25, 2021
thunderbird vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in Thunderbird.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
USN-4995-1 fixed vulnerabilities in Thunderbird. This update provides
the corresponding updates for Ubuntu 18.04 LTS.
Original advisory details:
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, spoof the UI, bypass security restrictions,
or execute arbitrary code. (CVE-2021-23961, CVE-2021-23981,
CVE-2021-23982, CVE-2021-23987, CVE-2021-23994, CVE-2021-23998,
CVE-2021-23999, CVE-2021-29945, CVE-2021-29946, CVE-2021-29967)
It was discovered that extensions could open popup windows with control
of the window title in some circumstances. If a user were tricked into
installing a specially crafted extension, an attacker could potentially
exploit this to spoof a website and trick the user into providing
credentials. (CVE-2021-23984)
Multiple security issues were discovered in Thunderbird's OpenPGP
integration. If a user were tricked into importing a specially crafted
key in some circumstances, an attacker could potentially exploit this
to cause a denial of service (inability to send encrypted email) or
confuse the user. (CVE-2021-23991, CVE-2021-23992, CVE-2021-23993)
A use-after-free was discovered when Responsive Design Mode was
enabled. If a user were tricked into opening a specially crafted
website with Responsive Design Mode enabled, an attacker could
potentially exploit this to cause a denial of service, or execute
arbitrary code. (CVE-2021-23995)
It was discovered that Thunderbird mishandled ftp URLs with encoded
newline characters. If a user were tricked into clicking on a specially
crafted link, an attacker could potentially exploit this to send arbitrary
FTP commands. (CVE-2021-24002)
It was discovered that Thunderbird wrote signatures to disk and read them
back during verification. A local attacker could potentially exploit this
to replace the data with another signature file. (CVE-2021-29948)
It was discovered that Thunderbird might load an alternative OTR
library. If a user were tricked into copying a specially crafted
library to one of Thunderbird's search paths, an attacker could
potentially exploit this to execute arbitrary code. (CVE-2021-29949)
It was discovered that secret keys imported into Thunderbird were
stored unencrypted. A local attacker could potentially exploit this to
obtain private keys. (CVE-2021-29956)
It was discovered that Thunderbird did not indicate when an inline signed
or encrypted message contained additional unprotected parts.
(CVE-2021-29957)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
thunderbird 1:78.11.0+build1-0ubuntu0.18.04.2
After a standard system update you need to restart Thunderbird to make
all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-4995-2
https://ubuntu.com/security/notices/USN-4995-1
CVE-2021-23961, CVE-2021-23981, CVE-2021-23982, CVE-2021-23984,
CVE-2021-23987, CVE-2021-23991, CVE-2021-23992, CVE-2021-23993,
CVE-2021-23994, CVE-2021-23995, CVE-2021-23998, CVE-2021-23999,
CVE-2021-24002, CVE-2021-29945, CVE-2021-29946, CVE-2021-29948,
CVE-2021-29949, CVE-2021-29956, CVE-2021-29957, CVE-2021-29967
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:78.11.0+build1-0ubuntu0.18.04.2
Ubuntu Security Notice USN-4995-2
June 25, 2021
thunderbird vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in Thunderbird.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
USN-4995-1 fixed vulnerabilities in Thunderbird. This update provides
the corresponding updates for Ubuntu 18.04 LTS.
Original advisory details:
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, spoof the UI, bypass security restrictions,
or execute arbitrary code. (CVE-2021-23961, CVE-2021-23981,
CVE-2021-23982, CVE-2021-23987, CVE-2021-23994, CVE-2021-23998,
CVE-2021-23999, CVE-2021-29945, CVE-2021-29946, CVE-2021-29967)
It was discovered that extensions could open popup windows with control
of the window title in some circumstances. If a user were tricked into
installing a specially crafted extension, an attacker could potentially
exploit this to spoof a website and trick the user into providing
credentials. (CVE-2021-23984)
Multiple security issues were discovered in Thunderbird's OpenPGP
integration. If a user were tricked into importing a specially crafted
key in some circumstances, an attacker could potentially exploit this
to cause a denial of service (inability to send encrypted email) or
confuse the user. (CVE-2021-23991, CVE-2021-23992, CVE-2021-23993)
A use-after-free was discovered when Responsive Design Mode was
enabled. If a user were tricked into opening a specially crafted
website with Responsive Design Mode enabled, an attacker could
potentially exploit this to cause a denial of service, or execute
arbitrary code. (CVE-2021-23995)
It was discovered that Thunderbird mishandled ftp URLs with encoded
newline characters. If a user were tricked into clicking on a specially
crafted link, an attacker could potentially exploit this to send arbitrary
FTP commands. (CVE-2021-24002)
It was discovered that Thunderbird wrote signatures to disk and read them
back during verification. A local attacker could potentially exploit this
to replace the data with another signature file. (CVE-2021-29948)
It was discovered that Thunderbird might load an alternative OTR
library. If a user were tricked into copying a specially crafted
library to one of Thunderbird's search paths, an attacker could
potentially exploit this to execute arbitrary code. (CVE-2021-29949)
It was discovered that secret keys imported into Thunderbird were
stored unencrypted. A local attacker could potentially exploit this to
obtain private keys. (CVE-2021-29956)
It was discovered that Thunderbird did not indicate when an inline signed
or encrypted message contained additional unprotected parts.
(CVE-2021-29957)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
thunderbird 1:78.11.0+build1-0ubuntu0.18.04.2
After a standard system update you need to restart Thunderbird to make
all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-4995-2
https://ubuntu.com/security/notices/USN-4995-1
CVE-2021-23961, CVE-2021-23981, CVE-2021-23982, CVE-2021-23984,
CVE-2021-23987, CVE-2021-23991, CVE-2021-23992, CVE-2021-23993,
CVE-2021-23994, CVE-2021-23995, CVE-2021-23998, CVE-2021-23999,
CVE-2021-24002, CVE-2021-29945, CVE-2021-29946, CVE-2021-29948,
CVE-2021-29949, CVE-2021-29956, CVE-2021-29957, CVE-2021-29967
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:78.11.0+build1-0ubuntu0.18.04.2
OpenBGPD 7.1 released
We have released OpenBGPD 7.1, which will be arriving in the
OpenBGPD directory of your local OpenBSD mirror soon.
This release includes the following changes to the previous release:
* OpenBSD 6.9 errata 009
During bgpd(8) config reloads prefixes of the wrong address family could
leak to peers resulting in session resets.
* Support for RFC 7313 - Enhanced Route Refresh
Disabled by default, to enable use 'announce enhanced refresh yes'.
* Improve output of Adj-RIB-Out by updating nexthop and ASPATH before
adding the prefix to the RIB. This improves `bgpctl show rib out`
output.
* Add command line option to show the version
OpenBGPD-portable is known to compile and run on FreeBSD, and
the Linux distributions Alpine, Debian, Fedora, RHEL/CentOS and Ubuntu.
It is our hope that packagers take interest and help adapt OpenBGPD-portable
to more distributions.
We welcome feedback and improvements from the broader community.
Thanks to all of the contributors who helped make this release
possible.
OpenBGPD directory of your local OpenBSD mirror soon.
This release includes the following changes to the previous release:
* OpenBSD 6.9 errata 009
During bgpd(8) config reloads prefixes of the wrong address family could
leak to peers resulting in session resets.
* Support for RFC 7313 - Enhanced Route Refresh
Disabled by default, to enable use 'announce enhanced refresh yes'.
* Improve output of Adj-RIB-Out by updating nexthop and ASPATH before
adding the prefix to the RIB. This improves `bgpctl show rib out`
output.
* Add command line option to show the version
OpenBGPD-portable is known to compile and run on FreeBSD, and
the Linux distributions Alpine, Debian, Fedora, RHEL/CentOS and Ubuntu.
It is our hope that packagers take interest and help adapt OpenBGPD-portable
to more distributions.
We welcome feedback and improvements from the broader community.
Thanks to all of the contributors who helped make this release
possible.
Thursday, June 24, 2021
[USN-4998-1] Ceph vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4998-1
June 25, 2021
ceph vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Ceph.
Software Description:
- ceph: distributed storage and file system
Details:
It was discovered that in some situations Ceph logged passwords from the
mgr module in clear text. An attacker could use this to expose sensitive
information. (CVE-2020-25678)
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access. (CVE-2020-27781)
It was discovered that the Ceph dashboard was susceptible to a cross-site
scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2020-27839)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of service or
possibly impersonate another user. (CVE-2021-20288)
Sergey Bobrov discovered that the Ceph dashboard was susceptible to a
cross-site scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2021-3509)
Sergey Bobrov discovered that Ceph's RadosGW (Ceph Object Gateway) allowed
the injection of HTTP headers in responses to CORS requests. An attacker
could use this to violate system integrity. (CVE-2021-3524)
It was discovered that Ceph's RadosGW (Ceph Object Gateway) did not
properly handle GET requests for swift URLs in some situations, leading to
an application crash. An attacker could use this to cause a denial of
service. (CVE-2021-3531)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
ceph 15.2.12-0ubuntu0.20.10.1
ceph-base 15.2.12-0ubuntu0.20.10.1
ceph-common 15.2.12-0ubuntu0.20.10.1
ceph-mgr 15.2.12-0ubuntu0.20.10.1
ceph-mgr-cephadm 15.2.12-0ubuntu0.20.10.1
ceph-mgr-dashboard 15.2.12-0ubuntu0.20.10.1
ceph-mgr-diskprediction-cloud 15.2.12-0ubuntu0.20.10.1
ceph-mgr-diskprediction-local 15.2.12-0ubuntu0.20.10.1
ceph-mgr-k8sevents 15.2.12-0ubuntu0.20.10.1
ceph-mgr-modules-core 15.2.12-0ubuntu0.20.10.1
ceph-mgr-rook 15.2.12-0ubuntu0.20.10.1
cephadm 15.2.12-0ubuntu0.20.10.1
radosgw 15.2.12-0ubuntu0.20.10.1
Ubuntu 20.04 LTS:
ceph 15.2.12-0ubuntu0.20.04.1
ceph-base 15.2.12-0ubuntu0.20.04.1
ceph-common 15.2.12-0ubuntu0.20.04.1
ceph-mgr 15.2.12-0ubuntu0.20.04.1
ceph-mgr-cephadm 15.2.12-0ubuntu0.20.04.1
ceph-mgr-dashboard 15.2.12-0ubuntu0.20.04.1
ceph-mgr-diskprediction-cloud 15.2.12-0ubuntu0.20.04.1
ceph-mgr-diskprediction-local 15.2.12-0ubuntu0.20.04.1
ceph-mgr-k8sevents 15.2.12-0ubuntu0.20.04.1
ceph-mgr-modules-core 15.2.12-0ubuntu0.20.04.1
ceph-mgr-rook 15.2.12-0ubuntu0.20.04.1
cephadm 15.2.12-0ubuntu0.20.04.1
radosgw 15.2.12-0ubuntu0.20.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-4998-1
CVE-2020-25678, CVE-2020-27781, CVE-2020-27839, CVE-2021-20288,
CVE-2021-3509, CVE-2021-3524, CVE-2021-3531
Package Information:
https://launchpad.net/ubuntu/+source/ceph/15.2.12-0ubuntu0.20.10.1
https://launchpad.net/ubuntu/+source/ceph/15.2.12-0ubuntu0.20.04.1
Ubuntu Security Notice USN-4998-1
June 25, 2021
ceph vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Ceph.
Software Description:
- ceph: distributed storage and file system
Details:
It was discovered that in some situations Ceph logged passwords from the
mgr module in clear text. An attacker could use this to expose sensitive
information. (CVE-2020-25678)
Goutham Pacha Ravi, Jahson Babel, and John Garbutt discovered that user
credentials in Ceph could be manipulated in certain environments. An
attacker could use this to gain unintended access. (CVE-2020-27781)
It was discovered that the Ceph dashboard was susceptible to a cross-site
scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2020-27839)
It was discovered that Ceph contained an authentication flaw, leading to
key reuse. An attacker could use this to cause a denial of service or
possibly impersonate another user. (CVE-2021-20288)
Sergey Bobrov discovered that the Ceph dashboard was susceptible to a
cross-site scripting attack. An attacker could use this to expose sensitive
information or gain unintended access. (CVE-2021-3509)
Sergey Bobrov discovered that Ceph's RadosGW (Ceph Object Gateway) allowed
the injection of HTTP headers in responses to CORS requests. An attacker
could use this to violate system integrity. (CVE-2021-3524)
It was discovered that Ceph's RadosGW (Ceph Object Gateway) did not
properly handle GET requests for swift URLs in some situations, leading to
an application crash. An attacker could use this to cause a denial of
service. (CVE-2021-3531)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
ceph 15.2.12-0ubuntu0.20.10.1
ceph-base 15.2.12-0ubuntu0.20.10.1
ceph-common 15.2.12-0ubuntu0.20.10.1
ceph-mgr 15.2.12-0ubuntu0.20.10.1
ceph-mgr-cephadm 15.2.12-0ubuntu0.20.10.1
ceph-mgr-dashboard 15.2.12-0ubuntu0.20.10.1
ceph-mgr-diskprediction-cloud 15.2.12-0ubuntu0.20.10.1
ceph-mgr-diskprediction-local 15.2.12-0ubuntu0.20.10.1
ceph-mgr-k8sevents 15.2.12-0ubuntu0.20.10.1
ceph-mgr-modules-core 15.2.12-0ubuntu0.20.10.1
ceph-mgr-rook 15.2.12-0ubuntu0.20.10.1
cephadm 15.2.12-0ubuntu0.20.10.1
radosgw 15.2.12-0ubuntu0.20.10.1
Ubuntu 20.04 LTS:
ceph 15.2.12-0ubuntu0.20.04.1
ceph-base 15.2.12-0ubuntu0.20.04.1
ceph-common 15.2.12-0ubuntu0.20.04.1
ceph-mgr 15.2.12-0ubuntu0.20.04.1
ceph-mgr-cephadm 15.2.12-0ubuntu0.20.04.1
ceph-mgr-dashboard 15.2.12-0ubuntu0.20.04.1
ceph-mgr-diskprediction-cloud 15.2.12-0ubuntu0.20.04.1
ceph-mgr-diskprediction-local 15.2.12-0ubuntu0.20.04.1
ceph-mgr-k8sevents 15.2.12-0ubuntu0.20.04.1
ceph-mgr-modules-core 15.2.12-0ubuntu0.20.04.1
ceph-mgr-rook 15.2.12-0ubuntu0.20.04.1
cephadm 15.2.12-0ubuntu0.20.04.1
radosgw 15.2.12-0ubuntu0.20.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-4998-1
CVE-2020-25678, CVE-2020-27781, CVE-2020-27839, CVE-2021-20288,
CVE-2021-3509, CVE-2021-3524, CVE-2021-3531
Package Information:
https://launchpad.net/ubuntu/+source/ceph/15.2.12-0ubuntu0.20.10.1
https://launchpad.net/ubuntu/+source/ceph/15.2.12-0ubuntu0.20.04.1
[USN-5004-1] RabbitMQ vulnerabilities
==========================================================================
Ubuntu Security Notice USN-5004-1
June 24, 2021
rabbitmq-server vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 21.04
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
Summary:
Several security issues were fixed in rabbitmq-server.
Software Description:
- rabbitmq-server: AMQP server written in Erlang
Details:
It was discovered that RabbitMQ incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11287)
Jonathan Knudsen discovered RabbitMQ incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2021-22116)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 21.04:
rabbitmq-server 3.8.9-2ubuntu0.1
Ubuntu 20.10:
rabbitmq-server 3.8.5-1ubuntu0.2
Ubuntu 20.04 LTS:
rabbitmq-server 3.8.2-0ubuntu1.3
Ubuntu 18.04 LTS:
rabbitmq-server 3.6.10-1ubuntu0.5
Ubuntu 16.04 ESM:
rabbitmq-server 3.5.7-1ubuntu0.16.04.4+esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5004-1
CVE-2019-11287, CVE-2021-22116
Package Information:
https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.9-2ubuntu0.1
https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.5-1ubuntu0.2
https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.2-0ubuntu1.3
https://launchpad.net/ubuntu/+source/rabbitmq-server/3.6.10-1ubuntu0.5
Ubuntu Security Notice USN-5004-1
June 24, 2021
rabbitmq-server vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 21.04
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
Summary:
Several security issues were fixed in rabbitmq-server.
Software Description:
- rabbitmq-server: AMQP server written in Erlang
Details:
It was discovered that RabbitMQ incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11287)
Jonathan Knudsen discovered RabbitMQ incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2021-22116)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 21.04:
rabbitmq-server 3.8.9-2ubuntu0.1
Ubuntu 20.10:
rabbitmq-server 3.8.5-1ubuntu0.2
Ubuntu 20.04 LTS:
rabbitmq-server 3.8.2-0ubuntu1.3
Ubuntu 18.04 LTS:
rabbitmq-server 3.6.10-1ubuntu0.5
Ubuntu 16.04 ESM:
rabbitmq-server 3.5.7-1ubuntu0.16.04.4+esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5004-1
CVE-2019-11287, CVE-2021-22116
Package Information:
https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.9-2ubuntu0.1
https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.5-1ubuntu0.2
https://launchpad.net/ubuntu/+source/rabbitmq-server/3.8.2-0ubuntu1.3
https://launchpad.net/ubuntu/+source/rabbitmq-server/3.6.10-1ubuntu0.5
F35 Change: libmemcached-awesome (Self-Contained Change proposal)
https://fedoraproject.org/wiki/Changes/libmemcached-awesome
== Summary ==
Switch from libmemcached to libmemcached-awesome
== Owner ==
* Name: [[User:Remi| Remi Collet]]
* Email: remi at fedoraproject dot org
== Detailed Description ==
libmemcache 1.0.18 was released in February 2014, so hasn't received
an update for 7 years.
libmemcache-awesome is a fork providing same libraries, tools with
API/ABI compatibility.
== Benefit to Fedora ==
Rely on a maintained project.
== Scope ==
* Proposal owners: Check Koschei status. Test with latest version to
ensure compatibility. Work with upstream on bug fixing. Needed mass
rebuild (C extensions) done by change owner.
* Other developers: N/A (not a System Wide Change)
* Release engineering:
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
N/A (not a System Wide Change)
== How To Test ==
* install and play with your application
== User Experience ==
Developers and system administrators will have the great benefit or
running a maintained library.
== Dependencies ==
All php-* packages (and some *-php)
== Contingency Plan ==
* Contingency mechanism: Drop not compatible packages.
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? N/A (not a System Wide Change)
== Documentation ==
* [https://awesomized.github.io/libmemcached/ Upstream documentation]
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
== Summary ==
Switch from libmemcached to libmemcached-awesome
== Owner ==
* Name: [[User:Remi| Remi Collet]]
* Email: remi at fedoraproject dot org
== Detailed Description ==
libmemcache 1.0.18 was released in February 2014, so hasn't received
an update for 7 years.
libmemcache-awesome is a fork providing same libraries, tools with
API/ABI compatibility.
== Benefit to Fedora ==
Rely on a maintained project.
== Scope ==
* Proposal owners: Check Koschei status. Test with latest version to
ensure compatibility. Work with upstream on bug fixing. Needed mass
rebuild (C extensions) done by change owner.
* Other developers: N/A (not a System Wide Change)
* Release engineering:
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
== Upgrade/compatibility impact ==
N/A (not a System Wide Change)
== How To Test ==
* install and play with your application
== User Experience ==
Developers and system administrators will have the great benefit or
running a maintained library.
== Dependencies ==
All php-* packages (and some *-php)
== Contingency Plan ==
* Contingency mechanism: Drop not compatible packages.
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? N/A (not a System Wide Change)
== Documentation ==
* [https://awesomized.github.io/libmemcached/ Upstream documentation]
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
Subscribe to:
Posts (Atom)