-------- Forwarded Message --------
Subject: F38 elections voting now open
Date: Mon, 29 May 2023 00:05:00 +0000
From: Justin W. Flory
F38 elections voting now open
Voting in the Fedora Linux 38 elections is now open. Go to the Elections app
<https://elections.fedoraproject.org/> to cast your vote. Voting closes at
23:59 UTC on Sunday 11 June. Don't forget to claim your "I Voted" badge when
you cast your ballot. Links to candidate interviews are below.
/Note/: The election was delayed from its original start date on 19 May. See
this Devel list thread
<https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/RCY37UYQYLHH74KU355PSIOSJ5HVTZVE/>
for additional context.
Fedora Council
There is one seat open
<https://elections.fedoraproject.org/about/council_f38> on the Fedora Council:
* Sumantro Mukherjee
<https://communityblog.fedoraproject.org/f38-council-election-interview-sumantro-mukherjee/>
Fedora Engineering Steering Committee (FESCo)
There are four seats open
<https://elections.fedoraproject.org/about/fesco_f38> on FESCo:
* Benjamin Beasley
<https://communityblog.fedoraproject.org/f38-fesco-election-interview-benjamin-beasley/>
* Major Hayden
<https://communityblog.fedoraproject.org/f38-council-election-interview-major-hayden/>
* Neal Gompa
<https://communityblog.fedoraproject.org/f38-fesco-election-interview-neal-gompa/>
* Stephen Gallagher
<https://communityblog.fedoraproject.org/f38-fesco-election-interview-stephen-gallagher/>
* Tom Stellard
<https://communityblog.fedoraproject.org/f38-fesco-election-interview-tom-stellard/>
Mindshare Committee
There is one seat open
<https://elections.fedoraproject.org/about/mindshare_f38> on the Mindshare
Committee:
* David Duncan
<https://communityblog.fedoraproject.org/f38-mindshare-election-interview-david-duncan/>
* Luis Bazan
<https://communityblog.fedoraproject.org/f38-mindshare-election-interview-luis-bazan/>
The post F38 elections voting now open
<https://communityblog.fedoraproject.org/f38-elections-voting-open/> appeared
first on Fedora Community Blog <https://communityblog.fedoraproject.org>.
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Monday, May 29, 2023
Saturday, May 27, 2023
LibreSSL 3.8.0 Released
We have released LibreSSL 3.8.0, which will be arriving in the LibreSSL
directory of your local OpenBSD mirror soon. This is a development
release for the 3.8.x branch, so we appreciate early testing and
feedback.
It includes the following changes:
* Portable changes
- Extended the endian.h compat header with hto* and *toh macros.
- Adapted more tests to the portable framework.
* Internal improvements
- Improved sieve of Eratosthenes script used for generating a table
of small primes.
- Started cleaning up and rewriting SHA internals.
- Replace internal use of BN_copy() with bn_copy() for consistency.
- Rewrote and improved BN_exp() and BN_copy().
- Add branch target information (BTI) support to arm64 assembly.
- Replaced BN_mod_sqrt() with a new implementation.
- Removed incomplete and dangerous BN_RECURSION code.
- Added endbr64 instructions to amd64 assembly.
- Imported RFC 5280 policy checking code from BoringSSL and used it
to replace the old exponential time code.
- Converted more of libcrypto to use CBB/CBS.
- Cleaned up and simplified the code dealing with builtin curves.
* New features
- Added support for truncated SHA-2 and for SHA-3.
- The BPSW primality test performs additional Miller-Rabin rounds
with random bases to reduce the likelihood of composites passing.
- Allow testing of ciphers and digests using badly aligned buffers
in openssl speed.
- Added a workaround for a poorly thought-out change in OpenSSL 3 that
broke privilege separation support in libtls.
* Compatibility changes
- Support for GF2m was removed: BIGNUM no longer supports binary extension
field arithmetic and all binary elliptic builtin curves were removed.
- Removed dangerous, "fast" NIST prime and elliptic curve implementations.
In particular, EC_GFp_nist_method() is no longer available.
- Removed most public symbols that were deprecated in OpenSSL 0.9.8.
- Removed the public X9.31 API (RSA_X931_PADDING is still available).
- Removed Cipher Text Stealing mode.
- Removed SXNET and NETSCAPE_CERT_SEQUENCE support including the
openssl(1) nseq command.
- Dropped proxy certificate (RFC 3820) support.
- The POLICY_TREE and its related structures and API were removed.
- The explicitText user notice uses UTF8String instead of VisibleString
to reduce the risk of emitting certificates with invalid DER-encoding.
- Initial fixes for RSA-PSS support to make the TLSv1.3 stack more
compliant with RFC 8446.
* Bug fixes
- Correctly handle negative input to various BIGNUM functions.
- Ensure ERR_load_ERR_strings() does not set errno unexpectedly.
- Fix error checking of i2d_ECDSA_SIG() in ossl_ecdsa_sign().
- Fixed detection of extended operations (XOP) on AMD hardware.
- Ensure Montgomery exponentiation is used for the initial RSA blinding.
- Policy is always checked in X509 validation. Critical policy extensions
are no longer silently ignored.
- Fixed error handling in tls_check_common_name().
- Add missing pointer invalidation in SSL_free().
- Fixed X509err() and X509V3err() and their internal versions.
- Ensure that OBJ_obj2txt() always returns a C string again.
- In X509_VERIFY_PARAM_inherit() copy hostflags independently of the
host list.
* Documentation improvements
- Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3),
BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3).
- Marked BIO_CB_return(), BIO_cb_pre(), and BIO_cb_post() as intentionally
undocumented.
* Testing and Proactive Security
- Significantly improved test coverage of BN_mod_sqrt() and GCD.
- As always, new test coverage is added as bugs are fixed and subsystems
are cleaned up.
The LibreSSL project continues improvement of the codebase to reflect modern,
safe programming practices. We welcome feedback and improvements from the
broader community. Thanks to all of the contributors who helped make this
release possible.
directory of your local OpenBSD mirror soon. This is a development
release for the 3.8.x branch, so we appreciate early testing and
feedback.
It includes the following changes:
* Portable changes
- Extended the endian.h compat header with hto* and *toh macros.
- Adapted more tests to the portable framework.
* Internal improvements
- Improved sieve of Eratosthenes script used for generating a table
of small primes.
- Started cleaning up and rewriting SHA internals.
- Replace internal use of BN_copy() with bn_copy() for consistency.
- Rewrote and improved BN_exp() and BN_copy().
- Add branch target information (BTI) support to arm64 assembly.
- Replaced BN_mod_sqrt() with a new implementation.
- Removed incomplete and dangerous BN_RECURSION code.
- Added endbr64 instructions to amd64 assembly.
- Imported RFC 5280 policy checking code from BoringSSL and used it
to replace the old exponential time code.
- Converted more of libcrypto to use CBB/CBS.
- Cleaned up and simplified the code dealing with builtin curves.
* New features
- Added support for truncated SHA-2 and for SHA-3.
- The BPSW primality test performs additional Miller-Rabin rounds
with random bases to reduce the likelihood of composites passing.
- Allow testing of ciphers and digests using badly aligned buffers
in openssl speed.
- Added a workaround for a poorly thought-out change in OpenSSL 3 that
broke privilege separation support in libtls.
* Compatibility changes
- Support for GF2m was removed: BIGNUM no longer supports binary extension
field arithmetic and all binary elliptic builtin curves were removed.
- Removed dangerous, "fast" NIST prime and elliptic curve implementations.
In particular, EC_GFp_nist_method() is no longer available.
- Removed most public symbols that were deprecated in OpenSSL 0.9.8.
- Removed the public X9.31 API (RSA_X931_PADDING is still available).
- Removed Cipher Text Stealing mode.
- Removed SXNET and NETSCAPE_CERT_SEQUENCE support including the
openssl(1) nseq command.
- Dropped proxy certificate (RFC 3820) support.
- The POLICY_TREE and its related structures and API were removed.
- The explicitText user notice uses UTF8String instead of VisibleString
to reduce the risk of emitting certificates with invalid DER-encoding.
- Initial fixes for RSA-PSS support to make the TLSv1.3 stack more
compliant with RFC 8446.
* Bug fixes
- Correctly handle negative input to various BIGNUM functions.
- Ensure ERR_load_ERR_strings() does not set errno unexpectedly.
- Fix error checking of i2d_ECDSA_SIG() in ossl_ecdsa_sign().
- Fixed detection of extended operations (XOP) on AMD hardware.
- Ensure Montgomery exponentiation is used for the initial RSA blinding.
- Policy is always checked in X509 validation. Critical policy extensions
are no longer silently ignored.
- Fixed error handling in tls_check_common_name().
- Add missing pointer invalidation in SSL_free().
- Fixed X509err() and X509V3err() and their internal versions.
- Ensure that OBJ_obj2txt() always returns a C string again.
- In X509_VERIFY_PARAM_inherit() copy hostflags independently of the
host list.
* Documentation improvements
- Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3),
BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3).
- Marked BIO_CB_return(), BIO_cb_pre(), and BIO_cb_post() as intentionally
undocumented.
* Testing and Proactive Security
- Significantly improved test coverage of BN_mod_sqrt() and GCD.
- As always, new test coverage is added as bugs are fixed and subsystems
are cleaned up.
The LibreSSL project continues improvement of the codebase to reflect modern,
safe programming practices. We welcome feedback and improvements from the
broader community. Thanks to all of the contributors who helped make this
release possible.
LibreSSL 3.7.3, 3.6.3 Released
We have released LibreSSL 3.6.3 and 3.7.3, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon.
They include the following fixes:
* Bug fix
- Hostflags in the verify parameters would not propagate from an
SSL_CTX to newly created SSL.
* Reliability fix
- A double free or use after free could occur after SSL_clear(3).
The LibreSSL project continues improvement of the codebase to reflect modern,
safe programming practices. We welcome feedback and improvements from the
broader community. Thanks to all of the contributors who helped make this
release possible.
LibreSSL directory of your local OpenBSD mirror soon.
They include the following fixes:
* Bug fix
- Hostflags in the verify parameters would not propagate from an
SSL_CTX to newly created SSL.
* Reliability fix
- A double free or use after free could occur after SSL_clear(3).
The LibreSSL project continues improvement of the codebase to reflect modern,
safe programming practices. We welcome feedback and improvements from the
broader community. Thanks to all of the contributors who helped make this
release possible.
Friday, May 26, 2023
Planned Outage of s390x affecting all koji 2023-06-01
Planned Outage - koji/s390x - 2023-06-01 05:00 UTC
There will be an outage starting at 2023-06-01 05:00 UTC,
which will last approximately 24 hours.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2023-06-01 05:00UTC'
Reason for outage:
The Red Hat Westford location will have more power line work done. This will require the building to be powered down in places which will affect various services like network connections and s390x builders.
Affected Services:
koji builds and composes will be affected with builds waiting until the s390x builders are able to complete the work.
Ticket Link:
https://pagure.io/fedora-infrastructure/issue/11345
Please join #fedora-admin or #fedora-noc on irc.libera.chat
or add comments to the ticket for this outage above.
There will be an outage starting at 2023-06-01 05:00 UTC,
which will last approximately 24 hours.
To convert UTC to your local time, take a look at
http://fedoraproject.org/wiki/Infrastructure/UTCHowto
or run:
date -d '2023-06-01 05:00UTC'
Reason for outage:
The Red Hat Westford location will have more power line work done. This will require the building to be powered down in places which will affect various services like network connections and s390x builders.
Affected Services:
koji builds and composes will be affected with builds waiting until the s390x builders are able to complete the work.
Ticket Link:
https://pagure.io/fedora-infrastructure/issue/11345
Please join #fedora-admin or #fedora-noc on irc.libera.chat
or add comments to the ticket for this outage above.
Stephen Smoogen, Red Hat Automotive
Let us be kind to one another, for most of us are fighting a hard battle. -- Ian MacClarenOpenBSD Errata: May 26, 2023 (rpki ssl)
Errata patches for rpki-client and LibreSSL libssl have been released
for OpenBSD 7.2 and 7.3.
Binary updates for the amd64, i386 and arm64 platform are available
via the syspatch utility. Source code patches can be found on the
respective errata page:
https://www.openbsd.org/errata72.html
https://www.openbsd.org/errata73.html
for OpenBSD 7.2 and 7.3.
Binary updates for the amd64, i386 and arm64 platform are available
via the syspatch utility. Source code patches can be found on the
respective errata page:
https://www.openbsd.org/errata72.html
https://www.openbsd.org/errata73.html
Thursday, May 25, 2023
[USN-6109-1] Linux kernel (Raspberry Pi) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6109-1
May 25, 2023
linux-raspi, linux-raspi-5.4 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-raspi: Linux kernel for Raspberry Pi systems
- linux-raspi-5.4: Linux kernel for Raspberry Pi systems
Details:
Zheng Wang discovered that the Intel i915 graphics driver in the Linux
kernel did not properly handle certain error conditions, leading to a
double-free. A local attacker could possibly use this to cause a denial of
service (system crash). (CVE-2022-3707)
Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did
not properly implement speculative execution barriers in usercopy functions
in certain situations. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2023-0459)
It was discovered that the TLS subsystem in the Linux kernel contained a
type confusion vulnerability in some situations. A local attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2023-1075)
It was discovered that the Reliable Datagram Sockets (RDS) protocol
implementation in the Linux kernel contained a type confusion vulnerability
in some situations. An attacker could use this to cause a denial of service
(system crash). (CVE-2023-1078)
Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel
did not properly initialize some data structures. A local attacker could
use this to expose sensitive information (kernel memory). (CVE-2023-1513)
It was discovered that a use-after-free vulnerability existed in the iSCSI
TCP implementation in the Linux kernel. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2023-2162)
It was discovered that the NET/ROM protocol implementation in the Linux
kernel contained a race condition in some situations, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2023-32269)
Duoming Zhou discovered that a race condition existed in the infrared
receiver/transceiver driver in the Linux kernel, leading to a use-after-
free vulnerability. A privileged attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2023-1118)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.4.0-1085-raspi 5.4.0-1085.96
linux-image-raspi 5.4.0.1085.115
linux-image-raspi2 5.4.0.1085.115
Ubuntu 18.04 LTS:
linux-image-5.4.0-1085-raspi 5.4.0-1085.96~18.04.1
linux-image-raspi-hwe-18.04 5.4.0.1085.82
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6109-1
CVE-2022-3707, CVE-2023-0459, CVE-2023-1075, CVE-2023-1078,
CVE-2023-1118, CVE-2023-1513, CVE-2023-2162, CVE-2023-32269
Package Information:
https://launchpad.net/ubuntu/+source/linux-raspi/5.4.0-1085.96
https://launchpad.net/ubuntu/+source/linux-raspi-5.4/5.4.0-1085.96~18.04.1
Ubuntu Security Notice USN-6109-1
May 25, 2023
linux-raspi, linux-raspi-5.4 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-raspi: Linux kernel for Raspberry Pi systems
- linux-raspi-5.4: Linux kernel for Raspberry Pi systems
Details:
Zheng Wang discovered that the Intel i915 graphics driver in the Linux
kernel did not properly handle certain error conditions, leading to a
double-free. A local attacker could possibly use this to cause a denial of
service (system crash). (CVE-2022-3707)
Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did
not properly implement speculative execution barriers in usercopy functions
in certain situations. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2023-0459)
It was discovered that the TLS subsystem in the Linux kernel contained a
type confusion vulnerability in some situations. A local attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2023-1075)
It was discovered that the Reliable Datagram Sockets (RDS) protocol
implementation in the Linux kernel contained a type confusion vulnerability
in some situations. An attacker could use this to cause a denial of service
(system crash). (CVE-2023-1078)
Xingyuan Mo discovered that the x86 KVM implementation in the Linux kernel
did not properly initialize some data structures. A local attacker could
use this to expose sensitive information (kernel memory). (CVE-2023-1513)
It was discovered that a use-after-free vulnerability existed in the iSCSI
TCP implementation in the Linux kernel. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2023-2162)
It was discovered that the NET/ROM protocol implementation in the Linux
kernel contained a race condition in some situations, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2023-32269)
Duoming Zhou discovered that a race condition existed in the infrared
receiver/transceiver driver in the Linux kernel, leading to a use-after-
free vulnerability. A privileged attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2023-1118)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
linux-image-5.4.0-1085-raspi 5.4.0-1085.96
linux-image-raspi 5.4.0.1085.115
linux-image-raspi2 5.4.0.1085.115
Ubuntu 18.04 LTS:
linux-image-5.4.0-1085-raspi 5.4.0-1085.96~18.04.1
linux-image-raspi-hwe-18.04 5.4.0.1085.82
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6109-1
CVE-2022-3707, CVE-2023-0459, CVE-2023-1075, CVE-2023-1078,
CVE-2023-1118, CVE-2023-1513, CVE-2023-2162, CVE-2023-32269
Package Information:
https://launchpad.net/ubuntu/+source/linux-raspi/5.4.0-1085.96
https://launchpad.net/ubuntu/+source/linux-raspi-5.4/5.4.0-1085.96~18.04.1
[USN-6054-2] Django vulnerability
==========================================================================
Ubuntu Security Notice USN-6054-2
May 25, 2023
python-django vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
A Django hardening measure could be bypassed.
Software Description:
- python-django: High-level Python web development framework
Details:
USN-6054-1 fixed a vulnerability in Django. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Moataz Al-Sharida and nawaik discovered that Django incorrectly handled
uploading multiple files using one form field. A remote attacker could
possibly use this issue to bypass certain validations.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
python-django 1.8.7-1ubuntu5.15+esm7
python-django-doc 1.8.7-1ubuntu5.15+esm7
python3-django 1.8.7-1ubuntu5.15+esm7
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
python-django 1.6.11-0ubuntu1.3+esm6
python-django-doc 1.6.11-0ubuntu1.3+esm6
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6054-2
https://ubuntu.com/security/notices/USN-6054-1
CVE-2023-31047
Ubuntu Security Notice USN-6054-2
May 25, 2023
python-django vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
A Django hardening measure could be bypassed.
Software Description:
- python-django: High-level Python web development framework
Details:
USN-6054-1 fixed a vulnerability in Django. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Moataz Al-Sharida and nawaik discovered that Django incorrectly handled
uploading multiple files using one form field. A remote attacker could
possibly use this issue to bypass certain validations.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
python-django 1.8.7-1ubuntu5.15+esm7
python-django-doc 1.8.7-1ubuntu5.15+esm7
python3-django 1.8.7-1ubuntu5.15+esm7
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
python-django 1.6.11-0ubuntu1.3+esm6
python-django-doc 1.6.11-0ubuntu1.3+esm6
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6054-2
https://ubuntu.com/security/notices/USN-6054-1
CVE-2023-31047
[USN-6105-2] ca-certificates update
==========================================================================
Ubuntu Security Notice USN-6105-2
May 24, 2023
ca-certificates update
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
The CA certificates in the ca-certificates package were updated.
Software Description:
- ca-certificates: Common CA certificates
Details:
USN-6105-1 updated ca-certificates. This provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
The ca-certificates package contained outdated CA certificates. This update
refreshes the included certificates to those contained in the 2.60 version
of the Mozilla certificate authority bundle.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
ca-certificates 20230311~16.04.1~esm1
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
ca-certificates 20230311~14.04.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6105-2
https://ubuntu.com/security/notices/USN-6105-1
https://launchpad.net/bugs/
Ubuntu Security Notice USN-6105-2
May 24, 2023
ca-certificates update
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
The CA certificates in the ca-certificates package were updated.
Software Description:
- ca-certificates: Common CA certificates
Details:
USN-6105-1 updated ca-certificates. This provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
The ca-certificates package contained outdated CA certificates. This update
refreshes the included certificates to those contained in the 2.60 version
of the Mozilla certificate authority bundle.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
ca-certificates 20230311~16.04.1~esm1
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
ca-certificates 20230311~14.04.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6105-2
https://ubuntu.com/security/notices/USN-6105-1
https://launchpad.net/bugs/
[USN-6108-1] Jhead vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6108-1
May 25, 2023
Jhead vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Jhead could be made to crash or run programs as your login if it
opened a specially crafted file.
Software Description:
- jhead: Manipulate the non-image part of Exif compliant JPEG files
Details:
It was discovered that Jhead did not properly handle certain crafted images
while rotating them. An attacker could possibly use this issue to crash Jhead,
resulting in a denial of service. (CVE-2021-34055)
Kyle Brown discovered that Jhead did not properly handle certain crafted
images while regenerating the Exif thumbnail. An attacker could possibly use
this issue to execute arbitrary commands. (CVE-2022-41751)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.10:
jhead 1:3.06.0.1-2ubuntu0.22.10.1
Ubuntu 22.04 LTS:
jhead 1:3.06.0.1-2ubuntu0.22.04.1
Ubuntu 20.04 LTS:
jhead 1:3.04-1ubuntu0.2
Ubuntu 18.04 LTS:
jhead 1:3.00-8~ubuntu0.2
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
jhead 1:3.00-4+deb9u1ubuntu0.1~esm2
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
jhead 1:2.97-1+deb8u2ubuntu0.1~esm2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6108-1
CVE-2021-34055, CVE-2022-41751
Package Information:
https://launchpad.net/ubuntu/+source/jhead/1:3.06.0.1-2ubuntu0.22.10.1
https://launchpad.net/ubuntu/+source/jhead/1:3.06.0.1-2ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/jhead/1:3.04-1ubuntu0.2
https://launchpad.net/ubuntu/+source/jhead/1:3.00-8~ubuntu0.2
Ubuntu Security Notice USN-6108-1
May 25, 2023
Jhead vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Jhead could be made to crash or run programs as your login if it
opened a specially crafted file.
Software Description:
- jhead: Manipulate the non-image part of Exif compliant JPEG files
Details:
It was discovered that Jhead did not properly handle certain crafted images
while rotating them. An attacker could possibly use this issue to crash Jhead,
resulting in a denial of service. (CVE-2021-34055)
Kyle Brown discovered that Jhead did not properly handle certain crafted
images while regenerating the Exif thumbnail. An attacker could possibly use
this issue to execute arbitrary commands. (CVE-2022-41751)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.10:
jhead 1:3.06.0.1-2ubuntu0.22.10.1
Ubuntu 22.04 LTS:
jhead 1:3.06.0.1-2ubuntu0.22.04.1
Ubuntu 20.04 LTS:
jhead 1:3.04-1ubuntu0.2
Ubuntu 18.04 LTS:
jhead 1:3.00-8~ubuntu0.2
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
jhead 1:3.00-4+deb9u1ubuntu0.1~esm2
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
jhead 1:2.97-1+deb8u2ubuntu0.1~esm2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6108-1
CVE-2021-34055, CVE-2022-41751
Package Information:
https://launchpad.net/ubuntu/+source/jhead/1:3.06.0.1-2ubuntu0.22.10.1
https://launchpad.net/ubuntu/+source/jhead/1:3.06.0.1-2ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/jhead/1:3.04-1ubuntu0.2
https://launchpad.net/ubuntu/+source/jhead/1:3.00-8~ubuntu0.2
Wednesday, May 24, 2023
[USN-6100-1] HTML::StripScripts vulnerability
==========================================================================
Ubuntu Security Notice USN-6100-1
May 23, 2023
libhtml-stripscripts-perl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
HTML::StripScripts could be made to crash if it received specially crafted
input.
Software Description:
- libhtml-stripscripts-perl: module for removing scripts from HTML
Details:
It was discovered that HTML::StripScripts does not properly parse HTML
content with certain style attributes. A remote attacker could use this issue
to cause a regular expression denial of service (ReDoS).
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.10:
libhtml-stripscripts-perl 1.06-2ubuntu0.1
Ubuntu 22.04 LTS:
libhtml-stripscripts-perl 1.06-1ubuntu0.22.04.1
Ubuntu 20.04 LTS:
libhtml-stripscripts-perl 1.06-1ubuntu0.20.04.1
Ubuntu 18.04 LTS:
libhtml-stripscripts-perl 1.06-1ubuntu0.18.04.1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libhtml-stripscripts-perl 1.05-2ubuntu0.1~esm1
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
libhtml-stripscripts-perl 1.05-1ubuntu0.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6100-1
CVE-2023-24038
Package Information:
https://launchpad.net/ubuntu/+source/libhtml-stripscripts-perl/1.06-2ubuntu0.1
https://launchpad.net/ubuntu/+source/libhtml-stripscripts-perl/1.06-1ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/libhtml-stripscripts-perl/1.06-1ubuntu0.20.04.1
https://launchpad.net/ubuntu/+source/libhtml-stripscripts-perl/1.06-1ubuntu0.18.04.1
Ubuntu Security Notice USN-6100-1
May 23, 2023
libhtml-stripscripts-perl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
HTML::StripScripts could be made to crash if it received specially crafted
input.
Software Description:
- libhtml-stripscripts-perl: module for removing scripts from HTML
Details:
It was discovered that HTML::StripScripts does not properly parse HTML
content with certain style attributes. A remote attacker could use this issue
to cause a regular expression denial of service (ReDoS).
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.10:
libhtml-stripscripts-perl 1.06-2ubuntu0.1
Ubuntu 22.04 LTS:
libhtml-stripscripts-perl 1.06-1ubuntu0.22.04.1
Ubuntu 20.04 LTS:
libhtml-stripscripts-perl 1.06-1ubuntu0.20.04.1
Ubuntu 18.04 LTS:
libhtml-stripscripts-perl 1.06-1ubuntu0.18.04.1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libhtml-stripscripts-perl 1.05-2ubuntu0.1~esm1
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
libhtml-stripscripts-perl 1.05-1ubuntu0.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6100-1
CVE-2023-24038
Package Information:
https://launchpad.net/ubuntu/+source/libhtml-stripscripts-perl/1.06-2ubuntu0.1
https://launchpad.net/ubuntu/+source/libhtml-stripscripts-perl/1.06-1ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/libhtml-stripscripts-perl/1.06-1ubuntu0.20.04.1
https://launchpad.net/ubuntu/+source/libhtml-stripscripts-perl/1.06-1ubuntu0.18.04.1
[USN-6106-1] calamares-settings-ubuntu vulnerability
==========================================================================
Ubuntu Security Notice USN-6106-1
May 24, 2023
calamares-settings-ubuntu vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
The system could be made to expose sensitive information.
Software Description:
- calamares-settings-ubuntu: Lubuntu Calamares Settings and Branding
Details:
It was discovered that calamares-settings-ubuntu allowed creating the first
user with a blank password, contrary to expectations.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
calamares-settings-ubuntu-common 1:22.04.4.3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6106-1
https://launchpad.net/bugs/2016436
Package Information:
https://launchpad.net/ubuntu/+source/calamares-settings-ubuntu/1:22.04.4.3
Ubuntu Security Notice USN-6106-1
May 24, 2023
calamares-settings-ubuntu vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
The system could be made to expose sensitive information.
Software Description:
- calamares-settings-ubuntu: Lubuntu Calamares Settings and Branding
Details:
It was discovered that calamares-settings-ubuntu allowed creating the first
user with a blank password, contrary to expectations.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
calamares-settings-ubuntu-common 1:22.04.4.3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6106-1
https://launchpad.net/bugs/2016436
Package Information:
https://launchpad.net/ubuntu/+source/calamares-settings-ubuntu/1:22.04.4.3
[USN-6105-1] ca-certificates update
==========================================================================
Ubuntu Security Notice USN-6105-1
May 24, 2023
ca-certificates update
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.04
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
The CA certificates in the ca-certificates package were updated.
Software Description:
- ca-certificates: Common CA certificates
Details:
The ca-certificates package contained outdated CA certificates. This update
refreshes the included certificates to those contained in the 2.60 version
of the Mozilla certificate authority bundle.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.04:
ca-certificates 20230311ubuntu0.23.04.1
Ubuntu 22.10:
ca-certificates 20230311ubuntu0.22.10.1
Ubuntu 22.04 LTS:
ca-certificates 20230311ubuntu0.22.04.1
Ubuntu 20.04 LTS:
ca-certificates 20230311ubuntu0.20.04.1
Ubuntu 18.04 LTS:
ca-certificates 20230311ubuntu0.18.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6105-1
https://launchpad.net/bugs/2020089
Package Information:
https://launchpad.net/ubuntu/+source/ca-certificates/20230311ubuntu0.23.04.1
https://launchpad.net/ubuntu/+source/ca-certificates/20230311ubuntu0.22.10.1
https://launchpad.net/ubuntu/+source/ca-certificates/20230311ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/ca-certificates/20230311ubuntu0.20.04.1
https://launchpad.net/ubuntu/+source/ca-certificates/20230311ubuntu0.18.04.1
Ubuntu Security Notice USN-6105-1
May 24, 2023
ca-certificates update
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.04
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
The CA certificates in the ca-certificates package were updated.
Software Description:
- ca-certificates: Common CA certificates
Details:
The ca-certificates package contained outdated CA certificates. This update
refreshes the included certificates to those contained in the 2.60 version
of the Mozilla certificate authority bundle.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.04:
ca-certificates 20230311ubuntu0.23.04.1
Ubuntu 22.10:
ca-certificates 20230311ubuntu0.22.10.1
Ubuntu 22.04 LTS:
ca-certificates 20230311ubuntu0.22.04.1
Ubuntu 20.04 LTS:
ca-certificates 20230311ubuntu0.20.04.1
Ubuntu 18.04 LTS:
ca-certificates 20230311ubuntu0.18.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6105-1
https://launchpad.net/bugs/2020089
Package Information:
https://launchpad.net/ubuntu/+source/ca-certificates/20230311ubuntu0.23.04.1
https://launchpad.net/ubuntu/+source/ca-certificates/20230311ubuntu0.22.10.1
https://launchpad.net/ubuntu/+source/ca-certificates/20230311ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/ca-certificates/20230311ubuntu0.20.04.1
https://launchpad.net/ubuntu/+source/ca-certificates/20230311ubuntu0.18.04.1
Subscribe to:
Posts (Atom)