Wiki - https://fedoraproject.org/wiki/Changes/SwitchToDnf5
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
Change the default package manager from dnf to dnf5.
== Owner ==
* Name: [[User:jkolarik| Jan Kolarik]]
* Email: jkolarik@redhat.com
* Name: [[User:jmracek| Jaroslav Mracek]]
* Email: jmracek@redhat.com
== Detailed Description ==
This proposal will implement several topics, which are outlined below.
=== Provider of the dnf command ===
This change proposes to switch the current provider of the
/usr/bin/dnf symlink from dnf to dnf5. Currently, the symlink target
is /usr/bin/dnf-3, provided by the dnf sub-package, python3-dnf. Upon
implementation of this change, the symlink will point to
/usr/bin/dnf5, provided by the dnf5 package.
=== Prepare the upgrade path ===
The dnf5 package, serving as the new provider of the /usr/bin/dnf
symlink, will obsolete the dnf package starting with Fedora 41. Upon
the release of this dnf5 package, upgrading the system or installing
dnf5 will replace the existing dnf package on the system.
Additionally, the dnf5 package will provide a /usr/bin/yum symlink for
backwards compatibility and the dnf-automatic command will be
obsoleted.
=== Feature parity with dnf ===
We aim to cover the majority of use cases available in the existing
dnf package. However, there are some features that may not be
implemented in time. Nevertheless, we plan to deliver them at a later
stage.
==== Plugins ====
The progress of implementing plugins to match the current set from the
dnf-plugins-core package is tracked
[https://github.com/rpm-software-management/dnf5/issues/389 upstream].
Among the missing plugins, we still plan to implement:
* debuginfo-install plugin
* reposync plugin
==== Modularity ====
As support for modularity was retired in Fedora 39, dnf5 currently
only implements a basic feature set for listing and enabling/disabling
modules.
=== Background service support ===
A new daemonized service, dnf5daemon, utilizing the D-Bus interface,
is prepared for clients as a sub-package. This will serve as an
alternative or replacement for the PackageKit layer. Integration of
dnf5daemon support into the default Fedora user interface, GNOME
Software, is currently in progress
=== Documentation of API changes ===
The public interface has undergone significant changes to enhance the
user experience and remove unused and obsolete code components. To
facilitate user migration to the new CLI and API interfaces, a
[https://dnf5.readthedocs.io/en/latest/changes.html guide] was
prepared covering all differences compared to the interface provided
by the existing dnf package, along with examples of typical use cases.
=== Deployment tasks ===
During the deployment of the dnf5 package manager as the new default,
several adjustments need to be made both to the infrastructure and the
dnf5 package itself. Some of these adjustments are detailed [[#Release
engineering|below]]. To ensure synchronization and address all
necessary changes, we've established an upstream tracking
[https://github.com/rpm-software-management/dnf5/issues/1057 issue].
== Feedback ==
As this is the second iteration of such a proposal, we've gathered a
lot of feedback from various sources during the first attempt to
accept this change.
=== FESCo inputs ===
A [https://pagure.io/fesco/issue/3039 ticket] discussing the reasons
why the contingency mechanism was invoked for the first attempt of the
proposal was opened by FESCo. It includes a list of items that are
either incomplete or in progress.
Below is a list of issues from the ticket that are still unresolved or
require clarification on their current status. Other items not
mentioned below are considered completed.
==== Switch in ELN ====
This should not block the proposal, as the current plan is to target
RHEL 11. Integration can occur there after the proposal is implemented
for Fedora 41.
==== Aligning configuration with the current state in dnf ====
All overrides to match the current state of dnf configuration will be
provided to the Fedora release project, see [[#Apply downstream
configuration overrides|below]].
==== System upgrade and offline transactions ====
The implementation work has been completed and is already present
upstream. We anticipate extensive testing during the summer, and we
also plan to organize testing days for this purpose.
==== Dropping the Snapper plugin ====
In dnf5, we've adopted a new approach for implementing functionality
that was previously handled by the Snapper plugin in dnf.
We're introducing the Actions plugin, which offers more capabilities
than the Snapper plugin, including support for running external
applications before or after transactions and interacting with the
dnf5 configuration.
[https://dnf5.readthedocs.io/en/latest/libdnf5_plugins/actions.8.html
Here] is the documentation for the Actions plugin, which includes
examples of how to emulate the behavior of the Snapper plugin.
==== Messages from RPM scriptlets ====
An issue with output from RPM scriptlets is the potential length,
coupled with the absence of a standardized policy for distinguishing
between important and unimportant messages.
Currently, all messages are logged in the dnf5 log files, with
differentiation based on their originating scriptlets, representing an
improvement over dnf. Additionally, in case of transaction errors, the
scriptlet output is included in the standard output. Furthermore,
there is already a resolved [https://pagure.io/koji/issue/4009 ticket]
in the infrastructure to incorporate logs on the builders.
=== Testing days ===
We've already held two dnf5 test days for Fedora
[https://fedoraproject.org/wiki/Test_Day:2023-03-14_Fedora_38_DNF_5
38] and [https://fedoraproject.org/wiki/Test_Day:2023-08-11_Fedora_39_DNF_5
39]. We've made efforts to document all reported issues in our
upstream tracking system, and major issues should now be resolved.
Some of these issues were related to user documentation, improving
command-line outputs, and enhancing overall user experience. These
topics are next on our priority list after completing the
functionality for mandatory commands and plugins.
=== Fedora QA scenarios ===
We've started a discussion
[https://discussion.fedoraproject.org/t/requirements-for-dnf5-in-fedora-41
thread] on the requirements for accepting this proposal from a QA
perspective. A list of relevant test cases and criteria has been
mentioned, which we'll review to ensure we've covered everything on
our end.
=== Fedora CI readiness ===
The dnf project is also deployed in the CI pipeline. We've initiated
communications with this team to ensure that all dnf functionality
used there is either already implemented in dnf5 or can be addressed
through an alternative dnf5 method. We've already received some
feedback from the first iteration of the proposal.
=== Tracking issue upstream ===
When implementing the first iteration of this proposal, we created an
upstream [https://github.com/rpm-software-management/dnf5/issues/635
ticket] to track all bugs or lack of needed functionality. All items
have been addressed, and only several known deployment issues remain,
which need to be managed at the time of the next switch.
== Benefit to Fedora ==
The new dnf5 will significantly improve the user experience and
performance. Detailed descriptions of individual areas are provided
below.
=== Reduced footprint ===
The dnf5 package is a fully-featured package manager that doesn't
require Python dependencies.
It also reduces the number of software management tools in Fedora by
replacing both the dnf and microdnf packages.
The installation size of the dnf5 stack in an empty container is
approximately 60% smaller than the dnf installation.
Currently, dnf, microdnf, and PackageKit use their own cache, leading
to significant metadata redundancy. With dnf5 and dnf5daemon, which
share metadata, this redundancy will be eliminated.
=== Enhanced performance ===
Loading and downloading repository metadata now occur concurrently.
Package query operations, including processing numerous command-line
arguments, have been significantly accelerated.
=== Lowered maintenance costs ===
Many functional duplicates in dnf were eliminated during the
development of the new dnf5 package manager. This was partly because
the integration of the original PackageKit and dnf libraries into the
original libdnf library was never completed.
Plugins are now included in the same package as the core functionality.
=== Unified user experience ===
Consistent user experience is offered to users across servers,
workstations, and containers, as dnf5 is the sole package manager
deployed there. Existing dnf, yum, and microdnf commands will be
linked to dnf5, while compatibility aliases for essential use cases
will be provided to facilitate migration.
Configuration files will be shared among dnf5 components.
API users will encounter unified code style and naming conventions.
Various scripting language interfaces are now provided from a single
source using SWIG bindings (formerly CPython and SWIG).
== Scope ==
=== Proposal owners ===
The remaining work on the proposal can be divided into several sections.
==== Feature implementation ====
===== [https://github.com/rpm-software-management/dnf5/issues/1052
System upgrade] =====
This command is essential for upgrading the system to the next
release. While the implementation is already completed, we plan to
conduct extensive testing, including community participation, to
minimize the risk of issues occurring in production.
===== [https://github.com/rpm-software-management/dnf5/issues/140
History command] =====
The functionality related to manipulating transaction history has not
yet been implemented. However, following the completion of the system
upgrade functionality, it is currently our top priority. Due to the
significant overlap between the functionality in the history command
and the system upgrade functionality, we anticipate its readiness
shortly thereafter.
===== [https://github.com/rpm-software-management/dnf5/issues/169
GNOME Software support] =====
The integration of dnf5 support, particularly dnf5daemon, into GNOME
Software is currently underway. Developers from both DNF5 and GNOME
Software are closely connected and regularly synchronize the progress
of their work.
==== Documentation ====
While our current priority is achieving full coverage of
[https://dnf5.readthedocs.io/en/latest/ user and API documentation],
there may still be some undocumented parts of the code. Please don't
hesitate to [https://github.com/rpm-software-management/dnf5/issues/new
report] any such issues upstream, and we'll endeavor to address them
promptly.
==== Early access for developmental branch users ====
The intention is to implement the proposed changes in the Rawhide
developmental branch prior to the date specified in the Contingency
Deadline section, targeting the transition period between March and
April. It is anticipated that certain mandatory items for the regular
release, as outlined in previous sections, may not be completed by
this time.
===== System upgrade =====
This functionality is unnecessary as Rawhide operates on a rolling
release model.
===== GNOME Software =====
Rawhide users will continue to utilize the current PackageKit backend
connected to the existing libdnf interface. These libraries can
coexist with the new dnf5 package on the same system. Although the
setup is not ideal due to differences in package state metadata
formats stored at separate locations, resulting in inefficient storage
usage, this is generally imperceptible for typical GUI users.
Furthermore, the underlying RPM DB remains the sole shared source of
information about installed packages.
=== Other developers ===
The following components are already prepared for transition to dnf5:
* [https://github.com/ansible/ansible/issues/78898 Ansible]
* [https://github.com/rpm-software-management/dnf5/issues/66 Lorax]
* [https://github.com/rpm-software-management/mock/issues/894 Mock]
Below is a list of dependencies that have not yet integrated with dnf5.
==== Anaconda ====
Migration to the dnf5 API will not be implemented at this time. After
discussion with the Anaconda team, it was determined that there isn't
sufficient capacity and time to complete the work on schedule.
Therefore, the existing dnf4 Python bindings from the python3-dnf
package will continue to be used for now.
==== GNOME Software ====
This integration is already addressed in the section above, as it
involves collaborative efforts.
=== Release engineering ===
==== Building with dnf5 ====
The Fedora infrastructure has been utilizing dnf5 for building Fedora
40+ chroots since before the Fedora 40 mass rebuilds began. This
implementation was based on the system-wide change outlined
[https://fedoraproject.org/wiki/Changes/BuildWithDNF5 here].
==== Apply downstream configuration overrides ====
Starting with dnf5, distro-specific overrides of the default
configuration values are implemented using
[https://dnf5.readthedocs.io/en/latest/dnf5.conf.5.html#drop-in-configuration-directories
drop-in directories]. Options with different values upstream compared
to the current state of dnf in Fedora will be filed in a pull request
against the [https://src.fedoraproject.org/rpms/fedora-release Fedora
release project].
==== Update of kickstarts for image composes ====
The dnf team will prepare a pull request to include the packages for
the new default dnf5 package manager in the
[https://pagure.io/fedora-kickstarts Fedora Kickstarts project].
==== Update of package groups definitions ====
The dnf team will prepare a pull request to include the packages for
the new default dnf5 package manager in the
[https://pagure.io/fedora-comps Fedora Comps project].
==== Update of KIWI image descriptions ====
The dnf team will prepare a pull request to include the packages for
the new default dnf5 package manager in the
[https://pagure.io/fedora-kiwi-descriptions Fedora KIWI descriptions
project].
== Upgrade/compatibility impact ==
=== Running the upgrade ===
The dnf5 package will be installed on the system to provide
/usr/bin/dnf, replacing the existing dnf package as it becomes
obsolete. Additionally, the dnf automatic tool will be replaced by the
new dnf5 automatic plugin.
Below is an example of performing this upgrade transaction.
<pre>
$ sudo dnf upgrade
Last metadata expiration check: 0:01:09 ago on Wed 13 Mar 2024 05:48:25 AM EDT.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
dnf5-plugin-automatic x86_64 5.1.14-1.fc41 rawhide 120 k
replacing dnf-automatic.noarch 4.19.0-1.fc40
Upgrading:
dnf-data noarch 4.19.0-1.fc41 rawhide 40 k
python3-dnf noarch 4.19.0-1.fc41 rawhide 551 k
Installing group/module packages:
dnf5 x86_64 5.1.14-1.fc41 rawhide 599 k
replacing dnf.noarch 4.19.0-1.fc40
replacing yum.noarch 4.19.0-1.fc40
Installing dependencies:
fmt x86_64 10.2.1-3.fc40 rawhide 125 k
libdnf5 x86_64 5.1.14-1.fc41 rawhide 991 k
libdnf5-cli x86_64 5.1.14-1.fc41 rawhide 229 k
Installing weak dependencies:
bash-completion noarch 1:2.11-15.fc41 rawhide 360 k
Transaction Summary
================================================================================
Install 6 Packages
Upgrade 2 Packages
</pre>
=== Binaries and symlinks ===
The existing dnf binaries will remain on the system and will be
available at /usr/bin/dnf-3, which refers to the Python 3 version to
which dnf was migrated in the past. Additionally, they will be
accessible at /usr/bin/dnf4, which is a symlink to the dnf-3 script
and denotes the major version of the dnf binary. This binary naming
convention is also used for /usr/bin/dnf5, which will become the
target of the /usr/bin/dnf symlink.
Below is the output of the tree command showing the expected file
structure after the upgrade.
==== Before upgrade ====
<pre>
$ tree /usr/bin/ -P dnf*
/usr/bin/
├── dnf -> dnf-3
├── dnf-3
└── dnf4 -> dnf-3
</pre>
==== After upgrade ====
<pre>
$ tree /usr/bin/ -P dnf*
/usr/bin/
├── dnf -> dnf5
├── dnf-3
├── dnf4 -> dnf-3
└── dnf5
</pre>
=== Different system state ===
The transactional history in dnf and dnf5 is not shared, and they now
use different formats. Transactions performed in dnf will not be
visible in dnf5, and vice versa.
While the history database is not migrated to dnf5, when running a
transaction in dnf5 for the first time, an attempt is made to convert
and load the existing system state from dnf. This should preserve
information about the reasons for installed packages and prevent them
from being treated as user-installed, requiring manual removal from
the system instead of being seen as dependencies of explicitly removed
packages.
=== Compatibility ===
While the majority of CLI use cases for managing packages should
remain the same, the dnf5 API has undergone significant changes. To
ease adoption, dnf5 will provide compatibility aliases for commands
and options. Additionally, user output will differ, and we plan to
offer machine-readable support for most commands. For more details,
please refer to the section above.
Applications encountering difficulties with dnf5 adoption can continue
using the existing dnf CLI and API provided by the python3-dnf and
libdnf packages. These libraries can be used in parallel on the
system, but modifying installed software is not recommended due to
differences in system state, as mentioned in the [[#Documentation of
API changes|previous]] section.
== How To Test ==
=== Copr repository ===
[https://copr.fedorainfracloud.org/coprs/rpmsoftwaremanagement/dnf5-testing/
A testing Copr repository] has been set up with dnf5 already deployed
as the default package manager. Instructions on how to proceed are
provided alongside.
=== Quay containers ===
We have also prepared Fedora container images with the dnf5 stack
preinstalled on
[https://quay.io/repository/rpmsoftwaremanagement/fedora-dnf5
quay.io], making it easy to test in isolation with Podman.
=== Side-tag for testing ===
Before pushing the new dnf5 into the Rawhide compose, we plan to
announce the prepared side-tag containing this new package publicly.
This will allow interested parties to test it against their software.
=== Testing days ===
We are planning at least two iterations of testing days before dnf5 is
delivered into Fedora 41. One will focus on testing the overall
functionality of dnf5, with an emphasis on parts that were not tested
during previous testing days. The other iteration will center around
testing the system upgrade functionality.
=== Communication channels ===
Community feedback, including bug reports, issues, or feature
requests, is highly encouraged.
Our primary communication channel is
[https://github.com/rpm-software-management/dnf5 upstream], where you
can report [https://github.com/rpm-software-management/dnf5/issues
issues], participate in
[https://github.com/rpm-software-management/dnf5/discussions
discussions], or even propose
[https://github.com/rpm-software-management/dnf5/pulls pull requests].
We are happy to review them.
Issues specific to a particular version of the dnf5 package can also
be reported through the
[https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=dnf5
Bugzilla] tracking system, which we also monitor.
== User Experience ==
=== Faster query processing ===
The processing of package metadata is now significantly faster.
Executing commands such as repoquery to list packages available in
repositories is now twice as fast compared to dnf. Similarly,
operations like listing dependencies or parsing numerous command-line
arguments are notably expedited, potentially saving users seconds to
tens of seconds in waiting time for the results.
=== Consolidated and streamlined API ===
The API for managing packages, working with repositories, and solving
package dependencies is now consolidated into a single component,
providing a unified solution. The original dnf API underwent a review
process, during which unused workflows and obsolete methods were
removed, while improving usability for users.
=== Enhanced command-line outputs ===
Transaction tables now offer more detailed information, verbose
scriptlet outputs are redirected and organized by package name into
log files, individual commands come with their own man pages, bash
completion has been enhanced, and numerous other improvements have
been made.
== Dependencies ==
=== Owned by our team ===
==== dnf-plugins-core ====
Installed plugins will persist on the system and remain functional
using the dnf4 binary from the python3-dnf package.
With the exception of the system upgrade plugin, all essential plugins
are now implemented in dnf5 and are provided by the dnf5-plugins
package or dnf5 directly.
==== dnf-plugins-extras ====
Installed plugins will persist on the system and remain functional
using the dnf4 binary from the python3-dnf package.
Porting the functionality to dnf5 is currently of low priority, and
its implementation depends more on community involvement. The
functionality of the Snapper plugin is already covered by the dnf5
actions plugin.
=== Requirements on dnf ===
This is the most critical category of packages as issues connected
with them can potentially disrupt the system upgrade path.
Here, we can split components into two groups.
The first group utilizes dnf from the command line interface (CLI),
and thus, they either need to adjust to the new syntax and behavior of
dnf5 or switch to utilizing the existing dnf4 binary directly.
The second group consists of components providing plugins for the dnf
command. These plugins will remain functional using the binary from
python3-dnf, requiring packaging changes to depend on this package
instead.
<pre>
auter
calamares
copr-builder
cpanspec
dnfdragora
etckeeper-dnf
fedora-review
fedora-upgrade
kiwi-systemdeps-core
libdnf-plugin-subscription-manager
lpf
mock
osbuild
perl-CPAN-Plugin-Sysdeps
rbm
rpmdistro-repoquery
supermin
system-config-language
</pre>
A tracking [https://github.com/rpm-software-management/dnf5/issues/418
issue] was created in advance to inform maintainers about the planned
switch to dnf5.
=== Requirements on python3-dnf ===
Here, we can also categorize components into two groups.
The first group consists of components providing plugins for the dnf
command. These plugins will remain functional using the binary from
python3-dnf, requiring packaging changes to depend on this package
instead.
The second group utilizes the dnf's Python API, and they should not be
directly affected by the change. However, testing is still necessary,
and it is strongly recommended to consider porting to the dnf5 API.
<pre>
anaconda-core
copr-builder
dnf-plugin-diff
dnf-plugin-ovl
dnfdaemon
fedora-easy-karma
fedora-review
fedrq
lorax
mock-core-configs
module-build-service
modulemd-tools
needrestart
policycoreutils-devel
pungi
python3-dnf-plugin-cow
python3-dnf-plugin-flunk_dependent_remove
python3-dnf-plugin-perfmetrics
python3-imgcreate
python3-libreport
retrace-server
subscription-manager
system-config-language
</pre>
=== Requirements on libdnf ===
These packages utilize the libdnf API and should not be directly
impacted by the change. However, testing is still necessary.
Tools that modify system software, such as PackageKit, may exhibit
different behavior when used alongside dnf5 to manage the same system,
as previously described.
Additionally, it is strongly recommended to consider porting to the
dnf5 API in this context.
<pre>
PackageKit
copr-builder
libdnf-plugin-subscription-manager
libdnf-plugin-swidtags
libdnf-plugin-txnupd
</pre>
=== Requirements on python3-hawkey ===
These components utilize unsupported Hawkey Python bindings and should
not be directly impacted by the change. However, thorough testing is
necessary. Again, it is strongly recommended to consider porting to
the dnf5 API in this context.
<pre>
mock-core-configs
modulemd-tools
python3-rpmdeplint
retrace-server
</pre>
== Contingency Plan ==
=== Contingency mechanism ===
To revert to the previous state with dnf as the default package
manager on the system, the following steps would be necessary:
* Packaging changes in dnf5 to remove the obsoletion of dnf and
provider of the /usr/bin/dnf symlink.
* Untagging the candidate dnf5 package from the compose.
* Components that adapted to the dnf5 CLI must synchronize in this
process and revert the changes to use dnf4 again. Proactive
communication will be conducted similarly to how components were
informed about the dnf5 migration.
=== Contingency deadline ===
Branch Fedora Linux 41 from Rawhide
=== Blocks release? ===
No
== Documentation ==
=== [https://dnf5.readthedocs.io/en/latest/index.html Official
documentation] ===
=== [https://github.com/rpm-software-management/dnf5 Upstream project] ===
=== [https://dnf5.readthedocs.io/en/latest/changes.html Changes
between dnf and dnf5] ===
=== [https://dnf5.readthedocs.io/en/latest/dnf_daemon/dnf5daemon_dbus_api.8.html
D-Bus API documentation] ===
=== [https://github.com/rpm-software-management/dnf5/blob/main/CONTRIBUTING.md
Contributing guide for developers] ===
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Monday, March 25, 2024
[CentOS-announce] CESA-2024:1249 Important CentOS 7 kernel Security Update
CentOS Errata and Security Advisory 2024:1249 Important
Upstream details at : https://access.redhat.com/errata/RHSA-2024:1249
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
ebf604edce00a3a3778207eeaac06a3de226dbf62bfb987ed00584aa8d736ea1 bpftool-3.10.0-1160.114.2.el7.x86_64.rpm
4ea83e958a87df368396a4445d79a7047566af99a681051e97005b0c5b61aa05 kernel-3.10.0-1160.114.2.el7.src.rpm
d4e1ed8394af297a574fede15b7e0b3dcc28d263998175257f45e728f22fca91 kernel-3.10.0-1160.114.2.el7.x86_64.rpm
18d2703d9432cd3d8353acf0fb1f852fe4c15301b3d49fffac3f0194c6a4aaa0 kernel-abi-whitelists-3.10.0-1160.114.2.el7.noarch.rpm
fe01de01f7bcb863a54f276394f9ab097a0d29db56661a42eb33d27e4bef27f8 kernel-debug-3.10.0-1160.114.2.el7.x86_64.rpm
cfde4230671763bf6a464de9ec8c191195c9ae864571afd92bc7bea8dfcbb11e kernel-debug-devel-3.10.0-1160.114.2.el7.x86_64.rpm
74dfc146e5e4ab219dba838033e3a2a983e2ad796cee5a175fda1b6c17653193 kernel-devel-3.10.0-1160.114.2.el7.x86_64.rpm
b5a460913216927a863650ccef6d332b05a92836c9647e73a369720e9156fe84 kernel-doc-3.10.0-1160.114.2.el7.noarch.rpm
4aeb221b696dbe4b67c7b108b689cf26df6c7baa673fd4a529bd4df444eaf4fc kernel-headers-3.10.0-1160.114.2.el7.x86_64.rpm
2ba740802cbbc7ff23957b8b2a38c06b773a113b40708d05815b6081f7eecb19 kernel-tools-3.10.0-1160.114.2.el7.x86_64.rpm
d4ce276deccf36c3cdff38a52ff6f73bd2c271d8df45463c61cc66cdd8dd7e18 kernel-tools-libs-3.10.0-1160.114.2.el7.x86_64.rpm
bee03f8565ac02484c05292876b9c0976e9334dad12bbf643dd9f59526e9eb6d kernel-tools-libs-devel-3.10.0-1160.114.2.el7.x86_64.rpm
0af8a6a9e3b24968bed3be9b8de12ef658fbbfc2164edfd7186a7cced585e5ec perf-3.10.0-1160.114.2.el7.x86_64.rpm
850766245b53884b841d001909aa89898b167cf79a244d26c44c42dd775019c3 python-perf-3.10.0-1160.114.2.el7.x86_64.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@libera.chat
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHSA-2024:1249
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
ebf604edce00a3a3778207eeaac06a3de226dbf62bfb987ed00584aa8d736ea1 bpftool-3.10.0-1160.114.2.el7.x86_64.rpm
4ea83e958a87df368396a4445d79a7047566af99a681051e97005b0c5b61aa05 kernel-3.10.0-1160.114.2.el7.src.rpm
d4e1ed8394af297a574fede15b7e0b3dcc28d263998175257f45e728f22fca91 kernel-3.10.0-1160.114.2.el7.x86_64.rpm
18d2703d9432cd3d8353acf0fb1f852fe4c15301b3d49fffac3f0194c6a4aaa0 kernel-abi-whitelists-3.10.0-1160.114.2.el7.noarch.rpm
fe01de01f7bcb863a54f276394f9ab097a0d29db56661a42eb33d27e4bef27f8 kernel-debug-3.10.0-1160.114.2.el7.x86_64.rpm
cfde4230671763bf6a464de9ec8c191195c9ae864571afd92bc7bea8dfcbb11e kernel-debug-devel-3.10.0-1160.114.2.el7.x86_64.rpm
74dfc146e5e4ab219dba838033e3a2a983e2ad796cee5a175fda1b6c17653193 kernel-devel-3.10.0-1160.114.2.el7.x86_64.rpm
b5a460913216927a863650ccef6d332b05a92836c9647e73a369720e9156fe84 kernel-doc-3.10.0-1160.114.2.el7.noarch.rpm
4aeb221b696dbe4b67c7b108b689cf26df6c7baa673fd4a529bd4df444eaf4fc kernel-headers-3.10.0-1160.114.2.el7.x86_64.rpm
2ba740802cbbc7ff23957b8b2a38c06b773a113b40708d05815b6081f7eecb19 kernel-tools-3.10.0-1160.114.2.el7.x86_64.rpm
d4ce276deccf36c3cdff38a52ff6f73bd2c271d8df45463c61cc66cdd8dd7e18 kernel-tools-libs-3.10.0-1160.114.2.el7.x86_64.rpm
bee03f8565ac02484c05292876b9c0976e9334dad12bbf643dd9f59526e9eb6d kernel-tools-libs-devel-3.10.0-1160.114.2.el7.x86_64.rpm
0af8a6a9e3b24968bed3be9b8de12ef658fbbfc2164edfd7186a7cced585e5ec perf-3.10.0-1160.114.2.el7.x86_64.rpm
850766245b53884b841d001909aa89898b167cf79a244d26c44c42dd775019c3 python-perf-3.10.0-1160.114.2.el7.x86_64.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@libera.chat
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
F41 Change Proposal: RPM 4.20 (System-Wide)
Wiki - https://fedoraproject.org/wiki/Changes/RPM-4.20
== Summary ==
Update RPM to the up coming [https://rpm.org/wiki/Releases/4.20.0
4.20] release.
== Owner ==
* Name: [[User:ffesti| Florian Festi]]
* Email: ffesti@redhat.com
== Detailed Description ==
RPM 4.20 contains various improvements over previous versions.
* Hands-free packaging
** [https://github.com/rpm-software-management/rpm/issues/1087
Declarative build system]
** Dynamic spec generation extended
** [https://github.com/orgs/rpm-software-management/projects/16/views/1
File trigger scriptlet arguments]
** [https://github.com/rpm-software-management/rpm/issues/782 Support
for spec local dependency generators]
** [https://github.com/rpm-software-management/rpm/issues/2816 Support
for sysusers 'm' directive]
** [https://github.com/rpm-software-management/rpm/issues/2078
Guaranteed per-build directory]
* [https://github.com/rpm-software-management/rpm/issues/1536 Public plugin API]
* Increased install scriptlet isolation
([https://github.com/rpm-software-management/rpm/issues/2632 #2632],
[https://github.com/rpm-software-management/rpm/issues/2665 #2665])
The 4.20 alpha release is expected in late March/early April and the
final release is expected in time for the Fedora 41 release cycle as
usual.
== Feedback ==
== Benefit to Fedora ==
This release comes with many improvements. It opens the possibility
for Fedora to adopt the new major features mentioned above.
== Scope ==
* Proposal owners:
** Release RPM 4.20 alpha
** Rebase RPM in rawhide
** Assist with dealing with incompatibilities
* Other developers:
** Test new release, report issues and bugs
* Release engineering: [https://pagure.io/releng/issues #Releng issue number]
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Community Initiatives: None
== Upgrade/compatibility impact ==
== How To Test ==
Rpm receives a thorough and constant testing via every single package
build, system installs and updates. New features can be tested
specifically as per their documentation.
== User Experience ==
There are no major differences in the normal user experience.
== Dependencies ==
== Contingency Plan ==
* Contingency mechanism: Revert back to RPM 4.19
* Contingency deadline: Beta freeze
* Blocks release? No
== Documentation ==
Release notes at https://rpm.org/wiki/Releases/4.20.0 (still tbd) and
reference manual at
https://rpm-software-management.github.io/rpm/manual/
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
== Summary ==
Update RPM to the up coming [https://rpm.org/wiki/Releases/4.20.0
4.20] release.
== Owner ==
* Name: [[User:ffesti| Florian Festi]]
* Email: ffesti@redhat.com
== Detailed Description ==
RPM 4.20 contains various improvements over previous versions.
* Hands-free packaging
** [https://github.com/rpm-software-management/rpm/issues/1087
Declarative build system]
** Dynamic spec generation extended
** [https://github.com/orgs/rpm-software-management/projects/16/views/1
File trigger scriptlet arguments]
** [https://github.com/rpm-software-management/rpm/issues/782 Support
for spec local dependency generators]
** [https://github.com/rpm-software-management/rpm/issues/2816 Support
for sysusers 'm' directive]
** [https://github.com/rpm-software-management/rpm/issues/2078
Guaranteed per-build directory]
* [https://github.com/rpm-software-management/rpm/issues/1536 Public plugin API]
* Increased install scriptlet isolation
([https://github.com/rpm-software-management/rpm/issues/2632 #2632],
[https://github.com/rpm-software-management/rpm/issues/2665 #2665])
The 4.20 alpha release is expected in late March/early April and the
final release is expected in time for the Fedora 41 release cycle as
usual.
== Feedback ==
== Benefit to Fedora ==
This release comes with many improvements. It opens the possibility
for Fedora to adopt the new major features mentioned above.
== Scope ==
* Proposal owners:
** Release RPM 4.20 alpha
** Rebase RPM in rawhide
** Assist with dealing with incompatibilities
* Other developers:
** Test new release, report issues and bugs
* Release engineering: [https://pagure.io/releng/issues #Releng issue number]
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Community Initiatives: None
== Upgrade/compatibility impact ==
== How To Test ==
Rpm receives a thorough and constant testing via every single package
build, system installs and updates. New features can be tested
specifically as per their documentation.
== User Experience ==
There are no major differences in the normal user experience.
== Dependencies ==
== Contingency Plan ==
* Contingency mechanism: Revert back to RPM 4.19
* Contingency deadline: Beta freeze
* Blocks release? No
== Documentation ==
Release notes at https://rpm.org/wiki/Releases/4.20.0 (still tbd) and
reference manual at
https://rpm-software-management.github.io/rpm/manual/
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
[CentOS-announce] CEBA-2024:1276 CentOS 7 resource-agents BugFix Update
CentOS Errata and Bugfix Advisory 2024:1276
Upstream details at : https://access.redhat.com/errata/RHBA-2024:1276
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
619d5b89b88c559b235692c6c00c5d06cedd0d274f0132dc0732b25bc91bb93e resource-agents-4.1.1-61.el7_9.20.src.rpm
1f633f20c7b2aa6eafb4ac8894d9cd73727c40432189eee52f62aee11daf62e9 resource-agents-4.1.1-61.el7_9.20.x86_64.rpm
6d0aee209b29a68899270b50fbdb5657444b46017f3f4b39ff4652e77f30292c resource-agents-aliyun-4.1.1-61.el7_9.20.x86_64.rpm
639a97b21ae7b51141fd76f2777d2f3ea1bd758549e53130764657fafe2daf7a resource-agents-gcp-4.1.1-61.el7_9.20.x86_64.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@libera.chat
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHBA-2024:1276
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
619d5b89b88c559b235692c6c00c5d06cedd0d274f0132dc0732b25bc91bb93e resource-agents-4.1.1-61.el7_9.20.src.rpm
1f633f20c7b2aa6eafb4ac8894d9cd73727c40432189eee52f62aee11daf62e9 resource-agents-4.1.1-61.el7_9.20.x86_64.rpm
6d0aee209b29a68899270b50fbdb5657444b46017f3f4b39ff4652e77f30292c resource-agents-aliyun-4.1.1-61.el7_9.20.x86_64.rpm
639a97b21ae7b51141fd76f2777d2f3ea1bd758549e53130764657fafe2daf7a resource-agents-gcp-4.1.1-61.el7_9.20.x86_64.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@libera.chat
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[USN-6711-1] CRM shell vulnerability
==========================================================================
Ubuntu Security Notice USN-6711-1
March 25, 2024
crmsh vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
CRM shell could be made to execute arbitrary code if it received
a specially crafted input.
Software Description:
- crmsh: CRM shell for the pacemaker cluster manager
Details:
Vincent Berg discovered that CRM shell incorrectly handled certain commands.
An local attacker could possibly use this issue to execute arbitrary code
via shell code injection to the crm history commandline.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
crmsh 4.2.0-2ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6711-1
CVE-2020-35459
Package Information:
https://launchpad.net/ubuntu/+source/crmsh/4.2.0-2ubuntu1.1
Ubuntu Security Notice USN-6711-1
March 25, 2024
crmsh vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
CRM shell could be made to execute arbitrary code if it received
a specially crafted input.
Software Description:
- crmsh: CRM shell for the pacemaker cluster manager
Details:
Vincent Berg discovered that CRM shell incorrectly handled certain commands.
An local attacker could possibly use this issue to execute arbitrary code
via shell code injection to the crm history commandline.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
crmsh 4.2.0-2ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6711-1
CVE-2020-35459
Package Information:
https://launchpad.net/ubuntu/+source/crmsh/4.2.0-2ubuntu1.1
[CentOS-announce] CEBA-2024:1275 CentOS 7 lm_sensors BugFix Update
CentOS Errata and Bugfix Advisory 2024:1275
Upstream details at : https://access.redhat.com/errata/RHBA-2024:1275
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
88e82b5a11526a65b2ac8dcbe253868992a00064db1db424255bd509feb452cb lm_sensors-3.4.0-8.20160601gitf9185e5.el7_9.1.src.rpm
be4cfd2a6f6ccca83e063fb2eccc0c3e16716ba370638be5de4deda72c80848a lm_sensors-3.4.0-8.20160601gitf9185e5.el7_9.1.x86_64.rpm
95d76c0c65f9a62fc846a490f4d2b19a993d7bfe3b29c8f5435e619d31f10fe5 lm_sensors-devel-3.4.0-8.20160601gitf9185e5.el7_9.1.i686.rpm
552d8f1a349abd352ed882be0cfbe9423589f98f6621627e58afa84d6c83599d lm_sensors-devel-3.4.0-8.20160601gitf9185e5.el7_9.1.x86_64.rpm
189cab5bc603286773946e73c42d38c539c7a0de2d36fdb6fa6aba0763c86a44 lm_sensors-libs-3.4.0-8.20160601gitf9185e5.el7_9.1.i686.rpm
0af4fa113704a011a3594459a6619542c384a68bce85aa250f90448e347431fe lm_sensors-libs-3.4.0-8.20160601gitf9185e5.el7_9.1.x86_64.rpm
60f10f4641f2dac4d689ad5b1ee25cc224768eadce58b7f0d64c3eecf32b94ff lm_sensors-sensord-3.4.0-8.20160601gitf9185e5.el7_9.1.x86_64.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@libera.chat
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHBA-2024:1275
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
88e82b5a11526a65b2ac8dcbe253868992a00064db1db424255bd509feb452cb lm_sensors-3.4.0-8.20160601gitf9185e5.el7_9.1.src.rpm
be4cfd2a6f6ccca83e063fb2eccc0c3e16716ba370638be5de4deda72c80848a lm_sensors-3.4.0-8.20160601gitf9185e5.el7_9.1.x86_64.rpm
95d76c0c65f9a62fc846a490f4d2b19a993d7bfe3b29c8f5435e619d31f10fe5 lm_sensors-devel-3.4.0-8.20160601gitf9185e5.el7_9.1.i686.rpm
552d8f1a349abd352ed882be0cfbe9423589f98f6621627e58afa84d6c83599d lm_sensors-devel-3.4.0-8.20160601gitf9185e5.el7_9.1.x86_64.rpm
189cab5bc603286773946e73c42d38c539c7a0de2d36fdb6fa6aba0763c86a44 lm_sensors-libs-3.4.0-8.20160601gitf9185e5.el7_9.1.i686.rpm
0af4fa113704a011a3594459a6619542c384a68bce85aa250f90448e347431fe lm_sensors-libs-3.4.0-8.20160601gitf9185e5.el7_9.1.x86_64.rpm
60f10f4641f2dac4d689ad5b1ee25cc224768eadce58b7f0d64c3eecf32b94ff lm_sensors-sensord-3.4.0-8.20160601gitf9185e5.el7_9.1.x86_64.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@libera.chat
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CEBA-2024:1277 CentOS 7 libX11 BugFix Update
CentOS Errata and Bugfix Advisory 2024:1277
Upstream details at : https://access.redhat.com/errata/RHBA-2024:1277
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
3e22c1e91e6c946f60aaa437911042d67c7e9de92d77cf458a51d5660658186c libX11-1.6.7-5.el7_9.i686.rpm
f79bf580272858f3f9343a97221fc561755bb908456a1beb77582f9310486ae1 libX11-1.6.7-5.el7_9.src.rpm
1f4f286b0441b2c508c416f72ee52c1b323a1ba12aae4579f986c007ecde653f libX11-1.6.7-5.el7_9.x86_64.rpm
70bbd71ba6462d9f6702322739a79ddf57ab8a23f41a3ae1e2c47feacb60d0d1 libX11-common-1.6.7-5.el7_9.noarch.rpm
1ef57080cad8889aa2a957bb771d161af38b61bf4aec83a7fcd19e2dfe510079 libX11-devel-1.6.7-5.el7_9.i686.rpm
374f721b5f41a11a081cd23537162130ab654a02ece3e8c55f3840ecd8f839a0 libX11-devel-1.6.7-5.el7_9.x86_64.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@libera.chat
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHBA-2024:1277
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
3e22c1e91e6c946f60aaa437911042d67c7e9de92d77cf458a51d5660658186c libX11-1.6.7-5.el7_9.i686.rpm
f79bf580272858f3f9343a97221fc561755bb908456a1beb77582f9310486ae1 libX11-1.6.7-5.el7_9.src.rpm
1f4f286b0441b2c508c416f72ee52c1b323a1ba12aae4579f986c007ecde653f libX11-1.6.7-5.el7_9.x86_64.rpm
70bbd71ba6462d9f6702322739a79ddf57ab8a23f41a3ae1e2c47feacb60d0d1 libX11-common-1.6.7-5.el7_9.noarch.rpm
1ef57080cad8889aa2a957bb771d161af38b61bf4aec83a7fcd19e2dfe510079 libX11-devel-1.6.7-5.el7_9.i686.rpm
374f721b5f41a11a081cd23537162130ab654a02ece3e8c55f3840ecd8f839a0 libX11-devel-1.6.7-5.el7_9.x86_64.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@libera.chat
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[USN-6712-1] Net::CIDR::Lite vulnerability
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmYBdz0ACgkQZWnYVadE
vpNiGhAAupEEyOEv1b8uVnMF9f/Smz3QOmRPIjjFRSi9pd+Wz6osWKr1IcQxW75C
Yq/s5aOE2dnUp4eokBG75m/ss9p69f0IfftexauXNxaTvLP2y2mBUxGu2bfjFcMh
6S9LsCZ4Rk3PpRsZnNLjWxFelNMvYUvdh2iG/TvtOcSkJk0Q6IIjtauYC8HJ+3SY
FPa4Yp9atXjzRODzEcipoIoi9P/rXmJwFoy+2n8u2mryhRWrGIxDAm5WB5WnN2YZ
yrH7cmzRb1yeBoX6NQwtG1fDLKIFO9UgmKOFGGWgzN5JCxF4YN9YwrZzLv9H/Q9y
vQO9UX7oeF2cEFYwXj+ugP/0v60ynzLxI8pwDgQfNRT+MSgQrshw2qKFOuHfc2zo
HbWUrkpvxM5JivHPhiyqMkgvpM0kMwhzMNc9R0TY8FtxRXUBHdOhjm8o1VJD2ifw
ucU2xIKBEdoqqOyWeHLRQpmHcpQcHsSyPReqbWLAamJV+GURa9O0qSZjqFPwoXd6
ASjiLWiki4aa9uZzKbpJspP499cfUfw4eAH18mkzh1zonFDejUo99rWcD613B/GL
+IZM1Bo5BKMHrrhyfZkr+QKexTaq7OE5UyuM6NNLDw21J3dbkUJPYETAtEmecu1u
7X6KRKqaaa21TAAodHqxpOELNQSc45STSvShCYYDhxvrzqemisY=
=eYCr
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6712-1
March 25, 2024
libnet-cidr-lite-perl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Net::CIDR::Lite could allow unintended access to network services.
Software Description:
- libnet-cidr-lite-perl: module for merging IPv4 or IPv6 CIDR address ranges
Details:
It was discovered that Net::CIDR::Lite incorrectly handled extra zero
characters at the beginning of IP address strings. A remote attacker could
possibly use this issue to bypass access controls.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
libnet-cidr-lite-perl 0.21-2ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6712-1
CVE-2021-47154
Package Information:
https://launchpad.net/ubuntu/+source/libnet-cidr-lite-perl/0.21-2ubuntu0.1
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmYBdz0ACgkQZWnYVadE
vpNiGhAAupEEyOEv1b8uVnMF9f/Smz3QOmRPIjjFRSi9pd+Wz6osWKr1IcQxW75C
Yq/s5aOE2dnUp4eokBG75m/ss9p69f0IfftexauXNxaTvLP2y2mBUxGu2bfjFcMh
6S9LsCZ4Rk3PpRsZnNLjWxFelNMvYUvdh2iG/TvtOcSkJk0Q6IIjtauYC8HJ+3SY
FPa4Yp9atXjzRODzEcipoIoi9P/rXmJwFoy+2n8u2mryhRWrGIxDAm5WB5WnN2YZ
yrH7cmzRb1yeBoX6NQwtG1fDLKIFO9UgmKOFGGWgzN5JCxF4YN9YwrZzLv9H/Q9y
vQO9UX7oeF2cEFYwXj+ugP/0v60ynzLxI8pwDgQfNRT+MSgQrshw2qKFOuHfc2zo
HbWUrkpvxM5JivHPhiyqMkgvpM0kMwhzMNc9R0TY8FtxRXUBHdOhjm8o1VJD2ifw
ucU2xIKBEdoqqOyWeHLRQpmHcpQcHsSyPReqbWLAamJV+GURa9O0qSZjqFPwoXd6
ASjiLWiki4aa9uZzKbpJspP499cfUfw4eAH18mkzh1zonFDejUo99rWcD613B/GL
+IZM1Bo5BKMHrrhyfZkr+QKexTaq7OE5UyuM6NNLDw21J3dbkUJPYETAtEmecu1u
7X6KRKqaaa21TAAodHqxpOELNQSc45STSvShCYYDhxvrzqemisY=
=eYCr
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6712-1
March 25, 2024
libnet-cidr-lite-perl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Net::CIDR::Lite could allow unintended access to network services.
Software Description:
- libnet-cidr-lite-perl: module for merging IPv4 or IPv6 CIDR address ranges
Details:
It was discovered that Net::CIDR::Lite incorrectly handled extra zero
characters at the beginning of IP address strings. A remote attacker could
possibly use this issue to bypass access controls.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
libnet-cidr-lite-perl 0.21-2ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6712-1
CVE-2021-47154
Package Information:
https://launchpad.net/ubuntu/+source/libnet-cidr-lite-perl/0.21-2ubuntu0.1
[USN-6713-1] QPDF vulnerability
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmYBd1UACgkQZWnYVadE
vpNqRg/+PRn3lhUE2c7cTUYDetBMoB4S3huB+CuF8by95FspcSrXBqzdzxqu3rYU
LYOdqplA4FpVSX7Tk4UGx03AaCFT4B776BwT1wpQuYl2I8oUXPUnKi6YkY9Dv7+H
cDp4Bs022LCVLzMwzLgMdV9b2hP2NNPX/GoGVaM7lMlHTOndq6qHi2JtVcAU9QWq
8PE+YhrR2v04cV6wHkOzwYpofgE2XO1a2Kj8tzdvVuR1MRRE/oHM7Mtt2tV6iKnb
GdYucAkTcGtgncxYa3hTgQ6/r6IqW0Zdv8RlZsVnj3NAEabb/ZYLbWPl3FC1fR2H
pNxMAUx5Knh4WEVVSEPbJ59v2VE5E3Cef9G3+YrtVTowmuLlSIEq7t2o+mFeL5Te
wlRYZPFAj77u0uAg7R5XCV9uEmj3fENJW6s2kecxuQLdGJyb7mhW86TKCkgG/Jw2
RDTxbYa/NaLuXMc2iojFex22n6AXDl9XWLj+D/q7BXxb5UcXzVFRhzrAF5Tzihw8
Q+CAjikwbFIXSnX3+bI1G6WfifqN6pyJ/KcdqXkEgMGYhNed1qOEtjw8AeLy6KbQ
50izfJ3yU8JzPVW56OLMVDhZr1sEN8jesfjPVRwEy4A+giMDOCpDpg/7FSnqwS7+
StdDRg7B0Qy+RuoQij4ehFyVRO5xwe5R2M1XF+/FSCT76jV4kfc=
=xVCl
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6713-1
March 25, 2024
qpdf vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
Summary:
QPDF could be made to crash or run programs if it opened a specially
crafted file.
Software Description:
- qpdf: tools for transforming and inspecting PDF files
Details:
It was discovered that QPDF incorrectly handled certain memory operations
when decoding JSON files. If a user or automated system were tricked into
processing a specially crafted JSON file, QPDF could be made to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libqpdf29 11.5.0-1ubuntu1.1
qpdf 11.5.0-1ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6713-1
CVE-2024-24246
Package Information:
https://launchpad.net/ubuntu/+source/qpdf/11.5.0-1ubuntu1.1
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmYBd1UACgkQZWnYVadE
vpNqRg/+PRn3lhUE2c7cTUYDetBMoB4S3huB+CuF8by95FspcSrXBqzdzxqu3rYU
LYOdqplA4FpVSX7Tk4UGx03AaCFT4B776BwT1wpQuYl2I8oUXPUnKi6YkY9Dv7+H
cDp4Bs022LCVLzMwzLgMdV9b2hP2NNPX/GoGVaM7lMlHTOndq6qHi2JtVcAU9QWq
8PE+YhrR2v04cV6wHkOzwYpofgE2XO1a2Kj8tzdvVuR1MRRE/oHM7Mtt2tV6iKnb
GdYucAkTcGtgncxYa3hTgQ6/r6IqW0Zdv8RlZsVnj3NAEabb/ZYLbWPl3FC1fR2H
pNxMAUx5Knh4WEVVSEPbJ59v2VE5E3Cef9G3+YrtVTowmuLlSIEq7t2o+mFeL5Te
wlRYZPFAj77u0uAg7R5XCV9uEmj3fENJW6s2kecxuQLdGJyb7mhW86TKCkgG/Jw2
RDTxbYa/NaLuXMc2iojFex22n6AXDl9XWLj+D/q7BXxb5UcXzVFRhzrAF5Tzihw8
Q+CAjikwbFIXSnX3+bI1G6WfifqN6pyJ/KcdqXkEgMGYhNed1qOEtjw8AeLy6KbQ
50izfJ3yU8JzPVW56OLMVDhZr1sEN8jesfjPVRwEy4A+giMDOCpDpg/7FSnqwS7+
StdDRg7B0Qy+RuoQij4ehFyVRO5xwe5R2M1XF+/FSCT76jV4kfc=
=xVCl
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6713-1
March 25, 2024
qpdf vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
Summary:
QPDF could be made to crash or run programs if it opened a specially
crafted file.
Software Description:
- qpdf: tools for transforming and inspecting PDF files
Details:
It was discovered that QPDF incorrectly handled certain memory operations
when decoding JSON files. If a user or automated system were tricked into
processing a specially crafted JSON file, QPDF could be made to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libqpdf29 11.5.0-1ubuntu1.1
qpdf 11.5.0-1ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6713-1
CVE-2024-24246
Package Information:
https://launchpad.net/ubuntu/+source/qpdf/11.5.0-1ubuntu1.1
[USN-6710-1] Firefox vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmYBBYAFAwAAAAAACgkQWNrRIKaTkWet
2g//Q/iD2gqYSkcci/rDuBHNNoDx9RndtHQticMwIniGVQmWDmtUirhN6dbOM5L8ud17hh2obzKS
dFeuL5HTvoEWNV+dsam5GpX4qelEYQKxP8BtVNHSHGMVPrp0nse9XiK4qLMaa5kVrNcZ8eRdrY5a
VaP1eMvKfExFmZOexK4WXmd0viN/TSqsmpRd1dJWA/0FFVZK4g1OTg6bA2HOXD+mbbExyYj3ZRmv
nhoKU4cheeaJQjwp1ESxyBF3PogB1vMI9jVgwo1j7v4ANfcXxuhJULxB8dW5MIjpVk4flc8tC9/d
A3ZGrNaNakCsXfvDAPfoX+G9fl/5a1VbDD5PjvSezyTD4AuvhMCqr68FI2ThC8DaKFzhvTb/4G6d
OZ4lZyIhDYNva7bCZw+Mx5JB3Vqy8djrDEklcdCat2+anVaZqydrwf/zak9XVC6egIeMcdyHANvK
NLC/9+YBqwFdjAXniFh02+DitFmo1poGmF9Px4mZ7mx24GGvj7ApvtYWvz1JbrfNMZHiFB10IasP
gnRdKyYIMd8KWPMxMnB7TLB3NKKpBI9afSC5dfTrzFcfIYLOeT5XOZrBR+8JN/VCVfkk8J9qhkwU
A9f8ZFm34zbQAclGGR8JTG151z5MT3FaQZzlmaUCdvM6qDw8tJJ82FQQxKkKDC4CWIwsz+2Psy+1
j9o=
=IX8w
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6710-1
March 25, 2024
firefox vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Firefox.
Software Description:
- firefox: Mozilla Open Source web browser
Details:
Manfred Paul discovered that Firefox did not properly perform bounds
checking during range analysis, leading to an out-of-bounds write
vulnerability. A attacker could use this to cause a denial of service,
or execute arbitrary code. (CVE-2024-29943)
Manfred Paul discovered that Firefox incorrectly handled MessageManager
listeners under certain circumstances. An attacker who was able to inject
an event handler into a privileged object may have been able to execute
arbitrary code. (CVE-2024-29944)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
firefox 124.0.1+build1-0ubuntu0.20.04.1
After a standard system update you need to restart Firefox to make all the
necessary changes.
References:
https://ubuntu.com/security/notices/USN-6710-1
CVE-2024-29943, CVE-2024-29944
Package Information:
https://launchpad.net/ubuntu/+source/firefox/124.0.1+build1-0ubuntu0.20.04.1
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmYBBYAFAwAAAAAACgkQWNrRIKaTkWet
2g//Q/iD2gqYSkcci/rDuBHNNoDx9RndtHQticMwIniGVQmWDmtUirhN6dbOM5L8ud17hh2obzKS
dFeuL5HTvoEWNV+dsam5GpX4qelEYQKxP8BtVNHSHGMVPrp0nse9XiK4qLMaa5kVrNcZ8eRdrY5a
VaP1eMvKfExFmZOexK4WXmd0viN/TSqsmpRd1dJWA/0FFVZK4g1OTg6bA2HOXD+mbbExyYj3ZRmv
nhoKU4cheeaJQjwp1ESxyBF3PogB1vMI9jVgwo1j7v4ANfcXxuhJULxB8dW5MIjpVk4flc8tC9/d
A3ZGrNaNakCsXfvDAPfoX+G9fl/5a1VbDD5PjvSezyTD4AuvhMCqr68FI2ThC8DaKFzhvTb/4G6d
OZ4lZyIhDYNva7bCZw+Mx5JB3Vqy8djrDEklcdCat2+anVaZqydrwf/zak9XVC6egIeMcdyHANvK
NLC/9+YBqwFdjAXniFh02+DitFmo1poGmF9Px4mZ7mx24GGvj7ApvtYWvz1JbrfNMZHiFB10IasP
gnRdKyYIMd8KWPMxMnB7TLB3NKKpBI9afSC5dfTrzFcfIYLOeT5XOZrBR+8JN/VCVfkk8J9qhkwU
A9f8ZFm34zbQAclGGR8JTG151z5MT3FaQZzlmaUCdvM6qDw8tJJ82FQQxKkKDC4CWIwsz+2Psy+1
j9o=
=IX8w
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6710-1
March 25, 2024
firefox vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Firefox.
Software Description:
- firefox: Mozilla Open Source web browser
Details:
Manfred Paul discovered that Firefox did not properly perform bounds
checking during range analysis, leading to an out-of-bounds write
vulnerability. A attacker could use this to cause a denial of service,
or execute arbitrary code. (CVE-2024-29943)
Manfred Paul discovered that Firefox incorrectly handled MessageManager
listeners under certain circumstances. An attacker who was able to inject
an event handler into a privileged object may have been able to execute
arbitrary code. (CVE-2024-29944)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
firefox 124.0.1+build1-0ubuntu0.20.04.1
After a standard system update you need to restart Firefox to make all the
necessary changes.
References:
https://ubuntu.com/security/notices/USN-6710-1
CVE-2024-29943, CVE-2024-29944
Package Information:
https://launchpad.net/ubuntu/+source/firefox/124.0.1+build1-0ubuntu0.20.04.1
Friday, March 22, 2024
[USN-6708-1] Graphviz vulnerability
-----BEGIN PGP SIGNATURE-----
wsD5BAABCAAjFiEE26yozGlLvY8PLmS9C+du+fOjiEwFAmX9gOYFAwAAAAAACgkQC+du+fOjiEyX
3gv+Nz1LRsHFBNv1sPA0c0fTcGb7g57GphenhwUf7mD5szGCta93dTaHCpmI1PTlKfdpt5TSNp6c
MQL3xhc6ysDw9DT5hR+K+Pc1Ia1Hc8O4bCRAN/ivcYbsgQPgcbTiNSjL160xckMtxq6nm0BEFfFw
dUGmboW5fllIi+LFYa/a6901RXW7m37f5dvI6q21hktjBzF//QsMrFs3m25UQ5OdO8MXjZCF2YHq
IL47CDoE4X/NlPVgI5sZJqrTr/045Ywo6KJrs39WWb4ZcH6ClN5Eip+UOmpKL5hNYCgYYd3s7O4O
jgaA9ePIPjahFHSKNcRdvchPb399lYzv+9/2+/QVJFGL2WmpA6MqqZy15kWWIoHtJzsvq4MR9FPr
/uTMiDdzH2AvYG3DOoa3ier6gnllZ0u9s8WJZZkToz0soqKiAFsPqKcpptfYaTWuQzthPtZWCSdw
46ivDTTxdp/5Cj8HbdnNi853CpPIZxNWUHYXkgEWH1ZsWno8uI9hzpWkxSr8
=kvve
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6708-1
March 21, 2024
graphviz vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS (Available with Ubuntu Pro)
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Graphviz could be made to crash if it opened a specially crafted
config6a file.
Software Description:
- graphviz: rich set of graph drawing tools
Details:
It was discovered that Graphviz incorrectly handled certain config6a files.
An attacker could possibly use this issue to cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS (Available with Ubuntu Pro):
graphviz 2.42.2-6ubuntu0.1~esm1
Ubuntu 20.04 LTS (Available with Ubuntu Pro):
graphviz 2.42.2-3ubuntu0.1~esm2
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
graphviz 2.40.1-2ubuntu0.1~esm2
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
graphviz 2.38.0-12ubuntu2.1+esm2
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
graphviz 2.36.0-0ubuntu3.2+esm2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6708-1
CVE-2023-46045
wsD5BAABCAAjFiEE26yozGlLvY8PLmS9C+du+fOjiEwFAmX9gOYFAwAAAAAACgkQC+du+fOjiEyX
3gv+Nz1LRsHFBNv1sPA0c0fTcGb7g57GphenhwUf7mD5szGCta93dTaHCpmI1PTlKfdpt5TSNp6c
MQL3xhc6ysDw9DT5hR+K+Pc1Ia1Hc8O4bCRAN/ivcYbsgQPgcbTiNSjL160xckMtxq6nm0BEFfFw
dUGmboW5fllIi+LFYa/a6901RXW7m37f5dvI6q21hktjBzF//QsMrFs3m25UQ5OdO8MXjZCF2YHq
IL47CDoE4X/NlPVgI5sZJqrTr/045Ywo6KJrs39WWb4ZcH6ClN5Eip+UOmpKL5hNYCgYYd3s7O4O
jgaA9ePIPjahFHSKNcRdvchPb399lYzv+9/2+/QVJFGL2WmpA6MqqZy15kWWIoHtJzsvq4MR9FPr
/uTMiDdzH2AvYG3DOoa3ier6gnllZ0u9s8WJZZkToz0soqKiAFsPqKcpptfYaTWuQzthPtZWCSdw
46ivDTTxdp/5Cj8HbdnNi853CpPIZxNWUHYXkgEWH1ZsWno8uI9hzpWkxSr8
=kvve
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6708-1
March 21, 2024
graphviz vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS (Available with Ubuntu Pro)
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Graphviz could be made to crash if it opened a specially crafted
config6a file.
Software Description:
- graphviz: rich set of graph drawing tools
Details:
It was discovered that Graphviz incorrectly handled certain config6a files.
An attacker could possibly use this issue to cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS (Available with Ubuntu Pro):
graphviz 2.42.2-6ubuntu0.1~esm1
Ubuntu 20.04 LTS (Available with Ubuntu Pro):
graphviz 2.42.2-3ubuntu0.1~esm2
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
graphviz 2.40.1-2ubuntu0.1~esm2
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
graphviz 2.38.0-12ubuntu2.1+esm2
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
graphviz 2.36.0-0ubuntu3.2+esm2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6708-1
CVE-2023-46045
Thursday, March 21, 2024
[USN-6700-2] Linux kernel (AWS) vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmX8pk4FAwAAAAAACgkQZ0GeRcM5nt0s
bgf+K2qn5xyu8TzXLlVTNs1qPLXkemQ1x2YyN9C7QhL8k07Z7+jdt53F1TYAYgfZzs9Qnn8NM7Z8
xbcBtttjIChA31bSpngjDfTTOOJwwqM7KqczYu/M4kSZcy/FHMHa2G6ry+JIqIcE8WxFo2DvP92/
T2eRF6xXVU3Fvh3wSjCPOfyvlLmFa9Ic6dSQHSN4pBgmJtwrCb+hWw63CmMbRx+6G3u26g05n3kx
C4JHbiIKbxSpihY2O+9kYZahT64yPq435IH6MTgfxFJm8lwVAVmXMYG5vjN5g0yu7cjBaRDdzLit
6RFvbJnZK4N0LgDnEJVjoXPbBYkBXFgBC9C44jFcLw==
=WVUR
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6700-2
March 21, 2024
linux-aws vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
Details:
It was discovered that the Layer 2 Tunneling Protocol (L2TP) implementation
in the Linux kernel contained a race condition when releasing PPPoL2TP
sockets in certain conditions, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20567)
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly handle block device modification while it is
mounted. A privileged attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-34256)
Eric Dumazet discovered that the netfilter subsystem in the Linux kernel
did not properly handle DCCP conntrack buffers in certain situations,
leading to an out-of-bounds read vulnerability. An attacker could possibly
use this to expose sensitive information (kernel memory). (CVE-2023-39197)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly handle the remount operation in certain cases,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2024-0775)
Notselwyn discovered that the netfilter subsystem in the Linux kernel did
not properly handle verdict parameters in certain cases, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2024-1086)
It was discovered that a race condition existed in the SCSI Emulex
LightPulse Fibre Channel driver in the Linux kernel when unregistering FCF
and re-scanning an HBA FCF table, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2024-24855)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
linux-image-4.4.0-1167-aws 4.4.0-1167.182
linux-image-aws 4.4.0.1167.171
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6700-2
https://ubuntu.com/security/notices/USN-6700-1
CVE-2022-20567, CVE-2023-34256, CVE-2023-39197, CVE-2023-51781,
CVE-2024-0775, CVE-2024-1086, CVE-2024-24855
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmX8pk4FAwAAAAAACgkQZ0GeRcM5nt0s
bgf+K2qn5xyu8TzXLlVTNs1qPLXkemQ1x2YyN9C7QhL8k07Z7+jdt53F1TYAYgfZzs9Qnn8NM7Z8
xbcBtttjIChA31bSpngjDfTTOOJwwqM7KqczYu/M4kSZcy/FHMHa2G6ry+JIqIcE8WxFo2DvP92/
T2eRF6xXVU3Fvh3wSjCPOfyvlLmFa9Ic6dSQHSN4pBgmJtwrCb+hWw63CmMbRx+6G3u26g05n3kx
C4JHbiIKbxSpihY2O+9kYZahT64yPq435IH6MTgfxFJm8lwVAVmXMYG5vjN5g0yu7cjBaRDdzLit
6RFvbJnZK4N0LgDnEJVjoXPbBYkBXFgBC9C44jFcLw==
=WVUR
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6700-2
March 21, 2024
linux-aws vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
Details:
It was discovered that the Layer 2 Tunneling Protocol (L2TP) implementation
in the Linux kernel contained a race condition when releasing PPPoL2TP
sockets in certain conditions, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-20567)
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly handle block device modification while it is
mounted. A privileged attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-34256)
Eric Dumazet discovered that the netfilter subsystem in the Linux kernel
did not properly handle DCCP conntrack buffers in certain situations,
leading to an out-of-bounds read vulnerability. An attacker could possibly
use this to expose sensitive information (kernel memory). (CVE-2023-39197)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
It was discovered that the ext4 file system implementation in the Linux
kernel did not properly handle the remount operation in certain cases,
leading to a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2024-0775)
Notselwyn discovered that the netfilter subsystem in the Linux kernel did
not properly handle verdict parameters in certain cases, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2024-1086)
It was discovered that a race condition existed in the SCSI Emulex
LightPulse Fibre Channel driver in the Linux kernel when unregistering FCF
and re-scanning an HBA FCF table, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2024-24855)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
linux-image-4.4.0-1167-aws 4.4.0-1167.182
linux-image-aws 4.4.0.1167.171
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6700-2
https://ubuntu.com/security/notices/USN-6700-1
CVE-2022-20567, CVE-2023-34256, CVE-2023-39197, CVE-2023-51781,
CVE-2024-0775, CVE-2024-1086, CVE-2024-24855
Subscribe to:
Posts (Atom)