April 2022 - Epel-packagers-sig - Fedora mailing-lists

[Bug 2060615] CVE-2022-0841 npm-lockfile: os command injection
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2060615 Bug 2060615 depends on bug 2060674, which changed state. Bug 2060674 Summary: CVE-2022-0841 nodejs:13/nodejs: npm-lockfile: os command injection [epel-8] https://bugzilla.redhat.com/show_bug.cgi?id=2060674 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2060615

1 0

[Bug 2060615] CVE-2022-0841 npm-lockfile: os command injection
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2060615 --- Comment #2 from Mauro Matteo Cascella <mcascell(a)redhat.com> --- Created yarnpkg tracking bugs for this issue: Affects: fedora-all [bug 2070960] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2060615

1 0

[Bug 2060615] CVE-2022-0841 npm-lockfile: os command injection
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2060615 Mauro Matteo Cascella <mcascell(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2070960 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2070960 [Bug 2070960] CVE-2022-0841 yarnpkg: npm-lockfile: os command injection [fedora-all] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2060615

1 0

[Bug 2070960] New: CVE-2022-0841 yarnpkg: npm-lockfile: os command injection [fedora-all]
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2070960 Bug ID: 2070960 Summary: CVE-2022-0841 yarnpkg: npm-lockfile: os command injection [fedora-all] Product: Fedora Version: 35 Status: NEW Component: yarnpkg Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: zsvetlik(a)redhat.com Reporter: mcascell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2070960

1 2

[Bug 2060615] CVE-2022-0841 npm-lockfile: os command injection
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2060615 Mauro Matteo Cascella <mcascell(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |epel-packagers-sig(a)lists.fe | |doraproject.org, | |ngompa13(a)gmail.com -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2060615

1 0

[Bug 2069364] New: CVE-2021-43085 openssl: Insecure permissions vulnerability due to an error in the implementation of the CMAC_Final() function
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2069364 Bug ID: 2069364 Summary: CVE-2021-43085 openssl: Insecure permissions vulnerability due to an error in the implementation of the CMAC_Final() function Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: aos-bugs(a)redhat.com, asoldano(a)redhat.com, bbaranow(a)redhat.com, bdettelb(a)redhat.com, berrange(a)redhat.com, bmaxwell(a)redhat.com, bootloader-eng-team(a)redhat.com, brian.stansberry(a)redhat.com, caswilli(a)redhat.com, cdewolf(a)redhat.com, cfergeau(a)redhat.com, chazlett(a)redhat.com, crobinso(a)redhat.com, crypto-team(a)lists.fedoraproject.org, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dbelyavs(a)redhat.com, dhalasz(a)redhat.com, dkreling(a)redhat.com, dkuc(a)redhat.com, dosoudil(a)redhat.com, dueno(a)redhat.com, elima(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, erik-fedora(a)vanpienbroek.nl, f4bug(a)amsat.org, fjansen(a)redhat.com, fjuma(a)redhat.com, fmartine(a)redhat.com, gparvin(a)redhat.com, gzaronik(a)redhat.com, iweiss(a)redhat.com, jburrell(a)redhat.com, jclere(a)redhat.com, jkoehler(a)redhat.com, jochrist(a)redhat.com, jramanat(a)redhat.com, jwong(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, krathod(a)redhat.com, kraxel(a)redhat.com, ktietz(a)redhat.com, lgao(a)redhat.com, marcandre.lureau(a)redhat.com, michal.skrivanek(a)redhat.com, michel(a)michel-slm.name, micjohns(a)redhat.com, mjg59(a)srcf.ucam.org, mosmerov(a)redhat.com, mperina(a)redhat.com, msochure(a)redhat.com, mspacek(a)redhat.com, msvehla(a)redhat.com, mturk(a)redhat.com, njean(a)redhat.com, nobody(a)redhat.com, nwallace(a)redhat.com, pahickey(a)redhat.com, pbonzini(a)redhat.com, pjindal(a)redhat.com, pjones(a)redhat.com, pmackay(a)redhat.com, redhat-bugzilla(a)linuxnetz.de, rfreiman(a)redhat.com, rharwood(a)redhat.com, rh-spice-bugs(a)redhat.com, rjones(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, sahana(a)redhat.com, sbonazzo(a)redhat.com, smaestri(a)redhat.com, stcannon(a)redhat.com, sthirugn(a)redhat.com, szappis(a)redhat.com, tmeszaro(a)redhat.com, tm(a)t8m.info, tom.jenkinson(a)redhat.com, virt-maint(a)lists.fedoraproject.org, virt-maint(a)redhat.com, vkrizan(a)redhat.com, vkumar(a)redhat.com, vmugicag(a)redhat.com Target Milestone: --- Classification: Other An Insecure Permissions vulnerability exists in the OpenSSL Project 3.0 due to an error in the implementation of the CMAC_Final() function. Upstream issue: https://github.com/openssl/openssl/issues/16873 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2069364

1 3

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 31 Mar '22

31 Mar '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 Manabu Ori <mori(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mori(a)redhat.com --- Comment #49 from Manabu Ori <mori(a)redhat.com> --- Hi Mauro, The fixed package does not seem to be 1.1.1g-15.el8_3, but 1.1.1g-16.el8_4. ``` $ rpm --changelog -qp openssl-1.1.1g-16.el8_4.x86_64.rpm | head -n 3 * Wed Mar 23 2022 Clemens Lang <cllang(a)redhat.com> - 1:1.1.1g-16 - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates - Resolves: rhbz#2067143 ``` -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 31 Mar '22

31 Mar '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 Kaushal Sathe <ksathe(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ksathe(a)redhat.com -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

2024

2023

2022

2021

Epel-packagers-sig April 2022