April 2022 - Epel-packagers-sig - Fedora mailing-lists

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 04 Apr '22

04 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:1175 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 03 Apr '22

03 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:1171 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 03 Apr '22

03 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:1170 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2062202] CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2062202 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHBA-2022:1169 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2062202

1 0

[Bug 2060615] CVE-2022-0841 npm-lockfile: os command injection
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2060615 --- Doc Text *updated* by RaTasha Tillery-Smith <rtillery(a)redhat.com> --- A flaw was found in npm-lockfile, where npm-lockfile v2 did not sanitize the `only` parameter before invoking sensitive command execution API with the input. This issue leads to a command injection vulnerability. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2060615

1 0

[Bug 2066148] New: bear-3.0.19 is available
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2066148 Bug ID: 2066148 Summary: bear-3.0.19 is available Product: Fedora Version: rawhide Status: NEW Component: bear Keywords: FutureFeature, Triaged Assignee: dan.cermak(a)cgc-instruments.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: code(a)musicinmybrain.net, dan.cermak(a)cgc-instruments.com, epel-packagers-sig(a)lists.fedoraproject.org, mgansser(a)netcom-mail.de, thofmann(a)fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 3.0.19 Current version/release in rawhide: 3.0.18-3.fc37 URL: https://github.com/rizsotto/Bear Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/18436/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2066148

1 12

[Bug 2060615] CVE-2022-0841 npm-lockfile: os command injection
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2060615 --- Comment #5 from Mauro Matteo Cascella <mcascell(a)redhat.com> --- npm-lockfile v1 shipped in RHEL is not affected by this CVE as it doesn't include the vulnerable code (i.e., support for `only` parameter). -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2060615

1 0

[Bug 2060615] CVE-2022-0841 npm-lockfile: os command injection
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2060615 Product Security DevOps Team <prodsec-dev(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG Last Closed| |2022-04-01 13:25:20 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2060615

1 0

[Bug 2060615] CVE-2022-0841 npm-lockfile: os command injection
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2060615 --- Comment #3 from Product Security DevOps Team <prodsec-dev(a)redhat.com> --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-0841 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2060615

1 0

[Bug 2060615] CVE-2022-0841 npm-lockfile: os command injection
by bugzilla＠redhat.com 01 Apr '22

01 Apr '22

https://bugzilla.redhat.com/show_bug.cgi?id=2060615 --- Doc Text *updated* by Mauro Matteo Cascella <mcascell(a)redhat.com> --- A flaw was found in npm-lockfile. npm-lockfile v2 did not sanitize the `only` parameter before invoking sensitive command execution API with the input, leading to a command injection vulnerability. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2060615

1 0

2024

2023

2022

2021

Epel-packagers-sig April 2022