September 2022 - Epel-packagers-sig

[Bug 2126276] CVE-2021-43138 async: Prototype Pollution in async
by bugzilla＠redhat.com 15 Sep '22

15 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2126276 Avinash Hanwate <ahanwate(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2127003, 2126998, 2126996, | |2126997, 2126995, 2126994, | |2126999, 2127001, 2127000, | |2127009, 2127002, 2127006, | |2127005, 2127008, 2126993, | |2127007, 2127004 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2126993 [Bug 2126993] CVE-2021-43138 golang-github-prometheus: async: Prototype Pollution in async [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=2126994 [Bug 2126994] CVE-2021-43138 nodejs: async: Prototype Pollution in async [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=2126995 [Bug 2126995] CVE-2021-43138 breeze-icon-theme: async: Prototype Pollution in async [epel-8] https://bugzilla.redhat.com/show_bug.cgi?id=2126996 [Bug 2126996] CVE-2021-43138 seamonkey: async: Prototype Pollution in async [epel-8] https://bugzilla.redhat.com/show_bug.cgi?id=2126997 [Bug 2126997] CVE-2021-43138 breeze-icon-theme: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2126998 [Bug 2126998] CVE-2021-43138 cockatrice: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2126999 [Bug 2126999] CVE-2021-43138 couchdb: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2127000 [Bug 2127000] CVE-2021-43138 golang-entgo-ent: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2127001 [Bug 2127001] CVE-2021-43138 grafana: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2127002 [Bug 2127002] CVE-2021-43138 mozjs68: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2127003 [Bug 2127003] CVE-2021-43138 mozjs78: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2127004 [Bug 2127004] CVE-2021-43138 nodejs: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2127005 [Bug 2127005] CVE-2021-43138 python-engineio: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2127006 [Bug 2127006] CVE-2021-43138 seamonkey: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2127007 [Bug 2127007] CVE-2021-43138 workrave: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2127008 [Bug 2127008] CVE-2021-43138 yarnpkg: async: Prototype Pollution in async [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2127009 [Bug 2127009] CVE-2021-43138 zuul: async: Prototype Pollution in async [fedora-all] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126276

1 0

[Bug 2127008] New: CVE-2021-43138 yarnpkg: async: Prototype Pollution in async [fedora-all]
by bugzilla＠redhat.com 15 Sep '22

15 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2127008 Bug ID: 2127008 Summary: CVE-2021-43138 yarnpkg: async: Prototype Pollution in async [fedora-all] Product: Fedora Version: 36 Status: NEW Component: yarnpkg Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: zsvetlik(a)redhat.com Reporter: ahanwate(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2127008

1 2

[Bug 2126276] CVE-2021-43138 async: Prototype Pollution in async
by bugzilla＠redhat.com 15 Sep '22

15 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2126276 Avinash Hanwate <ahanwate(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2126992, 2126991 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126276

1 0

[Bug 2126276] CVE-2021-43138 async: Prototype Pollution in async
by bugzilla＠redhat.com 15 Sep '22

15 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2126276 --- Doc Text *updated* by Avinash Hanwate <ahanwate(a)redhat.com> --- A vulnerability was found in the async package, which could let a malicious user obtain privileges via the mapValues() method. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126276

1 0

[Bug 2126276] CVE-2021-43138 async: Prototype Pollution in async
by bugzilla＠redhat.com 15 Sep '22

15 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2126276 --- Doc Text *updated* by Avinash Hanwate <ahanwate(a)redhat.com> --- A vulnerability was found in the async package, which could let a malicious user obtain privileges via the mapValues() method. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126276

1 0

[Bug 2124060] New: For unknown reasons /usr/bin/meld not have executable attr
by bugzilla＠redhat.com 15 Sep '22

15 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2124060 Bug ID: 2124060 Summary: For unknown reasons /usr/bin/meld not have executable attr Product: Fedora Version: rawhide Status: NEW Component: meld Assignee: dmaphy(a)fedoraproject.org Reporter: mikhail.v.gavrilov(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: cwickert(a)fedoraproject.org, dmaphy(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, lkundrak(a)v3.sk, michel(a)michel-slm.name, oliver(a)linux-kernel.at Target Milestone: --- Classification: Fedora Created attachment 1909478 --> https://bugzilla.redhat.com/attachment.cgi?id=1909478&action=edit Software screenshot Description of problem: $ meld bash: /usr/bin/meld: Permission denied $ ls -la /usr/bin/meld -rw-r--r--. 1 root root 15876 Aug 19 16:53 /usr/bin/meld Workaround: # chmod +x /usr/bin/meld Version: # rpm -q meld meld-3.21.3-1.fc38.noarch -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2124060

1 14

[Bug 2124033] New: meld-3.22.0 is available
by bugzilla＠redhat.com 15 Sep '22

15 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2124033 Bug ID: 2124033 Summary: meld-3.22.0 is available Product: Fedora Version: rawhide Status: NEW Component: meld Keywords: FutureFeature, Triaged Assignee: dmaphy(a)fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: cwickert(a)fedoraproject.org, dmaphy(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, lkundrak(a)v3.sk, michel(a)michel-slm.name, oliver(a)linux-kernel.at Target Milestone: --- Classification: Fedora Releases retrieved: 3.22.0 Upstream release that is considered latest: 3.22.0 Current version/release in rawhide: 3.21.3-1.fc38 URL: http://meldmerge.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/5520/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/meld -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2124033

1 13

[Bug 2120360] New: /usr/bin/meld is not executable
by bugzilla＠redhat.com 15 Sep '22

15 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2120360 Bug ID: 2120360 Summary: /usr/bin/meld is not executable Product: Fedora Version: rawhide OS: Linux Status: NEW Component: meld Severity: high Assignee: dmaphy(a)fedoraproject.org Reporter: fedora(a)lyes.eu QA Contact: extras-qa(a)fedoraproject.org CC: cwickert(a)fedoraproject.org, dmaphy(a)fedoraproject.org, epel-packagers-sig(a)lists.fedoraproject.org, lkundrak(a)v3.sk, michel(a)michel-slm.name, oliver(a)linux-kernel.at Target Milestone: --- Classification: Fedora Description of problem: When installing meld, /usr/bin/meld was not executable. Version-Release number of selected component (if applicable): 3.21.3-1.fc38 How reproducible: Always Steps to Reproduce: 1. sudo dnf install meld 2. bash: /usr/bin/meld: Permission denied Actual results: /usr/bin/meld is not executable. Meld cannot be launched from overview, command line, or git mergetool. Expected results: /usr/bin/meld is executable. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2120360

1 13

[Bug 2126816] New: CVE-2021-40648 man2html: sys-apps/man2html: multiple vulnerabilities [fedora-all]
by bugzilla＠redhat.com 14 Sep '22

14 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2126816 Bug ID: 2126816 Summary: CVE-2021-40648 man2html: sys-apps/man2html: multiple vulnerabilities [fedora-all] Product: Fedora Version: 36 Status: NEW Component: man2html Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: sergio(a)serjux.com Reporter: ybuenos(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, orion(a)nwra.com, sergio(a)serjux.com, tchollingsworth(a)gmail.com, viktor.vix.jancik(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126816

1 2

[Bug 2126075] New: CVE-2021-40648 sys-apps/man2html: multiple vulnerabilities
by bugzilla＠redhat.com 14 Sep '22

14 Sep '22

https://bugzilla.redhat.com/show_bug.cgi?id=2126075 Bug ID: 2126075 Summary: CVE-2021-40648 sys-apps/man2html: multiple vulnerabilities Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: ybuenos(a)redhat.com CC: epel-packagers-sig(a)lists.fedoraproject.org, orion(a)nwra.com, sergio(a)serjux.com, tchollingsworth(a)gmail.com, viktor.vix.jancik(a)gmail.com Target Milestone: --- Classification: Other CVE-2021-40648: In man2html 1.6g, a filename can be created to overwrite the previous size parameter of the next chunk and the fd, bk, fd_nextsize, bk_nextsize of the current chunk. The next chunk is then freed later on, causing a freeing of an arbitrary amount of memory. https://gist.github.com/untaman/cb58123fe89fc65e3984165db5d40933 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126075

1 2

2024

2023

2022

2021

Epel-packagers-sig September 2022