--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2022-aeafd24818
2022-10-25 13:12:34.597448
--------------------------------------------------------------------------------

Name        : xmlsec1
Product     : Fedora 36
Version     : 1.2.33
Release     : 3.fc36
URL         : https://www.aleksey.com/xmlsec/
Summary     : Library providing support for "XML Signature" and "XML Encryption" standards
Description :
XML Security Library is a C library based on LibXML2  and OpenSSL.
The library was created with a goal to support major XML security
standards "XML Digital Signature" and "XML Encryption".

--------------------------------------------------------------------------------
Update Information:

Update to 2.10.3  * Fix CVE-2022-40303 * Fix CVE-2022-40304
--------------------------------------------------------------------------------
ChangeLog:

* Mon Oct 24 2022 David King  - 1.2.33-3
- Rebuild against libxml2 (#2136800)
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2119077 - libxml2-2.10.2 is available
        https://bugzilla.redhat.com/show_bug.cgi?id=2119077
  [ 2 ] Bug #2136274 - CVE-2022-40303 libxml2: integer overflows with XML_PARSE_HUGE [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2136274
  [ 3 ] Bug #2136293 - CVE-2022-40304 libxml2: dict corruption caused by entity reference cycles [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2136293
  [ 4 ] Bug #2136800 - openconnect fails due to missing symbol xmlIOFTPRead
        https://bugzilla.redhat.com/show_bug.cgi?id=2136800
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2022-aeafd24818' at the command
line. For more information, refer to the dnf documentation available at
https://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue