Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Update to upstream 9.2.3 Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-1caffb88af 2023-11-03 18:20:20.954007 -------------------------------------------------------------------------------- Name : trafficserver Product : Fedora 39 Version : 9.2.3 Release : 1.fc39 URL : https://trafficserver.apache.org/ Summary : Fast, scalable and extensible HTTP/1.1 and HTTP/2 caching proxy server Description : Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching and reusing frequently-requested web pages, images, and web service calls. Proxying - Easily add keep-alive, filter or anonymize content requests, or add load balancing by adding a proxy layer. Fast - Scales well on modern SMP hardware, handling 10s of thousands of requests per second. Extensible - APIs to write your own plug-ins to do anything from modifying HTTP headers to handling ESI requests to writing your own cache algorithm. Proven - Handling over 400TB a day at Yahoo! both as forward and reverse proxies, Apache Traffic Server is battle hardened. -------------------------------------------------------------------------------- Update Information: Update to upstream 9.2.3 Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456 -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 11 2023 Jered Floyd 9.2.3-1 - Update to upstream 9.2.3 - Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456 * Wed Oct 4 2023 Jered Floyd 9.2.2-2 - Use OpenSSL 1.1.x from EPEL on RHEL 7 to fix Chrome 117+bugs -------------------------------------------------------------------------------- References: [ 1 ] Bug #2242988 - trafficserver-9.2.3-rc0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2242988 [ 2 ] Bug #2243251 - [Major Incident] CVE-2023-44487 trafficserver: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2243251 [ 3 ] Bug #2243252 - [Major Incident] CVE-2023-44487 trafficserver: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2243252 [ 4 ] Bug #2245107 - CVE-2023-39456 trafficserver: improper input validation vulnerability [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2245107 [ 5 ] Bug #2245110 - CVE-2023-39456 trafficserver: improper input validation vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2245110 [ 6 ] Bug #2245141 - CVE-2023-41752 trafficserver: possible exposure of sensitive information [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2245141 [ 7 ] Bug #2245142 - CVE-2023-41752 trafficserver: possible exposure of sensitive information [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2245142 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-1caffb88af' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announcemailing list --
Update Folly stack to the latest 2023.10.16.00 tag proxygen: Security fix for CVE-2023-44487. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-17efd3f2cd 2023-10-24 01:21:22.156597 -------------------------------------------------------------------------------- Name : watchman Product : Fedora 38 Version : 2021.05.10.00 Release : 24.fc38 URL : https://facebook.github.io/watchman/ Summary : File alteration monitoring service Description : Watchman exists to watch files and record when they actually change. It can also trigger actions (such as rebuilding assets) when matching files change. -------------------------------------------------------------------------------- Update Information: Update Folly stack to the latest 2023.10.16.00 tag proxygen: Security fix for CVE-2023-44487 -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 18 2023 Michel Lind - 2021.05.10.00-24 - Rebuilt for folly 2023.10.16.00 * Wed Sep 13 2023 Michel Lind - 2021.05.10.00-23 - Rebuilt for folly 2023.09.11.00 * Sat Jul 22 2023 Fedora Release Engineering - 2021.05.10.00-22 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2221799 - mcrouter-2023.10.09.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2221799 [ 2 ] Bug #2239431 - proxygen-2023.10.16.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239431 [ 3 ] Bug #2239594 - wangle-2023.10.16.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239594 [ 4 ] Bug #2239613 - fb303-2023.10.09.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239613 [ 5 ] Bug #2239614 - fbthrift-2023.10.09.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239614 [ 6 ] Bug #2239623 -fizz-2023.10.09.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239623 [ 7 ] Bug #2239624 - folly-2023.10.09.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239624 [ 8 ] Bug #2243253 - [Major Incident] CVE-2023-44487 proxygen: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2243253 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-17efd3f2cd' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Update Folly stack to the latest 2023.10.16.00 tag proxygen: Security fix for CVE-2023-44487. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-2a9214af5f 2023-10-24 01:11:19.008712 -------------------------------------------------------------------------------- Name : mvfst Product : Fedora 37 Version : 2023.10.16.00 Release : 1.fc37 URL : https://github.com/facebook/mvfst Summary : An implementation of the QUIC transport protocol Description : mvfst (Pronounced move fast) is a client and server implementation of IETF QUIC protocol in C++ by Facebook. QUIC is a UDP based reliable, multiplexed transport protocol that will become an internet standard. The goal of mvfst is to build a performant implementation of the QUIC transport protocol that applications could adapt for use cases on both the internet and the data-center. mvfst has been tested at scale on android, iOS apps, as well as servers and has several features to support large scale deployments. -------------------------------------------------------------------------------- Update Information: Update Folly stack to the latest 2023.10.16.00 tag proxygen: Security fix for CVE-2023-44487 -------------------------------------------------------------------------------- ChangeLog: * Tue Oct 17 2023 Michel Lind - 2023.10.16.00-1 - Update to 2023.10.16.00 * Tue Oct 17 2023 Michel Lind - 2023.10.09.00-1 - Update to 2023.10.09.00 * Sat Oct 7 2023 Michel Lind - 2023.09.11.00-2 - Rebuild for new libsodium * Tue Sep 12 2023 Michel Lind - 2023.09.11.00-1 - Initial package -------------------------------------------------------------------------------- References: [ 1 ] Bug #2221799 - mcrouter-2023.10.09.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2221799 [ 2 ] Bug #2239431 - proxygen-2023.10.16.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239431 [ 3 ] Bug#2239594 - wangle-2023.10.16.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239594 [ 4 ] Bug #2239613 - fb303-2023.10.09.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239613 [ 5 ] Bug #2239614 - fbthrift-2023.10.09.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239614 [ 6 ] Bug #2239623 - fizz-2023.10.09.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239623 [ 7 ] Bug #2239624 - folly-2023.10.09.00 is available https://bugzilla.redhat.com/show_bug.cgi?id=2239624 [ 8 ] Bug #2243253 - [Major Incident] CVE-2023-44487 proxygen: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2243253 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-2a9214af5f' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Update to upstream 9.2.3 Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-5ff7bf1dd8 2023-10-20 00:41:06.953602 -------------------------------------------------------------------------------- Name : trafficserver Product : Fedora 38 Version : 9.2.3 Release : 1.fc38 URL : https://trafficserver.apache.org/ Summary : Fast, scalable and extensible HTTP/1.1 and HTTP/2 caching proxy server Description : Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching and reusing frequently-requested web pages, images, and web service calls. Proxying - Easily add keep-alive, filter or anonymize content requests, or add load balancing by adding a proxy layer. Fast - Scales well on modern SMP hardware, handling 10s of thousands of requests per second. Extensible - APIs to write your own plug-ins to do anything from modifying HTTP headers to handling ESI requests to writing your own cache algorithm. Proven - Handling over 400TB a day at Yahoo! both as forward and reverse proxies, Apache Traffic Server is battle hardened. -------------------------------------------------------------------------------- Update Information: Update to upstream 9.2.3 Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456 -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 11 2023 Jered Floyd 9.2.3-1 - Update to upstream 9.2.3 - Resolves CVE-2023-44487, CVE-2023-41752, CVE-2023-39456 * Wed Oct 4 2023 Jered Floyd 9.2.2-2 - Use OpenSSL 1.1.x from EPEL on RHEL 7 to fix Chrome 117+bugs -------------------------------------------------------------------------------- References: [ 1 ] Bug #2242988 - trafficserver-9.2.3-rc0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2242988 [ 2 ] Bug #2243251 - [Major Incident] CVE-2023-44487 trafficserver: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2243251 [ 3 ] Bug #2243252 - [Major Incident] CVE-2023-44487 trafficserver: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2243252 [ 4 ] Bug #2245107 - CVE-2023-39456 trafficserver: improper input validation vulnerability [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2245107 [ 5 ] Bug #2245110 - CVE-2023-39456 trafficserver: improper input validation vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2245110 [ 6 ] Bug #2245141 - CVE-2023-41752 trafficserver: possible exposure of sensitive information [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2245141 [ 7 ] Bug #2245142 - CVE-2023-41752 trafficserver: possible exposure of sensitive information [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2245142 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-5ff7bf1dd8' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announcemailing list --
New upstream version CVE-2020-15225. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-f213fea441 2021-10-27 02:07:36.150396 --------------------------------------------------------------------------------Name : python-django-filter Product : Fedora 34 Version : 21.1 Release : 1.fc34 URL : https://github.com/carltongibson/django-filter Summary : A Django application for allowing users to filter queryset dynamically Description : Django-filter is a reusable Django application for allowing users to filter querysets dynamically. --------------------------------------------------------------------------------Update Information: New upstream version CVE-2020-15225 --------------------------------------------------------------------------------ChangeLog: * Mon Oct 18 2021 Luis Bazan - 21.1-1 - New upstream version * Tue Jul 27 2021 Fedora Release Engineering - 2.4.0-3 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild * Fri Jun 4 2021 Python Maint - 2.4.0-2 - Rebuilt for Python 3.10 --------------------------------------------------------------------------------References: [ 1 ] Bug #1955772 - CVE-2020-15225 python-django-filter: Maliciously input using exponential format may cause denial of service https://bugzilla.redhat.com/show_bug.cgi?id=1955772 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-f213fea441' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.