Stay Secure with the Latest Linux Advisories

security advisoryFedoraDoS

Fedora 31: FEDORA-2020-fe299b3fa3 critical: pandoc-citeproc DoS

Security fix for CVE-2020-5238 - ghc-cmark-gfm updated to 0.2.2 which rebases the bundled cmark-gfm to 0.29.0.gfm.1 https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-fe299b3fa3 2020-10-06 15:06:57.555099 --------------------------------------------------------------------------------Name : pandoc-citeproc Product : Fedora 31 Version : 0.15.0.1 Release : 2.fc31 URL : https://hackage.haskell.org/package/pandoc-citeproc Summary : Citeproc support for pandoc Description : The pandoc-citeproc library supports automatic generation of citations and a bibliography in pandoc documents using the Citation Style Language (CSL) macro language. More details on CSL can be found at . In addition to a library, the package includes an executable, pandoc-citeproc, which works as a pandoc filter and also has a mode for converting bibliographic databases into CSL JSON and pandoc YAML metadata formats. pandoc-citeproc originated as a fork of Andrea Rossato's citeproc-hs. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2020-5238 - ghc-cmark-gfm updated to 0.2.2 which rebases the bundled cmark-gfm to 0.29.0.gfm.1 https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85 --------------------------------------------------------------------------------ChangeLog: * Thu Sep 24 2020 Jens Petersen - 0.15.0.1-2 - rebuild for cmark-gfm-0.2.2: fixes exponential parse (#1854329) --------------------------------------------------------------------------------References: [ 1 ] Bug #1854328 - CVE-2020-5238 cmark: Exponential time to parse certain inputs could lead to DoS. https://bugzilla.redhat.com/show_bug.cgi?id=1854328 --------------------------------------------------------------------------------This update can be installedwith the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-fe299b3fa3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Critical security update for Fedora 31's pandoc-citeproc tackling CVE-2020-5238 associated with cmark-gfm Exponential DoS vulnerabilities.. pandoc-citeproc,cmark-gfm,security fix,Fedora,DoS. . Severity: Critical. LinuxSecurity.com Team

Oct 06, 2020 •Critical Fedora