Stay Secure with the Latest Linux Advisories

security advisoryFedorasecurity fix

Fedora 32: FEDORA-2020-238bbf85d8 Critical: Oddjob Race Condition

This update includes a security fix for CVE-2020-10737. Additionally, From 0.34.6: - update license on src/buffer.h - changes "/var/run" to "/run" in systemd service file (Orion Poplawski, #1834511) From 0.34.5: - apply patch from Matthias Gerstner of the SUSE security team to fix a possible race condition in the mkhomedir helper (noted above, this fixes CVE-2020-10737) -. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-238bbf85d8 2020-05-14 02:35:07.838586 --------------------------------------------------------------------------------Name : oddjob Product : Fedora 32 Version : 0.34.6 Release : 1.fc32 URL : https://pagure.io/oddjob Summary : A D-Bus service which runs odd jobs on behalf of client applications Description : oddjob is a D-Bus service which performs particular tasks for clients which connect to it and issue requests using the system-wide message bus. --------------------------------------------------------------------------------Update Information: This update includes a security fix for CVE-2020-10737. Additionally, From 0.34.6: - update license on src/buffer.h - changes "/var/run" to "/run" in systemd service file (Orion Poplawski, #1834511) From 0.34.5: - apply patch from Matthias Gerstner of the SUSE security team to fix a possible race condition in the mkhomedir helper (noted above, this fixes CVE-2020-10737) -only process SELinux contexts if SELinux is not disabled (Alexander Bokovoy, #1828855) --------------------------------------------------------------------------------ChangeLog: * Thu May 7 2020 Nalin Dahyabhai - 0.34.6-1 - update license on src/buffer.h - change /var/run -> /run in systemd service file (Orion Poplawski) * Thu May 7 2020 Nalin Dahyabhai - 0.34.5-1 - apply patch from Matthias Gerstner of the SUSE security team to fix a possible race condition in the mkhomedir helper (CVE-2020-10737) - only process SELinux contexts ifSELinux is not disabled (Alexander Bokovoy) --------------------------------------------------------------------------------References: [ 1 ] Bug #1833042 - CVE-2020-10737 oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack https://bugzilla.redhat.com/show_bug.cgi?id=1833042 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-238bbf85d8' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . A security update for oddjob in Fedora 32 resolves a critical race condition that may facilitate symlink exploitation. Users are urged to upgrade promptly.. Oddjob Update,Fedora 32,Security Notice,D-Bus Service,Race Condition. . Severity: Critical. LinuxSecurity.com Team

May 13, 2020 •Critical Fedora