GNOME 40.rc. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-303f6623fa 2021-03-20 00:16:30.596999 --------------------------------------------------------------------------------Name : gnome-initial-setup Product : Fedora 34 Version : 40~rc Release : 1.fc34 URL : https://wiki.gnome.org/Design/OS/InitialSetup Summary : Bootstrapping your OS Description : GNOME Initial Setup is an alternative to firstboot, providing a good setup experience to welcome you to your system, and walks you through configuring it. It is integrated with gdm. --------------------------------------------------------------------------------Update Information: GNOME 40.rc --------------------------------------------------------------------------------ChangeLog: * Mon Mar 15 2021 Kalev Lember - 40~rc-1 - Update to 40.rc --------------------------------------------------------------------------------References: [ 1 ] Bug #1925640 - CVE-2020-36241 gnome-autoar: directory traversal via a malicious archive that contains a file whose parent is a symbolic link which points outside of the destination directory https://bugzilla.redhat.com/show_bug.cgi?id=1925640 [ 2 ] Bug #1940026 - CVE-2021-28650 gnome-autoar: directory traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations https://bugzilla.redhat.com/show_bug.cgi?id=1940026 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-303f6623fa' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
An update for setup is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Low: setup security and bug fix update Advisory ID: RHSA-2018:3249-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:3249 Issue date: 2018-10-30 CVE Names: CVE-2018-1113 ==================================================================== 1. Summary: An update for setup is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - noarch Red Hat Enterprise Linux ComputeNode (v. 7) - noarch Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Enterprise Linux Workstation (v. 7) - noarch Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - noarch 3. Description: The setup package contains a set of important default system configuration and setup files. Examples include /etc/passwd, /etc/group, and /etc/profile. Other examples are the default lists of reserved user IDs, reserved ports, reserved protocols, allowed shells, allowed secure terminals. Security Fix(es): * setup: nologin listed in /etc/shells violates security expectations (CVE-2018-1113) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the Referencessection. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1566469 - Typing Mistake in /etc/protocols 1571094 - CVE-2018-1113 setup: nologin listed in /etc/shells violates security expectations 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: setup-2.8.71-10.el7.src.rpm noarch: setup-2.8.71-10.el7.noarch.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: setup-2.8.71-10.el7.src.rpm noarch: setup-2.8.71-10.el7.noarch.rpm Red Hat Enterprise Linux Server (v. 7): Source: setup-2.8.71-10.el7.src.rpm noarch: setup-2.8.71-10.el7.noarch.rpm Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7): Source: setup-2.8.71-10.el7.src.rpm noarch: setup-2.8.71-10.el7.noarch.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: setup-2.8.71-10.el7.src.rpm noarch: setup-2.8.71-10.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-1113 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBW9gQR9zjgjWX9erEAQiuoRAAiZpJfOGqTAfRNqZhCk6bHEovRaD7UiQv fkv1CLGed2MXsrEWabe3Ybh/aNrsHdpKTyEm/hPtC/XMifV4WLz7qfwoRPhpLj00 57+5h2DCFgWn2ATKJNVLfHJilgpXwlKrVJTrU86lP0rfT3NCWa0h+epst6IIOgm8 lyrQDmhD+NM4wWM9j6hySVabLiEiJgVOUoJWss6CeIHL2lfu9Dz5tkZqVQxG72BE rR8G0YYrT7ssncYZ3QaHJqDP+eFx+DZsla4LCYaSwlHpuE0pItDB+nUrFff9n/8X VYidORe35L8ZzE869np3M+daY2gnOWXzyw41MmeVKGtGiD/xBtAns1kyFUA1/lug D2gtq33eHnAYHD5/W33JsfLkDEhjcNyrphFubZ21alg7RV4GriZ6oVhtoJMX3Gbj M6j6br/H5gPQTvpV2fDIIgR4+p1r4W+UrwRbH96U4vgvvM+6Pw39Fa4Y1UrwZyBJ P7SEA3WYjKmQGophTuOa4qa0hwAkt+KyIwkE/kucuR8Y69idUr/4zGDnvezJa7h+ Sy18JPjTvzBLDq6FIBdzBPla8hi5MzgReX4J0gUb4CckEzrZvfeIDNTgexSP+4tG 6kQ/cnKNIzhmXlWlPmMED7fpvMSt4xgq1o1EqruXhTRAv0x0SN56vyMbG8tH3V7b RMWmpvYCGso=lwzl -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Get the latest Linux and open source security news straight to your inbox.