Stay Secure with the Latest Linux Advisories

security advisorySQL Injectionfedora

Fedora 42 python-scitokens Path Traversal SQL Fix FEDORA-2026-dec8f790f7

Remove legacy parent SciToken chaining behavior from token initialization and claim handling Harden Enforcer scope path traversal validation (including encoded traversal checks) Clean up documentation references to parent/chained SciTokens. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-dec8f790f7 2026-03-22 01:07:57.226580+00:00 -------------------------------------------------------------------------------- Name : python-scitokens Product : Fedora 42 Version : 1.9.7 Release : 1.fc42 URL : https://scitokens.org Summary : SciToken reference implementation library Description : SciToken reference implementation library -------------------------------------------------------------------------------- Update Information: Remove legacy parent SciToken chaining behavior from token initialization and claim handling Harden Enforcer scope path traversal validation (including encoded traversal checks) Clean up documentation references to parent/chained SciTokens Fix SQL injection risk in KeyCache by using parameterized SQLite queries Prevent sibling-path authorization bypass in Enforcer scope checks -------------------------------------------------------------------------------- ChangeLog: * Fri Mar 13 2026 Derek Weitzel - 1.9.7-1 - Remove legacy parent SciToken chaining behavior from token initialization and claim handling - Harden Enforcer scope path traversal validation (including encoded traversal checks) - Clean up documentation references to parent/chained SciTokens * Fri Mar 13 2026 Derek Weitzel - 1.9.6-1 - Fix SQL injection risk in KeyCache by using parameterized SQLite queries - Prevent sibling-path authorization bypass in Enforcer scope checks * Sat Jan 17 2026 Fedora Release Engineering - 1.9.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- This updatecan be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-dec8f790f7' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new . Upgrade python-scitokens in Fedora 42 to address path traversal and SQL injection risks effectively.. python-scitokens Fedora update security path traversal SQL. . Severity: Important. LinuxSecurity.com Team

Mar 22, 2026 •Important Fedora