Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 21 articles for you...
87
security advisorycriticaldebianDebian: Rails Severe Command Manipulation DSA-6090-2 CVE-2025-24294
Multiple security issues were discovered in the Rails web framework which could result in command injection or logging of unescaped ANSI sequences. For the oldstable distribution (bookworm), these problems have been fixed in version 2:6.1.7.10+dfsg-1~deb12u2.. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6090-1
Dec 21, 2025
•Critical
Debian
89
security advisoryfedoracriticalFedora 43 python-starlette Critical Parsing Issue Fix 2025-4154ea83d0
uv / python-uv-build 0.9.5 https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md ruff 0.14.2 https://github.com/astral-sh/ruff/blob/0.14.2/CHANGELOG.md Pydantic 2.12.3. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-4154ea83d0 2025-11-05 02:09:57.817569+00:00 -------------------------------------------------------------------------------- Name : python-starlette Product : Fedora 43 Version : 0.49.1 Release : 1.fc43 URL : https://www.starlette.io/ Summary : The little ASGI library that shines Description : Starlette is a lightweight ASGI framework/toolkit, which is ideal for building async web services in Python. It is production-ready, and gives you the following: \u2022 A lightweight, low-complexity HTTP web framework. \u2022 WebSocket support. \u2022 In-process background tasks. \u2022 Startup and shutdown events. \u2022 Test client built on requests. \u2022 CORS, GZip, Static Files, Streaming responses. \u2022 Session and Cookie support. \u2022 100% test coverage. \u2022 100% type annotated codebase. \u2022 Few hard dependencies. \u2022 Compatible with asyncio and trio backends. \u2022 Great overall performance against independent benchmarks. -------------------------------------------------------------------------------- Update Information: uv / python-uv-build 0.9.5 https://github.com/astral-sh/uv/blob/0.9.5/CHANGELOG.md ruff 0.14.2 https://github.com/astral-sh/ruff/blob/0.14.2/CHANGELOG.md Pydantic 2.12.3 Blog post maturin 1.9.6 https://github.com/PyO3/maturin/blob/v1.9.6/Changelog.md python-typing-inspection 0.4.2 (2025-10-01) Add typing_objects.is_noextraitems() python-jiter 0.11.0 https://github.com/pydantic/jiter/releases/tag/v0.11.0 python-pydantic-extra-types 2.10.6 https://github.com/pydantic/pydantic-extra-types/releases/tag/v2.10.6 Typer 0.20.0 Features \u2728 Enable command suggestions on typo by default. Upgrades \u2b06\ufe0f Add (official) support for Python3.14. Internal Assorted small enhancements. FastAPI 0.120.1 Upgrades \u2b06\ufe0f Bump Starlette to
Nov 05, 2025
•Critical
Fedora
202
security advisorymoderaterubyopenSUSE: Advisory 2025:15587-1 for ruby3.4-rubygem-rack CVE-2025-59830
An update that solves one vulnerability can now be installed.. # ruby3.4-rubygem-rack-2.2-2.2.18-1.1 on GA media Announcement ID: openSUSE-SU-2025:15587-1 Rating: moderate Cross-References: * CVE-2025-59830 CVSS scores: * CVE-2025-59830 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.18-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * ruby3.4-rubygem-rack-2.2 2.2.18-1.1 ## References: * https://www.suse.com/security/cve/CVE-2025-59830.html . An update for ruby3.4-rubygem-rack on openSUSE addresses a moderate severity issue and enhances system security.. openSUSE security update,ruby3.4,rubygem,rack,security advisory. . LinuxSecurity.com Team
Sep 30, 2025
OpenSUSE
197
security advisoryDebianSQL injectionDebian 11: DLA-4189-1 critical: web.py SQL injection issue
PostgreSQL SQL injection has been fixed in web.py, a Web framework for Python applications. For Debian 11 bullseye, this problem has been fixed in version . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4189-1
May 29, 2025
•Critical
Debian LTS
89
security advisoryFedoraweb frameworkFedora 41: perl-Mojolicious 9.39 critical: HMAC secret issue
Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. Mojolicious 9.39 added EXPERIMENTAL support for encrypted session cookies. This feature is much more secure than signed cookies and can be enabled by installing CryptX and setting the encrypted attribute.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-c38fd06bec 2025-05-21 02:04:40.357842+00:00 -------------------------------------------------------------------------------- Name : perl-Mojolicious Product : Fedora 41 Version : 9.39 Release : 1.fc41 URL : https://metacpan.org/dist/Mojolicious Summary : A next generation web framework for Perl Description : Back in the early days of the web there was this wonderful Perl library called CGI, many people only learned Perl because of it. It was simple enough to get started without knowing much about the language and powerful enough to keep you going, learning by doing was much fun. While most of the techniques used are outdated now, the idea behind it is not. Mojolicious is a new attempt at implementing this idea using state of the art technology. -------------------------------------------------------------------------------- Update Information: Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default. Mojolicious 9.39 added EXPERIMENTAL support for encrypted session cookies. This feature is much more secure than signed cookies and can be enabled by installing CryptX and setting the encrypted attribute. -------------------------------------------------------------------------------- ChangeLog: * Sun Nov 24 2024 Emmanuel Seyman - 9.39-1 - Update to 9.39 * Sun Sep 1 2024 Emmanuel Seyman - 9.38-1 - Update to9.38 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2364057 - CVE-2024-58134 perl-Mojolicious: Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2364057 [ 2 ] Bug #2364058 - CVE-2024-58134 perl-Mojolicious: Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's class name, as a HMAC session secret by default [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2364058 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-c38fd06bec' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
May 21, 2025
•Critical
Fedora
197
security advisorysecurity updateXSSDebian 11: DLA-4124-1 critical: bootstrap3 XSS vulnerabilities
Bootstrap (formerly Twitter Bootstrap), a free and open-source CSS framework, was affected by XSS vulnerabilities. If you use bootstrap through a module bundler, you may need to rebuild your . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4124-1
Apr 13, 2025
•Critical
Debian LTS
197
security advisorydebianweb frameworkDebian LTS: DLA-4007-1 python-tornado critical redirect issue
Tornado is a scalable, non-blocking Python web framework and asynchronous networking library. CVE-2023-28370 . ------------------------------------------------------------------------- Debian LTS Advisory DLA-4007-1
Jan 01, 2025
•Critical
Debian LTS
89
security advisoryFedoramoderate severityFedora 37: 2023-e72bf7b92e Moderate: rust-axum Web Framework Update
- Update the axum crate to version 0.6.20. - Update the tokio-tungstenite crate to version 0.20.1. - Update the tungstenite crate to version 0.20.1. - Port warp from tungstenite v0.18 to v0.20. Version 0.20.1 of the tungstenite crate includes a fix for CVE-2023-43669. No dependent applications need to be rebuilt since none of them use the WebSocket functionality of axum or warp.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-e72bf7b92e 2023-10-03 00:43:11.265398 -------------------------------------------------------------------------------- Name : rust-axum Product : Fedora 37 Version : 0.6.20 Release : 1.fc37 URL : Summary : Web framework that focuses on ergonomics and modularity Description : Web framework that focuses on ergonomics and modularity. -------------------------------------------------------------------------------- Update Information: - Update the axum crate to version 0.6.20. - Update the tokio-tungstenite crate to version 0.20.1. - Update the tungstenite crate to version 0.20.1. - Port warp from tungstenite v0.18 to v0.20. Version 0.20.1 of the tungstenite crate includes a fix for CVE-2023-43669. No dependent applications need to be rebuilt since none of them use the WebSocket functionality of axum or warp. -------------------------------------------------------------------------------- ChangeLog: * Sun Sep 24 2023 Fabio Valentini - 0.6.20-1 - Update to version 0.6.20; Fixes RHBZ#2230184 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-e72bf7b92e' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Oct 03, 2023
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!