Stay Secure with the Latest Linux Advisories

security advisoryfedoraimportant

Fedora 42: rust-h2 0.4.12 Important ZIP Validation Exploit CVE-2025-54368

Update uv to version 0.8.8. Update the h2 crate to version 0.4.12. The builds in this update also address CVE-2025-54368.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-c22dd590b8 2025-08-19 04:14:40.703643+00:00 -------------------------------------------------------------------------------- Name : rust-h2 Product : Fedora 42 Version : 0.4.12 Release : 1.fc42 URL : https://crates.io/crates/h2 Summary : HTTP/2 client and server Description : An HTTP/2 client and server. -------------------------------------------------------------------------------- Update Information: Update uv to version 0.8.8. Update the h2 crate to version 0.4.12. The builds in this update also address CVE-2025-54368. -------------------------------------------------------------------------------- ChangeLog: * Thu Aug 7 2025 Fabio Valentini - 0.4.12-1 - Update to version 0.4.12; Fixes RHBZ#2386891 * Fri Jul 25 2025 Fedora Release Engineering - 0.4.11-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2386891 - rust-h2-0.4.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2386891 [ 2 ] Bug #2387194 - uv-0.8.8 is available https://bugzilla.redhat.com/show_bug.cgi?id=2387194 [ 3 ] Bug #2387243 - CVE-2025-54368 uv: uv ZIP Archive Validation Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2387243 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-c22dd590b8' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPGkey. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . The upgrade to rust-h2 version 0.4.12 in Fedora 42 tackles CVE-2025-54368, bolstering defenses against potential ZIP-related security risks.. Fedora update,rust-h2 security,CVE-2025-54368,ZIP exploit risk. . Severity: Important. LinuxSecurity.com Team

Aug 19, 2025 •Important Fedora