Aggregator

vyper-0.4.3-9.fc44

Fedora Security Advisories
3 days 13 hours ago
FEDORA-2026-9e904c3eb3 Packages in this update:
  • vyper-0.4.3-9.fc44
Update description:

Security update: backport fixes for Vyper compiler issues that can silently miscompile contracts.

  • CVE-2026-114114, CVE-2026-114116 (GHSA-wvx7-39qj-2g9v): multi-byte characters (e.g. non-ASCII identifiers), line-separator characters such as form feed or U+2028, or a leading byte-order mark could shift the compiler's source lookups, so numeric and address literals compiled to values other than the ones written. Source spans are now computed the way the Python parser reports them.
  • CVE-2026-114118: create_from_blueprint accepted a code_offset that wraps around 2**256 and deployed a contract with empty code instead of reverting. The offset is now checked against the blueprint size before subtracting.
  • CVE-2026-114115 (GHSA-cw3h-xwxq-8cx2): a ternary choosing between nested arrays with different inner bounds could read the narrower array with the wider layout and produce corrupted values.

Contracts compiled with earlier builds may need to be recompiled and redeployed if they are affected.

vyper-0.4.3-9.fc45

Fedora Security Advisories
3 days 13 hours ago
FEDORA-2026-d7d3016c54 Packages in this update:
  • vyper-0.4.3-9.fc45
Update description:

Security update: backport fixes for Vyper compiler issues that can silently miscompile contracts.

  • CVE-2026-114114, CVE-2026-114116 (GHSA-wvx7-39qj-2g9v): multi-byte characters (e.g. non-ASCII identifiers), line-separator characters such as form feed or U+2028, or a leading byte-order mark could shift the compiler's source lookups, so numeric and address literals compiled to values other than the ones written. Source spans are now computed the way the Python parser reports them.
  • CVE-2026-114118: create_from_blueprint accepted a code_offset that wraps around 2**256 and deployed a contract with empty code instead of reverting. The offset is now checked against the blueprint size before subtracting.
  • CVE-2026-114115 (GHSA-cw3h-xwxq-8cx2): a ternary choosing between nested arrays with different inner bounds could read the narrower array with the wider layout and produce corrupted values.

Contracts compiled with earlier builds may need to be recompiled and redeployed if they are affected.

python-crate-ingredients-0.3.3-2.fc43

Fedora Security Advisories
3 days 13 hours ago
FEDORA-2026-e015e480f6 Packages in this update:
  • python-crate-ingredients-0.3.3-2.fc43
Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

mstflint-4.37.0_1.1-4.fc43

Fedora Security Advisories
3 days 20 hours ago
FEDORA-2026-8c39ba6bab Packages in this update:
  • mstflint-4.37.0_1.1-4.fc43
Update description:

mstfwmanager now verifies TLS peers of www.mellanox.com against the system CA trust store (libcurl's default) instead of the private, stale Mozilla root store copy shipped in /etc/mstflint/ca-bundle.crt — a July 2021 snapshot that still trusted roots removed or distrusted since, including those involved in the eMudhra intermediate CA compromise. The private bundle file is no longer shipped; --ssl-certificate still works for passing a custom CA bundle.

Backport of https://github.com/Mellanox/mstflint/pull/2090

mstflint-4.37.0_1.1-4.fc44

Fedora Security Advisories
3 days 20 hours ago
FEDORA-2026-7092a043be Packages in this update:
  • mstflint-4.37.0_1.1-4.fc44
Update description:

mstfwmanager now verifies TLS peers of www.mellanox.com against the system CA trust store (libcurl's default) instead of the private, stale Mozilla root store copy shipped in /etc/mstflint/ca-bundle.crt — a July 2021 snapshot that still trusted roots removed or distrusted since, including those involved in the eMudhra intermediate CA compromise. The private bundle file is no longer shipped; --ssl-certificate still works for passing a custom CA bundle.

Backport of https://github.com/Mellanox/mstflint/pull/2090

mstflint-4.37.0_1.1-4.fc45

Fedora Security Advisories
3 days 20 hours ago
FEDORA-2026-015536827f Packages in this update:
  • mstflint-4.37.0_1.1-4.fc45
Update description:

mstfwmanager now verifies TLS peers of www.mellanox.com against the system CA trust store (libcurl's default) instead of the private, stale Mozilla root store copy shipped in /etc/mstflint/ca-bundle.crt — a July 2021 snapshot that still trusted roots removed or distrusted since, including those involved in the eMudhra intermediate CA compromise. The private bundle file is no longer shipped; --ssl-certificate still works for passing a custom CA bundle.

Backport of https://github.com/Mellanox/mstflint/pull/2090

rabbitmq-server-4.0.9-6.fc43

Fedora Security Advisories
3 days 21 hours ago
FEDORA-2026-baae3b217a Packages in this update:
  • rabbitmq-server-4.0.9-6.fc43
Update description:

Security update: backport upstream RabbitMQ security fixes to 4.0.9.

  • CVE-2026-67409: JWKS signing keys are now only replaced from a successful (HTTP 200), well-formed response, so an error reply from the OAuth 2 provider can no longer wipe the cached keys and deny all OAuth 2 logins.
  • CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
  • CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.
  • CVE-2026-67420: user tags are rebuilt on OAuth 2 credential refresh, so a revoked impersonator tag no longer survives on an existing connection.

rabbitmq-server-4.2.9-4.fc44

Fedora Security Advisories
3 days 23 hours ago
FEDORA-2026-bfe9cc4c24 Packages in this update:
  • rabbitmq-server-4.2.9-4.fc44
Update description:

Security update: backport upstream RabbitMQ security fixes to 4.2.9.

  • CVE-2026-67414: an authenticated AMQP 1.0 client could exhaust broker memory with arrays of zero-width elements; such arrays are now kept as opaque values.
  • CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
  • CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.

Also includes the CVE-2026-67420 fix from 4.2.9-3 (stale impersonator tag kept after OAuth token refresh). CVE-2026-67409 and CVE-2026-67410 are fixed upstream in 4.2.9.

Fix for CVE-2026-67420 (RabbitMQ: unauthorized user impersonation via stale OAuth token refresh). On a JWT/OAuth token refresh, rabbit_access_control:update_state/2 discarded the refreshed user tags, so a revoked 'impersonator' tag could survive on an existing connection. Backported from upstream v4.3.x (commit 5de287d).