Aggregator

FEDORA-2026-ea1afc0a7b Packages in this update:

• rabbitmq-server-4.0.9-7.fc43

Update description:

Security update: backport upstream RabbitMQ security fixes to 4.0.9.

Management UI and HTTP API: - CVE-2026-67421: HTML injection on the OAuth 2 login page via an attacker-controlled queue name; the error reason is now escaped and the default CSP gains base-uri 'none'. - CVE-2026-67239: stored XSS via TLS peer certificate fields in the stream connection page. - CVE-2026-66073, CVE-2026-67226, CVE-2026-67227: atom table exhaustion via the "node" field, the user tags list and global parameter names. - CVE-2026-61837: the AMQP 1.0 management GET /bindings endpoint now checks permissions like the other binding operations.

Authentication and authorisation: - CVE-2026-67223: LDAP user DN templates now RFC 4514-escape the username. - CVE-2026-44838, CVE-2026-67407: regex metacharacters (including "-") in topic permission variables are now escaped. - CVE-2026-67411: MQTT and Web MQTT behind a PROXY protocol frontend now check loopback_users against the real client address. - CVE-2026-67412: Federation upstream URIs now require access to the target virtual host. - CVE-2026-66071: OAuth 2 tag scopes no longer create new atoms. - CVE-2026-67222: AMQP URI auth_mechanism values are limited to known mechanisms and no longer create atoms.

Denial of service: - CVE-2026-67413: JMS topic exchange LIKE selectors run with regex match limits. - CVE-2026-67230: Web STOMP enforces the login timeout and a frame size limit before authentication. - CVE-2026-67225: the stream protocol rejects frames larger than the negotiated frame_max.

This update also includes the fixes from 4.0.9-6 (CVE-2026-67409, CVE-2026-67416, CVE-2026-67418, CVE-2026-67420).

Security update: backport upstream RabbitMQ security fixes to 4.0.9.

• CVE-2026-67409: JWKS signing keys are now only replaced from a successful (HTTP 200), well-formed response, so an error reply from the OAuth 2 provider can no longer wipe the cached keys and deny all OAuth 2 logins.
• CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
• CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.
• CVE-2026-67420: user tags are rebuilt on OAuth 2 credential refresh, so a revoked impersonator tag no longer survives on an existing connection.

FEDORA-2026-296b2865ba Packages in this update:

• rabbitmq-server-4.2.9-5.fc44

Update description:

Fix for CVE-2026-67421

Security update: backport upstream RabbitMQ security fixes to 4.2.9.

• CVE-2026-67414: an authenticated AMQP 1.0 client could exhaust broker memory with arrays of zero-width elements; such arrays are now kept as opaque values.
• CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
• CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.

Also includes the CVE-2026-67420 fix from 4.2.9-3 (stale impersonator tag kept after OAuth token refresh). CVE-2026-67409 and CVE-2026-67410 are fixed upstream in 4.2.9.

Fix for CVE-2026-67420 (RabbitMQ: unauthorized user impersonation via stale OAuth token refresh). On a JWT/OAuth token refresh, rabbit_access_control:update_state/2 discarded the refreshed user tags, so a revoked 'impersonator' tag could survive on an existing connection. Backported from upstream v4.3.x (commit 5de287d).

USN-7530-1 fixed a vulnerability in ADOdb. This update provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. Original advisory details: It was discovered that ADOdb incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL commands.

FEDORA-2026-93ccf43a01 Packages in this update:

• mtools-4.0.50-1.fc43

Update description:

Update to 4.0.50 (#2564411)

Version:next-20261104 (linux-next) Released:2026-11-04

FEDORA-2026-69a77954cf Packages in this update:

• gimp-3.2.8-1.fc43

Update description:

This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.

For more information, please consult the GIMP 3.2.8 release announcement.

FEDORA-2026-e55621607b Packages in this update:

• gimp-3.2.8-1.fc45

Update description:

This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.

For more information, please consult the GIMP 3.2.8 release announcement.

FEDORA-2026-32431829f1 Packages in this update:

• gimp-3.2.8-1.fc44

Update description:

This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.

For more information, please consult the GIMP 3.2.8 release announcement.

FEDORA-EPEL-2026-c167d2d2d7 Packages in this update:

• python-loguru-0.7.3-9.el10_3

Update description:

Backport fix for CVE-2026-120217

FEDORA-2026-4701fdc782 Packages in this update:

• mongo-c-driver-2.5.8-1.fc45

Update description: libbson version 2.5.8

Fixes

• Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954

libmongoc version 2.5.8

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-0da73d1b5b Packages in this update:

• mongo-c-driver-2.5.8-1.el10_4

Update description: libbson version 2.5.8

Fixes

• Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954

libmongoc version 2.5.8

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-8663de05d3 Packages in this update:

• mongo-c-driver-2.5.8-1.el10_3

Update description: libbson version 2.5.8

Fixes

• Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954

libmongoc version 2.5.8

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-2026-43d95b04a7 Packages in this update:

• mongo-c-driver-1.30.15-1.fc44

Update description: libmongoc 1.30.15

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-a98d3339c8 Packages in this update:

• mongo-c-driver-1.30.15-1.el8

Update description: libmongoc 1.30.15

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-8865b24891 Packages in this update:

• mongo-c-driver-1.30.15-1.el10_2

Update description: libmongoc 1.30.15

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-2026-be6a432dc3 Packages in this update:

• mongo-c-driver-1.30.15-1.fc43

Update description: libmongoc 1.30.15

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-318de46435 Packages in this update:

• mongo-c-driver-1.30.15-1.el9

Update description: libmongoc 1.30.15

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-2035b2e21b Packages in this update:

• python-loguru-0.7.3-9.el10_4

Update description:

Backport fix for CVE-2026-120217

FEDORA-2026-a04615c725 Packages in this update:

• perl-CGI-5.02-1.fc45

Update description:

5.02 bump - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex) - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type) - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits) - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS) - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups) - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references) - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values) - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ";" injected attributes) - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes) - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host) - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it) - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs) - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical) - Fix CVE-2026-120648 (comment() text could end HTML comment) - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs) - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling) - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk) - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field) - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values) - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

FEDORA-2026-516e427bac Packages in this update:

• perl-CGI-5.02-1.fc44

Update description:

5.02 bump - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex) - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type) - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits) - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS) - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups) - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references) - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values) - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ";" injected attributes) - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes) - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host) - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it) - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs) - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical) - Fix CVE-2026-120648 (comment() text could end HTML comment) - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs) - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling) - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk) - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field) - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values) - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)