Fedora Security Advisories

fuse-sshfs-3.7.6-1.el10_2

Fedora Security Advisories
1 hour 26 minutes ago
FEDORA-EPEL-2026-1fb4e037f0 Packages in this update:
  • fuse-sshfs-3.7.6-1.el10_2
Update description:

Security update: update SSHFS to 3.7.6.

  • CVE-2026-47187: a rogue SFTP server could return absolute symlink targets or targets containing "..", which the local kernel then resolved against the client's filesystem, so ordinary operations (cp, rsync, editors, backup tools) could disclose or overwrite local files. The new contain_symlinks option, enabled by default, rejects such targets with EPERM; use -o no_contain_symlinks for trusted servers that rely on them.
  • CVE-2026-48711: a bracketed mount source such as [-oProxyCommand=CMD]:/path could inject options into the ssh command line and run arbitrary commands. Host names starting with "-" are now rejected and "--" is passed before the host name.

Other changes since 3.7.3 include IPv6 support for direct_port connections, fixes for malformed SFTP replies, a statfs divide-by-zero and a cache memory leak. Note that the -v/--verbose command-line flag was removed; use -o sshfs_verbose instead.

fuse-sshfs-3.7.6-1.el10_3

Fedora Security Advisories
1 hour 26 minutes ago
FEDORA-EPEL-2026-acaf87abe0 Packages in this update:
  • fuse-sshfs-3.7.6-1.el10_3
Update description:

Security update: update SSHFS to 3.7.6.

  • CVE-2026-47187: a rogue SFTP server could return absolute symlink targets or targets containing "..", which the local kernel then resolved against the client's filesystem, so ordinary operations (cp, rsync, editors, backup tools) could disclose or overwrite local files. The new contain_symlinks option, enabled by default, rejects such targets with EPERM; use -o no_contain_symlinks for trusted servers that rely on them.
  • CVE-2026-48711: a bracketed mount source such as [-oProxyCommand=CMD]:/path could inject options into the ssh command line and run arbitrary commands. Host names starting with "-" are now rejected and "--" is passed before the host name.

Other changes since 3.7.3 include IPv6 support for direct_port connections, fixes for malformed SFTP replies, a statfs divide-by-zero and a cache memory leak. Note that the -v/--verbose command-line flag was removed; use -o sshfs_verbose instead.

fuse-sshfs-3.7.6-1.el10_4

Fedora Security Advisories
1 hour 26 minutes ago
FEDORA-EPEL-2026-435b731a0b Packages in this update:
  • fuse-sshfs-3.7.6-1.el10_4
Update description:

Security update: update SSHFS to 3.7.6.

  • CVE-2026-47187: a rogue SFTP server could return absolute symlink targets or targets containing "..", which the local kernel then resolved against the client's filesystem, so ordinary operations (cp, rsync, editors, backup tools) could disclose or overwrite local files. The new contain_symlinks option, enabled by default, rejects such targets with EPERM; use -o no_contain_symlinks for trusted servers that rely on them.
  • CVE-2026-48711: a bracketed mount source such as [-oProxyCommand=CMD]:/path could inject options into the ssh command line and run arbitrary commands. Host names starting with "-" are now rejected and "--" is passed before the host name.

Other changes since 3.7.3 include IPv6 support for direct_port connections, fixes for malformed SFTP replies, a statfs divide-by-zero and a cache memory leak. Note that the -v/--verbose command-line flag was removed; use -o sshfs_verbose instead.

fuse-sshfs-3.7.6-1.el9

Fedora Security Advisories
1 hour 26 minutes ago
FEDORA-EPEL-2026-c7d633ecd9 Packages in this update:
  • fuse-sshfs-3.7.6-1.el9
Update description:

Security update: update SSHFS to 3.7.6.

  • CVE-2026-47187: a rogue SFTP server could return absolute symlink targets or targets containing "..", which the local kernel then resolved against the client's filesystem, so ordinary operations (cp, rsync, editors, backup tools) could disclose or overwrite local files. The new contain_symlinks option, enabled by default, rejects such targets with EPERM; use -o no_contain_symlinks for trusted servers that rely on them.
  • CVE-2026-48711: a bracketed mount source such as [-oProxyCommand=CMD]:/path could inject options into the ssh command line and run arbitrary commands. Host names starting with "-" are now rejected and "--" is passed before the host name.

Other changes since 3.7.3 include IPv6 support for direct_port connections, fixes for malformed SFTP replies, a statfs divide-by-zero and a cache memory leak. Note that the -v/--verbose command-line flag was removed; use -o sshfs_verbose instead.

vyper-0.4.3-9.fc43

Fedora Security Advisories
2 hours 8 minutes ago
FEDORA-2026-a6f4884fd9 Packages in this update:
  • vyper-0.4.3-9.fc43
Update description:

Security update: backport fixes for Vyper compiler issues that can silently miscompile contracts.

  • CVE-2026-114114, CVE-2026-114116 (GHSA-wvx7-39qj-2g9v): multi-byte characters (e.g. non-ASCII identifiers), line-separator characters such as form feed or U+2028, or a leading byte-order mark could shift the compiler's source lookups, so numeric and address literals compiled to values other than the ones written. Source spans are now computed the way the Python parser reports them.
  • CVE-2026-114118: create_from_blueprint accepted a code_offset that wraps around 2**256 and deployed a contract with empty code instead of reverting. The offset is now checked against the blueprint size before subtracting.
  • CVE-2026-114115 (GHSA-cw3h-xwxq-8cx2): a ternary choosing between nested arrays with different inner bounds could read the narrower array with the wider layout and produce corrupted values.

Contracts compiled with earlier builds may need to be recompiled and redeployed if they are affected.

vyper-0.4.3-9.fc44

Fedora Security Advisories
2 hours 9 minutes ago
FEDORA-2026-9e904c3eb3 Packages in this update:
  • vyper-0.4.3-9.fc44
Update description:

Security update: backport fixes for Vyper compiler issues that can silently miscompile contracts.

  • CVE-2026-114114, CVE-2026-114116 (GHSA-wvx7-39qj-2g9v): multi-byte characters (e.g. non-ASCII identifiers), line-separator characters such as form feed or U+2028, or a leading byte-order mark could shift the compiler's source lookups, so numeric and address literals compiled to values other than the ones written. Source spans are now computed the way the Python parser reports them.
  • CVE-2026-114118: create_from_blueprint accepted a code_offset that wraps around 2**256 and deployed a contract with empty code instead of reverting. The offset is now checked against the blueprint size before subtracting.
  • CVE-2026-114115 (GHSA-cw3h-xwxq-8cx2): a ternary choosing between nested arrays with different inner bounds could read the narrower array with the wider layout and produce corrupted values.

Contracts compiled with earlier builds may need to be recompiled and redeployed if they are affected.

vyper-0.4.3-9.fc45

Fedora Security Advisories
2 hours 9 minutes ago
FEDORA-2026-d7d3016c54 Packages in this update:
  • vyper-0.4.3-9.fc45
Update description:

Security update: backport fixes for Vyper compiler issues that can silently miscompile contracts.

  • CVE-2026-114114, CVE-2026-114116 (GHSA-wvx7-39qj-2g9v): multi-byte characters (e.g. non-ASCII identifiers), line-separator characters such as form feed or U+2028, or a leading byte-order mark could shift the compiler's source lookups, so numeric and address literals compiled to values other than the ones written. Source spans are now computed the way the Python parser reports them.
  • CVE-2026-114118: create_from_blueprint accepted a code_offset that wraps around 2**256 and deployed a contract with empty code instead of reverting. The offset is now checked against the blueprint size before subtracting.
  • CVE-2026-114115 (GHSA-cw3h-xwxq-8cx2): a ternary choosing between nested arrays with different inner bounds could read the narrower array with the wider layout and produce corrupted values.

Contracts compiled with earlier builds may need to be recompiled and redeployed if they are affected.

python-crate-ingredients-0.3.3-2.fc43

Fedora Security Advisories
2 hours 30 minutes ago
FEDORA-2026-e015e480f6 Packages in this update:
  • python-crate-ingredients-0.3.3-2.fc43
Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

mstflint-4.37.0_1.1-4.fc43

Fedora Security Advisories
9 hours 3 minutes ago
FEDORA-2026-8c39ba6bab Packages in this update:
  • mstflint-4.37.0_1.1-4.fc43
Update description:

mstfwmanager now verifies TLS peers of www.mellanox.com against the system CA trust store (libcurl's default) instead of the private, stale Mozilla root store copy shipped in /etc/mstflint/ca-bundle.crt — a July 2021 snapshot that still trusted roots removed or distrusted since, including those involved in the eMudhra intermediate CA compromise. The private bundle file is no longer shipped; --ssl-certificate still works for passing a custom CA bundle.

Backport of https://github.com/Mellanox/mstflint/pull/2090

mstflint-4.37.0_1.1-4.fc44

Fedora Security Advisories
9 hours 30 minutes ago
FEDORA-2026-7092a043be Packages in this update:
  • mstflint-4.37.0_1.1-4.fc44
Update description:

mstfwmanager now verifies TLS peers of www.mellanox.com against the system CA trust store (libcurl's default) instead of the private, stale Mozilla root store copy shipped in /etc/mstflint/ca-bundle.crt — a July 2021 snapshot that still trusted roots removed or distrusted since, including those involved in the eMudhra intermediate CA compromise. The private bundle file is no longer shipped; --ssl-certificate still works for passing a custom CA bundle.

Backport of https://github.com/Mellanox/mstflint/pull/2090

mstflint-4.37.0_1.1-4.fc45

Fedora Security Advisories
9 hours 30 minutes ago
FEDORA-2026-015536827f Packages in this update:
  • mstflint-4.37.0_1.1-4.fc45
Update description:

mstfwmanager now verifies TLS peers of www.mellanox.com against the system CA trust store (libcurl's default) instead of the private, stale Mozilla root store copy shipped in /etc/mstflint/ca-bundle.crt — a July 2021 snapshot that still trusted roots removed or distrusted since, including those involved in the eMudhra intermediate CA compromise. The private bundle file is no longer shipped; --ssl-certificate still works for passing a custom CA bundle.

Backport of https://github.com/Mellanox/mstflint/pull/2090

rabbitmq-server-4.0.9-6.fc43

Fedora Security Advisories
10 hours 25 minutes ago
FEDORA-2026-baae3b217a Packages in this update:
  • rabbitmq-server-4.0.9-6.fc43
Update description:

Security update: backport upstream RabbitMQ security fixes to 4.0.9.

  • CVE-2026-67409: JWKS signing keys are now only replaced from a successful (HTTP 200), well-formed response, so an error reply from the OAuth 2 provider can no longer wipe the cached keys and deny all OAuth 2 logins.
  • CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
  • CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.
  • CVE-2026-67420: user tags are rebuilt on OAuth 2 credential refresh, so a revoked impersonator tag no longer survives on an existing connection.
Checked
50 minutes 6 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security