Fedora Security Advisories

FEDORA-EPEL-2025-b479f3bb28 Packages in this update:

• checkpointctl-1.4.1-1.el9

Update description:

Update checkpointctl to 1.4.1

FEDORA-2025-db05be2555 Packages in this update:

• containernetworking-plugins-1.9.0-1.fc41

Update description:

Update to release v1.9.0

FEDORA-2025-3a607d134b Packages in this update:

• checkpointctl-1.4.1-1.fc41

Update description:

Update checkpointctl to 1.4.1

FEDORA-2025-909f303a85 Packages in this update:

• checkpointctl-1.4.1-1.fc42

Update description:

Update checkpointctl to 1.4.1 (CVE-2025-47906)

FEDORA-2025-ebfdef0115 Packages in this update:

• checkpointctl-1.4.1-1.fc43

Update description:

Update checkpointctl to 1.4.1

FEDORA-2025-bab8cb971e Packages in this update:

• containernetworking-plugins-1.9.0-1.fc42

Update description:

Update to release v1.9.0

FEDORA-2025-294d534170 Packages in this update:

• containernetworking-plugins-1.9.0-1.fc43

Update description:

Update to release v1.9.0

FEDORA-2025-c67591d0a2 Packages in this update:

• containernetworking-plugins-1.9.0-1.fc44

Update description:

Automatic update for containernetworking-plugins-1.9.0-1.fc44.

Changelog * Tue Dec 9 2025 Bradley G Smith <bradley.g.smith@gmail.com> - 1.9.0-1 - Update to release v1.9.0 - Resolves: rhbz#2420515 - Resolves CVE-2025-58188: rhbz#2411454, rhbz#2411189, rhbz#2410923 - Resolves CVE-2025-58185: rhbz#2410556, rhbz#2410277, rhbz#2409991 - Resolves CVE-2025-61723: rhbz#2409605, rhbz#2409325, rhbz#2409043 - Resolves CVE-2025-58189: rhbz#2408135, rhbz#2407858, rhbz#2407588 - Fixes CVE-2025-67499, a bug in the nftables backend for the portmap plugin - Additional changes

FEDORA-2025-b1379d950d Packages in this update:

• python-django4.2-4.2.27-1.fc42

Update description:

• Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
• Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
• Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (4.2.26)
• Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB (4.2.25)
• Fixes CVE-2025-59682: Potential partial directory-traversal via archive.extract() (4.2.25)
• Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation column aliases (4.2.24)

FEDORA-2025-c08e0795c0 Packages in this update:

• python-django4.2-4.2.27-1.fc41

Update description:

• Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
• Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
• Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (4.2.26)
• Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB (4.2.25)
• Fixes CVE-2025-59682: Potential partial directory-traversal via archive.extract() (4.2.25)
• Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation column aliases (4.2.24)

FEDORA-EPEL-2025-f43c018f46 Packages in this update:

• python-django4.2-4.2.27-1.el9

Update description:

• Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
• Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
• Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (4.2.26)
• Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB (4.2.25)
• Fixes CVE-2025-59682: Potential partial directory-traversal via archive.extract() (4.2.25)
• Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation column aliases (4.2.24)

FEDORA-2025-24dfd3b072 Packages in this update:

• python-django5-5.2.9-1.fc43

Update description:

• Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
• Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
• Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (5.2.8)
• Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB (5.2.7)
• Fixes CVE-2025-59682: Potential partial directory-traversal via archive.extract() (5.2.7)
• Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation column aliases (5.2.6)

FEDORA-2025-45ee190318 Packages in this update:

• python-django5-5.2.9-1.fc42

Update description:

• Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
• Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
• Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (5.2.8)
• Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB (5.2.7)
• Fixes CVE-2025-59682: Potential partial directory-traversal via archive.extract() (5.2.7)
• Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation column aliases (5.2.6)

FEDORA-2025-9621c19da8 Packages in this update:

• httpd-2.4.66-1.fc43

Update description:

• version update
• security update

FEDORA-2025-f7c75ffee2 Packages in this update:

• httpd-2.4.66-1.fc42

Update description:

• version update
• security update

FEDORA-2025-bf07d21f3e Packages in this update:

• nebula-1.10.0-2.fc43

Update description:

Upstream update

FEDORA-2025-4fa5b6cb8e Packages in this update:

• firefox-146.0-2.fc43

Update description:

• Updated to latest upstream (146.0)

FEDORA-2025-d09ccba523 Packages in this update:

• firefox-146.0-2.fc42

Update description:

• Updated to latest upstream (146.0)

FEDORA-2025-d9707059b7 Packages in this update:

• vips-8.17.3-1.fc43

Update description:

New version of vips.

FEDORA-2025-107641b428 Packages in this update:

• vips-8.17.3-1.fc42

Update description:

New version of vips.