Fedora Security Advisories

FEDORA-2026-7dfa949ea9 Packages in this update:

• GitPython-3.1.55-1.fc43

Update description:

Update to 3.1.55: Fixes GHSA-2f96-g7mh-g2hx, GHSA-v396-v7q4-x2qj, GHSA-956x-8gvw-wg5v, GHSA-rwj8-pgh3-r573, GHSA-3rp5-jjmw-4wv2, GHSA-r9mr-m37c-5fr3, GHSA-fjr4-x663-mwxc, GHSA-6p8h-3wgx-97gf, and GHSA-94p4-4cq8-9g67.

FEDORA-2026-8e8273f18f Packages in this update:

• GitPython-3.1.55-1.fc44

Update description:

Update to 3.1.55: Fixes GHSA-2f96-g7mh-g2hx, GHSA-v396-v7q4-x2qj, GHSA-956x-8gvw-wg5v, GHSA-rwj8-pgh3-r573, GHSA-3rp5-jjmw-4wv2, GHSA-r9mr-m37c-5fr3, GHSA-fjr4-x663-mwxc, GHSA-6p8h-3wgx-97gf, and GHSA-94p4-4cq8-9g67.

FEDORA-2026-7d71f89d7e Packages in this update:

• firefox-153.0-3.fc44

Update description:

• Update to latest upstream (153.0)

• New upstream release (153.0)

• Updated to latest upstream (153.0)

FEDORA-2026-6dab7a3eff Packages in this update:

• firefox-153.0-3.fc43

Update description:

• Update to latest upstream (153.0)

• New upstream release (153.0)

• Updated to latest upstream (153.0)

FEDORA-2026-b29cbdb53f Packages in this update:

• rabbitmq-server-4.0.9-4.fc43

Update description:

Fixed CVE-2026-44839

FEDORA-2026-ff2a96c8de Packages in this update:

• rabbitmq-server-4.2.9-1.fc44

Update description:

RabbitMQ ver. 4.2.9

FEDORA-EPEL-2026-75bd5ec746 Packages in this update:

• pack-0.40.8-1.el9

Update description:

Security update to pack 0.40.8

Fixes CVE-2026-39828: golang.org/x/crypto/ssh - Unauthorized command execution via discarded SSH permissions Fixes GO-2026-4970: Root escape via symlink plus trailing slash in os package Fixes GO-2026-5856: Encrypted Client Hello privacy leak in crypto/tls

FEDORA-EPEL-2026-394b18b263 Packages in this update:

• pack-0.40.8-1.el10_2

Update description:

Security update to pack 0.40.8

Fixes CVE-2026-39828: golang.org/x/crypto/ssh - Unauthorized command execution via discarded SSH permissions Fixes GO-2026-4970: Root escape via symlink plus trailing slash in os package Fixes GO-2026-5856: Encrypted Client Hello privacy leak in crypto/tls

FEDORA-2026-e6e0368149 Packages in this update:

• pack-0.40.8-1.fc43

Update description:

Security update to pack 0.40.8

Fixes CVE-2026-39828: golang.org/x/crypto/ssh - Unauthorized command execution via discarded SSH permissions Fixes GO-2026-4970: Root escape via symlink plus trailing slash in os package Fixes GO-2026-5856: Encrypted Client Hello privacy leak in crypto/tls

FEDORA-2026-8729dce4b8 Packages in this update:

• pack-0.40.8-1.fc44

Update description:

Security update to pack 0.40.8

Fixes CVE-2026-39828: golang.org/x/crypto/ssh - Unauthorized command execution via discarded SSH permissions Fixes GO-2026-4970: Root escape via symlink plus trailing slash in os package Fixes GO-2026-5856: Encrypted Client Hello privacy leak in crypto/tls

FEDORA-2026-9b2e56edf5 Packages in this update:

• skopeo-1.22.2-2.fc44

Update description:

Security fix for CVE-2026-27145 (Go stdlib crypto/x509 DoS vulnerability). Rebuild with golang-1.26.5 which includes the fix.

FEDORA-2026-4d9a2870e5 Packages in this update:

• skopeo-1.22.2-2.fc43

Update description:

Security fix for CVE-2026-27145 (Go stdlib crypto/x509 DoS vulnerability). Rebuild with golang-1.25.12 which includes the fix.

FEDORA-2026-2b94d8d05c Packages in this update:

• kernel-7.1.4-204.fc44

Update description:

The 7.1.4-104/204 stable kennel updates contain a couple of security fixes for issues with exploits in the wild.

FEDORA-2026-6503a6a639 Packages in this update:

• kernel-7.1.4-104.fc43

Update description:

The 7.1.4-104/204 stable kennel updates contain a couple of security fixes for issues with exploits in the wild.

FEDORA-2026-68853bb50c Packages in this update:

• dokuwiki-20250514b-4.fc43

Update description:

Backport some security fixes

FEDORA-2026-d37b1b981a Packages in this update:

• dokuwiki-20250514b-6.fc44

Update description:

Backport some security fixes

FEDORA-2026-9af234bcd6 Packages in this update:

• nasm-2.16.03-5.fc43

Update description:

Fixes for CVE-2026-6067 and CVE-2026-6068.

FEDORA-2026-fa34dc95e6 Packages in this update:

• bpfman-0.5.4-13.fc45

Update description:

Automatic update for bpfman-0.5.4-13.fc45.

Changelog * Wed Jul 22 2026 Daniel Mellado <dmellado@fedoraproject.org> - 0.5.4-13 - Bump vendored openssl to 0.10.78 / openssl-sys to 0.9.117 for OpenSSL 4.0 support * Wed Jul 15 2026 Fedora Release Engineering <releng@fedoraproject.org> - 0.5.4-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild * Fri Jun 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 0.5.4-11 - Rebuilt for openssl 4.0 * Tue Apr 28 2026 Mario Fernandez <mariofer@redhat.com> - 0.5.4-10 - update sources and spec * Tue Apr 7 2026 Mario Fernandez <mariofer@redhat.com> - 0.5.4-9 - add source vendor * Tue Apr 7 2026 Mario Fernandez <mariofer@redhat.com> - 0.5.4-8 - Fix CVE-2026-25727: Bump time to 0.3.47 - closes rhbz#2438107

FEDORA-2026-30e8e9a2b2 Packages in this update:

• lego-5.3.1-2.fc44

Update description:

Update to 5.3.1

FEDORA-2026-256592dfe7 Packages in this update:

• lego-5.3.1-2.fc43

Update description:

Update to 5.3.1