Fedora Security Advisories

• perl-Dancer2-1.1.2-4.fc43

Dancer2 générates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there.

• perl-Dancer2-2.0.1-4.fc44

Dancer2 générates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there.

• perl-Dancer2-2.1.0-3.fc45

Dancer2 générates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there.

• python-configargparse-1.7.6-1.el10_4

Update to 1.7.6

Security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

• python-configargparse-1.7.6-1.fc43

Update to 1.7.6

Security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

• python-configargparse-1.7.6-1.fc44

Update to 1.7.6

Security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

• python-configargparse-1.7.6-1.fc45

Update to 1.7.6

Security fix for GHSA-6m27-337c-jcgf. Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values.

• rust-lru0.16-0.16.4-1.el9
• rust-lru-0.18.4-1.el9

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• rust-lru0.16-0.16.4-1.el10_4
• rust-lru-0.18.4-1.el10_4

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• rust-lru0.16-0.16.4-1.fc43
• rust-lru-0.18.4-1.fc43

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• rust-lru0.16-0.16.4-1.fc44
• rust-lru-0.18.4-1.fc44

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• rust-lru0.16-0.16.4-1.fc45
• rust-lru-0.18.4-1.fc45

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• rust-lru0.16-0.16.4-1.fc46
• rust-lru-0.18.4-1.fc46

Update lru crate to version 0.18.4 and add a compat package for version 0.16.

This fixes an obscure potential use-after-free issue: https://rustsec.org/advisories/RUSTSEC-2026-0253.html

Rebuild tracker: https://forge.fedoraproject.org/rust/backlog/issues/39

• perl-Data-Entropy-0.010-1.fc44

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. This update fixes that issue (CVE-2026-18536).

• perl-Data-Entropy-0.010-1.fc43

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. This update fixes that issue (CVE-2026-18536).

• perl-Data-Entropy-0.010-1.fc45

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. This update fixes that issue (CVE-2026-18536).

• perl-HTML-FormHandler-0.410001-1.fc45

HTML::FormHandler versions through 0.40068 allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.

Versions 0.410000+ fix the issue by passing error messages with request data as Locale::Maketext arguments instead of templates.

• perl-HTML-FormHandler-0.410001-1.fc43

HTML::FormHandler versions through 0.40068 allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.

Versions 0.410000+ fix the issue by passing error messages with request data as Locale::Maketext arguments instead of templates.

• perl-HTML-FormHandler-0.410001-1.fc44

HTML::FormHandler versions through 0.40068 allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.

Versions 0.410000+ fix the issue by passing error messages with request data as Locale::Maketext arguments instead of templates.

• podman-tui-2.0.0-1.el10_4

release v2.0.0