Fedora Security Advisories

• tor-0.4.9.15-1.el9

Update to latest upstream release

• epiphany-50.6-5.fc44

Fix CVE-2026-118598 and CVE-2026-118599

Fix for CVE-2026-18487 and CVE-2026-94291

• epiphany-51.1-4.fc45

Fix CVE-2026-118598 and CVE-2026-118599

• epiphany-49.9.1-5.fc43

Fix CVE-2026-118598 and CVE-2026-118599

Fix for CVE-2026-18487 and CVE-2026-94291

• tor-0.4.9.15-1.el10_4

Update to latest upstream release

• tor-0.4.9.15-1.fc45

Update to latest upstream release

• tor-0.4.9.15-1.fc44

Update to latest upstream release

• tor-0.4.9.15-1.fc43

Update to latest upstream release

• libreswan-5.4.1-4.fc45

Fix automated passwordless "ipsec import" support for PKCS12 files

Fixes CVE-2026-77205, CVE-2026-77206, CVE-2026-77207 and CVE-2026-94453

• openjpeg-2.5.4-5.fc45

Apply proposed fix for #2552420.

• openjpeg-2.5.4-5.fc44

Apply proposed fix for #2552420.

• python-pillow-12.3.0-6.fc45

Backport fix for CVE-2026-112398

Backport fix for CVE-2026-112393.

Backport fix for CVE-2026-112892.

• python-pillow-12.3.0-6.fc44

Backport fix for CVE-2026-112398

Backport fix for CVE-2026-112393.

• hatch-1.15.1-8.el10_3

Backport updated Python distributions from Hatch 1.18.2

The latest managed CPython interpreters for Python 3.11 and later should now distrust the compromised eMudhra/emSign intermediate CA certificates, as described in the release notes for uv 0.13.5. Both hatch and uv use python-build-standalone for their managed Python interpreters.

• ignition-2.28.0-2.fc43

Rebuild against the patched Go toolchain (golang 1.26.10) to pick up the fix for CVE-2026-111943. Go's crypto/x509 now rejects certificate chains that use any of eight compromised eMudhra intermediate CA public keys. There are no source changes to ignition itself -- this rebuild simply links the fixed standard library into the binary.

Update to Ignition 2.28.0, including Butane OpenShift 5.0 support. See https://github.com/coreos/ignition/issues/2336.

• ignition-2.28.0-2.fc44

Rebuild against the patched Go toolchain (golang 1.26.10) to pick up the fix for CVE-2026-111943. Go's crypto/x509 now rejects certificate chains that use any of eight compromised eMudhra intermediate CA public keys. There are no source changes to ignition itself -- this rebuild simply links the fixed standard library into the binary.

Update to Ignition 2.28.0, including Butane OpenShift 5.0 support. See https://github.com/coreos/ignition/issues/2336.

• perl-Plack-1.0057-1.el10_3

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.

• perl-Plack-1.0057-1.el9

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.

• perl-Plack-1.0057-1.el10_4

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.

• perl-Plack-1.0057-1.el10_2

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.