Fedora Security Advisories

• ceph-19.2.6-1.fc43

• CVE-2025-30156 is an authentication bypass in CephX caused by misuse of AES-CBC.

  https://docs.ceph.com/en/latest/security/CVE-2025-30156

• CVE-2026-39944 shares the unauthenticated-encryption root cause of CVE-2025-30156

  https://docs.ceph.com/en/latest/security/CVE-2026-39944

• CVE-2026-50152 is an improper authorization flaw in the Ceph Monitor subscription handler.

  https://docs.ceph.com/en/latest/security/CVE-2026-50152

• CVE-2026-54330 is a flaw in RGW not properly verifying its SigV4 cryptographic signatures in RGW's SigV4 verifier.

  https://docs.ceph.com/en/latest/security/CVE-2026-54330

• java-21-openjdk-21.0.12.1.1-1.0.fc43
• java-21-openjdk-portable-21.0.12.1.1-1.0.fc43

First monthly cadence release candidate

• bluez-5.87-4.fc43

An out-of-bounds read flaw was found in BlueZ in the AVRCP profile implementation. The vulnerability exists in the parse_media_element() and parse_media_folder() functions in profiles/audio/avrcp.c, where insufficient validation of packet length fields in GetFolderItems responses allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This can result in a crash of the bluetoothd daemon (denial of service) and potentially expose sensitive heap memory contents.

This update fixes this issue (CVE-2026-75032)

• bluez-5.87-4.fc44

An out-of-bounds read flaw was found in BlueZ in the AVRCP profile implementation. The vulnerability exists in the parse_media_element() and parse_media_folder() functions in profiles/audio/avrcp.c, where insufficient validation of packet length fields in GetFolderItems responses allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This can result in a crash of the bluetoothd daemon (denial of service) and potentially expose sensitive heap memory contents.

This update fixes this issue (CVE-2026-75032)

• postgresql16-anonymizer-3.1.3-1.fc44

Update to 3.1.3

• openssh-10.2p1-14.fc44

Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded

• openssh-10.0p1-12.fc43

Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded

• opkssh-0.16.0-2.el10_3

Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing via chi's RealIP middleware).

opkssh bundles only chi's root router package and never the affected middleware package, so the vulnerable code was not actually shipped in any opkssh build.

• opkssh-0.16.0-2.el10_2

Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing via chi's RealIP middleware).

opkssh bundles only chi's root router package and never the affected middleware package, so the vulnerable code was not actually shipped in any opkssh build.

• opkssh-0.16.0-2.fc43

Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing via chi's RealIP middleware).

opkssh bundles only chi's root router package and never the affected middleware package, so the vulnerable code was not actually shipped in any opkssh build.

• opkssh-0.16.0-2.fc44

Update the bundled github.com/go-chi/chi/v5 to v5.3.1, which is outside the range affected by CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing via chi's RealIP middleware).

opkssh bundles only chi's root router package and never the affected middleware package, so the vulnerable code was not actually shipped in any opkssh build.

• firefox-154.0-3.fc44

Implement buffer stride support for PipeWire camera.

• Update to latest upstream (154.0)
• Enabled Wayland session restore on KDE.

• openbao-2.6.2-1.el8

Update to upstream 2.6.2, including security fixes for GHSA-rh46-vc3j-w2w3 and GHSA-g892-p242-8g86.

• openbao-2.6.2-1.el10_3

Update to upstream 2.6.2, including security fixes for GHSA-rh46-vc3j-w2w3 and GHSA-g892-p242-8g86.

• openbao-2.6.2-1.fc44

Update to upstream 2.6.2, including security fixes for GHSA-rh46-vc3j-w2w3 and GHSA-g892-p242-8g86.

• openbao-2.6.2-1.el10_2

Update to upstream 2.6.2, including security fixes for GHSA-rh46-vc3j-w2w3 and GHSA-g892-p242-8g86.

• openbao-2.6.2-1.fc43

Update to upstream 2.6.2, including security fixes for GHSA-rh46-vc3j-w2w3 and GHSA-g892-p242-8g86.

• openbao-2.6.2-1.el9

Update to upstream 2.6.2, including security fixes for GHSA-rh46-vc3j-w2w3 and GHSA-g892-p242-8g86.

• knot-3.4.11-1.fc43

New upstream release with security fixes.

• knot-3.5.7-1.fc44

New upstream release with security fixes.