Fedora Security Advisories

• proftpd-1.3.9e-3.el10_2

This update fixes a couple of issues in mod_copy, which is not enabled by default.

• <Limit READ> configurations were not honored by SITE COPY as they should be
• Fix write restriction bypass via symlink following in mod_copy (CVE-2026-119364)

• proftpd-1.3.9e-3.el10_4

This update fixes a couple of issues in mod_copy, which is not enabled by default.

• <Limit READ> configurations were not honored by SITE COPY as they should be
• Fix write restriction bypass via symlink following in mod_copy (CVE-2026-119364)

• proftpd-1.3.9e-3.fc44

This update fixes a couple of issues in mod_copy, which is not enabled by default.

• <Limit READ> configurations were not honored by SITE COPY as they should be
• Fix write restriction bypass via symlink following in mod_copy (CVE-2026-119364)

• proftpd-1.3.9e-3.el10_3

This update fixes a couple of issues in mod_copy, which is not enabled by default.

• <Limit READ> configurations were not honored by SITE COPY as they should be
• Fix write restriction bypass via symlink following in mod_copy (CVE-2026-119364)

• proftpd-1.3.9e-3.fc43

This update fixes a couple of issues in mod_copy, which is not enabled by default.

• <Limit READ> configurations were not honored by SITE COPY as they should be
• Fix write restriction bypass via symlink following in mod_copy (CVE-2026-119364)

• proftpd-1.3.9e-3.fc45

This update fixes a couple of issues in mod_copy, which is not enabled by default.

• <Limit READ> configurations were not honored by SITE COPY as they should be
• Fix write restriction bypass via symlink following in mod_copy (CVE-2026-119364)

• rsync-3.5.2-1.fc45

New version 3.5.2, includes the fix for CVE-2026-119741

• rsync-3.5.2-1.fc44

New version 3.5.2, includes the fix for CVE-2026-119741

• rsync-3.5.2-1.fc43

New version 3.5.2, includes the fix for CVE-2026-119741

• dnf5-5.2.18.0-6.fc43

This release fixes CVE-2026-111253 (dnf5daemon-server: missing session-owner check allows foreign D-Bus callers to replace another client's resolved transaction)

• python-h5io-0.2.6-2.fc43

Update to 0.2.6 upstream release

This release fixes GHSA-vwvw-f6v4-w737 / CVE-2026-120499: read_hdf5 could execute arbitrary code when reading a crafted HDF5 file.

As part of the fix, loading files containing classes, objects written with use_state=True, or pandas DataFrame/Series objects is disabled by default and will now raise a ValueError; see the release notes for details.

• python-h5io-0.2.6-2.fc44

Update to 0.2.6 upstream release

This release fixes GHSA-vwvw-f6v4-w737 / CVE-2026-120499: read_hdf5 could execute arbitrary code when reading a crafted HDF5 file.

As part of the fix, loading files containing classes, objects written with use_state=True, or pandas DataFrame/Series objects is disabled by default and will now raise a ValueError; see the release notes for details.

• python-h5io-0.2.6-2.fc45

Update to 0.2.6 upstream release

This release fixes GHSA-vwvw-f6v4-w737 / CVE-2026-120499: read_hdf5 could execute arbitrary code when reading a crafted HDF5 file.

As part of the fix, loading files containing classes, objects written with use_state=True, or pandas DataFrame/Series objects is disabled by default and will now raise a ValueError; see the release notes for details.

• hugo-0.165.0-1.fc44

Update to Hugo 0.165.0, which includes security fixes for several CVEs.

This release fixes CVE-2026-75926 (Tailwind CSS Node permission model bypass) and CVE-2026-89258 (symlink confinement bypass), as well as earlier escaping and sandbox issues fixed upstream.

Fedora 44 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release that can be built for this Fedora release.

The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.

Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0

• hugo-0.165.0-1.fc43

Update to Hugo 0.165.0.

Fedora 43 provides Go 1.26, and Hugo 0.166.0 and later require Go 1.27.0, so 0.165.0 is the newest release that can be built for this Fedora release. This update therefore skips 0.167.0 and 0.168.0, neither of which was published for Fedora 43. It is intended to be the final Hugo update for Fedora 43.

The extended edition is built with bundled LibSass, so the package does not depend on a system libsass.

Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0

• hugo-0.169.0-2.fc45

Update to Hugo 0.169.0, which includes a security fix.

Menu pre and post values defined in front matter are no longer rendered as unescaped HTML. Because front matter is untrusted content, a content contributor could previously inject arbitrary HTML, including script, into pages that render menu entries. These values are now HTML escaped unless text/html is allowed in security.allowContent, and a warning-menu-pre-post-html-escaped warning is logged when markup is escaped. Menu entries defined in the site configuration are not affected.

This update also requires Go 1.27.0 and continues to build the extended edition with bundled LibSass, so the package does not depend on a system libsass.

Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.169.0

• mysql9.7-9.7.4-3.fc44

MySQL 9.7.4

• mysql9.7-9.7.4-3.fc43

MySQL 9.7.4

• python-joserfc-1.7.7-1.fc44

Update to 1.7.7 (rhbz#2567025)

• xen-4.20.4-5.fc43

arbitrary read/write via grant copy [XSA-523, CVE-2026-102703, CVE-2026-102704]

wrong version of xsa518 patch in last build x86/AMD: ineffectual Zenbleed workaround [XSA-515, CVE-2026-79608] x86: XPTI may break on huge-memory systems [XSA-516, CVE-2026-79609] grant-table: double version change race [XSA-517, CVE-2026-79610] VMX: VMentry failure with branch tracing and blocked states [XSA-518, CVE-2026-79611] Arm: multiple issues with GNTTABOP_cache_flush [XSA-519, CVE-2026-102699, CVE-2026-102702] gnttab: cache-flush handling may cause page reference leak [XSA-520, CVE-2026-102700]