Fedora Security Advisories

mstflint-4.37.0_1.1-4.fc43

Fedora Security Advisories
2 hours 22 minutes ago
FEDORA-2026-8c39ba6bab Packages in this update:
  • mstflint-4.37.0_1.1-4.fc43
Update description:

mstfwmanager now verifies TLS peers of www.mellanox.com against the system CA trust store (libcurl's default) instead of the private, stale Mozilla root store copy shipped in /etc/mstflint/ca-bundle.crt — a July 2021 snapshot that still trusted roots removed or distrusted since, including those involved in the eMudhra intermediate CA compromise. The private bundle file is no longer shipped; --ssl-certificate still works for passing a custom CA bundle.

Backport of https://github.com/Mellanox/mstflint/pull/2090

mstflint-4.37.0_1.1-4.fc44

Fedora Security Advisories
2 hours 49 minutes ago
FEDORA-2026-7092a043be Packages in this update:
  • mstflint-4.37.0_1.1-4.fc44
Update description:

mstfwmanager now verifies TLS peers of www.mellanox.com against the system CA trust store (libcurl's default) instead of the private, stale Mozilla root store copy shipped in /etc/mstflint/ca-bundle.crt — a July 2021 snapshot that still trusted roots removed or distrusted since, including those involved in the eMudhra intermediate CA compromise. The private bundle file is no longer shipped; --ssl-certificate still works for passing a custom CA bundle.

Backport of https://github.com/Mellanox/mstflint/pull/2090

mstflint-4.37.0_1.1-4.fc45

Fedora Security Advisories
2 hours 49 minutes ago
FEDORA-2026-015536827f Packages in this update:
  • mstflint-4.37.0_1.1-4.fc45
Update description:

mstfwmanager now verifies TLS peers of www.mellanox.com against the system CA trust store (libcurl's default) instead of the private, stale Mozilla root store copy shipped in /etc/mstflint/ca-bundle.crt — a July 2021 snapshot that still trusted roots removed or distrusted since, including those involved in the eMudhra intermediate CA compromise. The private bundle file is no longer shipped; --ssl-certificate still works for passing a custom CA bundle.

Backport of https://github.com/Mellanox/mstflint/pull/2090

rabbitmq-server-4.0.9-6.fc43

Fedora Security Advisories
3 hours 44 minutes ago
FEDORA-2026-baae3b217a Packages in this update:
  • rabbitmq-server-4.0.9-6.fc43
Update description:

Security update: backport upstream RabbitMQ security fixes to 4.0.9.

  • CVE-2026-67409: JWKS signing keys are now only replaced from a successful (HTTP 200), well-formed response, so an error reply from the OAuth 2 provider can no longer wipe the cached keys and deny all OAuth 2 logins.
  • CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
  • CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.
  • CVE-2026-67420: user tags are rebuilt on OAuth 2 credential refresh, so a revoked impersonator tag no longer survives on an existing connection.

rabbitmq-server-4.2.9-4.fc44

Fedora Security Advisories
4 hours 57 minutes ago
FEDORA-2026-bfe9cc4c24 Packages in this update:
  • rabbitmq-server-4.2.9-4.fc44
Update description:

Security update: backport upstream RabbitMQ security fixes to 4.2.9.

  • CVE-2026-67414: an authenticated AMQP 1.0 client could exhaust broker memory with arrays of zero-width elements; such arrays are now kept as opaque values.
  • CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
  • CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.

Also includes the CVE-2026-67420 fix from 4.2.9-3 (stale impersonator tag kept after OAuth token refresh). CVE-2026-67409 and CVE-2026-67410 are fixed upstream in 4.2.9.

Fix for CVE-2026-67420 (RabbitMQ: unauthorized user impersonation via stale OAuth token refresh). On a JWT/OAuth token refresh, rabbit_access_control:update_state/2 discarded the refreshed user tags, so a revoked 'impersonator' tag could survive on an existing connection. Backported from upstream v4.3.x (commit 5de287d).

chromium-156.0.8078.79-1.fc43

Fedora Security Advisories
5 hours 52 minutes ago
FEDORA-2026-0168c5c231 Packages in this update:
  • chromium-156.0.8078.79-1.fc43
Update description:

Update to 156.0.8078.73, include 21 security fixes

* CVE-2026-119260: Use after free in Frames * CVE-2026-119261: Improper input validation in Skia * CVE-2026-119262: Improper input validation in V8 * CVE-2026-119263: Memory corruption in GarbageCollection * CVE-2026-119264: Memory corruption in Dawn * CVE-2026-119265: Memory corruption in Quota * CVE-2026-119266: Use after free in Quota * CVE-2026-119267: Memory corruption in DOM * CVE-2026-119268: Integer overflow in Editing * CVE-2026-119269: Use after free in Blink * CVE-2026-119270: Improper input validation in CacheStorage * CVE-2026-119271: Use after free in Skia * CVE-2026-119272: Out of bounds read in FileSystem * CVE-2026-76024: Memory corruption in MediaStream * CVE-2026-76025: Use after free in FileSystem * CVE-2026-76026: Memory corruption in Autofill * CVE-2026-76027: Memory corruption in CacheStorage * CVE-2026-76028: Use after free in FileSystem * CVE-2026-76029: Memory corruption in Network * CVE-2026-76030: Memory corruption in FileSystem * CVE-2026-76031: Use after free in Input

chromium-156.0.8078.79-1.fc45

Fedora Security Advisories
5 hours 52 minutes ago
FEDORA-2026-253271f6fe Packages in this update:
  • chromium-156.0.8078.79-1.fc45
Update description:

Update to 156.0.8078.73, include 21 security fixes

* CVE-2026-119260: Use after free in Frames * CVE-2026-119261: Improper input validation in Skia * CVE-2026-119262: Improper input validation in V8 * CVE-2026-119263: Memory corruption in GarbageCollection * CVE-2026-119264: Memory corruption in Dawn * CVE-2026-119265: Memory corruption in Quota * CVE-2026-119266: Use after free in Quota * CVE-2026-119267: Memory corruption in DOM * CVE-2026-119268: Integer overflow in Editing * CVE-2026-119269: Use after free in Blink * CVE-2026-119270: Improper input validation in CacheStorage * CVE-2026-119271: Use after free in Skia * CVE-2026-119272: Out of bounds read in FileSystem * CVE-2026-76024: Memory corruption in MediaStream * CVE-2026-76025: Use after free in FileSystem * CVE-2026-76026: Memory corruption in Autofill * CVE-2026-76027: Memory corruption in CacheStorage * CVE-2026-76028: Use after free in FileSystem * CVE-2026-76029: Memory corruption in Network * CVE-2026-76030: Memory corruption in FileSystem * CVE-2026-76031: Use after free in Input
Checked
10 minutes 54 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security