Fedora Security Advisories

• tor-0.4.9.15-1.el10_4

Update to latest upstream release

• tor-0.4.9.15-1.fc45

Update to latest upstream release

• tor-0.4.9.15-1.fc44

Update to latest upstream release

• tor-0.4.9.15-1.fc43

Update to latest upstream release

• libreswan-5.4.1-4.fc45

Fix automated passwordless "ipsec import" support for PKCS12 files

Fixes CVE-2026-77205, CVE-2026-77206, CVE-2026-77207 and CVE-2026-94453

• openjpeg-2.5.4-5.fc45

Apply proposed fix for #2552420.

• openjpeg-2.5.4-5.fc44

Apply proposed fix for #2552420.

• python-pillow-12.3.0-6.fc45

Backport fix for CVE-2026-112398

Backport fix for CVE-2026-112393.

Backport fix for CVE-2026-112892.

• python-pillow-12.3.0-6.fc44

Backport fix for CVE-2026-112398

Backport fix for CVE-2026-112393.

• hatch-1.15.1-8.el10_3

Backport updated Python distributions from Hatch 1.18.2

The latest managed CPython interpreters for Python 3.11 and later should now distrust the compromised eMudhra/emSign intermediate CA certificates, as described in the release notes for uv 0.13.5. Both hatch and uv use python-build-standalone for their managed Python interpreters.

• ignition-2.28.0-2.fc43

Rebuild against the patched Go toolchain (golang 1.26.10) to pick up the fix for CVE-2026-111943. Go's crypto/x509 now rejects certificate chains that use any of eight compromised eMudhra intermediate CA public keys. There are no source changes to ignition itself -- this rebuild simply links the fixed standard library into the binary.

Update to Ignition 2.28.0, including Butane OpenShift 5.0 support. See https://github.com/coreos/ignition/issues/2336.

• ignition-2.28.0-2.fc44

Rebuild against the patched Go toolchain (golang 1.26.10) to pick up the fix for CVE-2026-111943. Go's crypto/x509 now rejects certificate chains that use any of eight compromised eMudhra intermediate CA public keys. There are no source changes to ignition itself -- this rebuild simply links the fixed standard library into the binary.

Update to Ignition 2.28.0, including Butane OpenShift 5.0 support. See https://github.com/coreos/ignition/issues/2336.

• perl-Plack-1.0057-1.el10_3

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.

• perl-Plack-1.0057-1.el9

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.

• perl-Plack-1.0057-1.el10_4

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.

• perl-Plack-1.0057-1.el10_2

HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.

• webkitgtk-2.54.2-3.el10_3

Update WebKitGTK to version 2.54.2.

This brings a plethora of fixes for security issues since the last build (2.48.3) that was available for EPEL 10 (including ~300 issues with assigned CVEs), published in the following WebKit security advisories:

• https://webkitgtk.org/security/WSA-2026-0001.html
• https://webkitgtk.org/security/WSA-2026-0002.html
• https://webkitgtk.org/security/WSA-2026-0003.html
• https://webkitgtk.org/security/WSA-2026-0004.html
• https://webkitgtk.org/security/WSA-2026-0005.html
• https://webkitgtk.org/security/WSA-2026-0006.html

Release notes for versions since 2.48.3 leading up to 2.54.2:

• https://webkitgtk.org/2025/07/30/webkitgtk2.48.4-released.html
• https://webkitgtk.org/2025/08/01/webkitgtk2.48.5-released.html
• https://webkitgtk.org/2025/09/03/webkitgtk2.48.6-released.html
• https://webkitgtk.org/2025/09/24/webkitgtk2.48.7-released.html
• https://webkitgtk.org/2025/09/17/webkitgtk2.50.0-released.html
• https://webkitgtk.org/2025/10/10/webkitgtk2.50.1-released.html
• https://webkitgtk.org/2025/11/19/webkitgtk2.50.2-released.html
• https://webkitgtk.org/2025/12/04/webkitgtk2.50.3-released.html
• https://webkitgtk.org/2025/12/16/webkitgtk2.50.4-released.html
• https://webkitgtk.org/2026/02/09/webkitgtk2.50.5-released.html
• https://webkitgtk.org/2026/03/12/webkitgtk2.50.6-released.html
• https://webkitgtk.org/2026/03/18/webkitgtk2.52.0-released.html
• https://webkitgtk.org/2026/03/27/webkitgtk2.52.1-released.html
• https://webkitgtk.org/2026/04/13/webkitgtk2.52.2-released.html
• https://webkitgtk.org/2026/04/16/webkitgtk2.52.3-released.html
• https://webkitgtk.org/2026/06/02/webkitgtk2.52.4-released.html
• https://webkitgtk.org/2026/07/09/webkitgtk2.52.5-released.html
• https://webkitgtk.org/2026/08/19/webkitgtk2.52.6-released.html
• https://webkitgtk.org/2026/09/16/webkitgtk2.54.0-released.html
• https://webkitgtk.org/2026/10/02/webkitgtk2.54.1-released.html
• https://webkitgtk.org/2026/10/23/webkitgtk2.54.2-released.html

• webkitgtk-2.54.2-3.el10_4

Update WebKitGTK to version 2.54.2.

This brings a plethora of fixes for security issues since the last build (2.48.3) that was available for EPEL 10 (including ~300 issues with assigned CVEs), published in the following WebKit security advisories:

• https://webkitgtk.org/security/WSA-2026-0001.html
• https://webkitgtk.org/security/WSA-2026-0002.html
• https://webkitgtk.org/security/WSA-2026-0003.html
• https://webkitgtk.org/security/WSA-2026-0004.html
• https://webkitgtk.org/security/WSA-2026-0005.html
• https://webkitgtk.org/security/WSA-2026-0006.html

Release notes for versions since 2.48.3 leading up to 2.54.2:

• https://webkitgtk.org/2025/07/30/webkitgtk2.48.4-released.html
• https://webkitgtk.org/2025/08/01/webkitgtk2.48.5-released.html
• https://webkitgtk.org/2025/09/03/webkitgtk2.48.6-released.html
• https://webkitgtk.org/2025/09/24/webkitgtk2.48.7-released.html
• https://webkitgtk.org/2025/09/17/webkitgtk2.50.0-released.html
• https://webkitgtk.org/2025/10/10/webkitgtk2.50.1-released.html
• https://webkitgtk.org/2025/11/19/webkitgtk2.50.2-released.html
• https://webkitgtk.org/2025/12/04/webkitgtk2.50.3-released.html
• https://webkitgtk.org/2025/12/16/webkitgtk2.50.4-released.html
• https://webkitgtk.org/2026/02/09/webkitgtk2.50.5-released.html
• https://webkitgtk.org/2026/03/12/webkitgtk2.50.6-released.html
• https://webkitgtk.org/2026/03/18/webkitgtk2.52.0-released.html
• https://webkitgtk.org/2026/03/27/webkitgtk2.52.1-released.html
• https://webkitgtk.org/2026/04/13/webkitgtk2.52.2-released.html
• https://webkitgtk.org/2026/04/16/webkitgtk2.52.3-released.html
• https://webkitgtk.org/2026/06/02/webkitgtk2.52.4-released.html
• https://webkitgtk.org/2026/07/09/webkitgtk2.52.5-released.html
• https://webkitgtk.org/2026/08/19/webkitgtk2.52.6-released.html
• https://webkitgtk.org/2026/09/16/webkitgtk2.54.0-released.html
• https://webkitgtk.org/2026/10/02/webkitgtk2.54.1-released.html
• https://webkitgtk.org/2026/10/23/webkitgtk2.54.2-released.html

• hatch-1.15.1-8.el10_4

Backport updated Python distributions from Hatch 1.18.2

The latest managed CPython interpreters for Python 3.11 and later should now distrust the compromised eMudhra/emSign intermediate CA certificates, as described in the release notes for uv 0.13.5. Both hatch and uv use python-build-standalone for their managed Python interpreters.

• zvbi-0.2.46-1.fc44

Update to 0.2.46

Fixes CVE-2026-110654