Release of stargz snapshotter v0.19.0, containing fixes for CVE-2026-71482 and CVE-2026-77395. Release note is available on https://github.com/containerd/stargz-snapshotter/releases/tag/v0.19.0
Rebuilt several packages with faster-hex version 0.10.1 to fix RUSTSEC-2026-0306, an unsoundness issue on x86 and x86_64 when AVX2 is enabled.
Update to 1.1.8, including fixes for CVE-2026-111136 and for a memory leak.
Update to 1.1.8, including fixes for CVE-2026-111136 and for a memory leak.
Apply a proposed fix for CVE-2026-111136
Update to haveged 1.9.27
Update to 1.9.26. Fixes two regressions introduced in 1.9.24:
Fix 100% CPU spin when --no-command is used (BZ#2492029): socket_fd was uninitialized (defaulting to 0), causing the daemon loop to call accept4() on stdin in a tight loop.
Fix initramfs switch-root failure caused by --no-command (BZ#2491739): add a separate haveged-initramfs.service for use inside the initramfs, so the switch-root mechanism works. Prevents emergency mode on systems where haveged was started but not enabled.
Update to 1.9.25 — fix initramfs switch-root failure (BZ#2491739).
The v1.9.24 haveged.service with --no-command broke the initramfs switch-root handoff, causing emergency mode on systems where haveged was started but not enabled. Fix: add a separate haveged-initramfs.service for use inside the initramfs.
Update to 1.9.24. Disable command mode in long-running service (--no-command flag). Enable PrivateNetwork=true in systemd service. Remove SELinux policy module (no longer needed without command mode).
Fix rpminspect.yaml: use annocheck failure_severity instead of inspections toggle (annocheck is a security inspection and cannot be disabled via inspections section)
Update to 1.9.23-2: - Add SELinux policy module to allow semaphore creation in /dev/shm - Add rpminspect.yaml to waive pre-existing annocheck false positive
Security fixes in 1.9.23-1: - Use O_EXCL with sem_open to prevent semaphore pre-planting attacks - Fix OOB memory access in safein()/safeout() on socket errors - Reject command socket connections from different user namespaces - Use O_NOFOLLOW for PID file to prevent symlink attacks - Open random device with O_CLOEXEC, restrict semaphore to 0600 - Fix stale semaphore recovery after SIGKILL - Fix compilation when NO_COMMAND_MODE is defined
Update to 1.9.23 — security hardening: - Use O_EXCL with sem_open to prevent semaphore pre-planting attacks - Fix OOB memory access in safein()/safeout() on socket errors - Reject command socket connections from different user namespaces - Use O_NOFOLLOW for PID file to prevent symlink attacks - Open random device with O_CLOEXEC, restrict semaphore to 0600 - Fix stale semaphore recovery after SIGKILL - Fix compilation when NO_COMMAND_MODE is defined
Validate the file table against the header size
Validate the file table against the header size
Validate the file table against the header size
Backport fixes for CVE-2026-19967, CVE-2026-19969
Backport fixes for CVE-2026-19967, CVE-2026-19969
Update to python-3.11.17.
Update to python-3.11.17.