Fedora Security Advisories

composer-2.11.2-1.el10_3

Fedora Security Advisories
1 day 15 hours ago
FEDORA-EPEL-2026-d02b793e7f Packages in this update:
  • composer-2.11.2-1.el10_3
Update description: [2.11.2] 2026-11-11
  • Security: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm)
  • Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
  • Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
  • Security: Updated the bundled symfony/filesystem to a version fixing a disclosed vulnerability present in the one shipped with 2.11.1 (GHSA-6prc-h956-hxjq)
  • Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13253)
  • Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13208)
  • Security: Fixed IPs blocked by the prevent_ip_access_callable transport option only being rejected after the request had been sent, and rejected in-flight downloads not being stopped (#13255)
  • Added exclude-branches option to VCS repositories to skip branches matching the given patterns, e.g. bot-managed ones (#13235)
  • Added support for setting allow-git-fallback to false in GitLab, Bitbucket and Forgejo repositories to fail on API errors instead of falling back to a git clone (#13234)
  • Added a 30 seconds stall timeout so downloads from a server which accepts the connection but never responds are aborted and retried instead of hanging for 300 seconds, configurable or disabled via the COMPOSER_HTTP_STALL_TIMEOUT env var (#13243)
  • Improved performance of security advisory lookups by querying the API only once per package name (#13202)
  • Improved performance of VCS repository updates by skipping the default branch lookup when the git mirror is up to date (#13224)
  • Improved performance and memory usage of dependency resolution, package loading and sorting, and repository traversal (#13187, #13188, #13194, #13197, #13200, #13211, #13217, #13218)
  • Improved performance with micro-optimizations in path and URL handling, lock file and installed.php generation, archiving and TLS/HTTP helpers (#13189, #13190, #13191, #13192, #13193, #13195, #13196, #13198, #13214, #13215, #13216, #13220, #13222)
  • Fixed config failing with a schema error or corrupting composer.json by turning nested {} into [] when adding or removing dotted sub-keys (#13210)
  • Fixed config --unset, remove and require leaving in place or duplicating composer.json keys which are set to null (#13225)
  • Fixed dist URLs of codeberg.org packages and bitbucket zip archives not being updated when requiring a specific commit with dev-branch#hash (#13242)
  • Fixed an undefined array key warning hiding the real error when curl 8.23+ fails to parse a URL (#13252)

composer-2.11.2-1.fc45

Fedora Security Advisories
1 day 15 hours ago
FEDORA-2026-479af584c3 Packages in this update:
  • composer-2.11.2-1.fc45
Update description: [2.11.2] 2026-11-11
  • Security: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm)
  • Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
  • Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
  • Security: Updated the bundled symfony/filesystem to a version fixing a disclosed vulnerability present in the one shipped with 2.11.1 (GHSA-6prc-h956-hxjq)
  • Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13253)
  • Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13208)
  • Security: Fixed IPs blocked by the prevent_ip_access_callable transport option only being rejected after the request had been sent, and rejected in-flight downloads not being stopped (#13255)
  • Added exclude-branches option to VCS repositories to skip branches matching the given patterns, e.g. bot-managed ones (#13235)
  • Added support for setting allow-git-fallback to false in GitLab, Bitbucket and Forgejo repositories to fail on API errors instead of falling back to a git clone (#13234)
  • Added a 30 seconds stall timeout so downloads from a server which accepts the connection but never responds are aborted and retried instead of hanging for 300 seconds, configurable or disabled via the COMPOSER_HTTP_STALL_TIMEOUT env var (#13243)
  • Improved performance of security advisory lookups by querying the API only once per package name (#13202)
  • Improved performance of VCS repository updates by skipping the default branch lookup when the git mirror is up to date (#13224)
  • Improved performance and memory usage of dependency resolution, package loading and sorting, and repository traversal (#13187, #13188, #13194, #13197, #13200, #13211, #13217, #13218)
  • Improved performance with micro-optimizations in path and URL handling, lock file and installed.php generation, archiving and TLS/HTTP helpers (#13189, #13190, #13191, #13192, #13193, #13195, #13196, #13198, #13214, #13215, #13216, #13220, #13222)
  • Fixed config failing with a schema error or corrupting composer.json by turning nested {} into [] when adding or removing dotted sub-keys (#13210)
  • Fixed config --unset, remove and require leaving in place or duplicating composer.json keys which are set to null (#13225)
  • Fixed dist URLs of codeberg.org packages and bitbucket zip archives not being updated when requiring a specific commit with dev-branch#hash (#13242)
  • Fixed an undefined array key warning hiding the real error when curl 8.23+ fails to parse a URL (#13252)

composer-2.11.2-1.el10_4

Fedora Security Advisories
1 day 15 hours ago
FEDORA-EPEL-2026-8d9e3a7486 Packages in this update:
  • composer-2.11.2-1.el10_4
Update description: [2.11.2] 2026-11-11
  • Security: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm)
  • Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
  • Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
  • Security: Updated the bundled symfony/filesystem to a version fixing a disclosed vulnerability present in the one shipped with 2.11.1 (GHSA-6prc-h956-hxjq)
  • Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13253)
  • Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13208)
  • Security: Fixed IPs blocked by the prevent_ip_access_callable transport option only being rejected after the request had been sent, and rejected in-flight downloads not being stopped (#13255)
  • Added exclude-branches option to VCS repositories to skip branches matching the given patterns, e.g. bot-managed ones (#13235)
  • Added support for setting allow-git-fallback to false in GitLab, Bitbucket and Forgejo repositories to fail on API errors instead of falling back to a git clone (#13234)
  • Added a 30 seconds stall timeout so downloads from a server which accepts the connection but never responds are aborted and retried instead of hanging for 300 seconds, configurable or disabled via the COMPOSER_HTTP_STALL_TIMEOUT env var (#13243)
  • Improved performance of security advisory lookups by querying the API only once per package name (#13202)
  • Improved performance of VCS repository updates by skipping the default branch lookup when the git mirror is up to date (#13224)
  • Improved performance and memory usage of dependency resolution, package loading and sorting, and repository traversal (#13187, #13188, #13194, #13197, #13200, #13211, #13217, #13218)
  • Improved performance with micro-optimizations in path and URL handling, lock file and installed.php generation, archiving and TLS/HTTP helpers (#13189, #13190, #13191, #13192, #13193, #13195, #13196, #13198, #13214, #13215, #13216, #13220, #13222)
  • Fixed config failing with a schema error or corrupting composer.json by turning nested {} into [] when adding or removing dotted sub-keys (#13210)
  • Fixed config --unset, remove and require leaving in place or duplicating composer.json keys which are set to null (#13225)
  • Fixed dist URLs of codeberg.org packages and bitbucket zip archives not being updated when requiring a specific commit with dev-branch#hash (#13242)
  • Fixed an undefined array key warning hiding the real error when curl 8.23+ fails to parse a URL (#13252)

composer-2.11.2-1.el9

Fedora Security Advisories
1 day 15 hours ago
FEDORA-EPEL-2026-308fca30bf Packages in this update:
  • composer-2.11.2-1.el9
Update description: [2.11.2] 2026-11-11
  • Security: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm)
  • Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
  • Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
  • Security: Updated the bundled symfony/filesystem to a version fixing a disclosed vulnerability present in the one shipped with 2.11.1 (GHSA-6prc-h956-hxjq)
  • Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13253)
  • Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13208)
  • Security: Fixed IPs blocked by the prevent_ip_access_callable transport option only being rejected after the request had been sent, and rejected in-flight downloads not being stopped (#13255)
  • Added exclude-branches option to VCS repositories to skip branches matching the given patterns, e.g. bot-managed ones (#13235)
  • Added support for setting allow-git-fallback to false in GitLab, Bitbucket and Forgejo repositories to fail on API errors instead of falling back to a git clone (#13234)
  • Added a 30 seconds stall timeout so downloads from a server which accepts the connection but never responds are aborted and retried instead of hanging for 300 seconds, configurable or disabled via the COMPOSER_HTTP_STALL_TIMEOUT env var (#13243)
  • Improved performance of security advisory lookups by querying the API only once per package name (#13202)
  • Improved performance of VCS repository updates by skipping the default branch lookup when the git mirror is up to date (#13224)
  • Improved performance and memory usage of dependency resolution, package loading and sorting, and repository traversal (#13187, #13188, #13194, #13197, #13200, #13211, #13217, #13218)
  • Improved performance with micro-optimizations in path and URL handling, lock file and installed.php generation, archiving and TLS/HTTP helpers (#13189, #13190, #13191, #13192, #13193, #13195, #13196, #13198, #13214, #13215, #13216, #13220, #13222)
  • Fixed config failing with a schema error or corrupting composer.json by turning nested {} into [] when adding or removing dotted sub-keys (#13210)
  • Fixed config --unset, remove and require leaving in place or duplicating composer.json keys which are set to null (#13225)
  • Fixed dist URLs of codeberg.org packages and bitbucket zip archives not being updated when requiring a specific commit with dev-branch#hash (#13242)
  • Fixed an undefined array key warning hiding the real error when curl 8.23+ fails to parse a URL (#13252)

composer-2.11.2-1.fc43

Fedora Security Advisories
1 day 15 hours ago
FEDORA-2026-36c0aba2e1 Packages in this update:
  • composer-2.11.2-1.fc43
Update description: [2.11.2] 2026-11-11
  • Security: Fixed arbitrary command execution via the prevent_url_access_callable transport option being loaded from composer.lock / vendor/composer/installed.json (GHSA-jhfp-4ppm-crmm)
  • Security: Fixed malicious zip archives being able to write files outside of the package directory via symlinked entries when extraction falls back from unzip to ZipArchive (GHSA-w6hj-6587-3jh5)
  • Security: Fixed inline repository HTTP credentials being sent to dist mirrors on other hosts supplied by a crafted composer.lock / vendor/composer/installed.json (GHSA-x82q-x274-r6pq)
  • Security: Updated the bundled symfony/filesystem to a version fixing a disclosed vulnerability present in the one shipped with 2.11.1 (GHSA-6prc-h956-hxjq)
  • Security: Fixed Authorization and Cookie headers set in request options, e.g. via a repository's http.header option, being resent when following a redirect to another origin (#13253)
  • Security: Fixed non-auth config settings being read from a project's auth.json and the COMPOSER_AUTH env var, and home being read from a project's composer.json, these are now ignored with a warning (#13208)
  • Security: Fixed IPs blocked by the prevent_ip_access_callable transport option only being rejected after the request had been sent, and rejected in-flight downloads not being stopped (#13255)
  • Added exclude-branches option to VCS repositories to skip branches matching the given patterns, e.g. bot-managed ones (#13235)
  • Added support for setting allow-git-fallback to false in GitLab, Bitbucket and Forgejo repositories to fail on API errors instead of falling back to a git clone (#13234)
  • Added a 30 seconds stall timeout so downloads from a server which accepts the connection but never responds are aborted and retried instead of hanging for 300 seconds, configurable or disabled via the COMPOSER_HTTP_STALL_TIMEOUT env var (#13243)
  • Improved performance of security advisory lookups by querying the API only once per package name (#13202)
  • Improved performance of VCS repository updates by skipping the default branch lookup when the git mirror is up to date (#13224)
  • Improved performance and memory usage of dependency resolution, package loading and sorting, and repository traversal (#13187, #13188, #13194, #13197, #13200, #13211, #13217, #13218)
  • Improved performance with micro-optimizations in path and URL handling, lock file and installed.php generation, archiving and TLS/HTTP helpers (#13189, #13190, #13191, #13192, #13193, #13195, #13196, #13198, #13214, #13215, #13216, #13220, #13222)
  • Fixed config failing with a schema error or corrupting composer.json by turning nested {} into [] when adding or removing dotted sub-keys (#13210)
  • Fixed config --unset, remove and require leaving in place or duplicating composer.json keys which are set to null (#13225)
  • Fixed dist URLs of codeberg.org packages and bitbucket zip archives not being updated when requiring a specific commit with dev-branch#hash (#13242)
  • Fixed an undefined array key warning hiding the real error when curl 8.23+ fails to parse a URL (#13252)

incron-0.5.12-31.fc46

Fedora Security Advisories
1 day 21 hours ago
FEDORA-2026-3f54d4b3cd Packages in this update:
  • incron-0.5.12-31.fc46
Update description:

Automatic update for incron-0.5.12-31.fc46.

Changelog * Tue Nov 10 2026 Kevin Fenzi <kevin@scrye.com> - 0.5.12-31 - Add Patch to stop non root users using their own config. Fixes rhbz#2568586

et-6.2.11-5.fc45

Fedora Security Advisories
2 days ago
FEDORA-2026-67db247b7f Packages in this update:
  • et-6.2.11-5.fc45
Update description:

Security fixes from et 7.1.x, backported to 6.2.11, and telemetry disabled.

Security fixes (backported from et 7.1.0 and 7.1.1, one commit per upstream fix; see https://github.com/MisterTea/EternalTerminal/issues/923):

  • Pre-authentication denial of service: stuck or silent peers, slow reconnects and accept() resource exhaustion could block or crash etserver for every user
  • etserver and the router no longer abort on malformed packets or registrations
  • Router session ownership is taken from the kernel's peer credentials, and both ends of the Unix HTM control socket are authenticated
  • etserver no longer does root file operations or connections on Unix socket paths chosen by the client

Telemetry disabled (CVE-2023-23558):

et is now built with telemetry disabled on all architectures. This removes the bundled sentry-native and its fixed paths in /tmp, and drops the libcurl dependency. The default /etc/et.cfg now says telemetry = false. An existing et.cfg that still says telemetry = true is harmless: the setting does nothing in this build.

Packaging: the bundled() Provides and License: now match the bundled libraries actually shipped.

Note: this update stays on 6.2.11, which keeps the 6.x command-line options. et 7.x changes several short options to match OpenSSH, so it is only in Rawhide.

et-6.2.11-5.fc44

Fedora Security Advisories
2 days ago
FEDORA-2026-8272c43689 Packages in this update:
  • et-6.2.11-5.fc44
Update description:

Security fixes from et 7.1.x, backported to 6.2.11, and telemetry disabled.

Security fixes (backported from et 7.1.0 and 7.1.1, one commit per upstream fix; see https://github.com/MisterTea/EternalTerminal/issues/923):

  • Pre-authentication denial of service: stuck or silent peers, slow reconnects and accept() resource exhaustion could block or crash etserver for every user
  • etserver and the router no longer abort on malformed packets or registrations
  • Router session ownership is taken from the kernel's peer credentials, and both ends of the Unix HTM control socket are authenticated
  • etserver no longer does root file operations or connections on Unix socket paths chosen by the client

Telemetry disabled (CVE-2023-23558):

et is now built with telemetry disabled on all architectures. This removes the bundled sentry-native and its fixed paths in /tmp, and drops the libcurl dependency. The default /etc/et.cfg now says telemetry = false. An existing et.cfg that still says telemetry = true is harmless: the setting does nothing in this build.

Packaging: the bundled() Provides and License: now match the bundled libraries actually shipped.

Note: this update stays on 6.2.11, which keeps the 6.x command-line options. et 7.x changes several short options to match OpenSSH, so it is only in Rawhide.

et-6.2.11-5.fc43

Fedora Security Advisories
2 days ago
FEDORA-2026-666b7444a4 Packages in this update:
  • et-6.2.11-5.fc43
Update description:

Security fixes from et 7.1.x, backported to 6.2.11, and telemetry disabled.

Security fixes (backported from et 7.1.0 and 7.1.1, one commit per upstream fix; see https://github.com/MisterTea/EternalTerminal/issues/923):

  • Pre-authentication denial of service: stuck or silent peers, slow reconnects and accept() resource exhaustion could block or crash etserver for every user
  • etserver and the router no longer abort on malformed packets or registrations
  • Router session ownership is taken from the kernel's peer credentials, and both ends of the Unix HTM control socket are authenticated
  • etserver no longer does root file operations or connections on Unix socket paths chosen by the client

Telemetry disabled (CVE-2023-23558):

et is now built with telemetry disabled on all architectures. This removes the bundled sentry-native and its fixed paths in /tmp, and drops the libcurl dependency. The default /etc/et.cfg now says telemetry = false. An existing et.cfg that still says telemetry = true is harmless: the setting does nothing in this build.

Packaging: the bundled() Provides and License: now match the bundled libraries actually shipped.

Note: this update stays on 6.2.11, which keeps the 6.x command-line options. et 7.x changes several short options to match OpenSSH, so it is only in Rawhide.

et-6.2.11-5.el9 simpleini-4.25-1.el9

Fedora Security Advisories
2 days ago
FEDORA-EPEL-2026-b1d6daf614 Packages in this update:
  • et-6.2.11-5.el9
  • simpleini-4.25-1.el9
Update description:

Update et from 6.2.8 to 6.2.11, with security fixes from 7.1.x backported, and add simpleini, which et now builds against.

Security fixes (backported from et 7.1.0 and 7.1.1, one commit per upstream fix; see https://github.com/MisterTea/EternalTerminal/issues/923):

  • Pre-authentication denial of service: stuck or silent peers, slow reconnects and accept() resource exhaustion could block or crash etserver for every user
  • etserver and the router no longer abort on malformed packets or registrations
  • Router session ownership is taken from the kernel's peer credentials, and both ends of the Unix HTM control socket are authenticated
  • etserver no longer does root file operations or connections on Unix socket paths chosen by the client

Telemetry disabled (CVE-2023-23558):

et is now built with telemetry disabled on all architectures. This removes the bundled sentry-native and its fixed paths in /tmp, and drops the libcurl dependency. The default /etc/et.cfg now says telemetry = false. An existing et.cfg that still says telemetry = true is harmless: the setting does nothing in this build.

Other changes since 6.2.8 include a 30 s socket timeout, fixes for jumphost user names, and reverse tunnels bound to localhost. Full list: https://github.com/MisterTea/EternalTerminal/compare/et-v6.2.8...et-v6.2.11

Note: et 6.2.11 keeps the 6.x command-line options. The 7.x series changes several short options to match OpenSSH, so it is not being pushed to EPEL 9.

xen-4.21.2-6.fc44

Fedora Security Advisories
2 days 3 hours ago
FEDORA-2026-d9acb64367 Packages in this update:
  • xen-4.21.2-6.fc44
Update description:

AMD IOMMU Out-of-Bounds Device Table Read [XSA-524, CVE-2024-21963] x86: Transient Scheduler Attacks (update) [XSA-525, CVE-2024-36350, CVE-2024-36357, CVE-2026-0004]

proftpd-1.3.6e-12.el8

Fedora Security Advisories
2 days 4 hours ago
FEDORA-EPEL-2026-f318914cc8 Packages in this update:
  • proftpd-1.3.6e-12.el8
Update description:

This update addresses a number of security issues, none of which affect modules enabled by default.

Checked
4 minutes 45 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security