Aggregator

• asterisk-18.26.4-2.el9

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

• asterisk-18.26.4-2.el8

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

• asterisk-18.26.4-2.fc44

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

• asterisk-18.26.4-2.fc43

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

• nextcloud-35.0.2-1.el10_2

35.0.2 Release

• nextcloud-35.0.2-1.el10_3

35.0.2 Release

• nextcloud-35.0.2-1.el10_4

35.0.2 Release

• nextcloud-35.0.2-1.fc43

35.0.2 Release

• nextcloud-35.0.2-1.fc44

35.0.2 Release

• python-crate-ingredients-0.3.3-2.fc45

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

• rust-ingredients-0.3.3-2.fc43

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

• nextcloud-35.0.2-1.fc45

35.0.2 Release

• rust-ingredients-0.3.3-2.fc44

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

• rust-coreos-installer-0.27.0-2.fc43

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

Updated License expression based on a current Rawhide build

• rust-ingredients-0.3.3-2.fc45

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

• rust-rbw-1.13.2-8.el9

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

• rust-coreos-installer-0.27.0-2.fc44

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

Updated License expression based on a current Rawhide build

• rust-rbw-1.13.2-8.el10_3

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

• rust-rbw-1.13.2-8.el10_4

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

• rust-sequoia-sq-1.5.0-2.fc43

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.