Fedora 41 Update: golang-github-openprinting-ipp-usb-0.9.30-7.fc41
Fedora 41 Update: libnbd-1.22.5-1.fc41
Fedora 42 Update: golang-github-openprinting-ipp-usb-0.9.30-7.fc42
Fedora 42 Update: singularity-ce-4.3.4-1.fc42
Fedora 42 Update: kea-3.0.2-1.fc42
Fedora 42 Update: libnbd-1.22.5-1.fc42
Fedora 43 Update: luksmeta-10-1.fc43
Fedora 43 Update: singularity-ce-4.3.4-1.fc43
Fedora 43 Update: bind-9.18.41-1.fc43
Fedora 43 Update: bind-dyndb-ldap-11.11-8.fc43
[SECURITY] Fedora 41 Update: golang-github-openprinting-ipp-usb-0.9.30-7.fc41
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-9d12a32bce
2025-11-08 02:54:10.233088+00:00
--------------------------------------------------------------------------------
Name : golang-github-openprinting-ipp-usb
Product : Fedora 41
Version : 0.9.30
Release : 7.fc41
URL : https://github.com/OpenPrinting/ipp-usb
Summary : HTTP reverse proxy, backed by IPP-over-USB connection to device
Description :
HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
driverless support for USB devices capable of using IPP-over-USB protocol.
--------------------------------------------------------------------------------
Update Information:
Rebuild with the latest golang in repos
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 31 2025 Zdenek Dohnal [zdohnal@redhat.com] - 0.9.30-7
- Rebuild with the latest golang in repos
* Fri Oct 10 2025 Maxwell G [maxwell@gtmx.me] - 0.9.30-6
- Rebuild for golang 1.25.2
* Fri Aug 15 2025 Maxwell G [maxwell@gtmx.me] - 0.9.30-5
- Rebuild for golang-1.25.0
* Thu Jul 24 2025 Fedora Release Engineering [releng@fedoraproject.org] - 0.9.30-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2407251 - CVE-2025-58185 encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1
https://bugzilla.redhat.com/show_bug.cgi?id=2407251
[ 2 ] Bug #2407252 - CVE-2025-61723 encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem
https://bugzilla.redhat.com/show_bug.cgi?id=2407252
[ 3 ] Bug #2407260 - CVE-2025-58189 crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information
https://bugzilla.redhat.com/show_bug.cgi?id=2407260
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-9d12a32bce' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 41 Update: libnbd-1.22.5-1.fc41
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-ffa97eb16f
2025-11-08 02:54:10.232995+00:00
--------------------------------------------------------------------------------
Name : libnbd
Product : Fedora 41
Version : 1.22.5
Release : 1.fc41
URL : https://gitlab.com/nbdkit/libnbd
Summary : NBD client library in userspace
Description :
NBD ??? Network Block Device ??? is a protocol for accessing Block Devices
(hard disks and disk-like things) over a Network.
This is the NBD client library in userspace, a simple library for
writing NBD clients.
The key features are:
* Synchronous and asynchronous APIs, both for ease of use and for
writing non-blocking, multithreaded clients.
* High performance.
* Minimal dependencies for the basic library.
* Well-documented, stable API.
* Bindings in several programming languages.
--------------------------------------------------------------------------------
Update Information:
New upstream stable version 1.22.5
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 23 2025 Richard W.M. Jones [rjones@redhat.com] - 1.22.5-1
- New upstream stable version 1.22.5
- Fixes security issue with nbd+ssh URIs
https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/YZMBF3SJRWTRVT5L3KWSNHITFTRMQNTT/
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-ffa97eb16f' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 42 Update: golang-github-openprinting-ipp-usb-0.9.30-7.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-d9921d4ed5
2025-11-08 01:27:10.727154+00:00
--------------------------------------------------------------------------------
Name : golang-github-openprinting-ipp-usb
Product : Fedora 42
Version : 0.9.30
Release : 7.fc42
URL : https://github.com/OpenPrinting/ipp-usb
Summary : HTTP reverse proxy, backed by IPP-over-USB connection to device
Description :
HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
driverless support for USB devices capable of using IPP-over-USB protocol.
--------------------------------------------------------------------------------
Update Information:
Rebuild with the latest golang in repos
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 31 2025 Zdenek Dohnal [zdohnal@redhat.com] - 0.9.30-7
- Rebuild with the latest golang in repos
* Fri Oct 10 2025 Maxwell G [maxwell@gtmx.me] - 0.9.30-6
- Rebuild for golang 1.25.2
* Fri Aug 15 2025 Maxwell G [maxwell@gtmx.me] - 0.9.30-5
- Rebuild for golang-1.25.0
* Thu Jul 24 2025 Fedora Release Engineering [releng@fedoraproject.org] - 0.9.30-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2407251 - CVE-2025-58185 encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1
https://bugzilla.redhat.com/show_bug.cgi?id=2407251
[ 2 ] Bug #2407252 - CVE-2025-61723 encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem
https://bugzilla.redhat.com/show_bug.cgi?id=2407252
[ 3 ] Bug #2407260 - CVE-2025-58189 crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information
https://bugzilla.redhat.com/show_bug.cgi?id=2407260
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-d9921d4ed5' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 42 Update: singularity-ce-4.3.4-1.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-75b28e93c9
2025-11-08 01:27:10.727137+00:00
--------------------------------------------------------------------------------
Name : singularity-ce
Product : Fedora 42
Version : 4.3.4
Release : 1.fc42
URL : https://www.sylabs.io/singularity/
Summary : Application and environment virtualization
Description :
SingularityCE is the Community Edition of Singularity, an open source
container platform designed to be simple, fast, and secure.
--------------------------------------------------------------------------------
Update Information:
Upgrade to 4.3.4 upstream version.
Build with Go 1.24.9 fixes multiple Go CVEs BZ#2408093 BZ#2408688 BZ#2409563
BZ#2410514 BZ#2411412
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 30 2025 David Trudgian [dtrudg@sylabs.io] - 4.3.4-1
- Upgrade to 4.3.4 upstream version.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2408093 - CVE-2025-58189 singularity-ce: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2408093
[ 2 ] Bug #2408688 - CVE-2025-61725 singularity-ce: Excessive CPU consumption in ParseAddress in net/mail [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2408688
[ 3 ] Bug #2409563 - CVE-2025-61723 singularity-ce: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2409563
[ 4 ] Bug #2410514 - CVE-2025-58185 singularity-ce: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2410514
[ 5 ] Bug #2411412 - CVE-2025-58188 singularity-ce: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2411412
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-75b28e93c9' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 42 Update: kea-3.0.2-1.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-e121742c9d
2025-11-08 01:27:10.727077+00:00
--------------------------------------------------------------------------------
Name : kea
Product : Fedora 42
Version : 3.0.2
Release : 1.fc42
URL : http://kea.isc.org
Summary : DHCPv4, DHCPv6 and DDNS server from ISC
Description :
DHCP implementation from Internet Systems Consortium, Inc. that features fully
functional DHCPv4, DHCPv6 and Dynamic DNS servers.
Both DHCP servers fully support server discovery, address assignment, renewal,
rebinding and release. The DHCPv6 server supports prefix delegation. Both
servers support DNS Update mechanism, using stand-alone DDNS daemon.
--------------------------------------------------------------------------------
Update Information:
New version 3.0.2 (rhbz#2407048)
Fixes CVE-2025-11232 (rhbz#2407228)
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 30 2025 Martin Osvald [mosvald@redhat.com] - 3.0.2-1
- New version 3.0.2 (rhbz#2407048)
- Fixes CVE-2025-11232
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2407048 - kea-3.0.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2407048
[ 2 ] Bug #2407228 - CVE-2025-11232 kea: Invalid characters cause assert [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2407228
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-e121742c9d' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 42 Update: libnbd-1.22.5-1.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-2e23403e23
2025-11-08 01:27:10.727042+00:00
--------------------------------------------------------------------------------
Name : libnbd
Product : Fedora 42
Version : 1.22.5
Release : 1.fc42
URL : https://gitlab.com/nbdkit/libnbd
Summary : NBD client library in userspace
Description :
NBD ??? Network Block Device ??? is a protocol for accessing Block Devices
(hard disks and disk-like things) over a Network.
This is the NBD client library in userspace, a simple library for
writing NBD clients.
The key features are:
* Synchronous and asynchronous APIs, both for ease of use and for
writing non-blocking, multithreaded clients.
* High performance.
* Minimal dependencies for the basic library.
* Well-documented, stable API.
* Bindings in several programming languages.
--------------------------------------------------------------------------------
Update Information:
New upstream stable version 1.22.5
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 23 2025 Richard W.M. Jones [rjones@redhat.com] - 1.22.5-1
- New upstream stable version 1.22.5
- Fixes security issue with nbd+ssh URIs
https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/YZMBF3SJRWTRVT5L3KWSNHITFTRMQNTT/
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-2e23403e23' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 43 Update: luksmeta-10-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-e53e8fdc0a
2025-11-08 01:06:29.234651+00:00
--------------------------------------------------------------------------------
Name : luksmeta
Product : Fedora 43
Version : 10
Release : 1.fc43
URL : https://github.com/latchset/luksmeta
Summary : Utility for storing small metadata in the LUKSv1 header
Description :
LUKSMeta is a command line utility for storing small portions of metadata in
the LUKSv1 header for use before unlocking the volume.
--------------------------------------------------------------------------------
Update Information:
Fix handling of large metadata
Fix: CVE-2025-11568
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 31 2025 Sergio Correia [scorreia@redhat.com] - 10-1
- New upstream release v10
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2404247 - CVE-2025-11568 luksmeta: Data corruption when handling LUKS1 partitions with luksmeta [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2404247
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-e53e8fdc0a' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 43 Update: singularity-ce-4.3.4-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-a6641a44f2
2025-11-08 01:06:29.234624+00:00
--------------------------------------------------------------------------------
Name : singularity-ce
Product : Fedora 43
Version : 4.3.4
Release : 1.fc43
URL : https://www.sylabs.io/singularity/
Summary : Application and environment virtualization
Description :
SingularityCE is the Community Edition of Singularity, an open source
container platform designed to be simple, fast, and secure.
--------------------------------------------------------------------------------
Update Information:
Upgrade to 4.3.4 upstream version.
Go 1.25.2 for build fixes multiple go CVEs. BZ#2408346 BZ#2408744 BZ#2409819
BZ#2410769 BZ#2411665
--------------------------------------------------------------------------------
ChangeLog:
* Thu Oct 30 2025 David Trudgian [dtrudg@sylabs.io] - 4.3.4-1
- Upgrade to 4.3.4 upstream version.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2408346 - CVE-2025-58189 singularity-ce: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2408346
[ 2 ] Bug #2408744 - CVE-2025-61725 singularity-ce: Excessive CPU consumption in ParseAddress in net/mail [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2408744
[ 3 ] Bug #2409819 - CVE-2025-61723 singularity-ce: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2409819
[ 4 ] Bug #2410769 - CVE-2025-58185 singularity-ce: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2410769
[ 5 ] Bug #2411665 - CVE-2025-58188 singularity-ce: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2411665
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-a6641a44f2' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 43 Update: bind-9.18.41-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-66fb3fa6b0
2025-11-08 01:06:29.234560+00:00
--------------------------------------------------------------------------------
Name : bind
Product : Fedora 43
Version : 9.18.41
Release : 1.fc43
URL : https://www.isc.org/downloads/bind/
Summary : The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
Description :
BIND (Berkeley Internet Name Domain) is an implementation of the DNS
(Domain Name System) protocols. BIND includes a DNS server (named),
which resolves host names to IP addresses; a resolver library
(routines for applications to use when interfacing with DNS); and
tools for verifying that the DNS server is operating properly.
--------------------------------------------------------------------------------
Update Information:
Update to 9.18.41 (rhbz#2405786)
Security fixes:
DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677)
Address various spoofing attacks. (CVE-2025-40778)
Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780)
New Features:
Support for parsing HHIT and BRID records has been added.
Removed Features:
Deprecate the "tkey-domain" statement.
Deprecate the "tkey-gssapi-credential" statement.
Bug Fixes:
Prevent spurious SERVFAILs for certain 0-TTL resource records.
Missing DNSSEC information when CD bit is set in query.
https://downloads.isc.org/isc/bind9/9.18.41/doc/arm/html/notes.html#notes-for-
bind-9-18-41
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 24 2025 Petr Men????k [pemensik@redhat.com] - 32:9.18.41-1
- Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2405786 - bind-9.18.41 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2405786
[ 2 ] Bug #2405831 - CVE-2025-8677 CVE-2025-40778 CVE-2025-40780 bind: various flaws [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2405831
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-66fb3fa6b0' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 43 Update: bind-dyndb-ldap-11.11-8.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-66fb3fa6b0
2025-11-08 01:06:29.234560+00:00
--------------------------------------------------------------------------------
Name : bind-dyndb-ldap
Product : Fedora 43
Version : 11.11
Release : 8.fc43
URL : https://releases.pagure.org/bind-dyndb-ldap
Summary : LDAP back-end plug-in for BIND
Description :
This package provides an LDAP back-end plug-in for BIND. It features
support for dynamic updates and internal caching, to lift the load
off of your LDAP server.
--------------------------------------------------------------------------------
Update Information:
Update to 9.18.41 (rhbz#2405786)
Security fixes:
DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677)
Address various spoofing attacks. (CVE-2025-40778)
Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780)
New Features:
Support for parsing HHIT and BRID records has been added.
Removed Features:
Deprecate the "tkey-domain" statement.
Deprecate the "tkey-gssapi-credential" statement.
Bug Fixes:
Prevent spurious SERVFAILs for certain 0-TTL resource records.
Missing DNSSEC information when CD bit is set in query.
https://downloads.isc.org/isc/bind9/9.18.41/doc/arm/html/notes.html#notes-for-
bind-9-18-41
--------------------------------------------------------------------------------
ChangeLog:
* Fri Oct 24 2025 Petr Men????k [pemensik@redhat.com] - 11.11-8
- Rebuilt for BIND 9.18.41 (rhbz#2405786)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2405786 - bind-9.18.41 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2405786
[ 2 ] Bug #2405831 - CVE-2025-8677 CVE-2025-40778 CVE-2025-40780 bind: various flaws [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2405831
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-66fb3fa6b0' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
