Glibc, Kerberos, GitPython, and more updates for Fedora

Fedora Linux 9336 Published by

Fedora just pushed out a major security refresh for versions 42 through 44 that addresses multiple vulnerabilities across essential system packages. You will find updated releases for glibc, Kerberos, GitPython, Xen, Perl CryptX, Rust OpenSSL libraries, OpenVPN, and OpenSSH all packed with critical patches. These fixes tackle serious issues ranging from buffer overflows and memory corruption to privilege escalation flaws that could easily let malicious actors take control of your machines. Running the regular dnf upgrade command will install everything quickly so you can close those security gaps before anyone tries to exploit them.

Fedora 44 Update: glibc-2.43-4.fc44
Fedora 44 Update: krb5-1.22.2-4.fc44
Fedora 44 Update: GitPython-3.1.49-1.fc44
Fedora 44 Update: xen-4.21.1-2.fc44
Fedora 44 Update: perl-CryptX-0.088-2.fc44
Fedora 44 Update: rust-openssl-sys-0.9.114-1.fc44
Fedora 44 Update: rust-openssl-0.10.78-1.fc44
Fedora 42 Update: perl-CryptX-0.088-2.fc42
Fedora 42 Update: rust-openssl-sys-0.9.114-1.fc42
Fedora 42 Update: openvpn-2.6.20-1.fc42
Fedora 42 Update: rust-openssl-0.10.78-1.fc42
Fedora 42 Update: openssh-9.9p1-14.fc42
Fedora 43 Update: GitPython-3.1.49-1.fc43
Fedora 43 Update: rust-openssl-sys-0.9.114-1.fc43
Fedora 43 Update: perl-CryptX-0.088-2.fc43
Fedora 43 Update: rust-openssl-0.10.78-1.fc43



[SECURITY] Fedora 44 Update: glibc-2.43-4.fc44


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-ced72ab158
2026-05-02 02:10:24.452838+00:00
--------------------------------------------------------------------------------

Name : glibc
Product : Fedora 44
Version : 2.43
Release : 4.fc44
URL : http://www.gnu.org/software/glibc/
Summary : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.

--------------------------------------------------------------------------------
Update Information:

This update provides various security fixes.
Buffer overflow in scanf %mc (CVE-2026-5450)
ns_sprintrrf buffer overreads (CVE-2026-6238)
ns_sprintrrf buffer overflow in TSIG record processing (CVE-2026-5435)
Memory corruption in ungetwc (CVE-2026-5928)
Assertion failure in iconv with IBM1390, IBM1399 charsets (CVE-2026-4046)
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 30 2026 Florian Weimer [fweimer@redhat.com] - 2.43-4
- Add downstream patches with fixes for vulnerabilities.
- Fix buffer overflow in scanf %mc (CVE-2026-5450)
- Fix ns_sprintrrf buffer overreads (CVE-2026-6238)
- Fix ns_sprintrrf buffer overflow in TSIG record processing (CVE-2026-5435)
- Fix memory corruption in ungetwc (CVE-2026-5928)
- Auto-sync with upstream branch release/2.43/master,
commit 8362e8ce10b24068bacc19552c128dd10e082fd9:
- iconv: Use pending character state in IBM1390, IBM1399 character sets
(CVE-2026-4046)
--------------------------------------------------------------------------------
References:

[ 1 ] Bug #2453212 - CVE-2026-4046 glibc: glibc: Denial of Service via iconv() function with specific character sets [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2453212
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-ced72ab158' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 44 Update: krb5-1.22.2-4.fc44


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-8b43ea2f82
2026-05-02 02:10:24.452831+00:00
--------------------------------------------------------------------------------

Name : krb5
Product : Fedora 44
Version : 1.22.2
Release : 4.fc44
URL : https://web.mit.edu/kerberos/www/
Summary : The Kerberos network authentication system
Description :
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of sending passwords over the network in unencrypted form.

--------------------------------------------------------------------------------
Update Information:

Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
Add upstream patches to build against openssl 4.0
Make configure.ac work with autoconf 2.73
--------------------------------------------------------------------------------
ChangeLog:

* Tue Apr 28 2026 Julien Rische [jrische@redhat.com] - 1.22.2-4
- Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
- resolves: rhbz#2463398
- resolves: rhbz#2463395
- Add upstream patches to build against openssl 4.0
- Make configure.ac work with autoconf 2.73
--------------------------------------------------------------------------------
References:

[ 1 ] Bug #2463395 - CVE-2026-40356 krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2463395
[ 2 ] Bug #2463398 - CVE-2026-40355 krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2463398
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-8b43ea2f82' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 44 Update: GitPython-3.1.49-1.fc44


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-9342da13e0
2026-05-02 02:10:24.452829+00:00
--------------------------------------------------------------------------------

Name : GitPython
Product : Fedora 44
Version : 3.1.49
Release : 1.fc44
URL : https://github.com/gitpython-developers/GitPython
Summary : Python Git Library
Description :
GitPython is a python library used to interact with git repositories,
high-level like git-porcelain, or low-level like git-plumbing.

It provides abstractions of git objects for easy access of repository data, and
additionally allows you to access the git repository more directly using either
a pure python implementation, or the faster, but more resource intensive git
command implementation.

The object database implementation is optimized for handling large quantities
of objects and large datasets, which is achieved by using low-level structures
and data streaming.

--------------------------------------------------------------------------------
Update Information:

Fixes security defects GHSA-rpm5-65cw-6hj4, GHSA-x2qx-6953-8485,
GHSA-7545-fcxq-7j24, and GHSA-v87r-6q3f-2j67.
--------------------------------------------------------------------------------
ChangeLog:

* Wed Apr 29 2026 Benjamin A. Beasley [code@musicinmybrain.net] - 3.1.49-1
- Update to 3.1.49; closes RHBZ#2463714 and fixes GHSA-v87r-6q3f-2j67
* Tue Apr 28 2026 Benjamin A. Beasley [code@musicinmybrain.net] - 3.1.48-1
- Update to 3.1.48; closes RHBZ#2460480, fixes GHSA-rpm5-65cw-6hj4,
fixes GHSA-x2qx-6953-8485, and fixes GHSA-7545-fcxq-7j24
--------------------------------------------------------------------------------
References:

[ 1 ] Bug #2460480 - GitPython-3.1.48 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2460480
[ 2 ] Bug #2463714 - GitPython-3.1.49 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2463714
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-9342da13e0' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 44 Update: xen-4.21.1-2.fc44


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-883e88db68
2026-05-02 02:10:24.452819+00:00
--------------------------------------------------------------------------------

Name : xen
Product : Fedora 44
Version : 4.21.1
Release : 2.fc44
URL : http://xen.org/
Summary : Xen is a virtual machine monitor
Description :
This package contains the XenD daemon and xm command line
tools, needed to manage virtual machines running under the
Xen hypervisor

--------------------------------------------------------------------------------
Update Information:

oxenstored keeps quota related use counts across domain destruction
[XSA-483, CVE-2026-23556]
Xenstored DoS via XS_RESET_WATCHES command [XSA-484, CVE-2026-23557]
grant table v2 race in status page mapping [XSA-486, CVE-2026-23558]
x86: Floating Point Divider State Sampling [XSA-488, CVE-2025-54505]
--------------------------------------------------------------------------------
ChangeLog:

* Tue Apr 28 2026 Michael Young [m.a.young@durham.ac.uk] - 4.21.1-2
- oxenstored keeps quota related use counts across domain destruction
[XSA-483, CVE-2026-23556]
- Xenstored DoS via XS_RESET_WATCHES command [XSA-484, CVE-2026-23557]
- grant table v2 race in status page mapping [XSA-486, CVE-2026-23558]
- x86: Floating Point Divider State Sampling [XSA-488, CVE-2025-54505]
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-883e88db68' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 44 Update: perl-CryptX-0.088-2.fc44


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-f533fcc0b6
2026-05-02 02:10:24.452774+00:00
--------------------------------------------------------------------------------

Name : perl-CryptX
Product : Fedora 44
Version : 0.088
Release : 2.fc44
URL : https://metacpan.org/release/CryptX
Summary : Cryptographic toolkit
Description :
This Perl library provides a cryptography based on LibTomCrypt library.

--------------------------------------------------------------------------------
Update Information:

0.088 2026-04-23
- Crypt::KeyDerivation - new functions: pbkdf1_openssl, bcrypt_pbkdf,
scrypt_pbkdf, argon2_pbkdf
- Crypt::Misc - new functions: random_v7uuid, is_uuid
- bundled libtomcrypt update branch:develop (commit: 2e441a17
2026-04-15)
- bundled libtommath update branch:develop (commit: ae40a87 2026-04-20)
- security fix CVE-2026-41564 https://github.com/DCIT/perl-
CryptX/security/advisories/GHSA-24c2-gp6c-24c6
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 23 2026 Xavier Bachelot [xavier@bachelot.org] - 0.088-2
- Add missing BR: perl(Time::HiRes)
* Thu Apr 23 2026 Xavier Bachelot [xavier@bachelot.org] - 0.088-1
- Update to 0.088 (RHBZ#22461073)
- Fix CVE-2026-41564 (RHBZ#2461084,RHBZ#2461085)
--------------------------------------------------------------------------------
References:

[ 1 ] Bug #2461085 - CVE-2026-41564 perl-CryptX: CryptX: Private key recovery due to predictable pseudo-random number generation after forking [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2461085
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-f533fcc0b6' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 44 Update: rust-openssl-sys-0.9.114-1.fc44


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-fc9d4b5520
2026-05-02 02:10:24.452770+00:00
--------------------------------------------------------------------------------

Name : rust-openssl-sys
Product : Fedora 44
Version : 0.9.114
Release : 1.fc44
URL : https://crates.io/crates/openssl-sys
Summary : FFI bindings to OpenSSL
Description :
FFI bindings to OpenSSL.

--------------------------------------------------------------------------------
Update Information:

Update the openssl crate to version 0.10.78 and the openssl-sys crate to version
0.9.114.
Release notes:
openssl 0.10.77 / openssl-sys 0.9.113: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.77
openssl 0.10.78 / openssl-sys 0.9.114: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.78
This addresses the following security advisories:
GHSA-pqf5-4pqq-29f5 / CVE-2026-41676: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-pqf5-4pqq-29f5
GHSA-xmgf-hq76-4vx2 / CVE-2026-41677: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-xmgf-hq76-4vx2
GHSA-8c75-8mhr-p7r9 / CVE-2026-41678: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-8c75-8mhr-p7r9
GHSA-ghm9-cr32-g9qj / CVE-2026-41681: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-ghm9-cr32-g9qj
GHSA-hppc-g8h3-xhp3 (no CVE entry): https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-hppc-g8h3-xhp3
Affected applications still need to be rebuilt to pick up these fixes.
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 23 2026 Fabio Valentini [decathorpe@gmail.com] - 0.9.114-1
- Update to version 0.9.114; Fixes RHBZ#2457692
* Mon Apr 13 2026 Fabio Valentini [decathorpe@gmail.com] - 0.9.112-2
- Add upper bound to OpenSSL dependency since 4.0 is not supported yet
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-fc9d4b5520' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 44 Update: rust-openssl-0.10.78-1.fc44


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-fc9d4b5520
2026-05-02 02:10:24.452770+00:00
--------------------------------------------------------------------------------

Name : rust-openssl
Product : Fedora 44
Version : 0.10.78
Release : 1.fc44
URL : https://crates.io/crates/openssl
Summary : OpenSSL bindings
Description :
OpenSSL bindings.

--------------------------------------------------------------------------------
Update Information:

Update the openssl crate to version 0.10.78 and the openssl-sys crate to version
0.9.114.
Release notes:
openssl 0.10.77 / openssl-sys 0.9.113: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.77
openssl 0.10.78 / openssl-sys 0.9.114: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.78
This addresses the following security advisories:
GHSA-pqf5-4pqq-29f5 / CVE-2026-41676: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-pqf5-4pqq-29f5
GHSA-xmgf-hq76-4vx2 / CVE-2026-41677: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-xmgf-hq76-4vx2
GHSA-8c75-8mhr-p7r9 / CVE-2026-41678: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-8c75-8mhr-p7r9
GHSA-ghm9-cr32-g9qj / CVE-2026-41681: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-ghm9-cr32-g9qj
GHSA-hppc-g8h3-xhp3 (no CVE entry): https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-hppc-g8h3-xhp3
Affected applications still need to be rebuilt to pick up these fixes.
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 23 2026 Fabio Valentini [decathorpe@gmail.com] - 0.10.78-1
- Update to version 0.10.78; Fixes RHBZ#2457691
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-fc9d4b5520' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 42 Update: perl-CryptX-0.088-2.fc42


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-bc5090f99b
2026-05-02 01:57:11.713683+00:00
--------------------------------------------------------------------------------

Name : perl-CryptX
Product : Fedora 42
Version : 0.088
Release : 2.fc42
URL : https://metacpan.org/release/CryptX
Summary : Cryptographic toolkit
Description :
This Perl library provides a cryptography based on LibTomCrypt library.

--------------------------------------------------------------------------------
Update Information:

0.088 2026-04-23
- Crypt::KeyDerivation - new functions: pbkdf1_openssl, bcrypt_pbkdf,
scrypt_pbkdf, argon2_pbkdf
- Crypt::Misc - new functions: random_v7uuid, is_uuid
- bundled libtomcrypt update branch:develop (commit: 2e441a17
2026-04-15)
- bundled libtommath update branch:develop (commit: ae40a87 2026-04-20)
- security fix CVE-2026-41564 https://github.com/DCIT/perl-
CryptX/security/advisories/GHSA-24c2-gp6c-24c6
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 23 2026 Xavier Bachelot [xavier@bachelot.org] - 0.088-2
- Add missing BR: perl(Time::HiRes)
* Thu Apr 23 2026 Xavier Bachelot [xavier@bachelot.org] - 0.088-1
- Update to 0.088 (RHBZ#22461073)
- Fix CVE-2026-41564 (RHBZ#2461084,RHBZ#2461085)
* Sat Jan 17 2026 Fedora Release Engineering [releng@fedoraproject.org] - 0.087-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jul 25 2025 Fedora Release Engineering [releng@fedoraproject.org] - 0.087-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Mon Jul 7 2025 Jitka Plesnikova [jplesnik@redhat.com] - 0.087-3
- Perl 5.42 rebuild
--------------------------------------------------------------------------------
References:

[ 1 ] Bug #2461085 - CVE-2026-41564 perl-CryptX: CryptX: Private key recovery due to predictable pseudo-random number generation after forking [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2461085
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-bc5090f99b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 42 Update: rust-openssl-sys-0.9.114-1.fc42


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-76f57efeef
2026-05-02 01:57:11.713681+00:00
--------------------------------------------------------------------------------

Name : rust-openssl-sys
Product : Fedora 42
Version : 0.9.114
Release : 1.fc42
URL : https://crates.io/crates/openssl-sys
Summary : FFI bindings to OpenSSL
Description :
FFI bindings to OpenSSL.

--------------------------------------------------------------------------------
Update Information:

Update the openssl crate to version 0.10.78 and the openssl-sys crate to version
0.9.114.
Release notes:
openssl 0.10.77 / openssl-sys 0.9.113: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.77
openssl 0.10.78 / openssl-sys 0.9.114: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.78
This addresses the following security advisories:
GHSA-pqf5-4pqq-29f5 / CVE-2026-41676: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-pqf5-4pqq-29f5
GHSA-xmgf-hq76-4vx2 / CVE-2026-41677: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-xmgf-hq76-4vx2
GHSA-8c75-8mhr-p7r9 / CVE-2026-41678: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-8c75-8mhr-p7r9
GHSA-ghm9-cr32-g9qj / CVE-2026-41681: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-ghm9-cr32-g9qj
GHSA-hppc-g8h3-xhp3 (no CVE entry): https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-hppc-g8h3-xhp3
Affected applications still need to be rebuilt to pick up these fixes.
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 23 2026 Fabio Valentini [decathorpe@gmail.com] - 0.9.114-1
- Update to version 0.9.114; Fixes RHBZ#2457692
* Mon Apr 13 2026 Fabio Valentini [decathorpe@gmail.com] - 0.9.112-2
- Add upper bound to OpenSSL dependency since 4.0 is not supported yet
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-76f57efeef' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 42 Update: openvpn-2.6.20-1.fc42


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-ddc5696c20
2026-05-02 01:57:11.713676+00:00
--------------------------------------------------------------------------------

Name : openvpn
Product : Fedora 42
Version : 2.6.20
Release : 1.fc42
URL : https://community.openvpn.net/
Summary : A full-featured TLS VPN solution
Description :
OpenVPN is a robust and highly flexible tunneling application that uses all
of the encryption, authentication, and certification features of the
OpenSSL library to securely tunnel IP networks over a single UDP or TCP
port. It can use the Marcus Franz Xaver Johannes Oberhumers LZO library
for compression.

--------------------------------------------------------------------------------
Update Information:

Update to upstream OpenVPN 2.6.20
CVE-2026-40215
CVE-2026-35058
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 23 2026 Frank Lichtenheld [frank@lichtenheld.com] - 2.6.20-1
- Update to upstream OpenVPN 2.6.20
- CVE-2026-40215
- CVE-2026-35058
* Wed Feb 4 2026 Frank Lichtenheld [frank@lichtenheld.com] - 2.6.19-1
- Update to upstream OpenVPN 2.6.19
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-ddc5696c20' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 42 Update: rust-openssl-0.10.78-1.fc42


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-76f57efeef
2026-05-02 01:57:11.713681+00:00
--------------------------------------------------------------------------------

Name : rust-openssl
Product : Fedora 42
Version : 0.10.78
Release : 1.fc42
URL : https://crates.io/crates/openssl
Summary : OpenSSL bindings
Description :
OpenSSL bindings.

--------------------------------------------------------------------------------
Update Information:

Update the openssl crate to version 0.10.78 and the openssl-sys crate to version
0.9.114.
Release notes:
openssl 0.10.77 / openssl-sys 0.9.113: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.77
openssl 0.10.78 / openssl-sys 0.9.114: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.78
This addresses the following security advisories:
GHSA-pqf5-4pqq-29f5 / CVE-2026-41676: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-pqf5-4pqq-29f5
GHSA-xmgf-hq76-4vx2 / CVE-2026-41677: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-xmgf-hq76-4vx2
GHSA-8c75-8mhr-p7r9 / CVE-2026-41678: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-8c75-8mhr-p7r9
GHSA-ghm9-cr32-g9qj / CVE-2026-41681: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-ghm9-cr32-g9qj
GHSA-hppc-g8h3-xhp3 (no CVE entry): https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-hppc-g8h3-xhp3
Affected applications still need to be rebuilt to pick up these fixes.
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 23 2026 Fabio Valentini [decathorpe@gmail.com] - 0.10.78-1
- Update to version 0.10.78; Fixes RHBZ#2457691
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-76f57efeef' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 42 Update: openssh-9.9p1-14.fc42


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-d08c298940
2026-05-02 01:57:11.713666+00:00
--------------------------------------------------------------------------------

Name : openssh
Product : Fedora 42
Version : 9.9p1
Release : 14.fc42
URL : http://www.openssh.com/portable.html
Summary : An open source implementation of SSH protocol version 2
Description :
SSH (Secure SHell) is a program for logging into and executing
commands on a remote machine. SSH is intended to replace rlogin and
rsh, and to provide secure encrypted communications between two
untrusted hosts over an insecure network. X11 connections and
arbitrary TCP/IP ports can also be forwarded over the secure channel.

OpenSSH is OpenBSD's version of the last free version of SSH, bringing
it up to date in terms of security and features.

This package includes the core files necessary for both the OpenSSH
client and server. To make this package useful, you should also
install openssh-clients, openssh-server, or both.

--------------------------------------------------------------------------------
Update Information:

Fixes high severity CVE:
- CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in
preserving file mode
--------------------------------------------------------------------------------
ChangeLog:

* Mon Apr 20 2026 Zoltan Fridrich [zfridric@redhat.com] - 9.9p1-14
- CVE-2026-35385: Fix privilege escalation via scp legacy protocol
when not in preserving file mode
Resolves: rhbz#2454941
--------------------------------------------------------------------------------
References:

[ 1 ] Bug #2454941 - CVE-2026-35385 openssh: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2454941
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-d08c298940' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 43 Update: GitPython-3.1.49-1.fc43


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-fdbf3705cc
2026-05-02 01:51:01.714190+00:00
--------------------------------------------------------------------------------

Name : GitPython
Product : Fedora 43
Version : 3.1.49
Release : 1.fc43
URL : https://github.com/gitpython-developers/GitPython
Summary : Python Git Library
Description :
GitPython is a python library used to interact with git repositories,
high-level like git-porcelain, or low-level like git-plumbing.

It provides abstractions of git objects for easy access of repository data, and
additionally allows you to access the git repository more directly using either
a pure python implementation, or the faster, but more resource intensive git
command implementation.

The object database implementation is optimized for handling large quantities
of objects and large datasets, which is achieved by using low-level structures
and data streaming.

--------------------------------------------------------------------------------
Update Information:

Fixes security defects GHSA-rpm5-65cw-6hj4, GHSA-x2qx-6953-8485,
GHSA-7545-fcxq-7j24, and GHSA-v87r-6q3f-2j67.
--------------------------------------------------------------------------------
ChangeLog:

* Wed Apr 29 2026 Benjamin A. Beasley [code@musicinmybrain.net] - 3.1.49-1
- Update to 3.1.49; closes RHBZ#2463714 and fixes GHSA-v87r-6q3f-2j67
* Tue Apr 28 2026 Benjamin A. Beasley [code@musicinmybrain.net] - 3.1.48-1
- Update to 3.1.48; closes RHBZ#2460480, fixes GHSA-rpm5-65cw-6hj4,
fixes GHSA-x2qx-6953-8485, and fixes GHSA-7545-fcxq-7j24
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 3.1.46-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 3.1.46-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:

[ 1 ] Bug #2460480 - GitPython-3.1.48 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2460480
[ 2 ] Bug #2463714 - GitPython-3.1.49 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2463714
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-fdbf3705cc' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 43 Update: rust-openssl-sys-0.9.114-1.fc43


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-16a3cea414
2026-05-02 01:51:01.714148+00:00
--------------------------------------------------------------------------------

Name : rust-openssl-sys
Product : Fedora 43
Version : 0.9.114
Release : 1.fc43
URL : https://crates.io/crates/openssl-sys
Summary : FFI bindings to OpenSSL
Description :
FFI bindings to OpenSSL.

--------------------------------------------------------------------------------
Update Information:

Update the openssl crate to version 0.10.78 and the openssl-sys crate to version
0.9.114.
Release notes:
openssl 0.10.77 / openssl-sys 0.9.113: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.77
openssl 0.10.78 / openssl-sys 0.9.114: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.78
This addresses the following security advisories:
GHSA-pqf5-4pqq-29f5 / CVE-2026-41676: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-pqf5-4pqq-29f5
GHSA-xmgf-hq76-4vx2 / CVE-2026-41677: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-xmgf-hq76-4vx2
GHSA-8c75-8mhr-p7r9 / CVE-2026-41678: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-8c75-8mhr-p7r9
GHSA-ghm9-cr32-g9qj / CVE-2026-41681: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-ghm9-cr32-g9qj
GHSA-hppc-g8h3-xhp3 (no CVE entry): https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-hppc-g8h3-xhp3
Affected applications still need to be rebuilt to pick up these fixes.
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 23 2026 Fabio Valentini [decathorpe@gmail.com] - 0.9.114-1
- Update to version 0.9.114; Fixes RHBZ#2457692
* Mon Apr 13 2026 Fabio Valentini [decathorpe@gmail.com] - 0.9.112-2
- Add upper bound to OpenSSL dependency since 4.0 is not supported yet
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-16a3cea414' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 43 Update: perl-CryptX-0.088-2.fc43


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-3e1f671a17
2026-05-02 01:51:01.714151+00:00
--------------------------------------------------------------------------------

Name : perl-CryptX
Product : Fedora 43
Version : 0.088
Release : 2.fc43
URL : https://metacpan.org/release/CryptX
Summary : Cryptographic toolkit
Description :
This Perl library provides a cryptography based on LibTomCrypt library.

--------------------------------------------------------------------------------
Update Information:

0.088 2026-04-23
- Crypt::KeyDerivation - new functions: pbkdf1_openssl, bcrypt_pbkdf,
scrypt_pbkdf, argon2_pbkdf
- Crypt::Misc - new functions: random_v7uuid, is_uuid
- bundled libtomcrypt update branch:develop (commit: 2e441a17
2026-04-15)
- bundled libtommath update branch:develop (commit: ae40a87 2026-04-20)
- security fix CVE-2026-41564 https://github.com/DCIT/perl-
CryptX/security/advisories/GHSA-24c2-gp6c-24c6
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 23 2026 Xavier Bachelot [xavier@bachelot.org] - 0.088-2
- Add missing BR: perl(Time::HiRes)
* Thu Apr 23 2026 Xavier Bachelot [xavier@bachelot.org] - 0.088-1
- Update to 0.088 (RHBZ#22461073)
- Fix CVE-2026-41564 (RHBZ#2461084,RHBZ#2461085)
* Sat Jan 17 2026 Fedora Release Engineering [releng@fedoraproject.org] - 0.087-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:

[ 1 ] Bug #2461085 - CVE-2026-41564 perl-CryptX: CryptX: Private key recovery due to predictable pseudo-random number generation after forking [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2461085
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-3e1f671a17' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new



[SECURITY] Fedora 43 Update: rust-openssl-0.10.78-1.fc43


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-16a3cea414
2026-05-02 01:51:01.714148+00:00
--------------------------------------------------------------------------------

Name : rust-openssl
Product : Fedora 43
Version : 0.10.78
Release : 1.fc43
URL : https://crates.io/crates/openssl
Summary : OpenSSL bindings
Description :
OpenSSL bindings.

--------------------------------------------------------------------------------
Update Information:

Update the openssl crate to version 0.10.78 and the openssl-sys crate to version
0.9.114.
Release notes:
openssl 0.10.77 / openssl-sys 0.9.113: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.77
openssl 0.10.78 / openssl-sys 0.9.114: https://github.com/rust-openssl/rust-
openssl/releases/tag/openssl-v0.10.78
This addresses the following security advisories:
GHSA-pqf5-4pqq-29f5 / CVE-2026-41676: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-pqf5-4pqq-29f5
GHSA-xmgf-hq76-4vx2 / CVE-2026-41677: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-xmgf-hq76-4vx2
GHSA-8c75-8mhr-p7r9 / CVE-2026-41678: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-8c75-8mhr-p7r9
GHSA-ghm9-cr32-g9qj / CVE-2026-41681: https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-ghm9-cr32-g9qj
GHSA-hppc-g8h3-xhp3 (no CVE entry): https://github.com/rust-openssl/rust-
openssl/security/advisories/GHSA-hppc-g8h3-xhp3
Affected applications still need to be rebuilt to pick up these fixes.
--------------------------------------------------------------------------------
ChangeLog:

* Thu Apr 23 2026 Fabio Valentini [decathorpe@gmail.com] - 0.10.78-1
- Update to version 0.10.78; Fixes RHBZ#2457691
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-16a3cea414' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------


Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new


Chromium, Dovecot, ImageMagick, and more updates for Debian

Dtrace, Libtiff, Grafana-PCP, and more updates for Oracle Linux

Windows

Linux

macOS

Community

  • Lexonight
    Hey everyone,Wanted to share a project I've been b ...
  • SeveG
    need some help here... situationPC= Packard BellOS= win1 ...
  • dhamu
    Hello Phil, I have a Linux Tutorial website that curre ...