Fedora 42 Update: nginx-mod-naxsi-1.6-12.fc42
Fedora 42 Update: nginx-mod-headers-more-0.39-4.fc42
Fedora 42 Update: doctl-1.148.0-1.fc42
Fedora 42 Update: nginx-mod-vts-0.2.4-4.fc42
Fedora 42 Update: nginx-1.28.1-1.fc42
Fedora 42 Update: nginx-mod-modsecurity-1.0.4-5.fc42
Fedora 42 Update: nginx-mod-brotli-1.0.0~rc-4.fc42
Fedora 42 Update: nginx-mod-fancyindex-0.5.2-13.fc42
Fedora 43 Update: grpcurl-1.9.3-6.fc43
Fedora 43 Update: gitleaks-8.30.0-1.fc43
Fedora 43 Update: doctl-1.148.0-1.fc43
[SECURITY] Fedora 42 Update: nginx-mod-naxsi-1.6-12.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-8caa129b2e
2026-01-04 01:00:12.006176+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-naxsi
Product : Fedora 42
Version : 1.6
Release : 12.fc42
URL : https://github.com/wargio/naxsi
Summary : nginx web application firewall module
Description :
naxsi is an nginx module that provides score based Web Application Firewall
(WAF) abilities in a highly granular fashion.
--------------------------------------------------------------------------------
Update Information:
Changes with nginx 1.28.1 23 Dec 2025
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
*) Bugfix: a segmentation fault might occur in a worker process if the
"try_files" directive and "proxy_pass" with a URI were used.
*) Bugfix: in handling "Host" and ":authority" header lines with equal
values when using HTTP/2; the bug had appeared in 1.17.9.
*) Bugfix: in handling "Host" header lines with a port when using
HTTP/3.
*) Bugfix: an XCLIENT command didn't use the xtext encoding.
Thanks to Igor Morgenstern of Aisle Research.
*) Bugfix: in SSL certificate caching during reconfiguration.
*) Bugfix: in delta-seconds processing in the "Cache-Control" backend
response header line.
*) Change: the native nginx/Windows binary release is now built using
Windows SDK 10.
*) Bugfix: nginx could not be built on NetBSD 10.0.
*) Bugfix: in HTTP/3.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Dec 26 2025 Felix Kaechele [felix@kaechele.ca] - 1.6-12
- Rebuild for 1.28.1
* Thu Jul 24 2025 Fedora Release Engineering [releng@fedoraproject.org] - 1.6-11
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-8caa129b2e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 42 Update: nginx-mod-headers-more-0.39-4.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-8caa129b2e
2026-01-04 01:00:12.006176+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-headers-more
Product : Fedora 42
Version : 0.39
Release : 4.fc42
URL : https://github.com/openresty/headers-more-nginx-module
Summary : This module allows adding, setting, or clearing specified input/output headers
Description :
This module allows adding, setting, or clearing specified input/output headers.
This is an enhanced version of the standard headers module because it provides
more utilities like resetting or clearing "builtin headers" like Content-Type,
Content-Length, and Server.
--------------------------------------------------------------------------------
Update Information:
Changes with nginx 1.28.1 23 Dec 2025
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
*) Bugfix: a segmentation fault might occur in a worker process if the
"try_files" directive and "proxy_pass" with a URI were used.
*) Bugfix: in handling "Host" and ":authority" header lines with equal
values when using HTTP/2; the bug had appeared in 1.17.9.
*) Bugfix: in handling "Host" header lines with a port when using
HTTP/3.
*) Bugfix: an XCLIENT command didn't use the xtext encoding.
Thanks to Igor Morgenstern of Aisle Research.
*) Bugfix: in SSL certificate caching during reconfiguration.
*) Bugfix: in delta-seconds processing in the "Cache-Control" backend
response header line.
*) Change: the native nginx/Windows binary release is now built using
Windows SDK 10.
*) Bugfix: nginx could not be built on NetBSD 10.0.
*) Bugfix: in HTTP/3.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Dec 26 2025 Felix Kaechele [felix@kaechele.ca] - 0.39-4
- Rebuild for 1.28.1
* Thu Jul 24 2025 Fedora Release Engineering [releng@fedoraproject.org] - 0.39-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-8caa129b2e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 42 Update: doctl-1.148.0-1.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-cfdb90b52d
2026-01-04 01:00:12.006236+00:00
--------------------------------------------------------------------------------
Name : doctl
Product : Fedora 42
Version : 1.148.0
Release : 1.fc42
URL : https://github.com/digitalocean/doctl
Summary : The official command line interface for the DigitalOcean API
Description :
The official command line interface for the DigitalOcean API.
--------------------------------------------------------------------------------
Update Information:
Update to 1.148.0
--------------------------------------------------------------------------------
ChangeLog:
* Mon Dec 29 2025 Mikel Olasagasti Uranga [mikel@olasagasti.info] - 1.148.0-1
- Update to 1.148.0 - Closes rhbz#2397308
* Fri Oct 10 2025 Alejandro S??ez [asm@redhat.com] - 1.142.0-2
- rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2398680 - CVE-2025-47910 doctl: CrossOriginProtection bypass in net/http [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2398680
[ 2 ] Bug #2399357 - CVE-2025-47906 doctl: Unexpected paths returned from LookPath in os/exec [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2399357
[ 3 ] Bug #2407883 - CVE-2025-58189 doctl: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2407883
[ 4 ] Bug #2409352 - CVE-2025-61723 doctl: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2409352
[ 5 ] Bug #2410302 - CVE-2025-58185 doctl: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2410302
[ 6 ] Bug #2412383 - CVE-2025-58188 doctl: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2412383
[ 7 ] Bug #2412764 - CVE-2025-58183 doctl: Unbounded allocation when parsing GNU sparse map [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2412764
[ 8 ] Bug #2419006 - CVE-2024-25621 doctl: containerd local privilege escalation [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2419006
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-cfdb90b52d' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 42 Update: nginx-mod-vts-0.2.4-4.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-8caa129b2e
2026-01-04 01:00:12.006176+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-vts
Product : Fedora 42
Version : 0.2.4
Release : 4.fc42
URL : https://github.com/vozlt/nginx-module-vts
Summary : Nginx virtual host traffic status module
Description :
Nginx virtual host traffic status module.
--------------------------------------------------------------------------------
Update Information:
Changes with nginx 1.28.1 23 Dec 2025
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
*) Bugfix: a segmentation fault might occur in a worker process if the
"try_files" directive and "proxy_pass" with a URI were used.
*) Bugfix: in handling "Host" and ":authority" header lines with equal
values when using HTTP/2; the bug had appeared in 1.17.9.
*) Bugfix: in handling "Host" header lines with a port when using
HTTP/3.
*) Bugfix: an XCLIENT command didn't use the xtext encoding.
Thanks to Igor Morgenstern of Aisle Research.
*) Bugfix: in SSL certificate caching during reconfiguration.
*) Bugfix: in delta-seconds processing in the "Cache-Control" backend
response header line.
*) Change: the native nginx/Windows binary release is now built using
Windows SDK 10.
*) Bugfix: nginx could not be built on NetBSD 10.0.
*) Bugfix: in HTTP/3.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Dec 26 2025 Felix Kaechele [felix@kaechele.ca] - 0.2.4-4
- Rebuild for 1.28.1
* Thu Jul 24 2025 Fedora Release Engineering [releng@fedoraproject.org] - 0.2.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-8caa129b2e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 42 Update: nginx-1.28.1-1.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-8caa129b2e
2026-01-04 01:00:12.006176+00:00
--------------------------------------------------------------------------------
Name : nginx
Product : Fedora 42
Version : 1.28.1
Release : 1.fc42
URL : https://nginx.org
Summary : A high performance web server and reverse proxy server
Description :
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and
IMAP protocols, with a strong focus on high concurrency, performance and low
memory usage.
--------------------------------------------------------------------------------
Update Information:
Changes with nginx 1.28.1 23 Dec 2025
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
*) Bugfix: a segmentation fault might occur in a worker process if the
"try_files" directive and "proxy_pass" with a URI were used.
*) Bugfix: in handling "Host" and ":authority" header lines with equal
values when using HTTP/2; the bug had appeared in 1.17.9.
*) Bugfix: in handling "Host" header lines with a port when using
HTTP/3.
*) Bugfix: an XCLIENT command didn't use the xtext encoding.
Thanks to Igor Morgenstern of Aisle Research.
*) Bugfix: in SSL certificate caching during reconfiguration.
*) Bugfix: in delta-seconds processing in the "Cache-Control" backend
response header line.
*) Change: the native nginx/Windows binary release is now built using
Windows SDK 10.
*) Bugfix: nginx could not be built on NetBSD 10.0.
*) Bugfix: in HTTP/3.
--------------------------------------------------------------------------------
ChangeLog:
* Wed Dec 24 2025 Felix Kaechele [felix@kaechele.ca] - 2:1.28.1-1
- update to 1.28.1
* Thu Nov 20 2025 Lubo?? Uhliarik [luhliari@redhat.com] - 2:1.28.0-5
- Remove 50x.html from the nginx-core package
* Tue Sep 16 2025 Lubo?? Uhliarik [luhliari@redhat.com] - 2:1.28.0-4
- Add tmpfiles.d rules for /var directories (bootc compatibility)
* Thu Jul 24 2025 Fedora Release Engineering [releng@fedoraproject.org] - 2:1.28.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-8caa129b2e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 42 Update: nginx-mod-modsecurity-1.0.4-5.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-8caa129b2e
2026-01-04 01:00:12.006176+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-modsecurity
Product : Fedora 42
Version : 1.0.4
Release : 5.fc42
URL : https://github.com/SpiderLabs/ModSecurity-nginx
Summary : ModSecurity v3 nginx connector
Description :
The ModSecurity-nginx connector is the connection point between nginx and
libmodsecurity (ModSecurity v3). Said another way, this project provides a
communication channel between nginx and libmodsecurity. This connector is
required to use LibModSecurity with nginx.
The ModSecurity-nginx connector takes the form of an nginx module. The module
simply serves as a layer of communication between nginx and ModSecurity
--------------------------------------------------------------------------------
Update Information:
Changes with nginx 1.28.1 23 Dec 2025
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
*) Bugfix: a segmentation fault might occur in a worker process if the
"try_files" directive and "proxy_pass" with a URI were used.
*) Bugfix: in handling "Host" and ":authority" header lines with equal
values when using HTTP/2; the bug had appeared in 1.17.9.
*) Bugfix: in handling "Host" header lines with a port when using
HTTP/3.
*) Bugfix: an XCLIENT command didn't use the xtext encoding.
Thanks to Igor Morgenstern of Aisle Research.
*) Bugfix: in SSL certificate caching during reconfiguration.
*) Bugfix: in delta-seconds processing in the "Cache-Control" backend
response header line.
*) Change: the native nginx/Windows binary release is now built using
Windows SDK 10.
*) Bugfix: nginx could not be built on NetBSD 10.0.
*) Bugfix: in HTTP/3.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Dec 26 2025 Felix Kaechele [felix@kaechele.ca] - 1.0.4-5
- Rebuild for 1.28.1
* Fri Sep 5 2025 Mikel Olasagasti Uranga [mikel@olasagasti.info] - 1.0.4-4
- Use pcre2-devel
* Thu Jul 24 2025 Fedora Release Engineering [releng@fedoraproject.org] - 1.0.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-8caa129b2e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 42 Update: nginx-mod-brotli-1.0.0~rc-4.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-8caa129b2e
2026-01-04 01:00:12.006176+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-brotli
Product : Fedora 42
Version : 1.0.0~rc
Release : 4.fc42
URL : https://github.com/google/ngx_brotli
Summary : NGINX module for Brotli compression
Description :
NGINX module for Brotli compression.
--------------------------------------------------------------------------------
Update Information:
Changes with nginx 1.28.1 23 Dec 2025
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
*) Bugfix: a segmentation fault might occur in a worker process if the
"try_files" directive and "proxy_pass" with a URI were used.
*) Bugfix: in handling "Host" and ":authority" header lines with equal
values when using HTTP/2; the bug had appeared in 1.17.9.
*) Bugfix: in handling "Host" header lines with a port when using
HTTP/3.
*) Bugfix: an XCLIENT command didn't use the xtext encoding.
Thanks to Igor Morgenstern of Aisle Research.
*) Bugfix: in SSL certificate caching during reconfiguration.
*) Bugfix: in delta-seconds processing in the "Cache-Control" backend
response header line.
*) Change: the native nginx/Windows binary release is now built using
Windows SDK 10.
*) Bugfix: nginx could not be built on NetBSD 10.0.
*) Bugfix: in HTTP/3.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Dec 26 2025 Felix Kaechele [felix@kaechele.ca] - 1.0.0~rc-4
- Rebuild for 1.28.1
* Thu Jul 24 2025 Fedora Release Engineering [releng@fedoraproject.org] - 1.0.0~rc-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-8caa129b2e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 42 Update: nginx-mod-fancyindex-0.5.2-13.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-8caa129b2e
2026-01-04 01:00:12.006176+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-fancyindex
Product : Fedora 42
Version : 0.5.2
Release : 13.fc42
URL : https://github.com/aperezdc/ngx-fancyindex
Summary : Nginx FancyIndex module
Description :
The Fancy Index module makes possible the generation of file listings,
like the built-in autoindex module does, but adding a touch of style.
This is possible because the module allows a certain degree of
customization of the generated content:
* Custom headers. Either local or stored remotely.
* Custom footers. Either local or stored remotely.
* Add you own CSS style rules.
* Allow choosing to sort elements by name (default),
modification time, or size; both ascending (default),
or descending.
--------------------------------------------------------------------------------
Update Information:
Changes with nginx 1.28.1 23 Dec 2025
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
*) Bugfix: a segmentation fault might occur in a worker process if the
"try_files" directive and "proxy_pass" with a URI were used.
*) Bugfix: in handling "Host" and ":authority" header lines with equal
values when using HTTP/2; the bug had appeared in 1.17.9.
*) Bugfix: in handling "Host" header lines with a port when using
HTTP/3.
*) Bugfix: an XCLIENT command didn't use the xtext encoding.
Thanks to Igor Morgenstern of Aisle Research.
*) Bugfix: in SSL certificate caching during reconfiguration.
*) Bugfix: in delta-seconds processing in the "Cache-Control" backend
response header line.
*) Change: the native nginx/Windows binary release is now built using
Windows SDK 10.
*) Bugfix: nginx could not be built on NetBSD 10.0.
*) Bugfix: in HTTP/3.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Dec 26 2025 Felix Kaechele [felix@kaechele.ca] - 0.5.2-13
- Rebuild for 1.28.1
* Thu Jul 24 2025 Fedora Release Engineering [releng@fedoraproject.org] - 0.5.2-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-8caa129b2e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 43 Update: grpcurl-1.9.3-6.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-7da33c2d62
2026-01-04 00:48:37.722157+00:00
--------------------------------------------------------------------------------
Name : grpcurl
Product : Fedora 43
Version : 1.9.3
Release : 6.fc43
URL : https://github.com/fullstorydev/grpcurl
Summary : Like cURL, but for gRPC: Command-line tool for interacting with gRPC servers
Description :
Like cURL, but for gRPC: Command-line tool for interacting with gRPC servers.
--------------------------------------------------------------------------------
Update Information:
Fix version ldflag for #2424534
--------------------------------------------------------------------------------
ChangeLog:
* Mon Dec 29 2025 Mikel Olasagasti Uranga [mikel@olasagasti.info] - 1.9.3-6
- Fix version ldflag - Closes rhbz#2424534
* Fri Oct 10 2025 Alejandro S??ez [asm@redhat.com] - 1.9.3-5
- rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2408296 - CVE-2025-58189 grpcurl: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2408296
[ 2 ] Bug #2408718 - CVE-2025-61725 grpcurl: Excessive CPU consumption in ParseAddress in net/mail [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2408718
[ 3 ] Bug #2409769 - CVE-2025-61723 grpcurl: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2409769
[ 4 ] Bug #2410719 - CVE-2025-58185 grpcurl: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2410719
[ 5 ] Bug #2411615 - CVE-2025-58188 grpcurl: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2411615
[ 6 ] Bug #2424534 - -version returns no version
https://bugzilla.redhat.com/show_bug.cgi?id=2424534
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-7da33c2d62' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 43 Update: gitleaks-8.30.0-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-55bf0b6949
2026-01-04 00:48:37.722152+00:00
--------------------------------------------------------------------------------
Name : gitleaks
Product : Fedora 43
Version : 8.30.0
Release : 1.fc43
URL : https://github.com/zricethezav/gitleaks
Summary : Scan git repos (or files) for secrets using regex and entropy
Description :
Scan git repos (or files) for secrets using regex and entropy.
--------------------------------------------------------------------------------
Update Information:
Update to 8.30.0
--------------------------------------------------------------------------------
ChangeLog:
* Mon Dec 29 2025 Mikel Olasagasti Uranga [mikel@olasagasti.info] - 8.30.0-1
- Update to 8.30.0 - Closes rhbz#2417325
* Thu Nov 20 2025 Mikel Olasagasti Uranga [mikel@olasagasti.info] - 8.29.1-3
- Update packit config
* Thu Nov 20 2025 Mikel Olasagasti Uranga [mikel@olasagasti.info] - 8.29.1-2
- Correct version LDFLAG
* Wed Nov 19 2025 Packit [hello@packit.dev] - 8.29.1-1
- Update to 8.29.1 upstream release
- Resolves: rhbz#2416007
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2411492 - CVE-2025-58188 gitleaks: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2411492
[ 2 ] Bug #2412689 - CVE-2025-58183 gitleaks: Unbounded allocation when parsing GNU sparse map [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2412689
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-55bf0b6949' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 43 Update: doctl-1.148.0-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-714a42ffeb
2026-01-04 00:48:37.722154+00:00
--------------------------------------------------------------------------------
Name : doctl
Product : Fedora 43
Version : 1.148.0
Release : 1.fc43
URL : https://github.com/digitalocean/doctl
Summary : The official command line interface for the DigitalOcean API
Description :
The official command line interface for the DigitalOcean API.
--------------------------------------------------------------------------------
Update Information:
Update to 1.148.0
--------------------------------------------------------------------------------
ChangeLog:
* Mon Dec 29 2025 Mikel Olasagasti Uranga [mikel@olasagasti.info] - 1.148.0-1
- Update to 1.148.0 - Closes rhbz#2397308
* Fri Oct 10 2025 Alejandro S??ez [asm@redhat.com] - 1.142.0-2
- rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2408160 - CVE-2025-58189 doctl: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2408160
[ 2 ] Bug #2409630 - CVE-2025-61723 doctl: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2409630
[ 3 ] Bug #2410581 - CVE-2025-58185 doctl: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2410581
[ 4 ] Bug #2411479 - CVE-2025-58188 doctl: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2411479
[ 5 ] Bug #2412684 - CVE-2025-58183 doctl: Unbounded allocation when parsing GNU sparse map [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2412684
[ 6 ] Bug #2419035 - CVE-2024-25621 doctl: containerd local privilege escalation [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2419035
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-714a42ffeb' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
