Fedora 41 Update: perl-Crypt-CBC-3.07-1.fc41
Fedora 41 Update: unbound-1.23.1-1.fc41
Fedora 42 Update: perl-Crypt-CBC-3.07-1.fc42
[SECURITY] Fedora 41 Update: perl-Crypt-CBC-3.07-1.fc41
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-1d22f55c40
2025-08-06 01:55:23.021319+00:00
--------------------------------------------------------------------------------
Name : perl-Crypt-CBC
Product : Fedora 41
Version : 3.07
Release : 1.fc41
URL : https://metacpan.org/release/Crypt-CBC
Summary : Encrypt Data with Cipher Block Chaining Mode
Description :
This is Crypt::CBC, a Perl-only implementation of the cryptographic
cipher block chaining mode (CBC). In combination with a block cipher
such as Crypt::DES or Crypt::IDEA, you can encrypt and decrypt
messages of arbitrarily long length. The encrypted messages are
compatible with the encryption format used by SSLeay.
--------------------------------------------------------------------------------
Update Information:
This update, to the current upstream release version, includes a fix to source
random numbers using the Crypt::URandom module rather than trying to read
/dev/urandom and falling back to Perl's insecure rand() function if /dev/urandom
is not usable (CVE-2025-2814).
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jul 28 2025 Paul Howarth - 3.07-1
- Update to 3.07 (rhbz#2383870)
- New upstream maintainer
- Fix CVE-2025-2814 by using Crypt::URandom
- Fix decryption of ciphertext created with 'header' => 'randomiv'
- Fixed bug in which manually-specified key and -pkdf=>"none" was not having
any effect
- Converted build process to Dist::Zilla
- Miscellaneous minor Dist::Zilla related changes
- Switch upstream source URL from cpan.metacpan.org to www.cpan.org to skip a
redirect
- Package new LICENSE, SECURITY.md and vulnerabilities.txt files
* Fri Jul 25 2025 Fedora Release Engineering [releng@fedoraproject.org] - 3.04-18
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Sat Jan 18 2025 Fedora Release Engineering [releng@fedoraproject.org] - 3.04-17
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2359385 - CVE-2025-2814 perl-Crypt-CBC: Crypt::CBC versions between 1.21 and 3.04 for Perl may use insecure rand() function for cryptographic functions [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2359385
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-1d22f55c40' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 41 Update: unbound-1.23.1-1.fc41
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-e262093d58
2025-08-06 01:55:23.021300+00:00
--------------------------------------------------------------------------------
Name : unbound
Product : Fedora 41
Version : 1.23.1
Release : 1.fc41
URL : https://nlnetlabs.nl/projects/unbound/
Summary : Validating, recursive, and caching DNS(SEC) resolver
Description :
Unbound is a validating, recursive, and caching DNS(SEC) resolver.
The C implementation of Unbound is developed and maintained by NLnet
Labs. It is based on ideas and algorithms taken from a java prototype
developed by Verisign labs, Nominet, Kirei and ep.net.
Unbound is designed as a set of modular components, so that also
DNSSEC (secure DNS) validation and stub-resolvers (that do not run
as a server, but are linked into an application) are easily possible.
--------------------------------------------------------------------------------
Update Information:
Update to 1.23.1 (rhbz#2380450)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jul 21 2025 Tomas Korbar [tkorbar@redhat.com] - 1.23.1-1
- Update to 1.23.1 (rhbz#2380450)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2381425 - CVE-2025-5994 unbound: Unbound Cache poisoning [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2381425
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-e262093d58' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 42 Update: perl-Crypt-CBC-3.07-1.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-f7bc7b789f
2025-08-06 01:35:39.776296+00:00
--------------------------------------------------------------------------------
Name : perl-Crypt-CBC
Product : Fedora 42
Version : 3.07
Release : 1.fc42
URL : https://metacpan.org/release/Crypt-CBC
Summary : Encrypt Data with Cipher Block Chaining Mode
Description :
This is Crypt::CBC, a Perl-only implementation of the cryptographic
cipher block chaining mode (CBC). In combination with a block cipher
such as Crypt::DES or Crypt::IDEA, you can encrypt and decrypt
messages of arbitrarily long length. The encrypted messages are
compatible with the encryption format used by SSLeay.
--------------------------------------------------------------------------------
Update Information:
This update, to the current upstream release version, includes a fix to source
random numbers using the Crypt::URandom module rather than trying to read
/dev/urandom and falling back to Perl's insecure rand() function if /dev/urandom
is not usable (CVE-2025-2814).
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jul 28 2025 Paul Howarth - 3.07-1
- Update to 3.07 (rhbz#2383870)
- New upstream maintainer
- Fix CVE-2025-2814 by using Crypt::URandom
- Fix decryption of ciphertext created with 'header' => 'randomiv'
- Fixed bug in which manually-specified key and -pkdf=>"none" was not having
any effect
- Converted build process to Dist::Zilla
- Miscellaneous minor Dist::Zilla related changes
- Switch upstream source URL from cpan.metacpan.org to www.cpan.org to skip a
redirect
- Package new LICENSE, SECURITY.md and vulnerabilities.txt files
* Fri Jul 25 2025 Fedora Release Engineering [releng@fedoraproject.org] - 3.04-18
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2359384 - CVE-2025-2814 perl-Crypt-CBC: Crypt::CBC versions between 1.21 and 3.04 for Perl may use insecure rand() function for cryptographic functions [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2359384
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-f7bc7b789f' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
