Fedora 44 Update: libssh-0.12.2-1.fc44
Fedora 44 Update: unbound-1.25.2-1.fc44
Fedora 44 Update: proftpd-1.3.9c-3.fc44
Fedora 44 Update: squid-7.6-1.fc44
Fedora 44 Update: nodejs24-24.18.0-1.fc44
Fedora 44 Update: wordpress-6.9.5-1.fc44
Fedora 43 Update: proftpd-1.3.9c-3.fc43
Fedora 43 Update: wordpress-6.9.5-1.fc43
Fedora 43 Update: nginx-mod-fancyindex-0.6.0-8.fc43
Fedora 43 Update: nginx-mod-vts-0.2.4-13.fc43
Fedora 43 Update: nginx-mod-modsecurity-1.0.4-16.fc43
Fedora 43 Update: nginx-mod-brotli-1.0.0~rc-13.fc43
Fedora 43 Update: nginx-1.30.4-1.fc43
Fedora 43 Update: nginx-mod-naxsi-1.6-21.fc43
Fedora 43 Update: nginx-mod-headers-more-0.40-3.fc43
Fedora 43 Update: perl-HTTP-Date-6.08-1.fc43
[SECURITY] Fedora 44 Update: libssh-0.12.2-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-c60881e04b
2026-07-30 01:13:56.238311+00:00
--------------------------------------------------------------------------------
Name : libssh
Product : Fedora 44
Version : 0.12.2
Release : 1.fc44
URL : http://www.libssh.org
Summary : A library implementing the SSH protocol
Description :
The ssh library was designed to be used by programmers needing a working SSH
implementation by the mean of a library. The complete control of the client is
made by the programmer. With libssh, you can remotely execute programs, transfer
files, use a secure and transparent tunnel for your remote programs. With its
Secure FTP implementation, you can play with remote files easily, without
third-party programs others than libcrypto (from openssl).
--------------------------------------------------------------------------------
Update Information:
New upstream release 0.12.2
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 28 2026 Jakub Jelen [jjelen@redhat.com] - 0.12.2-1
- New upstream release 0.12.2
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-c60881e04b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: unbound-1.25.2-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-e495bd59ef
2026-07-30 01:13:56.238297+00:00
--------------------------------------------------------------------------------
Name : unbound
Product : Fedora 44
Version : 1.25.2
Release : 1.fc44
URL : https://nlnetlabs.nl/projects/unbound/
Summary : Validating, recursive, and caching DNS(SEC) resolver
Description :
Unbound is a validating, recursive, and caching DNS(SEC) resolver.
The C implementation of Unbound is developed and maintained by NLnet
Labs. It is based on ideas and algorithms taken from a java prototype
developed by Verisign labs, Nominet, Kirei and ep.net.
Unbound is designed as a set of modular components, so that also
DNSSEC (secure DNS) validation and stub-resolvers (that do not run
as a server, but are linked into an application) are easily possible.
--------------------------------------------------------------------------------
Update Information:
Update to 1.25.2 (rhbz#2506061)
Security fixes:
Fix CVE-2026-14586, Assertion in libngtcp2 when under pressure in high
concurrency DNS-over-QUIC environments. Thanks to Kunta Chu, Kaihua Wang, and
Jianjun Chen from Tsinghua University, for the report.
Fix CVE-2026-32665, Remote DNS-over-QUIC denial of service due to quic-size
budget bypass. Thanks to N0zoM1z0 ( https://github.com/N0zoM1z0) for the report.
In addition, thanks to Kunta Chu, Kaihua Wang, and Jianjun Chen from Tsinghua
University, for also reporting this issue. In addition, thanks to Qifan Zhang,
Palo Alto Networks, for also reporting this issue. In addition, thanks to
Xuanchao Xie, for also reporting this issue.
Fix CVE-2026-40691, Packet of death for DNSCrypt over TCP. Thanks to Qifan
Zhang, Palo Alto Networks, for the report. In addition, thanks to Trung Nguyen
(@everping) of CyStack, for also reporting this issue.
Fix CVE-2026-41637, Degradation of resolution service from improperly accounted
client-terminated DNS-over-QUIC queries. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix CVE-2026-42955, Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA
records disallowing a one-time 'ghost domain' delegation renewal via glue
records. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-44621, Libunbound applications configured with 'unwanted-reply-
threshold' could eventually be abruptly terminated. Thanks to Qifan Zhang, Palo
Alto Networks, for the report.
Fix CVE-2026-44687, Off-by-one error in 'harden-below-nxdomain' logic can shadow
a stub/forward zone by a legitimate parent's NXDOMAIN. Thanks to Qifan Zhang,
Palo Alto Networks, for the report.
Fix CVE-2026-44690, Cross-zone wildcard cache poisoning via RRSIG.labels
manipulation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-46582, A wildcard replay, as another piece of data, triggers
poisoning in the serve expired reply path. Thanks to Qifan Zhang, Palo Alto
Networks, for the report.
Fix CVE-2026-50045, 'max-global-quota' reset by DNSSEC validation restarts.
Thanks to Kunjie Shang, University of Science and Technology of China, for the
report.
Fix CVE-2026-50046, Possible heap use-after-free in an error path when a DoT
forwarded query is jostled out. Thanks to Qifan Zhang, Palo Alto Networks, for
the report.
Fix CVE-2026-50243, 'response-ip'/'rpz' can rewrite BOGUS answers instead of
returning SERVFAIL. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-50248, BOGUS configured primary hostname accepted for XFR in
auth/rpz zones. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-50251, Attacker supplied 0.0.0.0/:: glue triggers defensive full-
cache flush. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-50252, Possible cache poisoning attack by mapping source port
population per thread. Thanks to Inbal Schussheim and Amit Klein, Hebrew
University, for the report.
Fix CVE-2026-52863, Memory corruption could lead to crash and denial of service.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-54478, DNS Cookie bypass when combined with proxy-protocol use.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-55708, Privacy/configuration issue when adding local data in views
through 'unbound-control'. Thanks to Qifan Zhang, Palo Alto Networks, for the
report.
Fix CVE-2026-55717, 'serve-expired-client-timeout' and 'response-ip' CNAME
redirect could lead to a crash. Thanks to Qifan Zhang, Palo Alto Networks, for
the report. In addition, thanks to Xin Wang, Jiapeng Li, and Jiajia Liu,
Northwestern Polytechnical University, for also reporting this issue.
Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to stack buffer overflow.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-55990, Packet of death for a DNSCrypt misconfigured Unbound. Thanks
to Qifan Zhang, Palo Alto Networks, for the report.
Fix CVE-2026-55991, Remote DNS-over-QUIC (DoQ) flow-control assertion failure in
libngtcp2. Thanks to Qifan Zhang, Palo Alto Networks, for the report. In
addition, thanks to Xuanchao Xie, for also reporting this issue.
Fix CVE-2026-56416, Possible heap buffer overflow when validator canonicalizes
RDATA that contains domain name. Thanks to Qifan Zhang, Palo Alto Networks, for
the report.
Fix CVE-2026-56444, Degradation of resolution service when 'discard-timeout' and
'serve-expired-client-timeout' are combined in unusual configuration. Thanks to
Qifan Zhang, Palo Alto Networks, for the report. In addition, thanks to Xin
Wang, Jiapeng Li, and Jiajia Liu, Northwestern Polytechnical University, for
also reporting this issue. In addition, thanks to Haruki Oyama (Waseda
University), for also reporting this issue.
Source: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jul 27 2026 Fedor Vorobev [fvorobev@redhat.com] - 1.25.2-1
- Update to 1.25.2 (rhbz#2506061)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2491434 - CVE-2026-44390 unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2491434
[ 2 ] Bug #2491795 - CVE-2026-42534 unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2491795
[ 3 ] Bug #2491930 - CVE-2026-41292 unbound: Unbound: Denial of Service via excessive EDNS options [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2491930
[ 4 ] Bug #2491933 - CVE-2026-41292 unbound: Unbound: Denial of Service via excessive EDNS options [fedora-44]
https://bugzilla.redhat.com/show_bug.cgi?id=2491933
[ 5 ] Bug #2506061 - unbound-1.25.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2506061
[ 6 ] Bug #2506178 - CVE-2026-40691 unbound: Unbound: Denial of Service via crafted DNSCrypt query [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2506178
[ 7 ] Bug #2506420 - CVE-2026-56416 unbound: Unbound: Heap buffer overflow via malformed DNSSEC record [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2506420
[ 8 ] Bug #2506834 - CVE-2026-14586 unbound: Unbound: Denial of Service via assertion failure in DNS-over-QUIC environments [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2506834
[ 9 ] Bug #2507425 - CVE-2026-55991 unbound: Unbound: Denial of Service via crafted DNS-over-QUIC connection [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2507425
[ 10 ] Bug #2507454 - CVE-2026-54478 unbound: Unbound: DNS Cookie security bypass via incorrect server cookie calculation [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2507454
[ 11 ] Bug #2507649 - CVE-2026-55973 unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2507649
[ 12 ] Bug #2507650 - CVE-2026-44690 unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2507650
[ 13 ] Bug #2507651 - CVE-2026-32665 unbound: Unbound: Denial of Service via improper validation of DNS-over-QUIC client length [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2507651
[ 14 ] Bug #2507955 - CVE-2026-50251 unbound: NLnet Labs Unbound: Denial of Service via crafted DNS glue records [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2507955
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-e495bd59ef' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: proftpd-1.3.9c-3.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-2994824419
2026-07-30 01:13:56.238288+00:00
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora 44
Version : 1.3.9c
Release : 3.fc44
URL : http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by systemd instead are included.
--------------------------------------------------------------------------------
Update Information:
This update adds a new module, mod_procfs, which is enabled by default. It
addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by
disallowing any file accesses via procfs filesystems.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 21 2026 Paul Howarth - 1.3.9c-3
- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
/proc/self/root path prefix); this module disallows file accesses via procfs
filesystems
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.3.9c-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2492208 - CVE-2026-35025 proftpd: ACL bypass via /proc/self/root path prefix in RNFR [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2492208
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-2994824419' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: squid-7.6-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-e6bbab8aa8
2026-07-30 01:13:56.238276+00:00
--------------------------------------------------------------------------------
Name : squid
Product : Fedora 44
Version : 7.6
Release : 1.fc44
URL : http://www.squid-cache.org
Summary : The Squid proxy caching server
Description :
Squid is a high-performance proxy caching server for Web clients,
supporting FTP and HTTP data objects. Unlike traditional
caching software, Squid handles all requests in a single,
non-blocking, I/O-driven process. Squid keeps meta data and especially
hot objects cached in RAM, caches DNS lookups, supports non-blocking
DNS lookups, and implements negative caching of failed requests.
Squid consists of a main server program squid, a Domain Name System
lookup program (dnsserver), a program for retrieving FTP data
(ftpget), and some management and client tools.
--------------------------------------------------------------------------------
Update Information:
new version 7.6
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 21 2026 Luboš Uhliarik [luhliari@redhat.com] - 7:7.6-1
- new version 7.6
* Fri Jul 17 2026 Fedora Release Engineering [releng@fedoraproject.org] - 7:7.5-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Fri Jun 12 2026 Yaakov Selkowitz [yselkowi@redhat.com] - 7:7.5-3
- Rebuilt for openssl 4.0
* Wed May 6 2026 Pavol Žáčik [pzacik@redhat.com] - 7:7.5-2
- Add patch to fix OpenSSL 4.0 compatibility
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2486184 - squid-7.6 is available
https://bugzilla.redhat.com/show_bug.cgi?id$86184
[ 2 ] Bug #2492994 - CVE-2026-47729 squid: memory disclosure in FTP gateway [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$92994
[ 3 ] Bug #2492995 - CVE-2026-50012 squid: memory corruption in cache_digest reply handling [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$92995
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-e6bbab8aa8' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 44 Update: nodejs24-24.18.0-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-ce5dac2ed8
2026-07-30 01:13:56.238228+00:00
--------------------------------------------------------------------------------
Name : nodejs24
Product : Fedora 44
Version : 24.18.0
Release : 1.fc44
URL : https://nodejs.org
Summary : JavaScript runtime
Description :
Node.js is a platform built on Chrome's JavaScript runtime
for easily building fast, scalable network applications.
Node.js uses an event-driven, non-blocking I/O model that
makes it lightweight and efficient, perfect for data-intensive
real-time applications that run across distributed devices.
--------------------------------------------------------------------------------
Update Information:
Update to version 24.18.0
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jul 9 2026 tjuhasz [tjuhasz@redhat.com] - 1:24.18.0-1
- Update to version 24.18.0 (rhbz#2480530)
* Mon Apr 20 2026 Jan Staněk [jstanek@redhat.com] - 1:24.15.0-1
- Update to version 24.15.0 (rhbz#2458897)
- Start reporting version of bundled nodejs-minimatch.
* Wed Mar 25 2026 Jan Staněk [jstanek@redhat.com] - 1:24.14.1-3
- Update bundled nghttp2 to 1.68.1
* Wed Mar 25 2026 Jan Staněk [jstanek@redhat.com] - 1:24.14.1-2
- cleanup: remove unused patches
* Wed Mar 25 2026 tjuhasz [tjuhasz@redhat.com] - 1:24.14.1-1
- Update to version 24.14.1 (rhbz#2442366)
* Mon Mar 23 2026 tjuhasz [tjuhasz@redhat.com] - 1:24.14.0-4
- Remove disablement of LTO from specfile
* Mon Mar 23 2026 Jan Staněk [jstanek@redhat.com] - 1:24.14.0-3
- Swap definition order for metadata fields
* Fri Mar 20 2026 Andrei Radchenko [aradchen@redhat.com] - 1:24.14.0-2
- test: add sub-plan covering -bin packages
- make metadata shared between sub-plans
* Fri Mar 6 2026 tjuhasz [tjuhasz@redhat.com] - 1:24.14.0-1
- Update to version 24.14.0 (rhbz#2442366).
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2442366 - nodejs24-24.14.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id$42366
[ 2 ] Bug #2458897 - nodejs24-24.15.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id$58897
[ 3 ] Bug #2487622 - CVE-2026-42338 nodejs24: ip-address: Cross-site scripting via improper HTML escaping of untrusted input [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$87622
[ 4 ] Bug #2490199 - CVE-2026-6734 nodejs24: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$90199
[ 5 ] Bug #2490202 - CVE-2026-9679 nodejs24: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$90202
[ 6 ] Bug #2490204 - CVE-2026-9697 nodejs24: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$90204
[ 7 ] Bug #2490206 - CVE-2026-11525 nodejs24: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$90206
[ 8 ] Bug #2490213 - CVE-2026-6733 nodejs24: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$90213
[ 9 ] Bug #2490218 - CVE-2026-9678 nodejs24: Undici: Information disclosure due to improper cache-control header parsing [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$90218
[ 10 ] Bug #2490224 - CVE-2026-12151 nodejs24: undici: Denial of Service due to unbounded memory growth via WebSocket frames [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$90224
[ 11 ] Bug #2493801 - CVE-2026-48933 nodejs24: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$93801
[ 12 ] Bug #2493810 - CVE-2026-48618 nodejs24: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$93810
[ 13 ] Bug #2493817 - CVE-2026-48936 nodejs24: Node.js: Local server can be started without network permission via Permission API flaw [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$93817
[ 14 ] Bug #2493818 - CVE-2026-48615 nodejs24: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$93818
[ 15 ] Bug #2493824 - CVE-2026-48928 nodejs24: Node.js: Trust-policy bypass due to hostname matching inconsistency [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$93824
[ 16 ] Bug #2493825 - CVE-2026-48934 nodejs24: Node.js: Certification validation bypass in TLS host verification [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$93825
[ 17 ] Bug #2493829 - CVE-2026-48935 nodejs24: Node.js: Unauthorized file metadata modification [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$93829
[ 18 ] Bug #2493831 - CVE-2026-48619 nodejs24: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$93831
[ 19 ] Bug #2493835 - CVE-2026-48930 nodejs24: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$93835
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-ce5dac2ed8' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 44 Update: wordpress-6.9.5-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-2b8250197a
2026-07-30 01:13:56.238215+00:00
--------------------------------------------------------------------------------
Name : wordpress
Product : Fedora 44
Version : 6.9.5
Release : 1.fc44
URL : https://wordpress.org/
Summary : Blog tool and publishing platform
Description :
Wordpress is an online publishing / weblog package that makes it very easy,
almost trivial, to get information out to people on the web.
Important information in /usr/share/doc/wordpress/README.fedora
--------------------------------------------------------------------------------
Update Information:
Version 6.9.5
Security updates
A facilitated SQL injection issue
A REST API batch-route confusion and SQL injection issue leading to Remote Code
Execution
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 21 2026 Remi Collet [remi@remirepo.net] - 6.9.5-1
- WordPress 6.9.5 Security Release
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-2b8250197a' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: proftpd-1.3.9c-3.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-d314ce6051
2026-07-30 00:59:32.960163+00:00
--------------------------------------------------------------------------------
Name : proftpd
Product : Fedora 43
Version : 1.3.9c
Release : 3.fc43
URL : http://www.proftpd.org/
Summary : Flexible, stable and highly-configurable FTP server
Description :
ProFTPD is an enhanced FTP server with a focus toward simplicity, security,
and ease of configuration. It features a very Apache-like configuration
syntax, and a highly customizable server infrastructure, including support for
multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory
visibility.
This package defaults to the standalone behavior of ProFTPD, but all the
needed scripts to have it run by systemd instead are included.
--------------------------------------------------------------------------------
Update Information:
This update adds a new module, mod_procfs, which is enabled by default. It
addressses CVE-2026-35025 (ACL bypass via /proc/self/root path prefix), by
disallowing any file accesses via procfs filesystems.
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 21 2026 Paul Howarth - 1.3.9c-3
- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
/proc/self/root path prefix); this module disallows file accesses via procfs
filesystems
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.3.9c-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2492208 - CVE-2026-35025 proftpd: ACL bypass via /proc/self/root path prefix in RNFR [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2492208
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-d314ce6051' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: wordpress-6.9.5-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-46346e9637
2026-07-30 00:59:32.960081+00:00
--------------------------------------------------------------------------------
Name : wordpress
Product : Fedora 43
Version : 6.9.5
Release : 1.fc43
URL : https://wordpress.org/
Summary : Blog tool and publishing platform
Description :
Wordpress is an online publishing / weblog package that makes it very easy,
almost trivial, to get information out to people on the web.
Important information in /usr/share/doc/wordpress/README.fedora
--------------------------------------------------------------------------------
Update Information:
Version 6.9.5
Security updates
A facilitated SQL injection issue
A REST API batch-route confusion and SQL injection issue leading to Remote Code
Execution
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 21 2026 Remi Collet [remi@remirepo.net] - 6.9.5-1
- WordPress 6.9.5 Security Release
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-46346e9637' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: nginx-mod-fancyindex-0.6.0-8.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-3b93aae2d6
2026-07-30 00:59:32.960071+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-fancyindex
Product : Fedora 43
Version : 0.6.0
Release : 8.fc43
URL : https://github.com/aperezdc/ngx-fancyindex
Summary : Nginx FancyIndex module
Description :
The Fancy Index module makes possible the generation of file listings,
like the built-in autoindex module does, but adding a touch of style.
This is possible because the module allows a certain degree of
customization of the generated content:
* Custom headers. Either local or stored remotely.
* Custom footers. Either local or stored remotely.
* Add you own CSS style rules.
* Allow choosing to sort elements by name (default),
modification time, or size; both ascending (default),
or descending.
--------------------------------------------------------------------------------
Update Information:
nginx-mod-vts:
Rebuild for 1.30.4
nginx-mod-brotli:
Rebuild for 1.30.4
nginx-mod-fancyindex:
Rebuild for 1.30.4
nginx-mod-headers-more:
Rebuild for 1.30.4
nginx-mod-modsecurity:
Rebuild for 1.30.4
nginx-mod-naxsi:
Rebuild for 1.30.4
nginx:
update to 1.30.4
fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jul 19 2026 Felix Kaechele [felix@kaechele.ca] - 0.6.0-8
- Rebuild for 1.30.4
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 0.6.0-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-3b93aae2d6' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: nginx-mod-vts-0.2.4-13.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-3b93aae2d6
2026-07-30 00:59:32.960071+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-vts
Product : Fedora 43
Version : 0.2.4
Release : 13.fc43
URL : https://github.com/vozlt/nginx-module-vts
Summary : Nginx virtual host traffic status module
Description :
Nginx virtual host traffic status module.
--------------------------------------------------------------------------------
Update Information:
nginx-mod-vts:
Rebuild for 1.30.4
nginx-mod-brotli:
Rebuild for 1.30.4
nginx-mod-fancyindex:
Rebuild for 1.30.4
nginx-mod-headers-more:
Rebuild for 1.30.4
nginx-mod-modsecurity:
Rebuild for 1.30.4
nginx-mod-naxsi:
Rebuild for 1.30.4
nginx:
update to 1.30.4
fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jul 19 2026 Felix Kaechele [felix@kaechele.ca] - 0.2.4-13
- Rebuild for 1.30.4
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 0.2.4-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-3b93aae2d6' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: nginx-mod-modsecurity-1.0.4-16.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-3b93aae2d6
2026-07-30 00:59:32.960071+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-modsecurity
Product : Fedora 43
Version : 1.0.4
Release : 16.fc43
URL : https://github.com/SpiderLabs/ModSecurity-nginx
Summary : ModSecurity v3 nginx connector
Description :
The ModSecurity-nginx connector is the connection point between nginx and
libmodsecurity (ModSecurity v3). Said another way, this project provides a
communication channel between nginx and libmodsecurity. This connector is
required to use LibModSecurity with nginx.
The ModSecurity-nginx connector takes the form of an nginx module. The module
simply serves as a layer of communication between nginx and ModSecurity
--------------------------------------------------------------------------------
Update Information:
nginx-mod-vts:
Rebuild for 1.30.4
nginx-mod-brotli:
Rebuild for 1.30.4
nginx-mod-fancyindex:
Rebuild for 1.30.4
nginx-mod-headers-more:
Rebuild for 1.30.4
nginx-mod-modsecurity:
Rebuild for 1.30.4
nginx-mod-naxsi:
Rebuild for 1.30.4
nginx:
update to 1.30.4
fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jul 19 2026 Felix Kaechele [felix@kaechele.ca] - 1.0.4-16
- Rebuild for 1.30.4
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.0.4-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Wed Jul 8 2026 Joe Orton [jorton@redhat.com] - 1.0.4-14
- Rebuild.
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-3b93aae2d6' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: nginx-mod-brotli-1.0.0~rc-13.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-3b93aae2d6
2026-07-30 00:59:32.960071+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-brotli
Product : Fedora 43
Version : 1.0.0~rc
Release : 13.fc43
URL : https://github.com/google/ngx_brotli
Summary : NGINX module for Brotli compression
Description :
NGINX module for Brotli compression.
--------------------------------------------------------------------------------
Update Information:
nginx-mod-vts:
Rebuild for 1.30.4
nginx-mod-brotli:
Rebuild for 1.30.4
nginx-mod-fancyindex:
Rebuild for 1.30.4
nginx-mod-headers-more:
Rebuild for 1.30.4
nginx-mod-modsecurity:
Rebuild for 1.30.4
nginx-mod-naxsi:
Rebuild for 1.30.4
nginx:
update to 1.30.4
fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jul 19 2026 Felix Kaechele [felix@kaechele.ca] - 1.0.0~rc-13
- Rebuild for 1.30.4
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.0.0~rc-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-3b93aae2d6' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: nginx-1.30.4-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-3b93aae2d6
2026-07-30 00:59:32.960071+00:00
--------------------------------------------------------------------------------
Name : nginx
Product : Fedora 43
Version : 1.30.4
Release : 1.fc43
URL : https://nginx.org
Summary : A high performance web server and reverse proxy server
Description :
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and
IMAP protocols, with a strong focus on high concurrency, performance and low
memory usage.
--------------------------------------------------------------------------------
Update Information:
nginx-mod-vts:
Rebuild for 1.30.4
nginx-mod-brotli:
Rebuild for 1.30.4
nginx-mod-fancyindex:
Rebuild for 1.30.4
nginx-mod-headers-more:
Rebuild for 1.30.4
nginx-mod-modsecurity:
Rebuild for 1.30.4
nginx-mod-naxsi:
Rebuild for 1.30.4
nginx:
update to 1.30.4
fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jul 19 2026 Felix Kaechele [felix@kaechele.ca] - 2:1.30.4-1
- update to 1.30.4
- fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 2:1.30.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-3b93aae2d6' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: nginx-mod-naxsi-1.6-21.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-3b93aae2d6
2026-07-30 00:59:32.960071+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-naxsi
Product : Fedora 43
Version : 1.6
Release : 21.fc43
URL : https://github.com/wargio/naxsi
Summary : nginx web application firewall module
Description :
naxsi is an nginx module that provides score based Web Application Firewall
(WAF) abilities in a highly granular fashion.
--------------------------------------------------------------------------------
Update Information:
nginx-mod-vts:
Rebuild for 1.30.4
nginx-mod-brotli:
Rebuild for 1.30.4
nginx-mod-fancyindex:
Rebuild for 1.30.4
nginx-mod-headers-more:
Rebuild for 1.30.4
nginx-mod-modsecurity:
Rebuild for 1.30.4
nginx-mod-naxsi:
Rebuild for 1.30.4
nginx:
update to 1.30.4
fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jul 19 2026 Felix Kaechele [felix@kaechele.ca] - 1.6-21
- Rebuild for 1.30.4
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.6-20
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-3b93aae2d6' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: nginx-mod-headers-more-0.40-3.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-3b93aae2d6
2026-07-30 00:59:32.960071+00:00
--------------------------------------------------------------------------------
Name : nginx-mod-headers-more
Product : Fedora 43
Version : 0.40
Release : 3.fc43
URL : https://github.com/openresty/headers-more-nginx-module
Summary : This module allows adding, setting, or clearing specified input/output headers
Description :
This module allows adding, setting, or clearing specified input/output headers.
This is an enhanced version of the standard headers module because it provides
more utilities like resetting or clearing "builtin headers" like Content-Type,
Content-Length, and Server.
--------------------------------------------------------------------------------
Update Information:
nginx-mod-vts:
Rebuild for 1.30.4
nginx-mod-brotli:
Rebuild for 1.30.4
nginx-mod-fancyindex:
Rebuild for 1.30.4
nginx-mod-headers-more:
Rebuild for 1.30.4
nginx-mod-modsecurity:
Rebuild for 1.30.4
nginx-mod-naxsi:
Rebuild for 1.30.4
nginx:
update to 1.30.4
fixes CVE-2026-42533, CVE-2026-60005, CVE-2026-56434
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jul 19 2026 Felix Kaechele [felix@kaechele.ca] - 0.40-3
- Rebuild for 1.30.4
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 0.40-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-3b93aae2d6' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: perl-HTTP-Date-6.08-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-b1bdb7c518
2026-07-30 00:59:32.960051+00:00
--------------------------------------------------------------------------------
Name : perl-HTTP-Date
Product : Fedora 43
Version : 6.08
Release : 1.fc43
URL : https://metacpan.org/release/HTTP-Date
Summary : Date conversion routines
Description :
This module provides functions that deal the date formats used by the HTTP
protocol (and then some more). Only the first two functions, time2str() and
str2time(), are exported by default.
--------------------------------------------------------------------------------
Update Information:
Changes:
6.08 2026-07-09 02:04:21Z
- [SECURITY] Reject input longer than 64 characters in parse_date()
to prevent quadratic regex backtracking (a denial of service) on
hostile date strings. Fixes CVE-2026-14741. (Olaf Alders)
6.07 2026-06-25 15:12:09Z
- Add test with Time::Zone (GH#25) (Michal Josef Špaček)
- Add test with bad Time::Zone string (GH#26) (Michal Josef Špaček)
- Add tests with negative time (GH#26) (Michal Josef Špaček)
- Replace all instances of \d with [0-9] in regular expressions to
reject non-ASCII Unicode digits, with a regression test (GH#27)
(Robert Rothenberg)
- Reject malformed ISO 8601 timezones with a doubled colon (GH#31)
(Olaf Alders)
- Document day/month/year ordering for numeric dates (GH#32) (Olaf
Alders)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jul 13 2026 Michal Josef Špaček [mspacek@redhat.com] - 6.08-1
- 6.08 bump
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2492991 - perl-HTTP-Date-6.08 is available
https://bugzilla.redhat.com/show_bug.cgi?id$92991
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-b1bdb7c518' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
