Update to latest upstream version.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade bundled urllib3 to 1.25.3, requests to 2.22.0. Security fix for CVE-2019-11324, CVE-2019-11236.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-19722: NULL pointer dereference in push notification driver

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Upgrade to upstream 3.5.2, still using golang-1.11 on epel8

----

Upgrade to upstream 3.5.1, use golang-1.11 on epel8

----

Upgrade to upstream 3.5.0

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-12098

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to latest release and include fix for CVE-2019-19630

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**WordPress 5.3.2 Maintenance Release**

Shortly after WordPress 5.3.1 was released, a couple of high severity Trac tickets were opened. The Core team scheduled this quick maintenance release to resolve these issues.

Main issues addressed in 5.3.2 :

  - Date/Time: Ensure that get_feed_build_date() correctly     handles a modified post object with invalid date.

  - Uploads: Fix file name collision in wp_unique_filename()     when uploading a file with upper case extension on non     case-sensitive file systems.

  - Media: Fix PHP warnings in wp_unique_filename() when the     destination directory is unreadable.

  - Administration: Fix the colors in all color schemes for     buttons with the .active class.

  - Posts, Post Types: In wp_insert_post(), when checking     the post date to set future or publish status, use a     proper delta comparison.

----

See: [WordPress 5.3.1 Security and Maintenance Release](https://wordpress.org/news/2019/12/wordpress-5-3-1-security-a nd-maintenance-release/)

**Four security issues** affect WordPress versions 5.3 and earlier;
version 5.3.1 fixes them, so you&rsquo;ll want to upgrade. If you haven&rsquo;t yet updated to 5.3, there are also updated versions of 5.2 and earlier that fix the security issues.

  - Props to Daniel Bachhuber for finding an issue where an     unprivileged user could make a post sticky via the REST     API.

  - Props to Simon Scannell of RIPS Technologies for finding     and disclosing an issue where cross-site scripting (XSS)     could be stored in well-crafted links.

  - Props to the WordPress.org Security Team for hardening     wp_kses_bad_protocol() to ensure that it is aware of the     named colon attribute.

  - Props to Nguyen The Duc for discovering a stored XSS     vulnerability using block editor content.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 3.4.3, with bugfixes and several security fixes.

See https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/annou ncements/3.4.3.txt for the full announcement.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- https://www.drupal.org/project/l10n_update/releases/7.x-2.3

    - https://www.drupal.org/sa-contrib-2019-072

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to new upstream version 3.0.13, which includes a fix for CVE-2019-19783 and other minor fixes. Release notes:
https://www.cyrusimap.org/imap/download/release-notes/3.0/x/3.0.13.htm l

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**PHP version 7.3.13** (18 Dec 2019)

**Bcmath:**

  - Fixed bug php#78878 (Buffer underflow in     bc_shift_addsub). (**CVE-2019-11046**). (cmb)

**Core:**

  - Fixed bug php#78862 (link() silently truncates after a     null byte on Windows). (**CVE-2019-11044**). (cmb)

  - Fixed bug php#78863 (DirectoryIterator class silently     truncates after a null byte). (**CVE-2019-11045**).
    (cmb)

  - Fixed bug php#78943 (mail() may release string with     refcount==1 twice). (**CVE-2019-11049**). (cmb)

  - Fixed bug php#78787 (Segfault with trait overriding     inherited private shadow property). (Nikita)

  - Fixed bug php#78868 (Calling __autoload() with incorrect     EG(fake_scope) value). (Antony Dovgal, Dmitry)

  - Fixed bug php#78296 (is_file fails to detect file).
    (cmb)

**EXIF:**

  - Fixed bug php#78793 (Use-after-free in exif parsing     under memory sanitizer). (**CVE-2019-11050**). (Nikita)

  - Fixed bug php#78910 (Heap-buffer-overflow READ in exif).
    (**CVE-2019-11047**). (Nikita)

**GD:**

  - Fixed bug php#78849 (GD build broken with -D     SIGNED_COMPARE_SLOW). (cmb)

**MBString:**

  - Upgraded bundled Oniguruma to 6.9.4. (cmb)

**OPcache:**

  - Fixed potential ASLR related invalid opline handler     issues. (cmb)

  - Fixed $x = (bool)$x; with opcache (should emit     undeclared variable notice). (Tyson Andre)

**PCRE:**

  - Fixed bug php#78853 (preg_match() may return integer >     1). (cmb)

**Standard:**

  - Fixed bug php#78759 (array_search in $GLOBALS). (Nikita)

  - Fixed bug php#77638 (var_export'ing certain class     instances segfaults). (cmb)

  - Fixed bug php#78840 (imploding $GLOBALS crashes). (cmb)

  - Fixed bug php#78833 (Integer overflow in pack causes     out-of-bound access). (cmb)

  - Fixed bug php#78814 (strip_tags allows / in tag name =>     whitelist bypass). (cmb)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is Python 3.8.1, the first maintenance release of Python 3.8. It contains security fixes as well as bugfixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- https://www.drupal.org/project/webform/releases/7.x-4.21

    - https://www.drupal.org/sa-contrib-2019-096

- https://www.drupal.org/project/webform/releases/7.x-4.20

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an early developer preview of Python 3.9, alpha 2. It contains security fixes as well as bugfixes and new features.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to NetHack 3.6.4 - fixes security issue with privilege escalation: http://nethack.org/security/index.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-13767.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

RPM notes :

  - All docs are now in `/usr/share/doc/drupal7/`

  - All licenses are now in `/usr/share/licenses/drupal7/`

  - Requires have been updated to include all     [phpcompatinfo](http://php5.laurent-laville.org/compatin     fo/) extension findings

### 7.69

Maintenance and security release of the Drupal 7 series.

This release fixes **security vulnerabilities**. Sites are **[urged to upgrade immediately](https://www.drupal.org/docs/7/update/introduction)** after reading the notes below and the security announcement :

  - [Drupal core - Critical - Multiple vulnerabilities -     SA-CORE-2019-012](https://www.drupal.org/sa-core-2019-01     2)

No other fixes are included.

#### Important update information

  - Drupal 7 includes a bundled version of the     pear/archive_tar project, the included version has been     updated from 1.4.5 to 1.4.9 in order to mitigate [Drupal     core - Critical - Multiple vulnerabilities -     SA-CORE-2019-012](https://www.drupal.org/sa-core-2019-01     2)

No changes have been made to the `.htaccess`, `web.config`, `robots.txt`, or default `settings.php` files in this release, so upgrading custom versions of those files is not necessary.

### 7.68

Maintenance release of the Drupal 7 series. Includes bug fixes and small API/feature improvements only (no major, non-backwards-compatible new functionality).

No security fixes are included in this release.

**This is the first release to fully support PHP 7.3. Please test and report any bugs in the issue queue.**

No changes have been made to robots.txt in this release, so upgrading custom versions of that file is not necessary.

However, changes have been made to .htaccess, web.config and sites/default/default.settings.php in this release.

The .htaccess and web.config changes are detailed in this Change Record :

  - Access to web.config is blocked in .htaccess (and     vice-versa): https://www.drupal.org/node/3098687

Upgrading custom versions of .htaccess and web.config to incorporate this change is recommended, but not required.

There is one change to the sites/default/default.settings.php file in this release, but the only change is to file permissions :

  - [Regression] Fix default.settings.php permission:
    https://www.drupal.org/node/3035772

#### Major changes since 7.67

  - Fully support PHP 7.3

  - drupal_http_request() accepts data as an array in Drupal     7

  - Access to web.config is blocked in .htaccess (and     vice-versa)

  - New 'scripts' element

  - theme_table() takes an optional footer variable and     produces <tfoot>

#### All changes since 7.67

  - \#3098664 by mcdruid: drupal_http_build_query() only     accepts arrays (followup to #3059391)

  - \#3097342 by mcdruid, Fabianx: Prepare Drupal 7.68     (CHANGELOG.txt)

  - \#3088938 by DamienMcKenna, webchick, mcdruid: Update     the D7 maintainers list

  - \#2902430 by stefanos.petrakis, joseph.olstad,     SergFromSD, kiamlaluno, Ayesh, mcdruid, alexpott: [PHP     7.1] A non-numeric value encountered in theme_pager()

  - \#2472025 by stupiddingo, stefanos.petrakis: [D7] Hide     toolbar when printing

  - \#2171113 by Pol, wiifm, mw4ll4c3, David_Rothstein,     douggreen, Fabianx: Settings returned via ajax are not     run through hook_js_alter()

  - \#3059391 by Liam Morland: Use drupal_http_build_query()     in drupal_http_request()

  - \#2966335 by mcdruid, dvandijk, David_Rothstein: Avoid     DrupalRequestSanitizer not found fatal error when     bootstrap phase order is changed

  - \#3025335 by mcdruid, mfb, joseph.olstad, Fabianx,     kiamlaluno, Pol: [PHP 7.3] Cannot change session id when     session is active

  - \#3055805 by mcdruid, greggles, Ayesh, Darren Oh,     David_Rothstein, sidharrell, pwolanin, mkalkbrenner,     Sweetchuck, YesCT: file.inc generated .htaccess does not     cover PHP 7

  - \#3047412 by mcdruid, Chi, beckydev, DKAN, alexpott,     sammuell, rabbitlair, longwave, greggles, interX: Block     web.config in .htaccess (and vice-versa)

  - \#3047844 by mfb, jordanwood, Taran2L: Fix test failures     on PHP 5.3

  - \#3088557: Add mcdruid as provisional Drupal 7 branch     maintainer

  - \#3051370 by Pol, markcarver, Fabianx: Create 'scripts'     element to align rendering workflow to how 'styles' are     handled

  - \#2814031 by Liam Morland: In drupal_http_request(),     allow passing data as array

  - \#1861604 by hefox, joseph.olstad, Sivaji, mgifford,     webchick: Skip module_invoke/module_hook in calling     hook_watchdog (excessive function_exist)

  - \#2666908 by iamEAP, cilefen: HTTP status 200 returned     for &rdquo;Additional uncaught exception thrown while     handling exception&rdquo;

  - \#1892654 by Pol, willvincent, Fabianx: D7 Backport:
    theme_table() should take an optional footer variable     and produce

  - \#3009351 by Pol, mfb, BrianLP: [PHP &ge; 7.2]     'session_id(): Cannot change session id'

  - \#2684337 by geoffray, Pol, jweowu, Fabianx: Warning:
    uasort() expects parameter 1 to be array, null given in     node_view_multiple()

  - \#3035772 by Pol: [Regression] Fix default.settings.php     permission

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to version 0.9.3 to address CVE-2019-14889

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

denial of service in find_next_bit() [XSA-307, CVE-2019-19581, CVE-2019-19582] (#1782211) denial of service in HVM/PVH guest userspace code [XSA-308, CVE-2019-19583] (#1782206) privilege escalation due to malicious PV guest [XSA-309, CVE-2019-19578] (#1782210) Further issues with restartable PV type change operations [XSA-310, CVE-2019-19580] (#1782207) vulnerability in dynamic height handling for AMD IOMMU pagetables [XSA-311, CVE-2019-19577] (#1782208)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Per the upstream release announcement&sup1;, this release fixes 'various security flaws, which allowed an attacker to overwrite arbitrary paths, remotely execute code, and/or overwrite files in the .git/ directory etc. See the release notes attached for the list for their descriptions and CVE identifiers.'

Refer to the 2.14.6 release notes&sup2; for details on these vulnerabilities.

&sup1;
https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com / &sup2;
https://www.kernel.org/pub/software/scm/git/docs/RelNotes/2.14.6.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.10.11, Security fixes for CVE-2019-14861 and CVE-2019-14870

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an early developer preview of Python 3.9, alpha 2. It contains security fixes as well as bugfixes and new features.

----

Build Python with -fno-semantic-interposition for better performance.
https://fedoraproject.org/wiki/Changes/PythonNoSemanticInterpositionSp eedup

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2019-18934 and misc other security items

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Drop patch fixing a corner case in BLS variable expansion since it may be causing issues

----

Fix a grub hidden-menu regression and a bug in blscfg variable expansion

----

Security fix for CVE-2019-14865

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 3.4.3, with bugfixes and several security fixes. 

See https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/annou ncements/3.4.3.txt for the full announcement.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 1.2.8

Release notes: https://www.cacti.net/release_notes.php?version=1.2.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Backport `-k` and `-a` options for `pathfix.py` to allow keeping and adding shebang flags.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-18397

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

bugfix release for CVE-2019-19118

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Rebase to version 1.0.101

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Per the upstream release announcement&sup1;, this release fixes 'various security flaws, which allowed an attacker to overwrite arbitrary paths, remotely execute code, and/or overwrite files in the .git/ directory etc. See the release notes attached for the list for their descriptions and CVE identifiers.'

Refer to the 2.14.6 release notes&sup2; for details on these vulnerabilities and the 2.24.0 release notes&sup3; for details on other improvements and fixes since 2.23.0.

&sup1;
https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com / &sup2;
https://www.kernel.org/pub/software/scm/git/docs/RelNotes/2.14.6.txt &sup3;
https://www.kernel.org/pub/software/scm/git/docs/RelNotes/2.24.0.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-5544

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Chromium 79. Fixes the usual giant pile of bugs and security issues. This time, the list is :

CVE-2019-13725 CVE-2019-13726 CVE-2019-13727 CVE-2019-13728 CVE-2019-13729 CVE-2019-13730 CVE-2019-13732 CVE-2019-13734 CVE-2019-13735 CVE-2019-13764 CVE-2019-13736 CVE-2019-13737 CVE-2019-13738 CVE-2019-13739 CVE-2019-13740 CVE-2019-13741 CVE-2019-13742 CVE-2019-13743 CVE-2019-13744 CVE-2019-13745 CVE-2019-13746 CVE-2019-13747 CVE-2019-13748 CVE-2019-13749 CVE-2019-13750 CVE-2019-13751 CVE-2019-13752 CVE-2019-13753 CVE-2019-13754 CVE-2019-13755 CVE-2019-13756 CVE-2019-13757 CVE-2019-13758 CVE-2019-13759 CVE-2019-13761 CVE-2019-13762 CVE-2019-13763

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
132739	Fedora 31 : firefox (2020-732a5913b6)	high
132738	Fedora 31 : python-pip (2020-6148c44137)	high
132737	Fedora 31 : 1:dovecot (2019-5898f4f935)	medium
132664	Fedora 31 : singularity (2019-f4eb2a01d1)	high
132663	Fedora 31 : heimdal (2019-f3046b6bfb)	high
132662	Fedora 31 : htmldoc (2019-e90a7032f2)	high
132661	Fedora 31 : wordpress (2019-e16ba9e54e)	high
132660	Fedora 30 : htmldoc (2019-e039dfaa30)	high
132659	Fedora 31 : spamassassin (2019-dbc586f724)	high
132658	Fedora 30 : wordpress (2019-da7b49a4b1)	high
132657	Fedora 30 : drupal7-l10n_update (2019-c4177f74f5)	high
132656	Fedora 31 : cyrus-imapd (2019-ad23a4522d)	medium
132655	Fedora 31 : php (2019-a54a622670)	critical
132654	Fedora 30 : python38 (2019-980f55cdd5)	high
132653	Fedora 31 : drupal7-webform (2019-88d9c30b7d)	high
132652	Fedora 31 : python39 (2019-7a0a8d022f)	high
132651	Fedora 30 : nethack (2019-79b80b66d9)	high
132650	Fedora 30 : cyrus-imapd (2019-7938c21723)	medium
132649	Fedora 30 : drupal7-webform (2019-6abe00cae1)	high
132648	Fedora 31 : chromium (2019-5fdceffcb9)	high
132647	Fedora 30 : drupal7 (2019-5f1a2cc839)	high
132646	Fedora 31 : drupal7 (2019-4917943339)	high
132645	Fedora 30 : libssh (2019-46b6bd2459)	high
132644	Fedora 30 : php (2019-437d94e271)	critical
132643	Fedora 31 : drupal7-l10n_update (2019-3b1529362e)	high
132642	Fedora 30 : heimdal (2019-2fa7d6405b)	high
132641	Fedora 30 : xen (2019-2e12bd3a9a)	high
132640	Fedora 31 : python38 (2019-26b2e55c90)	high
132639	Fedora 30 : git (2019-1cec196e20)	critical
132638	Fedora 30 : 2:samba (2019-11dddb785b)	medium
132637	Fedora 31 : nethack (2019-1090bd0af2)	high
132636	Fedora 30 : python39 (2019-03cf68b75d)	high
132409	Fedora 30 : unbound (2019-c7b5103d2a)	high
132408	Fedora 30 : 1:grub2 (2019-69da274284)	medium
132407	Fedora 30 : spamassassin (2019-3230b2aae9)	high
132348	Fedora 31 : cacti / cacti-spine (2019-362f0e9710)	medium
132329	Fedora 30 : cacti / cacti-spine (2019-6bf27b45b3)	medium
132328	Fedora 31 : python3 (2019-67c8b29703)	high
132327	Fedora 30 : fribidi (2019-533a72fec5)	high
132270	Fedora 31 : python-django (2019-adc8990386)	medium
132120	Fedora 31 : libyang (2019-dfe0b42bc5)	critical
132119	Fedora 31 : git (2019-c841bcc3b9)	critical
132118	Fedora 31 : unbound (2019-a29e620cd4)	high
132117	Fedora 30 : libyang (2019-9d83929ffa)	critical
132116	Fedora 31 : libssh (2019-8b0ad69829)	high
132115	Fedora 30 : openslp (2019-86bceb61b3)	critical
132114	Fedora 31 : fribidi (2019-7075bc4ff8)	high
132113	Fedora 31 : xen (2019-6aad703290)	high
132112	Fedora 31 : openslp (2019-1e5ae33e87)	critical
132111	Fedora 31 : chromium (2019-1a10c04281)	high

Detections

Analytics

Fedora Local Security Checks Family for Nessus

high

high

medium

high

high

high

high

high

high

high

high

medium

critical

high

high

high

high

medium

high

high

high

high

high

critical

high

high

high

high

critical

medium

high

high

high

medium

high

medium

medium

high

high

medium

critical

critical

high

critical

high

critical

high

high

critical

high