May 2024 - Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2024:3095: vorbis-tools security update (Moderate)
by AlmaLinux Errata Notifications 30 May '24

30 May '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2024-05-29 Summary: The vorbis-tools packages provide an encoder, a decoder, a playback tool, and a comment editor for Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent- and royalty-free, general-purpose compressed audio format. Security Fix(es): * vorbis-tools: Buffer Overflow vulnerability (CVE-2023-43361) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-3095.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:3105: python3.11-cryptography security update (Moderate)
by AlmaLinux Errata Notifications 30 May '24

30 May '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2024-05-29 Summary: The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library, which provides cryptographic primitives and recipes to Python developers. Security Fix(es): * python-cryptography: NULL-dereference when loading PKCS7 certificates (CVE-2023-49083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-3105.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:3058: mutt security update (Moderate)
by AlmaLinux Errata Notifications 30 May '24

30 May '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2024-05-29 Summary: Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP. Security Fix(es): * mutt: null pointer dereference (CVE-2023-4874) * mutt: null pointer dereference (CVE-2023-4875) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-3058.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:2950: kernel-rt security and bug fix update (Moderate)
by AlmaLinux Errata Notifications 30 May '24

30 May '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2024-05-29 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-2950.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:3017: edk2 security update (Important)
by AlmaLinux Errata Notifications 30 May '24

30 May '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2024-05-29 Summary: EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message (CVE-2023-45235) * EDK2: heap buffer overflow in Tcg2MeasureGptTable() (CVE-2022-36763) * EDK2: heap buffer overflow in Tcg2MeasurePeImage() (CVE-2022-36764) * EDK2: integer overflow in CreateHob() could lead to HOB OOB R/W (CVE-2022-36765) * edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message (CVE-2023-45229) * edk2: Out of Bounds read when handling a ND Redirect message with truncated options (CVE-2023-45231) * edk2: Infinite loop when parsing unknown options in the Destination Options header (CVE-2023-45232) * edk2: Infinite loop when parsing a PadN option in the Destination Options header (CVE-2023-45233) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-3017.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:2994: LibRaw security update (Moderate)
by AlmaLinux Errata Notifications 30 May '24

30 May '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2024-05-29 Summary: LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others). Security Fix(es): * LibRaw: stack buffer overflow in LibRaw_buffer_datastream::gets() in src/libraw_datastream.cpp (CVE-2021-32142) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-2994.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:3339: glibc security update (Important)
by AlmaLinux Errata Notifications 28 May '24

28 May '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2024-05-28 Summary: The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Out of bounds write in iconv conversion to ISO-2022-CN-EXT (CVE-2024-2961) * glibc: stack-based buffer overflow in netgroup cache (CVE-2024-33599) * glibc: null pointer dereferences after failed netgroup cache insertion (CVE-2024-33600) * glibc: netgroup cache may terminate daemon on memory allocation failure (CVE-2024-33601) * glibc: netgroup cache assumes NSS callback uses in-buffer strings (CVE-2024-33602) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-3339.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:3307: tomcat security and bug fix update (Important)
by AlmaLinux Errata Notifications 28 May '24

28 May '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2024-05-28 Summary: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549) * Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672) Bug Fix(es) and Enhancement(s): * Rebase tomcat to version 9.0.87 (JIRA:AlmaLinux-34815) * Amend tomcat's changelog so that fixed CVEs are mentioned explicitly (JIRA:AlmaLinux-35328) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-3307.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

It's time for AlmaLinux 8.10!
by benny Vasquez 28 May '24

28 May '24

Hi all!! We are excited to announce the general availability of AlmaLinux OS 8.10 <https://mirrors.almalinux.org/isos.html>! Installation ISOs are available on the mirrors now for all 4 architectures: - Intel/AMD (x86_64) <https://mirrors.almalinux.org/isos/x86_64/8.10.html> - ARM64 (aarch64) <https://mirrors.almalinux.org/isos/aarch64/8.10.html> - IBM PowerPC (ppc64le) <https://mirrors.almalinux.org/isos/ppc64le/8.10.html> - IBM Z (s390x) <https://mirrors.almalinux.org/isos/s390x/8.10.html> Torrents are available as well at: - Intel/AMD (x86_64) <https://repo.almalinux.org/almalinux/8.10/isos/x86_64/AlmaLinux-8.10-x86_64…> - ARM64 (aarch64) <https://repo.almalinux.org/almalinux/8.10/isos/aarch64/AlmaLinux-8.10-aarch…> - IBM PowerPC (ppc64le) <https://repo.almalinux.org/almalinux/8.10/isos/ppc64le/AlmaLinux-8.10-ppc64…> - IBM Z (s390x) <https://repo.almalinux.org/almalinux/8.10/isos/s390x/AlmaLinux-8.10-s390x.t…> <#How-we-build>How we build AlmaLinux matches release and software versions with Red Hat Enterprise Linux (RHEL) and builds from the same sources as RHEL, ensuring complete compatibility with RHEL, and does so from freely available open source code. If you are looking for a deeper understanding of how AlmaLinux is built, watch this 23-minute video of our Lead Architect explaining in detail at AlmaLinux Day: Germany <https://almalinux.org/almalinux-day-germany-2024/>, earlier this year. https://www.youtube.com/watch?v=aMvI5E9-LYI <#ISOs-Live-Images-Cloud-and-Containers>ISOs, Live Images, Cloud and Containers AlmaLinux also offers a variety of Cloud, Container and Live Images. The builds for these get kicked off as soon as the public repository is ready. The following images are expected to be available shortly. - Container <https://wiki.almalinux.org/containers/> images including Platform and UBI alternatives. We provide a wide variety of containers for your use. - LXC/LXD <https://images.linuxcontainers.org/images/almalinux/> - Live Media <https://wiki.almalinux.org/LiveMedia.html> for GNOME, GNOME-mini, KDE, XFCE, MATE and more. - Cloud Images - AWS <https://wiki.almalinux.org/cloud/AWS.html> for x86_64 and AArch64 EC2 Instances - Azure <https://wiki.almalinux.org/cloud/Azure.html> for x86_64 and AArch64 VMs - Google Cloud <https://wiki.almalinux.org/cloud/Google.html> - Generic Cloud/Cloud-init <https://wiki.almalinux.org/cloud/Generic-cloud-on-local.html> for all 4 architectures - OpenNebula <https://wiki.almalinux.org/cloud/OpenNebula.html> for x86_64 and AArch64 architectures - Oracle Cloud Infrastructure <https://wiki.almalinux.org/cloud/OCI.html> for x86_64 and AArch64 Instances - Vagrant Boxes <https://app.vagrantup.com/almalinux>: - Libvirt - VirtualBox - Hyper-V - VMWare for x86_64 and AArch64 - Parallels for AArch64 - Raspberry Pi <https://wiki.almalinux.org/documentation/raspberry-pi.html> - Windows Subsystem for Linux <https://wiki.almalinux.org/documentation/wsl.html> for x86_64 and AArch64 <#Release-Notes-and-More-Information>Release Notes and More Information AlmaLinux 8.10 brings updates to security and data protection, and improvements in web-console and system roles to automate operations and ensure consistency in intricate IT settings. The release continues to enhance system availability, reliability, and recovery processes, alongside improving virtual machine snapshot functions in hybrid cloud scenarios. New system roles have been introduced to streamline the creation and administration of logical volume manager (LVM) snapshots for better data backup and recovery processes. Performance, scalability, and reliability continue to be the focus of updates in the 8.10 version to aid developers in application development and management. You can read the full release notes for this version on the wiki: AlmaLinux OS 8.10 Release Notes <https://wiki.almalinux.org/release-notes/8.10.html>. <#Renewing-support-for-upstream-deprecated-hardware>Renewing support for upstream deprecated hardware With AlmaLinux 8.10 we have also differentiated ourselves by meeting another request from our community for support with older hardware to help them stay on updated operating systems. The following device drivers were modified to re-add PCI IDs for hardware disabled in upstream: - The following device drivers were modified to re-add PCI IDs for hardware disabled in upstream: - aacraid - Dell PERC2, 2/Si, 3/Si, 3/Di, Adaptec Advanced Raid Products, HP NetRAID-4M, IBM ServeRAID & ICP SCSI - be2iscsi - Emulex OneConnect Open-iSCSI for BladeEngine 2 and 3 adapters - hpsa - HP Smart Array Controller - lpfc - Emulex LightPulse Fibre Channel SCSI - megaraid_sas - Broadcom MegaRAID SAS - mlx4_core - Mellanox Gen2 and ConnectX-2 adapters - mpt3sas - LSI MPT Fusion SAS 3.0 - mptsas - Fusion MPT SAS Host - qla2xxx - QLogic Fibre Channel HBA - qla4xxx - QLogic iSCSI HBA For a complete list of hardware support for which was added in this release, see the Extended hardware support <https://wiki.almalinux.org/release-notes/8.10.html#extended-hardware-support> section in the 8.10 release notes. While this list is quite comprehensive, we also welcome feedback from all of our users! If you use older hardware, does this list cover everything you need it to? If not, please share more here on the AlmaLinux Forums: Re-adding support for older hardware <https://forums.almalinux.org/t/re-adding-support-for-older-hardware/3851>. <#Pitch-In>Pitch In Join us in the AlmaLinux Community Chat <https://chat.almalinux.org> to get any assistance you need and help others. You can also post a question on our 8.10 Forum <https://forums.almalinux.org/c/devel/8-stable/36>, on our AlmaLinux Community on Reddit <https://reddit.com/r/almalinux>, catch us on Twitter/X <https://twitter.com/almalinux> and follow us on Mastodon @almalinux@fosstodon.org <https://fosstodon.org/@almalinux> Please report any bugs you may see on the Bug Tracker <https://bugs.almalinux.org/>. Enjoy the release and have fun! benny Vasquez Chair, Board of Directors @AlmaLinux OS Foundation *I am sending this message now because it suits me, but I don’t expect that you will read, respond to, or act on it outside of comfortable hours for your time zone.*

1 0

Introducing AlmaLinux Engineering Steering Committee
by benny Vasquez 21 May '24

21 May '24

Happy Tuesday everyone! I just published a blog post announcing the brand-new AlmaLinux Engineering Steering Committee. https://almalinux.org/blog/2024-05-21-introducing-alesco/ This is the result of a lot of very intentional thought and effort by many, many people, and I am excited to see this getting off the ground! See the blog post for the info, then check out the wiki page ( https://wiki.almalinux.org/alesco ) for even more information. Congrats and thank you to Andrew Lukoshko, Ben Thomas, Cody Robertson, Elkhan Mammadli, Jonathan Wright, and Neal Gompa for serving as the inaugural ALESCo members. We also quietly launched our new event management system available at events.almalinux.org. There you'll find SIG meetings and webinars that we're hosting with our sponsors, and soon you'll be able to see where to find AlmaLinux at events throughout the year! Thanks everyone for your continued support, benny Vasquez Chair, Board of Directors @AlmaLinux OS Foundation *I am sending this message now because it suits me, but I don’t expect that you will read, respond to, or act on it outside of comfortable hours for your time zone.*

1 0