- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2023:2127: samba security update (Important)
by AlmaLinux Errata Notifications 05 May '23

05 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2023-05-05 Summary: Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (CVE-2022-38023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-2127.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:2122: libreswan security update (Important)
by AlmaLinux Errata Notifications 05 May '23

05 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2023-05-05 Summary: Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * libreswan: Malicious IKEv1 Aggressive Mode packets can crash libreswan (CVE-2023-30570) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-2122.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

Introducing AlmaLinux Accounts
by Jonathan Wright 04 May '23

04 May '23

Over the past few months, our infrastructure team <https://wiki.almalinux.org/sigs/Infrastructure.html> has been hard at work preparing our single sign-on system that will provide a unified login experience to nearly all AlmaLinux websites and properties. We are happy to announce the launch of https://accounts.almalinux.org! AlmaLinux Accounts <https://accounts.almalinux.org> will give you a single account to use across the array of sites and services offered by AlmaLinux! In addition it eases the process of onboarding new contributors through centralized groups and permissions. Why? Introducing our Single Sign-On (SSO) system offers numerous benefits for both users and the AlmaLinux OS Foundation. SSO enhances security, streamlines access, and simplifies user management across our ecosystem. With a single set of credentials, users can seamlessly navigate all AlmaLinux websites and services. This unified login experience ultimately boosts productivity, fosters collaboration, and provides a more cohesive and personalized experience for our community. Software Stack In the spirit of FOSS, it was only natural for us to stick with a free and open-source software stack. The chosen components should be familiar to anyone who has dealt with directory management or SSO in the Enterprise Linux space. We took inspiration from Fedora’s account system for some components. We have chosen the following FOSS components to power our SSO: - FreeIPA <https://www.freeipa.org> for directory and user management. - Noggin <https://github.com/fedora-infra/noggin>, a web front-end for user self-service. We’ve been doing work in the Fedora project to get noggin and its dependencies added to EPEL 9. This will benefit anyone looking to deploy noggin on RHEL 9 or RHEL 9 compatible distros. 1 - Keycloak <https://www.keycloak.org/>, an OpenID Connect system to sit between applications and LDAP. We’ve started contributing to a playbook mostly maintained by RHEL engineers to help ease the deployment of Keycloak on EL distros. 2 What About My Existing Account(s)? We have a transition plan for the next few weeks to get all systems fully supporting our AlmaLinux Accounts <https://accounts.almalinux.org> and all existing accounts transitioned into the system, or otherwise integrated. chat.almalinux.org (Mattermost) chat.almalinux.org is the single largest standalone user database we have to transition. Luckily this is a very easy and painless task for us as well as users. After you’ve created your AlmaLinux Account <https://accounts.almalinux.org>, navigate to the Profile -> Security section in Mattermost. [image: Step 1 of converting MatterMost account to use AlmaLinux Accounts] From here click on Edit next to Sign-in Method and then Switch to Using OpenID SSO and you can link your new AlmaLinux account. *Keep in mind that once you link your account you will always use your AlmaLinux account to sign in to chat.almalinux.org <http://chat.almalinux.org>.* [image: Step 2 of associating chat.almalinux.org account with AlmaLinux Accounts] On the next screen enter your current chat.almalinux.org (Mattermost) password. [image: Step 3 of associating chat.almalinux.org account with AlmaLinux Accounts]) Finally, log in using your AlmaLinux Account details. [image: Step 4 of associating chat.almalinux.org account with AlmaLinux Accounts] From now on when you log in to chat.almalinux.org you will use your AlmaLinux Account via the dedicated login button: [image: How to log in to chat.almalinux.org/Mattermost with AlmaLinux Accounts] bugs.almalinux.org All existing users on bugs.almalinux.org have been imported as AlmaLinux Accounts. You can gain access to the account by requesting a password reset at https://accounts.almalinux.org/forgot-password/ask using your username. git.almalinux.org git.almalinux.org was originally setup with only GitHub as an authentication source. This is now disabled and you must use your AlmaLinux Account to log in. If you wish to recover your previous git.almalinux.org account send an email to account-merge(a)almalinux.org from the address tied to your GitHub and AlmaLinux accounts and we can tie them together for you. lists.almalinux.org lists.almalinux.org has been tied into AlmaLinux Accounts <https://accounts.almalinux.org> for a few weeks now. Existing lists accounts can be linked to AlmaLinux Accounts seamlessly. Login option for new accounts: [image: Step 1 of associating lists.almalinux.org account with AlmaLinux Accounts] Tie your existing account to your AlmaLinux Account at https://lists.almalinux.org/accounts/social/connections/: [image: Step 2 of associating lists.almalinux.org account with AlmaLinux Accounts] pes.almalinux.org The Package Evolution Service (PES) will be updated with OIDC support, and subsequently AlmaLinux Account support soon. build.almalinux.org The AlmaLinux Build System (ALBS) will be updated with OIDC support, and subsequently AlmaLinux Account support soon. Other There are various other services used by contributors which are mostly tied into AlmaLinux Accounts already with a few to follow soon. Frequently Asked Questions *Q:* I configured 2FA/OTP at https://accounts.almalinux.org but *service/site XYZ* does not have a field for my OTP on the login page. *A:* All sites tied to AlmaLinux Accounts <https://accounts.almalinux.org> support your 2FA/OTP. Simply add it to the end of your password in the password field when logging in. For example if your password is hunter2 and your OTP is 123456 you would enter hunter2123456 into the password field. *Q:* Where should I go for help? *A:* The Infrastructure Channel on Mattermost <https://chat.almalinux.org/almalinux/channels/infrastructure>, IRC <https://web.libera.chat/#almalinux-infrastructure>, mailing list <https://lists.almalinux.org/mailman3/lists/infra.lists.almalinux.org/>. *Q:* Where can I use my AlmaLinux Account <https://accounts.almalinux.org>? *A: *See the table in the blog post <https://almalinux.org/blog/almalinux-accounts-launch/#frequently-asked-ques…> . ------------------------------ 1 *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-b0e8a9d618 <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-b0e8a9d618>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-cfcb055a9f <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-cfcb055a9f>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-fdfb8a6342 <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-fdfb8a6342>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-3b54948adb <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-3b54948adb>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-46e518d693 <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-46e518d693>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-607e3d35c7 <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-607e3d35c7>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-6215554ad9 <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-6215554ad9>* *https://bugzilla.redhat.com/show_bug.cgi?id=2174923 <https://bugzilla.redhat.com/show_bug.cgi?id=2174923>* 2 *https://github.com/ansible-middleware/keycloak/pull/73 <https://github.com/ansible-middleware/keycloak/pull/73>* --- Jonathan Wright AlmaLinux Foundation Mattermost: chat <https://chat.almalinux.org/almalinux/messages/@jonathan>

1 0

[Security Advisory] ALSA-2023:2074: emacs security update (Important)
by AlmaLinux Errata Notifications 03 May '23

03 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2023-05-03 Summary: GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: command injection vulnerability in org-mode (CVE-2023-28617) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-2074.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:2078: libwebp security update (Important)
by AlmaLinux Errata Notifications 03 May '23

03 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2023-05-03 Summary: The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Security Fix(es): * Mozilla: libwebp: Double-free in libwebp (CVE-2023-1999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-2078.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:1909: java-1.8.0-openjdk security and bug fix update (Important)
by AlmaLinux Errata Notifications 03 May '23

03 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2023-05-02 Summary: The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * The RSAPSSSignature implementation works with RSA keys via the SunRSASign provider. However, it did not fully check that the RSA key could be used by the provider before attempting to do so, leading to the possibility of errors being returned with custom security providers. The implementation now validates RSA keys and will allow other providers to handle such keys where it cannot. (RHBZ#2188024) Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-1909.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:2076: libwebp security update (Important)
by AlmaLinux Errata Notifications 03 May '23

03 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2023-05-03 Summary: The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Security Fix(es): * Mozilla: libwebp: Double-free in libwebp (CVE-2023-1999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-2076.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:1908: java-1.8.0-openjdk security update (Important)
by AlmaLinux Errata Notifications 03 May '23

03 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2023-05-02 Summary: The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-1908.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

AlmaLinux 9.2 Beta - Now Available
by Jonathan Wright 27 Apr '23

27 Apr '23

Hello glorious community. The AlmaLinux OS Foundation is proud to announce the availability of AlmaLinux 9.2 Beta “Turquoise Kodkod” for all supported architectures: - Intel/AMD (x86_64) - ARM64 (aarch64) - IBM PowerPC (ppc64le) - IBM Z (s390x) Beta ISOs are available at repo.almalinux.org <https://repo.almalinux.org/almalinux/9.2-beta/isos/>. Select a mirror closest to your geographic area listed on the mirrors.almalinux.org website to download a suitable ISO image more quickly. Starting with the AlmaLinux 9.2 Beta release, beta repositories will now be available in the Vault <https://repo.almalinux.org/vault/9.2-beta/> to reduce storage usage on mirrors. As usual, a simple reminder, this is a *BETA* release. It should not be used for production installations. The provided upgrade instructions should not be used on production machines unless you don’t mind if something breaks. Now if you wanna test this somehow, somewhere to see how things will work in 9.2 stable, you’re on the right track. Release Notes and More Information You can read more about this release by checking out the Release Notes <https://wiki.almalinux.org/release-notes/9.2-beta.html>. The AlmaLinux 9.2 Beta provides enhancements and features to the hybrid cloud’s foundation and delivers workloads, applications and services for multiple environments faster and with less effortless. The release includes security updates such as the realmd system role, a SCAP profile, and Ansible content for enhanced system checks to simplify managing security and compliance. Improvements to application streams provide compilers, runtime languages, databases and web server updates. Enhancements to the web console and new system roles make it easier to automate and standardize systems. As for containers, new capabilities allow the developing and managing containerized deployments more easily. I want to help. What can I do? Test, test, test. Your feedback is what helps make great production releases. Please, report any bugs you may see on the Bug Tracker <https://bugs.almalinux.org/>. Also, pop into the AlmaLinux Community Chat <https://chat.almalinux.org> and join our Testing Channel, post a question on our 9.2 Beta Forum <https://almalinux.discourse.group/c/devel/9-2-beta/39>, on our AlmaLinux Community on Reddit <https://reddit.com/r/almalinux> or catch us on Mastodon <https://fosstodon.org/@almalinux> & Twitter <https://twitter.com/almalinux> . Please enjoy this Beta release, let us know what you think and stay tuned for more updates and announcements coming soon. *Happy Testing!* -- Jonathan Wright AlmaLinux Foundation Mattermost: chat <https://chat.almalinux.org/almalinux/messages/@jonathan>

1 0

[Security Advisory] ALSA-2023:1930: emacs security update (Important)
by AlmaLinux Errata Notifications 24 Apr '23

24 Apr '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2023-04-24 Summary: GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: command injection vulnerability in org-mode (CVE-2023-28617) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-1930.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0