- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2023:6748: squid security update (Critical)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2023-11-14 Summary: Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847) * squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846) * squid: denial of Service in FTP (CVE-2023-46848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6748.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6615: python-cryptography security update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library, which provides cryptographic primitives and recipes to Python developers. Security Fix(es): * python-cryptography: memory corruption via immutable objects (CVE-2023-23931) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6615.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6569: sysstat security and bug fix update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: The sysstat packages provide the sar and iostat commands. These commands enable system monitoring of disk, network, and other I/O activity. Security Fix(es): * sysstat: check_overflow() function can work incorrectly, which could lead to an overflow (CVE-2023-33204) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6569.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6549: libreswan security update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * libreswan: Invalid IKEv2 REKEY proposal causes restart (CVE-2023-38710) * libreswan: Invalid IKEv1 Quick Mode ID causes restart (CVE-2023-38711) * libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart (CVE-2023-38712) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6549.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6496: haproxy security and bug fix update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fix(es): * haproxy: data leak via fcgi requests (CVE-2023-0836) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6496.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6523: python-tornado security update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: Tornado is a Python web framework and asynchronous networking library that provides an open source version of scalable, non-blocking web server and tools. Security Fix(es): * python-tornado: open redirect vulnerability in StaticFileHandler under certain configurations (CVE-2023-28370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6523.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6492: tang security update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: Tang is a server for binding data to network presence. It includes a daemon which provides cryptographic operations for binding to a remote service. The tang package provides the server side of the Network Bound Disk Encryption (NBDE) project. Security Fix(es): * tang: Race condition exists in the key generation and rotation functionality (CVE-2023-1672) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6492.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6402: containernetworking-plugins security and bug fix update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted. Security Fix(es): * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540) * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723) * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724) * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538) * golang: html/template: improper sanitization of CSS values (CVE-2023-24539) * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400) * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6402.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6420: grafana security and enhancement update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: persistent xss in grafana core plugins (CVE-2022-23552) * grafana: plugin signature bypass (CVE-2022-31123) * grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins (CVE-2022-31130) * grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins (CVE-2022-39201) * grafana: email addresses and usernames cannot be trusted (CVE-2022-39306) * grafana: User enumeration via forget password (CVE-2022-39307) * grafana: Spoofing of the originalUrl parameter of snapshots (CVE-2022-39324) * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6420.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6380: runc security update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. Security Fix(es): * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724) * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809) * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561) * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration (CVE-2023-28642) * runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration (CVE-2021-43784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6380.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6365: mod_auth_openidc security and bug fix update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527) * mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is supplied (CVE-2023-28625) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6365.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6341: xorg-x11-server-Xwayland security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 15 Nov '23

15 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-14 Summary: Xwayland is an X server for running X clients under Wayland. The following packages have been upgraded to a later upstream version: xorg-x11-server-Xwayland (22.1.9). (BZ#2158761) Security Fix(es): * xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability (CVE-2023-1393) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6341.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

Announcing AlmaLinux Day Tokyo
by benny Vasquez 13 Nov '23

13 Nov '23

Hi all! While the Core SIG <https://wiki.almalinux.org/sigs/Core.html> and Infrastructure SIG <https://wiki.almalinux.org/sigs/Infrastructure.html> have been hard at work bringing us AlmaLinux 9.3 <https://github.com/AlmaLinux/almalinux.org/blob/master/blog/2023-11-13-anno…> (and prepping AlmaLinux 8.9 <https://almalinux.org/blog/2023-11-02-announcing-89-beta/> for next week), the Marketing SIG <https://wiki.almalinux.org/sigs/Marketing.html> has been working on another exciting announcement: an event focused entirely on AlmaLinux. Already in? Reserve your spot at AlmaLinux Day Tokyo now! <https://github.com/AlmaLinux/almalinux.org/blob/master/aldt-2023> Announcing AlmaLinux Day Tokyo <https://github.com/AlmaLinux/almalinux.org/blob/master/content/blog/2023-11…> AlmaLinux Day Tokyo on December 9th, is an exciting event dedicated to all things AlmaLinux! Our team will be at the beautiful Internet Initiative, along with 150 new friends to talk about the current state and future of AlmaLinux. Alongside me, you can expect special apparencies by Igor Seletskiy, the man who got us started, and Yohei Suzuki from Cybertrust Japan, discussing the status of the industry and all the things we're excited to share. AlmaLinux Day Tokyo is also scheduled just a few days after Open Source Summit Japan <https://events.linuxfoundation.org/open-source-summit-japan/>, making it easy for anyone already attending OSSJ to join us for AlmaLinux Day, too! The Schedule <https://github.com/AlmaLinux/almalinux.org/blob/master/content/blog/2023-11…> Opening talks begin at 13:00 local time, along with several others who have had an active hand in contributing to the success of AlmaLinux. We have amazing things to share! See the full schedule with all of its updates on the AlmaLinux Day Tokyo 2023 <https://github.com/AlmaLinux/almalinux.org/blob/master/aldt-2023> page, and make sure to register to save your seat! Can't make it? <https://github.com/AlmaLinux/almalinux.org/blob/master/content/blog/2023-11…> That's OK! All the talks will be recorded and posted to our YouTube channel <https://www.youtube.com/@almalinux6891>. Keep an eye on our channel after the event! We will also be announcing two more events in 2024, so keep an eye out for an event near you! Tokyo is an amazing city, and I am so grateful to Cybertrust Japan and all of our users in Japan for welcoming us. Can't wait to see you all there! benny Vasquez Chair, Board of Directors @AlmaLinux OS Foundation *I am sending this message now because it suits me, but I don’t expect that you will read, respond to, or act on it outside of comfortable hours for your time zone.*

1 0

Resend: AlmaLinux 9.3 Stable now available!
by benny Vasquez 13 Nov '23

13 Nov '23

Sending again due to a problem with our mailing lists. Sorry for those of you who get a duplicate! Hi all! The AlmaLinux OS Foundation is proud to announce the general availability of AlmaLinux OS 9.3 <https://mirrors.almalinux.org/isos.html> codenamed "Shamrock Pampas Cat"! Installation ISOs are available on the mirrors now for all 4 architectures: - Intel/AMD (x86_64) <https://mirrors.almalinux.org/isos/x86_64/9.3.html> - ARM64 (aarch64) <https://mirrors.almalinux.org/isos/aarch64/9.3.html> - IBM PowerPC (ppc64le) <https://mirrors.almalinux.org/isos/ppc64le/9.3.html> - IBM Z (s390x) <https://mirrors.almalinux.org/isos/s390x/9.3.html> Torrents are available as well at: - Intel/AMD (x86_64) <https://repo.almalinux.org/almalinux/9.3/isos/x86_64/AlmaLinux-9.3-x86_64.t…> - ARM64 (aarch64) <https://repo.almalinux.org/almalinux/9.3/isos/aarch64/AlmaLinux-9.3-aarch64…> - IBM PowerPC (ppc64le) <https://repo.almalinux.org/almalinux/9.3/isos/ppc64le/AlmaLinux-9.3-ppc64le…> - IBM Z (s390x) <https://repo.almalinux.org/almalinux/9.3/isos/s390x/AlmaLinux-9.3-s390x.tor…> ISOs, Live Images, Cloud and Containers <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> AlmaLinux also offers a variety of Cloud, Container, and Live Images. The builds for these get kicked off as soon as the public repository is ready. *The following images are expected to be available shortly.* We will post a separate "Images Update" announcement soon, to keep the community informed. - Docker <https://wiki.almalinux.org/containers/docker-images.html#about-almalinux-do…> images including Platform and UBIs alternatives. We provide a wide variety of containers for your use. Please see our Docker Official Image <https://hub.docker.com/_/almalinux> as well as all AlmaLinux images <https://hub.docker.com/u/almalinux>. - LXC/LXD <https://images.linuxcontainers.org/images/almalinux/> - Live Media <https://wiki.almalinux.org/LiveMedia.html> for GNOME, GNOME-mini, KDE, XFCE, MATE and more. - Cloud Images - AWS AMIs <https://wiki.almalinux.org/cloud/AWS.html> for x86_64 and Graviton Instances - Azure <https://wiki.almalinux.org/cloud/Azure.html> Images for in standard and HPC flavors for x86_64 and aarch64 - Google Cloud <https://wiki.almalinux.org/cloud/Google.html> - Generic Cloud/Cloud-init <https://wiki.almalinux.org/cloud/Generic-cloud-on-local.html> for all 4 architectures - Open Nebula <https://wiki.almalinux.org/cloud/OpenNebula.html> for all 4 architectures - Oracle Cloud Infrastructure <https://wiki.almalinux.org/cloud/OCI.html> for x86_64 and aarch64 - Vagrant Boxes <https://app.vagrantup.com/almalinux>: - Libvirt - VirtualBox - Hyper-V - VMWare - Parallels - Raspberry Pi <https://wiki.almalinux.org/documentation/raspberry-pi.html> - Windows Subsystem for Linux <https://wiki.almalinux.org/documentation/wsl.html> Release Notes and More Information <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> AlmaLinux 9.3 aims to improve flexibility and reliability, as well as to enhance security across hybrid environments. This release continues simplifying automation and system management. Web console enhancements simplify management tasks. Additionally, users can configure health check actions for Podman containers and vsock devices in virtual machines. Application Streams updates provide developers with flexibility and customization options without affecting the platform's stability. The 9.3 offers enhanced security and compliance. Additionally, it provides enhanced flexibility, stability, and reliability needed to support hybrid cloud innovation. You can read more about this release by checking out the Release Notes <https://wiki.almalinux.org/release-notes/9.3.html>. Join us on Mastodon! <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> Have you jumped on Mastodon yet? Follow us! @almalinux@fosstodon.org <https://fosstodon.org/@almalinux> Pitch In <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> Join us in the AlmaLinux Community Chat <https://chat.almalinux.org/> to get any assistance you need and help others. You can also post a question on our 9.3 Forum <https://almalinux.discourse.group/c/devel/36-category/36>, on our AlmaLinux Community on Reddit <https://reddit.com/r/almalinux>, or catch us on Twitter <https://twitter.com/almalinux>. Please report any bugs you may see on the Bug Tracker <https://bugs.almalinux.org/>. Enjoy the release and have fun! benny Vasquez Chair, Board of Directors @AlmaLinux OS Foundation *I am sending this message now because it suits me, but I don’t expect that you will read, respond to, or act on it outside of comfortable hours for your time zone.*

1 0

AlmaLinux 9.3 Stable now available!
by benny Vasquez 13 Nov '23

13 Nov '23

Hi all! The AlmaLinux OS Foundation is proud to announce the general availability of AlmaLinux OS 9.3 <https://mirrors.almalinux.org/isos.html> codenamed "Shamrock Pampas Cat"! Installation ISOs are available on the mirrors now for all 4 architectures: - Intel/AMD (x86_64) <https://mirrors.almalinux.org/isos/x86_64/9.3.html> - ARM64 (aarch64) <https://mirrors.almalinux.org/isos/aarch64/9.3.html> - IBM PowerPC (ppc64le) <https://mirrors.almalinux.org/isos/ppc64le/9.3.html> - IBM Z (s390x) <https://mirrors.almalinux.org/isos/s390x/9.3.html> Torrents are available as well at: - Intel/AMD (x86_64) <https://repo.almalinux.org/almalinux/9.3/isos/x86_64/AlmaLinux-9.3-x86_64.t…> - ARM64 (aarch64) <https://repo.almalinux.org/almalinux/9.3/isos/aarch64/AlmaLinux-9.3-aarch64…> - IBM PowerPC (ppc64le) <https://repo.almalinux.org/almalinux/9.3/isos/ppc64le/AlmaLinux-9.3-ppc64le…> - IBM Z (s390x) <https://repo.almalinux.org/almalinux/9.3/isos/s390x/AlmaLinux-9.3-s390x.tor…> ISOs, Live Images, Cloud and Containers <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> AlmaLinux also offers a variety of Cloud, Container, and Live Images. The builds for these get kicked off as soon as the public repository is ready. *The following images are expected to be available shortly.* We will post a separate "Images Update" announcement soon, to keep the community informed. - Docker <https://wiki.almalinux.org/containers/docker-images.html#about-almalinux-do…> images including Platform and UBIs alternatives. We provide a wide variety of containers for your use. Please see our Docker Official Image <https://hub.docker.com/_/almalinux> as well as all AlmaLinux images <https://hub.docker.com/u/almalinux>. - LXC/LXD <https://images.linuxcontainers.org/images/almalinux/> - Live Media <https://wiki.almalinux.org/LiveMedia.html> for GNOME, GNOME-mini, KDE, XFCE, MATE and more. - Cloud Images - AWS AMIs <https://wiki.almalinux.org/cloud/AWS.html> for x86_64 and Graviton Instances - Azure <https://wiki.almalinux.org/cloud/Azure.html> Images for in standard and HPC flavors for x86_64 and aarch64 - Google Cloud <https://wiki.almalinux.org/cloud/Google.html> - Generic Cloud/Cloud-init <https://wiki.almalinux.org/cloud/Generic-cloud-on-local.html> for all 4 architectures - Open Nebula <https://wiki.almalinux.org/cloud/OpenNebula.html> for all 4 architectures - Oracle Cloud Infrastructure <https://wiki.almalinux.org/cloud/OCI.html> for x86_64 and aarch64 - Vagrant Boxes <https://app.vagrantup.com/almalinux>: - Libvirt - VirtualBox - Hyper-V - VMWare - Parallels - Raspberry Pi <https://wiki.almalinux.org/documentation/raspberry-pi.html> - Windows Subsystem for Linux <https://wiki.almalinux.org/documentation/wsl.html> Release Notes and More Information <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> AlmaLinux 9.3 aims to improve flexibility and reliability, as well as to enhance security across hybrid environments. This release continues simplifying automation and system management. Web console enhancements simplify management tasks. Additionally, users can configure health check actions for Podman containers and vsock devices in virtual machines. Application Streams updates provide developers with flexibility and customization options without affecting the platform's stability. The 9.3 offers enhanced security and compliance. Additionally, it provides enhanced flexibility, stability, and reliability needed to support hybrid cloud innovation. You can read more about this release by checking out the Release Notes <https://wiki.almalinux.org/release-notes/9.3.html>. Join us on Mastodon! <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> Have you jumped on Mastodon yet? Follow us! @almalinux@fosstodon.org <https://fosstodon.org/@almalinux> Pitch In <https://github.com/sboldyreva/almalinux.org/blob/9-3-stable/content/blog/20…> Join us in the AlmaLinux Community Chat <https://chat.almalinux.org/> to get any assistance you need and help others. You can also post a question on our 9.3 Forum <https://almalinux.discourse.group/c/devel/36-category/36>, on our AlmaLinux Community on Reddit <https://reddit.com/r/almalinux>, or catch us on Twitter <https://twitter.com/almalinux>. Please report any bugs you may see on the Bug Tracker <https://bugs.almalinux.org/>. Enjoy the release and have fun! benny Vasquez Chair, Board of Directors @AlmaLinux OS Foundation *I am sending this message now because it suits me, but I don’t expect that you will read, respond to, or act on it outside of comfortable hours for your time zone.*

1 0

[Security Advisory] ALSA-2023:6194: thunderbird security update (Important)
by AlmaLinux Errata Notifications 10 Nov '23

10 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2023-11-10 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.4.1. Security Fix(es): * Mozilla: Queued up rendering could have allowed websites to clickjack (CVE-2023-5721) * Mozilla: Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4 (CVE-2023-5730) * libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488) * Mozilla: Large WebGL draw could have led to a crash (CVE-2023-5724) * Mozilla: WebExtensions could open arbitrary URLs (CVE-2023-5725) * Mozilla: Improper object tracking during GC in the JavaScript engine could have led to a crash. (CVE-2023-5728) * Mozilla: Address bar spoofing via bidirectional characters (CVE-2023-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-6194.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6267: squid:4 security update (Critical)
by AlmaLinux Errata Notifications 09 Nov '23

09 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2023-11-09 Summary: Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847) * SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-6267.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6187: firefox security update (Important)
by AlmaLinux Errata Notifications 09 Nov '23

09 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2023-11-09 Summary: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.4.0 ESR. Security Fix(es): * Mozilla: Queued up rendering could have allowed websites to clickjack (CVE-2023-5721) * Mozilla: Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4 (CVE-2023-5730) * libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488) * Mozilla: Large WebGL draw could have led to a crash (CVE-2023-5724) * Mozilla: WebExtensions could open arbitrary URLs (CVE-2023-5725) * Mozilla: Improper object tracking during GC in the JavaScript engine could have led to a crash. (CVE-2023-5728) * Mozilla: Address bar spoofing via bidirectional characters (CVE-2023-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-6187.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6247: .NET 7.0 security update (Moderate)
by AlmaLinux Errata Notifications 09 Nov '23

09 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2023-11-09 Summary: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.113 and .NET Runtime 7.0.13. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-6247.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6245: .NET 6.0 security update (Moderate)
by AlmaLinux Errata Notifications 06 Nov '23

06 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2023-11-03 Summary: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.124 and .NET Runtime 6.0.24. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-6245.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6236: binutils security update (Moderate)
by AlmaLinux Errata Notifications 06 Nov '23

06 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2023-11-03 Summary: The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities. Security Fix(es): * binutils: NULL pointer dereference in _bfd_elf_get_symbol_version_string leads to segfault (CVE-2022-4285) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-6236.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6246: .NET 7.0 security update (Moderate)
by AlmaLinux Errata Notifications 03 Nov '23

03 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-11-03 Summary: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.113 and .NET Runtime 7.0.13. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6246.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6266: squid security update (Critical)
by AlmaLinux Errata Notifications 03 Nov '23

03 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2023-11-03 Summary: Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847) * SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846) * SQUID-2023:5 squid: denial of Service in FTP (CVE-2023-46848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6266.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6265: ghostscript security update (Important)
by AlmaLinux Errata Notifications 03 Nov '23

03 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2023-11-03 Summary: The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: GhostPDL can lead to remote code execution via crafted PostScript documents (CVE-2023-43115) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6265.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6191: thunderbird security update (Important)
by AlmaLinux Errata Notifications 03 Nov '23

03 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2023-11-03 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.4.1. Security Fix(es): * Mozilla: Queued up rendering could have allowed websites to clickjack (CVE-2023-5721) * Mozilla: Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4 (CVE-2023-5730) * libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488) * Mozilla: Large WebGL draw could have led to a crash (CVE-2023-5724) * Mozilla: WebExtensions could open arbitrary URLs (CVE-2023-5725) * Mozilla: Improper object tracking during GC in the JavaScript engine could have led to a crash. (CVE-2023-5728) * Mozilla: Address bar spoofing via bidirectional characters (CVE-2023-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-6191.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0