Re: RFC: incompatible update for routinator for Fedora *and* EPEL 9 and 10

--===============3071699217213100065==
Content-Type: multipart/signed; micalg="pgp-sha512";
	protocol="application/pgp-signature"; boundary="=-r3GFTVEs5TyVnPOwAVe1"


--=-r3GFTVEs5TyVnPOwAVe1
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, 2026-07-08 at 10:33 +0100, Michel Lind wrote:
> On Fri, 2026-07-03 at 13:39 +0100, Michel Lind wrote:
> > Routinator has four CVE fixes in the latest 0.15.2 (we're now at
> > 0.14.2), and some of them are marked as high severity
> >=20
> > https://nvd.nist.gov/vuln/detail/CVE-2026-49232=C2=A0- CVSS-B 8.7
> > https://nvd.nist.gov/vuln/detail/CVE-2026-49233=C2=A0- CVSS-B 8.3
> > https://nvd.nist.gov/vuln/detail/CVE-2026-49234=C2=A0- CVSS-B 8.2
> > https://nvd.nist.gov/vuln/detail/CVE-2026-49235=C2=A0- CVSS-B 8.7
> >=20
> > You might have noticed 0.14->0.15 indicates a breaking change, and
> > unfortunately... you're right. The reason is *another* security fix
> >=20
> > https://nvd.nist.gov/vuln/detail/CVE-2023-39916=C2=A0
> >=20
> > No score available, and this one is in an option that is not on by
> > default - quoting NVD:
> >=20
> > NLnet Labs=E2=80=99 Routinator 0.9.0 up to and including 0.12.1 as well=
 as
> > 0.14.0 up to and including 0.14.2 contains a possible path
> > traversal
> > vulnerability in the optional, off-by-default keep-rrdp-responses
> > feature that allows users to store the content of responses
> > received
> > for RRDP requests
> >=20
> > From the upstream changelog, they have been trying to fix this for
> > several releases and finally gave up and pulled the plug:
> >=20
> > "This once and for all fixes [CVE-2023-39916] which returned again
> > in
> > release 0.14.0."
> >=20
> > So out of an abundance of caution I'm giving a heads up and
> > following
> > the incompatible update process for both Fedora and EPEL
> >=20
> > The updates have been built but I am disabling automatic push by
> > karma
> > and time:
> >=20
> > https://bodhi.fedoraproject.org/updates/?search=3D0.15.2&packages=3Drus=
t-routinator
> >=20
> > Best regards,
> >=20
> FESCo request:
> https://forge.fedoraproject.org/fesco/tickets/issues/3635
>=20
> Best regards,
>=20
routinator 0.15.2 is now stable:

https://bodhi.fedoraproject.org/updates/?search=3D0.15.2&packages=3Drust-ro=
utinator&releases=3DF44&releases=3DF43

Best regards,


--=20
=C2=A0_o) Michel Lind
_( ) https://keyoxide.org/5dce2e7e9c3b1cffd335c1d78b229d2f7ccc04f2
     README:    https://fedoraproject.org/wiki/User:Salimma#README

--=-r3GFTVEs5TyVnPOwAVe1
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iJAEABYKADgWIQRdzi5+nDsc/9M1wdeLIp0vfMwE8gUCamfCEhocc2FsaW1tYUBm
ZWRvcmFwcm9qZWN0Lm9yZwAKCRCLIp0vfMwE8hnYAP0dqyjr7K4pANp+Z/h1vln+
PqZYxZPHg5gXmnlbmmgCVQEA5TiVIPjc6B20gKXhfa8Ag3Rk0W+CY29ra4OufJGb
Ywg=
=03sT
-----END PGP SIGNATURE-----

--=-r3GFTVEs5TyVnPOwAVe1--

--===============3071699217213100065==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCmRldmVs
IG1haWxpbmcgbGlzdCAtLSBkZXZlbEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpUbyB1bnN1YnNj
cmliZSBzZW5kIGFuIGVtYWlsIHRvIGRldmVsLWxlYXZlQGxpc3RzLmZlZG9yYXByb2plY3Qub3Jn
CkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0Lm9yZy9l
bi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRwczovL2Zl
ZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBBcmNoaXZl
czogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L2RldmVsQGxp
c3RzLmZlZG9yYXByb2plY3Qub3JnCkRvIG5vdCByZXBseSB0byBzcGFtLCByZXBvcnQgaXQ6IGh0
dHBzOi8vZm9yZ2UuZmVkb3JhcHJvamVjdC5vcmcvaW5mcmEvdGlja2V0cy9pc3N1ZXMvbmV3Cg==

--===============3071699217213100065==--