FEDORA-2024-abe1e34fdb — security update for onnx

stable

onnx-1.14.1-2.fc40

FEDORA-2024-abe1e34fdb created by aalvarez 9 months ago for Fedora 40

Security fix for CVE-2024-27318 and CVE-2024-27319

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2024-abe1e34fdb

This update has been submitted for testing by aalvarez.

9 months ago

This update's test gating status has been changed to 'ignored'.

9 months ago

This update has been pushed to testing.

9 months ago

This update has been submitted for stable by bodhi.

9 months ago

This update has been pushed to stable.

9 months ago

jamatos commented & provided feedback 9 months ago

I get:

Problem: package python3-torch-2.1.2-3.fc40.x86_64 requires libonnx.so.1.14.0()(64bit), but none of the providers can be installed
  - package python3-torch-2.1.2-3.fc40.x86_64 requires libonnx_proto.so.1.14.0()(64bit), but none of the providers can be installed
  - cannot install both onnx-libs-1.14.0-10.fc40.x86_64 and onnx-libs-1.14.1-2.fc40.x86_64
  - cannot install the best update candidate for package python3-torch-2.1.2-3.fc40.x86_64
  - cannot install the best update candidate for package onnx-libs-1.14.0-10.fc40.x86_64

so when updating onnx please also update python-torch that depends on it.

aalvarez commented & provided feedback 9 months ago

Thanks for the heads up and sorry for the trouble. I can not push a build myself, but I have let them know

https://bugzilla.redhat.com/show_bug.cgi?id=2272359

Please login to add feedback.

Metadata

Type

security

Severity

high

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

3 days

Dates

submitted

9 months ago

in testing

9 months ago

in stable

9 months ago

approved

9 months ago

Builds

onnx-1.14.1-2.fc40

BZ#2265737 CVE-2024-27318 onnx: directory traversal

BZ#2265738 CVE-2024-27318 onnx: directory traversal [fedora-all]

BZ#2265739 CVE-2024-27319 onnx: oob read

BZ#2265740 CVE-2024-27319 onnx: oob read [fedora-all]

onnx-1.14.1-2.fc40

Automated Test Results

ignored