Fedora alert FEDORA-2026-9d0e7df23a (glow)
| From: | updates--- via package-announce <package-announce@lists.fedoraproject.org> | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 42 Update: glow-2.1.2-1.fc42 | |
| Date: | Fri, 01 May 2026 01:27:54 +0000 | |
| Message-ID: | <20260501012754.38F23650F1@bastion01.rdu3.fedoraproject.org> | |
| Archive-link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-9d0e7df23a 2026-05-01 01:22:47.586705+00:00 -------------------------------------------------------------------------------- Name : glow Product : Fedora 42 Version : 2.1.2 Release : 1.fc42 URL : https://github.com/charmbracelet/glow Summary : Terminal based markdown reader Description : Glow is a terminal based markdown reader designed from the ground up to bring out the beauty—and power—of the CLI. Use it to discover markdown files, read documentation directly on the command line. Glow will find local markdown files in subdirectories or a local Git repository. -------------------------------------------------------------------------------- Update Information: Update to version 2.1.2. This also updates some of the vendored dependencies to fix CVEs, as well as building with the latest golang to fix even more CVEs. -------------------------------------------------------------------------------- ChangeLog: * Wed Apr 22 2026 Carl George <carlwgeorge@fedoraproject.org> - 2.1.2-1 - Update to version 2.1.2 rhbz#2457076 - Update vendored goldmark to 1.7.17 to resolve CVE-2026-5160 * Sun Mar 22 2026 Carl George <carlwgeorge@fedoraproject.org> - 2.1.1-10 - Adopt go-vendor-tools * Mon Feb 2 2026 Maxwell G <maxwell@gtmx.me> - 2.1.1-9 - Rebuild for https://fedoraproject.org/wiki/Changes/golang1.26 * Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.1-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Oct 10 2025 Alejandro Sáez <asm@redhat.com> - 2.1.1-7 - rebuild * Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 2.1.1-6 - Rebuild for golang-1.25.0 * Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 2.1.1-5 - Revert "Rebuild for golang-1.25.0" * Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 2.1.1-4 - Rebuild for golang-1.25.0 * Thu Jul 24 2025 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 2.1.1-3 - Set the correct goipath * Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2375621 - glow: mapstructure May Leak Sensitive Information [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2375621 [ 2 ] Bug #2398694 - CVE-2025-47910 glow: CrossOriginProtection bypass in net/http [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2398694 [ 3 ] Bug #2399375 - CVE-2025-47906 glow: Unexpected paths returned from LookPath in os/exec [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2399375 [ 4 ] Bug #2399713 - CVE-2025-11065 glow: Go-viper's mapstructure May Leak Sensitive Information in Logs in github.com/go-viper/mapstructure [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2399713 [ 5 ] Bug #2407898 - CVE-2025-58189 glow: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2407898 [ 6 ] Bug #2409367 - CVE-2025-61723 glow: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2409367 [ 7 ] Bug #2410317 - CVE-2025-58185 glow: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2410317 [ 8 ] Bug #2411218 - CVE-2025-58188 glow: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2411218 [ 9 ] Bug #2457076 - glow-2.1.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2457076 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-9d0e7df23a' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgr... All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
Attachment: None (type=text/plain)
-- _______________________________________________ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond... List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-ann... Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new