Fedora alert FEDORA-2026-5d9b0e2c17 (haveged)
| From: | updates--- via package-announce <package-announce@lists.fedoraproject.org> | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 43 Update: haveged-1.9.22-1.fc43 | |
| Date: | Sat, 30 May 2026 01:08:14 +0000 | |
| Message-ID: | <20260530010814.79FBD6B41C@bastion01.rdu3.fedoraproject.org> | |
| Archive-link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-5d9b0e2c17 2026-05-30 01:07:34.273959+00:00 -------------------------------------------------------------------------------- Name : haveged Product : Fedora 43 Version : 1.9.22 Release : 1.fc43 URL : https://github.com/jirka-h/haveged Summary : A Linux entropy source using the HAVEGE algorithm Description : A Linux entropy source using the HAVEGE algorithm Haveged is a user space entropy daemon which is not dependent upon the standard mechanisms for harvesting randomness for the system entropy pool. This is important in systems with high entropy needs or limited user interaction (e.g. headless servers). Haveged uses HAVEGE (HArdware Volatile Entropy Gathering and Expansion) to maintain a 1M pool of random bytes used to fill /dev/random whenever the supply of random bits in /dev/random falls below the low water mark of the device. The principle inputs to haveged are the sizes of the processor instruction and data caches used to setup the HAVEGE collector. The haveged default is a 4kb data cache and a 16kb instruction cache. On machines with a cpuid instruction, haveged will attempt to select appropriate values from internal tables. -------------------------------------------------------------------------------- Update Information: Update to 1.9.22 — fix systemd sandboxing: add ReadWritePaths=/dev/shm for semaphore creation Backport fix for CVE-2026-41054: privilege escalation via command socket -------------------------------------------------------------------------------- ChangeLog: * Thu May 21 2026 Jirka Hladky <hladky.jiri@gmail.com> - 1.9.22-1 - Update to 1.9.22 - Fix systemd sandboxing: add ReadWritePaths=/dev/shm for semaphore creation * Wed May 20 2026 Jirka Hladky <hladky.jiri@gmail.com> - 1.9.21-1 - Update to 1.9.21 - Security fix: CVE-2026-41054 — privilege escalation via command socket - Fix semaphore error handling (SEM_FAILED vs NULL) - Fix /dev/shm permissions (use 01777 with sticky bit) * Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.18-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2480051 - CVE-2026-41054 haveged: privilege escalation via command socket https://bugzilla.redhat.com/show_bug.cgi?id=2480051 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-5d9b0e2c17' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgr... All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
Attachment: None (type=text/plain)
-- _______________________________________________ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond... List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-ann... Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new