{"update": {"autokarma": true, "autotime": true, "stable_karma": 3, "stable_days": 7, "unstable_karma": -3, "require_bugs": false, "require_testcases": true, "display_name": "", "notes": "Fix issue with incorrect obsoletes.\n", "type": "security", "status": "stable", "request": null, "severity": "unspecified", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": false, "critpath_groups": null, "close_bugs": true, "date_submitted": "2021-09-08 16:46:29", "date_modified": "2021-09-16 15:28:39", "date_approved": null, "date_testing": "2021-09-09 18:21:46", "date_stable": "2021-09-17 14:35:09", "alias": "FEDORA-EPEL-2021-8634a5d3f8", "test_gating_status": "ignored", "from_tag": null, "date_pushed": "2021-09-17 14:35:09", "meets_testing_requirements": true, "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2021-8634a5d3f8", "title": "ntfs-3g-2021.8.22-2.el7", "version_hash": "a721aa20719d4ce9e6c05126abb351450c5f1daf", "release": {"name": "EPEL-7", "long_name": "Fedora EPEL 7", "version": "7", "id_prefix": "FEDORA-EPEL", "branch": "epel7", "dist_tag": "epel7", "stable_tag": "epel7", "testing_tag": "epel7-testing", "candidate_tag": "epel7-testing-candidate", "pending_signing_tag": "epel7-signing-pending", "pending_testing_tag": "epel7-testing-pending", "pending_stable_tag": "epel7-pending", "override_tag": "epel7-override", "mail_template": "fedora_epel_legacy_errata_template", "state": "archived", "composed_by_bodhi": true, "create_automatic_updates": false, "package_manager": "unspecified", "testing_repository": null, "released_on": null, "eol": null, "setting_status": null}, "user": {"name": "spot", "email": "spotrh@gmail.com", "id": 224, "avatar": "https://seccdn.libravatar.org/avatar/6fe82351f854e333f2fb661c4fa2fcc3172d897a90ab823204327fa9e5c82de5?s=24&d=retro", "openid": "spot.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "arm-qa"}, {"name": "cvsfedora"}, {"name": "mirror-ia64"}, {"name": "gitfedora-logos"}, {"name": "fedorabugs"}, {"name": "ambassadors"}, {"name": "signed_fpca"}, {"name": "openhw2012"}, {"name": "paste-deleter"}, {"name": "3d-printing-sig"}, {"name": "cla_redhat"}, {"name": "cvsadmin"}, {"name": "fedora-contributor"}, {"name": "gitgeneric-release"}, {"name": "gitmoksha"}, {"name": "irc-support-operators"}, {"name": "ipausers"}, {"name": "r-maint-sig"}, {"name": "trust admins"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by spot. ", "timestamp": "2021-09-08 16:46:29", "update_id": 339796, "user_id": 91, "id": 2200434, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'ignored'.", "timestamp": "2021-09-08 16:46:29", "update_id": 339796, "user_id": 91, "id": 2200435, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'waiting'.", "timestamp": "2021-09-08 16:46:29", "update_id": 339796, "user_id": 91, "id": 2200436, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'ignored'.", "timestamp": "2021-09-08 17:12:16", "update_id": 339796, "user_id": 91, "id": 2200464, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2021-09-09 18:21:56", "update_id": 339796, "user_id": 91, "id": 2202154, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "spot edited this update.", "timestamp": "2021-09-16 15:28:39", "update_id": 339796, "user_id": 91, "id": 2209968, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for stable by bodhi. ", "timestamp": "2021-09-16 18:24:34", "update_id": 339796, "user_id": 91, "id": 2210782, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to stable.", "timestamp": "2021-09-17 14:35:45", "update_id": 339796, "user_id": 91, "id": 2211849, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}], "builds": [{"nvr": "ntfs-3g-2021.8.22-2.el7", "signed": true, "release_id": 8, "type": "rpm", "epoch": 2}], "bugs": [{"bug_id": 2001608, "title": "CVE-2021-33285 ntfs3g: when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur.", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001609, "title": "CVE-2021-33286 ntfs-3g:  When a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001613, "title": "CVE-2021-33287 ntfs-3g: When specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001616, "title": "CVE-2021-33289 ntfs-3g: When a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001619, "title": "CVE-2021-35266 ntfs-3g: When a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001621, "title": "CVE-2021-35267 ntfs-3g: A stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001623, "title": "CVE-2021-35268 ntfs-3g: When a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001645, "title": "CVE-2021-35269 ntfs-3g: when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001649, "title": "CVE-2021-39251 ntfs-3g: A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001650, "title": "CVE-2021-39252 ntfs-3g: A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001651, "title": "CVE-2021-39253 ntfs-3g: A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001652, "title": "CVE-2021-39254 ntfs-3g: A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow", "security": true, "parent": true, "feedback": []}, {"bug_id": 2001755, "title": "Cannot install ntfs-3g on Fedora 34: ntfs-3g-libs is already installed", "security": false, "parent": false, "feedback": [{"karma": 0, "comment_id": 2200562, "bug_id": 2001755, "comment": {"karma": 0, "karma_critpath": 0, "text": "I'm looking into the automated test failures here. The error is that the updated packages are not getting installed when they were expected to be installed, but I'm figuring out the cause of that. It's not clearly an error in the packages like it usually is when this happens.", "timestamp": "2021-09-08 18:13:07", "update_id": 339795, "user_id": 302, "id": 2200562, "testcase_feedback": [], "user": {"name": "adamwill", "email": "awilliam@redhat.com", "id": 302, "avatar": "https://seccdn.libravatar.org/avatar/51720fbb2ec5dfd2bc005ac374a3bfd3190cb8f45f3bb8d6bdf35fb6a051d03b?s=24&d=retro", "openid": "adamwill.id.fedoraproject.org", "groups": [{"name": "proventesters"}, {"name": "provenpackager"}, {"name": "packager"}, {"name": "qa-tools-sig"}, {"name": "fedora-contributor"}, {"name": "news"}, {"name": "gittriage"}, {"name": "sysadmin"}, {"name": "gitspin-kickstarts"}, {"name": "signed_fpca"}, {"name": "gitgeneric-release"}, {"name": "yak_farmers"}, {"name": "triagers"}, {"name": "qa"}, {"name": "sysadmin-qa"}, {"name": "fedorabugs"}, {"name": "ipausers"}, {"name": "gitmkinitrd"}, {"name": "qa-admin"}, {"name": "aws-qa"}, {"name": "change-wranglers"}, {"name": "fedora-ci-admins"}, {"name": "common-issues-triage"}, {"name": "sysadmin-main"}, {"name": "trust admins"}, {"name": "program-management"}, {"name": "gitfedora-project-schedule"}]}}}, {"karma": 0, "comment_id": 2200621, "bug_id": 2001755, "comment": {"karma": 0, "karma_critpath": 0, "text": "So, yeah, this is very odd. I can reproduce it locally. I set up a side repo with the -2.fc35 build in it (plus ntfs-3g-system-compression-1.0-7.fc35, which needs to be available for deps to resolve). The -1.fc35 build is currently in updates-testing. Now check this out:\n\n    [adamw@xps13k /]$ sudo dnf --disablerepo=updates-testing update ntfs-3g*\n    Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/fedora-updates-testing.repo; Configuration: OptionBinding with id \"failovermethod\" does not exist\n    Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/fedora-updates-testing.repo; Configuration: OptionBinding with id \"failovermethod\" does not exist\n    Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/fedora-updates-testing.repo; Configuration: OptionBinding with id \"failovermethod\" does not exist\n    Private side repo                                                                                                                                            2.9 MB/s | 3.0 kB     00:00    \n    Private side repo                                                                                                                                            948 kB/s | 4.6 kB     00:00    \n    Dependencies resolved.\n    =============================================================================================================================================================================================\n     Package                                                   Architecture                          Version                                           Repository                           Size\n    =============================================================================================================================================================================================\n    Upgrading:\n     ntfs-3g                                                   x86_64                                2:2021.8.22-2.fc35                                side                                127 k\n     ntfs-3g-system-compression                                x86_64                                1.0-7.fc35                                        side                                 28 k\n     ntfsprogs                                                 x86_64                                2:2021.8.22-2.fc35                                side                                368 k\n    Installing dependencies:\n     ntfs-3g-libs                                              x86_64                                2:2021.8.22-2.fc35                                side                                174 k\n\n    Transaction Summary\n    =============================================================================================================================================================================================\n    Install  1 Package\n    Upgrade  3 Packages\n\n    Total size: 697 k\n    Is this ok [y/N]: n\n    Operation aborted.\n    [adamw@xps13k /]$ sudo dnf update ntfs-3g*\n    Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/fedora-updates-testing.repo; Configuration: OptionBinding with id \"failovermethod\" does not exist\n    Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/fedora-updates-testing.repo; Configuration: OptionBinding with id \"failovermethod\" does not exist\n    Invalid configuration value: failovermethod=priority in /etc/yum.repos.d/fedora-updates-testing.repo; Configuration: OptionBinding with id \"failovermethod\" does not exist\n    Last metadata expiration check: 0:00:11 ago on Wed 08 Sep 2021 11:49:33 AM.\n    Dependencies resolved.\n    =============================================================================================================================================================================================\n     Package                                                Architecture                       Version                                         Repository                                   Size\n    =============================================================================================================================================================================================\n    Upgrading:\n     ntfs-3g                                                x86_64                             2:2021.8.22-1.fc35                              updates-testing                             127 k\n     ntfs-3g-system-compression                             x86_64                             1.0-7.fc35                                      updates-testing                              28 k\n     ntfsprogs                                              x86_64                             2:2021.8.22-1.fc35                              updates-testing                             368 k\n    Installing dependencies:\n     ntfs-3g-libs                                           x86_64                             2:2021.8.22-1.fc35                              updates-testing                             174 k\n\n    Transaction Summary\n    =============================================================================================================================================================================================\n    Install  1 Package\n    Upgrade  3 Packages\n\n    Total download size: 697 k\n    Is this ok [y/N]: n\n    Operation aborted.\n\ni.e. if I run a `dnf update` with the updates-testing repo disabled, dnf picks the -2.fc35 packages from the side repo...but if I run `dnf update` with the updates-testing repo enabled, for some reason it prefers the -1.fc35 packages from updates-testing over the -2.fc35 packages from the side repo. I don't understand why, though.\n\nThis problem may 'go away' once the update is pushing to testing and replaces the -1.fc35 packages there, I guess.", "timestamp": "2021-09-08 18:52:35", "update_id": 339795, "user_id": 302, "id": 2200621, "testcase_feedback": [], "user": {"name": "adamwill", "email": "awilliam@redhat.com", "id": 302, "avatar": "https://seccdn.libravatar.org/avatar/51720fbb2ec5dfd2bc005ac374a3bfd3190cb8f45f3bb8d6bdf35fb6a051d03b?s=24&d=retro", "openid": "adamwill.id.fedoraproject.org", "groups": [{"name": "proventesters"}, {"name": "provenpackager"}, {"name": "packager"}, {"name": "qa-tools-sig"}, {"name": "fedora-contributor"}, {"name": "news"}, {"name": "gittriage"}, {"name": "sysadmin"}, {"name": "gitspin-kickstarts"}, {"name": "signed_fpca"}, {"name": "gitgeneric-release"}, {"name": "yak_farmers"}, {"name": "triagers"}, {"name": "qa"}, {"name": "sysadmin-qa"}, {"name": "fedorabugs"}, {"name": "ipausers"}, {"name": "gitmkinitrd"}, {"name": "qa-admin"}, {"name": "aws-qa"}, {"name": "change-wranglers"}, {"name": "fedora-ci-admins"}, {"name": "common-issues-triage"}, {"name": "sysadmin-main"}, {"name": "trust admins"}, {"name": "program-management"}, {"name": "gitfedora-project-schedule"}]}}}, {"karma": 0, "comment_id": 2201332, "bug_id": 2001755, "comment": {"karma": 0, "karma_critpath": 0, "text": "ah, no, it didn't 'go away', because the -1.fc35 builds are now in stable for f33, f34 and f35. So we still have -1.fc35 and -2.fc35 both available when the test runs, and dnf picks -1.fc35 over -2.fc35.\n\nAnother thing I can do is rebuild the openQA base disk images to include -1.fc35, so that's where we start out, and see if the update from there to -2.fc35 works. This is just papering over the issue, but I guess it'd be kinda acceptable, because it would mean the 'real world' consequence would only be that if both are available when a system updates from an older version, it will first go to -1.fc35, then -2.fc35, which isn't so bad. I'll try that.", "timestamp": "2021-09-09 00:21:04", "update_id": 339795, "user_id": 302, "id": 2201332, "testcase_feedback": [], "user": {"name": "adamwill", "email": "awilliam@redhat.com", "id": 302, "avatar": "https://seccdn.libravatar.org/avatar/51720fbb2ec5dfd2bc005ac374a3bfd3190cb8f45f3bb8d6bdf35fb6a051d03b?s=24&d=retro", "openid": "adamwill.id.fedoraproject.org", "groups": [{"name": "proventesters"}, {"name": "provenpackager"}, {"name": "packager"}, {"name": "qa-tools-sig"}, {"name": "fedora-contributor"}, {"name": "news"}, {"name": "gittriage"}, {"name": "sysadmin"}, {"name": "gitspin-kickstarts"}, {"name": "signed_fpca"}, {"name": "gitgeneric-release"}, {"name": "yak_farmers"}, {"name": "triagers"}, {"name": "qa"}, {"name": "sysadmin-qa"}, {"name": "fedorabugs"}, {"name": "ipausers"}, {"name": "gitmkinitrd"}, {"name": "qa-admin"}, {"name": "aws-qa"}, {"name": "change-wranglers"}, {"name": "fedora-ci-admins"}, {"name": "common-issues-triage"}, {"name": "sysadmin-main"}, {"name": "trust admins"}, {"name": "program-management"}, {"name": "gitfedora-project-schedule"}]}}}, {"karma": 1, "comment_id": 2202992, "bug_id": 2001755, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2021-09-10 12:36:29", "update_id": 339794, "user_id": 892, "id": 2202992, "testcase_feedback": [], "user": {"name": "vtrefny", "email": "vtrefny@redhat.com", "id": 892, "avatar": "https://seccdn.libravatar.org/avatar/95ac5aea9a3286a9c62547143dc353f378557eed37f6ea8ebe9b5eacb57d32fe?s=24&d=retro", "openid": "vtrefny.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "gitanaconda"}, {"name": "storage_apis"}]}}}, {"karma": 1, "comment_id": 2208166, "bug_id": 2001755, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2021-09-15 10:46:00", "update_id": 339794, "user_id": 5881, "id": 2208166, "testcase_feedback": [], "user": {"name": "geraldosimiao", "email": "geraldo.simiao.kutz@gmail.com", "id": 5881, "avatar": "https://seccdn.libravatar.org/avatar/03fa5b58e8ac78544bf41ad8ecf9ee1920f2ebedb86542c2f4cdf7ef15813168?s=24&d=retro", "openid": "geraldosimiao.id.fedoraproject.org", "groups": [{"name": "qa"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "ambassadors"}, {"name": "fedora-br"}, {"name": "advocates"}, {"name": "respins-sig"}]}}}]}, {"bug_id": 2004498, "title": "CVE-2021-33285 ntfs-3g: ntfs3g: when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer overflow can occur. [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2004505, "title": "CVE-2021-33286 ntfs-3g:  When a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2004521, "title": "CVE-2021-33287 ntfs-3g: When specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2004614, "title": "CVE-2021-33289 ntfs-3g: When a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2004627, "title": "CVE-2021-35266 ntfs-3g: When a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2004637, "title": "CVE-2021-35268 ntfs-3g: When a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2004656, "title": "CVE-2021-35267 ntfs-3g: A stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execution [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2004669, "title": "CVE-2021-35269 ntfs-3g: when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buffer overflow can occur [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2004683, "title": "CVE-2021-39251 ntfs-3g: A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2004692, "title": "CVE-2021-39252 ntfs-3g: A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2004699, "title": "CVE-2021-39253 ntfs-3g: A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 2004708, "title": "CVE-2021-39254 ntfs-3g: A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow [epel-all]", "security": true, "parent": false, "feedback": []}], "updateid": "FEDORA-EPEL-2021-8634a5d3f8", "karma": 0, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}