Update routinator to the latest, pulling in updated dependencies (rpki and syslog), and switch fern to using syslog 7 instead of 6 for this update, and loosen the syslog version bound for ifcfg-devname.
This release fixes a number of vulnerabilities and security issues identified by a security audit performed by X41 D-Sec and financed by Sovereign Tech Agency.
We advise all users to upgrade at their earliest convenience.
This issue was assigned CVE-2026-49232.
This fixes a path traversal vulnerability that has been assigned CVE-2026-49233.
This fixes a vulnerability that has been assigned CVE-2026-49234.
This fixes a vulnerability that has been assigned CVE-2026-49235.
max_object_size config option. (#1090)-e and --rsh options will now be rejected in the rsync-args config option. Similarly, Routinator will not start if the equivalent evironment variable RSYNC_RSH is set. (#1091)--rrdp-tcp-keepalive to be a command line option rather than a command line argument. ([1085])PrivateUsers restriction in systemd unit files to allow user to run Routinator on privileged ports. (#1068)rrdp-keep-responses feature. We suggest the use of an HTTP proxy such as mitmproxy instead.This once and for all fixes CVE-2023-39916 which returned again in release 0.14.0. (#1055)
* Messages about issues with repositories and publication points are now logged separately and by default are only visible in the status HTTP server endpoints. The new log-repository-issues option can be used to have these messages also written to the log. ([#1054])
* Changed how server mode deals with broken or missing local exception files. Previously, Routinator would just stop updating until they are fixed, leading to updates being stalled if the operator misses the error messages. Now it will log a warning and keep using the previous set of local exceptions. When starting, it will exit with an error message if there are broken or missing local exception files. (#1060)
* Changed the RRDP timeouts: introduced a new config variable rrdp-read-timeout that provides a timeout for individual network operations (primarily: read from the server). Its default is 10 seconds. This timeout is also used for connecting of no specific value is given, significantly speeding up validation runs.
In addition, the RRDP timeout was increased from 300 to 600 seconds to better deal with slow transmission of large snapshots of some repositories. (#1061)
refresh even if objects expire earlier. The new min-refresh option can be used to specify a short minimum refresh time if objects expire before the refresh time. If this value is set to 0, the old behaviour is restored. (#1027)dump command now prints the source directories of the data it dumps. (#1045)--update-after option to the vrps subcommand that skips updating the local cache if the last successful validation run was known to be less than a given number of minutes ago. (#1049)/validity HTTP server endpoint now accepts POST requests with a JSON body containing multiple routes to be checked all at once. (#1053)This fixes an issue where an accidentally or maliciously manipulated locally stored manifest could block update of a legitimate new manifest which was reported by Zizhi Shang, Zhechao Lin, Jiahao Cao, Yangyang Wang, Mingwei Xu of the Institute for Network Sciences and Cyberspace (INSC), Tsinghua University.
Please log in to add feedback.
This update's test gating status has been changed to 'waiting'.
This update has been submitted for testing by bodhi.
This update's test gating status has been changed to 'ignored'.
This update has been pushed to testing.
salimma edited this update.
New build(s):
Removed build(s):
Karma has been reset.
This update has been submitted for testing by salimma.
Checking update: FEDORA-EPEL-2026-cc5650cf72
Branch: c10s (@epel)
Packages
4 package(s): 4 updated, 0 new
0.7.1-4.el10_2→0.7.1-6.el10_3(rust-fern)0.14.2-4.el10_2→0.15.2-1.el10_3(rust-routinator)0.18.6-4.el10_3→0.19.3-2.el10_3(rust-rpki)6.1.1-6.el10_3→7.0.0-2.el10_3(rust-syslog)Analysis
Removed Provides (4)
crate(fern/syslog-6) = 0.7.1crate(fern/syslog6) = 0.7.1rust-fern+syslog-6-devel = 0.7.1-4.el10_2rust-fern+syslog6-devel = 0.7.1-4.el10_2Generated by ebranch 0.15.3 —
ebranch check-update --give-karma -v FEDORA-EPEL-2026-cc5650cf72 -b c10s -r @epelI'm looking into why rmdepcheck doesn't catch that. I think it may be a
dnf repoclosurebug. Will investigate more tomorrow.This update has been pushed to testing.
Ah I think I see the issue, the rpmdepcheck test I saw ran against rust-rpki+quick-xml-devel-0.19.3-2.el10_3, but the build in testing at the time I checked was rust-rpki+quick-xml-devel-0.19.3-1.el10_3. That release bump specifically has the fix for this. Sorry for the noise, that's my mistake for not noticing the builds had changed after it initially pushed to the testing repo. I can confirm the new build installs correctly.
This update can be pushed to stable now if the maintainer wishes
salimma edited this update.
It was a race condition - the updates pushing the new routinator + rpki pre-existed me building the quick-xml security fix, and the dependency analysis done separately did not catch that of course the new rpki did not have its dependency bound relaxed enough to cover 0.41 as it was done earlier.
This update has been submitted for stable by salimma.
This update has been pushed to stable.