<?xml version="1.0" encoding="UTF-8"?>
<updates>
  <update from="updates@fedoraproject.org" status="stable" type="enhancement" version="2.0">
    <id>FEDORA-MODULAR-2020-51bde10eed</id>
    <title>cri-o-1.20-3320201026190339.601d93de</title>
    <issued date="2020-12-21 01:40:56"/>
    <updated date="2020-12-11 20:24:06"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>Moderate</severity>
    <summary>cri-o-1.20-3320201026190339.601d93de enhancement update</summary>
    <description>CRI-O 1.20.0</description>
    <references/>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="security" version="2.0">
    <id>FEDORA-MODULAR-2021-a6dfc20147</id>
    <title>varnish-6.0-3320210717084350.601d93de</title>
    <issued date="2021-07-26 00:21:37"/>
    <updated date="2021-07-17 19:05:41"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>Important</severity>
    <summary>varnish-6.0-3320210717084350.601d93de security update</summary>
    <description>Security fix for CVE-2021-36740</description>
    <references>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1982413" id="1982413" type="bugzilla" title="CVE-2021-36740 varnish:6.0/varnish: HTTP/2 request smuggling attack via a large Content-Length header for a POST request [fedora-all]"/>
    </references>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="testing" type="unspecified" version="2.0">
    <id>FEDORA-MODULAR-2021-05d5012894</id>
    <title>nginx-mainline-3320211102232012.601d93de</title>
    <issued date="2021-11-04 02:39:20"/>
    <updated date="2021-11-03 02:01:12"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>None</severity>
    <summary>nginx-mainline-3320211102232012.601d93de unspecified update</summary>
    <description>* Change: support for NPN instead of ALPN to establish HTTP/2    connections has been removed.
* Change: now nginx rejects SSL connections if ALPN is used by the    client, but no supported protocols can be negotiated.
* Change: the default value of the "sendfile_max_chunk" directive was    changed to 2 megabytes.
* Feature: the "proxy_half_close" directive in the stream module.
* Feature: the "ssl_alpn" directive in the stream module.
* Feature: the $ssl_alpn_protocol variable.
* Feature: support for SSL_sendfile() when using OpenSSL 3.0.
* Feature: the "mp4_start_key_frame" directive in the    ngx_http_mp4_module.    Thanks to Tracey Jaquith.
* Bugfix: in the $content_length variable when using chunked transfer    encoding.
* Bugfix: after receiving a response with incorrect length from a    proxied backend nginx might nevertheless cache the connection.       Thanks to Awdhesh Mathpal.
* Bugfix: invalid headers from backends were logged at the "info" level    instead of "error"; the bug had appeared in 1.21.1.
* Bugfix: requests might hang when using HTTP/2 and the "aio_write"    directive.</description>
    <references/>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="bugfix" version="2.0">
    <id>FEDORA-MODULAR-2020-be4dc65d95</id>
    <title>jmc-7-3320201104160448.601d93de</title>
    <issued date="2020-11-19 02:37:27"/>
    <updated date="2020-11-10 14:53:58"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>Important</severity>
    <summary>jmc-7-3320201104160448.601d93de bugfix update</summary>
    <description>Update JMC stream '7', dropping dependency on Eclipse module that is no longer shipped.





</description>
    <references/>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="security" version="2.0">
    <id>FEDORA-MODULAR-2021-aba3bac39d</id>
    <title>mysql-8.0-3320211031142409.601d93de</title>
    <issued date="2021-11-09 00:23:11"/>
    <updated date="2021-10-31 17:53:03"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>Moderate</severity>
    <summary>mysql-8.0-3320211031142409.601d93de security update</summary>
    <description>**MySQL 8.0.27**

Release notes:

    https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-27.html</description>
    <references>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2016142" id="2016142" type="bugzilla" title="CVE-2021-2478 CVE-2021-2479 CVE-2021-2481 CVE-2021-35546 CVE-2021-35575 CVE-2021-35577 CVE-2021-35591 CVE-2021-35596 CVE-2021-35597 CVE-2021-35602 CVE-2021-35604 CVE-2021-35607 CVE-2021-35608 ... mysql:8.0/community-mysql: various flaws [fedora-all]"/>
    </references>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="unspecified" version="2.0">
    <id>FEDORA-MODULAR-2021-2d28a0977c</id>
    <title>avocado-vt-82lts-3320210902113311.798db4a2</title>
    <issued date="2021-09-06 23:01:28"/>
    <updated date="2021-09-02 12:03:59"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>None</severity>
    <summary>avocado-vt-82lts-3320210902113311.798db4a2 unspecified update</summary>
    <description>updates
</description>
    <references/>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="enhancement" version="2.0">
    <id>FEDORA-MODULAR-2021-af104ccaec</id>
    <title>ghc-9.2-3320211101111632.646e4c76</title>
    <issued date="2021-11-11 02:33:17"/>
    <updated date="2021-11-02 02:30:54"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>None</severity>
    <summary>ghc-9.2-3320211101111632.646e4c76 enhancement update</summary>
    <description>GHC 9.2.1

- https://downloads.haskell.org/~ghc/9.2.1/docs/html/users_guide/9.2.1-notes.html</description>
    <references/>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="security" version="2.0">
    <id>FEDORA-MODULAR-2021-366e9a5a63</id>
    <title>postgresql-10-3320211019194202.601d93de</title>
    <issued date="2021-10-28 19:01:32"/>
    <updated date="2021-10-20 06:43:44"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>None</severity>
    <summary>postgresql-10-3320211019194202.601d93de security update</summary>
    <description>rebase</description>
    <references/>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="bugfix" version="2.0">
    <id>FEDORA-MODULAR-2021-193dd9fc09</id>
    <title>openmpi-4.0-3320211001235923.601d93de</title>
    <issued date="2021-10-13 00:10:59"/>
    <updated date="2021-10-05 01:14:16"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>None</severity>
    <summary>openmpi-4.0-3320211001235923.601d93de bugfix update</summary>
    <description>Update to 4.0.6</description>
    <references>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2003824" id="2003824" type="bugzilla" title="module openmpi:4.0 broken dependencies on Fedora 34 Workstation"/>
    </references>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="enhancement" version="2.0">
    <id>FEDORA-MODULAR-2021-b66ee379f6</id>
    <title>perl-bootstrap-5.32-3320210903064505.601d93de</title>
    <issued date="2021-09-15 18:51:18"/>
    <updated date="2021-09-07 11:42:31"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>None</severity>
    <summary>perl-bootstrap-5.32-3320210903064505.601d93de enhancement update</summary>
    <description>This release converts perl-bootstrap:5.32 to a static context.</description>
    <references/>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="bugfix" version="2.0">
    <id>FEDORA-MODULAR-2021-8320b27b17</id>
    <title>perl-5.32-3320210922073647.94c872f1</title>
    <issued date="2021-10-01 01:46:55"/>
    <updated date="2021-09-22 08:27:34"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>None</severity>
    <summary>perl-5.32-3320210922073647.94c872f1 bugfix update</summary>
    <description>This release fixes modularity metadata to be accepted with G.A. Fedora 33 package mananger. It also updates perl-Module-CoreList (data about Perl 5.35.4).</description>
    <references>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2004853" id="2004853" type="bugzilla" title="Module yaml error: Unexpected key in data: static_context"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2006089" id="2006089" type="bugzilla" title="perl-Module-CoreList-5.20210920 is available"/>
    </references>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="unspecified" version="2.0">
    <id>FEDORA-MODULAR-2021-2fa9d164a3</id>
    <title>nextcloud-nextcloud_22-3320210712193613.601d93de</title>
    <issued date="2021-07-24 00:24:39"/>
    <updated date="2021-07-15 07:43:43"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>None</severity>
    <summary>nextcloud-nextcloud_22-3320210712193613.601d93de unspecified update</summary>
    <description>Initial release of 22.0.0</description>
    <references/>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="unspecified" version="2.0">
    <id>FEDORA-MODULAR-2021-bd30f41d1f</id>
    <title>swig-4.0-3320210826081408.601d93de</title>
    <issued date="2021-09-03 00:18:24"/>
    <updated date="2021-08-26 16:48:13"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>None</severity>
    <summary>swig-4.0-3320210826081408.601d93de unspecified update</summary>
    <description>Built for F36</description>
    <references>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1997853" id="1997853" type="bugzilla" title="swig module missing from Fedora Rawhide (36)"/>
    </references>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="bugfix" version="2.0">
    <id>FEDORA-MODULAR-2020-f070abc275</id>
    <title>dwm-latest-3320201101015024.601d93de</title>
    <issued date="2020-11-10 02:31:42"/>
    <updated date="2020-11-01 02:25:31"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>Low</severity>
    <summary>dwm-latest-3320201101015024.601d93de bugfix update</summary>
    <description>Updating dwm:latest to the current upstream HEAD from Mar 3, 2020, 61bb8b2.</description>
    <references/>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="security" version="2.0">
    <id>FEDORA-MODULAR-2021-f620e155b8</id>
    <title>ruby-2.7-3320210609104615.601d93de</title>
    <issued date="2021-07-25 00:33:38"/>
    <updated date="2021-07-16 21:33:54"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>Moderate</severity>
    <summary>ruby-2.7-3320210609104615.601d93de security update</summary>
    <description>Security fix for CVE-2021-31799 CVE-2021-31810 CVE-2021-32066 CVE-2021-28965</description>
    <references>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1947526" id="1947526" type="bugzilla" title="CVE-2021-28965 ruby: XML round-trip vulnerability in REXML"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1947529" id="1947529" type="bugzilla" title="CVE-2021-28965 ruby:2.7/ruby: XML round-trip vulnerability in REXML [fedora-33]"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1980126" id="1980126" type="bugzilla" title="CVE-2021-31810 ruby: FTP PASV command response can cause Net::FTP to connect to arbitrary host"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1980128" id="1980128" type="bugzilla" title="CVE-2021-32066 ruby: StartTLS stripping vulnerability in Net::IMAP"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1980132" id="1980132" type="bugzilla" title="CVE-2021-31799 rubygem-rdoc: Command injection vulnerability in RDoc"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1980568" id="1980568" type="bugzilla" title="CVE-2021-31799 CVE-2021-31810 CVE-2021-32066 ruby:2.7/ruby: various flaws [fedora-all]"/>
    </references>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="security" version="2.0">
    <id>FEDORA-MODULAR-2021-301b00749a</id>
    <title>nodejs-16-3320211013191319.601d93de</title>
    <issued date="2021-10-23 02:55:24"/>
    <updated date="2021-10-15 15:00:11"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>Moderate</severity>
    <summary>nodejs-16-3320211013191319.601d93de security update</summary>
    <description>## 2021-10-12, Version 16.11.1 (Current), @danielleadams

This is a security release.

### Notable changes

* **CVE-2021-22959**: HTTP Request Smuggling due to spaced in headers (Medium)
  * The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at [CVE-2021-22959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959) after publication.
* **CVE-2021-22960**: HTTP Request Smuggling when parsing the body (Medium)
  * The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at [CVE-2021-22960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960) after publication.

## 2021-10-08, Version 16.11.0 (Current), @danielleadams

### Notable Changes

* **crypto**
  * update root certificates (Richard Lau) [#40280](https://github.com/nodejs/node/pull/40280)
* **deps**
  * upgrade npm to 8.0.0 (npm team) [#40369](https://github.com/nodejs/node/pull/40369)
  * update `nghttp2` to v1.45.1 (thunder-coding) [#40206](https://github.com/nodejs/node/pull/40206)
  * update V8 to 9.4.146.19 (Michaël Zasso) [#40285](https://github.com/nodejs/node/pull/40285)
* **tools**
  * update certdata.txt (Richard Lau) [#40280](https://github.com/nodejs/node/pull/40280)

</description>
    <references>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2012396" id="2012396" type="bugzilla" title="nodejs-16.11.1 is available"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2014057" id="2014057" type="bugzilla" title="CVE-2021-22959 llhttp: HTTP Request Smuggling due to spaced in headers"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2014059" id="2014059" type="bugzilla" title="CVE-2021-22960 llhttp: HTTP Request Smuggling when parsing the body"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2014066" id="2014066" type="bugzilla" title="CVE-2021-22960 nodejs: llhttp: HTTP Request Smuggling when parsing the body [fedora-all]"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2014115" id="2014115" type="bugzilla" title="CVE-2021-22960 nodejs:16/nodejs: llhttp: HTTP Request Smuggling when parsing the body [fedora-all]"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2014123" id="2014123" type="bugzilla" title="CVE-2021-22959 nodejs:16/nodejs: llhttp: HTTP Request Smuggling due to spaced in headers [fedora-all]"/>
    </references>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="security" version="2.0">
    <id>FEDORA-MODULAR-2021-fa1891286b</id>
    <title>avocado-latest-3320210728003410.601d93de</title>
    <issued date="2021-08-07 00:43:42"/>
    <updated date="2021-07-28 15:54:37"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>Low</severity>
    <summary>avocado-latest-3320210728003410.601d93de security update</summary>
    <description>Update to Avocado 90.0.</description>
    <references/>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="enhancement" version="2.0">
    <id>FEDORA-MODULAR-2021-fa9d9b4144</id>
    <title>sway-rolling-3320210219163353.601d93de</title>
    <issued date="2021-03-01 17:24:23"/>
    <updated date="2021-02-21 05:57:49"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>None</severity>
    <summary>sway-rolling-3320210219163353.601d93de enhancement update</summary>
    <description>- rofi 1.6.1
- waybar 0.9.5</description>
    <references/>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
  <update from="updates@fedoraproject.org" status="stable" type="security" version="2.0">
    <id>FEDORA-MODULAR-2021-118efad6bc</id>
    <title>mariadb-10.5-3320210511134129.601d93de</title>
    <issued date="2021-05-20 01:33:37"/>
    <updated date="2021-05-11 18:37:36"/>
    <rights>Copyright (C) 2021 Red Hat, Inc. and others.</rights>
    <release>Fedora 33 Modular</release>
    <severity>Moderate</severity>
    <summary>mariadb-10.5-3320210511134129.601d93de security update</summary>
    <description>**MariaDB 10.5.10**

Release notes:

    https://mariadb.com/kb/en/mariadb-10510-release-notes/</description>
    <references>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1954278" id="1954278" type="bugzilla" title="CVE-2021-2154 CVE-2021-2166 mariadb: various flaws [fedora-all]"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1954281" id="1954281" type="bugzilla" title="CVE-2021-2154 CVE-2021-2166 mariadb:10.5/mariadb: various flaws [fedora-all]"/>
    </references>
    <pkglist>
      <collection short="F33M">
        <name>Fedora 33 Modular</name>
      </collection>
    </pkglist>
  </update>
</updates>
