The developers of the Fedora project announced the release of Fedora 37 has been postponed to November 15 due to the need to address a critical vulnerability in the OpenSSL library. Since details of the vulnerability will only be disclosed on November 1, and it is unclear how much time will be required to implement the fix in the distribution, it has been decided to delay the release by two weeks. This is not the first delay — the release of Fedora 37 was originally expected on October 18, but has been postponed twice (to October 25 and November 1) due to failure to meet quality criteria.
Currently, there are three issues remaining in the final testing builds that are considered blocking for the release. Besides the need to fix the vulnerability in OpenSSL, there is a mention of the kwin compositor freezing when starting a KDE Plasma session based on Wayland with the nomodeset (basic graphics) mode set in UEFI, and the gnome-calendar application freezing when editing recurring events.
The critical vulnerability in OpenSSL affects only the 3.0.x branch; releases 1.1.1x are not vulnerable. The OpenSSL 3.0 branch is already used in distributions such as Ubuntu 22.04, CentOS Stream 9, RHEL 9, OpenMandriva 4.2, Gentoo, Fedora 36, and Debian Testing/Unstable. In SUSE Linux Enterprise 15 SP4 and openSUSE Leap 15.4, packages with OpenSSL 3.0 are available optionally, while system packages use the 1.1.1 branch. Debian 11, Arch Linux, Void Linux, Ubuntu 20.04, Slackware, ALT Linux, RHEL 8, OpenWrt, and Alpine Linux 3.16 remain on OpenSSL 1.x branches.
The vulnerability has been classified as critical; details are not yet provided, but in terms of severity, it is similar to the notorious Heartbleed vulnerability. A critical severity level implies the potential for remote attacks on typical configurations. Critical issues may include problems that lead to remote leaks of memory contents, de serverthe execution of malicious code, or the compromise of server private keys. The fix for OpenSSL 3.0.7 addressing the issue and details about the vulnerability will be published on November 1.
Bron: opennet.ru
