[Rpm-maint] RPM 4.14.0 release candidate 2 is out

Panu Matilainen pmatilai at redhat.com
Thu Sep 28 14:06:00 UTC 2017

There aren't that many changes since rc1, but enough to warrant a second 
release candidate instead of going for final. The important ones being:

- Fix a bug of file triggers failing on some packages (MgBug:18797, in 
4.13.x already)
- Fix a regression on 32bit architectures on generation of packages over 
2GB in size (RhBug:1492587)
- Fix rpm following arbitrary directory symlinks on installation 
- Fix rpm following symlinks on file creation (CVE-2017-7501)
- Adjust verification to match the new directory symlink rule
- Forbid 'if' richops in 'or' context and 'unless' richops in 'and' context

As usual, the details + download info at:


Oh and release notes changed to use SHA256 instead of SHA1 for the 
source checksum. Guess it's about time.

On behalf of the rpm-team,

	- Panu -

More information about the Rpm-maint mailing list