Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
urity framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-qrx8-8545-4wg2 - https://x-stream.github.io/CVE-2021-39148.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ -
CVE ID: CVE-2021-39149 State: PUBLISHED Published: 2021-08-23T18:05:44 Last Updated: 2024-08-04T01:58:18.235Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by def
urity framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-3ccq-5vw3-2p6x - https://x-stream.github.io/CVE-2021-39149.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ -
CVE ID: CVE-2021-39150 State: PUBLISHED Published: 2021-08-23T18:20:15 Last Updated: 2024-08-04T01:58:18.258Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-502, CWE-918 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required t
who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp - https://x-stream.github.io/CVE-2021-39150.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://li
ject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20210923-0003/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-39151 State: PUBLISHED Published: 2021-08-23T17:55:09 Last Updated: 2024-08-04T01:58:18.203Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by def
urity framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-hph2-m3g5-xxv4 - https://x-stream.github.io/CVE-2021-39151.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ -
CVE ID: CVE-2021-39152 State: PUBLISHED Published: 2021-08-23T18:20:10 Last Updated: 2024-08-04T01:58:18.220Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-502, CWE-918 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required t
who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-xw4p-crpj-vjx2 - https://x-stream.github.io/CVE-2021-39152.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://li
CVE ID: CVE-2021-39153 State: PUBLISHED Published: 2021-08-23T17:55:14 Last Updated: 2024-08-04T01:58:18.194Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a w
th JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v - https://x-stream.github.io/CVE-2021-39153.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/arch
kage-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7/ - https://www.debian.org/security/2021/dsa-5004 - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20210923-0003/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-39154 State: PUBLISHED Published: 2021-08-23T17:50:09 Last Updated: 2024-08-04T01:58:18.219Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-434, CWE-502 Description: XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by def
urity framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-6w62-hx7r-mw68 - https://x-stream.github.io/CVE-2021-39154.html - https://lists.debian.org/debian-lts-announce/2021/09/msg00017.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB/ -
CVE ID: CVE-2021-39155 State: PUBLISHED Published: 2021-08-24T22:25:18 Last Updated: 2024-08-04T01:58:18.140Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: istio Products: istio Problem Types: CWE-178 Description: Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. According to [RFC 4343](https://datatracker.ietf.org/doc/html/rfc4343), Istio authorization policy should compare the hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case sensitive. The proxy will route the request hostname in a c
a case insensitive way, but currently the comparison is case sensitive. The proxy will route the request hostname in a case-insensitive way which means the authorization policy could be bypassed. As an example, the user may have an authorization policy that rejects request with hostname "httpbin.foo" for some source IPs, but the attacker can bypass this by sending the request with hostname "Httpbin.Foo". Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize Host header before the authorization check. This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/bes
his is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/istio/istio/security/advisories/GHSA-7774-7vr3-cc8j - https://datatracker.ietf.org/doc/html/rfc4343
CVE ID: CVE-2021-39156 State: PUBLISHED Published: 2021-08-24T22:30:12 Last Updated: 2024-08-04T01:58:18.136Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: istio Products: istio Problem Types: CWE-863 Description: Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8.
pass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize the path. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/istio/istio/security/advisories/GHSA-hqxw-mm44-gc4r - https://istio.io/latest/news/security/istio-security-2021-008
CVE ID: CVE-2021-39157 State: PUBLISHED Published: 2021-08-24T18:15:11 Last Updated: 2024-08-04T01:58:18.139Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: sonicdoe Products: detect-character-encoding Problem Types: CWE-755 Description: detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in [detect-character-encoding v0.7.0](https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.7.0). No workaround are available and all users should update to resolve this issue. Additional An
oding/releases/tag/v0.7.0). No workaround are available and all users should update to resolve this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sonicdoe/detect-character-encoding/security/advisories/GHSA-jqfh-8hw5-fqjr - https://github.com/sonicdoe/detect-character-encoding/issues/15 - https://github.com/sonicdoe/detect-character-encoding/commit/992a11007fff6cfd40b952150ab8d30410c4a20a
CVE ID: CVE-2021-39158 State: PUBLISHED Published: 2021-08-23T20:15:09 Last Updated: 2024-08-04T01:58:18.277Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NVIDIA Products: caffe Problem Types: CWE-345 Description: NVCaffe's python required dependencies list used to contain `gfortran`version prior to 0.17.4, entry which does not exist in the repository pypi.org. An attacker could potentially have posted malicious files to pypi.org causing a user to install it within NVCaffe. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NVIDIA/caffe/security/advisories/GHSA-fmpp-8pwg-vwh9
CVE ID: CVE-2021-39159 State: PUBLISHED Published: 2021-08-25T18:20:09 Last Updated: 2024-08-04T01:58:18.117Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: jupyterhub Products: binderhub Problem Types: CWE-94 Description: BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input could execute code in the BinderHub context, with the potential to egress credentials of the BinderHub deployment, including JupyterHub API token
BinderHub context, with the potential to egress credentials of the BinderHub deployment, including JupyterHub API tokens, kubernetes service accounts, and docker registry credentials. This may provide the ability to manipulate images and other user created pods in the deployment, with the potential to escalate to the host depending on the underlying kubernetes configuration. Users are advised to update to version 0.2.0-n653. If users are unable to update they may disable the git repo provider by specifying the `BinderHub.repo_providers` as a workaround. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyterhub/binderhub/security/advisories/GHSA-9jjr-qqfp
Notes: - CVE Program Container: References: - https://github.com/jupyterhub/binderhub/security/advisories/GHSA-9jjr-qqfp-ppwx - https://github.com/jupyterhub/binderhub/commit/195caac172690456dcdc8cc7a6ca50e05abf8182.patch
CVE ID: CVE-2021-39160 State: PUBLISHED Published: 2021-08-25T18:10:11 Last Updated: 2024-08-04T01:58:18.218Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: jupyterhub Products: nbgitpuller Problem Types: CWE-94 Description: nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupy
for users who can not upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52j - https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481 - https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25
CVE ID: CVE-2021-39161 State: PUBLISHED Published: 2021-08-26T20:00:11 Last Updated: 2024-08-04T01:58:18.168Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: discourse Products: discourse Problem Types: CWE-79 Description: Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross-site scripting(XSS) attacks. This is mitigated by Discourse's default Content Security Policy and this vulnerability only affects sites which have modified or disabled or changed Discourse's default Content Security Policy have allowed for moderators to modify categories. This issue is patched in the latest stable, beta
tent Security Policy have allowed for moderators to modify categories. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to ensure that the Content Security Policy is enabled, and has not been modified in a way which would make it more vulnerable to XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/discourse/discourse/security/advisories/GHSA-xhmc-9jwm-wqph
CVE ID: CVE-2021-39162 State: PUBLISHED Published: 2021-09-09T22:05:11 Last Updated: 2024-08-04T01:58:18.235Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: pomerium Products: pomerium Problem Types: CWE-754 Description: Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered. Additi
tched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ - https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgv - https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8
CVE ID: CVE-2021-39163 State: PUBLISHED Published: 2021-08-31T16:00:11 Last Updated: 2024-08-04T01:58:18.227Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: matrix-org Products: synapse Problem Types: CWE-200 Description: Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where the vulnerable homeserver is in the room and untrusted users are permitted to create groups (communities). By default, only homeserver administrators can create groups
trusted users are permitted to create groups (communities). By default, only homeserver administrators can create groups. However, homeserver administrators can already access this information in the database or using the admin API. As a result, only homeservers where the configuration setting `enable_group_creation` has been set to `true` are impacted. Server administrators should upgrade to 1.41.1 or higher to patch the vulnerability. There are two potential workarounds. Server administrators can set `enable_group_creation` to `false` in their homeserver configuration (this is the default value) to prevent creation of groups by non-administrators. Administrators that are using a reverse pr
is is the default value) to prevent creation of groups by non-administrators. Administrators that are using a reverse proxy could, with partial loss of group functionality, block the endpoints `/_matrix/client/r0/groups/{group_id}/rooms` and `/_matrix/client/unstable/groups/{group_id}/rooms`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrix-org/synapse/security/advisories/GHSA-jj53-8fmw-f2w2 - https://github.com/matrix-org/synapse/commit/cb35df940a - https://github.com/matrix-org/synapse/releases/tag/v1.41.1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN/ - https://l
oject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF/
CVE ID: CVE-2021-39164 State: PUBLISHED Published: 2021-08-31T16:20:10 Last Updated: 2024-08-04T01:58:18.118Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: matrix-org Products: synapse Problem Types: CWE-200 Description: Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators sho
the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrix-org/synapse/commit/cb35df940a - https://github.com/matrix-org/synapse/releases/tag/v1.41.1 - https://github.com/
/matrix-org/synapse/commit/cb35df940a - https://github.com/matrix-org/synapse/releases/tag/v1.41.1 - https://github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3q - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF/