+++ This bug was initially created as a clone of Bug #847825 +++ Description of problem: Current version of calibre package in Fedora-17 (calibre-0.8.50-1.fc17) uses its own bundled copy of the python-feedparser code (BUILD/calibre/src/calibre/web/feeds/feedparser.py), instead of the system one. Though right now it seems to be updated against all of the recent python-feedparser flaws (CVE-2009-5065, CVE-2011-1156, CVE-2011-1157, and CVE-2011-1158), it is not a good practice to use embedded copy instead of the system one (since once a security flaw is found in the embedded package, both packages [the system one, and the embedding one] need to be updated). Version-Release number of selected component (if applicable): calibre-0.8.50-1.fc17 How reproducible: Always Steps to Reproduce: 1. Check content of BUILD/calibre/src/calibre/web/feeds/feedparser.py and / or check output of 'rpm -q --requires calibre' command Actual results: python-feedparser not listed in above rpm command output Expected results: python-feedparser listed in rpm check && calibre using system python-feedparser version (python-feedparser-5.1.2-2.fc17 available currently, also containing fixes for above four CVE issues already) Additional info: See similar https://bugzilla.redhat.com/show_bug.cgi?id=846757 if necessary
Thanks for the info. I think I have this unbundled in rawhide/f18 and update for f17 coming. I'm going to have to look at f16, since it's so many versions behind.
calibre-0.8.63-1.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/calibre-0.8.63-1.fc17
Package calibre-0.8.63-1.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing calibre-0.8.63-1.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-11860/calibre-0.8.63-1.fc17 then log in and leave karma (feedback).
calibre-0.8.63-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.