Fedora 32.x — End of Life
EOL Actively exploitedFedora 32.x reached end of life on May 25, 2021, 1977 days ago, and no longer receives security fixes. The most recent release in this series is 32. 29 CVEs are tracked for this series, including 1 critical and 1 actively exploited according to CISA KEV. The next major version is Fedora 33. See Fedora 33 →
Fedora 32.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 32 | Apr 28, 2020 | — | May 25, 2021 | 32 | EOL |
CVEs affecting Fedora 32.x (29)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-31204 | HIGH | 7.3 | 1.19% | — | 32 | .NET and Visual Studio Elevation of Privilege Vulnerability | May 11, 2021 |
| CVE-2021-25317 | LOW | 3.3 | 0.26% | — | 32 | A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE… | May 5, 2021 |
| CVE-2021-23133 | MEDIUM | 6.7 | 0.47% | — | 32 | A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalatio… | Apr 22, 2021 |
| CVE-2021-28972 | MEDIUM | 6.7 | 0.80% | — | 32 | In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolera… | Mar 22, 2021 |
| CVE-2020-27171 | MEDIUM | 6.0 | 0.57% | — | 32 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resulta… | Mar 20, 2021 |
| CVE-2020-27170 | MEDIUM | 4.7 | 0.56% | — | 32 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds spec… | Mar 20, 2021 |
| CVE-2020-25639 | MEDIUM | 4.4 | 0.36% | — | 32 | A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.… | Mar 4, 2021 |
| CVE-2020-35496 | MEDIUM | 5.5 | 1.15% | — | 32 | There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to sub… | Jan 4, 2021 |
| CVE-2020-35495 | MEDIUM | 5.5 | 1.21% | — | 32 | There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the obj… | Jan 4, 2021 |
| CVE-2020-35494 | MEDIUM | 6.1 | 1.12% | — | 32 | There's a flaw in binutils /opcodes/tic4x-dis.c. An attacker who is able to submit a crafted input file to be processed … | Jan 4, 2021 |
| CVE-2020-35493 | MEDIUM | 5.5 | 1.13% | — | 32 | A flaw exists in binutils in bfd/pef.c. An attacker who is able to submit a crafted PEF file to be parsed by objdump cou… | Jan 4, 2021 |
| CVE-2020-1971 | MEDIUM | 5.9 | 7.05% | — | 32 | The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known… | Dec 8, 2020 |
| CVE-2020-25649 | HIGH | 7.5 | 17.71% | — | 32 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allow… | Dec 3, 2020 |
| CVE-2020-28941 | MEDIUM | 5.5 | 0.33% | — | 32 | An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers … | Nov 19, 2020 |
| CVE-2020-11979 | HIGH | 7.5 | 8.01% | — | 32 | As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the… | Oct 1, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 32 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2019-20907 | HIGH | 7.5 | 2.98% | — | 32 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when o… | Jul 13, 2020 |
| CVE-2020-14422 | MEDIUM | 5.9 | 12.70% | — | 32 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,… | Jun 18, 2020 |
| CVE-2020-8619 | MEDIUM | 4.9 | 2.10% | — | 32 | In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edi… | Jun 17, 2020 |
| CVE-2020-13632 | MEDIUM | 5.5 | 0.60% | — | 32 | ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. | May 27, 2020 |
| CVE-2020-13631 | MEDIUM | 5.5 | 0.65% | — | 32 | SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c an… | May 27, 2020 |
| CVE-2020-13630 | HIGH | 7.0 | 1.03% | — | 32 | ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. | May 27, 2020 |
| CVE-2020-9484 | HIGH | 7.0 | 55.52% | — | 32 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)… | May 20, 2020 |
| CVE-2020-1967 | HIGH | 7.5 | 53.33% | — | 32 | Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due… | Apr 21, 2020 |
| CVE-2020-10932 | MEDIUM | 4.7 | 0.25% | — | 32 | An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough s… | Apr 15, 2020 |
| CVE-2020-9281 | MEDIUM | 6.1 | 4.30% | — | 32 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attacke… | Mar 7, 2020 |
| CVE-2020-1938 | CRITICAL | 9.8 | 99.27% | KEV | 32 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc… | Feb 24, 2020 |
| CVE-2020-8492 | MEDIUM | 6.5 | 6.61% | — | 32 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTT… | Jan 30, 2020 |
| CVE-2019-1551 | MEDIUM | 5.3 | 14.29% | — | 32 | There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC a… | Dec 6, 2019 |
Fedora 32.x is EOL — migrate to Fedora 33.x
Fedora 33.x is the next major release. Plan your upgrade before Fedora 32.x stops receiving security patches.
Add a Fedora 32 EOL badge to your README
Show your users which Fedora version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/fedora/32)Frequently asked questions
Is Fedora 32 end of life?
Yes. All Fedora 32.x releases have reached end of life and no longer receive security patches. There are 29 known CVEs affecting Fedora 32.x, including 1 critical. Migrate to Fedora 33.x as soon as possible.
What CVEs affect Fedora 32?
There are 29 CVEs tracked for Fedora 32.x, including 1 critical severity issue and 1 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest Fedora 32 version?
The latest Fedora 32.x patch release is 32, released on April 28, 2020. Always run the latest patch to benefit from all security fixes.
How to migrate from Fedora 32 to Fedora 33?
To migrate from Fedora 32 to Fedora 33: (1) review the official Fedora 33 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Fedora 32 in production?
No. Fedora 32 has reached end of life and security vulnerabilities are no longer patched. Critically, 1 CVE affecting Fedora 32.x is in the CISA KEV catalog — meaning it is actively exploited in the wild. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA