Fedora 33.x — End of Life
EOL Critical risk EOL: Nov 30, 20211 release in this series64 CVEs
Fedora 33.x reached end of life on Nov 30, 2021, 1788 days ago, and no longer receives security fixes. The most recent release in this series is 33. 64 CVEs are tracked for this series, including 3 critical. 1 of them was published after the end of life of the affected cycle and will not get an official patch. The next major version is Fedora 34. See Fedora 34 →
Fedora 33.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 33 | Oct 27, 2020 | — | Nov 30, 2021 | 33 | EOL |
CVEs affecting Fedora 33.x (64)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 33 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-3928 | HIGH | 7.8 | 0.63% | — | 33 | vim is vulnerable to Use of Uninitialized Variable | Nov 5, 2021 |
| CVE-2021-3927 | HIGH | 7.8 | 1.70% | — | 33 | vim is vulnerable to Heap-based Buffer Overflow | Nov 5, 2021 |
| CVE-2021-41184 | MEDIUM | 6.5 | 40.76% | — | 33 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option… | Oct 26, 2021 |
| CVE-2021-41183 | MEDIUM | 6.5 | 8.53% | — | 33 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text`… | Oct 26, 2021 |
| CVE-2021-41182 | MEDIUM | 6.5 | 39.36% | — | 33 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` … | Oct 26, 2021 |
| CVE-2021-35556 | MEDIUM | 5.3 | 8.46% | — | 33 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported … | Oct 20, 2021 |
| CVE-2021-41864 | HIGH | 7.8 | 0.41% | — | 33 | prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to tri… | Oct 2, 2021 |
| CVE-2021-41617 | HIGH | 7.0 | 2.54% | — | 33 | sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalatio… | Sep 26, 2021 |
| CVE-2021-35267 | HIGH | 7.8 | 0.48% | — | 33 | NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror all… | Sep 7, 2021 |
| CVE-2021-35266 | HIGH | 7.8 | 0.48% | — | 33 | In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer… | Sep 7, 2021 |
| CVE-2021-33287 | HIGH | 7.8 | 0.41% | — | 33 | In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a he… | Sep 7, 2021 |
| CVE-2021-35269 | HIGH | 7.8 | 0.47% | — | 33 | NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_se… | Sep 7, 2021 |
| CVE-2021-35268 | HIGH | 7.8 | 0.47% | — | 33 | In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a h… | Sep 7, 2021 |
| CVE-2021-33289 | HIGH | 7.8 | 0.48% | — | 33 | In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflo… | Sep 7, 2021 |
| CVE-2021-40490 | HIGH | 7.0 | 0.30% | — | 33 | A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux ker… | Sep 3, 2021 |
| CVE-2021-39152 | HIGH | 8.5 | 11.37% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39150 | HIGH | 8.5 | 3.43% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39140 | MEDIUM | 6.5 | 5.91% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39154 | HIGH | 8.5 | 4.73% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39153 | HIGH | 8.5 | 4.45% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39151 | HIGH | 8.5 | 4.73% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39149 | HIGH | 8.5 | 4.73% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39148 | HIGH | 8.5 | 4.73% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39147 | HIGH | 8.5 | 4.73% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39146 | HIGH | 8.5 | 14.29% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39145 | HIGH | 8.5 | 4.06% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39141 | HIGH | 8.5 | 16.11% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-39139 | HIGH | 8.5 | 4.54% | — | 33 | XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allo… | Aug 23, 2021 |
| CVE-2021-38166 | HIGH | 7.8 | 0.31% | — | 33 | In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when ma… | Aug 7, 2021 |
| CVE-2021-34556 | MEDIUM | 5.5 | 0.41% | — | 33 | In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via … | Aug 2, 2021 |
| CVE-2021-35477 | MEDIUM | 5.5 | 0.46% | — | 33 | In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via … | Aug 2, 2021 |
| CVE-2021-31957 | MEDIUM | 5.9 | 5.13% | — | 33 | ASP.NET Core Denial of Service Vulnerability | Jun 8, 2021 |
| CVE-2021-29505 | HIGH | 7.5 | 77.23% | — | 33 | XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4… | May 28, 2021 |
| CVE-2021-23134 | HIGH | 7.8 | 0.37% | — | 33 | Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to elevate their pr… | May 12, 2021 |
| CVE-2021-31204 | HIGH | 7.3 | 1.19% | — | 33 | .NET and Visual Studio Elevation of Privilege Vulnerability | May 11, 2021 |
| CVE-2021-3501 | HIGH | 7.1 | 0.37% | — | 33 | A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to … | May 6, 2021 |
| CVE-2021-25317 | LOW | 3.3 | 0.26% | — | 33 | A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE… | May 5, 2021 |
| CVE-2021-23133 | MEDIUM | 6.7 | 0.47% | — | 33 | A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalatio… | Apr 22, 2021 |
| CVE-2021-21351 | MEDIUM | 5.4 | 82.13% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21350 | MEDIUM | 5.3 | 15.23% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21349 | MEDIUM | 6.1 | 46.82% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21348 | MEDIUM | 5.3 | 13.83% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21347 | MEDIUM | 6.1 | 14.30% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21346 | MEDIUM | 6.1 | 76.36% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21345 | MEDIUM | 5.8 | 72.32% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21344 | MEDIUM | 5.3 | 75.98% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21343 | MEDIUM | 5.3 | 46.66% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21342 | MEDIUM | 5.3 | 49.99% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulne… | Mar 23, 2021 |
| CVE-2021-21341 | HIGH | 7.5 | 77.80% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnera… | Mar 23, 2021 |
| CVE-2021-28972 | MEDIUM | 6.7 | 0.80% | — | 33 | In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolera… | Mar 22, 2021 |
| CVE-2020-27171 | MEDIUM | 6.0 | 0.57% | — | 33 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resulta… | Mar 20, 2021 |
| CVE-2020-27170 | MEDIUM | 4.7 | 0.56% | — | 33 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds spec… | Mar 20, 2021 |
| CVE-2020-25639 | MEDIUM | 4.4 | 0.36% | — | 33 | A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.… | Mar 4, 2021 |
| CVE-2020-11987 | HIGH | 8.2 | 13.28% | — | 33 | Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPan… | Feb 24, 2021 |
| CVE-2020-26259 | MEDIUM | 6.8 | 82.39% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to… | Dec 16, 2020 |
| CVE-2020-26258 | MEDIUM | 6.3 | 81.81% | — | 33 | XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Fo… | Dec 16, 2020 |
| CVE-2020-1971 | MEDIUM | 5.9 | 7.05% | — | 33 | The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known… | Dec 8, 2020 |
| CVE-2020-28941 | MEDIUM | 5.5 | 0.33% | — | 33 | An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers … | Nov 19, 2020 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 33 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
| CVE-2020-11979 | HIGH | 7.5 | 8.01% | — | 33 | As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the… | Oct 1, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 33 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2019-20445 | CRITICAL | 9.1 | 13.83% | — | 33 | HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Lengt… | Jan 29, 2020 |
| CVE-2019-20444 | CRITICAL | 9.1 | 8.91% | — | 33 | HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a … | Jan 29, 2020 |
Fedora 33.x is EOL — migrate to Fedora 34.x
Fedora 34.x is the next major release. Plan your upgrade before Fedora 33.x stops receiving security patches.
Add a Fedora 33 EOL badge to your README
Show your users which Fedora version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/fedora/33)Frequently asked questions
Is Fedora 33 end of life?
Yes. All Fedora 33.x releases have reached end of life and no longer receive security patches. There are 64 known CVEs affecting Fedora 33.x, including 3 critical. Migrate to Fedora 34.x as soon as possible.
What CVEs affect Fedora 33?
There are 64 CVEs tracked for Fedora 33.x, including 3 critical severity issues. See the full list above with CVSS and EPSS scores.
What is the latest Fedora 33 version?
The latest Fedora 33.x patch release is 33, released on October 27, 2020. Always run the latest patch to benefit from all security fixes.
How to migrate from Fedora 33 to Fedora 34?
To migrate from Fedora 33 to Fedora 34: (1) review the official Fedora 34 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Fedora 33 in production?
No. Fedora 33 has reached end of life and security vulnerabilities are no longer patched. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA