[#3831] Added ChangeLog

diff --git a/ChangeLog b/ChangeLog
index d3f2b69c1f10574e0391ad214112c1252cfdb8e1..5efe8b34b12517bd2e6b84f892b0effc389c585d 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,17 @@
+2344.  [func]*         tmark
+       All files and sockets created by Kea servers have been
+       restricted to default paths determined at compile time
+       which may be overridden one enviornment varibles. This
+       incldes lease files, log files, forensic log files, control
+       channel sockets, and the output from commands such as
+       config-write, cache-write, lease4-write, and lease6-write. 
+       Use of unsupported paths will result in servers emitting
+       errors and refusing to start or rejecting commands.
+       The specifics including the supported paths and environment
+       names are in the relevant ARM sections.
+       CVE:2025-32801
+       (Gitlab #3831)
+        
 Kea 2.7.8 (development) released on April 30, 2025
 
 2343.  [build]         wlodek

diff --git a/changelog_unreleased/3831-CVE-2025-32802-restrict-unix-control-channel-sockets b/changelog_unreleased/3831-CVE-2025-32802-restrict-unix-control-channel-sockets
new file mode 100644 (file)
index 0000000..dfe7fed
--- /dev/null
+++ b/changelog_unreleased/3831-CVE-2025-32802-restrict-unix-control-channel-sockets
@@ -0,0 +1,15 @@
+[sec]*         tmark, fdupont, razvan
+       All files and sockets created by Kea servers have been
+       restricted to default paths determined at compile time
+       which may be overridden by environment variables. This
+       includes lease files, log files, forensic log files, control
+       channel sockets, and the output from commands such as
+       cache-write, lease4-write, and lease6-write. The output
+       of config-write is restricted to the directory from which the
+       configuration file was read. Use of unsupported paths will
+    result in servers emitting errors and refusing to start
+       or rejecting commands.  The specifics including the supported
+       paths and environment variable names are in the relevant
+       ARM sections.
+       CVE:2025-32801
+       (Gitlab #3831)