Adolf Belka [Tue, 15 Jun 2021 17:15:44 +0000 (19:15 +0200)]
glib: Update to 2.68.3
- Update from 2.68.2 to 2.68.3
- Update rootfile
- Changelog
Overview of changes in GLib 2.68.3
* Bugs fixed:
- #2311 testfilemonitor test leaks ip_watched_file_t struct
- #2417 GFile: `g_file_replace_contents()` reports `G_IO_ERROR_WRONG_ETAG` when saving from a symlink
- !2133 Backport !2128 “inotify: Fix a memory leak” to glib-2-68
- !2137 Backport !2136 “tlscertificate: Avoid possible invalid read” to glib-2-68
- !2141 Backport !2138 “glocalfileoutputstream: Fix ETag check when replacing through a symlink” to glib-2-68
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 15 Jun 2021 17:15:26 +0000 (19:15 +0200)]
fuse: Update to 3.10.4
- Update from 3.10.3 to 3.10.4
- Update of rootfile
- Changelog
* Building of unit tests is now optional.
* Fixed a test failure when running tests under XFS.
* Fixed memory leaks in examples.
* Minor documentation fixes.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 15 Jun 2021 17:15:11 +0000 (19:15 +0200)]
cmake: Update to 3.20.4
- Update from 3.20.3 to 3.20.4
- Update of rootfile not required.
- Changelog
Changes in 3.20.4 since 3.20.3:
Ben Boeckel (1):
ci: use consistent sccache builds
Brad King (8):
VS: Add special case for '-T version=14.29.16.10' under VS 16.10
VS: Add flag table entries for '/external:W*' flags in VS 16.10
gitlab-ci: Update Windows builds to MSVC 19.29-16.10 toolset
Makefiles: Fix CMAKE_EXPORT_COMPILE_COMMANDS crash with custom compile rule
presets: Fix buildPreset "jobs" field test case
IRSL: Add Intel oneAPI redist location on Windows
fileapi: Fix codemodel-v2 link command fragment relative paths
John Drouhard (1):
FindBoost: Add check for json component header in Boost 1.75+
Marc Chevrier (1):
Help: cmake_path: fix erroneous example for IS_PREFIX
Raul Tambre (2):
MSVC: C++20 final flag, C++23 support
Clang/MSVC: C++20 final flag, C++23 support
Sam Freed (2):
presets: Fix buildPreset "jobs"
presets: Fix buildPreset "targets" not allowing a single string
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Sat, 12 Jun 2021 13:23:25 +0000 (15:23 +0200)]
sudo: Update to 1.9.7p1
- Update from 1.9.7 to 1.9.7p1
- Update of rootfile not required.
- Changelog
Major changes between sudo 1.9.7p1 and 1.9.7
* Fixed an SELinux sudoedit bug when the edited temporary file
could not be opened. The sesh helper would still be run even
when there are no temporary files available to install.
* Fixed a compilation problem on FreeBSD.
* The sudo_noexec.so file is now built as a module on all systems
other than macOS. This makes it possible to use other libtool
implementations such as slibtool. On macOS shared libraries and
modules are not interchangeable and the version of libtool shipped
with sudo must be used.
* Fixed a few bugs in the getgrouplist() emulation on Solaris when
reading from the local group file.
* Fixed a bug in sudo_logsrvd that prevented periodic relay server
connection retries from occurring in "store_first" mode.
* Disabled the nss_search()-based getgrouplist() emulation on HP-UX
due to a crash when the group source is set to "compat" in
/etc/nsswitch.conf. This is probably due to a mismatch between
include/compat/nss_dbdefs.h and what HP-UX uses internally. On
HP-UX we now just cycle through groups the slow way using
getgrent(). Bug #978.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Fri, 11 Jun 2021 11:33:15 +0000 (13:33 +0200)]
Postfix: update to 3.6.0
Please refer to http://www.postfix.org/announcements/postfix-3.6.0.html
for this versions' release announcements.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Reviewed-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Thu, 10 Jun 2021 11:53:29 +0000 (13:53 +0200)]
nettle: Update to 3.7.3
- Update from 3.7.2 to 3.7.3
- Update rootfile
- Changelog
2021-05-22 Niels Möller <nisse@lysator.liu.se>
* configure.ac: Bump package version, to 3.7.3.
(LIBNETTLE_MINOR): Bump minor number, to 8.4.
(LIBHOGWEED_MINOR): Bump minor number, to 6.4.
2021-05-17 Niels Möller <nisse@lysator.liu.se>
* rsa-decrypt-tr.c (rsa_decrypt_tr): Check up-front that input is
in range.
* rsa-sec-decrypt.c (rsa_sec_decrypt): Likewise.
* rsa-decrypt.c (rsa_decrypt): Likewise.
* testsuite/rsa-encrypt-test.c (test_main): Add tests with input > n.
2021-05-14 Niels Möller <nisse@lysator.liu.se>
* rsa-sign-tr.c (rsa_sec_blind): Delete mn argument.
(_rsa_sec_compute_root_tr): Delete mn argument, instead require
that input size matches key size. Rearrange use of temporary
storage, to support in-place operation, x == m. Update all
callers.
* rsa-decrypt-tr.c (rsa_decrypt_tr): Make zero-padded copy of
input, for calling _rsa_sec_compute_root_tr.
* rsa-sec-decrypt.c (rsa_sec_decrypt): Likewise.
* testsuite/rsa-encrypt-test.c (test_main): Test calling all of
rsa_decrypt, rsa_decrypt_tr, and rsa_sec_decrypt with zero input.
2021-05-06 Niels Möller <nisse@lysator.liu.se>
* pkcs1-sec-decrypt.c (_pkcs1_sec_decrypt): Check that message
length is valid, for given key size.
* testsuite/rsa-sec-decrypt-test.c (test_main): Add test cases for
calls to rsa_sec_decrypt specifying a too large message length.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Thu, 10 Jun 2021 11:53:16 +0000 (13:53 +0200)]
libxcrypt: Update to 4.4.22
- Update from 4.4.20 to 4.4.22
- Update of rootfile not required
- Changelog
Version 4.4.22
* The crypt_checksalt() function has been fixed to correctly return
with 'CRYPT_SALT_INVALID', in case the setting, that is passed
to be checked, represents an empty passphrase or an uncomputed
setting for descrypt without any salt characters.
Version 4.4.21
* The crypt_checksalt() function will now return the value
'CRYPT_SALT_METHOD_LEGACY' in case the setting, that is passed
to be checked, uses a hashing method, which is considered to be
too weak for use with new passphrases.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Thu, 10 Jun 2021 11:53:04 +0000 (13:53 +0200)]
libogg: Update to 1.3.5
- Update from 1.3.4 to 1.3.5
- Update rootfile
- Changelog
Version 1.3.5 (2020 June 3)
* Fix unsigned typedef problem on macOS.
* Fix overflow check in ogg_sync_buffer.
* Clean up cmake and autotools build files.
* Remove Symbian and Apple XCode build files.
* Fix documentation cross-reference links.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from 20210419-3.1 to 20210522-3.1
- Update rootfile
- Changelog
2021-05-22 Jess Thrysoee
* version-info: 0:66:0
* all: sync with upstream source
* src/el.c: editrc not read on systems without issetugid
Patch by Trevor Cordes
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Thu, 10 Jun 2021 11:52:30 +0000 (13:52 +0200)]
elfutils: Update to 0.185
- Update from 0.184 to 0.185
- Update rootfile
- Changelog
Version 0.185
debuginfod-client: Simplify curl handle reuse so downloads which
return an error are retried.
elfcompress: Always exit with code 0 when the operation succeeds (even
when nothing was done). On error the exit code is now always 1.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Fri, 4 Jun 2021 21:29:42 +0000 (23:29 +0200)]
rng-tools: update to 6.12
Please refer to https://github.com/nhorman/rng-tools/releases for a full
list of meaningful changes between 6.4 and 6.12. "--without-pkcs11" is
necessary to avoid additional dependencies, which do not make sense on
IPFire since there are no use-cases for it.
Rootfiles did not change, our patch to use RDRDAND on i586 as well is
still valid.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Fri, 4 Jun 2021 16:23:12 +0000 (18:23 +0200)]
~/src/patches/: Clean up orphaned patches, duplicates and application patches outside existing directory structures
This patch represents the first batch of various patches we do not use
anymore, hence there is no sense in keeping them, polluting ~/src/patches/.
Two coreutils patches have been moved into the already existing
coreutils folder, while one libloc patch has been a duplicate to that
one already existing in ~/src/patches/libloc/.
Cleaning up this dump remains a non-exhaustive attempt, though. There
are several other patches I could not locate in LFS files in the first
place, which means that the amount of files we can drop from this
directory is likely to be greater than this patch currently covers.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Adolf Belka [Thu, 3 Jun 2021 12:21:49 +0000 (14:21 +0200)]
perl-TimeDate: Update to 2.33
- Update from 1.20(2009) to 2.33(2020)
- Update rootfile
- Changelog
2.33 -- Wed May 19 11:34:00 MT 2020
* Remove PAX Headers in tarball using GNU tar
2.32 -- Wed Mar 04 14:41:00 MT 2020
* Fix t/date.t to run on leap years [arc]
2.31 -- Thu Jan 16 14:00:00 MT 2020
* Fix year 2020 bug from t/getdate.t [Prajith]
* Fix warnings from t/date.t
* Fix pod issue in lib/Date/Parse.pm
* Fix for French language using English day suffixes in %o [mitchjacksontech]
* RT#84075: Fix Date::Parse::str2time century issue. [perlpilot]
* Adds Occitan language. [Quenty31]
* Migrate GitHub repo and bugtracker to atoomic/perl-TimeDate
2.30 -- Mon Feb 18 13:31:03 CST 2013
* Syncing distribution version number with Date::Parse, not functional changes
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Thu, 3 Jun 2021 12:21:32 +0000 (14:21 +0200)]
pcre2: Update to 10.37
- Update from 10.36 to 10.37
- Update rootfile
- find-dependencies run to check impact of so lib bump
No issues found
- Changelog
Version 10.37 26-May-2021
1. Change RunGrepTest to use tr instead of sed when testing with binary
zero bytes, because sed varies a lot from system to system and has problems
with binary zeros. This is from Bugzilla #2681. Patch from Jeremie
Courreges-Anglas via Nam Nguyen. This fixes RunGrepTest for OpenBSD. Later:
it broke it for at least one version of Solaris, where tr can't handle binary
zeros. However, that system had /usr/xpg4/bin/tr installed, which works OK, so
RunGrepTest now checks for that command and uses it if found.
2. Compiling with gcc 10.2's -fanalyzer option showed up a hypothetical problem
with a NULL dereference. I don't think this case could ever occur in practice,
but I have put in a check in order to get rid of the compiler error.
3. An alternative patch for CMakeLists.txt because 10.36 #4 breaks CMake on
Windows. Patch from email@cs-ware.de fixes bugzilla #2688.
4. Two bugs related to over-large numbers have been fixed so the behaviour is
now the same as Perl.
(a) A pattern such as /\214748364/ gave an overflow error instead of being
treated as the octal number \214 followed by literal digits.
(b) A sequence such as {65536 that has no terminating } so is not a
quantifier was nevertheless complaining that a quantifier number was too big.
5. A run of autoconf suggested that configure.ac was out-of-date with respect
to the lastest autoconf. Running autoupdate made some valid changes, some valid
suggestions, and also some invalid changes, which were fixed by hand. Autoconf
now runs clean and the resulting "configure" seems to work, so I hope nothing
is broken. Later: the requirement for autoconf 2.70 broke some automatic test
robots. It doesn't seem to be necessary: trying a reduction to 2.60.
6. The pattern /a\K.(?0)*/ when matched against "abac" by the interpreter gave
the answer "bac", whereas Perl and JIT both yield "c". This was because the
effect of \K was not propagating back from the full pattern recursion. Other
recursions such as /(a\K.(?1)*)/ did not have this problem.
7. Restore single character repetition optimization in JIT. Currently fewer
character repetitions are optimized than in 10.34.
8. When the names of the functions in the POSIX wrapper were changed to
pcre2_regcomp() etc. (see change 10.33 #4 below), functions with the original
names were left in the library so that pre-compiled programs would still work.
However, this has proved troublesome when programs link with several libraries,
some of which use PCRE2 via the POSIX interface while others use a native POSIX
library. For this reason, the POSIX function names are removed in this release.
The macros in pcre2posix.h should ensure that re-compiling fixes any programs
that haven't been compiled since before 10.33.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Thu, 3 Jun 2021 12:21:19 +0000 (14:21 +0200)]
netsnmpd: Update to 5.9.1
- Update from 5.8 to 5.9.1
- Update rootfile
- find-dependencies run to check impact of so lib bump
no issues found
- Changelog - for more details on the Many bug fixes for 5.9.1 see the
ChangeLog file in the source tarball
The following is from the CHANGES file in the source tarball
*5.9.1*:
General: Many bug fixes
*5.9*
snmplib:
- Add IPv6 support to DTLSUDP transport
- use new netsnmp_sockaddr_storage in netsnmp_addr_pair
- add base_transport ptr for tunneled transports
- Add support for OpenSSL 1.1.1
- Dtls: overhaul of debug
- Remove inline versions of container funcs
snmpd:
- Use ETHTOOL_GLINKSETTINGS when available Newer Linux kernels
support ETHTOOL_GLINKSETTINGS. Use it when available instead of the
older and deprecated ETHTOOL_GSET. This patch avoids that the Linux
kernel reports the following kernel warning: warning: 'snmpd' uses
legacy ethtool link settings API, link modes are only partially
reported See also https://sourceforge.net/p/net-snmp/patches/1387/.
[bvanassche: reworked this patch significantly]
- Reduce the time needed to execute "pass" scripts on BSD systems See
also https://github.com/net-snmp/net-snmp/issues/8.
- [BUG 2926]: Make it possible to set agentXPingInterval for a
subagent - register agentXPingInterval for the subagent list
handler, before it was registered for snmp - added agentxTimeout to
the subagent list handler. It's now possible to set for snmpd and
the subagent. See 'man snmpd.conf' - added agentxRetries to the
subagent list handler. See 'man snmpd.conf'. It's never used in the
subagent, but it's now following the documentation Signed-off-by:
Anders Wallin <wallinux@gmail.com>
snmptrap:
- BUG: 2899: Patch from Drew Roedersheimer to set library
engineboots/time values before sending
snmptrapd:
- Add support for the latest libmysqlclient version
libsnmp:
- Scan MIB directories in alphabetical order This guarantees that
e.g. mibs/RFC1213-MIB.txt is read before mibs/SNMPv2-MIB.txt. The
order in which these MIBs is read matters because both define
sysLocation but with different attributes.
unspecified:
- [BUG 2930]: Fix a Solaris hrSWInst crash Avoid that snmpd crashes
on Solaris when querying software packages with an empty CATEGORY
field. See also https://sourceforge.net/p/net-snmp/bugs/2930/. See
also https://sourceforge.net/p/net-snmp/patches/1390/.
FreeBSD:
- Fix first byte of IF-MIB::ifPhysAddress Don't write past the
interface name, and use temporary copy instead. This fixes the
first byte of ifPhysAddress always being 0 on FreeBSD. See also
https://sourceforge.net/p/net-snmp/code/merge-requests/20/. [
bvanassche: edited patch title / added test for malloc() result /
reduced number of free(if_name) calls ]
Win32:
- BUG: 2779541 Fixed handle leak in pass_persist.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Thu, 3 Jun 2021 12:21:03 +0000 (14:21 +0200)]
libnl-3: Update to 3.5.0
- Update from 3.2.25 (2014) to 3.5.0 (2019)
- Update rootfile
- Added --disable-static to ./configure
- Added --bindir=/usr/sbin otherwise binaries were installed in /usr/bin
Previous version installed the binaries in /usr/sbin without any command
This maintains location of binaries the same across the versions
- Changelog is no longer provided. Changes have to be found by reading
through the commits. https://github.com/thom311/libnl/releases
This is too large to include here.
There are 664 commits across 7 releases
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Thu, 3 Jun 2021 12:20:45 +0000 (14:20 +0200)]
libcap: Update to 2.50
- Update from 2.49 to 2.50
- Update rootfile
- Version 2.50 failed to install capsh - bug raised for this
https://bugzilla.kernel.org/show_bug.cgi?id=213261
patch to fix this bug created and used in this build
- Changelog
Release notes for 2.50
2021-05-24 12:05:16 -0700
Some new capsh features:
--explain=cap_foo: describe what cap_foo does (Bug 212451)
--suggest=phrase: search all the cap descriptions and describe those that match the phrase
Add "keepcaps" module argument support to pam_cap.so (reported by Zoltan Fridrich. Bug 212945)
extend libcap to include cap_prctl() and cap_prctlw() functions to regain feature parity with Go "cap" package. These are only needed when linking against -lpsx for keepcaps POSIX semantics.
this likely requires substantial application changes to make Ambient capability support usable in general, but doing our part for the admin.
Add a test case for recent kernel fix (Bug 212737)
Go pragma fix for convenience functions in "cap" module (reported by Lorenz Bauer. Bug 212321)
Minor man documentation updates
Minor build tree improvements (mostly for maintainer)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Thu, 3 Jun 2021 12:20:27 +0000 (14:20 +0200)]
gnutls: Update to 3.6.16
- Update from 3.6.14 to 3.6.16
- Update rootfile
- Changelog
* Version 3.6.16 (released 2021-05-24)
** libgnutls: Fixed potential miscalculation of ECDSA/EdDSA code backported from
Nettle. In GnuTLS, as long as it is built and linked against the fixed
version of Nettle, this only affects GOST curves. [CVE-2021-20305]
** libgnutls: Fixed potential use-after-free in sending "key_share"
and "pre_shared_key" extensions. When sending those extensions, the
client may dereference a pointer no longer valid after
realloc. This happens only when the client sends a large Client
Hello message, e.g., when HRR is sent in a resumed session
previously negotiated large FFDHE parameters, because the initial
allocation of the buffer is large enough without having to call
realloc (#1151). [GNUTLS-SA-2021-03-10, CVSS: low]
* Version 3.6.15 (released 2020-09-04)
** libgnutls: Fixed "no_renegotiation" alert handling at incorrect timing.
The server sending a "no_renegotiation" alert in an unexpected timing,
followed by an invalid second handshake was able to cause a TLS 1.3 client to
crash via a null-pointer dereference. The crash happens in the application's
error handling path, where the gnutls_deinit function is called after
detecting a handshake failure (#1071). [GNUTLS-SA-2020-09-04, CVSS: medium]
** libgnutls: If FIPS self-tests are failed, gnutls_fips140_mode_enabled() now
indicates that with a false return value (!1306).
** libgnutls: Under FIPS mode, the generated ECDH/DH public keys are checked
accordingly to SP800-56A rev 3 (!1295, !1299).
** libgnutls: gnutls_x509_crt_export2() now returns 0 upon success, rather than
the size of the internal base64 blob (#1025). The new behavior aligns to the
existing documentation.
** libgnutls: Certificate verification failue due to OCSP must-stapling is not
honered is now correctly marked with the GNUTLS_CERT_INVALID flag
(!1317). The new behavior aligns to the existing documentation.
** libgnutls: The audit log message for weak hashes is no longer printed twice
(!1301).
** libgnutls: Fixed version negotiation when TLS 1.3 is enabled and TLS 1.2 is
disabled in the priority string. Previously, even when TLS 1.2 is explicitly
disabled with "-VERS-TLS1.2", the server still offered TLS 1.2 if TLS 1.3 is
enabled (#1054).
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Thu, 20 May 2021 22:03:02 +0000 (00:03 +0200)]
~/src/patches/: Clean up orphaned patches, duplicates and application patches outside existing directory structures
This patch represents the first batch of various patches we do not use
anymore, hence there is no sense in keeping them, polluting ~/src/patches/.
Two coreutils patches have been moved into the already existing
coreutils folder, while one libloc patch has been a duplicate to that
one already existing in ~/src/patches/libloc/.
Cleaning up this dump remains a non-exhaustive attempt, though. There
are several other patches I could not locate in LFS files in the first
place, which means that the amount of files we can drop from this
directory is likely to be greater than this patch currently covers.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 2 Jun 2021 19:37:55 +0000 (21:37 +0200)]
Clean up whatever remained from ALGs in userspace
This patch removes translations, directives in LFS files, and ALG shared
object files which all became orphaned after we disabled ALGs due to NAT
Slipstreaming vulnerability in Core Update 155.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 2 Jun 2021 18:37:02 +0000 (20:37 +0200)]
Drop unmaintained add-on dpfhack
This package seems to be unmaintained for at least five years. It's
(former?) upstream traces back to https://section5.ch/index.php/2011/01/13/dpf-hacking/,
but download links to both dpfhack and a patched version of lcd4linux
point to http://localhost/.
http://tech.section5.ch/files/dpfhack-0.1alpha.tgz still serves
something apparently related to dpfhack, but it is unclear whether that
is a previous version than the "0.12devel" we know about, or a
successor. https://tech.section5.ch/files/dpfhack-0.1alpha.tgz, just to
have it noticed, comes with a X.509 certificate not issued for this
FQDN.
dpfhack is solely needed as a dependancy for lcd4linux, which appears to
be unmaintained as well, hence being dropped in a dedicated patch.
Given the status quo, bugs in dpfhack cannot be reported properly,
security issues won't be addressed (by anybody else then ourselves), and
technical questions cannot be clarified aside a reverse engineering
approach.
We should not allow such an add-on to be installed on a firewall system.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Reviewed-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 2 Jun 2021 18:36:31 +0000 (20:36 +0200)]
Drop unmaintained add-on lcd4linux
This package has not received any updates or attention within the last
three years. It's sole known upstream URL (https://ssl.bulix.org/projects/lcd4linux/)
returns a HTTP error 404 nowadays, and the author was unable to locate
any upstream source that appears to be still maintained today.
Given the status quo, bugs in lcd4linux cannot be reported properly,
security issues won't be addressed (by anybody else then ourselves), and
technical questions cannot be clarified aside a reverse engineering
approach.
We should not allow such an add-on to be installed on a firewall system.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Reviewed-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Wed, 2 Jun 2021 18:00:04 +0000 (20:00 +0200)]
dmidecode: update to 3.3
Notable changes as per https://git.savannah.gnu.org/cgit/dmidecode.git/plain/NEWS:
Version 3.3 (Wed Oct 14 2020)
- [BUILD] Allow overriding build settings from the environment.
- [COMPATIBILITY] Document how the UUID fields are interpreted.
- [PORTABILITY] Don't use memcpy on /dev/mem on arm64.
- [PORTABILITY] Only scan /dev/mem for entry point on x86.
- Support for SMBIOS 3.3.0. This includes new processor names, new port
connector types, and new memory device form factors, types and
technologies.
- Add bios-revision, firmware-revision and system-sku-number to -s option.
- Use the most appropriate unit for cache size.
- Decode system slot base bus width and peers.
- Important bug fixes:
Fix Redfish Hostname print length
Fix formatting of TPM table output
Fix System Slot Information for PCIe SSD
Don't choke on invalid processor voltage
- Use the most appropriate unit for cache size.
Version 3.2 (Wed Sep 14 2018)
- [COMPATIBILITY] The UUID is now displayed using lowercase letters, per
RFC 4122 (#53569). You must ensure that any code parsing it is
case-insensitive.
- Support for SMBIOS 3.2.0. This includes new processor names, new socket
and port connector types, new system slot state and property, and support
for non-volatile memory (NVDIMM).
- Support for Redfish management controllers.
- A new command line option to query a specific structure by its handle.
- A new command line option to query the system family string.
- Support for 3 ThinkPad-specific structures (patch #9642).
- Support for HPE's new company name.
- Support UEFI on FreeBSD.
- Important bug fixes:
Fix firmware version of TPM device
Fix the HPE UEFI feature flag check
- (biosdecode) A new command line option to fully decode PIR information
(support request #109339).
Peter Müller [Wed, 2 Jun 2021 17:53:43 +0000 (19:53 +0200)]
gzip: update to 1.10
Relevant excerpt from Changelog as per
https://savannah.gnu.org/forum/forum.php?forum_id=9339:
NEWS
* Noteworthy changes in release 1.10 (2018-12-29) [stable]
** Changes in behavior
Compressed gzip output no longer contains the current time as a
timestamp when the input is not a regular file. Instead, the output
contains a null (zero) timestamp. This makes gzip's behavior more
reproducible when used as part of a pipeline. (As a reminder, even
regular files will use null timestamps after the year 2106, due to a
limitation in the gzip format.)
** Bug fixes
A use of uninitialized memory on some malformed inputs has been fixed.
[bug present since the beginning]
A few theoretical race conditions in signal handers have been fixed.
These bugs most likely do not happen on practical platforms.
[bugs present since the beginning]
In addition, gzip 1.10 comes with the GNU library patch applied, so
there is no need to carry this file around any more.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 1 Jun 2021 09:39:09 +0000 (11:39 +0200)]
dnsdist: Improve initscript to prevent reload on config error
start, restart and reload will now be prohibited if the configuration
file has an incorrect syntax. This avoids killing a running daemon and
is showing an indication to the user instead of having the daemon dying
silently in the background.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Sun, 30 May 2021 10:33:31 +0000 (12:33 +0200)]
OpenSSH: restrict file permissions for sshd_config to 0600
This file does not have to be readable by anybody else than the user
running an OpenSSH server. While it does not really contain confidential
information, exposing it to the rest of the world makes no sense either.
This will silence a Lynis warning. :-)
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Sat, 29 May 2021 16:41:31 +0000 (18:41 +0200)]
expat: Update to 2.4.1
- Update from 2.3.0 to 2.4.1
- Update rootfile
- Changelog (URL in changelog changed to https://verbump(dot)de as mail was
rejected by IPFire mail system due to policy violation because URL was
highlighted as a blacklisted addresss
Release 2.4.1 Sun May 23 2021
Bug fixes:
#488 #490 Autotools: Fix installed header expat_config.h for multilib
systems; regression introduced in 2.4.0 by pull request #486
Other changes:
#491 #492 Version info bumped from 9:0:8 to 9:1:8;
see https://verbump(dot)de/ for what these numbers do
Special thanks to:
Gentoo's QA check "multilib_check_headers"
Release 2.4.0 Sun May 23 2021
Security fixes:
#34 #466 #484 CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks
(denial-of-service; flavors targeting CPU time or RAM or both,
leveraging general entities or parameter entities or both)
by tracking and limiting the input amplification factor
(<amplification> := (<direct> + <indirect>) / <direct>).
By conservative default, amplification up to a factor of 100.0
is tolerated and rejection only starts after 8 MiB of output bytes
(=<direct> + <indirect>) have been processed.
The fix adds the following to the API:
- A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to
signals this specific condition.
- Two new API functions ..
- XML_SetBillionLaughsAttackProtectionMaximumAmplification and
- XML_SetBillionLaughsAttackProtectionActivationThreshold
.. to further tighten billion laughs protection parameters
when desired. Please see file "doc/reference.html" for details.
If you ever need to increase the defaults for non-attack XML
payload, please file a bug report with libexpat.
- Two new XML_FEATURE_* constants ..
- that can be queried using the XML_GetFeatureList function, and
- that are shown in "xmlwf -v" output.
- Two new environment variable switches ..
- EXPAT_ACCOUNTING_DEBUG=(0|1|2|3) and
- EXPAT_ENTITY_DEBUG=(0|1)
.. for runtime debugging of accounting and entity processing.
Specific behavior of these values may change in the future.
- Two new command line arguments "-a FACTOR" and "-b BYTES"
for xmlwf to further tighten billion laughs protection
parameters when desired.
If you ever need to increase the defaults for non-attack XML
payload, please file a bug report with libexpat.
Bug fixes:
#332 #470 For (non-default) compilation with -DEXPAT_MIN_SIZE=ON (CMake)
or CPPFLAGS=-DXML_MIN_SIZE (GNU Autotools): Fix segfault
for UTF-16 payloads containing CDATA sections.
#485 #486 Autotools: Fix generated CMake files for non-64bit and
non-Linux platforms (e.g. macOS and MinGW in particular)
that were introduced with release 2.3.0
Other changes:
#468 #469 xmlwf: Improve help output and the xmlwf man page
#463 xmlwf: Improve maintainability through some refactoring
#477 xmlwf: Fix man page DocBook validity
#458 #459 CMake: Support absolute paths for both CMAKE_INSTALL_LIBDIR
and CMAKE_INSTALL_INCLUDEDIR
#471 #481 CMake: Add support for standard variable BUILD_SHARED_LIBS
#457 Unexpose symbol _INTERNAL_trim_to_complete_utf8_characters
#467 Resolve macro HAVE_EXPAT_CONFIG_H
#472 Delete unused legacy helper file "conftools/PrintPath"
#473 #483 Improve attribution
#464 #465 #477 doc/reference.html: Fix XHTML validity
#475 #478 doc/reference.html: Replace the 90s look by OK.css
#479 Version info bumped from 8:0:7 to 9:0:8
due to addition of new symbols and error codes;
see https://verbump(dot)de/ for what these numbers do
Infrastructure:
#456 CI: Enable periodic runs
#457 CI: Start covering the list of exported symbols
#474 CI: Isolate coverage task
#476 #482 CI: Adapt to breaking changes in image "ubuntu-18.04"
#477 CI: Cover well-formedness and DocBook/XHTML validity
of doc/reference.html and doc/xmlwf.xml
Special thanks to:
Dimitry Andric
Eero Helenius
Nick Wellnhofer
Rhodri James
Tomas Korbar
Yury Gribov and Clang LeakSan
JetBrains
OSS-Fuzz
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Sat, 29 May 2021 16:02:43 +0000 (18:02 +0200)]
curl: Update to 7.77.0
- Update from 7.76.1 to 7.77.0
- Update rootfile
- Changelog is too large to include here. It can be accesed at
https://curl.se/changes.html
There are 5 changes and 133 bug fixes of which 3 are related to CVE's
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Sat, 29 May 2021 16:02:22 +0000 (18:02 +0200)]
cmake: Update to 3.20.3
- Update from 3.20.2 to 3.20.3
- Update of rootfile not required
- Changelog
Changes made since CMake 3.20.2:
Brad King (7):
Help: Use relative path for IDE Integration guide link to preset schema
BinUtils: Use more-private temporary variable names
ObjectiveC: Respect OSX_ARCHITECTURES for OBJC
FindBoost: Add support for Boost 1.76
Ninja: Restore support for Fortran in a symlinked build tree
Utilities/Sphinx: Update man page config for Sphinx 4
CMake 3.20.3
Craig Scott (2):
ExternalProject: Ensure git fetch if updating to hash we don’t have yet
ExternalProject: Only add git config setting with git 1.7.7 or later
Kyle Edwards (2):
Ninja Multi-Config: Split long command lines by config
CMP0082: Check EXCLUDE_FROM_ALL property at generate time
Raul Tambre (3):
GNU: C++17 default version
GNU: Final C++20 flags
GNU: C++23 support
Robert Maynard (6):
CUDA: improve regex for CUDA Toolkit root from nvcc verbose output
cmCommandLineArgument: Correctly record parsing failures
cmake: --build and --install error out when encountering bad flags
cmCommandLineArgument: Provide more information syntax error messages
NVHPC: Support explicit language flags
NVHPC: Support Ninja dependency scanning
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 25 May 2021 19:34:56 +0000 (21:34 +0200)]
zstd: Update to 1.5.0
- Update from 1.4.9 to 1.5.0
- Update of rootfile
- Changelog
v1.5.0 (May 11, 2021)
api: Various functions promoted from experimental to stable API: (#2579-2581, @senhuang42)
`ZSTD_defaultCLevel()`
`ZSTD_getDictID_fromCDict()`
api: Several experimental functions have been deprecated and will emit a compiler warning (#2582, @senhuang42)
`ZSTD_compress_advanced()`
`ZSTD_compress_usingCDict_advanced()`
`ZSTD_compressBegin_advanced()`
`ZSTD_compressBegin_usingCDict_advanced()`
`ZSTD_initCStream_srcSize()`
`ZSTD_initCStream_usingDict()`
`ZSTD_initCStream_usingCDict()`
`ZSTD_initCStream_advanced()`
`ZSTD_initCStream_usingCDict_advanced()`
`ZSTD_resetCStream()`
api: ZSTDMT_NBWORKERS_MAX reduced to 64 for 32-bit environments (@Cyan4973)
perf: Significant speed improvements for middle compression levels (#2494, @senhuang42 @terrelln)
perf: Block splitter to improve compression ratio, enabled by default for high compression levels (#2447, @senhuang42)
perf: Decompression loop refactor, speed improvements on `clang` and for `--long` modes (#2614 #2630, @Cyan4973)
perf: Reduced stack usage during compression and decompression entropy stage (#2522 #2524, @terrelln)
bug: Improve setting permissions of created files (#2525, @felixhandte)
bug: Fix large dictionary non-determinism (#2607, @terrelln)
bug: Fix non-determinism test failures on Linux i686 (#2606, @terrelln)
bug: Fix various dedicated dictionary search bugs (#2540 #2586, @senhuang42 @felixhandte)
bug: Ensure `ZSTD_estimateCCtxSize*() `monotonically increases with compression level (#2538, @senhuang42)
bug: Fix --patch-from mode parameter bound bug with small files (#2637, @occivink)
bug: Fix UBSAN error in decompression (#2625, @terrelln)
bug: Fix superblock compression divide by zero bug (#2592, @senhuang42)
bug: Make the number of physical CPU cores detection more robust (#2517, @PaulBone)
doc: Improve `zdict.h` dictionary training API documentation (#2622, @terrelln)
doc: Note that public `ZSTD_free*()` functions accept NULL pointers (#2521, @animalize)
doc: Add style guide docs for open source contributors (#2626, @Cyan4973)
tests: Better regression test coverage for different dictionary modes (#2559, @senhuang42)
tests: Better test coverage of index reduction (#2603, @terrelln)
tests: OSS-Fuzz coverage for seekable format (#2617, @senhuang42)
tests: Test coverage for ZSTD threadpool API (#2604, @senhuang42)
build: Dynamic library built multithreaded by default (#2584, @senhuang42)
build: Move `zstd_errors.h` and `zdict.h` to `lib/` root (#2597, @terrelln)
build: Allow `ZSTDMT_JOBSIZE_MIN` to be configured at compile-time, reduce default to 512KB (#2611, @Cyan4973)
build: Single file library build script moved to `build/` directory (#2618, @felixhandte)
build: `ZBUFF_*()` is no longer built by default (#2583, @senhuang42)
build: Fixed Meson build (#2548, @SupervisedThinking @kloczek)
build: Fix excessive compiler warnings with clang-cl and CMake (#2600, @nickhutchinson)
build: Detect presence of `md5` on Darwin (#2609, @felixhandte)
build: Avoid SIGBUS on armv6 (#2633, @bmwiedmann)
cli: `--progress` flag added to always display progress bar (#2595, @senhuang42)
cli: Allow reading from block devices with `--force` (#2613, @felixhandte)
cli: Fix CLI filesize display bug (#2550, @Cyan4973)
cli: Fix windows CLI `--filelist` end-of-line bug (#2620, @Cyan4973)
contrib: Various fixes for linux kernel patch (#2539, @terrelln)
contrib: Seekable format - Decompression hanging edge case fix (#2516, @senhuang42)
contrib: Seekable format - New seek table-only API (#2113 #2518, @mdittmer @Cyan4973)
contrib: Seekable format - Fix seek table descriptor check when loading (#2534, @foxeng)
contrib: Seekable format - Decompression fix for large offsets, (#2594, @azat)
misc: Automatically published release tarballs available on Github (#2535, @felixhandte)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 25 May 2021 19:34:42 +0000 (21:34 +0200)]
zerofree: Update to 1.1.1
- Update from 1.0.1 (2008) to 1.1.1 (2018)
- Update of rootfile not required
- Changelog information is not available in the source tarball or in the
zerofree website
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 25 May 2021 19:34:22 +0000 (21:34 +0200)]
zd1211-firmware: Update to 1.5
- Update from 1.4 (2007) to 1.5 (2014)
- Update of rootfile not required
- Changelog
Sync to vendor driver v3.0.0.56
Header files taken from LinuxUSB_AR2524-3.0.0.56.tgz
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Tue, 25 May 2021 19:33:57 +0000 (21:33 +0200)]
XML-Parser: Update to 2.46
- Update from 2.34 to 2.46
- Update rootfile
- Changelog
2.46 2019-09-24 (by Todd Rinaldo)
- use foreach not for for loops
- produce README.md so travis will show up on github
- remove use vars and switch to our.
- travis-ci testing from 5.8..5.28
- Convert XML::Parser to use 3 arg opens with no barewords.
- Migrate tracker to github
- Switch to XSLoader
- Fix a buffer overwrite in parse_stream()
2.44 2015-01-12 (by Todd Rinaldo)
- RT 99098 - Revert "Add more useful error message on parse to Expat". It breaks
XML::Twig. Calling code will need to do this if it's needed.
- RT 100959 - Add use FileHandle to t/astress.t - Make perl 5.10.0 happy.
2.43 2014-12-11 (by Todd Rinaldo)
- POD patch to man from Debian via Nicholas Bamber
- POD patch from Debian via gregor herrmann.
- Add more useful error message on parse to Expat
- Fix LWP dependency to be LWP::Useragent
- Bump to 2.43 for overdue release to CPAN.
2.42_01 2013-07-12 (by Todd Rinaldo)
- Added instructions to README for OSX
- XS changes: stop using SvPV(string, PL_na)
- Fix documentation typos
2.41 2011-06-01 (by Todd Rinaldo)
- Tests are cleaned. promoting to stable. No changes since 2.40_02
2.40_02 2011-05-31 (by Todd Rinaldo)
- TODO some tests which fail in Free BSD due to improper expat CVE patch
http://www.freebsd.org/cgi/query-pr.cgi?pr=157469
2.40_01 2011-05-24 (by Todd Rinaldo)
- better installation instructions
- Small spelling patches from Debian package - Thanks Nicholas Bamber
- RT 68399 - Upgrade Devel::CheckLib to 0.93 to make it
perl 5.14 compliant - qw()
- RT 67207 - Stop doing tied on globs - Thanks sprout
- RT 31319 - Fix doc links in POD for XML/Parser.pm
2.40 2010-09-16 (by Alexandr Ciornii)
- Add windows-1251.enc, ibm866.enc, koi8-r.enc (Russian)
- Add windows-1255.enc (Hebrew)
- Update iso-8859-7.enc (RT#40712)
- Use Devel::CheckLib
- Better description of expat packages
- Better Perl style in both code and docs
2.36
- Fix for Carp::Heavy bugs
2.35 (mostly by Alexandr Ciornii)
- Works in 5.10 (Andreas J. Koenig)
- Added license in Makefile.PL (Alexandr Ciornii)
- Makefile.PL also searches for expat in C:/lib/Expat-2.0.0 (Alexandr Ciornii)
- No longer uses variable named 'namespace' in Expat.xs (Jeff Hunter)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Tue, 25 May 2021 15:37:16 +0000 (17:37 +0200)]
knot: Update to 3.0.6
For details see:
https://www.knot-dns.cz/2021-05-12-version-306.html
"Features:
mod-probe: new module for simple traffic logging (Python API not yet included)
Improvements:
keymgr: new mode for listing zones with at least one key stored
keymgr: the pregenerate command accepts optional timestamp-from parameter
kzonecheck: accept '-' as substitution for standard input #727
knotd: print an error when unable to change owner of a logging file
knotd: new warning log if no interface is configured
knotd: new signing policy check for NSEC3 iterations higher than 20
knotd: don't allow backup to/restore from the DB storage directory
Various code (mostly zone backup/restore), tests, and documentation improvements
Bugfixes:
knotd: secondary fails to load zone file if HTTPS or SVCB record is present #725
knotd: (KSK roll-over) new KSK is not signing DNSKEY long enough before DS submission
knotd: (KSK roll-over) old KSK uselessly published after roll-over finished
knotd: malformed address in TCP-related logs when listening on a UNIX socket
knotd: server responds FORMERR instead of BADTIME if TSIG signed time is zero #730
modules: incorrect local and remote addresses in the XDP mode
modules: failed to read configuration from a section without identifiers
mod-synthrecord: queries on synthesized empty-non-terminals not answered with NODATA
keymgr: confusing error if del-all-old command fails"
For 3.0.5 (skipped):
https://www.knot-dns.cz/2021-03-25-version-305.html
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Stefan Schantl [Mon, 24 May 2021 17:38:20 +0000 (19:38 +0200)]
pakfire: Prevent from get launched multiple times.
When pakfire gets launched a check if a so called lockfile exists and
the process will be aborted, otherwise the file will be created which
prevents any other pakfire instance to perform any operations until the
first process gets finished and the lock will be released again.
Because the release of the lock is located in an END block, the lock
also will be released in case the pakfire process gets interuped or
gains an error.
This prevents from an lock loop and an unuseable pakfire.
Reference: #12621.
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Sun, 23 May 2021 15:43:38 +0000 (17:43 +0200)]
libusb: update to 1.0.24
Full changelog as per CHANGELOG file:
2020-12-09: v1.0.24
* Add new platform abstraction (#252)
* Add Null POSIX backend
* Add support for eventfd
* Add support for thread IDs on Haiku, NetBSD and Solaris
* New API libusb_hotplug_get_user_data()
* Darwin (macOS): Fix race condition that results in segmentation fault (#701)
* Darwin (macOS): Fix stale descriptor information post reset (#733)
* Darwin (macOS): use IOUSBDevice as darwin_device_class explicitly (#693)
* Linux: Drop support for kernel older than 2.6.32
* Linux: Provide an event thread name (#689)
* Linux: Wait until all USBs have been reaped before freeing them (#607)
* NetBSD: Recognize device timeouts (#710)
* OpenBSD: Allow opening ugen devices multiple times (#763)
* OpenBSD: Support libusb_get_port_number() (#764)
* SunOS: Fix a memory leak (#756)
* SunOS: Various fixes (#627, #628, #629)
* Windows: Add Visual Studio 2019 support
* Windows: Drop support for WinCE and Visual Studio older than 2013
* Windows: Drop support for Windows XP
* Windows: Support building all examples using Visual Studio (#151)
* Documentation fixes and improvements
* Various other bug fixes and improvements
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Reviewed-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
The changelog between version "s20160803" is too large to include it
here, please refer to https://github.com/iputils/iputils/releases for a
human-readable version.
Due to build system changes, single binaries cannot be compiled by
running "make [program]" anymore, updated rootfiles to reflect that
change.
20210202's version of /usr/bin/ping is bug-compatible to s20160803's
one, hence does not cause trouble in ~/src/ppp/ip-up. Tested, works.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Sat, 22 May 2021 13:29:30 +0000 (15:29 +0200)]
bind: Update to 9.11.32
For details see:
https://downloads.isc.org/isc/bind9/9.11.31/RELEASE-NOTES-bind-9.11.32.html
"Notes for BIND 9.11.32
Feature Changes
DNSSEC responses containing NSEC3 records with iteration counts
greater than 150 are now treated as insecure. [GL #2445]
The maximum supported number of NSEC3 iterations that can be
configured for a zone has been reduced to 150. [GL #2642]
The implementation of the ZONEMD RR type has been updated to match
RFC 8976. [GL #2658]
Notes for BIND 9.11.31
Security Fixes
A malformed incoming IXFR transfer could trigger an assertion
failure in named, causing it to quit abnormally. (CVE-2021-25214)
ISC would like to thank Greg Kuechle of SaskTel for bringing this
vulnerability to our attention. [GL #2467]
named crashed when a DNAME record placed in the ANSWER section
during DNAME chasing turned out to be the final answer to a client
query. (CVE-2021-25215)
ISC would like to thank Siva Kakarla for bringing this vulnerability
to our attention. [GL #2540]
When a server's configuration set the tkey-gssapi-keytab
or tkey-gssapi-credential option, a specially crafted GSS-TSIG query
could cause a buffer overflow in the ISC implementation of SPNEGO
(a protocol enabling negotiation of the security mechanism used for
GSSAPI authentication). This flaw could be exploited to crash named
binaries compiled for 64-bit platforms, and could enable remote code
execution when named was compiled for 32-bit platforms.
(CVE-2021-25216)
This vulnerability was reported to us as ZDI-CAN-13347 by Trend
Micro Zero Day Initiative. [GL #2604]
Feature Changes
The ISC implementation of SPNEGO was removed from BIND 9 source
code. Instead, BIND 9 now always uses the SPNEGO implementation
provided by the system GSSAPI library when it is built with GSSAPI
support. All major contemporary Kerberos/GSSAPI libraries contain
an implementation of the SPNEGO mechanism. [GL #2607]
Notes for BIND 9.11.30
The BIND 9.11.30 release was withdrawn after a backporting bug was
discovered during pre-release testing. ISC would like to acknowledge the
assistance of Natan Segal of Bluecat Networks.2"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Matthias Fischer [Sat, 22 May 2021 13:25:11 +0000 (15:25 +0200)]
vnstat: Update to 2.7
For details see:
https://humdi[dot]net/vnstat/CHANGES
"2.7 / 16-May-2021
- Fixed
- Possibility of segmentation fault with image list output when database
existed but no data was available
- ./configure output could show invalid install paths with some parameter
combinations (pull request by Severin Glöckner)
- Columns in text hours graph output could get misaligned if the selected
system locale used a UTF-8 sequence for the thousands separator instead
of a single character
- New
- Add -5g / --fivegraph options to image output with sizing related
parameters for the output of a 5 minute resolution bar graph
- Add configuration option SummaryGraph and optional parameter for
--hsummary and --vsummary for selecting which graph is shown next to
the summary data in the horizontal and vertical summary image outputs
- Add --large / --small options and configuration option LargeFonts for
controlling the image output font size
- Add --scale and configuration option ImageScale for scaling the image
output to a given percent
- Add configuration option LineSpacingAdjustment for adjusting the line
spacing of list format image outputs
- Add bar visualizations for traffic estimations in image output
- Allow writing image output to a filename starting with -
- Add --initdb to daemon for creating a new empty database without having
the daemon process staying running, doesn't discard data if a database
already exists
- Add configuration option BarColumnShowsRate for having the bar column in
image list outputs be scaled according to the average rate column values
when those values are visible, disabled by default
- Add --dbiflist for getting a list of interfaces in the database, both
--iflist and --dbiflist also get alternative more parseable outputs
- Add configuration option for large font output and make 5 minute
resolution graph visible in vnstat.cgi"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Fri, 21 May 2021 12:22:50 +0000 (14:22 +0200)]
backup.pl: Fix #12626 backup/include.user entries will not override backup/exclude
- Current situation is that any restrictions in the exclude file will not
be overwritten by the include.user file
- For example the global exclude file has *.tmp preventing any tmp files
being backed up from the globally included IPFire files
If a user has some specific tmp files they want to backup and include
them in the include.user file they will not override the global
exclude file.
- This fix does the backup of the global and user backups as two separate
events and then appends them. This means that any tmp files in the
include.user file will be backed up.
- The backups are created as a global tar file and then have the user
tar file appended and then the combined file gzipped and given the .ipf
suffix. This has to be done this was as gzipped files can not be
appended to each other whereas tar files can.
Fixes: 12626 Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Fri, 21 May 2021 13:42:36 +0000 (15:42 +0200)]
Icinga: Do not ship event handlers for Nagios
These are owned (hence being writable) by "nobody", posing a potential
security risk. Since the files itself were already exluded from being
shipped, their parent directory should be as well.
This patch should reduce the amount of executable files being owned by
nobody to zero after upgrading to Core Update 157. Due to complexity
reasons, not all applications available in Pakfire could be tested,
though, so your mileage may vary.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
projects / people / pmueller / ipfire-2.x.git / log
