Adolf Belka [Wed, 24 Aug 2022 07:49:29 +0000 (09:49 +0200)]
efivar: Update to version 38
- Update from version 37 to 38
- Update of rootfile
- mandoc is now a build dependency for efivar
- Old compile fixes patches are no longer required with version 38
- Details for lfs build of version 38 obtained from Beyond Linux From Scratch
- Changelog
bug fixes
Rework some makefile bits to make overriding some options simpler. by @vathpela in #140
Handle /sys/devices/virtual/{nvme-fabrics,nvme-subsystem} devices by @vathpela in #139
guids.S: Include <cet.h> when CET is enabled by @hjl-tools in #149
Fix /sys/block sysfs parsing for eMMC-s by @jwrdegoede in #150
Properly check mmap return error by @hannob in #152
Fix s{yt,ty}le typo in efi_get_variable(3) by @nabijaczleweli in #162
Handle NULL set_variable() by @lcp in #159
Fix parsing for nvme-subsystem devices by @dannf in #158
Attempt to fix the identified thread safety bugs by @vathpela in #155
Make thread-test depend on libefivar.so by @hjl-tools in #176
Upstream a local patch from rawhide by @frozencemetery in #177
Fix conversion from UTF8 to UCS2 by @freedge in #171
efivar: make docs match current code for 'efivar -A' by @vathpela in #178
Migrate CI to Github actions by @frozencemetery in #179
Add code of conduct by @frozencemetery in #180
Misc minor fixes by @vathpela in #182
Add efi_time_t declarations and helper functions. by @vathpela in #183
More misc fixes by @vathpela in #185
Run CI on more targets by @vathpela in #187
Coverity fixes 20211208 by @vathpela in #189
CI: run abicheck by @frozencemetery in #190
Fix linux virtual root device parsing by @vathpela in #188
efivar.spec.in: fix license to be valid SPDX by @frozencemetery in #192
Add efisecdb tooling by @vathpela in #184
Fix linker string comparison for dash by @frozencemetery in #194
Full changelog diff between version 37 and 38 is available in github repo
https://github.com/rhboot/efivar/compare/37...38
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Adolf Belka [Wed, 24 Aug 2022 07:50:47 +0000 (09:50 +0200)]
nettle: Update to version 3.8.1
- Update from version 3.7.3 to 3.8.1
- Update of rootfile
- Changelog
3.8.1 release
This is a bugfix release, fixing a few portability issues
reported for Nettle-3.8.
Bug fixes:
* Avoid non-posix m4 argument references in the chacha
implementation for arm64, powerpc64 and s390x. Reported by
Christian Weisgerber, fix contributed by Mamone Tarsha.
* Use explicit .machine pseudo-ops where needed in s390x
assembly files. Bug report by Andreas K. Huettel, fix
contributed by Mamone Tarsha.
Optimizations:
* Implemented runtime detection of cpu features for OpenBSD on
arm64. Contributed by Christian Weisgerber.
The new version is intended to be fully source and binary
compatible with Nettle-3.6. The shared library names are
libnettle.so.8.6 and libhogweed.so.6.6, with sonames
libnettle.so.8 and libhogweed.so.6.
3.8 release
This release includes a couple of new features, and many
performance improvements. It adds assembly code for two more
architectures: ARM64 and S390x.
The new version is intended to be fully source and binary
compatible with Nettle-3.6. The shared library names are
libnettle.so.8.5 and libhogweed.so.6.5, with sonames
libnettle.so.8 and libhogweed.so.6.
New features:
* AES keywrap (RFC 3394), contributed by Nicolas Mora.
* SM3 hash function, contributed by Tianjia Zhang.
* New functions cbc_aes128_encrypt, cbc_aes192_encrypt,
cbc_aes256_encrypt.
On processors where AES is fast enough, e.g., x86_64 with
aesni instructions, the overhead of using Nettle's general
cbc_encrypt can be significant. The new functions can be
implemented in assembly, to do multiple blocks with reduced
per-block overhead.
Note that there's no corresponding new decrypt functions,
since the general cbc_decrypt doesn't suffer from the same
performance problem.
Bug fixes:
* Fix fat builds for x86_64 windows, these appear to never
have worked.
Optimizations:
* New ARM64 implementation of AES, GCM, Chacha, SHA1 and
SHA256, for processors supporting crypto extensions. Great
speedups, and fat builds are supported. Contributed by
Mamone Tarsha.
* New s390x implementation of AES, GCM, Chacha, memxor, SHA1,
SHA256, SHA512 and SHA3. Great speedups, and fat builds are
supported. Contributed by Mamone Tarsha.
* New PPC64 assembly for ecc modulo/redc operations,
contributed by Amitay Isaacs, Martin Schwenke and Alastair
D´Silva.
* The x86_64 AES implementation using aesni instructions has
been reorganized with one separate function per key size,
each interleaving the processing of two blocks at a time
(when the caller processes multiple blocks with each call).
This gives a modest performance improvement on some
processors.
* Rewritten and faster x86_64 poly1305 assembly.
Known issues:
* Nettle's testsuite doesn't work out-of-the-box on recent
MacOS, due to /bin/sh discarding the DYLD_LIBRARY_PATH
environment variable. Nettle's test scripts handle this in
some cases, but currently fails the test cases that are
themselves written as /bin/sh scripts. As a workaround, use
make check EMULATOR='env DYLD_LIBRARY_PATH=$(TEST_SHLIB_DIR)'
Miscellaneous:
* Updated manual to current makeinfo conventions, with no
explicit node pointers. Generate pdf version with texi2pdf,
to get working hyper links.
* Added square root functions for NIST ecc curves, as a
preparation for supporting compact point representation.
* Reworked internal GCM/ghash interfaces, simplifying assembly
implementations. Deleted unused GCM C implementation
variants with less than 8-bit lookup table.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Adolf Belka [Wed, 24 Aug 2022 07:50:20 +0000 (09:50 +0200)]
iproute2: Update to version 5.19.0
- Update from 5.17.0 to 5.19.0
- Update of rootfile
- Changelog is only available as the lsit fo commits from the git repository
https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/log/
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Adolf Belka [Wed, 24 Aug 2022 07:50:02 +0000 (09:50 +0200)]
fetchmail: Update to version 6.4.32
- Update from version 6.4.19 to 6.4.32
- Update of rootfile not required
- Changelog - range of security and bug fixes
fetchmail-6.4.32 (released 2022-07-30, 31696 LoC):
# FIXES:
* Use configure to find rst2html, some systems install it only with .py suffix,
others only without, and some install both.
* Update README.maintainer
# TRANSLATIONS: language translations were updated by these fine people:
(in alphabetical order of language codes so as not to prefer people):
* cs: Petr Pisar [Czech]
* es: Cristian Othón Martínez Vera [Spanish]
* ja: Takeshi Hamasaki [Japanese]
* pl: Jakub Bogusz [Polish]
* ro: Remus-Gabriel Chelu [Romanian]
* sq: Besnik Bleta [Albanian]
* sv: Göran Uddeborg [Swedish]
fetchmail-6.4.31 (released 2022-07-16, 31694 LoC):
# BUG FIXES:
* Try to fix ./configure --with-ssl=... for systems that have multiple OpenSSL
versions installed. Issues reported by Dennis Putnam.
* The netrc parser now reports its errors to syslog or logfile when appropriate,
previously it would always log to stderr.
* Add error checking to .netrc parser.
# CHANGES:
* manpage: use .UR/.UE macros instead of .URL for URIs.
* manpage: fix contractions. Found with FreeBSD's igor tool.
* manpage: HTML now built with pandoc -> python-docutils
(manServer.pl was dropped)
fetchmail-6.4.30 (released 2022-04-26, 31666 LoC):
# BREAKING CHANGES:
* Bump wolfSSL minimum required version to 5.2.0 to pull in security fix.
# CHANGES:
* Using OpenSSL 1.* before 1.1.1n elicits a compile-time warning.
* Using OpenSSL 3.* before 3.0.2 elicits a compile-time warning.
* configure.ac was tweaked in order to hopefully fix cross-compilation issues
report, and different patch suggested, by Fabrice Fontaine,
https://gitlab.com/fetchmail/fetchmail/-/merge_requests/42
# TRANSLATIONS: language translations were updated by this fine person:
* ro: Remus-Gabriel Chelu [Romanian]
fetchmail-6.4.29 (released 2022-03-20, 31661 LoC):
# TRANSLATIONS: language translations were updated by this fine person:
* vi: Trần Ngọc Quân [Vietnamese]
fetchmail-6.4.28 (released 2022-03-05, 31661 LoC):
# DOCUMENTATION:
* Fix a typo in the manual page, courtesy of Jeremy Petch.
# TRANSLATIONS: language translations were updated by this fine person:
* es: Cristian Othón Martínez Vera [Spanish]
fetchmail-6.4.27 (released 2022-01-26, 31661 LoC):
# BREAKING CHANGES:
* Bump wolfSSL minimum required version to 5.1.1 to pull in security fix.
# TRANSLATIONS: language translations were updated by this fine person:
* ro: Remus-Gabriel Chelu [Romanian]
fetchmail-6.4.26 (released 2021-12-26, 31661 LoC):
# FIXES:
* When using wolfSSL 5.0.0, work around a bug that appears to hit wolfSSL when
receiving handshake records while still in SSL_peek(). Workaround is to read
1 byte and cache it, then call SSL_peek() again.
This affects only some servers. https://github.com/wolfSSL/wolfssl/issues/4593
# TRANSLATIONS: language translations were updated by this fine person:
* sr: Мирослав Николић (Miroslav Nikolić) [Serbian]
fetchmail-6.4.25 (released 2021-12-10, 31653 LoC):
# BREAKING CHANGES:
* Since distributions continue patching for LibreSSL use, which cannot be
linked legally, block out LibreSSL in configure.ac and socket.c, and
refer to COPYING, unless on OpenBSD (which ships it in the base system).
OpenSSL and wolfSSL 5 can be used. SSL-related documentation was updated, do
re-read COPYING, INSTALL, README, README.packaging, README.SSL.
* Bump OpenSSL version requirement to 1.0.2f in order to safely remove
the obsolete OpenSSL flag SSL_OP_SINGLE_DH_USE. This blocks out 1.0.2e and
older 1.0.2 versions. 1.0.2f was a security fix release, and 1.0.2u is
publicly available from https://www.openssl.org/source/old/1.0.2/
* Some of the configure.ac fiddling MIGHT have broken cross-compilation
again. The maintainer does not test cross-compiling fetchmail; if you
have difficulties, try setting PKG_CONFIG_LIBDIR to the pkg-config path
containing your target/host libraries, or see if --with-ssl-prefix or
--with-wolfssl-prefix, or overriding LDFLAGS/LIBS/CPPFLAGS, can help.
Feedback solicited on compliant systems that are before end-of-life.
# BUG FIXES:
* 6.4.24's workaround for OpenSSL 1.0.2's X509_V_FLAG_TRUSTED_FIRST flag
contained a typo and would not kick in properly.
* Library and/or rpath setting from configure.ac was fixed.
# ADDITIONS:
* Added an example systemd unit file and instructions to contrib/systemd/
which runs fetchmail as a daemon with 5-minute poll intervals.
Courteously contributed by Barak A. Pearlmutter, Debian Bug#981464.
* fetchmail can now be used with wolfSSL 5's OpenSSL compatibility layer,
see INSTALL and README.SSL. This is considered experimental.
Feedback solicited.
# CHANGES:
* The getstats.py dist-tool now counts lines of .ac and .am files.
* ./configure --with-ssl now supports pkg-config module names, too. See INSTALL.
# TRANSLATIONS: language translations were updated by these fine people:
(in reverse alphabetical order of language codes so as not to prefer people):
* sv: Göran Uddeborg [Swedish]
* sq: Besnik Bleta [Albanian]
* pl: Jakub Bogusz [Polish]
* ja: Takeshi Hamasaki [Japanese]
* fr: Frédéric Marchal [French]
* eo: Keith Bowes [Esperanto]
* cs: Petr Pisar [Czech]
fetchmail-6.4.24 (released 2021-11-20, 30218 LoC):
# OPENSSL AND LICENSING NOTE:
> see fetchmail-6.4.22 below, and the file COPYING.
Note that distribution of packages linked with LibreSSL is not feasible
due to a missing GPLv2 clause 2(b) exception.
# COMPATIBILITY:
* Bison 3.8 dropped yytoknum altogether, breaking compilation due to a
warning workaround. Remove the cast of yytoknum to void. This may cause
a compiler warning to reappear with older Bison versions.
* OpenSSL 1.0.2: Workaround for systems that keep the expired DST Root CA X3
certificate in its trust store because OpenSSL by default prefers the
untrusted certificate and fails. Fetchmail now sets the
X509_V_FLAG_TRUSTED_FIRST flag (on OpenSSL 1.0.2 only).
This is workaround #2 from the OpenSSL Blog. For details, see both:
https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/
https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/
NOTE: OpenSSL 1.0.2 is end of life, it is assumed that the OpenSSL library
is kept up to date by a distributor or via OpenSSL support contract.
Where this is not the case, please upgrade to a supported OpenSSL version.
# DOCUMENTATION:
* The manual page was revised after re-checking with mandoc -Tlint, aspell,
igor. Some more revisions were made for clarity.
# TRANSLATIONS: language translations were updated by these fine people:
* sv: Göran Uddeborg [Swedish]
* pl: Jakub Bogusz [Polish]
* fr: Frédéric Marchal [French]
* cs: Petr Pisar [Czech]
* eo: Keith Bowes [Esperanto]
* ja: Takeshi Hamasaki [Japanese]
fetchmail-6.4.23 (released 2021-10-31, 30206 LoC):
# USABILITY:
* For common ssh-based IMAP PREAUTH setups (i. e. those that use a plugin
- no matter its contents - and that set auth ssh), change the STARTTLS
error message to suggest sslproto '' instead.
This is a commonly reported issue after the CVE-2021-39272 fix in 6.4.22.
Fixes Redhat Bugzilla 2008160. Fixes GitLab #39.
# TRANSLATIONS: language translations were updated by these fine people:
* ja: Takeshi Hamasaki [Japanese]
* sr: Мирослав Николић (Miroslav Nikolić) [Serbian]
fetchmail-6.4.22 (released 2021-09-13, 30201 LoC):
# OPENSSL AND LICENSING NOTE:
* fetchmail 6.4.22 is compatible with OpenSSL 1.1.1 and 3.0.0.
OpenSSL's licensing changed between these releases from dual OpenSSL/SSLeay
license to Apache License v2.0, which is considered incompatible with GPL v2
by the FSF. For implications and details, see the file COPYING.
# SECURITY FIXES:
* CVE-2021-39272: fetchmail-SA-2021-02: On IMAP connections, without --ssl and
with nonempty --sslproto, meaning that fetchmail is to enforce TLS, and when
the server or an attacker sends a PREAUTH greeting, fetchmail used to continue
an unencrypted connection. Now, log the error and abort the connection.
--Recommendation for servers that support SSL/TLS-wrapped or "implicit" mode on
a dedicated port (default 993): use --ssl, or the ssl user option in an rcfile.
--Reported by: Andrew C. Aitchison, based on the USENIX Security 21 paper "Why
TLS is better without STARTTLS - A Security Analysis of STARTTLS in the Email
Context" by Damian Poddebniak, Fabian Ising, Hanno Böck, and Sebastian
Schinzel. The paper did not mention fetchmail.
* On IMAP and POP3 connections, --auth ssh no longer prevents STARTTLS
negotiation.
* On IMAP connections, fetchmail does not permit overriding a server-side
LOGINDISABLED with --auth password any more.
* On POP3 connections, the possibility for RPA authentication (by probing with
an AUTH command without arguments) no longer prevents STARTTLS negotiation.
* For POP3 connections, only attempt RPA if the authentication type is "any".
# BUG FIXES:
* On IMAP connections, when AUTHENTICATE EXTERNAL fails and we have received the
tagged (= final) response, do not send "*".
* On IMAP connections, AUTHENTICATE EXTERNAL without username will properly send
a "=" for protocol compliance.
* On IMAP connections, AUTHENTICATE EXTERNAL will now check if the server
advertised SASL-IR (RFC-4959) support and otherwise refuse (fetchmail <= 6.4
has not supported and does not support the separate challenge/response with
command continuation)
* On IMAP connections, when --auth external is requested but not advertised by
the server, log a proper error message.
* Fetchmail no longer crashes when attempting a connection with --plugin "" or
--plugout "".
* Fetchmail no longer leaks memory when processing the arguments of --plugin or
--plugout on connections.
* On POP3 connections, the CAPAbilities parser is now caseblind.
* Fix segfault on configurations with "defaults ... no envelope". Reported by
Bjørn Mork. Fixes Debian Bug#992400. This is a regression in fetchmail 6.4.3
and happened when plugging memory leaks, which did not account for that the
envelope parameter is special when set as "no envelope". The segfault happens
in a constant strlen(-1), triggered by trusted local input => no vulnerability.
* Fix program abort (SIGABRT) with "internal error" when invalid sslproto is
given with OpenSSL 1.1.0 API compatible SSL implementations.
# CHANGES:
* IMAP: When fetchmail is in not-authenticated state and the server volunteers
CAPABILITY information, use it and do not re-probe. (After STARTTLS, fetchmail
must and will re-probe explicitly.)
* For typical POP3/IMAP ports 110, 143, 993, 995, if port and --ssl option
do not match, emit a warning and continue. Closes Gitlab #31.
(cherry-picked from 6.5 beta branch "legacy_6x")
* fetchmail.man and README.SSL were updated in line with RFC-8314/8996/8997
recommendations to prefer Implicit TLS (--ssl/ssl) and TLS v1.2 or newer,
placing --sslproto tls1.2+ more prominently.
The defaults shall not change between 6.4.X releases for compatibility.
# TRANSLATIONS: language translations were updated by these fine people:
* sq: Besnik Bleta [Albanian]
* cs: Petr Pisar [Czech]
* eo: Keith Bowes [Esperanto]
* fr: Frédéric Marchal [French]
* pl: Jakub Bogusz [Polish]
* sv: Göran Uddeborg [Swedish]
fetchmail-6.4.21 (released 2021-08-09, 30042 LoC):
# REGRESSION FIX:
* The new security fix in 6.4.20 for CVE-2021-36386 caused truncation of
messages logged to buffered outputs, from --logfile and --syslog.
This also caused lines in the logfile to run into one another because
the fragment containing the '\n' line-end character was usually lost.
Reason is that on all modern systems (with <stdarg.h> header and vsnprintf()
interface), the length of log message fragments was added up twice, so
that these ended too deep into a freshly allocated buffer, after the '\0'
byte. Unbuffered outputs flushed the fragments right away, which masked the
bug.
fetchmail-6.4.20 (released 2021-07-28, 30042 LoC):
# SECURITY FIX:
* When a log message exceeds c. 2 kByte in size, for instance, with very long
header contents, and depending on verbosity option, fetchmail can crash or
misreport each first log message that requires a buffer reallocation.
fetchmail then reallocates memory and re-runs vsnprintf() without another
call to va_start(), so it reads garbage. The exact impact depends on
many factors around the compiler and operating system configurations used and
the implementation details of the stdarg.h interfaces of the two functions
mentioned before. To fix CVE-2021-36386.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Adolf Belka [Wed, 24 Aug 2022 07:49:04 +0000 (09:49 +0200)]
efibootmgr: Update to version 18
- Update from version 17 to 18
- Update of rootfile not required
- Changelog
bug fixes
fixed the simple run example by @Katana-Steel in #88
Restore activation error message in efibootmgr by @rbisewski in #89
Android: correct the sources list by @cwhuang in #124
remove-dupes: update error message by @raharper in #127
Fix typo in manual page by @ferivoz in #136
README: Note efivarfs as the current required kernel module by @cjmayo in #145
Fix possible read out of bounds in ucs2_to_utf8 by @dlrobertson in #147
Migrate CI by @frozencemetery in #153
Add code of conduct by @frozencemetery in #154
Fix help messages by @robert-scheck in #156
Add option for insertion location of new entries by @frozencemetery in #166
Full changelog can be found from the github repository comparing versio 17 to 18
https://github.com/rhboot/efibootmgr/compare/17...18
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Adolf Belka [Sun, 21 Aug 2022 20:01:41 +0000 (22:01 +0200)]
elfutils: Update to version 0.187
- Update from version 0.186 to 0.187
- Update of rootfile
- Changelog
0.187
* NEWS *
debuginfod: Support -C option for connection thread pooling.
debuginfod-client: Negative cache file are now zero sized instead of
no-permission files.
addr2line: The -A, --absolute option, which shows file names including
the full compilation directory is now the default. To get the
old behavior use the new option --relative.
readelf, elflint: Recognize FDO Packaging Metadata ELF notes
libdw, debuginfo-client: Load libcurl lazily only when files need to
be fetched remotely. libcurl is now never
loaded when DEBUGINFOD_URLS is unset. And when
DEBUGINFOD_URLS is set, libcurl is only loaded
when the debuginfod_begin function is called.
* GIT SHORTLOG *
debuginfod: Include "IPv4 IPv6" in server startup message
PR29022: 000-permissions files cause problems for backups
debuginfod: Use the debuginfod-size response header
debuginfod: ensure X-DEBUGINFOD-SIZE contains file size
config: simplify profile.*sh.in
debuginfod/debuginfod-client.c: use long for cache time configurations
readelf: Don't consider padding DT_NULL as dynamic section entry
debuginfod: correct concurrency bug in fdcache metrics
PR28661: debuginfo connection thread pool support
man debuginfod-client-config.7: Elaborate $DEBUGINFOD_URLS
PR28708: debuginfod: use MHD_USE_EPOLL for microhttpd threads
debuginfod: use single ipv4+ipv6 microhttpd daemon configuration
AUTHORS: Use generator script & git mailmap
libebl: recognize FDO Packaging Metadata ELF note
tests: Don't set DEBUGINFOD_TIMEOUT
tests: Add -rdynamic to dwfl_proc_attach_LDFLAGS
debuginfod: Use gmtime_r instead of gmtime to avoid data race
debuginfod: sqlite3_sharedprefix_fn should not compare past end of string
debuginfod: Fix some memory leaks on debuginfod-client error paths.
debuginfod: Clear and reset debuginfod_client winning_headers on reuse
libdwfl: Don't read beyond end of file in dwfl_segment_report_module
debuginfod: Check result of calling MHD_add_response_header.
readelf: Workaround stringop-truncation error
tests: varlocs workaround format-overflow errors
debuginfod: Fix debuginfod_pool leak
configure: Add --enable-sanitize-address
debuginfod: Don't format clog using 'right' or 'setw(20)'.
libdwfl: Don't try to convert too many bytes in dwfl_link_map_report
libdwfl: Make sure we know the phdr entry size before searching phdrs.
libdwfl: Don't trust e_shentsize in dwfl_segment_report_module
libdwfl: Don't install an Elf handle in a Dwfl_Module twice
libdwfl: Don't try to convert too many dyns in dwfl_link_map_report
libdwfl: Don't allocate more than SIZE_MAX in dwfl_segment_report_module.
libelf: Use offsetof to get field of unaligned
libdwfl: Make sure phent is sane and there is at least one phdr
libdwfl: Add overflow check while iterating in dwfl_segment_report_module
tests: Use /bin/sh instead of /bin/ls as always there binary
libdwfl: Make sure there is at least one dynamic entry
libdwfl: Make sure there is at least one phdr
libdwfl: Make sure note data is properly aligned.
libdwfl: Make dwfl_segment_report_module aware of maximum Elf size
libdwfl: Make sure the note len increases each iteration
libelf: Only set shdr state when there is at least one shdr
libdwfl: Make sure that ph_buffer_size has room for at least one phdr
libdwfl: Make sure dyn_filesz has a sane size
libdwfl: Rewrite GElf_Nhdr reading in dwfl_segment_report_module
libdwfl: Handle unaligned Ehdr in dwfl_segment_report_module
libdwfl: Handle unaligned Phdr in dwfl_segment_report_module
libdwfl: Handle unaligned Nhdr in dwfl_segment_report_module
libdwfl: Always clean up build_id.memory
libdwfl: Make sure dwfl_elf_phdr_memory_callback returns at least minread
libdwfl: Call xlatetom on aligned buffers in dwfl_link_map_report
libdwfl: Calculate addr to read by hand in link_map.c read_addrs.
libdwfl: Fix overflow check in link_map.c read_addrs
libdwfl: Handle unaligned Dyns in dwfl_segment_report_module
libdwfl: Declare possible zero sized arrays only when non-zero
backends: Use PTRACE_GETREGSET for ppc_set_initial_registers_tid
configure: Test for _FORTIFY_SOURCE=3 support.
addr2line: Make --absolute the default, add --relative option.
configure: Use AS_HELP_STRING instead of AC_HELP_STRING.
libelf: Take map offset into account for Shdr alignment check in elf_begin
libelf: Make sure ar_size starts with a digit before calling atol.
libelf: Check alignment of Verdef, Verdaux, Verneed and Vernaux offsets
libdwfl: Close ar members when they cannot be processed.
libdwfl: Use memcpy to assign image header field values
libelf: Don't overflow offsets in elf_cvt_Verneed and elf_cvt_Verdef
libelf: Correct alignment of ELF_T_GNUHASH data for ELFCLASS64
tests: Check addsections test binary is 64bit for run-large-elf-file.sh
configure: Don't check whether -m64 works for 32bit host biarch check
libelf: Sync elf.h from glibc.
elflint: Recognize NT_FDO_PACKAGING_METADATA
Introduce error_exit as a noreturn variant of error (EXIT_FAILURE, ...)
libelf: Also copy/convert partial datastructures in xlate functions
libelf: Return already gotten Elf_Data from elf_getdata_rawchunk
config: Add versioned requires on libs/libelf for debuginfod-client
libdw: Add DWARF5 package file section identifiers, DW_SECT_*
tests: Don't try to corrupt sqlite database during test.
libdw: Remove unused atomics.h include from libdwP.h
readelf: Define dyn_mem outside the while loop.
tests: Lower parallel lookups in run-debuginfod-webapi-concurrency.sh
debuginfod: Use MHD_USE_ITC in MHD_start_daemon flags
elfclassify: Fix --no-stdin flag
libelf: Check for mremap, elf_update needs it for ELF_C_RDWR_MMAP
debuginfod, libdwfl: Initialize libcurl and dlopen debuginfod-client lazily
dwfl: fix potential overflow when reporting on kernel modules
debuginfod: fix compilation on platforms without <error.h>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Adolf Belka [Wed, 24 Aug 2022 07:50:34 +0000 (09:50 +0200)]
libarchive: Update to version 3.6.1
- Update from version 3.6.0 to 3.6.1
- Update of rootfile
- Changelog
Libarchive 3.6.1 is a bugfix and security release.
Security fixes:
7zip reader: fix PPMD read beyond boundary (#1671)
ZIP reader: fix possible out of bounds read (OSS-Fuzz 38766 #1672)
ISO reader: fix possible heap buffer overflow in read_children() (OSS-Fuzz 38764, #1685)
RARv4 redaer: fix multiple issues in RARv4 filter code (introduced in libarchive 3.6.0)
fix heap use after free in archive_read_format_rar_read_data() (OSS-Fuzz 44547, 52efa50)
fix null dereference in read_data_compressed() (OSS-Fuzz 44843, 1271f77)
fix heap user after free in run_filters() (OSS-Fuzz 46279, #1715)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Adolf Belka [Wed, 24 Aug 2022 07:51:01 +0000 (09:51 +0200)]
openvpn: Update to version 2.5.7
- Update from version 2.5.6 to 2.5.7
- Update of rootfile not required
- Changelog
2.5.7. This is mostly a bugfix release, but adds limited support for OpenSSL 3.0. Full
support will arrive in OpenVPN 2.6.
networking: use OPENVPN_ETH_ALEN instead of ETH_ALEN
networking_iproute2: don't pass M_WARN to openvpn_execve_check()
t_net.sh: delete dummy iface using iproute command
auth-pam.c: add missing include limits.h
Add insecure tls-cert-profile options
Refactor early initialisation and uninitialisation into methods
Allow loading of non default providers
Add ubuntu 22.04 to Github Actions
Add macos OpenSSL 3.0 and ASAN builds
Add --with-openssl-engine autoconf option (auto|yes|no)
Fix allowing/showing unsupported ciphers and digests
Remove dependency on BF-CBC existance from test_ncp
Add message when decoding PKCS12 file fails.
Translate OpenSSL 3.0 digest names to OpenSSL 1.1 digest names
Fix client-pending-auth error message to say ERROR instead of SUCCESS
cipher-negotiation.rst missing from doc/Makefile.am
vcpkg-ports\pkcs11-helper: shorten patch filename
msvc: adjust build options to harden binaries
vcpkg-ports: remove openssl port
vcpkg: switch to manifest
Fix M_ERRNO behavior on Windows
vcpkg-ports/pkcs11-helper: bump to release 1.29
tapctl: Resolve MSVC C4996 warnings
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
- Update from version 3390000 to 3390200
- Update of rootfile not required
- Changelog
version 3.39.2 (2022-07-21):
Fix a performance regression in the query planner associated with rearranging
the order of FROM clause terms in the presences of a LEFT JOIN.
Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing.
version 3.39.1 (2022-07-13):
Fix an incorrect result from a query that uses a view that contains a
compound SELECT in which only one arm contains a RIGHT JOIN and where the
view is not the first FROM clause term of the query that contains the view.
forum post 174afeae5734d42d.
Fix some harmless compiler warnings.
Fix a long-standing problem with ALTER TABLE RENAME that can only arise if
the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value.
Fix a long-standing problem in FTS3 that can only arise when compiled with
the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option.
Fix the build so that is works when the SQLITE_DEBUG and
SQLITE_OMIT_WINDOWFUNC compile-time options are both provided at the same time.
Fix the initial-prefix optimization for the REGEXP extension so that it works
correctly even if the prefix contains characters that require a 3-byte UTF8
encoding.
Enhance the sqlite_stmt virtual table so that it buffers all of its output.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Matthias Fischer [Sat, 27 Aug 2022 07:02:00 +0000 (09:02 +0200)]
bind: Update to 9.16.32
For details see:
https://downloads.isc.org/isc/bind9/9.16.32/doc/arm/html/notes.html#notes-for-bind-9-16-32
Excerpt from changelog:
"5934. [func] Improve fetches-per-zone fetch limit logging to log
the final allowed and spilled values of the fetch
counters before the counter object gets destroyed.
[GL #3461]
5933. [port] Automatically disable RSASHA1 and NSEC3RSASHA1 in
named on Fedorda 33, Oracle Linux 9 and RHEL9 when
they are disabled by the security policy. [GL #3469]
5932. [bug] Fix rndc dumpdb -expired and always include expired
RRsets, not just for RBTDB_VIRTUAL time window.
[GL #3462]
5929. [bug] The "max-zone-ttl" option in "dnssec-policy" was
not fully effective; it was used for timing key
rollovers but did not actually place an upper limit
on TTLs when loading a zone. This has been
corrected, and the documentation has been clarified
to indicate that the old "max-zone-ttl" zone option
is now ignored when "dnssec-policy" is in use.
[GL #2918]
5924. [func] When it's necessary to use AXFR to respond to an
IXFR request, a message explaining the reason
is now logged at level info. [GL #2683]
5923. [bug] Fix inheritance for dnssec-policy when checking for
inline-signing. [GL #3438]
5922. [bug] Forwarding of UPDATE message could fail with the
introduction of netmgr. This has been fixed. [GL #3389]"
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org> Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
Adolf Belka [Sun, 21 Aug 2022 20:01:56 +0000 (22:01 +0200)]
udev: Update to version 3.2.11
- Update from version 3.2.6 to 3.2.11
- Update of rootfile
- Changelog
Release 3.2.11 Latest
add actions workflows to check compilation on glibc and musl (devuan, alpine) by @ArsenArsen in #206
Add build instructions by @slicer69 in #207
src/libudev/conf-files.c: fix bug of using basename by @xfan1024 in #198
Permit eudev to work with rules which include escaped double-quotes by @slicer69 in #208
sync src/ata_id/ata_id.c by @bbonev in #201
sync src/v4l_id/v4l_id.c by @bbonev in #202
sync src/scsi_id/scsi_id.c by @bbonev in #203
sync src/mtd_probe/*.[ch] by @bbonev in #204
sparse: avoid clash with __bitwise and __force from 4.10 linux/types.… by @bbonev in #209
Silence deprecation warnings by @bbonev in #210
update CONTRIBUTING to reflect updated governance, clarify systemd commit hash requirements by @kaniini in #211
hashmap: don't initialize devt_hash_ops in the header by @kaniini in #212
Update to latest Devuan stable by @wwuck in #213
hwdb: sync with systemd/main by @bbonev in #215
Add getrandom(2) system call number for PowerPC by @Low-power in #216
No changelog for versions prior to 3.2.11 found. Looks like they are in nthe systemd
releases and not easily extracted.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org> Acked-by: Michael Tremer <michael.tremer@ipfire.org> Acked-by: Michael Tremer <michael.tremer@ipfire.org>
Adolf Belka [Sun, 21 Aug 2022 20:01:18 +0000 (22:01 +0200)]
curl: Update to version 7.84.0
- Update from version 7.83.1 to 7.84.0
- Update of rootfile
- Changelog
7.84.0 - June 27 2022
Changes:
curl: add --rate to set max request rate per time unit
curl: deprecate --random-file and --egd-file
curl_version_info: add CURL_VERSION_THREADSAFE
CURLINFO_CAPATH/CAINFO: get the default CA paths from libcurl
lib: make curl_global_init() threadsafe when possible
libssh2: add CURLOPT_SSH_HOSTKEYFUNCTION
opts: deprecate RANDOM_FILE and EGDSOCKET
socks: support unix sockets for socks proxy
Bugfixes:
aws-sigv4: fix potentional NULL pointer arithmetic
bindlocal: don't use a random port if port number would wrap
c-hyper: mark status line as status for Curl_client_write()
ci: avoid `cmake -Hpath`
CI: bump FreeBSD 13.0 to 13.1
ci: update github actions
cmake: add libpsl support
cmake: do not add libcurl.rc to the static libcurl library
cmake: enable curl.rc for all Windows targets
cmake: fix detecting libidn2
cmake: support adding a suffix to the OS value
configure: skip libidn2 detection when winidn is used
configure: use the SED value to invoke sed
configure: warn about rustls being experimental
content_encoding: return error on too many compression steps
cookie: address secure domain overlay
cookie: apply limits
copyright.pl: parse and use .reuse/dep5 for skips
copyright: make repository REUSE compliant
curl.1: add a few see also --tls-max
curl.1: mention exit code zero too
curl: re-enable --no-remote-name
curl_easy_pause.3: remove explanation of progress function
curl_getdate.3: document that some illegal dates pass through
Curl_parsenetrc: don't access local pwbuf outside of scope
curl_url_set.3: clarify by default using known schemes only
CURLOPT_ALTSVC.3: document the file format
CURLOPT_FILETIME.3: fix the protocols this works with
CURLOPT_HTTPHEADER.3: improve comment in example
CURLOPT_NETRC.3: document the .netrc file format
CURLOPT_PORT.3: We discourage using this option
CURLOPT_RANGE.3: remove ranged upload advice
digest: added detection of more syntax error in server headers
digest: tolerate missing "realm"
digest: unquote realm and nonce before processing
DISABLED: disable 1021 for hyper again
docs/cmdline-opts: add copyright and license identifier to each file
docs/CONTRIBUTE.md: document the 'needs-votes' concept
docs: clarify data replacement policy for MIME API
doh: remove UNITTEST macro definition
examples/crawler.c: use the curl license
examples: remove fopen.c and rtsp.c
FAQ: Clarify Windows double quote usage
fopen: add Curl_fopen() for better overwriting of files
ftp: restore protocol state after http proxy CONNECT
ftp: when failing to do a secure GSSAPI login, fail hard
GHA/hyper: enable debug in the build
gssapi: improve handling of errors from gss_display_status
gssapi: initialize gss_buffer_desc strings
headers api: remove EXPERIMENTAL tag
http2: always debug print stream id in decimal with %u
http2: reject overly many push-promise headers
http: restore header folding behavior
hyper: use 'alt-used'
krb5: return error properly on decode errors
lib: make more protocol specific struct fields #ifdefed
libcurl-security.3: add "Secrets in memory"
libcurl-security.3: document CRLF header injection
libssh: skip the fake-close when libssh does the right thing
links: update dead links to the curl-wiki
log2changes: do not indent empty lines [ci skip]
macos9: remove partial support
Makefile.am: fix portability issues
Makefile.m32: delete obsolete options, improve -On [ci skip]
Makefile.m32: delete two obsolete OpenSSL options [ci skip]
Makefile.m32: stop forcing XP target with ipv6 enabled [ci skip]
max-time.d: clarify max-time sets max transfer time
mprintf: ignore clang non-literal format string
netrc: check %USERPROFILE% as well on Windows
netrc: support quoted strings
ngtcp2: allow curl to send larger UDP datagrams
ngtcp2: correct use of ngtcp2 and nghttp3 signed integer types
ngtcp2: enable Linux GSO
ngtcp2: extend QUIC transport parameters buffer
ngtcp2: fix alert_read_func return value
ngtcp2: fix typo in preprocessor condition
ngtcp2: handle error from ngtcp2_conn_submit_crypto_data
ngtcp2: send appropriate connection close error code
ngtcp2: support boringssl crypto backend
ngtcp2: use helper funcs to simplify TLS handshake integration
ntlm: provide a fixed fake host name
projects: fix third-party SSL library build paths for Visual Studio
quic: add Curl_quic_idle
quiche: support ca-fallback
rand: stop detecting /dev/urandom in cross-builds
remote-name.d: mention --output-dir
runtests.pl: add the --repeat parameter to the --help output
runtests: fix skipping tests not done event-based
runtests: skip starting the ssh server if user name is lacking
scripts/copyright.pl: fix the exclusion to not ignore man pages
sectransp: check for a function defined when __BLOCKS__ is undefined
select: return error from "lethal" poll/select errors
server/sws: support spaces in the HTTP request path
speed-limit/time.d: mention these affect transfers in either direction
strcase: some optimisations
test 2081: add a valid reply for the second request
test 675: add missing CR so the test passes when run through Privoxy
test414: add the '--resolve' keyword
test681: verify --no-remote-name
tests 266, 116 and 1540: add a small write delay
tests/data/test1501: kill ftp server after slow LIST response
tests/getpart: fix getpartattr to work with "data" and "data2"
tests/server/sws.c: change the HTTP writedelay unit to milliseconds
test{440,441,493,977}: add "HTTP proxy" keywords
tool_getparam: fix --parallel-max maximum value constraint
tool_operate: make sure --fail-with-body works with --retry
transfer: fix potential NULL pointer dereference
transfer: maintain --path-as-is after redirects
transfer: upload performance; avoid tiny send
url: free old conn better on reuse
url: remove redundant #ifdefs in allocate_conn()
url: URL encode the path when extracted, if spaces were set
urlapi: make curl_url_set(url, CURLUPART_URL, NULL, 0) clear all parts
urlapi: support CURLU_URLENCODE for curl_url_get()
urldata: reduce size of a few struct fields
urldata: remove three unused booleans from struct UserDefined
urldata: store tcp_keepidle and tcp_keepintvl as ints
version: allow stricmp() for sorting the feature list
vtls: make curl_global_sslset thread-safe
wolfssh.h: removed
wolfssl: correct the failf() message when a handle can't be made
wolfSSL: explicitly use compatibility layer
x509asn1: mark msnprintf return as unchecked
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Michael Tremer [Tue, 6 Sep 2022 12:15:54 +0000 (14:15 +0200)]
proxy.cgi: Correctly validate domain lists
Fixes: #12925 - JVN#15411362 Inquiry on vulnerability found in IPFire Reported-by: Noriko Totsuka <vuls@jpcert.or.jp> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Michael Tremer [Tue, 6 Sep 2022 11:58:22 +0000 (13:58 +0200)]
mail.cgi: Validate email recipient
The email recipient was not correctly validated which allowed for some
stored cross-site scripting vulnerability.
Fixes: #12925 - JVN#15411362 Inquiry on vulnerability found in IPFire Reported-by: Noriko Totsuka <vuls@jpcert.or.jp> Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Peter Müller [Thu, 1 Sep 2022 20:30:18 +0000 (20:30 +0000)]
configroot: Create "settings" and "modify" files for ipblocklist
The third version of this patch conducts the necessary changes in
configroot. Previously, they took place in ipblocklist itself, which
would have caused user settings to be overwritten, should ipblocklist be
shipped in future Core Updates.
Fixes: #12917 Cc: Stefan Schantl <stefan.schantl@ipfire.org> Signed-off-by: Peter Müller <peter.mueller@ipfire.org> Acked-by: Stefan Schantl <stefan.schantl@ipfire.org>
projects / people / pmueller / ipfire-2.x.git / log
