Arne Fitzenreiter
6703371d2d
Merge remote-tracking branch 'origin/core120' into kernel-4.14
2018-04-02 17:11:45 +02:00
Michael Tremer
4d888e6854
curl: Drop old compatibility symlink
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-04-02 15:50:09 +01:00
Arne Fitzenreiter
0d98de5a44
kernel: update to 4.14.32
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-04-01 16:15:27 +02:00
Arne Fitzenreiter
302dba205b
Merge remote-tracking branch 'origin/master' into kernel-4.14
2018-03-30 10:26:01 +02:00
Arne Fitzenreiter
018a19af64
kernel: update to 4.14.31
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-30 10:21:49 +02:00
Arne Fitzenreiter
36600cef36
Merge branch 'core119' into next
2018-03-30 09:35:28 +02:00
Michael Tremer
d9e656bb82
asterisk: Ship documentation
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-27 20:56:31 +01:00
Michael Tremer
d3cd99830a
fetchmail: Permit building without SSLv3
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-27 20:53:31 +01:00
Michael Tremer
76f422025f
openssl: Update to 1.0.2o
...
CVE-2018-0739 (OpenSSL advisory) [Moderate severity] 27 March 2018:
Constructed ASN.1 types with a recursive definition (such as can be
found in PKCS7) could eventually exceed the stack given malicious
input with excessive recursion. This could result in a Denial Of
Service attack. There are no such structures used within SSL/TLS
that come from untrusted sources so this is considered safe.
Reported by OSS-fuzz.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-27 16:05:07 +01:00
Michael Tremer
166ceacd6b
openssl: Update to 1.1.0h
...
CVE-2018-0739 (OpenSSL advisory) [Moderate severity] 27 March 2018:
Constructed ASN.1 types with a recursive definition (such as can be
found in PKCS7) could eventually exceed the stack given malicious
input with excessive recursion. This could result in a Denial Of
Service attack. There are no such structures used within SSL/TLS
that come from untrusted sources so this is considered safe.
Reported by OSS-fuzz.
This patch also entirely removes support for SSLv3. The patch to
disable it didn't apply and since nobody has been using this before,
we will not compile it into OpenSSL any more.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-27 16:03:44 +01:00
Peter Müller
dd48a7aac8
curl: update to 7.59.0
...
Update curl to 7.59.0 which fixes a number of bugs and
some minor security issues.
Signed-off-by: Peter Müller <peter.mueller@link38.eu >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-26 19:03:29 +01:00
Peter Müller
689fed340a
gnupg: update to 1.4.22
...
Update GnuPG to 1.4.22, which fixes some security vulnerabilities,
such as the memory side channel attack CVE-2017-7526.
Signed-off-by: Peter Müller <peter.mueller@link38.eu >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-26 19:03:24 +01:00
Arne Fitzenreiter
66b5b4d12c
kernel: update to 4.14.30
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-25 20:26:47 +02:00
Arne Fitzenreiter
37b86fa99b
xr819-firmware: add firmware for xradio xr-819 wlan
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-25 13:27:03 +02:00
Arne Fitzenreiter
0a21d63f26
kernel: updated arm config and image build
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-25 11:41:20 +02:00
Arne Fitzenreiter
ea9d53c822
inittab: change tty1 to console
...
this reduce the differences between tty and scon installations
and make it easier to switch between.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-24 13:26:32 +01:00
Arne Fitzenreiter
5bc33236ca
swconfig: remove old swconfig utility
...
this is not compatible with kernel 4.14
todo: replace swconfig calls in initskript
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-24 12:49:10 +01:00
Arne Fitzenreiter
4df5cc2f75
rpi-firmware: update to 2018-03-16
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-24 12:41:57 +01:00
Arne Fitzenreiter
2a0947f2e3
u-boot: update to 2018.03
...
todo: check wandboard version. there are internal changes to merge
the different wandboard images to one and u-boot.imx is not build
anymore. Which file is needed to boot on wandboard?
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-24 11:14:24 +01:00
Arne Fitzenreiter
832770a868
kernel: update to 4.14.29
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-22 13:16:37 +01:00
Matthias Fischer
a05af852c5
vnstat: Update to 1.18
...
For details see: https://humdi.net/vnstat/CHANGES
Changed "SaveInterval 5" to "SaveInterval 1" in '/etc/vnstat.conf', triggered by
https://forum.ipfire.org/viewtopic.php?f=22&t=20448 to avoid data loss with 1Gbit
connections and high traffic.
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-20 20:35:30 +00:00
Michael Tremer
eb68e27dd2
pakfire: Import key when system boots up
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-19 19:44:50 +00:00
Michael Tremer
5876642d17
ffmpeg: Ship libraries correctly
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-19 18:07:49 +00:00
Matthias Fischer
27ef66c26c
hdparm: Update to 9.55
...
Changelogs against 9.53:
"hdparm-9.55:
- added #include <sys/sysmacros.h> for major()/minor() macros
hdparm-9.54:
- Partial revert of Jmicron changes, from Jan Friesse."
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-19 11:56:35 +00:00
Matthias Fischer
71e5a29c81
dmidecode 3.1: Added patch (Fix firmware version of TPM device)
...
For details see:
http://git.savannah.gnu.org/cgit/dmidecode.git/commit/?id=174387405e98cd94c627832ae23abcb9be7e5623
"Both the operator (detected by clang, reported by Xorg) and the mask
for the minor firmware version field of TPM devices were wrong."
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-19 11:56:19 +00:00
Matthias Fischer
9e9fdb39e6
unbound: Update to 1.7.0
...
For details see:
http://www.unbound.net/download.html
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:49:40 +00:00
Matthias Fischer
399c2f9ccc
logrotate: Update to 3.14.0
...
For details see:
https://github.com/logrotate/logrotate/releases
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:44:27 +00:00
Matthias Fischer
4e316ae0a0
htop: Update to 2.1.0
...
For details see:
https://hisham.hm/htop/index.php?page=downloads
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:44:25 +00:00
Matthias Fischer
9051f3c9d7
bind: Update to 9.11.3
...
For details see:
http://ftp.isc.org/isc/bind9/9.11.3/RELEASE-NOTES-bind-9.11.3.html
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:44:19 +00:00
Matthias Fischer
1c1c1ac238
nano: Update to 2.9.4
...
For details see:
https://www.nano-editor.org/news.php
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:44:14 +00:00
Matthias Fischer
8aeec0ba89
rsync: Update to 3.1.3
...
For details see:
https://download.samba.org/pub/rsync/src/rsync-3.1.3-NEWS
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-18 13:44:12 +00:00
Arne Fitzenreiter
62777ff407
kernel: update to 4.14.27
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-16 20:49:22 +01:00
Erik Kapfer
cdc1a0e901
OpenVPN: Update to version 2.4.5
...
This is primarily a maintenance release, with further improved OpenSSL 1.1 integration, several minor bug fixes and other minor improvements.
Further information can be found in here https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst#version-245 and
here https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 .
Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-16 14:38:02 +00:00
Arne Fitzenreiter
bf19f5c6a0
kernel: drop rpi kernel
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-14 19:39:23 +01:00
Arne Fitzenreiter
ce8a4ba6a0
kernel: update to 4.14.26
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-13 11:37:36 +01:00
Arne Fitzenreiter
7fab74918d
kernel: update to 4.14.25
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-03-09 23:05:06 +01:00
Stephan Feddersen
f0e9ed78a2
WIO: increment PAK_VER
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-09 15:39:56 +00:00
Stephan Feddersen via Development
a25c95b3a0
WIO: Update to Version 1.3.2 several changes in many files
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-09 15:39:48 +00:00
Matthias Fischer
d536c178ec
ntp: Update to 4.2.8p11
...
For details see:
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
"This release addresses five security issues in ntpd:
LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephemeral
association attack
While fixed in ntp-4.2.8p7, there are significant additional protections for
this issue in 4.2.8p11.
Reported by Matt Van Gundy of Cisco.
INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer read overrun
leads to undefined behavior and information leak
Reported by Yihan Lian of Qihoo 360.
LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated ephemeral associations
Reported on the questions@ list.
LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode cannot recover
from bad state
Reported by Miroslav Lichvar of Red Hat.
LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet can reset
authenticated interleaved association
Reported by Miroslav Lichvar of Red Hat.
one security issue in ntpq:
MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909: ntpq:decodearr() can write beyond its
buffer limit
Reported by Michael Macnair of Thales-esecurity.com.
and provides over 33 bugfixes and 32 other improvements."
Best,
Matthias
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-07 18:44:04 +00:00
Matthias Fischer
cc4816a1af
clamav 0.99.4: removed gcc patch
...
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-07 18:43:44 +00:00
Peter Müller
9d5e5eb012
Tor: update to 0.3.2.10
...
Update Tor to 0.3.2.10, which fixes some security and DoS
issues especially important for relays.
The release notes are available at:
https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915
Signed-off-by: Peter Müller <peter.mueller@link38.eu >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
Fixes : #11662
2018-03-05 15:12:28 +00:00
Peter Müller
a12d488682
ClamAV: update to 0.99.4
...
Update ClamAV to 0.99.4 which fixes four security issues
and compatibility issues with GCC 6 and C++ 11.
The release note can be found here: http://blog.clamav.net/2018/03/clamav-0994-has-been-released.html
Signed-off-by: Peter Müller <peter.mueller@link38.eu >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-03-05 15:11:55 +00:00
Arne Fitzenreiter
d5e0428c15
kernel: 4.14.23
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-02-28 16:20:17 +01:00
Michael Tremer
263d1e6484
openssl: Apply ciphers patch before running Configure
...
This works just fine here.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-28 11:49:47 +00:00
Peter Müller via Development
5929493445
set OpenSSL 1.1.0 DEFAULT cipher list to secure value
...
Only use secure cipher list for the OpenSSL DEFAULT list:
* ECDSA is preferred over RSA since it is faster and more scalable
* TLS 1.2 suites are preferred over anything older
* weak ciphers such as RC4 and 3DES have been eliminated
* AES-GCM is preferred over AES-CBC (known as "mac-then-encrypt" problem)
* ciphers without PFS are moved to the end of the cipher list
This patch leaves AES-CCM, AES-CCM8 and CHACHA20-POLY1305 suites
where they are since they are considered secure and there is no
need to change anything.
The DEFAULT cipher list is now (output of "openssl ciphers -v"):
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-ECDSA-AES256-CCM8 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM8(256) Mac=AEAD
ECDHE-ECDSA-AES256-CCM TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM(256) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES128-CCM8 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM8(128) Mac=AEAD
ECDHE-ECDSA-AES128-CCM TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESCCM(128) Mac=AEAD
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384
ECDHE-ECDSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=Camellia(256) Mac=SHA384
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256
ECDHE-ECDSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=Camellia(128) Mac=SHA256
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384
ECDHE-RSA-CAMELLIA256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=Camellia(256) Mac=SHA384
ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256
ECDHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=Camellia(128) Mac=SHA256
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD
DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
DHE-RSA-AES256-CCM8 TLSv1.2 Kx=DH Au=RSA Enc=AESCCM8(256) Mac=AEAD
DHE-RSA-AES256-CCM TLSv1.2 Kx=DH Au=RSA Enc=AESCCM(256) Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES128-CCM8 TLSv1.2 Kx=DH Au=RSA Enc=AESCCM8(128) Mac=AEAD
DHE-RSA-AES128-CCM TLSv1.2 Kx=DH Au=RSA Enc=AESCCM(128) Mac=AEAD
DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256
DHE-RSA-CAMELLIA256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA256
DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256
DHE-RSA-CAMELLIA128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=Camellia(128) Mac=SHA256
ECDHE-ECDSA-AES256-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1
ECDHE-ECDSA-AES128-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1
ECDHE-RSA-AES256-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1
ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1
DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1
DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1
DHE-RSA-CAMELLIA128-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(128) Mac=SHA1
AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD
AES256-CCM8 TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM8(256) Mac=AEAD
AES256-CCM TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM(256) Mac=AEAD
AES128-GCM-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD
AES128-CCM8 TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM8(128) Mac=AEAD
AES128-CCM TLSv1.2 Kx=RSA Au=RSA Enc=AESCCM(128) Mac=AEAD
AES256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA256
CAMELLIA256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=Camellia(256) Mac=SHA256
AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256
CAMELLIA128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=Camellia(128) Mac=SHA256
AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1
CAMELLIA256-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(256) Mac=SHA1
AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1
CAMELLIA128-SHA SSLv3 Kx=RSA Au=RSA Enc=Camellia(128) Mac=SHA1
This has been discussed at 2017-12-04 (https://wiki.ipfire.org/devel/telco/2017-12-04 )
and for a similar patch written for OpenSSL 1.0.x.
Signed-off-by: Peter Müller <peter.mueller@link38.eu >
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-28 11:45:03 +00:00
Arne Fitzenreiter
031ea15b00
kernel: update to 4.14.22
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-02-27 15:25:50 +01:00
Arne Fitzenreiter
1a7cfc2f10
Merge remote-tracking branch 'origin/core119' into kernel-4.14
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-02-27 12:38:18 +01:00
Arne Fitzenreiter
7eb86ee39e
mpd: bump package to remove link against tcpwrapper
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-02-26 20:08:56 +01:00
Michael Tremer
ca4c354e08
Bump release of all packages linked against OpenSSL
...
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org >
2018-02-26 16:28:16 +00:00
Arne Fitzenreiter
e5ef944d6e
kernel: update to 4.14.21
...
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org >
2018-02-23 19:33:15 +01:00