Commit Graph

21024 Commits

Author SHA1 Message Date
Matthias Fischer
bbd49cbcca clamav: Update to 1.2.1
For details see:
https://blog.clamav.net/2023/10/clamav-121-113-104-010311-patch.html

Excerpt:

"ClamAV 1.2.1 is a patch release with the following fixes:

    Eliminate security warning about unused "atty" dependency.

    Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.

    Build system: Fix link error with Clang/LLVM/LLD version 17. Patch courtesy of Yasuhiro Kimura.

    Fix alert-exceeds-max feature for files > 2GB and < max-filesize."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
2023-11-21 19:05:19 +00:00
Peter Müller
726c4b0f4a firewall: Reject outgoing TCP connections to port 25 by default
This will affect new IPFire installations only, implementing a
long-standing BCP for preemptively combating botnet spam. Reject is
chosen over drop to reduce the likelihood for confusion during network
troubleshooting.

Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Tested-by: Peter Müller <peter.mueller@ipfire.org>
2023-11-21 19:04:44 +00:00
Peter Müller
c434310d03 spectre-meltdown-checker: Update to 0.46
See https://github.com/speed47/spectre-meltdown-checker/releases/tag/v0.46
for this version's release notes.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-11-21 19:03:56 +00:00
Peter Müller
dfcdebc029 Core Update 182: Ship sqlite
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-11-21 19:03:38 +00:00
Adolf Belka
d7e237a4f5 sqlite: Update to version 3430100
- Update from version 3430000 to 3430100
- Update of rootfile not required
- Changelog
    3.34.1
	Fix a regression in the way that the sum(), avg(), and total() aggregate functions
	 handle infinities.
	Fix a bug in the json_array_length() function that occurs when the argument comes
	 directly from json_remove().
	Fix the omit-unused-subquery-columns optimization (introduced in in version 3.42.0)
	 so that it works correctly if the subquery is a compound where one arm is
	 DISTINCT and the other is not.
	Other minor fixes.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2023-11-21 19:03:27 +00:00
Peter Müller
307be8b016 Core Update 182: Ship qpdf
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-11-21 19:03:10 +00:00
Adolf Belka
4b64641b38 qpdf: Update to version 11.6.1
- Update from version 11.5.0 to 11.6.1
- Update of rootfile
- Changelog
    11.6.1: release
        * Fix a logic error introduced in 11.6.0 in the fix to
          copyForeignObject. The bug could result in some pages not being
          copied.
    11.6.0: release
        * ascii85 parser: ignore spaces everywhere including between ~
          and >. Fixes #973.
        * Bug fix: with --pages, if one of the external files had warnings
          but the main file did not, the warning was previously not taken
          into consideration when determining the exit status.
        * Put quotation marks around the command in completion output to
          better handle spaces in paths. It is not a perfect fix (ideally,
          full shell-compatible quoting should be used), but it handles more
          cases than the old code and should handle all reasonable cases of
          qpdf being in a directory with a space in its name, which is
          common in Windows. Fixes #1021.
        * Move check for random number device to runtime instead of
          compile time. Since, by default, the crypto provider provides
          random numbers, runtime determination of a random number device is
          usually not needed. Fixes #1022.
        * Maintain links to foreign pages when copying foreign objects.
          This allows hyperlinks in imported files to work. Fixes #1003.
        * Bug fix: Return a null object if an attempt is made to to copy a
          foreign /Pages object with copyForeignObject. This corrects a
          possible crash. Fixes #1010.
        * Bug fix: Return a null object if an attempt is made to to copy a
          foreign /Pages object with copyForeignObject. Fixes #1003.
        * Add /MediaBox to a page if absent. Thanks M. Holger.
        * Use std::vector internally for Pl_Buffer to
          avoid incompatibility with C++20. Thanks to Zoe Clifford. Fixes #1024.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2023-11-21 19:02:31 +00:00
Peter Müller
bde13ed56b Core Update 182: Ship jq
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-11-21 19:02:15 +00:00
Adolf Belka
f376da91aa jq: Update to version 1.7
- Update from version 1.6 to 1.7
- This project had little happen to it for 5 years but is now going again
   https://jqlang.github.io/jq/
- Update of rootfile
- Changelog
    1.7
	After a five year hiatus we're back with a GitHub organization, with new admins
         and new maintainers who have brought a great deal of energy to make a
         long-awaited and long-needed new release.  We're very grateful for all the new
         owners, admins, and maintainers.  Special thanks go to Owen Ou (@owenthereal)
         for pushing to set up a new GitHub organization for jq, Stephen Dolan (@stedolan)
         for transferring the jq repository to the new organization, @itchyny for doing a
         great deal of work to get the release done, Mattias Wadman (@wader) and Emanuele
         Torre (@emanuele6) for many PRs and code reviews.  Many others also contributed
         PRs, issues, and code reviews as well, and you can find their contributions in
         the Git log and on the [closed issues and PRs page]
         (https://github.com/jqlang/jq/issues?q=is%3Aclosed+sort%3Aupdated-desc).
	Since the last stable release many things have happened:
	- jq now lives at <https://github.com/jqlang>
	- New maintainers, admins, and owners have been recruited.
	  - A list of [current maintainers](https://github.com/jqlang/jq/blob/jq-1.7/AUTHORS#L4-L14)
	- NEWS file is replaced by NEWS.md with Markdown format. @wader #2599
	- CI, scan builds, release, website builds etc now use GitHub actions. @owenthereal @wader @itchyny #2596 #2603 #2620 #2723
	- Lots of documentation improvements and fixes.
	- Website updated with new section search box, better section ids for linking, dark mode, etc. @itchyny #2628
	- Release builds for:
	  - Linux `amd64`, `arm64`, `armel`, `armhf`, `i386`, `mips`, `mips64`, `mips64el`, `mips64r6`, `mips64r6el`, `mipsel`, `mipsr6`, `mipsr6el`, `powerpc`, `ppc64el`, `riscv64` and `s390x`
	  - macOS `amd64` and `arm64`
	  - Windows `i386` and `amd64`
	  - Docker `linux/386`, `linux/amd64`, `linux/arm64`, `linux/mips64le`, `linux/ppc64le`, `linux/riscv64` and `linux/s390x`
	  - More details see @owenthereal #2665
	- Docker images are now available from `ghcr.io/jqlang/jq` instead of Docker Hub. @itchyny #2652 #2686
	- OSS-fuzz. @DavidKorczynski #2760 #2762
	Full commit log can be found at <https://github.com/jqlang/jq/compare/jq-1.6...jq-1.7> but here are some highlights:
      CLI changes
	- Make object key color configurable using `JQ_COLORS` environment variable. @itchyny @haguenau @ericpruitt #2703
	- Change the default color of null to Bright Black. @itchyny #2824
	- Respect `NO_COLOR` environment variable to disable color output. See <https://no-color.org> for details. @itchyny #2728
	- Improved `--help` output. Now mentions all options and nicer order. @itchyny @wader #2747 #2766 #2799
	- Fix multiple issues of exit code using `--exit-code`/`-e` option. @ryo1kato #1697
	- Add `--binary`/`-b` on Windows for binary output. To get `\n` instead of `\r\n` line endings. @nicowilliams 0dab2b1
	- Add `--raw-output0` for NUL (zero byte) separated output. @asottile @pabs3 @itchyny #1990 #2235 #2684
	- Fix assert crash and validate JSON for `--jsonarg`. @wader #2658
	- Remove deprecated `--argfile` option. @itchyny #2768
	- Enable stack protection. @nicowilliams #2801
      Language changes
	- Use decimal number literals to preserve precision. Comparison operations respects precision but arithmetic operations might truncate. @leonid-s-usov #1752
	- Adds new builtin `pick(stream)` to emit a projection of the input object or array. @pkoppstein #2656 #2779
	- Adds new builtin `debug(msgs)` that works like `debug` but applies a filter on the input before writing to stderr. @pkoppstein #2710
	- Adds new builtin `scan($re; $flags)`. Was documented but not implemented. @itchyny #1961
	- Adds new builtin `abs` to get absolute value. This potentially allows the literal value of numbers to be preserved as `length` and `fabs` convert to float. @pkoppstein #2767
	- Allow `if` without `else`-branch. When skipped the `else`-branch will be `.` (identity). @chancez @wader #1825 #2481
	- Allow use of `$binding` as key in object literals. @nicowilliams 8ea4a55
	- Allow dot between chained indexes when using `.["index"]` @nicowilliams #1168
	- Allow dot for chained value iterator `.[]`, `.[]?` @wader #2650
	- Fix try/catch catches more than it should. @nicowilliams #2750
	- Speed up and refactor some builtins, also remove `scalars_or_empty/0`. @muhmuhten #1845
	- Now `halt` and `halt_error` exit immediately instead of continuing to the next input. @emanuele6 #2667
	- Fix issue converting string to number after previous convert error. @thalman #2400
	- Fix issue representing large numbers on some platforms causing invalid JSON output. @itchyny #2661
	- Fix deletion using assigning empty against arrays. @itchyny #2133
	- Allow keywords to be used as binding name in more places. @emanuele6 #2681
	- Allow using `nan` as NaN in JSON. @emanuele6 #2712
	- Expose a module's function names in `modulemeta`. @mrwilson #2837
	- Fix `contains/1` to handle strings with NUL. @nicowilliams 61cd6db
	- Fix `stderr/0` to output raw text without any decoration. @itchyny #2751
	- Fix `nth/2` to emit empty on index out of range. @itchyny #2674
	- Fix `implode` to not assert and instead replace invalid unicode codepoints. @wader #2646
	- Fix `indices/1` and `rindex/1` in case of overlapping matches in strings. @emanuele6 #2718
	- Fix `sub/3` to resolve issues involving global search-and-replace (gsub) operations. @pkoppstein #2641
	- Fix `significand/0`, `gamma/0` and `drem/2` to be available on macOS. @itchyny #2756 #2775
	- Fix empty regular expression matches. @itchyny #2677
	- Fix overflow exception of the modulo operator. @itchyny #2629
	- Fix string multiplication by 0 (and less than 1) to emit empty string. @itchyny #2142
	- Fix segfault when using libjq and threads. @thalman #2546
	- Fix constant folding of division and reminder with zero divisor. @itchyny #2797
	- Fix `error/0`, `error/1` to throw null error. @emanuele6 #2823
	- Simpler and faster `transpose`. @pkoppstein #2758
	- Simple and efficient implementation of `walk/1`. @pkoppstein #2795
	- Remove deprecated filters `leaf_paths`, `recurse_down`. @itchyny #2666

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2023-11-21 19:01:29 +00:00
Adolf Belka
b8894582a7 dbus: Update to version 1.14.10
- Update from version 1.14.6 to 1.14.10
- Update of rootfile
- Changelog
    dbus 1.14.10 (2023-09-01)
      Bug fixes:
	• Avoid a dbus-daemon crash if re-creating a connection's policy fails.
	  If it isn't possible to re-create its policy (for example if it belongs
	  to a user account that has been deleted or if the Name Service Switch is
	  broken, on a system not supporting SO_PEERGROUPS), we now log a warning,
	  continue to use its current policy, and continue to reload other
	  connections' policies. (dbus#343; Peter Benie, Simon McVittie)
	• If getting the groups from a user ID fails, report the error correctly,
	  instead of logging "(null)" (dbus#343, Simon McVittie)
	• Return the primary group ID in GetConnectionCredentials()' UnixGroupIDs
	  field for processes with a valid-but-empty supplementary group list
	  (dbus!422, cptpcrd)
    dbus 1.14.8 (2023-06-06)
      Denial-of-service fixes:
	• Fix an assertion failure in dbus-daemon when a privileged Monitoring
	  connection (dbus-monitor, busctl monitor, gdbus monitor or similar)
	  is active, and a message from the bus driver cannot be delivered to a
	  client connection due to <deny> rules or outgoing message quota. This
	  is a denial of service if triggered maliciously by a local attacker.
	  (dbus#457; hongjinghao, Simon McVittie)
      Other fixes:
	• Fix compilation on compilers not supporting __FUNCTION__
	  (dbus!404, Barnabás Pőcze)
	• Fix some memory leaks on out-of-memory conditions
	  (dbus!403, Barnabás Pőcze)
	• Documentation:
	  · Fix syntax of a code sample in dbus-api-design
	    (dbus!396; Yen-Chin, Lee)
      Tests and CI enhancements:
	• Fix CI pipelines after freedesktop/freedesktop#540
	  (dbus!405, dbus#456; Simon McVittie)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2023-11-21 19:01:09 +00:00
Adolf Belka
270a3c534d alsa: Update to version 1.2.10
- Update alsa-lib, alsa-utils & alsa-ucn-conf from version 1.2.9 to 1.2.10
- Update of rootfile
- Changelog is too large to include here. Details can be found at
   https://www.alsa-project.org/wiki/Changes_v1.2.9_v1.2.10

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2023-11-21 19:00:55 +00:00
Peter Müller
1d552885c7 Start Core Update 182
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-11-21 18:59:47 +00:00
Michael Tremer
81b3cf237c core181: Package the correct udev files for riscv64
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-11-03 14:28:19 +00:00
Arne Fitzenreiter
8a37e7f0e3 kernel: update to 6.1.61
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-11-03 14:27:58 +00:00
Michael Tremer
d0b43f4cc4 udev: Update riscv64 rootfile
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-11-01 10:43:34 +00:00
Robin Roevens
19614961b6 zabbix_agentd: Fix ipfire.net.gateway.ping
Fixes custom IPFire Zabbix Agent userparameter ipfire.net.gateway.ping
returning 1 (success) when fping failed for other reasons (rc 2,3 or 4)
than host unreachable (rc 0).

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-30 10:04:03 +00:00
Robin Roevens
d17d26d7e5 zabbix_agentd: Update to 6.0.22 (LTS)
- Update from version 6.0.21 to 6.0.22
- Update of rootfile not required

Bugs fixed:
- ZBX-23417: Fixed possible memory leak when checking modbus.get[] item
New Features and Improvements:
- ZBXNEXT-6554:	Increased remote command execution limits to 16MB

Full changelogs since 6.0.21:
- https://www.zabbix.com/rn/rn6.0.22

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-30 10:04:03 +00:00
Michael Tremer
775a1055a5 core181: Remove old udev files
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-30 09:59:19 +00:00
Stefan Schantl
b68136940a make.sh: Adjust build order to proper build udev (systemd)
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-30 09:53:48 +00:00
Stefan Schantl
e174a9594b udev: Switch to udev from systemd
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-30 09:53:48 +00:00
Stefan Schantl
c6b5e0cfe2 python3-Jinja2: New package
This is a build dependency of udev (systemd)

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-30 09:53:48 +00:00
Stefan Schantl
e6453de73e python3-MarkupSafe: New package
This is a build dependency for udev (systemd)

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-30 09:53:48 +00:00
Peter Müller
4d14892646 linux: Update x86_64 rootfile
My fault to provide this ahead of time, again. :-/

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-10-30 06:44:50 +00:00
Arne Fitzenreiter
1d1694c7e5 kernel: update aarch64 rootfile
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-27 08:43:41 +00:00
Arne Fitzenreiter
cfe911bab5 kernel: update to 6.1.60
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-27 08:43:35 +00:00
Michael Tremer
026eafd586 core181: Ship OpenSSL
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-26 08:57:31 +00:00
Michael Tremer
6fa97f2c97 openssl: Update to 3.1.4
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-26 08:57:20 +00:00
Arne Fitzenreiter
cce398bca5 kernel: update to 6.1.59
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-25 11:01:30 +00:00
Arne Fitzenreiter
2b834ef42a kernel: update to 6.1.58
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-25 11:01:30 +00:00
Michael Tremer
2cfcb06430 samba: Update rootfile on aarch64 + riscv64
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-25 10:59:38 +00:00
Peter Müller
7f8b75f8ba linux: Set default IOMMU handling to "strict" on 64-bit ARM
This has been our default setting on x86_64 for quite some time now,
which is why this patch aligns the aarch64 kernel configuration to that
value.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-20 08:44:26 +00:00
Peter Müller
447d0bf51e linux: Disable io_uring
This subsystem has been a frequent source of security vulnerabilities
affecting the Linux kernel; as a result, Google announced on June 14,
2023, that they would disable it in their environment as widely as
possible.

IPFire does not depend on the availability of io_uring. Therefore,
disable this subsystem as well in order to preemptively cut attack
surface.

See also: https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.html

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-20 08:44:26 +00:00
Matthias Fischer
bf85d30b58 suricata: Update to 6.0.15
Excerpt from changelog:

"6.0.15 -- 2023-10-18

Security #6363: mime: quadratic complexity in MimeDecAddEntity (6.0.x backport)
Bug #6407: email: disabled fields in suricata.yaml also get logged (6.0.x backport)
Bug #6403: detect: multi-level tunneling inspection fails (6.0.x backport)
Bug #6377: byte_jump with negative post_offset before start of buffer failure (6.0.x backport)
Task #6364: decode: add drop reason for stream reassembly memcap (6.0.x backport)"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-20 08:44:02 +00:00
Michael Tremer
7a6cf8276d core181: Ship apache2
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-20 08:43:07 +00:00
Matthias Fischer
5049433d91 apache: Update to 2.4.58
For details see:
https://dlcdn.apache.org/httpd/CHANGES_2.4.58

Excerpt from changelog:
"Changes with Apache 2.4.58

  *) SECURITY: CVE-2023-45802: Apache HTTP Server: HTTP/2 stream
     memory not reclaimed right away on RST (cve.mitre.org)
     When a HTTP/2 stream was reset (RST frame) by a client, there
     was a time window were the request's memory resources were not
     reclaimed immediately. Instead, de-allocation was deferred to
     connection close. A client could send new requests and resets,
     keeping the connection busy and open and causing the memory
     footprint to keep on growing. On connection close, all resources
     were reclaimed, but the process might run out of memory before
     that.
     This was found by the reporter during testing of CVE-2023-44487
     (HTTP/2 Rapid Reset Exploit) with their own test client. During
     "normal" HTTP/2 use, the probability to hit this bug is very
     low. The kept memory would not become noticeable before the
     connection closes or times out.
     Users are recommended to upgrade to version 2.4.58, which fixes
     the issue.
     Credits: Will Dormann of Vul Labs

  *) SECURITY: CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with
     initial windows size 0 (cve.mitre.org)
     An attacker, opening a HTTP/2 connection with an initial window
     size of 0, was able to block handling of that connection
     indefinitely in Apache HTTP Server. This could be used to
     exhaust worker resources in the server, similar to the well
     known "slow loris" attack pattern.
     This has been fixed in version 2.4.58, so that such connection
     are terminated properly after the configured connection timeout.
     This issue affects Apache HTTP Server: from 2.4.55 through
     2.4.57.
     Users are recommended to upgrade to version 2.4.58, which fixes
     the issue.
     Credits: Prof. Sven Dietrich (City University of New York)

  *) SECURITY: CVE-2023-31122: mod_macro buffer over-read
     (cve.mitre.org)
     Out-of-bounds Read vulnerability in mod_macro of Apache HTTP
     Server.This issue affects Apache HTTP Server: through 2.4.57.
     Credits: David Shoon (github/davidshoon)"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-20 08:42:05 +00:00
Matthias Fischer
e1a68c27a0 samba: Update to 4.19.2
For details see:

v4.19.1. => https://www.samba.org/samba/history/samba-4.19.1.html
"
                  ==============================
                  Release Notes for Samba 4.19.1
                  October 10, 2023
                  ==============================

This is a security release in order to address the following defects:

o CVE-2023-3961:  Unsanitized pipe names allow SMB clients to connect as root to
                  existing unix domain sockets on the file system.
                  https://www.samba.org/samba/security/CVE-2023-3961.html

o CVE-2023-4091:  SMB client can truncate files to 0 bytes by opening files with
                  OVERWRITE disposition when using the acl_xattr Samba VFS
                  module with the smb.conf setting
                  "acl_xattr:ignore system acls = yes"
                  https://www.samba.org/samba/security/CVE-2023-4091.html

o CVE-2023-4154:  An RODC and a user with the GET_CHANGES right can view all
                  attributes, including secrets and passwords.  Additionally,
                  the access check fails open on error conditions.
                  https://www.samba.org/samba/security/CVE-2023-4154.html

o CVE-2023-42669: Calls to the rpcecho server on the AD DC can request that the
                  server block for a user-defined amount of time, denying
                  service.
                  https://www.samba.org/samba/security/CVE-2023-42669.html

o CVE-2023-42670: Samba can be made to start multiple incompatible RPC
                  listeners, disrupting service on the AD DC.
                  https://www.samba.org/samba/security/CVE-2023-42670.html"

v4.19.2 => https://www.samba.org/samba/history/samba-4.19.2.html
"Changes since 4.19.1
--------------------

o  Jeremy Allison <jra@samba.org>
   * BUG 15423: Use-after-free in aio_del_req_from_fsp during smbd shutdown
     after failed IPC FSCTL_PIPE_TRANSCEIVE.
   * BUG 15426: clidfs.c do_connect() missing a "return" after a cli_shutdown()
     call.

o  Ralph Boehme <slow@samba.org>
   * BUG 15463: macOS mdfind returns only 50 results.

o  Volker Lendecke <vl@samba.org>
   * BUG 15481: GETREALFILENAME_CACHE can modify incoming new filename with
     previous cache entry value.

o  Stefan Metzmacher <metze@samba.org>
   * BUG 15464: libnss_winbind causes memory corruption since samba-4.18,
     impacts sendmail, zabbix, potentially more.

o  Martin Schwenke <mschwenke@ddn.com>
   * BUG 15479: ctdbd: setproctitle not initialized messages flooding logs.

o  Joseph Sutton <josephsutton@catalyst.net.nz>
   * BUG 15491: CVE-2023-5568 Heap buffer overflow with freshness tokens in the
     Heimdal KDC in Samba 4.19
   * BUG 15477: The heimdal KDC doesn't detect s4u2self correctly when fast is
     in use."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-20 08:41:59 +00:00
Adolf Belka
37678a4f82 en.pl: Correction of typo
- This error means that a section in extrahd.cgi about the mount path being incorrect
   does not get shown for users with english language selected.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: bbitsch@ipfire.org
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-20 08:41:46 +00:00
Michael Tremer
d03f03e24c core181: Ship backup.pl
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-20 08:41:35 +00:00
Adolf Belka
3f18addede backup.pl: Fix for bug#11048 - add script for adding pass/no pass to ovpnconfig from backup
- A script was added to the update.sh script to add pass/no pass to the ovpnconfig entries
   but I forgot that this was also needed in the backup.pl file to add those statuses into
   any ovpnconfig file restored from a backup before the pass/no pass entries were added.
- This patch corrects that oversight.
- Confirmed by testing on my vm. Before the script added to backup.pl a restore of older
   ovpnconfig ended up not showing any icons or status elements. With the script in
   backup.pl confirmed that the restored ovpnconfig showed up in the WUI page correctly
   with the right icons and with the status elements correctly displayed.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-20 08:41:01 +00:00
Arne Fitzenreiter
6c829050c8 dnsdist: disabled on riscv64 again
dnsdist build on my builder fine but it fails on the buildserver
via qemu-user.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-13 08:13:16 +00:00
Arne Fitzenreiter
554e339b9e kernel: update to 6.1.57
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-13 08:13:12 +00:00
Peter Müller
41ac2cd531 Tor: Update to 0.4.8.7
Changes in version 0.4.8.7 - 2023-09-25
  This version fixes a single major bug in the Conflux subsystem on the client
  side. See below for more information. The upcoming Tor Browser 13 stable will
  pick this up.

  o Major bugfixes (conflux):
    - Fix an issue that prevented us from pre-building more conflux sets
      after existing sets had been used. Fixes bug 40862; bugfix
      on 0.4.8.1-alpha.

  o Minor features (fallbackdir):
    - Regenerate fallback directories generated on September 25, 2023.

  o Minor features (geoip data):
    - Update the geoip files to match the IPFire Location Database, as
      retrieved on 2023/09/25.

Changes in version 0.4.8.6 - 2023-09-18
  This version contains an important fix for onion service regarding congestion
  control and its reliability. Apart from that, uneeded BUG warnings have been
  suppressed especially about a compression bomb seen on relays. We strongly
  recommend, in particular onion service operators, to upgrade as soon as
  possible to this latest stable.

  o Major bugfixes (onion service):
    - Fix a reliability issue where services were expiring their
      introduction points every consensus update. This caused
      connectivity issues for clients caching the old descriptor and
      intro points. Bug reported and fixed by gitlab user
      @hyunsoo.kim676. Fixes bug 40858; bugfix on 0.4.7.5-alpha.

  o Minor features (debugging, compression):
    - Log the input and output buffer sizes when we detect a potential
      compression bomb. Diagnostic for ticket 40739.

  o Minor features (fallbackdir):
    - Regenerate fallback directories generated on September 18, 2023.

  o Minor features (geoip data):
    - Update the geoip files to match the IPFire Location Database, as
      retrieved on 2023/09/18.

  o Minor bugfix (defensive programming):
    - Disable multiple BUG warnings of a missing relay identity key when
      starting an instance of Tor compiled without relay support. Fixes
      bug 40848; bugfix on 0.4.3.1-alpha.

  o Minor bugfixes (bridge authority):
    - When reporting a pseudo-networkstatus as a bridge authority, or
      answering "ns/purpose/*" controller requests, include accurate
      published-on dates from our list of router descriptors. Fixes bug
      40855; bugfix on 0.4.8.1-alpha.

  o Minor bugfixes (compression, zstd):
    - Use less frightening language and lower the log-level of our run-
      time ABI compatibility check message in our Zstd compression
      subsystem. Fixes bug 40815; bugfix on 0.4.3.1-alpha.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-13 08:12:54 +00:00
Michael Tremer
82551c04d2 core181: Ship cURL
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-11 07:50:32 +00:00
Michael Tremer
0f7cdd7661 Merge branch 'master' into next 2023-10-11 07:50:21 +00:00
Michael Tremer
a85e9d4eb1 core180: Ship cURL
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-11 07:48:53 +00:00
Michael Tremer
c48872ef76 curl: Fix CVE-2023-38545
https://curl.se/docs/CVE-2023-38545.html

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-11 07:47:47 +00:00
Michael Tremer
4bcceb83f9 core181: Ship udev
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-09 08:18:43 +00:00
Michael Tremer
97bbd49a70 core181: Ship sysvinit
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-09 08:17:48 +00:00
Adolf Belka
ebcfcd1003 udev: Update to version 3.2.14
- Update from version 3.2.12 to 3.2.14
- Update of rootfile not required
- This version update includes the patches previously used to add the dummies for tags
   and to update to udev version 251 which is bugfix #253
- Changelog
    3.2.14
	    Clear sysattr cache if a null pointer is passed by @NaofumiHonda in #255
	    Add /usr/local/lib/udev/rules.d by @bbonev in #260
	    Fix := not preventing further assignments to RUN by @bbonev in #257
	    Let libudev find hwdb.bin under UDEV_HWDB_BIN by
	     @vivien-consider-dropping-github in #264
	    Add a generic --output argument to udevadm hwdb by
	     @vivien-consider-dropping-github in #263
	    Dynamically get the udevadm hwdb files with a path variable by
	     @vivien-consider-dropping-github in #262
	    More wording fixes for the manual page for udev by
	     @vivien-consider-dropping-github in #265
	    Add missing API from 247 by @bbonev in #253
	    Ensure that standard file descriptors are open by @bbonev in #266

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-09 08:17:26 +00:00
Adolf Belka
375d921d00 sysvinit: Update to version 3.08
- Update from version 3.00 to 3.08
- Update of rootfile
- All the other patches and sed modifications are now built mintyo the source tarball,
   except for the mountpoint patch which is stilol needed
- Changelog
    3.08
	This release focuses on three changes which are basically imports of patches from Gentoo. Special thanks to floppym for supplying these.
	    Applied a patch from floppm which adds kexec option to the halt command. This can be used as "halt -k".
	    floppym provided patch which causes the halt command to call "shutdown -h -H" instead of "shutdown -h" when halt is invoked without parameters. This forces the shutdown command to set the INIT_HALT variable and assume, unless other conditions apply, that the "halt" call really wants to halt the machine and INIT_HALT should be set. In other words we assume halt wants to halt unless told otherwise.
	     Addresses downstream Gentoo bug ID 911257.
	    Updated halt documentation and help output to display parameters in alphabetical order.
    3.07
	The 3.07 release of SysV init mostly introduces fixes and improvements for the
	 killall5 and pidof programs. (These are actually the same program, but are
	 invoked with two different names, which result in different behaviour. The main
	 highlights in this release are:
		Fixed killall5 so that processes in the omit list are not sent any
		 signals, including SIGSTOP.
		Fixed usage message for killall5 to be more accurate.
		pidof was not returning PIDs of programs which were launched using a
		 symbolic link. This has been fixed so programs run from a symbolic link
		 show up in process lists.
    3.06
	    Mark Hindley fixed typo in es.po
	    Mark Hindley cleaned up translation code in src/Makefile.
	    Drop sulogin from Debian build. Removed libcrypt-dev dependency.
	    Fixed pt translation pages which were failing due to mis-matched open/close
	     tags.
	    Makefile now respects ROOT prefix when setting up pidof-to-killall5 symbolic
	     link.
	    Removed redundant translation files from man directory.
	    Makefile now respects DESTDIR. User can specify either ROOT= or DESTDIR= to
	     set install prefix.
    3.05
	This release (3.05) focuses on two things:
	    Updating the translation framework.
	    Fixing compiling issues on various systems.
	The second point, compiling, encompasses a few minor changes to get SysV init to
	 build properly on GNU Hurd, systems without certain GNU assumptions, and systems
	 running the latest glibc library (2.36 at time of writing).
    3.04
	This release contains one minor fix which allows the bootlogd code to properly
	 compile on Debian's GNU Hurd branch.
    3.03
	This release includes two minor changes. One is fixing a typo in the init manual
	 page (init.8). this fix was offered by Mark hindley.
	Mark, and a few other people, also pointed out that a fix in 3.02 for bootlogd
	 introduced reliance on a defined PATH_MAX constant. This is used elsewhere in
	 the code, but is not explicitly defined in bootlogd, which caused bootlogd to
	 not build properly on GNU Hurd and musl C systems. This has been fixed.
    3.02
	    Added q and Q flags to synopsis in shutdown manual page.
	    Applied fixes for markup and spacing in manual pages.
	     Patch provided by Mario Blattermann.
	    Added translation framework (po4a) from Mario Blttermann.
	    Added Makefile for man/ directory. Will handle translations
	     and substitutions.
	    Applied new translations for multiple languages from Mario Blattermann.
	    Added ability to use "@" symbol in command named in the inittab file. This
	     treats commands as literal and does not launch a shell to interpret them.
	    Updated inittab manual page to include overview of symbols which trigger
	     a shell interpretor and how to disable them using the @ symbol.
	    Introduced change which adds error checking in bootlogd when performing
	     chdir(). - Provided by Alexander Vickberg
	    Add check for console using TIOCGDEV on Linux systems in bootlogd to
	     make finding console more robust. - Provided by Alexander Vickberg
    3.01
	    Default to showing processes in the uninterruptable state (D).
	     The -z flag no longer affects whether processes in D state are shown.
	     The -z flag does still toggle whether zombie (Z) processes are shown.
	    Removed unnecessary check which is always true from init tab parsing.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-10-09 08:17:23 +00:00