Commit Graph

21367 Commits

Author SHA1 Message Date
Michael Tremer
e95d12e5ee core184: Ship lzip
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-01 16:09:02 +00:00
Adolf Belka
f7520e0add lzip: Update to version 1.24
- Update from version 1.23 to 1.24
- Update of rootfile not required
- Changelog
    1.24
	The option '--empty-error', which forces exit status 2 if any empty member
	  is found, has been added.
	The option '--marking-error', which forces exit status 2 if the first LZMA
	  byte is non-zero in any member, has been added.
	File diagnostics have been reformatted as 'PROGRAM: FILE: MESSAGE'.
	Diagnostics caused by invalid arguments to command-line options now show the
	  argument and the name of the option.
	The option '-o, --output' now preserves dates, permissions, and ownership of
	  the file when (de)compressing exactly one file.
	The option '-o, --output' now creates missing intermediate directories when
	  writing to a file.
	The variable MAKEINFO has been added to configure and Makefile.in.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-01 16:08:42 +00:00
Michael Tremer
7de5c351b5 core184: Ship gettext
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-01 16:07:39 +00:00
Adolf Belka
64aa5bf53e gettext: Update to version 0.22.4
- Update from version 0.22 to 0.22.4
- Update of rootfile
- Changelog
    0.22.4
	* Bug fixes:
	  - AM_GNU_GETTEXT now recognizes a statically built libintl on macOS and AIX.
	  - Build fixes on AIX.
    0.22.3
	* Portability:
	  - The libintl library now works on macOS 14.  (Older versions of libintl
	    crash on macOS 14, due to an incompatible change in macOS.)
    0.22.2
	* Bug fixes:
	  - The libintl shared library now exports again some symbols that were
	    accidentally missing.
	    <https://savannah.gnu.org/bugs/index.php?64323>
	    This bug was introduced in version 0.22.
    0.22.1
	* Bug fixes:
	  - xgettext's processing of large Perl files may have led to errors
	    <https://savannah.gnu.org/bugs/index.php?64552>
	  - "xgettext --join-existing" could encounter errors.
	    <https://savannah.gnu.org/bugs/index.php?64490>
	  These bugs were introduced in version 0.22.
	* Portability:
	  - Building on Android is now supported.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-01 16:07:15 +00:00
Michael Tremer
2b2453568d core184: Ship ed
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-01 16:07:01 +00:00
Adolf Belka
da63a6cc46 ed: Update to version 1.20
- Update from version 1.19 to 1.20
- Update of rootfile not required
- Changelog
    1.20
	New command-line options '+line', '+/RE', and '+?RE' have been implemented to
	  set the current line to the line number specified or to the first or last line
	  matching the regular expression 'RE'.
	  (Suggested by Matthew Polk and John Cowan).
	File names containing control characters 1 to 31 are now rejected unless they
	  are allowed with the command-line option '--unsafe-names'.
	File names containing control characters 1 to 31 are now printed using octal
	  escape sequences.
	Ed now rejects file names ending with a slash.
	Intervening commands that don't set the modified flag no longer make a second
	  'e' or 'q' command fail with a 'buffer modified' warning.
	Tilde expansion is now performed on file names supplied to commands; if a file
	  name starts with '~/', the tilde (~) is expanded to the contents of the
	  variable HOME. (Suggested by John Cowan).
	Ed now warns the first time that a command modifies a buffer loaded from a
	  read-only file. (Suggested by Dan Jacobson).
	Ed now creates missing intermediate directories when writing to a file.
	It has been documented that 'e' creates an empty buffer if file does not exist.
	It has been documented that 'f' sets the default filename, whether or not its
	  argument names an existing file.
	The description of the exit status has been improved in '--help' and in the
	  manual.
	The variable MAKEINFO has been added to configure and Makefile.in.
	It has been documented in INSTALL that when choosing a C standard, the POSIX
	  features need to be enabled explicitly:
	   ./configure CFLAGS+='--std=c99 -D_POSIX_C_SOURCE=2'

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-01 16:06:40 +00:00
Michael Tremer
4975883833 core184: Ship diffutils
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-01 16:06:10 +00:00
Adolf Belka
fa96ada3a2 diffutils: Update to version 3.10
- Update from version 3.9 to 3.10
- Update of rootfile not required
- Changelog
    3.10
	Bug fixes
	  cmp/diff can again work with file dates past Y2K38
	   [bug introduced in 3.9]
	  diff -D no longer fails to output #ifndef lines.
	   [bug#61193 introduced in 3.9]

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-02-01 16:05:44 +00:00
Arne Fitzenreiter
88b6ad8112 mympd: create/check config before first start
this create missing folders for webradio and state.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
2024-01-31 21:09:14 +01:00
Adolf Belka
72a5fff634 sqlite: Update to version 3450100
- Update from version 3450000 to 3450100
- Update of rootfile not required
- Changelog
    3.45.1
	Restore the JSON BLOB input bug, and promise to support the anomaly in subsequent
	 releases, for backward compatibility.
	Fix the PRAGMA integrity_check command so that it works on read-only databases
	 that contain FTS3 and FTS5 tables. This resolves an issue introduced in version
	 3.44.0 but was undiscovered until after the 3.45.0 release.
	Fix issues associated with processing corrupt JSONB inputs:
	    Prevent exponential runtime when converting a corrupt JSONB into text.
	    Fix a possible read of one byte past the end of the JSONB blob when
	     converting a corrupt JSONB into text.
	    Enhanced testing using jfuzz to prevent any future JSONB problems such as the
	     above.
	Fix a long-standing bug in which a read of a few bytes past the end of a
	 memory-mapped segment might occur when accessing a craftily corrupted database
	 using memory-mapped database.
	Fix a long-standing bug in which a NULL pointer dereference might occur in the
	 bytecode engine due to incorrect bytecode being generated for a class of SQL
	 statements that are deliberately designed to stress the query planner but which
	 are otherwise pointless.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 17:06:43 +00:00
Michael Tremer
08fb3034d0 core184: Ship readline
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 17:06:33 +00:00
Adolf Belka
e9ba050b69 readline: Update patches to patch 1 to patch 10
- Update from version 8.2 with patch 1 to 8.2 with patches 1 to 10
- Update of rootfile not required
- Changelog
    Patch 10
	Fix the case where text to be completed from the line buffer (quoted) is
	compared to the common prefix of the possible matches (unquoted) and the
	quoting makes the former appear to be longer than the latter. Readline
	assumes the match doesn't add any characters to the word and doesn't display
	multiple matches.
    Patch 9
	Fix issue where the directory name portion of the word to be completed (the
	part that is passed to opendir()) requires both tilde expansion and dequoting.
	Readline only performed tilde expansion in this case, so filename completion
	would fail.
    Patch 8
	Add missing prototypes for several function declarations.
    Patch 7
	If readline is called with no prompt, it should display a newline if return
	is typed on an empty line. It should still suppress the final newline if
	return is typed on the last (empty) line of a multi-line command.
    Patch 6
	This is a variant of the same issue as the one fixed by patch 5. In this
	case, the signal arrives and is pending before readline calls rl_getc().
	When this happens, the pending signal will be handled by the loop, but may
	alter or destroy some state that the callback uses. Readline needs to treat
	this case the same way it would if a signal interrupts pselect/select, so
	compound operations like searches and reading numeric arguments get cleaned
	up properly.
    Patch 5
	If an application is using readline in callback mode, and a signal arrives
	after readline checks for it in rl_callback_read_char() but before it
	restores the application's signal handlers, it won't get processed until the
	next time the application calls rl_callback_read_char(). Readline needs to
	check for and resend any pending signals after restoring the application's
	signal handlers.
    Patch 4
	There are systems that supply one of select or pselect, but not both.
    Patch 3
	The custom color prefix that readline uses to color possible completions
	must have a leading `.'.
    Patch 2
	It's possible for readline to try to zero out a line that's not null-
	terminated, leading to a memory fault.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 17:06:19 +00:00
Michael Tremer
c749cee1e5 core184: Ship iana-etc
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 17:06:09 +00:00
Adolf Belka
622c9fe03f iana-etc: Update to version 20240125
- Update from version 20231026 to 20240125
- Update of rootfile not required
- Changelog - update of iana-etc files

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 17:05:56 +00:00
Adolf Belka
9d6db385d7 help2man: Update to version 1.49.3
- Update from version 1.49.2 to 1.49.3
- Update of rootfile not required
- Changelog
    1.49.3
	  * Cleanup whitespace in po-texi/help2man-texi.pot.
	  * Add Korean translation (thanks to Seong-ho Cho).

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 17:05:40 +00:00
Michael Tremer
43894a9bab core184: Ship file
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 17:05:30 +00:00
Adolf Belka
5aba1a15f7 file: Update to version 5.45
- Update from version 5.44 to 5.45
- Update of rootfile not required
- Changelog
    5.45
	* PR/465: psrok1: Avoid muslc asctime_r crash
	* add SIMH tape format support
	* bump the max size of the elf section notes to be read to 128K
	  and make it configurable
	* PR/415: Fix decompression with program returning empty
	* PR/408: fix -p with seccomp
	* PR/412: fix MinGW compilation

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 17:04:48 +00:00
Michael Tremer
2240d08312 core184: Ship updated glibc
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 11:11:41 +00:00
Michael Tremer
a61a21ef75 glibc: Import latest patches from upstream
These include (amongst others) fixes for:

GLIBC-SA-2024-0001:
===================
syslog: Heap buffer overflow in __vsyslog_internal (CVE-2023-6246)

__vsyslog_internal did not handle a case where printing a SYSLOG_HEADER
containing a long program name failed to update the required buffer
size, leading to the allocation and overflow of a too-small buffer on
the heap.

GLIBC-SA-2024-0002:
===================
syslog: Heap buffer overflow in __vsyslog_internal (CVE-2023-6779)

__vsyslog_internal used the return value of snprintf/vsnprintf to
calculate buffer sizes for memory allocation.  If these functions (for
any reason) failed and returned -1, the resulting buffer would be too
small to hold output.

GLIBC-SA-2024-0003:
===================
syslog: Integer overflow in __vsyslog_internal (CVE-2023-6780)

__vsyslog_internal calculated a buffer size by adding two integers, but
did not first check if the addition would overflow.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 11:09:41 +00:00
Michael Tremer
eadffeb43f core184: Ship updated collectd init script
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:30:47 +00:00
Michael Tremer
500b6311b4 collectd: Do not sync
Calling a global sync operation manually is generally a bad idea as it
can block for forever. If people have storage that does not retain
anything that is being written to it, they need to fix their hardware.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:30:27 +00:00
Michael Tremer
c1d60341d5 core184: Ship zlib
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:30:01 +00:00
Adolf Belka
91ddb27aa1 zlib: Update to version 1.3.1
- Update from version 1.3 to 1.3.1
- Update of rootfile
- Changelog
    1.3.1
	- Reject overflows of zip header fields in minizip
	- Fix bug in inflateSync() for data held in bit buffer
	- Add LIT_MEM define to use more memory for a small deflate speedup
	- Fix decision on the emission of Zip64 end records in minizip
	- Add bounds checking to ERR_MSG() macro, used by zError()
	- Neutralize zip file traversal attacks in miniunz
	- Fix a bug in ZLIB_DEBUG compiles in check_match()
	- Various portability and appearance improvements

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:29:47 +00:00
Michael Tremer
45d5af80a2 core184: Ship xz
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:29:31 +00:00
Adolf Belka
aff5c27567 xz: Update to version 5.4.6
- Update from version 5.4.5 to 5.4.6
- Update of rootfile
- Changelog
    5.4.6
	    * Fixed a bug involving internal function pointers in liblzma not
	      being initialized to NULL. The bug can only be triggered if
	      lzma_filters_update() is called on a LZMA1 encoder, so it does
	      not affect xz or any application known to us that uses liblzma.
	    * xz:
	        - Fixed a regression introduced in 5.4.2 that caused encoding
	          in the raw format to unnecessarily fail if --suffix was not
	          used. For instance, the following command no longer reports
	          that --suffix must be used:
	              echo foo | xz --format=raw --lzma2 | wc -c
	        - Fixed an issue on MinGW-w64 builds that prevented reading
	          from or writing to non-terminal character devices like NUL.
	    * Added a new test.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:29:13 +00:00
Michael Tremer
b26696ebdf core184: Ship libpng
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:28:48 +00:00
Adolf Belka
8066b4773b libpng: Update to version 1.6.41
- Update from 1.6.39 to 1.6.41
- Update of rootfile
- Changelog
    1.6.41
	  Added SIMD-optimized code for the Loongarch LSX hardware.
	    (Contributed by GuXiWei, JinBo and ZhangLixia)
	  Fixed the run-time discovery of MIPS MSA hardware.
	    (Contributed by Sui Jingfeng)
	  Fixed an off-by-one error in the function `png_do_check_palette_indexes`,
	    which failed to recognize errors that might have existed in the first
	    column of a broken palette-encoded image. This was a benign regression
	    accidentally introduced in libpng-1.6.33. No pixel was harmed.
	    (Contributed by Adam Richter; reviewed by John Bowler)
	  Fixed, improved and modernized the contrib/pngminus programs, i.e.,
	    png2pnm.c and pnm2png.c
	  Removed old and peculiar portability hacks that were meant to silence
	    warnings issued by gcc version 7.1 alone.
	    (Contributed by John Bowler)
	  Fixed and modernized the CMake file, and raised the minimum required
	    CMake version from 3.1 to 3.6.
	    (Contributed by Clinton Ingram, Timothy Lyanguzov, Tyler Kropp, et al.)
	  Allowed the configure script to disable the building of auxiliary tools
	    and tests, thus catching up with the CMake file.
	    (Contributed by Carlo Bramini)
	  Fixed a build issue on Mac.
	    (Contributed by Zixu Wang)
	  Moved the Autoconf macro files to scripts/autoconf.
	  Moved the CMake files (except for the main CMakeLists.txt) to
	    scripts/cmake and moved the list of their contributing authors to
	    scripts/cmake/AUTHORS.md
	  Updated the CI configurations and scripts.
	  Relicensed the CI scripts to the MIT License.
	  Improved the test coverage.
	    (Contributed by John Bowler)
    1.6.40
	  Fixed the eXIf chunk multiplicity checks.
	  Fixed a memory leak in pCAL processing.
	  Corrected the validity report about tRNS inside png_get_valid().
	  Fixed various build issues on *BSD, Mac and Windows.
	  Updated the configurations and the scripts for continuous integration.
	  Cleaned up the code, the build scripts, and the documentation.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:28:33 +00:00
Michael Tremer
4acdd39e35 core184: Ship bash
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:27:55 +00:00
Adolf Belka
85db98e919 bash: Update to include patches 22 to 26
- Update from version 5.2 with patches 1 to 21 to 5.2 with patches 1 to 26
- Update of rootfile not required
- Changelog
    Patch 26
	The custom color prefix that readline uses to color possible completions
	 must have a leading `.'.
    Patch 25
	Make sure a subshell checks for and handles any terminating signals before
	 exiting (which might have arrived after the command completed) so the parent
	 and any EXIT trap will see the correct value for $?.
    Patch 24
	Fix bug where associative array compound assignment would not expand tildes
	 in values.
    Patch 23
	Running `local -' multiple times in a shell function would overwrite the
	 original saved set of options.
    Patch 22
	It's possible for readline to try to zero out a line that's not null-
	 terminated, leading to a memory fault.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:27:43 +00:00
Michael Tremer
b9fb3495a8 core184: Ship acl
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:27:30 +00:00
Adolf Belka
f5000d47b7 acl: Update to version 2.3.2
- Update from version 2.3.1 to 2.3.2
- Update of rootfile
- Changelog is only available from reviewing the git commits
   https://git.savannah.nongnu.org/cgit/acl.git/log/

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-31 10:27:12 +00:00
Michael Tremer
0742f6eda5 core184: Ship vnstat
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-30 17:51:11 +00:00
Matthias Fischer
353e7b95be vnstat: Update to 2.12
For details see:
https://humdi.net/vnstat/CHANGES

"2.12 / 21-Jan-2024

 - Fixed
   - QueryMode documentation in configuration file didn't match implementation
     or man page description
   - Daemon didn't try to import legacy databases when --noadd was used and no
     current version database initially existed resulting in the process
     exiting even when something could have been done
   - Daemon didn't try to import legacy databases when --initdb was used and
     no current version database initially existed, this behaviour can still
     be enabled by using --noadd in combination with --initdb
   - Using --nodaemon and --initdb at the same time didn't result in an error
     being shown
 - New
   - Add 95th percentile output as --95th, also available via --alert, --json,
     --xml and image output, requires 5MinuteHours configuration to be set to
     at least 744 for storing all the necessary data
   - Add --json support for --alert
   - Database queries resulting in error exit with status 1
   - Show spinning animation at the beginning of -l / --live output line,
     visibility configurable using LiveSpinner configuration option
   - Add -ic / --invert-colors option to image output for facilitating for
     example dark mode switching without needing to have multiple separate
     color configurations
   - Add dark mode option to image output example cgi (examples/vnstat.cgi)
   - Add option 4 to QueryMode for selecting summary output of single
     interface regardless of the number of interfaces in the database
   - Add optional mode parameter to -q / --query for overriding QueryMode
     for summary output and for enabling control of summary output style
     regardless of the number of interfaces in the database
   - Add --startempty option to daemon for starting and keeping the daemon
     running even if no interfaces were discovered and the database is empty
   - Add --noremove option to daemon for disabling the automatic removal of
     interfaces from database that aren't currently visible and haven't seen
     any traffic
   - Add third mode option to --iflist and --dbiflist for getting only the
     interface count as output"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-30 17:49:57 +00:00
Matthias Fischer
10851f7ffa mc: Update to 4.8.31
For details see:
https://midnight-commander.org/wiki/NEWS-4.8.31

"Major changes since 4.8.30

Core
    Minimal version of GLib is 2.32.0.

VFS
    fish: drop support of native FISH server and protocol. Rename VFS to shell (#4232)
    extfs;
        uc1541 extfs: update up to 3.6 version (#4511)
        s3+: port to Python3 (#4324)
    Support for LZO/LZOP compression format (#4509)

...

    Skins: add color for non-printable characters in editor (#4433)

Fixes
    FTBFS on FreeBSD with ext2fs attribute support (#4493)
    Broken stickchars (-a) mode (#4498)
    Wrong timestamp after resuming of file copy operation (#4499)
    Editor: wrong deletion of marked column (#3761)
    Diff viewer: segfault when display of line numbers is enabled (#4500)
    Tar VFS: broken handling of hard links (#4494)
    Sftp VFS: failure establishing SSH session due hashed host names in ~/.ssh/known_hosts (#4506)
    Shell VFS: incorrect file names with cyrillic or diacritic symbols (#4507)
    mc.ext.ini: incorrect description of of how multiple sections and keys with same names are processed (#4497)
    mc.ext.ini: unescaped backslash \ is treated as invalid escape sequence in glib-2.77.3 and glib-2.79 (#4502)
    mc.ext.ini: file "Makefile.zip" is handled as Makefile not as zip-arhive (#4419)"

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-30 17:49:46 +00:00
Michael Tremer
65f2f43b0a Merge branch 'master' into next 2024-01-30 17:43:10 +00:00
Michael Tremer
31269e52cb core183: Ship vpnmain.cgi
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-30 17:42:53 +00:00
Michael Tremer
fc4b02df53 vpnmain.cgi: Fix parsing CN from certificates generated by OpenSSL 3.2
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-30 17:42:37 +00:00
Michael Tremer
7e8fc770bd openssl: Update to 3.2.1
* A file in PKCS12 format can contain certificates and keys and may come from
   an untrusted source. The PKCS12 specification allows certain fields to be
   NULL, but OpenSSL did not correctly check for this case. A fix has been
   applied to prevent a NULL pointer dereference that results in OpenSSL
   crashing. If an application processes PKCS12 files from an untrusted source
   using the OpenSSL APIs then that application will be vulnerable to this
   issue prior to this fix.

   OpenSSL APIs that were vulnerable to this are: PKCS12_parse(),
   PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
   and PKCS12_newpass().

   We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
   function is related to writing data we do not consider it security
   significant.

   ([CVE-2024-0727])

   *Matt Caswell*

 * When function EVP_PKEY_public_check() is called on RSA public keys,
   a computation is done to confirm that the RSA modulus, n, is composite.
   For valid RSA keys, n is a product of two or more large primes and this
   computation completes quickly. However, if n is an overly large prime,
   then this computation would take a long time.

   An application that calls EVP_PKEY_public_check() and supplies an RSA key
   obtained from an untrusted source could be vulnerable to a Denial of Service
   attack.

   The function EVP_PKEY_public_check() is not called from other OpenSSL
   functions however it is called from the OpenSSL pkey command line
   application. For that reason that application is also vulnerable if used
   with the "-pubin" and "-check" options on untrusted data.

   To resolve this issue RSA keys larger than OPENSSL_RSA_MAX_MODULUS_BITS will
   now fail the check immediately with an RSA_R_MODULUS_TOO_LARGE error reason.

   ([CVE-2023-6237])

   *Tomáš Mráz*

 * Restore the encoding of SM2 PrivateKeyInfo and SubjectPublicKeyInfo to
   have the contained AlgorithmIdentifier.algorithm set to id-ecPublicKey
   rather than SM2.

   *Richard Levitte*

 * The POLY1305 MAC (message authentication code) implementation in OpenSSL
   for PowerPC CPUs saves the contents of vector registers in different
   order than they are restored. Thus the contents of some of these vector
   registers is corrupted when returning to the caller. The vulnerable code is
   used only on newer PowerPC processors supporting the PowerISA 2.07
   instructions.

   The consequences of this kind of internal application state corruption can
   be various - from no consequences, if the calling application does not
   depend on the contents of non-volatile XMM registers at all, to the worst
   consequences, where the attacker could get complete control of the
   application process. However unless the compiler uses the vector registers
   for storing pointers, the most likely consequence, if any, would be an
   incorrect result of some application dependent calculations or a crash
   leading to a denial of service.

   ([CVE-2023-6129])

   *Rohan McLure*

 * Fix excessive time spent in DH check / generation with large Q parameter
   value.

   Applications that use the functions DH_generate_key() to generate an
   X9.42 DH key may experience long delays. Likewise, applications that use
   DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()
   to check an X9.42 DH key or X9.42 DH parameters may experience long delays.
   Where the key or parameters that are being checked have been obtained from
   an untrusted source this may lead to a Denial of Service.

   ([CVE-2023-5678])

   *Richard Levitte*

 * Disable building QUIC server utility when OpenSSL is configured with
   `no-apps`.

   *Vitalii Koshura*

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-30 17:41:53 +00:00
Michael Tremer
0bbbac7934 core184: Ship OpenSSL
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-30 17:41:07 +00:00
Michael Tremer
54387ef143 openssl: Update to 3.2.1
* A file in PKCS12 format can contain certificates and keys and may come from
   an untrusted source. The PKCS12 specification allows certain fields to be
   NULL, but OpenSSL did not correctly check for this case. A fix has been
   applied to prevent a NULL pointer dereference that results in OpenSSL
   crashing. If an application processes PKCS12 files from an untrusted source
   using the OpenSSL APIs then that application will be vulnerable to this
   issue prior to this fix.

   OpenSSL APIs that were vulnerable to this are: PKCS12_parse(),
   PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
   and PKCS12_newpass().

   We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
   function is related to writing data we do not consider it security
   significant.

   ([CVE-2024-0727])

   *Matt Caswell*

 * When function EVP_PKEY_public_check() is called on RSA public keys,
   a computation is done to confirm that the RSA modulus, n, is composite.
   For valid RSA keys, n is a product of two or more large primes and this
   computation completes quickly. However, if n is an overly large prime,
   then this computation would take a long time.

   An application that calls EVP_PKEY_public_check() and supplies an RSA key
   obtained from an untrusted source could be vulnerable to a Denial of Service
   attack.

   The function EVP_PKEY_public_check() is not called from other OpenSSL
   functions however it is called from the OpenSSL pkey command line
   application. For that reason that application is also vulnerable if used
   with the "-pubin" and "-check" options on untrusted data.

   To resolve this issue RSA keys larger than OPENSSL_RSA_MAX_MODULUS_BITS will
   now fail the check immediately with an RSA_R_MODULUS_TOO_LARGE error reason.

   ([CVE-2023-6237])

   *Tomáš Mráz*

 * Restore the encoding of SM2 PrivateKeyInfo and SubjectPublicKeyInfo to
   have the contained AlgorithmIdentifier.algorithm set to id-ecPublicKey
   rather than SM2.

   *Richard Levitte*

 * The POLY1305 MAC (message authentication code) implementation in OpenSSL
   for PowerPC CPUs saves the contents of vector registers in different
   order than they are restored. Thus the contents of some of these vector
   registers is corrupted when returning to the caller. The vulnerable code is
   used only on newer PowerPC processors supporting the PowerISA 2.07
   instructions.

   The consequences of this kind of internal application state corruption can
   be various - from no consequences, if the calling application does not
   depend on the contents of non-volatile XMM registers at all, to the worst
   consequences, where the attacker could get complete control of the
   application process. However unless the compiler uses the vector registers
   for storing pointers, the most likely consequence, if any, would be an
   incorrect result of some application dependent calculations or a crash
   leading to a denial of service.

   ([CVE-2023-6129])

   *Rohan McLure*

 * Fix excessive time spent in DH check / generation with large Q parameter
   value.

   Applications that use the functions DH_generate_key() to generate an
   X9.42 DH key may experience long delays. Likewise, applications that use
   DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()
   to check an X9.42 DH key or X9.42 DH parameters may experience long delays.
   Where the key or parameters that are being checked have been obtained from
   an untrusted source this may lead to a Denial of Service.

   ([CVE-2023-5678])

   *Richard Levitte*

 * Disable building QUIC server utility when OpenSSL is configured with
   `no-apps`.

   *Vitalii Koshura*

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-30 17:40:51 +00:00
Michael Tremer
e2dce81ca3 make.sh: Build dependencies for frr
These have accidentially been removed in ec01213dcf.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-30 14:56:11 +00:00
Michael Tremer
fc37ab7a51 libvirt: Fix rootfile for riscv64
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-29 16:08:11 +00:00
Adolf Belka
c3863ea14d python3-trio: Update to version 0.23.1
- Update from version 0.22.0 to 0.23.1
- Update of rootfile
- Changelog
    0.23.0
	Headline features
	    Add type hints. (#543)
	Features
	    When exiting a nursery block, the parent task always waits for child tasks
	     to exit. This wait cannot be cancelled. However, previously, if you tried
	     to cancel it, it would inject a Cancelled exception, even though it wasn’t
	     cancelled. Most users probably never noticed either way, but injecting a
	     Cancelled here is not really useful, and in some rare cases caused
	     confusion or problems, so Trio no longer does that. (#1457)
	    If called from a thread spawned by trio.to_thread.run_sync,
	     trio.from_thread.run and trio.from_thread.run_sync now reuse the task and
	     cancellation status of the host task; this means that context variables and
	     cancel scopes naturally propagate ‘through’ threads spawned by Trio. You
	     can also use trio.from_thread.check_cancelled to efficiently check for
	     cancellation without reentering the Trio thread. (#2392)
	    trio.lowlevel.start_guest_run() now does a bit more setup of the guest run
	     before it returns to its caller, so that the caller can immediately make
	     calls to trio.current_time(), trio.lowlevel.spawn_system_task(),
	     trio.lowlevel.current_trio_token(), etc. (#2696)
	Bugfixes
	    When a starting function raises before calling trio.TaskStatus.started(),
	     trio.Nursery.start() will no longer wrap the exception in an undocumented
	     ExceptionGroup. Previously, trio.Nursery.start() would incorrectly raise an
	     ExceptionGroup containing it when using trio.run(...,
	     strict_exception_groups=True). (#2611)
	Deprecations and removals
	    To better reflect the underlying thread handling semantics, the keyword
	     argument for trio.to_thread.run_sync that was previously called cancellable
	     is now named abandon_on_cancel. It still does the same thing – allow the
	     thread to be abandoned if the call to trio.to_thread.run_sync is
	     cancelled – but since we now have other ways to propagate a cancellation
	     without abandoning the thread, “cancellable” has become somewhat of a
	     misnomer. The old cancellable name is now deprecated. (#2841)
	    Deprecated support for math.inf for the backlog argument in
	     open_tcp_listeners, making its docstring correct in the fact that only
	     TypeError is raised if invalid arguments are passed. (#2842)
	Removals without deprecations
	    Drop support for Python3.7 and PyPy3.7/3.8. (#2668)
	    Removed special MultiError traceback handling for IPython. As of version
	     8.15 ExceptionGroup is handled natively. (#2702)
	Miscellaneous internal changes
	    Trio now indicates its presence to sniffio using the sniffio.thread_local
	     interface that is preferred since sniffio v1.3.0. This should be less
	     likely than the previous approach to cause sniffio.current_async_library()
	     to return incorrect results due to unintended inheritance of contextvars.
	     (#2700)
	    On windows, if SIO_BASE_HANDLE failed and SIO_BSP_HANDLE_POLL didn’t return
	     a different socket, runtime error will now raise from the OSError that
	     indicated the issue so that in the event it does happen it might help with
	     debugging. (#2807)
    0.22.2
	Bugfixes
	    Fix PermissionError when importing trio due to trying to access pthread.
	     (#2688)
    0.22.1
	Breaking changes
	    Timeout functions now raise ValueError if passed math.nan. This includes
	     trio.sleep, trio.sleep_until, trio.move_on_at, trio.move_on_after,
	     trio.fail_at and trio.fail_after. (#2493)
	Features
	    Added support for naming threads created with trio.to_thread.run_sync,
	     requires pthreads so is only available on POSIX platforms with glibc
	     installed. (#1148)
	    trio.socket.socket now prints the address it tried to connect to upon
	     failure. (#1810)
	Bugfixes
	    Fixed a crash that can occur when running Trio within an embedded Python
	     interpreter, by handling the TypeError that is raised when trying to
	     (re-)install a C signal handler. (#2333)
	    Fix sniffio.current_async_library() when Trio tasks are spawned from a
	     non-Trio context (such as when using trio-asyncio). Previously, a regular
	     Trio task would inherit the non-Trio library name, and spawning a system
	     task would cause the non-Trio caller to start thinking it was Trio. (#2462)
	    Issued a new release as in the git tag for 0.22.0, trio.__version__ is
	     incorrectly set to 0.21.0+dev. (#2485)
	Improved documentation
	    Documented that Nursery.start_soon does not guarantee task ordering. (#970)

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-29 16:03:31 +00:00
Adolf Belka
74c8dc3548 python3-pyfuse3: Update to version 3.3.0
- Update from version 3.2.2 to 3.3.0
- Update of rootfile
- Changelog
    3.3.0
	    Note: This is the first pyfuse3 release compatible with Cython 3.0.0 release.
	     Cython 0.29.x is also still supported.
	    Cythonized with latest Cython 3.0.0.
	    Drop Python 3.6 and 3.7 support and testing, #71.
	    CI: also test python 3.12. test on cython 0.29 and cython 3.0.
	    Tell Cython that callbacks may raise exceptions, #80.
	    Fix lookup in examples/hello.py, similar to #16.
	    Misc. CI, testing, build and sphinx related fixes.
    3.2.3
	    cythonize with latest Cython 0.29.34 (brings Python 3.12 support)
	    add a minimal pyproject.toml, require setuptools
	    tests: fix integer overflow on 32-bit arches, fixes #47
	    test: Use shutil.which() instead of external which(1) program
	    setup.py: catch more generic OSError when searching Cython, fixes #63
	    setup.py: require Cython >= 0.29
	    fix basedir computation in setup.py (fix pip install -e .)
	    use sphinx < 6.0 due to compatibility issues with more recent versions

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-29 16:03:31 +00:00
Adolf Belka
77d9d67314 python3-packaging: Update to version 23.2
- Update from version 23.0 to 23.2
- Update of rootfile
- Changelog
    23.2
	    Document calendar-based versioning scheme (#716)
	    Enforce that the entire marker string is parsed (#687)
	    Requirement parsing no longer automatically validates the URL (#120)
	    Canonicalize names for requirements comparison (#644)
	    Introduce metadata.Metadata (along with metadata.ExceptionGroup and
	     metadata.InvalidMetadata; #570)
	    Introduce the validate keyword parameter to utils.normalize_name() (#570)
	    Introduce utils.is_normalized_name() (#570)
	    Make utils.parse_sdist_filename() and utils.parse_wheel_filename() raise
	     InvalidSdistFilename and InvalidWheelFilename, respectively, when the
	     version component of the name is invalid
    23.1
	    Parse raw metadata (#671)
	    Import underlying parser functions as an underscored variable (#663)
	    Improve error for local version label with unsupported operators (#675)
	    Add dedicated error for specifiers with incorrect .* suffix
	    Replace spaces in platform names with underscores (#620)
	    Relax typing of _key on _BaseVersion (#669)
	    Handle prefix match with zeros at end of prefix correctly (#674)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-29 16:03:31 +00:00
Adolf Belka
0e299f6fb6 python3-msgpack: Update to version 1.0.7
- Update from version 1.0.4 to 1.0.7
- Update of rootfile
- Changelog
    1.0.7
	    Fix build error of extension module on Windows. (#567)
	    setup.py doesn't skip build error of extension module. (#568)
    1.0.6
	    Add Python 3.12 wheels (#517)
	    Remove Python 2.7, 3.6, and 3.7 support
    1.0.5
	    Use __BYTE_ORDER__ instead of __BYTE_ORDER for portability. (#513, #514)
	    Add Python 3.11 wheels (#517)
	    fallback: Fix packing multidimensional memoryview (#527)

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-29 16:03:31 +00:00
Adolf Belka
c60238f606 python3-exceptiongroup: Update to version 1.2.0
- Updated from version 1.1.0 to 1.2.0
- Update of rootfile
- Changelog
    1.2.0
	    Added special monkeypatching if Apport has overridden sys.excepthook so it
	     will format exception groups correctly (PR by John Litborn)
	    Added a backport of contextlib.suppress() from Python 3.12.1 which also
	     handles suppressing exceptions inside exception groups
	    Fixed bare raise in a handler reraising the original naked exception rather
	     than an exception group which is what is raised when you do a raise in an
	     except* handler
    1.1.3
	    catch() now raises a TypeError if passed an async exception handler instead
	     of just giving a RuntimeWarning about the coroutine never being awaited.
	     (#66, PR by John Litborn)
	    Fixed plain raise statement in an exception handler callback to work like a
	     raise in an except* block
	    Fixed new exception group not being chained to the original exception when
	     raising an exception group from exceptions raised in handler callbacks
	    Fixed type annotations of the derive(), subgroup() and split() methods to
	     match the ones in typeshed
    1.1.2
	    Changed handling of exceptions in exception group handler callbacks to not
	     wrap a single exception in an exception group, as per CPython issue 103590
    1.1.1
	    Worked around CPython issue #98778, urllib.error.HTTPError(..., fp=None)
	     raises KeyError on unknown attribute access, on affected Python versions.
	     (PR by Zac Hatfield-Dodds)

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-29 16:03:31 +00:00
Adolf Belka
6c7e8760f7 python3-calver: New build dependency for python3-trove-classifiers
- lfs and rootfile created.
- rootfile put into common as it is only used as a build dependency.
- Used setup.py build approach as the pyproject.toml approach failed to build successfully

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-29 16:03:31 +00:00
Adolf Belka
6d7c67de3f python3-trove-classifiers: New build dependency for python3-hatchling
- lfs and rootfile created.
- rootfile put into common as it is only used as a build dependency.
- Used setup.py build approach as the pyproject.toml approach failed to build successfully.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-29 16:03:31 +00:00
Adolf Belka
cffababa46 python3-pluggy: New build dependency for python3-hatchling
- lfs and rootfile created.
- rootfile put into common as it is only used as a build dependency.
- Used setup.py build approach  as pyproject.toml approach kept failing to build

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2024-01-29 16:03:31 +00:00