This was newly introduced in OpenSSH 9.9, hence our custom
configurations for both SSH server and client need to be updated.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Full changelog of this release:
*) SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
Unexpected lax shared memory permissions (cve.mitre.org)
Lax permissions set by the Apache Portable Runtime library on
Unix platforms would allow local users read access to named
shared memory segments, potentially revealing sensitive
application data.
This issue does not affect non-Unix platforms, or builds with
APR_USE_SHMEM_SHMGET=1 (apr.h)
Users are recommended to upgrade to APR version 1.7.5, which
fixes this issue.
Credits: Thomas Stangner
*) Unix: Implement apr_shm_perms_set() for the "POSIX shm_open()"
and "classic mmap" shared memory implementations. [Joe Orton,
Ruediger Pluem]
*) Fix missing ';' for XML/HTML hex entities from apr_escape_entity().
[Yann Ylavic]
*) Fix crash in apr_pool_create() with --enable-pool-debug=all|owner.
[Yann Ylavic]
*) Improve platform detection by updating config.guess and config.sub.
[Rainer Jung]
*) CMake: Add support for CMAKE_WARNING_AS_ERROR. [Ivan Zhakov]
*) CMake: Enable support for MSVC runtime library selection by abstraction.
[Ivan Zhakov]
*) CMake: Export installed targets (libapr-1, apr-1, libaprapp-1, aprapp-1)
to apr:: namespace. [Ivan Zhakov]
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- As requested in bug 13074, create a collectd.d directory to enable any addon definitions
to be created.
- Added include statement in conf file to load everything that is stored in the collectd.d
directory.
- collectd.precache and collectd.thermal have been left in their original locations
- Removed the arm section in the initscript as only aarch64 is now used.
- Modified the lfs to create the collectd.d directory
- Removal of collectd.custom file as this was the previous way to define custom collectd
profiles but would have been overwritten by any update of collectd.
- Update of rootfile to take account of new path and removal of collectd.custom
- Tested out in vm testbed with Core Update 188 and all existing graphs were still created
and updated. From my evaluation the changes have not affected anything.
- The creation of the collectd.d directory now allows users to add their own desired
profiles but also if it is decided that an addon should be included in the processes
graph, or if a new graph for addons is created then profiles for that addon can be
placed in the collectd.d directory and will be automatically included by collectd.
Fixes: Bug13074
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Due to the update of openssh to version 9.8 in CU187, logwatch no longer found the sshd
login data from the messages log as the daemon was changed to sshd-session.
- Therefore the daily logwatch files were missing the sshd information in them.
- A patch to add support for openssh-9.8 sshd-session and port info has been merged into
the logwatch git system and will be included into the next released version of logwatch
- Update logwatch from version 7.8 to 7.11 and add patch for openssh-9.8 support.
- Update the previous three logwatch patches for version 7.11
- Tested on my vm testbed. Confirmed that logwatch now includes back the sshd information
into the Log Summary page.
- When logwatch is updated to version 7.12 then the openssh-9.8 support patch will be able
to be removed.
Fixes: bug13762
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 3.9 to 3.10
- Update of rootfile
- Changelog
3.10
This is a maintenance release, including a few each of bug
fixes, new features and optimizations.
The new version is intended to be fully source and binary
compatible with Nettle-3.6. The shared library names are
libnettle.so.8.9 and libhogweed.so.6.9, with sonames
libnettle.so.8 and libhogweed.so.6.
Bug fixes:
* Add missing hash functions sha512_224 and sha512_256 to the
nettle_get_hashes() list. The name values in the
corresponding nettle_hash structs also changed to use
underscore instead of dash, for consistency.
* Fix a few cases of formally undefined calls to memcpy(dst,
NULL, 0), resulting from valid calls to, e.g.,
sha256_update(ctx, 0, NULL).
New features:
* Support RSA-OAEP encryption. Contributed by Nicolas Mora and
Daiki Ueno.
* New function sha3_256_shake_output, new functions
sha3_128_init, sha3_128_update, sha3_128_shake,
sha3_128_shake_output. Contributed by Daiki Ueno.
* Added DRBG-CTR with AES256, contributed by Simon Josefsson.
Optimizations:
* New combined gcm-aes assembly for powerpc64, contributed by
Danny Tsen.
* New sha256 assembly for powerpc64, contributed by Eric
Richter.
* Improved performance for powerpc64 AES decrypt, by skipping
subkey transformations that don't suit the vncipher
instructions.
* Add arm64 CPU feature detection for Android and for Apple systems,
contributed by Foolbar and Tim Kosse, prespectively.
Miscellaneous:
* New tests for side-channel silence, based on valgrind.
* Delete all md5 assembly code. Delete all sparc32 assembly code.
3.9.1
This is a bugfix release, fixing a few bugs reported for
Nettle-3.9. The bug in the new OCB code may be exploitable for
denial of service or worse, since triggering it leads to
memory corruption. Upgrading from Nettle-3.9 to the new
version is strongly recommended.
The new version is intended to be fully source and binary
compatible with Nettle-3.6. The shared library names are
libnettle.so.8.8 and libhogweed.so.6.8, with sonames
libnettle.so.8 and libhogweed.so.6.
Bug fixes:
* Fix OCB loop for processing messages of size 272 bytes or
larger. Reported and fixed by Jussi Kivilinna.
* Fix alignment bug in the new x86_64 non-pclmul assembly
implementation of ghash. Reported by Henrik Grubbström.
* Fix build-time memory leak in eccdata. Reported by Noah
Watkins.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 1.6.42 to 1.6.44
- Update of rootfile
- Changelog
1.6.44
Hardened calculations in chroma handling to prevent overflows, and
relaxed a constraint in cHRM validation to accomodate the standard
ACES AP1 set of color primaries.
(Contributed by John Bowler)
Removed the ASM implementation of ARM Neon optimizations and updated
the build accordingly. Only the remaining C implementation shall be
used from now on, thus ensuring the support of the PAC/BTI security
features on ARM64.
(Contributed by Ross Burton and John Bowler)
Fixed the pickup of the PNG_HARDWARE_OPTIMIZATIONS option in the
CMake build on FreeBSD/amd64. This is an important performance fix
on this platform.
Applied various fixes and improvements to the CMake build.
(Contributed by Eric Riff, Benjamin Buch and Erik Scholz)
Added fuzzing targets for the simplified read API.
(Contributed by Mikhail Khachayants)
Fixed a build error involving pngtest.c under a custom config.
This was a regression introduced in a code cleanup in libpng-1.6.43.
(Contributed by Ben Wagner)
Fixed and improved the config files for AppVeyor CI and Travis CI.
1.6.43
Fixed the row width check in png_check_IHDR().
This corrected a bug that was specific to the 16-bit platforms,
and removed a spurious compiler warning from the 64-bit builds.
(Reported by Jacek Caban; fixed by John Bowler)
Added eXIf chunk support to the push-mode reader in pngpread.c.
(Contributed by Chris Blume)
Added contrib/pngexif for the benefit of the users who would like
to inspect the content of eXIf chunks.
Added contrib/conftest/basic.dfa, a basic build-time configuration.
(Contributed by John Bowler)
Fixed a preprocessor condition in pngread.c that broke build-time
configurations like contrib/conftest/pngcp.dfa.
(Contributed by John Bowler)
Added CMake build support for LoongArch LSX.
(Contributed by GuXiWei)
Fixed a CMake build error that occurred under a peculiar state of the
dependency tree. This was a regression introduced in libpng-1.6.41.
(Contributed by Dan Rosser)
Marked the installed libpng headers as system headers in CMake.
(Contributed by Benjamin Buch)
Updated the build support for RISCOS.
(Contributed by Cameron Cawley)
Updated the makefiles to allow cross-platform builds to initialize
conventional make variables like AR and ARFLAGS.
Added various improvements to the CI scripts in areas like version
consistency verification and text linting.
Added version consistency verification to pngtest.c also.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Used in the samba addon.
- With the old separate module removed samba still successfully built, installed and was
able to be run from the WUI.
Fixes: bug13640
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Used by the git addon.
- With the old separate module removed git still successfully built, installed and was
able to be run, cloning the ipfire git repo, changing to next, modifying a file and
the running a commit with the change.
Fixes: bug13640
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Used in install-ipfire.sh script that is run by the install of vdradmin.
- With the old separate module removed vdradmin still successfully built and installed.
Fixes: bug13640
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Used in install-ipfire.sh script that is run by the install of vdradmin.
- With the old separate module removed vdradmin still successfully built and installed.
Fixes: bug13640
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Not referenced in the IPFire git repo so looks like not actively used
Fixes: bug13640
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Not referenced in the IPFire git repo so looks like not actively used
Fixes: bug13640
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Not referenced in the IPFire git repo so looks like not actively used
Fixes: bug13640
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 0.14.0 to 0.14.1
- Update of rootfile
- Changelog
0.14.1
* Fix: missing typename in URCU_FORCE_CAST
* Allow building with GCC >= 13.3 on RISC-V
* pointer.h: Fix the rcu_cmpxchg_pointer documentation
* Adjust shell script to allow Bash in other locations
* fix: handle EINTR correctly in get_cpu_mask_from_sysfs
* Relicense src/compat-smp.h to MIT
* ppc.h: use mftb on ppc
* Fix: allow clang to build liburcu on RISC-V
* Fix -Walloc-size
* urcu/uatomic/riscv: Mark RISC-V as broken
* Fix: urcu-bp: misaligned reader accesses
* LoongArch: Document that byte and short atomics are implemented with LL/SC
* Add LoongArch support
* tests/regression/rcutorture: Add wait state
* urcu-wait: Initialize node in URCU_WAIT_NODE_INIT
* Fix: urcu-wait: add missing futex.h include
* Adjust shell scripts to allow Bash in other locations
* Add support for OpenBSD
* Revert "compiler.h: Introduce caa_unqual_scalar_typeof"
* rculfhash: Use caa_container_of_check_null in cds_lfht_entry
* compiler.h: Introduce caa_container_of_check_null
* compiler.h: Introduce caa_unqual_scalar_typeof
* Avoid calling caa_container_of on NULL pointer in cds_lfht macros
* Fix: revise urcu_read_lock_update() comment
* Fix: uatomic powerpc comment about lwsync
* fix: aarch64: allow RHEL7 gcc 4.8.5-11
* fix: warning 'noreturn' function does return on ppc
* Fix: use __noreturn__ for C11-compatibility
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from vesion 8.9.1 to 8.10.0
- Update of rootfile
- In previous versions if libpsl was not found then the build excluded it. Now it needs
to be explicitly disabled otherwise the build will stop with a warning that it could
not be found.
- Changelog
8.10.0
changes:
o autotools: add `--enable-windows-unicode` option [103]
o curl: --help [option] displays documentation for given cmdline option [19]
o curl: add --skip-existing [54]
o curl: for -O, use "default" as filename when the URL has none [34]
o curl: make --rate accept "number of units" [4]
o curl: make --show-headers the same as --include [6]
o curl: support --dump-header % to direct to stderr [31]
o curl: support embedding a CA bundle and --dump-ca-embed [20]
o curl: support repeated use of the verbose option; -vv etc [35]
o curl: use libuv for parallel transfers with --test-event [82]
o getinfo: add CURLINFO_POSTTRANSFER_TIME_T [87]
o mbedtls: add CURLOPT_TLS13_CIPHERS support [78]
o rustls: add support for setting TLS version and ciphers [113]
o vtls: stop offering alpn http/1.1 for http2-prior-knowledge [53]
o wolfssl: add CURLOPT_TLS13_CIPHERS support [76]
o wolfssl: add support for ssl cert blob / ssl key blob options [50]
bugfixes:
o asyn-thread: stop using GetAddrInfoExW on Windows [241]
o autotools: fix MS-DOS builds [249]
o autotools: fix typo in tests/data target [30]
o aws_sigv4: fix canon order for headers with same prefix [74]
o bearssl: fix setting tls version [203]
o bearssl: improve shutdown handling [45]
o BINDINGS: add zig binding [100]
o build: add `iphlpapi` lib for libssh on Windows [166]
o build: add `poll()` detection for cross-builds [244]
o build: add options to disable SHA-512/256 hash algo [239]
o build: check OS-native IDN first, then libidn2 [223]
o build: delete unused `REQUIRE_LIB_DEPS` [226]
o build: drop unused `NROFF` reference [253]
o build: drop unused feature-detection code for Apple `poll()` [227]
o build: generate `buildinfo.txt` for test logs [256]
o build: improve compiler version detection portability
o build: make `CURL_FORMAT_CURL_OFF_T[U]` work with mingw-w64 <=7.0.0 [207]
o build: silence C4232 MSVC warnings in vcpkg ngtcp2 builds [137]
o build: use -Wno-format-overflow [195]
o buildconf.bat: fix tool_hugehelp.c generation [173]
o cf-socket: fix pollset for listening [179]
o cf-socket: prevent KEEPALIVE_FACTOR being set to 1000 for Windows [185]
o cfilters: send flush [13]
o CHANGES: rename to CHANGES.md, no longer generated [40]
o CI: enable parallel testing in CI builds [18]
o ci: Update actions/upload-artifact digest to 89ef406 [24]
o cmake: `Libs.private` improvements [215]
o cmake: add `CURL_USE_PKGCONFIG` option [138]
o cmake: add Linux CI job, fix pytest with cmake [71]
o cmake: add math library when using wolfssl and ngtcp2 [66]
o cmake: add missing `pkg-config` hints to Find modules [158]
o cmake: add missing version detection to Find modules [170]
o cmake: add rustls [116]
o cmake: add support for versioned symbols option [51]
o cmake: add wolfSSH support [117]
o cmake: allow `pkg-config` in more envs [147]
o cmake: cleanup header paths [59]
o cmake: default `CURL_DISABLE_LDAPS` to the value of `CURL_DISABLE_LDAP` [231]
o cmake: delete MSVC warning suppression for tests/server [101]
o cmake: detect `nghttp2` via `pkg-config`, enable by default [21]
o cmake: detect and show VCPKG in platform flags [84]
o cmake: distcheck for files in CMake subdir [9]
o cmake: drop custom `CMakeOutput.log`/`CMakeError.log` logs [27]
o cmake: drop libssh CONFIG-style detection [167]
o cmake: drop no-op `tests/data/CMakeLists.txt` [26]
o cmake: drop reference to undefined variable [25]
o cmake: drop unused `HAVE_IDNA_STRERROR` [62]
o cmake: drop unused internal variable [22]
o cmake: exclude tests/http/clients builds by default [110]
o cmake: fix `GSS_VERSION` for Heimdal found via pkg-config [77]
o cmake: fix `pkg-config`-based detection in `FindGSS.cmake` [94]
o cmake: fix and tidy up c-ares builds, enable in more CI jobs [156]
o cmake: fix find rustls [148]
o cmake: fixup linking libgsasl when detected via CMake-native
o cmake: honor custom `CMAKE_UNITY_BUILD_BATCH_SIZE` [163]
o cmake: limit `pkg-config` to UNIX and MSVC+vcpkg by default [188]
o cmake: limit libidn2 `pkg-config` detection to `UNIX` [109]
o cmake: migrate dependency detections to Find modules [183]
o cmake: more small tidy-ups and fixes [80]
o cmake: rename wolfSSL and zstd config variables to uppercase [151]
o cmake: respect cflags/libdirs of native pkg-config detections [175]
o cmake: show CMake platform/compiler flags [63]
o cmake: show warning if libpsl is not found [154]
o cmake: sync code between test/example targets [234]
o cmake: sync up formatting in Find modules [129]
o cmake: TLS 1.3 warning only for bearssl and sectranp [118]
o cmake: update `curl-config.cmake.in` template var list
o cmake: update list of "advanced" variables [119]
o cmake: use numeric comparison for `HAVE_WIN32_WINNT` [69]
o cmdline-opts: language fix for expect100-timeout.md and max-time.md [192]
o configure: delete unused `CURL_DEFINE_UNQUOTED` function [224]
o configure: delete unused `HAVE_OPENSSL3` macro [225]
o configure: delete unused `m4/xc-translit.m4` [114]
o configure: detect AppleIDN [70]
o configure: fail if PSL is not disabled but not found [46]
o configure: fix WinIDN builds targeting old Windows [210]
o configure: remove USE_EXPLICIT_LIB_DEPS [199]
o configure: replace nonportable grep -o with awk [111]
o connect: always prefer ipv6 in IP eyeballing [209]
o connect: limit update IP info [191]
o cookie.md: try to articulate the two different uses this option has [92]
o curl: allow 500MB data URL encode strings [38]
o curl: find curlrc in XDG_CONFIG_HOME without leading dot [186]
o curl: fix --proxy-pinnedpubkey [91]
o curl: fix the -w urle.* variables [153]
o curl: make the progress bar detect terminal width changes [169]
o curl: warn on unsupported SSL options [106]
o Curl_rand_bytes to control env override [17]
o curl_sha512_256: fix symbol collisions with nettle library [131]
o CURLMOPT_SOCKETFUNCTION.md: expand on the easy argument [216]
o CURLOPT_XFERINFOFUNCTION: clarify the callback return codes [141]
o dist: add missing `docs/examples/CMakeLists.txt` [58]
o dist: add missing `FindNettle.cmake` [11]
o dist: add missing `lib/optiontable.pl` [115]
o dist: add missing `test_*.py` scripts [102]
o dist: drop buildconf [65]
o dist: fix reproducible build from release tarball [36]
o dmaketgz: only run 'make distclean' if Makefile exists
o docs/SSLCERTS: rewrite [174]
o docs: add description of effect of --location-trusted on cookie [157]
o docs: document the (weak) random value situation in rustls builds [252]
o docs: fix some examples in man pages
o docs: improve cipher options documentation [159]
o docs: mention "@-" in more places [67]
o docs: remove ALTSVC.md, HSTS.md, HTTP2.md and PARALLEL-TRANSFERS.md [105]
o docs: update CIPHERS.md [140]
o doh-url.md: point out DOH server IP pinning [37]
o doh: remove redundant checks [242]
o easy: fix curl_easy_upkeep for shared connection caches [52]
o escape: allow curl_easy_escape to generate 3*input length output [39]
o FEATURES.md: fix typo [180]
o ftp: always offer line end conversions [219]
o ftp: flush pingpong before response [73]
o getinfo: return zero for unsupported options (when disabled) [189]
o GHA/windows: enable MulitSSL in an MSVC job [2]
o GHA: scan git repository and detect unvetted binary files [3]
o gnutls/wolfssl: improve error message when certificate fails [125]
o gnutls: send all data [230]
o gtls: fix OCSP stapling management [206]
o haproxy: send though next filter [222]
o hash: provide asserts to verify API use [96]
o http/2: simplify eos/blocked handling [90]
o http2+h3 filters: fix ctx init [142]
o http2: fix GOAWAY message sent to server [171]
o http2: improve rate limiting of downloads [33]
o http2: improved upload eos handling [41]
o http3.md: mention how the fallback can be h1 or h2 [194]
o hyper: call Curl_req_set_upload_done() [126]
o idn: more strictly check AppleIDN errors [98]
o idn: support non-UTF-8 input under AppleIDN [99]
o INSTALL.md: MultiSSL and QUIC are mutually exclusive [7]
o KNOWN_BUGS: "special characers" in URL works with aws-sigv4 [81]
o krb5: add Linux/macOS CI tests, fix cmake GSS detection [83]
o krb5: fix `-Wcast-align` [95]
o lib: add eos flag to send methods [14]
o lib: avoid macro collisions between wolfSSL and GnuTLS headers [133]
o lib: convert some debugf()s into traces [8]
o lib: delete stray undefs for `vsnprintf`, `vsprintf` [152]
o lib: fix AIX build issues [112]
o lib: fix building with wolfSSL without DES support [134]
o lib: make SSPI global symbols use Curl_ prefix [251]
o lib: prefer `CURL_SHA256_DIGEST_LENGTH` over the unprefixed name [132]
o lib: remove the final strncpy() calls [240]
o lib: remove use of RANDOM_FILE [235]
o libcurl.def: move from / into lib [238]
o libcurl.pc: add `Cflags.private` [10]
o libcurl.pc: add reference to `libgsasl` [150]
o libcurl/docs: expand on redirect following and secrets to other hosts [85]
o llist: remove direct struct accesses, use only functions [72]
o Makefile.dist: fix `ca-firefox` target [254]
o Makefile.mk: fixup enabling libidn2 [61]
o Makefile: remove 'scripts' duplicate from DIST_SUBDIRS
o maketgz: accept option to include latest commit hash [5]
o maketgz: fix RELEASE-TOOLS.md for daily tarballs [243]
o maketgz: move from / into scripts [237]
o managen: fix superfluous leading blank line in quoted sections [211]
o managen: in man output, remove the leading space from examples [198]
o managen: wordwrap long example lines in ASCII output [143]
o manpage: ensure a maximum width for the text version [75]
o max-filesize.md: mention zero disables the limit [93]
o mbedtls: add more informative logging [162]
o mbedtls: fix setting tls version [200]
o mbedtls: no longer use MBEDTLS_SSL_VERIFY_OPTIONAL [181]
o mime: avoid inifite loop in client reader [155]
o mk-ca-bundle.pl: include a link to the caextract webpage [68]
o multi: make the "general" list of easy handles a Curl_llist [97]
o multi: on socket callback error, remove socket hash entry nonetheless [149]
o ngtcp2/osslq: remove NULL pointer dereferences [213]
o ngtcp2: use NGHTTP3 prefix instead of NGTCP2 for errors in h3 callbacks [79]
o openssl quic: fix memory leak [229]
o openssl: certinfo errors now fail correctly [250]
o openssl: fix the data race when sharing an SSL session between threads [221]
o openssl: improve shutdown handling [44]
o pingpong: drain the input buffer when reading responses [193]
o POP3: fix multi-line responses [168]
o pop3: use the protocol handler ->write_resp [220]
o printf: fix mingw-w64 format checks [228]
o progress: ratelimit/progress tweaks [32]
o pytests: add tests for HEAD requests in all HTTP versions [42]
o rand: only provide weak random when needed [233]
o runtests: if DISABLED cannot be read, error out [56]
o runtests: log ignored but passed tests [130]
o runtests: remove "has_textaware" [217]
o rustls: fix setting tls version [202]
o rustls: make all tests pass [1]
o schannel: avoid malloc for CAinfo_blob_digest [247]
o scorecard: tweak request measurements [139]
o sectransp: fix setting tls version [204]
o SECURITY: mention OpenSSF best practices gold badge [161]
o setopt: allow CURLOPT_INTERFACE to be set to NULL [165]
o setopt: let CURLOPT_ECH set to NULL reset to default [187]
o setopt: make CURLOPT_TFTP_BLKSIZE accept bad values [184]
o sha256: fix symbol collision between nettle (GnuTLS) and OpenSSL [135]
o share: don't reinitialize conncache [214]
o sigpipe: init the struct so that first apply ignores [49]
o smb: convert superflous assign into assert [246]
o smtp: add tracing feature [120]
o splay: use access functions, add asserts, use Curl_timediff [121]
o spnego_gssapi: implement TLS channel bindings for openssl [146]
o src: delete `curlx_m*printf()` aliases [197]
o src: fix potential macro confusion in cmake unity builds [208]
o src: namespace symbols clashing with lib [248]
o src: replace copy of printf mappings with an include [190]
o ssh: deduplicate SSH backend includes (and fix libssh cmake unity build) [177]
o system_win32: fix typo
o test httpd: tweak cipher list [124]
o test1521: verify setting options to NULL better [182]
o test1707: output diff more for debugging differences in CI outputs
o test556: improve robustness [64]
o test579: improve robustness [60]
o test587: improve robustness [123]
o test649: improve robustness [122]
o test677: improve robustness [47]
o tests/runner: only allow [!A-Za-z0-9_-] in %if feature names [55]
o tests: constrain http pytest to tests/http directory [205]
o tests: don't mangle output if hostname or type unknown
o tests: ignore QUIT from FTP protocol comparisons [108]
o tests: provide docs as curldown, not nroff [12]
o tidy-up: misc build, tests, `lib/macos.c` [172]
o tidy-up: OS names [57]
o tool_operhlp: fix "potentially uninitialized local variable 'pc' used" [48]
o tool_paramhlp: bump maximum post data size in memory to 16GB [128]
o transfer: Curl_sendrecv() and event related improvements [164]
o transfer: remove comments, add asserts [218]
o transfer: skip EOS read when download done [196]
o url: dns_entry related improvements [16]
o url: fix connection reuse for HTTP/2 upgrades [236]
o urlapi: verify URL *decoded* hostname when set [160]
o urldata: introduce `data->mid`, a unique identifier inside a multi [127]
o urldata: remove 'scratch' from the UrlState struct [86]
o urldata: remove crlf_conversions counter [232]
o urldata: remove proxy_connect_closed bit [178]
o verify-release: shell script that verifies a release tarball [29]
o version: fix shadowing a `libssh.h` symbol [176]
o vtls: add SSLSUPP_CIPHER_LIST [107]
o vtls: fix MSVC 'cast truncates constant value' warning [23]
o vtls: fix static function name collisions between TLS backends [136]
o vtls: init ssl peer only once [15]
o websocket: introduce blocking sends [145]
o wolfssl: avoid taking cached x509 store ref if sslctx already using it [88]
o wolfssl: fix CURLOPT_SSLVERSION [144]
o wolfssl: fix setting tls version [201]
o wolfssl: improve shutdown handling [43]
o ws: flags to opcodes should ignore CURLWS_CONT flag [104]
o x509asn1: raise size limit for x509 certification information [28]
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
It probably doesn't matter much as the get_memory_consumption function just returns 0 when no pids are found. But it shouldn't even try as the mem var is never used when the service is not running.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Adds Zabbix Agent userparameter `ipfire.services.get` for the agent to get details about configured IPFire services (builtin and addon-services)
- Includes `ipfire_services.pl` script in sudoers for Zabbix Agent as it needs root permission to call addonctrl for addon service states.
- Adapts lfs install script to install new script
- Adds new script to rootfiles
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 1.9.15p5 to 1.9.16
- Update of rootfile
- Changelog
1.9.16
* Added the "cmddenial_message" sudoers option to provide additional
information to the user when a command is denied by the sudoers
policy. The default message is still displayed.
* The time stamp used for file-based logs is now more consistent
with the time stamp produced by syslog. GitHub issues #327.
* Sudo will now warn the user if it can detect the user's terminal
but cannot determine the path to the terminal device. The sudoers
time stamp file will now use the terminal device number directly.
GitHub issue #329.
* The embedded copy of zlib has been updated to version 1.3.1.
* Improved error handling if generating the list of signals and signal
names fails at build time.
* Fixed a compilation issue on Linux systems without process_vm_readv().
* Fixed cross-compilation with WolfSSL.
* Added a "json_compact" value for the sudoers "log_format" option
which can be used when logging to a file. The existing "json"
value has been aliased to "json_pretty". In a future release,
"json" will be an alias for "json_compact". GitHub issue #357.
* A new "pam_silent" sudoers option has been added which may be
negated to avoid suppressing output from PAM authentication modules.
GitHub issue #216.
* Fixed several cvtsudoers JSON output problems.
GitHub issues #369, #370, #371, #373, #381.
* When sudo runs a command in a pseudo-terminal and the user's
terminal is revoked, the pseudo-terminal's foreground process
group will now receive SIGHUP before the terminal is revoked.
This emulates the behavior of the session leader exiting and is
consistent with what happens when, for example, an ssh session
is closed. GitHub issue #367.
* Fixed "make test" with Python 3.12. GitHub issue #374.
* In schema.ActiveDirectory, fixed the quoting in the example command.
GitHub issue #376.
* Paths specified via a Chdir_Spec or Chroot_Spec in sudoers may
now be double-quoted.
* Sudo insults are now included by default, but disabled unless
the --with-insults configure option is specified or the "insults"
sudoers option is enabled.
* The default sudoers file now enables the "secure_path" option by
default and preserves the EDITOR, VISUAL, and SUDO_EDITOR environment
variables when running visudo. The new --with-secure-path-value
configure option can be used to set the value of "secure_path" in
the default sudoers file. GitHub issue #387.
* A sudoers schema for IBM Directory Server (aka IBM Tivoli Directory
Server, IBM Security Directory Server, and IBM Security Verify
Directory) is now included.
* When cross-compiling sudo, the configure script now assumes that
the snprintf() function is C99-compliant if the C compiler
supports the C99 standard. Previously, configure would use
sudo's own snprintf() when cross-compiling. GitHub issue #386.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
- Update from version 1.3.1 to 1.3.2
- Update of rootfile
- 2 CVE Fixes
- Changelog
1.3.2
- [CVE-2024-20506](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20506):
Changed the logging module to disable following symlinks on Linux and Unix
systems so as to prevent an attacker with existing access to the 'clamd' or
'freshclam' services from using a symlink to corrupt system files.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.1
- 1.3.2
- 1.0.7
- 0.103.12
Thank you to Detlef for identifying this issue.
- [CVE-2024-20505](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20505):
Fixed a possible out-of-bounds read bug in the PDF file parser that could
cause a denial-of-service (DoS) condition.
This issue affects all currently supported versions. It will be fixed in:
- 1.4.1
- 1.3.2
- 1.0.7
- 0.103.12
Thank you to OSS-Fuzz for identifying this issue.
- Removed unused Python modules from freshclam tests including deprecated
'cgi' module that is expected to cause test failures in Python 3.13.
- Fix unit test caused by expiring signing certificate.
- Backport of [GitHub pull request](https://github.com/Cisco-Talos/clamav/pull/1305)
- Fixed a build issue on Windows with newer versions of Rust.
Also upgraded GitHub Actions imports to fix CI failures.
Fixes courtesy of liushuyu.
- Backport of [GitHub pull request](https://github.com/Cisco-Talos/clamav/pull/1307)
- Fixed an unaligned pointer dereference issue on select architectures.
Fix courtesy of Sebastian Andrzej Siewior.
- Backport of [GitHub pull request](https://github.com/Cisco-Talos/clamav/pull/1293)
- Fixes to Jenkins CI pipeline.
For details, see [GitHub pull request](https://github.com/Cisco-Talos/clamav/pull/1330)
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
