* [PATCH] openssh: Update to version 9.9p2
@ 2025-02-19 13:30 Adolf Belka
2025-02-19 13:30 ` [PATCH] sqlite: Update to version 3490100 Adolf Belka
2025-02-19 15:36 ` [PATCH] openssh: Update to version 9.9p2 Michael Tremer
0 siblings, 2 replies; 3+ messages in thread
From: Adolf Belka @ 2025-02-19 13:30 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 2862 bytes --]
- Update from version 9.9p1 to 9.9p2
- Update of rootfile not required
- Changelog
9.9p2
Security
* Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1
(inclusive) contained a logic error that allowed an on-path
attacker (a.k.a MITM) to impersonate any server when the
VerifyHostKeyDNS option is enabled. This option is off by default.
* Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1
(inclusive) is vulnerable to a memory/CPU denial-of-service related
to the handling of SSH2_MSG_PING packets. This condition may be
mitigated using the existing PerSourcePenalties feature.
Both vulnerabilities were discovered and demonstrated to be exploitable
by the Qualys Security Advisory team. We thank them for their detailed
review of OpenSSH.
Bugfixes
* ssh(1), sshd(8): fix regression in Match directive that caused
failures when predicates and their arguments were separated by '='
characters instead of whitespace (bz3739).
* sshd(8): fix the "Match invalid-user" predicate, which was matching
incorrectly in the initial pass of config evaluation.
* ssh(1), sshd(8), ssh-keyscan(1): fix mlkem768x25519-sha256 key
exchange on big-endian systems.
* Fix a number of build problems on particular operating systems /
configurations.
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
lfs/openssh | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lfs/openssh b/lfs/openssh
index b1c9a1635..f2165a96d 100644
--- a/lfs/openssh
+++ b/lfs/openssh
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> #
+# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 9.9p1
+VER = 9.9p2
THISAPP = openssh-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 817d267e42b8be74a13e0cfd7999bdb4dab6355c7f62c1a4dd89adad310c5fb7fe3f17109ce1a36cd269a3639c1b8f1d18330c615ab3b419253ec027cfa20997
+$(DL_FILE)_BLAKE2 = 1b5bc09482b3a807ccfee52c86c6be3c363acf0c8e774862e0ae64f76bfeb4ce7cf29b3ed2f99c04c89bb4977da0cf50a7a175b15bf1d9925de1e03c66f8306d
install : $(TARGET)
--
2.48.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] sqlite: Update to version 3490100
2025-02-19 13:30 [PATCH] openssh: Update to version 9.9p2 Adolf Belka
@ 2025-02-19 13:30 ` Adolf Belka
2025-02-19 15:36 ` [PATCH] openssh: Update to version 9.9p2 Michael Tremer
1 sibling, 0 replies; 3+ messages in thread
From: Adolf Belka @ 2025-02-19 13:30 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 6393 bytes --]
- Update from version 3470200 to 3490100
- Update of rootfile
- Changelog
3490100
Improve portability of makefiles and configure scripts.
Fix a bug in the concat_ws() function, introduced in version 3.44.0, that could
lead to a memory error if the separator string is very large (hundreds of
megabytes).
Enhanced the SQLITE_DBCONFIG_LOOKASIDE interface to make it more robust against
misuse.
3490000
Enhancements to the query planner:
Improve the query-time index optimization so that it works on WITHOUT ROWID
tables.
Better query plans for large star-query joins. This fixes three different
performance regressions that were reported on the SQLite Forum.
When two or more queries have the same estimated cost, use the one with the
fewer bytes per row.
Enhance the iif() SQL function so that it can accept any number of arguments
greater than or equal to two.
Enhance the session extension so that it works on databases that make use of
generated columns.
Omit the SQLITE_USE_STDIO_FOR_CONSOLE compile-time option which was not
implemented correctly and never worked right. In its place add the
SQLITE_USE_W32_FOR_CONSOLE_IO compile-time option. This option applies to
command-line tools like the CLI only, not to the SQLite core. It causes Win32
APIs to be used for console I/O instead of stdio. This option affects Windows
builds only.
Three new options to sqlite3_db_config(). All default to "on".
SQLITE_DBCONFIG_ENABLE_ATTACH_CREATE
SQLITE_DBCONFIG_ENABLE_ATTACH_WRITE
SQLITE_DBCONFIG_ENABLE_COMMENTS
Replace Autotools with Autosetup for the configure script used in the
precompiled amalgamation tarball. The configure script for the canonical
source code was changed to Autosetup in the previous (3.48.0) release. Only
the main SQLite configure script in the amalgamation tarball is changed. The
(deprecated) configuration script use by TEA subdirectory of the amalgamation
tarball still relies on Autotools.
Various minor patches and fixes for problems seen in the 3.48.0 release.
3480000
Refactor the "configure" script used to help build SQLite from canonical
sources, to fix bugs, improve performance, and make the code more maintainable.
This does not affect the "configure" script in the
sqlite3-autoconf-NNNNNNN.tar.gz "amalgamation tarball", only the
canonical sources. The build system for the amalgamation tarball is
unchanged. If you are using the amalgamation tarball, nothing about
this change log entry applies to you.
The key innovation here is that Autosetup is now used instead of GNU
Autoconf. That seems like a big change, but it is really just an
implementation detail. The ./configure script is coded very
differently, but should work the same as before.
One advantage of the new configure is that you no longer need to install
TCL in order to build most SQLite targets. TCL is still required to
run tests or to build accessory programs (like sqlite3_analyzer) that
use TCL, but it is not required for most common targets. Hence, as of
this release, the only build dependencies are a C compiler and "make"
or "nmake".
Improved EXPLAIN QUERY PLAN output for covering indexes.
Allow a two-argument version of the iif() SQL function. Also allow if() as an
alternative spelling for iif().
Add the ".dbtotxt" command to the CLI.
Add the SQLITE_IOCAP_SUBPAGE_READ property to the xDeviceCharacteristics
method of the sqlite3_io_methods object.
Add the SQLITE_PREPARE_DONT_LOG option to sqlite3_prepare_v3() that prevents
warning messages being sent to the error log if the SQL is ill-formed. This
allows sqlite3_prepare_v3() to be used to do test compiles of SQL to check
for validity without polluting the error log with false messages.
Increase the minimum allowed value of SQLITE_LIMIT_LENGTH from 1 to 30.
Added the SQLITE_FCNTL_NULL_IO file control.
Extend the FTS5 auxiliary API xInstToken() to work with prefix queries via the
insttoken configuration option and the fts5_insttoken() SQL function.
Increase the maximum number of arguments to an SQL function from 127 to 1000.
Remove vestigial traces of SQLITE_USER_AUTHENTICATION.
Various obscure bug fixes.
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
config/rootfiles/common/sqlite | 4 +---
lfs/sqlite | 6 +++---
2 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/config/rootfiles/common/sqlite b/config/rootfiles/common/sqlite
index c3863bdb7..074e1f685 100644
--- a/config/rootfiles/common/sqlite
+++ b/config/rootfiles/common/sqlite
@@ -1,10 +1,8 @@
usr/bin/sqlite3
#usr/include/sqlite3.h
#usr/include/sqlite3ext.h
-#usr/lib/libsqlite3.a
-#usr/lib/libsqlite3.la
#usr/lib/libsqlite3.so
usr/lib/libsqlite3.so.0
-usr/lib/libsqlite3.so.0.8.6
+usr/lib/libsqlite3.so.3.49.1
#usr/lib/pkgconfig/sqlite3.pc
#usr/share/man/man1/sqlite3.1
diff --git a/lfs/sqlite b/lfs/sqlite
index ee7d96033..ea3edcec2 100644
--- a/lfs/sqlite
+++ b/lfs/sqlite
@@ -1,7 +1,7 @@
###############################################################################
# #
# IPFire.org - A linux based firewall #
-# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> #
+# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> #
# #
# This program is free software: you can redistribute it and/or modify #
# it under the terms of the GNU General Public License as published by #
@@ -24,7 +24,7 @@
include Config
-VER = 3470200
+VER = 3490100
THISAPP = sqlite-autoconf-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 3c2ea6cba87f5850a9c2355cc213182d351a9d7b26687f77c07178526b300eec19040804a713e6fa3db704dcb4e0e4921ef849f6bc14496adcfc22875048c640
+$(DL_FILE)_BLAKE2 = 08f9379977b9a7962de5283cb532ecdd500e6e9b00d5e64e14e323777b47ea90e15745528d441328b7907060b7f594dc5054b327b471189477e595c0575c43a0
install : $(TARGET)
--
2.48.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] openssh: Update to version 9.9p2
2025-02-19 13:30 [PATCH] openssh: Update to version 9.9p2 Adolf Belka
2025-02-19 13:30 ` [PATCH] sqlite: Update to version 3490100 Adolf Belka
@ 2025-02-19 15:36 ` Michael Tremer
1 sibling, 0 replies; 3+ messages in thread
From: Michael Tremer @ 2025-02-19 15:36 UTC (permalink / raw)
To: development
[-- Attachment #1: Type: text/plain, Size: 3150 bytes --]
Thank you. I merged this patch into Core Update 192.
I don’t think these are that hot for us, but let’s rather be safe than sorry.
-Michael
> On 19 Feb 2025, at 13:30, Adolf Belka <adolf.belka(a)ipfire.org> wrote:
>
> - Update from version 9.9p1 to 9.9p2
> - Update of rootfile not required
> - Changelog
> 9.9p2
> Security
> * Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1
> (inclusive) contained a logic error that allowed an on-path
> attacker (a.k.a MITM) to impersonate any server when the
> VerifyHostKeyDNS option is enabled. This option is off by default.
> * Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1
> (inclusive) is vulnerable to a memory/CPU denial-of-service related
> to the handling of SSH2_MSG_PING packets. This condition may be
> mitigated using the existing PerSourcePenalties feature.
> Both vulnerabilities were discovered and demonstrated to be exploitable
> by the Qualys Security Advisory team. We thank them for their detailed
> review of OpenSSH.
> Bugfixes
> * ssh(1), sshd(8): fix regression in Match directive that caused
> failures when predicates and their arguments were separated by '='
> characters instead of whitespace (bz3739).
> * sshd(8): fix the "Match invalid-user" predicate, which was matching
> incorrectly in the initial pass of config evaluation.
> * ssh(1), sshd(8), ssh-keyscan(1): fix mlkem768x25519-sha256 key
> exchange on big-endian systems.
> * Fix a number of build problems on particular operating systems /
> configurations.
>
> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
> ---
> lfs/openssh | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/lfs/openssh b/lfs/openssh
> index b1c9a1635..f2165a96d 100644
> --- a/lfs/openssh
> +++ b/lfs/openssh
> @@ -1,7 +1,7 @@
> ###############################################################################
> # #
> # IPFire.org - A linux based firewall #
> -# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> #
> +# Copyright (C) 2007-2025 IPFire Team <info(a)ipfire.org> #
> # #
> # This program is free software: you can redistribute it and/or modify #
> # it under the terms of the GNU General Public License as published by #
> @@ -24,7 +24,7 @@
>
> include Config
>
> -VER = 9.9p1
> +VER = 9.9p2
>
> THISAPP = openssh-$(VER)
> DL_FILE = $(THISAPP).tar.gz
> @@ -40,7 +40,7 @@ objects = $(DL_FILE)
>
> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
>
> -$(DL_FILE)_BLAKE2 = 817d267e42b8be74a13e0cfd7999bdb4dab6355c7f62c1a4dd89adad310c5fb7fe3f17109ce1a36cd269a3639c1b8f1d18330c615ab3b419253ec027cfa20997
> +$(DL_FILE)_BLAKE2 = 1b5bc09482b3a807ccfee52c86c6be3c363acf0c8e774862e0ae64f76bfeb4ce7cf29b3ed2f99c04c89bb4977da0cf50a7a175b15bf1d9925de1e03c66f8306d
>
> install : $(TARGET)
>
> --
> 2.48.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-02-19 15:36 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-02-19 13:30 [PATCH] openssh: Update to version 9.9p2 Adolf Belka
2025-02-19 13:30 ` [PATCH] sqlite: Update to version 3490100 Adolf Belka
2025-02-19 15:36 ` [PATCH] openssh: Update to version 9.9p2 Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox