Development March 2024

development@lists.ipfire.org

11 participants
55 discussions

[PATCH] intel-microcode: Update to version 20240312
by Adolf Belka 13 Mar '24

13 Mar '24

- Update from version 20231114 to 20240312 - Update of rootfile - For the changelog details see the releasenote.md file in the source tarball. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/x86_64/intel-microcode | 5 ++++- lfs/intel-microcode | 6 +++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/common/x86_64/intel-microcode b/config/rootfiles/common/x86_64/intel-microcode index 7f9632973..5037ac6a8 100644 --- a/config/rootfiles/common/x86_64/intel-microcode +++ b/config/rootfiles/common/x86_64/intel-microcode @@ -95,7 +95,6 @@ lib/firmware/intel-ucode/06-8e-09 lib/firmware/intel-ucode/06-8e-0a lib/firmware/intel-ucode/06-8e-0b lib/firmware/intel-ucode/06-8e-0c -lib/firmware/intel-ucode/06-8f-04 lib/firmware/intel-ucode/06-8f-05 lib/firmware/intel-ucode/06-8f-06 lib/firmware/intel-ucode/06-8f-07 @@ -117,12 +116,16 @@ lib/firmware/intel-ucode/06-a5-05 lib/firmware/intel-ucode/06-a6-00 lib/firmware/intel-ucode/06-a6-01 lib/firmware/intel-ucode/06-a7-01 +lib/firmware/intel-ucode/06-aa-04 lib/firmware/intel-ucode/06-b7-01 lib/firmware/intel-ucode/06-ba-02 lib/firmware/intel-ucode/06-ba-03 +lib/firmware/intel-ucode/06-ba-08 lib/firmware/intel-ucode/06-be-00 lib/firmware/intel-ucode/06-bf-02 lib/firmware/intel-ucode/06-bf-05 +lib/firmware/intel-ucode/06-cf-01 +lib/firmware/intel-ucode/06-cf-02 lib/firmware/intel-ucode/0f-00-07 lib/firmware/intel-ucode/0f-00-0a lib/firmware/intel-ucode/0f-01-02 diff --git a/lfs/intel-microcode b/lfs/intel-microcode index 5e262dda3..785b2303b 100644 --- a/lfs/intel-microcode +++ b/lfs/intel-microcode @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 20231114 +VER = 20240312 THISAPP = Intel-Linux-Processor-Microcode-Data-Files-microcode-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -41,7 +41,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = e6084c92e9c3cc627af25a7f2f7fb26230b6ed117ddc197d19991df2816334132af92925f23af829bad005c32d0bd3afc362055ef223a599799d846216cf7612 +$(DL_FILE)_BLAKE2 = 43c771becef0f6dbfd41bf78a9a3cc8f6679a43ea48765d0e7f555c138dca6e3db42a4d33f743d8d51f38b0b6aa69322bba0c00ae9f1ff4c533b52166ee54747 install : $(TARGET) -- 2.44.0

1 0

Fwd: [intel/Intel-Linux-Processor-Microcode-Data-Files] Release microcode-20240312 - microcode-20240312-staging Release
by Michael Tremer 13 Mar '24

13 Mar '24

Anyone up for this one? We might want to put this into the next update as there are some kernel patches floating around that might be connected to this issue. -Michael > Begin forwarded message: > > From: NayeliRico <notifications(a)github.com> > Subject: [intel/Intel-Linux-Processor-Microcode-Data-Files] Release microcode-20240312 - microcode-20240312-staging Release > Date: 12 March 2024 at 17:05:13 GMT > To: intel/Intel-Linux-Processor-Microcode-Data-Files <Intel-Linux-Processor-Microcode-Data-Files(a)noreply.github.com> > Cc: Subscribed <subscribed(a)noreply.github.com> > Reply-To: intel/Intel-Linux-Processor-Microcode-Data-Files <noreply(a)github.com> > > > microcode-20240312-staging Release <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/release…> > Repository: intel/Intel-Linux-Processor-Microcode-Data-Files <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files> · Tag: microcode-20240312 <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/tree/mi…> · Commit: 41af345 <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/commit/…> · Released by: NayeliRico <https://github.com/NayeliRico> > Release Notes > > microcode-20240312 <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/release…> > Purpose > > Security updates for INTEL-SA-INTEL-SA-00972 <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0…> > Security updates for INTEL-SA-INTEL-SA-00982 <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0…> > Security updates for INTEL-SA-INTEL-SA-00898 <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0…> > Security updates for INTEL-SA-INTEL-SA-00960 <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0…> > Security updates for INTEL-SA-INTEL-SA-01045 <https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0…> > Update for functional issues. Refer to Intel® Core™ Ultra Processor <https://cdrdv2.intel.com/v1/dl/getContent/792254> for details. > > Update for functional issues. Refer to 13th Generation Intel® Core™ Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/740518> for details. > > Update for functional issues. Refer to 12th Generation Intel® Core™ Processor Family <https://cdrdv2.intel.com/v1/dl/getContent/682436> for details. > > Update for functional issues. Refer to 11th Gen Intel® Core™ Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/631123> for details. > > Update for functional issues. Refer to 10th Gen Intel® Core™ Processor Families Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/341079> for details. > > Update for functional issues. Refer to 10th Generation Intel® Core™ Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/615213> for details. > > Update for functional issues. Refer to 8th and 9th Generation Intel® Core™ Processor Family Spec Update <https://cdrdv2.intel.com/v1/dl/getContent/337346> for details. > > Update for functional issues. Refer to 8th Generation Intel® Core™ Processor Families Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/338025> for details. > > Update for functional issues. Refer to 7th and 8th Generation Intel® Core™ Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/334663> for details. > > Update for functional issues. Refer to 5th Gen Intel® Xeon® Scalable Processors Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/793902> for details. > > Update for functional issues. Refer to 4th Gen Intel® Xeon® Scalable Processors Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/772415> for details. > > Update for functional issues. Refer to 3rd Generation Intel® Xeon® Scalable Processors Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/634897> for details. > > Update for functional issues. Refer to 3rd Generation Intel® Xeon® Processor Scalable Family Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/637780> for details. > > Update for functional issues. Refer to 2nd Generation Intel® Xeon® Processor Scalable Family Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/338848> for details. > > Update for functional issues. Refer to Intel® Processors and Intel® Core™ i3 N-Series <https://cdrdv2.intel.com/v1/dl/getContent/764616> for details. > > Update for functional issues. Refer to Intel® Xeon® D-2700 Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/714071> for details. > > Update for functional issues. Refer to Intel® Xeon® E-2300 Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/709192>for details. > > Update for functional issues. Refer to Intel® Xeon® Processor Scalable Family Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/613537> for details. > > Update for functional issues. Refer to Intel® Atom® C3000 Processor Product Family Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/336345> for details. > > Update for functional issues. Refer to Intel® Atom® x6000E Series, and Intel® Pentium® and Celeron® N and J Series Processors for Internet of Things (IoT) Applications <https://cdrdv2.intel.com/v1/dl/getContent/636674> for details. > > Update for functional issues. Refer to Intel® Pentium® Silver and Intel® Celeron® Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/336562> for details. > > Update for functional issues. Refer to Intel® Pentium® Silver and Intel® Celeron® Processor Specification Update <https://cdrdv2.intel.com/v1/dl/getContent/634542> for details. > > New Platforms > > Processor Stepping F-M-S/PI Old Ver New Ver Products > EMR-SP A-1 06-cf-02/87 21000200 Xeon Scalable Gen5 > EMR-SP A-0 06-cf-01/87 21000200 Xeon Scalable Gen5 > MTL C-0 06-aa-04/e6 0000001c Core™ Ultra Processor > Updated Platforms > > Processor Stepping F-M-S/PI Old Ver New Ver Products > ADL C0 06-97-02/07 00000032 00000034 Core Gen12 > ADL H0 06-97-05/07 00000032 00000034 Core Gen12 > ADL L0 06-9a-03/80 00000430 00000432 Core Gen12 > ADL R0 06-9a-04/80 00000430 00000432 Core Gen12 > ADL-N N0 06-be-00/11 00000012 00000015 Core i3-N305/N300, N50/N97/N100/N200, Atom x7211E/x7213E/x7425E > AML-Y42 V0 06-8e-0c/94 000000f8 000000fa Core Gen10 Mobile > BDX-NS A1 06-56-05/10 0e000014 0e000015 Xeon D-1513N/23/33/43/53 > CFL-H R0 06-9e-0d/22 000000fa 000000fc Core Gen9 Mobile > CFL-H/S P0 06-9e-0c/22 000000f4 000000f6 Core Gen9 > CFL-H/S/E3 U0 06-9e-0a/22 000000f4 000000f6 Core Gen8 Desktop, Mobile, Xeon E > CFL-S P0 06-9e-0c/22 000000f4 000000f6 Core Gen9 Desktop > CLX-SP B0 06-55-06/bf 04003604 04003605 Xeon Scalable Gen2 > CLX-SP B1 06-55-07/bf 05003604 05003605 Xeon Scalable Gen2 > CML-H R1 06-a5-02/20 000000f8 000000fa Core Gen10 Mobile > CML-S102 Q0 06-a5-05/22 000000f8 000000fa Core Gen10 > CML-S62 G1 06-a5-03/22 000000f8 000000fa Core Gen10 > CML-U42 V0 06-8e-0c/94 000000f8 000000fa Core Gen10 Mobile > CML-U62 V1 A0 06-a6-00/80 000000f8 000000fa Core Gen10 Mobile > CML-U62 V2 K1 06-a6-01/80 000000f8 000000fa Core Gen10 Mobile > CML-Y42 V0 06-8e-0c/94 000000f8 000000fa Core Gen10 Mobile > CPX-SP A1 06-55-0b/bf 07002703 07002802 Xeon Scalable Gen3 > DNV B0 06-5f-01/01 00000038 0000003e Atom C Series > EHL B1 06-96-01/01 00000017 00000019 Pentium J6426/N6415, Celeron J6412/J6413/N6210/N6211, Atom x6000E > GLK B0 06-7a-01/01 0000003e 00000040 Pentium Silver N/J5xxx, Celeron N/J4xxx > GLK-R R0 06-7a-08/01 00000022 00000024 Pentium J5040/N5030, Celeron J4125/J4025/N4020/N4120 > ICL-D B0 06-6c-01/10 01000268 01000290 Xeon D-17xx, D-27xx > ICL-U/Y D1 06-7e-05/80 000000c2 000000c4 Core Gen10 Mobile > ICX-SP Dx/M1 06-6a-06/87 0d0003b9 0d0003d1 Xeon Scalable Gen3 > JSL A0/A1 06-9c-00/01 24000024 24000026 Pentium N6000/N6005, Celeron N4500/N4505/N5100/N5105 > KBL-G/H/S/X/E3 B0 06-9e-09/2a 000000f4 000000f8 Core Gen7; Xeon E3 v6 > RPL-H/P/PX 6+8 J0 06-ba-02/e0 0000411c 00004121 Core Gen13 > RPL-S B0 06-b7-01/32 0000011d 00000122 Core Gen13 > RPL-S H0 06-bf-05/07 00000032 00000034 Core Gen12 > RKL-S B0 06-a7-01/02 0000005d 0000005e Core Gen11 > RPL-S/HX C0 06-bf-02/07 00000032 00000034 Core Gen12 > RPL-U 2+8 Q0 06-ba-03/e0 0000411c 00004121 Core Gen13 > SKX-SP B1 06-55-03/97 01000181 01000191 Xeon Scalable > SPR-SP E5/S3 06-8f-08/87 2b0004d0 2b000590 Xeon Scalable Gen4 > SPR-SP E4/S2 06-8f-07/87 2b0004d0 2b000590 Xeon Scalable Gen4 > SPR-SP E3 06-8f-06/87 2b0004d0 2b000590 Xeon Scalable Gen4 > SPR-SP E2 06-8f-05/87 2b0004d0 2b000590 Xeon Scalable Gen4 > TGL B0/B1 06-8c-01/80 000000b4 000000b6 Core Gen11 Mobile > TGL-H R0 06-8d-01/c2 0000004e 00000050 Core Gen11 Mobile > TGL-R C0 06-8c-02/c2 00000034 00000036 Core Gen11 Mobile > WHL-U V0 06-8e-0c/94 000000f8 000000fa Core Gen8 Mobile > — > This release has 2 assets: > > Source code (zip) > Source code (tar.gz) > Visit the release page <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/release…> to download them. > > — > You are receiving this because you are watching this repository. > View it on GitHub <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/release…> or unsubscribe <https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/unsubsc…> from all notifications for this repository. >

2 2

[PATCH] manualpages: update wiki url
by Jon Murphy 12 Mar '24

12 Mar '24

Suggested-by: Leo-Andres Hofmann <hofmann(a)leo-andres.de> Signed-off-by: Jon Murphy <jon.murphy(a)ipfire.org> --- config/cfgroot/manualpages | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/cfgroot/manualpages b/config/cfgroot/manualpages index fe5ebc0b8..f70381f12 100644 --- a/config/cfgroot/manualpages +++ b/config/cfgroot/manualpages @@ -2,7 +2,7 @@ # The CGI files are referenced relative to the "/cgi-bin/" path # Fixed base URL (without trailing slash) -BASE_URL=https://wiki.ipfire.org +BASE_URL=https://www.ipfire.org/docs # System menu index.cgi=configuration/system/startpage -- 2.30.2

1 0

[PATCH] elfutils: Update to version 0.191
by Adolf Belka 12 Mar '24

12 Mar '24

- Update from version 0.190 to 0.191 - Update of rootfile - Changelog 0.191 libdw: dwarf_addrdie now supports binaries lacking a .debug_aranges section. Improved support for DWARF package files. Add new function dwarf_cu_dwp_section_info. debuginfod: Caching eviction logic improvements to improve retention of small/frequent/slow files such as Fedora's vdso.debug. srcfiles: Can now fetch the source files of a DWARF/ELF file and place them into a zip. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/elfutils | 7 ++++--- lfs/elfutils | 4 ++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/config/rootfiles/common/elfutils b/config/rootfiles/common/elfutils index 830638e2b..fce1549dc 100644 --- a/config/rootfiles/common/elfutils +++ b/config/rootfiles/common/elfutils @@ -28,15 +28,15 @@ #usr/include/gelf.h #usr/include/libelf.h #usr/include/nlist.h -usr/lib/libasm-0.190.so +usr/lib/libasm-0.191.so #usr/lib/libasm.a #usr/lib/libasm.so usr/lib/libasm.so.1 -usr/lib/libdw-0.190.so +usr/lib/libdw-0.191.so #usr/lib/libdw.a #usr/lib/libdw.so usr/lib/libdw.so.1 -usr/lib/libelf-0.190.so +usr/lib/libelf-0.191.so #usr/lib/libelf.a #usr/lib/libelf.so usr/lib/libelf.so.1 @@ -56,3 +56,4 @@ usr/lib/libelf.so.1 #usr/share/man/man3/elf_clone.3 #usr/share/man/man3/elf_getdata.3 #usr/share/man/man3/elf_update.3 + diff --git a/lfs/elfutils b/lfs/elfutils index 7dd95caa2..901b82d42 100644 --- a/lfs/elfutils +++ b/lfs/elfutils @@ -26,7 +26,7 @@ include Config SUMMARY = Higher-level library to access ELF files -VER = 0.190 +VER = 0.191 THISAPP = elfutils-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -42,7 +42,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 9934aff08f1898377708b28595fb52130ef9f80408132ac7d306845b10672ba45cf1ac69783da07b3eea9fd647741d44da45b8b2626c45a768cb2844c6186513 +$(DL_FILE)_BLAKE2 = 2a7ad251369eca7ba609ab8644181fd479ad8596ee58dc068398ca22be25a978e96b81a10a92a5555d7574fd1b9227c8d54fb41dceb4025aedfc6ae32870bbca install : $(TARGET) -- 2.44.0

2 9

[PATCH] openssh: Update to version 9.7p1
by Adolf Belka 12 Mar '24

12 Mar '24

- Update from version 9.6p1 to 9.7p1 - Update of rootfile not required - Changelog 9.7p1 Future deprecation notice OpenSSH plans to remove support for the DSA signature algorithm in early 2025 and compile-time disable it later this year. DSA, as specified in the SSHv2 protocol, is inherently weak - being limited to a 160 bit private key and use of the SHA1 digest. Its estimated security level is only 80 bits symmetric equivalent. OpenSSH has disabled DSA keys by default since 2015 but has retained run-time optional support for them. DSA was the only mandatory-to- implement algorithm in the SSHv2 RFCs[3], mostly because alternative algorithms were encumbered by patents when the SSHv2 protocol was specified. This has not been the case for decades at this point and better algorithms are well supported by all actively-maintained SSH implementations. We do not consider the costs of maintaining DSA in OpenSSH to be justified and hope that removing it from OpenSSH can accelerate its wider deprecation in supporting cryptography libraries. This release makes DSA support in OpenSSH compile-time optional, defaulting to on. We intend the next release to change the default to disable DSA at compile time. The first OpenSSH release of 2025 will remove DSA support entirely. This release contains mostly bugfixes. New features * ssh(1), sshd(8): add a "global" ChannelTimeout type that watches all open channels and will close all open channels if there is no traffic on any of them for the specified interval. This is in addition to the existing per-channel timeouts added recently. This supports situations like having both session and x11 forwarding channels open where one may be idle for an extended period but the other is actively used. The global timeout could close both channels when both have been idle for too long. * All: make DSA key support compile-time optional, defaulting to on. Bugfixes * sshd(8): don't append an unnecessary space to the end of subsystem arguments (bz3667) * ssh(1): fix the multiplexing "channel proxy" mode, broken when keystroke timing obfuscation was added. (GHPR#463) * ssh(1), sshd(8): fix spurious configuration parsing errors when options that accept array arguments are overridden (bz3657). * ssh-agent(1): fix potential spin in signal handler (bz3670) * Many fixes to manual pages and other documentation, including GHPR#462, GHPR#454, GHPR#442 and GHPR#441. * Greatly improve interop testing against PuTTY. Portability * Improve the error message when the autoconf OpenSSL header check fails (bz#3668) * Improve detection of broken toolchain -fzero-call-used-regs support (bz3645). * Fix regress/misc/fuzz-harness fuzzers and make them compile without warnings when using clang16 Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/openssh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/openssh b/lfs/openssh index 3833f2ca7..315b1a70b 100644 --- a/lfs/openssh +++ b/lfs/openssh @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 9.6p1 +VER = 9.7p1 THISAPP = openssh-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = dd7f6747fe89f7b386be4faaf7fc43398a9bf439e45608ae61c2126cf8743c64ef7b5af45c75e9007b0bda525f8809261ca0f2fc47ce60177ba769a5324719dd +$(DL_FILE)_BLAKE2 = 520859fcbdf678808fc8515b64585ab9a90a8055fa869df6fbba3083cb7f73ddb81ed9ea981e131520736a8aed838f85ae68ca63406a410df61039913c5cb48b install : $(TARGET) -- 2.44.0

2 1

Fwd: [openssh-unix-announce] Announce: OpenSSH 9.7 released
by Michael Tremer 11 Mar '24

11 Mar '24

Is anyone happy to grab this one? > Begin forwarded message: > > From: Damien Miller <djm(a)cvs.openbsd.org> > Subject: [openssh-unix-announce] Announce: OpenSSH 9.7 released > Date: 11 March 2024 at 10:41:13 GMT > To: openssh-unix-announce(a)mindrot.org > > OpenSSH 9.7 has just been released. It will be available from the > mirrors listed at https://www.openssh.com/ shortly. > > OpenSSH is a 100% complete SSH protocol 2.0 implementation and > includes sftp client and server support. > > Once again, we would like to thank the OpenSSH community for their > continued support of the project, especially those who contributed > code or patches, reported bugs, tested snapshots or donated to the > project. More information on donations may be found at: > https://www.openssh.com/donations.html > > Future deprecation notice > ========================= > > OpenSSH plans to remove support for the DSA signature algorithm in > early 2025 and compile-time disable it later this year. > > DSA, as specified in the SSHv2 protocol, is inherently weak - being > limited to a 160 bit private key and use of the SHA1 digest. Its > estimated security level is only 80 bits symmetric equivalent. > > OpenSSH has disabled DSA keys by default since 2015 but has retained > run-time optional support for them. DSA was the only mandatory-to- > implement algorithm in the SSHv2 RFCs[3], mostly because alternative > algorithms were encumbered by patents when the SSHv2 protocol was > specified. > > This has not been the case for decades at this point and better > algorithms are well supported by all actively-maintained SSH > implementations. We do not consider the costs of maintaining DSA in > OpenSSH to be justified and hope that removing it from OpenSSH can > accelerate its wider deprecation in supporting cryptography > libraries. > > This release makes DSA support in OpenSSH compile-time optional, > defaulting to on. We intend the next release to change the default > to disable DSA at compile time. The first OpenSSH release of 2025 > will remove DSA support entirely. > > Changes since OpenSSH 9.6 > ========================= > > This release contains mostly bugfixes. > > New features > ------------ > > * ssh(1), sshd(8): add a "global" ChannelTimeout type that watches > all open channels and will close all open channels if there is no > traffic on any of them for the specified interval. This is in > addition to the existing per-channel timeouts added recently. > > This supports situations like having both session and x11 > forwarding channels open where one may be idle for an extended > period but the other is actively used. The global timeout could > close both channels when both have been idle for too long. > > * All: make DSA key support compile-time optional, defaulting to on. > > Bugfixes > -------- > > * sshd(8): don't append an unnecessary space to the end of subsystem > arguments (bz3667) > > * ssh(1): fix the multiplexing "channel proxy" mode, broken when > keystroke timing obfuscation was added. (GHPR#463) > > * ssh(1), sshd(8): fix spurious configuration parsing errors when > options that accept array arguments are overridden (bz3657). > > * ssh-agent(1): fix potential spin in signal handler (bz3670) > > * Many fixes to manual pages and other documentation, including > GHPR#462, GHPR#454, GHPR#442 and GHPR#441. > > * Greatly improve interop testing against PuTTY. > > Portability > ----------- > > * Improve the error message when the autoconf OpenSSL header check > fails (bz#3668) > > * Improve detection of broken toolchain -fzero-call-used-regs support > (bz3645). > > * Fix regress/misc/fuzz-harness fuzzers and make them compile without > warnings when using clang16 > > Checksums: > ========== > > - SHA1 (openssh-9.7.tar.gz) = 163272058edc20a8fde81661734a6684c9b4db11 > - SHA256 (openssh-9.7.tar.gz) = gXDWrF4wN2UWyPjyjvVhpjjKd7D2qI6LyZiIYhbJQVg= > > - SHA1 (openssh-9.7p1.tar.gz) = ce8985ea0ea2f16a5917fd982ade0972848373cc > - SHA256 (openssh-9.7p1.tar.gz) = SQQm92bYKidj/KzY2D6j1weYdQx70q/y5X3FZg93P/0= > > Please note that the SHA256 signatures are base64 encoded and not > hexadecimal (which is the default for most checksum tools). The PGP > key used to sign the releases is available from the mirror sites: > https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/RELEASE_KEY.asc > > Reporting Bugs: > =============== > > - Please read https://www.openssh.com/report.html > Security bugs should be reported directly to openssh(a)openssh.com > _______________________________________________ > openssh-unix-announce mailing list > openssh-unix-announce(a)mindrot.org > https://lists.mindrot.org/mailman/listinfo/openssh-unix-announce

2 2

[PATCH] unbound: Update to 1.19.2
by Matthias Fischer 09 Mar '24

09 Mar '24

For details see: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-19-2 "Bug Fixes Fix CVE-2024-1931, Denial of service when trimming EDE text on positive replies." Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/rootfiles/common/unbound | 2 +- lfs/unbound | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index 1badd605a..f5274dcd1 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.8 -usr/lib/libunbound.so.8.1.24 +usr/lib/libunbound.so.8.1.25 #usr/lib/pkgconfig/libunbound.pc usr/sbin/unbound usr/sbin/unbound-anchor diff --git a/lfs/unbound b/lfs/unbound index b852f75b9..0a5106064 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -24,7 +24,7 @@ include Config -VER = 1.19.1 +VER = 1.19.2 THISAPP = unbound-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = a48c5b9493eb0a9aa2171956e08677e1cfb7c49b53731c1b05f9192434c4d815eba972aab110ba0ee25fee1e7a57192c8b48e59bb21fb76ad7fd1c7d2d260012 +$(DL_FILE)_BLAKE2 = f8dcee649e5e1dfaab9285964419b4d957f0035e484021e3131784512fed842ee46c25d7b47304aca4f03a0480877b939968bca22e80620434d1d2cb7013c9b6 install : $(TARGET) -- 2.34.1

2 1

[PATCH] squid: Update to 6.8
by Matthias Fischer 07 Mar '24

07 Mar '24

For details see: https://github.com/squid-cache/squid/commits/v6 Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/squid | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/squid b/lfs/squid index 3a2d1039c..882a8842e 100644 --- a/lfs/squid +++ b/lfs/squid @@ -24,7 +24,7 @@ include Config -VER = 6.7 +VER = 6.8 THISAPP = squid-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -46,7 +46,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f91b0f617b6b32138c33575d5daec0bc6dfcb0d356939b6c01e9d4c33b77886ffb55c38678f31aeed9bf4d5d5e488c751d41098b846a956383c8b6db8c851cab +$(DL_FILE)_BLAKE2 = 771de358d395a6b4bb5d94b02325755d1ba891c24f2cc1bdc80d91a73467a475c2cb7f0e1c24aed2f714c0de38858a24ac3864a5b772b6828beeb014da827d9d install : $(TARGET) -- 2.34.1

2 1

[PATCH] connscheduler.cgi: Remove cleanhtml command from Remark
by Adolf Belka 07 Mar '24

07 Mar '24

- Using cleanhtml on Remarks means that all characters with diacritical marks such as umlauts or grave accents etc get encoded into other characters. - If Freifunk München e.V. is entered as a remark it gets converted to Freifunk MÃ¼nchen e.V. - cleanhtml is only removed from Remarks or Comment fields. In other places it has been left in place. Tested-by: Adolf Belka <adolf.belka(a)ipfire.org> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- html/cgi-bin/connscheduler.cgi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/html/cgi-bin/connscheduler.cgi b/html/cgi-bin/connscheduler.cgi index cc78cbc1b..817247cc4 100644 --- a/html/cgi-bin/connscheduler.cgi +++ b/html/cgi-bin/connscheduler.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007 Michael Tremer & Christian Schmidt # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -186,7 +186,7 @@ if ( ($cgiparams{'ACTION'} eq 'add') || ($cgiparams{'ACTION'} eq 'update') ) $CONNSCHED::config[$i]{'DAYSTYPE'} = lc($cgiparams{'ACTION_DAYSTYPE'}); $CONNSCHED::config[$i]{'DAYS'} = $l_days; $CONNSCHED::config[$i]{'WEEKDAYS'} = $l_weekdays; - $CONNSCHED::config[$i]{'COMMENT'} = &Header::cleanhtml($cgiparams{'ACTION_COMMENT'}); + $CONNSCHED::config[$i]{'COMMENT'} = $cgiparams{'ACTION_COMMENT'}; &CONNSCHED::WriteConfig; } -- 2.44.0

2 9

[PATCH] ethtool: Update to version 6.7
by Adolf Belka 05 Mar '24

05 Mar '24

- Update from version 6.3 to 6.7 - Update of rootfile not required - Changelog 6.7 - January 29, 2024 * Feature: support for setting TCP data split * Fix: fix new gcc14 warning * Fix: fix SFF-8472 transceiver module identification (-m) * Misc: code cleanup 6.6 - November 23, 2023 * Feature: support for more CMIS transceiver modules (-m) * Fix: fix build on systems with old kernel uapi headers 6.5 - September 12, 2023 * Feature: register dump for hns3 driver (-d) * Fix: fix fallback to ioctl for sset (-s) * Fix: fix empty slot search in rmgr (-N) 6.4 - July 1, 2023 * Feature: get/set Tx push buffer length (-G) * Feature: sff-8636 and cmis: report LOL / LOS / Tx Fault (-m) * Fix: fix duplex setting parser (-s) * Misc: check and require C11 language standard * Misc: clean up obsolete pre-build checks Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/ethtool | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/ethtool b/lfs/ethtool index e6d65ea12..c6b54aa4e 100644 --- a/lfs/ethtool +++ b/lfs/ethtool @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 6.3 +VER = 6.7 THISAPP = ethtool-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = c06509525db47f8ee7c220d0b880fe80323a4a00036e9698432b1b9c85ad75045e98b23498f6283497728cafd187ca173b15f3ad60f8e6f8b4d0c5688d84a1f9 +$(DL_FILE)_BLAKE2 = 94a6fd8d29ff479eb894fe56bf991f522fff9af5a94c176d06be2819fe2520125cb48dbded229df1a9f5a0308aeaec503c55caf5d248eef87640c7f90f1132ec install : $(TARGET) -- 2.44.0

1 8

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development March 2024