IPFire-SCM

ipfire-scm@lists.ipfire.org

7876 discussions

[git.ipfire.org] IPFire 2.x development tree branch, core89, updated. 7f024f5e46e24d67a3b64dc12d8110b5b3d0ce8c
by git＠ipfire.org 22 Mar '15

22 Mar '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core89 has been updated via 7f024f5e46e24d67a3b64dc12d8110b5b3d0ce8c (commit) from 810fb1046c1253c74ff41527509dc1c46b0f4426 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 7f024f5e46e24d67a3b64dc12d8110b5b3d0ce8c Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Sun Mar 22 21:48:07 2015 +0100 core89: move ddns.cgi call after language cache update. ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/89/update.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) Difference in files: diff --git a/config/rootfiles/core/89/update.sh b/config/rootfiles/core/89/update.sh index f3de863..9bf6c1d 100644 --- a/config/rootfiles/core/89/update.sh +++ b/config/rootfiles/core/89/update.sh @@ -39,9 +39,6 @@ done # Extract files extract_files -# Generate ddns configuration file -sudo -u nobody /srv/web/ipfire/cgi-bin/ddns.cgi - # Start services /etc/init.d/dnsmasq restart if [ `grep "ENABLED=on" /var/ipfire/vpn/settings` ]; then @@ -59,6 +56,9 @@ rm -f \ # Fix #10625 mkdir -p /etc/logrotate.d +# Generate ddns configuration file +sudo -u nobody /srv/web/ipfire/cgi-bin/ddns.cgi + sync # This update need a reboot... hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core89, updated. 810fb1046c1253c74ff41527509dc1c46b0f4426
by git＠ipfire.org 20 Mar '15

20 Mar '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core89 has been updated via 810fb1046c1253c74ff41527509dc1c46b0f4426 (commit) via 0ffeaa13a64b3dc4eabe404bfac8b3767616e268 (commit) from 78a620c82b6c179e60f484599de82b6adfbf900a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 810fb1046c1253c74ff41527509dc1c46b0f4426 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Fri Mar 20 18:53:44 2015 +0100 ddns.cgi: Drop code for proto handling. commit 0ffeaa13a64b3dc4eabe404bfac8b3767616e268 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Mar 20 19:04:33 2015 +0100 Revert "dnsmasq: Enable DNSSEC timestamp feature" This reverts commit de7abd2cd52e3751ac94d5d56ae9ff510311fc67. ----------------------------------------------------------------------- Summary of changes: html/cgi-bin/ddns.cgi | 5 ----- src/initscripts/init.d/dnsmasq | 2 +- 2 files changed, 1 insertion(+), 6 deletions(-) Difference in files: diff --git a/html/cgi-bin/ddns.cgi b/html/cgi-bin/ddns.cgi index 044aa97..3e6f72f 100644 --- a/html/cgi-bin/ddns.cgi +++ b/html/cgi-bin/ddns.cgi @@ -700,11 +700,6 @@ sub GenerateDDNSConfigFile { print FILE "password = $password\n"; } - # These providers need to be set to only use IPv4. - if ($provider ~~ ["freedns.afraid.org", "nsupdate.info", "opendns.com", "variomedia.de", "zoneedit.com"]) { - print FILE "proto = ipv4\n"; - } - print FILE "\n"; } diff --git a/src/initscripts/init.d/dnsmasq b/src/initscripts/init.d/dnsmasq index 4e37925..48b9d19 100644 --- a/src/initscripts/init.d/dnsmasq +++ b/src/initscripts/init.d/dnsmasq @@ -26,7 +26,7 @@ SHOW_SRV=1 TRUST_ANCHOR=".,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5" function dnssec_args() { - local cmdline="--dnssec --dnssec-timestamp" + local cmdline="--dnssec" if [ -n "${TRUST_ANCHOR}" ]; then cmdline="${cmdline} --trust-anchor=${TRUST_ANCHOR}" hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core89, updated. 78a620c82b6c179e60f484599de82b6adfbf900a
by git＠ipfire.org 20 Mar '15

20 Mar '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core89 has been updated via 78a620c82b6c179e60f484599de82b6adfbf900a (commit) from 0e1fcef0180f7b6542be989f2c53db27c3cdd522 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 78a620c82b6c179e60f484599de82b6adfbf900a Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Mar 20 19:00:20 2015 +0100 core89: don't overwrite ddns.conf. ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/89/exclude | 1 + 1 file changed, 1 insertion(+) Difference in files: diff --git a/config/rootfiles/core/89/exclude b/config/rootfiles/core/89/exclude index 18e9b4d..b8e966d 100644 --- a/config/rootfiles/core/89/exclude +++ b/config/rootfiles/core/89/exclude @@ -14,6 +14,7 @@ etc/sysconfig/firewall.local etc/sysconfig/rc.local etc/udev/rules.d/30-persistent-network.rules srv/web/ipfire/html/proxy.pac +var/ipfire/ddns/ddns.conf var/ipfire/ovpn var/log/cache var/state/dhcp/dhcpd.leases hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 3b9b58f95646c95b0fd7b2e8de90d074cb70cc70
by git＠ipfire.org 20 Mar '15

20 Mar '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 3b9b58f95646c95b0fd7b2e8de90d074cb70cc70 (commit) from 79cfa337b16e54e86b7812fb0166639759af29fe (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3b9b58f95646c95b0fd7b2e8de90d074cb70cc70 Author: Stefan Schantl <stefan.schantl(a)ipfire.org> Date: Fri Mar 20 18:53:44 2015 +0100 ddns.cgi: Drop code for proto handling. ----------------------------------------------------------------------- Summary of changes: html/cgi-bin/ddns.cgi | 5 ----- 1 file changed, 5 deletions(-) Difference in files: diff --git a/html/cgi-bin/ddns.cgi b/html/cgi-bin/ddns.cgi index 044aa97..3e6f72f 100644 --- a/html/cgi-bin/ddns.cgi +++ b/html/cgi-bin/ddns.cgi @@ -700,11 +700,6 @@ sub GenerateDDNSConfigFile { print FILE "password = $password\n"; } - # These providers need to be set to only use IPv4. - if ($provider ~~ ["freedns.afraid.org", "nsupdate.info", "opendns.com", "variomedia.de", "zoneedit.com"]) { - print FILE "proto = ipv4\n"; - } - print FILE "\n"; } hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core89, updated. 0e1fcef0180f7b6542be989f2c53db27c3cdd522
by git＠ipfire.org 20 Mar '15

20 Mar '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core89 has been updated via 0e1fcef0180f7b6542be989f2c53db27c3cdd522 (commit) from 5f7a8b7e1cf7d665fc4df8757bf54d5d08903a88 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0e1fcef0180f7b6542be989f2c53db27c3cdd522 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Mar 20 11:20:45 2015 +0100 set version to IPFire-2.17 core89 ----------------------------------------------------------------------- Summary of changes: make.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Difference in files: diff --git a/make.sh b/make.sh index d049888..4deb3c8 100755 --- a/make.sh +++ b/make.sh @@ -25,8 +25,8 @@ NAME="IPFire" # Software name SNAME="ipfire" # Short name VERSION="2.17" # Version number -CORE="88" # Core Level (Filename) -PAKFIRE_CORE="88" # Core Level (PAKFIRE) +CORE="89" # Core Level (Filename) +PAKFIRE_CORE="89" # Core Level (PAKFIRE) GIT_BRANCH=`git rev-parse --abbrev-ref HEAD` # Git Branch SLOGAN="www.ipfire.org" # Software slogan CONFIG_ROOT=/var/ipfire # Configuration rootdir hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 0e1fcef0180f7b6542be989f2c53db27c3cdd522
by git＠ipfire.org 20 Mar '15

20 Mar '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 0e1fcef0180f7b6542be989f2c53db27c3cdd522 (commit) from 5f7a8b7e1cf7d665fc4df8757bf54d5d08903a88 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0e1fcef0180f7b6542be989f2c53db27c3cdd522 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Fri Mar 20 11:20:45 2015 +0100 set version to IPFire-2.17 core89 ----------------------------------------------------------------------- Summary of changes: make.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Difference in files: diff --git a/make.sh b/make.sh index d049888..4deb3c8 100755 --- a/make.sh +++ b/make.sh @@ -25,8 +25,8 @@ NAME="IPFire" # Software name SNAME="ipfire" # Short name VERSION="2.17" # Version number -CORE="88" # Core Level (Filename) -PAKFIRE_CORE="88" # Core Level (PAKFIRE) +CORE="89" # Core Level (Filename) +PAKFIRE_CORE="89" # Core Level (PAKFIRE) GIT_BRANCH=`git rev-parse --abbrev-ref HEAD` # Git Branch SLOGAN="www.ipfire.org" # Software slogan CONFIG_ROOT=/var/ipfire # Configuration rootdir hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree tag, v2.17-core89, created. 5f7a8b7e1cf7d665fc4df8757bf54d5d08903a88
by git＠ipfire.org 20 Mar '15

20 Mar '15

1 0

[git.ipfire.org] IPFire 2.x development tree branch, core89, created. 5f7a8b7e1cf7d665fc4df8757bf54d5d08903a88
by git＠ipfire.org 20 Mar '15

20 Mar '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core89 has been created at 5f7a8b7e1cf7d665fc4df8757bf54d5d08903a88 (commit) - Log ----------------------------------------------------------------- commit 5f7a8b7e1cf7d665fc4df8757bf54d5d08903a88 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 19 19:16:33 2015 +0100 openssl: Fix soname version of build commit 506e4b967127485c89272751b7d870a9bd4c7b47 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Mar 19 16:04:35 2015 +0100 openssl: Rebase "disable SSLv2, SSLv3" patch commit 498b3cd3a85f0f3aba3297cbf786a12fb26bf1f6 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Mar 19 16:03:58 2015 +0100 openssl: Remove "fix parallel build" patch commit a0297133a1f2a6f98efbe2eec353015e2316f45d Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Mar 19 15:54:43 2015 +0100 openssl: Update weak-ciphers and build patches commit 03d4ff6007bd06868a7ea6ae4a113a043aa1087b Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Mar 19 15:47:13 2015 +0100 openssl: Remove support for cryptodev The patches won't apply any more and there does not seem support from upstream for the latest versions of OpenSSL commit 9ffd1b35db13760ceab2b396230fbc40fa03caec Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Thu Mar 19 15:13:07 2015 +0100 openssl: Update to version 1.0.1m and 0.9.8zf http://openssl.org/news/secadv_20150319.txt OpenSSL Security Advisory [19 Mar 2015] ======================================= OpenSSL 1.0.2 ClientHello sigalgs DoS (CVE-2015-0291) ===================================================== Severity: High If a client connects to an OpenSSL 1.0.2 server and renegotiates with an invalid signature algorithms extension a NULL pointer dereference will occur. This can be exploited in a DoS attack against the server. This issue affects OpenSSL version: 1.0.2 OpenSSL 1.0.2 users should upgrade to 1.0.2a. This issue was was reported to OpenSSL on 26th February 2015 by David Ramos of Stanford University. The fix was developed by Stephen Henson and Matt Caswell of the OpenSSL development team. Reclassified: RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204) ============================================================================ Severity: High This security issue was previously announced by the OpenSSL project and classified as "low" severity. This severity rating has now been changed to "high". This was classified low because it was originally thought that server RSA export ciphersuite support was rare: a client was only vulnerable to a MITM attack against a server which supports an RSA export ciphersuite. Recent studies have shown that RSA export ciphersuites support is far more common. This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8. OpenSSL 1.0.1 users should upgrade to 1.0.1k. OpenSSL 1.0.0 users should upgrade to 1.0.0p. OpenSSL 0.9.8 users should upgrade to 0.9.8zd. This issue was reported to OpenSSL on 22nd October 2014 by Karthikeyan Bhargavan of the PROSECCO team at INRIA. The fix was developed by Stephen Henson of the OpenSSL core team. It was previously announced in the OpenSSL security advisory on 8th January 2015. Multiblock corrupted pointer (CVE-2015-0290) ============================================ Severity: Moderate OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This feature only applies on 64 bit x86 architecture platforms that support AES NI instructions. A defect in the implementation of "multiblock" can cause OpenSSL's internal write buffer to become incorrectly set to NULL when using non-blocking IO. Typically, when the user application is using a socket BIO for writing, this will only result in a failed connection. However if some other BIO is used then it is likely that a segmentation fault will be triggered, thus enabling a potential DoS attack. This issue affects OpenSSL version: 1.0.2 OpenSSL 1.0.2 users should upgrade to 1.0.2a. This issue was reported to OpenSSL on 13th February 2015 by Daniel Danner and Rainer Mueller. The fix was developed by Matt Caswell of the OpenSSL development team. Segmentation fault in DTLSv1_listen (CVE-2015-0207) =================================================== Severity: Moderate The DTLSv1_listen function is intended to be stateless and processes the initial ClientHello from many peers. It is common for user code to loop over the call to DTLSv1_listen until a valid ClientHello is received with an associated cookie. A defect in the implementation of DTLSv1_listen means that state is preserved in the SSL object from one invocation to the next that can lead to a segmentation fault. Errors processing the initial ClientHello can trigger this scenario. An example of such an error could be that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only server. This issue affects OpenSSL version: 1.0.2 OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2a. This issue was reported to OpenSSL on 27th January 2015 by Per Allansson. The fix was developed by Matt Caswell of the OpenSSL development team. Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286) =================================================== Severity: Moderate The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check certificate signature algorithm consistency this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which enable client authentication. This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8. OpenSSL 1.0.2 users should upgrade to 1.0.2a OpenSSL 1.0.1 users should upgrade to 1.0.1m. OpenSSL 1.0.0 users should upgrade to 1.0.0r. OpenSSL 0.9.8 users should upgrade to 0.9.8zf. This issue was discovered and fixed by Stephen Henson of the OpenSSL development team. Segmentation fault for invalid PSS parameters (CVE-2015-0208) ============================================================= Severity: Moderate The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and invalid parameters. Since these routines are used to verify certificate signature algorithms this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which enable client authentication. This issue affects OpenSSL version: 1.0.2 OpenSSL 1.0.2 users should upgrade to 1.0.2a This issue was was reported to OpenSSL on 31st January 2015 by Brian Carpenter and a fix developed by Stephen Henson of the OpenSSL development team. ASN.1 structure reuse memory corruption (CVE-2015-0287) ======================================================= Severity: Moderate Reusing a structure in ASN.1 parsing may allow an attacker to cause memory corruption via an invalid write. Such reuse is and has been strongly discouraged and is believed to be rare. Applications that parse structures containing CHOICE or ANY DEFINED BY components may be affected. Certificate parsing (d2i_X509 and related functions) are however not affected. OpenSSL clients and servers are not affected. This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8. OpenSSL 1.0.2 users should upgrade to 1.0.2a OpenSSL 1.0.1 users should upgrade to 1.0.1m. OpenSSL 1.0.0 users should upgrade to 1.0.0r. OpenSSL 0.9.8 users should upgrade to 0.9.8zf. This issue was discovered by Emilia KÃ¤sper and a fix developed by Stephen Henson of the OpenSSL development team. PKCS7 NULL pointer dereferences (CVE-2015-0289) =============================================== Severity: Moderate The PKCS#7 parsing code does not handle missing outer ContentInfo correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing. Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or otherwise parse PKCS#7 structures from untrusted sources are affected. OpenSSL clients and servers are not affected. This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8. OpenSSL 1.0.2 users should upgrade to 1.0.2a OpenSSL 1.0.1 users should upgrade to 1.0.1m. OpenSSL 1.0.0 users should upgrade to 1.0.0r. OpenSSL 0.9.8 users should upgrade to 0.9.8zf. This issue was reported to OpenSSL on February 16th 2015 by Michal Zalewski (Google) and a fix developed by Emilia KÃ¤sper of the OpenSSL development team. Base64 decode (CVE-2015-0292) ============================= Severity: Moderate A vulnerability existed in previous versions of OpenSSL related to the processing of base64 encoded data. Any code path that reads base64 data from an untrusted source could be affected (such as the PEM processing routines). Maliciously crafted base 64 data could trigger a segmenation fault or memory corruption. This was addressed in previous versions of OpenSSL but has not been included in any security advisory until now. This issue affects OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8. OpenSSL 1.0.1 users should upgrade to 1.0.1h. OpenSSL 1.0.0 users should upgrade to 1.0.0m. OpenSSL 0.9.8 users should upgrade to 0.9.8za. The fix for this issue can be identified by commits d0666f289a (1.0.1), 84fe686173 (1.0.0) and 9febee0272 (0.9.8). This issue was originally reported by Robert Dugal and subsequently by David Ramos. DoS via reachable assert in SSLv2 servers (CVE-2015-0293) ========================================================= Severity: Moderate A malicious client can trigger an OPENSSL_assert (i.e., an abort) in servers that both support SSLv2 and enable export cipher suites by sending a specially crafted SSLv2 CLIENT-MASTER-KEY message. This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8. OpenSSL 1.0.2 users should upgrade to 1.0.2a OpenSSL 1.0.1 users should upgrade to 1.0.1m. OpenSSL 1.0.0 users should upgrade to 1.0.0r. OpenSSL 0.9.8 users should upgrade to 0.9.8zf. This issue was discovered by Sean Burford (Google) and Emilia KÃ¤sper (OpenSSL development team) in March 2015 and the fix was developed by Emilia KÃ¤sper. Empty CKE with client auth and DHE (CVE-2015-1787) ================================================== Severity: Moderate If client auth is used then a server can seg fault in the event of a DHE ciphersuite being selected and a zero length ClientKeyExchange message being sent by the client. This could be exploited in a DoS attack. This issue affects OpenSSL version: 1.0.2 OpenSSL 1.0.2 users should upgrade to 1.0.2a. This issue was discovered and the fix was developed by Matt Caswell of the OpenSSL development team. Handshake with unseeded PRNG (CVE-2015-0285) ============================================ Severity: Low Under certain conditions an OpenSSL 1.0.2 client can complete a handshake with an unseeded PRNG. The conditions are: - The client is on a platform where the PRNG has not been seeded automatically, and the user has not seeded manually - A protocol specific client method version has been used (i.e. not SSL_client_methodv23) - A ciphersuite is used that does not require additional random data from the PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA). If the handshake succeeds then the client random that has been used will have been generated from a PRNG with insufficient entropy and therefore the output may be predictable. For example using the following command with an unseeded openssl will succeed on an unpatched platform: openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA This issue affects OpenSSL version: 1.0.2 OpenSSL 1.0.2 users should upgrade to 1.0.2a. This issue was discovered and the fix was developed by Matt Caswell of the OpenSSL development team. Use After Free following d2i_ECPrivatekey error (CVE-2015-0209) =============================================================== Severity: Low A malformed EC private key file consumed via the d2i_ECPrivateKey function could cause a use after free condition. This, in turn, could cause a double free in several private key parsing functions (such as d2i_PrivateKey or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption for applications that receive EC private keys from untrusted sources. This scenario is considered rare. This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8. OpenSSL 1.0.2 users should upgrade to 1.0.2a OpenSSL 1.0.1 users should upgrade to 1.0.1m. OpenSSL 1.0.0 users should upgrade to 1.0.0r. OpenSSL 0.9.8 users should upgrade to 0.9.8zf. This issue was discovered by the BoringSSL project and fixed in their commit 517073cd4b. The OpenSSL fix was developed by Matt Caswell of the OpenSSL development team. X509_to_X509_REQ NULL pointer deref (CVE-2015-0288) =================================================== Severity: Low The function X509_to_X509_REQ will crash with a NULL pointer dereference if the certificate key is invalid. This function is rarely used in practice. This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8. OpenSSL 1.0.2 users should upgrade to 1.0.2a OpenSSL 1.0.1 users should upgrade to 1.0.1m. OpenSSL 1.0.0 users should upgrade to 1.0.0r. OpenSSL 0.9.8 users should upgrade to 0.9.8zf. This issue was discovered by Brian Carpenter and a fix developed by Stephen Henson of the OpenSSL development team. Note ==== As per our previous announcements and our Release Strategy (https://www.openssl.org/about/releasestrat.html), support for OpenSSL versions 1.0.0 and 0.9.8 will cease on 31st December 2015. No security updates for these releases will be provided after that date. Users of these releases are advised to upgrade. References ========== URL for this Security Advisory: https://www.openssl.org/news/secadv_20150319.txt Note: the online version of the advisory may be updated with additional details over time. For details of OpenSSL severity classifications please see: https://www.openssl.org/about/secpolicy.html commit 102825b673eaed53e2e07eda75b2341f42e479d7 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Wed Mar 18 15:51:37 2015 +0100 openssh: Update to version 6.8p1 commit 13ed354420129239911bd9ec3229957caf8a7fd5 Author: Michael Tremer <michael.tremer(a)ipfire.org> Date: Tue Mar 17 22:23:13 2015 +0100 fireinfo: Forbid string "Serial" ----------------------------------------------------------------------- hooks/post-receive -- IPFire 2.x development tree

1 0

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 5f7a8b7e1cf7d665fc4df8757bf54d5d08903a88
by git＠ipfire.org 20 Mar '15

20 Mar '15

1 0

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 79cfa337b16e54e86b7812fb0166639759af29fe
by git＠ipfire.org 19 Mar '15

19 Mar '15

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 79cfa337b16e54e86b7812fb0166639759af29fe (commit) via 2acac5421f03eccd0e603106093489b985c65cb8 (commit) via 7f5795c65fa65e4835cfcb60408a64581813e9ca (commit) from c3c2e81c6fd50e102b10891c980e515d1bb072a0 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 79cfa337b16e54e86b7812fb0166639759af29fe Merge: 2acac54 c3c2e81 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 19 19:19:32 2015 +0100 Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into next commit 2acac5421f03eccd0e603106093489b985c65cb8 Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 19 19:18:49 2015 +0100 cyrus-sasl: Update to version 2.1.26 commit 7f5795c65fa65e4835cfcb60408a64581813e9ca Author: Arne Fitzenreiter <arne_f(a)ipfire.org> Date: Thu Mar 19 19:18:23 2015 +0100 apache2: Update to version 2.2.29 ----------------------------------------------------------------------- Summary of changes: lfs/apache2 | 4 ++-- lfs/cyrus-sasl | 8 ++++---- src/patches/cyrus-sasl-2.1.22-bad-elif.patch | 21 --------------------- 3 files changed, 6 insertions(+), 27 deletions(-) delete mode 100644 src/patches/cyrus-sasl-2.1.22-bad-elif.patch Difference in files: diff --git a/lfs/apache2 b/lfs/apache2 index 5e88625..0d7b11e 100644 --- a/lfs/apache2 +++ b/lfs/apache2 @@ -25,7 +25,7 @@ include Config -VER = 2.2.27 +VER = 2.2.29 THISAPP = httpd-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -47,7 +47,7 @@ objects = $(DL_FILE) \ $(DL_FILE) = $(DL_FROM)/$(DL_FILE) httpd-2.2.2-config-1.patch = $(DL_FROM)/httpd-2.2.2-config-1.patch -$(DL_FILE)_MD5 = 8faef0decf3fa7e69b2568eb2105a3d8 +$(DL_FILE)_MD5 = 579342fdeaa7b8b68d17fee91f8fab6e httpd-2.2.2-config-1.patch_MD5 = e02a3ec5925eb9e111400b9aa229f822 install : $(TARGET) diff --git a/lfs/cyrus-sasl b/lfs/cyrus-sasl index af2b148..84f49d9 100644 --- a/lfs/cyrus-sasl +++ b/lfs/cyrus-sasl @@ -24,7 +24,7 @@ include Config -VER = 2.1.21 +VER = 2.1.26 THISAPP = cyrus-sasl-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -49,7 +49,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = dde02db234dea892bee298390890502e +$(DL_FILE)_MD5 = a7f4e5e559a0e37b3ffc438c9456e425 install : $(TARGET) @@ -82,7 +82,6 @@ $(subst %,%_MD5,$(objects)) : $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/cyrus-sasl-2.1.22-bad-elif.patch cd $(DIR_APP) && sed -i '/sasl_global/s/^static //' lib/client.c cd $(DIR_APP) && sed -i 's/cat8/man8/' saslauthd/Makefile.am cd $(DIR_APP) && autoconf @@ -90,7 +89,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) ifeq "$(PASS)" "" cd $(DIR_APP) && ./configure --prefix=/usr --sysconfdir=/etc \ --with-dbpath=/var/lib/sasl/sasldb2 \ - --with-saslauthd=/var/run/saslauthd + --with-saslauthd=/var/run/saslauthd \ + --with-des=no --with-rc4=no cd $(DIR_APP) && make cd $(DIR_APP) && make install install -v -m700 -d /var/lib/sasl diff --git a/src/patches/cyrus-sasl-2.1.22-bad-elif.patch b/src/patches/cyrus-sasl-2.1.22-bad-elif.patch deleted file mode 100644 index 33550c4..0000000 --- a/src/patches/cyrus-sasl-2.1.22-bad-elif.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff -up cyrus-sasl-2.1.22/plugins/digestmd5.c.elif cyrus-sasl-2.1.22/plugins/digestmd5.c ---- cyrus-sasl-2.1.22/plugins/digestmd5.c.elif 2009-01-23 09:40:31.000000000 +0100 -+++ cyrus-sasl-2.1.22/plugins/digestmd5.c 2009-02-06 15:20:15.000000000 +0100 -@@ -2743,7 +2743,7 @@ static sasl_server_plug_t digestmd5_serv - "DIGEST-MD5", /* mech_name */ - #ifdef WITH_RC4 - 128, /* max_ssf */ --#elif WITH_DES -+#elif defined(WITH_DES) - 112, - #else - 1, -@@ -4071,7 +4071,7 @@ static sasl_client_plug_t digestmd5_clie - "DIGEST-MD5", - #ifdef WITH_RC4 /* mech_name */ - 128, /* max ssf */ --#elif WITH_DES -+#elif defined(WITH_DES) - 112, - #else - 1, hooks/post-receive -- IPFire 2.x development tree

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM