From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gLj5r0pnwz2xQW for ; Thu, 21 May 2026 08:59:44 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gLj5r0SD2z2xNp for ; Thu, 21 May 2026 08:59:44 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [IPv6:2001:678:b28::161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "people01.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4gLj5q0fCTzQ5 for ; Thu, 21 May 2026 08:59:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1779353983; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=Wdl6ezIlXBjiad21huSa4R+RbvwDXRZ8OeE/PAfq8Hw=; b=kCnSKmEm3OiG5zHNjAu4RY+pG9uK5bqWU+QvLi6aADDPsofBaU/eIb2l2rvqEnHhNuPzBU 0faQZzN+FuRWiS6BaXcSkE6J9WVT085D39khzE/wT/3PQSqXMEKw0YXBJJCbx4VLURUu03 LyzCTafkreAibAKcj8EZI6dC8XLlSeGz2n2WyUU00QKMvsD68suHXEnR2Y7SVnCWued2c2 mKrtdiFEDMjrrkJaDdOE9g8Qvnc448Cg0kt1OH4tdyzXuD0uIxO7V2a2Iuv39MzPPBmdUW sOwtW51UBaMpreBIlidTkc4QSUsEA9jb8V2V6lsQON4zlnrdSqIoqqrI8Rq+gw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1779353983; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=Wdl6ezIlXBjiad21huSa4R+RbvwDXRZ8OeE/PAfq8Hw=; b=FVKh1lFzK7ICHuboJtRUHpQ+a4b9YmPmMMzG5woISXn22Q5yINVtnpAm12Al7MtIplDRc4 tNSfG4/aYjCeSaAw== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4gLj5p6djdz2xJB; Thu, 21 May 2026 08:59:42 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, master, updated. dfcc64bd8aac6809d1c058cd891fddb373cb94d5 X-Git-Refname: refs/heads/master X-Git-Reftype: branch X-Git-Oldrev: c9f577122c69dcdb8682cb03015f8b9f2b0874ac X-Git-Newrev: dfcc64bd8aac6809d1c058cd891fddb373cb94d5 Message-Id: <4gLj5p6djdz2xJB@people01.haj.ipfire.org> Date: Thu, 21 May 2026 08:59:42 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via dfcc64bd8aac6809d1c058cd891fddb373cb94d5 (commit) from c9f577122c69dcdb8682cb03015f8b9f2b0874ac (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit dfcc64bd8aac6809d1c058cd891fddb373cb94d5 Author: Michael Tremer Date: Thu May 21 08:59:06 2026 +0000 unbound: Update to 1.25.1 This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42960, CVE-2026-44390 and CVE-2026-44608. Bug Fixes Fix CVE-2026-33278, Possible remote code execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42944, Heap overflow and crash with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42959, Crash during DNSSEC validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-32792, Packet of death with DNSCrypt. Thanks to Andrew Griffiths from 'calif.io' for the report. Fix CVE-2026-40622, "Ghost domain name" variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-41292, Parsing a long list of incoming EDNS options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan Zhang from Palo Alto Networks, for the report. Fix CVE-2026-42534, Jostle logic bypass degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42923, Degradation of service with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42960, Possible cache poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and JianJun Chen, Tsinghua University, for the report. Fix CVE-2026-44390, Unbounded name compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: lfs/unbound | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Difference in files: diff --git a/lfs/unbound b/lfs/unbound index b0691e864..7fe47f5b6 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -24,7 +24,7 @@ include Config -VER = 1.25.0 +VER = 1.25.1 THISAPP = unbound-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 4c22e198c2257c251505f6845c42e67481edce2c5e8dc0c475584ef6b8e85907c322f32bd7ecfcb06243ba36fb3d91c63d8c1edd67dca66d374c6a242206e548 +$(DL_FILE)_BLAKE2 = 925d964cfaa76211b5d71ab7d16318327417e7e85791ef3b7b442b0b417e1e29fb925b7a1f3427105cc9114b5b8c093ecc9a9aa5c3457620f622a24ed3674de3 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree