From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gLj6B635vz2xQW for ; Thu, 21 May 2026 09:00:02 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gLj6B5rfKz2xNp for ; Thu, 21 May 2026 09:00:02 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [IPv6:2001:678:b28::161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "people01.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4gLj6B0cJJzQ5 for ; Thu, 21 May 2026 09:00:02 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1779354002; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=D0RqCIn78HrdGfToCOcL3YitIUhVYF4zXd/uolvrEyU=; b=nxz2RxhjqrTC/zV2qqr6LDnItY2huYQ+TwvsbbO3KqbXUclRMuzD5gLR7efN3pOY3iFBX7 tQb9iPOPr27XiPAw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1779354002; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=D0RqCIn78HrdGfToCOcL3YitIUhVYF4zXd/uolvrEyU=; b=YhkpTQNE3KZH7/rf5RvBqThYo3MHth1/HkaJZOKGPlV/CrELpzJ5axJo36NH6EDf2OzkfM 4G6Y0zG30IAL0IdgSZAtAH4Zq+B1VNtYdQh4xOnWgJ1rBgk06G1l/aIu8h44GRZhextsaX B1+QyhcnwfPuaVTP38h+PxEnzpCmnX5v4T7HdzljIAiOVwYRICFrOXxbiNgNzlnIEf08p3 Sju4ldl6X0ezrMIsE7hGFW5T3XFDZofsEWpfisZsl0MBX/wwCIsCEqt5JORjhorm2Qw5N9 9BeVlYFF3ykxAInwTQZKX8UdOkbOpGT1TsDqicEhkw8hsoven0lZOf3iHA3QAg== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4gLj6B08cbz2xJB; Thu, 21 May 2026 09:00:02 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, core202, created. dfcc64bd8aac6809d1c058cd891fddb373cb94d5 X-Git-Refname: refs/heads/core202 X-Git-Reftype: branch X-Git-Oldrev: 0000000000000000000000000000000000000000 X-Git-Newrev: dfcc64bd8aac6809d1c058cd891fddb373cb94d5 Message-Id: <4gLj6B08cbz2xJB@people01.haj.ipfire.org> Date: Thu, 21 May 2026 09:00:01 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core202 has been created at dfcc64bd8aac6809d1c058cd891fddb373cb94d5 (commit) - Log ----------------------------------------------------------------- commit dfcc64bd8aac6809d1c058cd891fddb373cb94d5 Author: Michael Tremer Date: Thu May 21 08:59:06 2026 +0000 unbound: Update to 1.25.1 This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-33278, CVE-2026-42944, CVE-2026-42959, CVE-2026-32792, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42960, CVE-2026-44390 and CVE-2026-44608. Bug Fixes Fix CVE-2026-33278, Possible remote code execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42944, Heap overflow and crash with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42959, Crash during DNSSEC validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-32792, Packet of death with DNSCrypt. Thanks to Andrew Griffiths from 'calif.io' for the report. Fix CVE-2026-40622, "Ghost domain name" variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-41292, Parsing a long list of incoming EDNS options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan Zhang from Palo Alto Networks, for the report. Fix CVE-2026-42534, Jostle logic bypass degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42923, Degradation of service with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42960, Possible cache poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and JianJun Chen, Tsinghua University, for the report. Fix CVE-2026-44390, Unbounded name compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Signed-off-by: Michael Tremer commit c9f577122c69dcdb8682cb03015f8b9f2b0874ac Author: Michael Tremer Date: Wed May 20 15:22:27 2026 +0000 core202: Ship header.pl Signed-off-by: Michael Tremer commit 2f97c9a22ce197f361dc02da13247ef0a807e969 Author: Michael Tremer Date: Wed May 20 16:15:44 2026 +0100 sambactrl: Fix local priviledge escalation From the reporter: LPE in /usr/local/bin/sambactrl 'join' action File: src/misc-progs/sambactrl.c, lines 117-126. All other actions call is_valid_argument_alnum() on argv[2]. The 'join' branch skips it entirely and feeds argv[2]/argv[3] into snprintf + safe_system (which is /bin/sh -c). Binary is installed -m 4750 -g nobody (src/misc-progs/Makefile:41), so any nobody-context process can invoke it and escalate to root. Reported-by: valent1 Signed-off-by: Michael Tremer commit 35d45aad9c59e87fe60d2c66cb18dcd015960d71 Author: Michael Tremer Date: Wed May 20 16:04:25 2026 +0100 samba: Fix shell command execution vulnerability in join operation From the reporter: File: html/cgi-bin/samba.cgi, lines 96-98 and 790-798. joindomain() builds @options = ("/usr/local/bin/sambactrl","join", $username, $password) and runs qx(@options). In Perl, qx(@array) joins with $" and passes the result to /bin/sh -c. POST parameters USERNAME and PASSWORD reach this with no validation on the 'join' code path. RCE as the web user (nobody). Reported-by: valent1 Signed-off-by: Michael Tremer commit f607f40952821ee52bdf28d34ba91bf95bdbc01f Author: Michael Tremer Date: Wed May 20 16:00:33 2026 +0100 header.pl: Escape titles for openbox() Reported-by: valent1 Signed-off-by: Michael Tremer ----------------------------------------------------------------------- hooks/post-receive -- IPFire 2.x development tree