From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gLqR82dYNz2xQW for ; Thu, 21 May 2026 13:45:08 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gLqR82KDQz2xNp for ; Thu, 21 May 2026 13:45:08 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [IPv6:2001:678:b28::161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "people01.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4gLqR75xS8z2M for ; Thu, 21 May 2026 13:45:07 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1779371107; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=Y6fonrZHKPUp+B5fgQKg4/FJHGR2XXPkAlZE6F7ebTg=; b=ApBdp4UWY/c3LvQlub7GrZVLRpRRavb26+b5niHZiiR7+D3tMo/m6b3qigrQln/l+Xj0j6 KU82/0P1z1l6upCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1779371107; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=Y6fonrZHKPUp+B5fgQKg4/FJHGR2XXPkAlZE6F7ebTg=; b=VrlC2aFYSxifp2hDErSfgqqbZcBa26cu/Tf/0T2yOybnHwagNipBUstjJBOPc/yKpgnQ/i Dd+DiKIIwjrbW0udxOFA8WziLMIvCVz76k7mOrXqPOdxlmh5c/2SbAeYXvy0cluPPRtYHc o7lJ8/mpS+MjVsWxY4WCpjlGQ79Aez0OiEfttMWq4D2FraqtWeKO6o/Gl5ipgNv1kI9KnX fq6yCii/eD8bwkm9r1POH8G9zAFH8WNxlY39//71sg4srmsTD+OGP6YhIWTxX/9qv1W7+2 EuYCUO1aqmZTI8p/1/289PWuf6gGhH+pBcyjuDWQsKLj2ptM5TfOLbYBSSQZ9A== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4gLqR75Tzqz2xJB; Thu, 21 May 2026 13:45:07 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, core202, updated. 43f50ebad077bfcb68493958acd48be3a961e015 X-Git-Refname: refs/heads/core202 X-Git-Reftype: branch X-Git-Oldrev: f7898141e90ce8241ac31ee40417f3addb90599e X-Git-Newrev: 43f50ebad077bfcb68493958acd48be3a961e015 Message-Id: <4gLqR75Tzqz2xJB@people01.haj.ipfire.org> Date: Thu, 21 May 2026 13:45:07 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, core202 has been updated via 43f50ebad077bfcb68493958acd48be3a961e015 (commit) via 88dea3a1187ad8e978db9859f8d497e1a08603ed (commit) via 887e752e324d49db60e195b567b65f093969c3aa (commit) from f7898141e90ce8241ac31ee40417f3addb90599e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 43f50ebad077bfcb68493958acd48be3a961e015 Author: Matthias Fischer Date: Thu May 21 15:29:50 2026 +0200 unbound: Update to 1.25.1 For details see: https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-1 "Bug Fixes Fix CVE-2026-33278, Possible remote code execution during DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42944, Heap overflow and crash with multiple nsid, cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42959, Crash during DNSSEC validation of malicious content. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-32792, Packet of death with DNSCrypt. Thanks to Andrew Griffiths from 'calif.io' for the report. Fix CVE-2026-40622, "Ghost domain name" variant. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-41292, Parsing a long list of incoming EDNS options degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan Zhang from Palo Alto Networks, for the report. Fix CVE-2026-42534, Jostle logic bypass degrades resolution performance. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42923, Degradation of service with unbounded NSEC3 hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-42960, Possible cache poisoning attack while following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo and JianJun Chen, Tsinghua University, for the report. Fix CVE-2026-44390, Unbounded name compression in certain cases causes degradation of service. Thanks to Qifan Zhang, Palo Alto Networks, for the report. Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks to Qifan Zhang, Palo Alto Networks, for the report." Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer commit 88dea3a1187ad8e978db9859f8d497e1a08603ed Author: Michael Tremer Date: Thu May 21 13:44:22 2026 +0000 Revert "unbound: Update to 1.25.1" This reverts commit dfcc64bd8aac6809d1c058cd891fddb373cb94d5. Signed-off-by: Michael Tremer commit 887e752e324d49db60e195b567b65f093969c3aa Author: Michael Tremer Date: Thu May 21 13:44:19 2026 +0000 Revert "unbound: Fix hash" This reverts commit f7898141e90ce8241ac31ee40417f3addb90599e. Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/unbound | 2 +- lfs/unbound | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) Difference in files: diff --git a/config/rootfiles/common/unbound b/config/rootfiles/common/unbound index 4ab2ee5b4..2fdf58b08 100644 --- a/config/rootfiles/common/unbound +++ b/config/rootfiles/common/unbound @@ -11,7 +11,7 @@ etc/unbound/unbound.conf #usr/lib/libunbound.la #usr/lib/libunbound.so usr/lib/libunbound.so.8 -usr/lib/libunbound.so.8.1.36 +usr/lib/libunbound.so.8.1.37 #usr/lib/pkgconfig/libunbound.pc usr/sbin/unbound usr/sbin/unbound-anchor diff --git a/lfs/unbound b/lfs/unbound index 5bbeee66b..086025e4b 100644 --- a/lfs/unbound +++ b/lfs/unbound @@ -109,7 +109,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) -mkdir -pv /var/lib/unbound install -v -m 644 $(DIR_SRC)/config/unbound/root.key \ /var/lib/unbound/root.key - chown -Rv unbound:unbound /var/lib/unbound + chown -Rv nobody.nobody /var/lib/unbound # Ship ICANN's certificates to validate DNS trust anchors install -v -m 644 $(DIR_SRC)/config/unbound/icannbundle.pem \ @@ -117,7 +117,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) # Install the cache directory -mkdir -pv /var/cache/unbound - chown unbound:unbound /var/cache/unbound + chown nobody:nobody /var/cache/unbound @rm -rf $(DIR_APP) @$(POSTBUILD) hooks/post-receive -- IPFire 2.x development tree