- Fix multiple security issues. See http://freeradius.org/security/fuzzer-2017.html Thanks to Guido Vranken for working with us to discover the issues and test the fixes.
- FR-GV-207 Avoid zero-length malloc() in data2vp().
- FR-GV-206 correct decoding of option 60.
- FR-GV-205 check for "too long" WiMAX options.
- FR-GV-204 free VP if decoding fails, so we don't leak memory.
- FR-GV-203 fix memory leak when using decode_tlv().
- FR-GV-202 check for "too long" attributes.
- FR-GV-201 check input/output length in make_secret().
- FR-AD-001 Use strncmp() instead of memcmp() for bounded data.
- Disable in-memory TLS session caches due to OpenSSL API issues.
- Allow issuer_cert to be empty.
- Look for extensions using correct index.
- Fix types.
- Work around OpenSSL 1.0.2 problems, which cause failures in TLS-based EAP methods.
- Revert RedHat contributed bug which removes run-time checks for OpenSSL consistency.
- Allow OCSP responder URL to be later in the packet Fix by Ean Pasternak.
- Catch empty subject and non-existent issuer cert in OCSP Fix by Ean Pasternak.
- Allow non-FIPS for MD5 Fix by Ean Pasternak.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
This fixes upstream regression introduced in 1.4.40. It was reported &
debugged in https://redmine.lighttpd.net/issues/2793
This fix is queued for 1.4.46 in the personal/gstrauss/master upstream
branch.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Update to 1.4.42 introduced a problem with starting lighttpd as
OpenWrt/LEDE service. It was stopping whole init process at sth like:
783 root 1124 S {S50lighttpd} /bin/sh /etc/rc.common /etc/rc.d/S50lighttpd boot
799 root 1164 S /usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf
It was hanging until getting random pool:
[ 176.340007] random: nonblocking pool is initialized
and then immediately the rest of init process followed:
[ 176.423475] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[ 176.430754] jffs2_build_filesystem(): unlocking the mtd device... done.
[ 176.437615] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
This was fixed in 1.4.44, but bump directly to 1.4.45 while at it.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
- new update url for service "duiadns.net" #3969
- updated public_suffix_list.dat
Signed-off-by: Christian Schoenebeck <christian.schoenebeck@gmail.com>
this installs the default MIBS-files under /usr/share/snmp/mibs .
Also aligns the defines to the same sorting-scheme.
backport of daeb5fd506
Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
Apply adblock updates 1.4.10-1.5.1
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Original commit messages:
adblock: update 1.4.10
- add 'enabled' check to iface hotplug event handler
- decrease startup priority from 99 to 90
- fix tab indentation in config
adblock: update 1.5.0
* add new 'envchk'function to check adblock environment only,
i.e. check volatile firewall rules or uhttpd instances
without list updates
* add new optional parm 'adb_loglevel',
set it to "0" to mute output (print only errors)
* set hotplug priority to '90' as well (missed in the last commit)
* documentation update
* cosmetics
adblock: bugfix 1.5.1
* fix uhttpd detection in tcp 4+6 configurations
Apply adblock updates 1.4.8-1.4.9
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Original commit messages:
adblock: update 1.4.8
* enhance the new query function:
change the regex to find only the relevant blocklist entries
add a recursive tld search to quickly identify domains for
whitelisting (see documentation)
better result preparation
* add securemecca as new blocklist source
* documentation update
adblock: update 1.4.9
* refine query function (see online doc)
Zoltan HERPAI