[22.03] opennds: Release v10.1.2

bluewavenet commented 1 year ago

Maintainer: Rob White rob@blue-wave.net

Compile tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64

Run tested: arm_cortex-a7_neon-vfpv4, mipsel_24kc, x86-64; on snapshot, 23.05, 22.03

Description: opennds (10.1.2)

Security Advisory. This version contains fixes for multiple potential security vulnerabilities Credit - Stanislav Dashevskyi - standash.github.io [standash] It also contains some minor bug fixes

Fix - Generate unique sha256 faskey if not set in config - CVE-2023-38324 [bluewavenet]
Fix - NULL pointer dereference if user_agent is NULL - CVE-2023-38320, CVE-2023-38322 [bluewavenet]
Fix - NULL pointer dereference if authdir is called with an incomplete or missing query string - CVE-2023-38313, CVE-2023-38314, CVE-2023-38315 [bluewavenet]
Fix - remove deprecated and non-functioning unescape callback - CVE-2023-38316 [bluewavenet]
Fix - prevent potential recursive dependency and detect if conflicting package is installed [bluewavenet]

Signed-off-by: Rob White rob@blue-wave.net (cherry picked from commit 3eb9aa30566eb34608e6aacc55157dad46550a6a)

bluewavenet commented 1 year ago

@mwarning @PolynomialDivision @BKPepe As this is a fix for a security issue and 22.03 is still the stable release, it should be merged as soon as possible. Note: CI is broken here, hence the failing tests. Many thanks.

mwarning commented 1 year ago

Pipeline broken. Local compilcation for openwrt-22.03 / ath79/generic was successful.

bluewavenet commented 1 year ago

@mwarning Thank you :-)

openwrt / routing

[22.03] opennds: Release v10.1.2 #1008