Staging tree of Christian Lamparter https://git.openwrt.org/openwrt/staging/chunkeey/atom?h=v21.02.2 2022-02-17T18:00:30Z 2022-02-17T18:00:30Z Hauke Mehrtens 2022-02-17T18:00:30Z urn:sha1:30e2782e0647a837044ada77ce86b29c5af8a9f2 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> 2022-02-12T23:23:30Z Hauke Mehrtens 2022-02-12T22:13:47Z urn:sha1:59e7ae8d65ab9a9315608a69565f6a4247d3b1ac This fixes the following security problem: The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 8f5875c4e221453932f217a82f8c3092cacba3e5) 2022-02-12T23:23:30Z Hauke Mehrtens 2022-02-12T19:37:12Z urn:sha1:0c0db6e66b3c28d93eddfed73683277d5fbc03c8 This fixes some recent security problems in hostapd. See here for details: https://w1.fi/security/2022-1 * CVE-2022-23303 * CVE-2022-23304 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> 2022-02-12T23:23:08Z Sergey V. Lobanov 2022-01-01T19:37:13Z urn:sha1:5b13b0b02c703a3c0c60828abfde01f283a2d821 Bump from 4.8.1-stable to 5.1.1-stable Detailed release notes: https://github.com/wolfSSL/wolfssl/releases Upstreamed patches: 001-Maths-x86-asm-change-asm-snippets-to-get-compiling.patch - https://github.com/wolfSSL/wolfssl/commit/fa8f23284d4689c2a737204b337b58d966dcbd8c 002-Update-macro-guard-on-SHA256-transform-call.patch - https://github.com/wolfSSL/wolfssl/commit/f447e4c1fa4c932c0286fa0331966756e243db81 Refreshed patches: 100-disable-hardening-check.patch 200-ecc-rng.patch CFLAG -DWOLFSSL_ALT_CERT_CHAINS replaced to --enable-altcertchains configure option The size of the ipk changed on aarch64 like this: 491341 libwolfssl4.8.1.31258522_4.8.1-stable-7_aarch64_cortex-a53.ipk 520322 libwolfssl5.1.1.31258522_5.1.1-stable-1_aarch64_cortex-a53.ipk Tested-by: Alozxy <alozxy@users.noreply.github.com> Acked-by: Eneas U de Queiroz <cotequeiroz@gmail.com> Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in> (cherry picked from commit 93d91197b98463277b601ec2653351666a4ca4bd) 2022-02-12T19:27:27Z Sergey V. Lobanov 2021-12-24T23:04:50Z urn:sha1:7d376e6e528f2d34e2f71f99f2f2f545a4dd63f2 x509v3 SAN extension is required to generate a certificate compatible with chromium-based web browsers (version >58) It can be disabled via unsetting CONFIG_WOLFSSL_ALT_NAMES Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in> (cherry picked from commit dfd695f4b9f364a7c7db646d2cada10fdf304f02) 2022-02-12T19:25:48Z Stan Grishin 2021-10-07T20:15:25Z urn:sha1:5ea2e1d5baa9cca7c300132dccc85ae0e2882eb7 * fixes https://github.com/openwrt/packages/issues/16652 see https://github.com/openwrt/packages/issues/16674#issuecomment-934983898 Signed-off-by: Stan Grishin <stangri@melmac.net> (cherry picked from commit 05a7af9ca0dd9c42eafbca5aa988b141e0e06053) 2022-02-12T19:02:21Z Hauke Mehrtens 2022-01-16T20:51:21Z urn:sha1:4108d02a29037cd733acfbd9a68f5dc4d58c3a56 868fd88 ustream-openssl: wolfSSL: Add compatibility for wolfssl >= 5.0 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit e74529552cf8fa16bd40b3db9d5cc82a913a49b4) 2022-02-12T18:42:08Z Hauke Mehrtens 2022-01-29T10:56:27Z urn:sha1:32d50a1281a76fab45d6bce5ea0d1ac6ff74a78d This fixes the following security problems: * Zeroize several intermediate variables used to calculate the expected value when verifying a MAC or AEAD tag. This hardens the library in case the value leaks through a memory disclosure vulnerability. For example, a memory disclosure vulnerability could have allowed a man-in-the-middle to inject fake ciphertext into a DTLS connection. * Fix a double-free that happened after mbedtls_ssl_set_session() or mbedtls_ssl_get_session() failed with MBEDTLS_ERR_SSL_ALLOC_FAILED (out of memory). After that, calling mbedtls_ssl_session_free() and mbedtls_ssl_free() would cause an internal session buffer to be free()'d twice. CVE-2021-44732 The sizes of the ipk changed on MIPS 24Kc like this: 182454 libmbedtls12_2.16.11-2_mips_24kc.ipk 182742 libmbedtls12_2.16.12-1_mips_24kc.ipk Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 57f38e2c827e3be71d8b1709073e366afe011985) 2022-01-23T10:30:30Z Rafał Miłecki 2021-04-14T06:32:26Z urn:sha1:97b95ef8b9186518cda6f2d3cec8a01860fae2e7 4b3db11 cli: add option for changing save path Signed-off-by: Rafał Miłecki <rafal@milecki.pl> (cherry picked from commit 05a4273058303c8cfb5ff9c087739b924df056b3) 2022-01-18T14:09:15Z Daniel Golle 2022-01-07T06:28:08Z urn:sha1:1472a8fa4253c0aed5053adffe59463ceb94f139 945d0d7 utils: fix C style in header file 2cfc26f inittab: detect active console from kernel if no console= specified Signed-off-by: Daniel Golle <daniel@makrotopia.org> (cherry picked from commit ffeb37047e85a5efd96890db12710e9d60b4b76a)