kea: bump to 3.0.3#29581
Open
commodo wants to merge 1 commit into
Open
Conversation
Member
Member
|
CI/CD fails due to this issue: |
Contributor
Author
yes, that goes with this PR #29577 i've split this up, to also make that as backport for 25.12 should it be needed; i'm a bit uncertain how buildbots work; |
3.0.3 is a security/vulnerability release on the stable 3.0 series. Notable fixes since 3.0.2: * **CVE-2026-3608** — A large number of bracket pairs in a JSON payload sent to any endpoint caused a stack overflow during recursive parsing. The exploit does not need a syntactically valid command, so it bypasses RBAC and the command filters on the High-Availability endpoints (upstream openwrt#4275 / openwrt#4288 / openwrt#4387). * Null dereference when configuring the Control Agent with a socket entry that lacks the mandatory ``socket-name`` is now caught (openwrt#4388, openwrt#4365). * UNIX command sockets are created group-writable so Stork 2.4.0+ and other tooling using the configured group can talk to the daemon (openwrt#4398, openwrt#4260). Upstream's release notes flag "no incompatible changes" and "no known issues" for this bump. All current patches still apply cleanly. Release notes: https://ftp.isc.org/isc/kea/3.0.3/Kea-3.0.3-ReleaseNotes.txt Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📦 Package Details
Maintainer: @pprindeville
Description:
3.0.3 is a security/vulnerability release on the stable 3.0 series.
Notable fixes since 3.0.2:
CVE-2026-3608 — A large number of bracket pairs in a JSON payload
sent to any endpoint caused a stack overflow during recursive parsing.
The exploit does not need a syntactically valid command, so it bypasses
RBAC and the command filters on the High-Availability endpoints
(upstream hfsprogs: fix when not linking aginst glibc #4275 / feature request: "iotop" package #4288 / Symlink soversions #4387).
Null dereference when configuring the Control Agent with a socket
entry that lacks the mandatory
socket-nameis now caught(sysrepo: add patch for disabling autostart #4388, python packages: move all things python under lang/python #4365).
UNIX command sockets are created group-writable so Stork 2.4.0+ and
other tooling using the configured group can talk to the daemon
(dnscrypt-proxy: update dnscrypt-resolvers.csv #4398, Fatal errors in privoxy v. 3.0.26-2 #4260).
Upstream's release notes flag "no incompatible changes" and "no known
issues" for this bump.
All current patches still apply cleanly.
Release notes:
https://ftp.isc.org/isc/kea/3.0.3/Kea-3.0.3-ReleaseNotes.txt
🧪 Run Testing Details
✅ Formalities