SUSE-RU-2024:0718-1: Recommended update for aardvark-dns, netavark

Published Feb 29, 2024
·
Updated

This update for aardvark-dns and netavark fixes the following issues: aardvark-dns was updated to version 1.10.0 (jsc#PED-7577): Changes in version 1.10.0:

chore(deps): update rust crate chrono to 0.4.32

chore(deps): update dependency containers/automationimages to v20240102 fix(deps): update rust crate futures-util to 0.3.30 fix(deps): update rust crate anyhow to 1.0.79 fix(deps): update rust crate tokio to 1.35.1 chore(deps): update dependency containers/automationimages to v20231208 fix(deps): update rust crate tokio to 1.35.0 fix duplicated IP CI flake server: remove unused kill switch

fix(deps): update rust crate clap to ~4.4.10

Changes in version 1.9.0:

run cargo update

chore(deps): update dependency containers/automationimages to v20231116 fix(deps): update rust crate tokio to 1.34.0 fix(deps): update rust crate async-broadcast to 0.6.0 update trust-dns to hickory fix(deps): update rust crate futures-util to 0.3.29 fix(deps): update rust crate trust-dns-server to 0.23.2 fix(deps): update rust crate trust-dns-proto to 0.23.2 tmt: initial enablement aardvark main: change error reporting chore(deps): update dependency containers/automationimages to v20231004 fix(deps): update rust crate trust-dns-proto to 0.23.1 fix(deps): update rust crate trust-dns-client to 0.23.1 clippy: some format fixes

fix(deps): update rust crate tokio to 1.33.0

Changes in version 1.8.0:

run cargo update

Packit: switch to @containers/packit-build team for copr failure notification comments [CI:BUILD] Packit: tag @lsm5 on copr build failures chore(deps): update rust crate chrono to 0.4.31 cargo: bump chrono to 0.4.30 test: IPv6 format is changed in v1.72.0 bump nix to 0.27.1 vendor: bump trustdnsproto and trustdnsclient to 0.23.0 fix(deps): update rust crate trust-dns-server to 0.23.0 [CI:BUILD] rpm: spdx compatible license field fix(deps): update rust crate anyhow to 1.0.75 fix(deps): update rust crate tokio to 1.32.0 chore(deps): update dependency containers/automationimages to v20230816 fix(deps): update rust crate tokio to 1.31.0 fix(deps): update rust crate anyhow to 1.0.74 fix(deps): update rust crate anyhow to 1.0.73 fix(deps): update rust crate log to 0.4.20 chore(deps): update dependency containers/automationimages to v20230809 fix(deps): update rust crate tokio to 1.30.0 fix(deps): update rust crate clap to 4.3.21 packit: Build PRs into default packit COPRs chore(deps): update dependency containers/automationimages to v20230807 fix(deps): update rust crate anyhow to 1.0.72 fix(deps): update rust crate signal-hook to 0.3.17 fix(deps): update rust crate clap to 4.3.19 fix(deps): update rust crate clap to 4.3.15 fix(deps): update rust crate signal-hook to 0.3.16 [CI:BUILD] Packit: remove pre-sync action fix(deps): update rust crate clap to 4.3.11 fix(deps): update rust crate tokio to 1.29.1 fix(deps): update rust crate clap to 4.3.10

[CI:BUILD] RPM: cleanup spec and fix eln builds

Disable restricting builds only for tier1 platforms i.e. only for x8664 and aarch64 and enable for all.

Changes in version 1.7.0:

fix(deps): update rust crate tokio to 1.29.0

fix(deps): update rust crate clap to 4.3.8 fix(deps): update rust crate clap to 4.3.5 run cargo update [CI:BUILD] Packit: add Fedora downstream tasks fix(deps): update rust crate clap to 4.3.4 chore(deps): update dependency containers/automationimages to v20230614 fix(deps): update rust crate clap to 4.3.3 fix(deps): update rust crate log to 0.4.19 fix(deps): update rust crate clap to 4.3.2 fix(deps): update rust crate clap to 4.3.1 cirrus: remove verifyvendor task chore(deps): update dependency containers/automationimages to v20230601 fix(deps): update rust crate trust-dns-server to 0.22.1 chore(deps): update rust crate chrono to 0.4.26 fix(deps): update rust crate tokio to 1.28.2 fix(deps): update rust crate log to 0.4.18 chore(deps): update rust crate chrono to 0.4.25 fix(deps): update rust crate clap to 4.3.0 chore(deps): update dependency containers/automationimages to v20230517 fix(deps): update rust crate tokio to 1.28.1 chore(deps): update dependency containers/automationimages to v20230426 fix(deps): update rust crate clap to 4.2.7 fix(deps): update rust crate anyhow to 1.0.71 fix typo in makefile fix(deps): update rust crate tokio to 1.28.0 fix(deps): update rust crate clap to 4.2.5 fix(deps): update rust crate syslog to ^6.1.0 fix(deps): update rust crate clap to 4.2.4 fix(deps): update rust crate clap to 4.2.3 fix(deps): update rust crate clap to v4

chore(deps): update dependency containers/automationimages to v20230405

Changes in version 1.6.0:

fix(deps): update rust crate tokio to 1.27.0

use lower TTL for contianer entries fix(deps): update rust crate syslog to ^6.0.1 fix(deps): update rust crate futures-util to 0.3.28 chore(deps): update dependency containers/automationimages to v20230330 Disable Dependabot in favor of Renovate chore(deps): update dependency containers/automationimages to v20230320 build(deps): bump futures-util from 0.3.26 to 0.3.27 [CI:BUILD] Packit: trigger builds on commit to main branch build(deps): bump anyhow from 1.0.68 to 1.0.70 fix lint issue with new rust version 1.68 Cirrus: Update to newer CI VM images build(deps): bump chrono from 0.4.23 to 0.4.24 build(deps): bump libc from 0.2.139 to 0.2.140 build(deps): bump async-broadcast from 0.5.0 to 0.5.1 build(deps): bump signal-hook from 0.3.14 to 0.3.15 build(deps): bump futures-util from 0.3.25 to 0.3.26 build(deps): bump tokio from 1.25.0 to 1.26.0 [CI:DOCS] Clarify packit related comments [CI:BUILD] Packit: initial enablement Allow custom cargo binary path Switch to explicit platform list for cargo vendor-filterer Add renovate.json5 Cirrus: Groom rust cache before updating netavark was update to version 1.10.2 (jsc#PED-7577): Changes in version 1.10.2:

Fixed aardvark-dns handling

Do not perform network namespace detection on AV update

Changes in version 1.10.1:

Updated to nftables release 0.3 from crates.io

DISTROPACKAGE: fix incorrect vendored tar archive URL

Bump to 1.11.0-dev

Changes in version 1.10.0:

RPM: update .cargo/config before building

Added support for isolation to the nftables driver build(deps): bump h2 from 0.3.22 to 0.3.24 chore(deps): update rust crate chrono to 0.4.32 fix(deps): update rust crate envlogger to 0.11.0 chore(deps): update dependency containers/automationimages to v20240102 Bump nftables-rs to latest commit Netavark: nftables support fix(deps): update rust crate serdejson to 1.0.111 feat: added the --firewall-driver option Document how to generate a code coverage report for netavark fix(deps): update rust crate clap to ~4.4.12 fix(deps): update rust crate serdejson to 1.0.110 fix(deps): update rust-futures monorepo to 0.3.30 fix(deps): update rust crate nispor to 1.2.16 chore(deps): update rust crate tempfile to 3.9.0 Use tonic::transport::Uri instead of HTTP chore(deps): update dependency containers/automationimages to v20231208 fix(deps): update rust crate tokio to 1.35 dhcp-proxy: return actual error instead of generic one dhcp-proxy: skip set gateway if missing bump netlink-packet-route to 0.18.1 chore(deps): update rust crate oncecell to 1.19.0 fix(deps): update rust crate nispor to 1.2.15 fix(deps): update rust crate serde to 1.0.193 fix(deps): update rust crate clap to ~4.4.10 aardvark: show error if process is in wrong netns aardvark: remove unessesary unlock lockfile calls fix(deps): update rust crate url to 2.5.0

Bump working version to v1.10.0-dev

Changes in version 1.9.0:

test: fix syntax problem in helpers.bash

run cargo update use OsString/Path over String for file paths chore(deps): update dependency containers/automationimages to v20231116 firewalld-reload: fix CI tests firewalld-reload: prevent race which could leak fw rules fix(deps): update rust crate clap to ~4.4.8 CI: skip broken firewalld test fix(deps): update rust crate http to 0.2.11 rpm: add netavark-firewalld-reload.service to spec firewalld-reload: add integration tests firewall/state: make sure to ignore enoent on read firewall-reload: integrate actual logic to reload rules firewall/state: improve error messages firewall: add state functions to serialize configs firewalld: fix lint errors with rust v1.73 firewall: do not use full Network in NetworkStruct firewall: add dnsport to SetupNetwork add firewalld-reload subcommand fix(deps): update rust crate http to 0.2.10 fix(deps): update rust crate envlogger to 0.10.1 fix(deps): update rust crate tokio to 1.34 Update rust container build files bridge: force static mac on bridge interface fix(deps): update rust crate futures-core to 0.3.29 fix(deps): update rust crate serde to 1.0.190 fix(deps): update rust crate serdejson to 1.0.108 fix(deps): update rust crate sysctl to 0.5.5 fix(deps): update rust-futures monorepo to 0.3.29 CI: Drop CI VM distro name chore(deps): update dependency containers/automationimages to v20231004 fix(deps): update rust crate tokio to 1.33 build-sys: Filter to tier 2 Linux declaratively fix(deps): update rust crate sha2 to 0.10.8 fix podman.io community link

Bump to v1.9.0-dev

Changes in version 1.8.0:

run cargo update

Add vrf support for bridges Packit: switch to @containers/packit-build team for copr failure notification comments fix(deps): update rust crate nispor to 1.2.14 [CI:BUILD] Packit: tag @lsm5 on copr build failures chore(deps): update rust crate chrono to 0.4.31 fix(deps): update rust crate serdejson to 1.0.107 rust io safety: convert RawFd to BorrowedFd<> bump nix to 0.27.1 chore(deps): update rust crate chrono to 0.4.30 fix(deps): update rust crate serdejson to 1.0.106 chore(deps): update rust crate chrono to 0.4.29 fix(deps): update rust crate netlink-packet-route to 0.17.1 Bump tonic and prost Update container image to F38 Add ACCEPT rules in firewall for bridge network with internal dns. chore(deps): update rust crate tonic-build to 0.10 fix(deps): update rust crate nispor to 1.2.13 fix(deps): update rust crate serde to 1.0.188 Fix clippy warnings about formatting update chrono crate fix(deps): update rust crate url to 2.4.1 Add protoc dependency to README [CI:BUILD] rpm: spdx compatible license field fix(deps): update rust crate tokio to 1.32 chore(deps): update dependency containers/automationimages to v20230816 fix(deps): update rust crate serdejson to 1.0.105 fix(deps): update rust crate tokio to 1.31 fix(deps): update rust crate log to 0.4.20 run cargo update update tonic-build to 0.9.2 bump rust edition to 2021 iptables: drop invalid packages fix(deps): update rust crate tokio to 1.30 docs: Convert markdown with go-md2man instead of mandown fix(deps): update rust crate clap to 4.3.21 packit: Build PRs into default packit COPRs chore(deps): update dependency containers/automationimages to v20230807 fix(deps): update rust crate serde to 1.0.183 fix(deps): update rust crate serde to 1.0.181 fix(deps): update rust crate serde to 1.0.180 fix(deps): update rust crate serdejson to 1.0.104 fix(deps): update rust crate serde to 1.0.179 fix(deps): update rust crate serde to 1.0.176 fix(deps): update rust crate clap to 4.3.19 fix(deps): update rust crate serde to 1.0.175 fix(deps): update rust crate clap to 4.3.17 fix(deps): update rust crate clap to 4.3.15 fix(deps): update rust crate clap to 4.3.12 fix(deps): update rust crate serdejson to 1.0.103 [CI:BUILD] Packit: remove pre-sync action fix(deps): update rust crate serdejson to 1.0.102 fix(deps): update rust crate nispor to 1.2.12 macvlan: use netlink type for bclim bump netlink deps fix(deps): update rust crate serde to 1.0.171 fix(deps): update rust crate serde to 1.0.167 fix(deps): update rust crate clap to 4.3.11 fix(deps): update rust crate serde to 1.0.166 fix(deps): update rust crate serdejson to 1.0.100 iptables: improve error when ip6?tables commands are missing fix(deps): update rust crate clap to 4.3.10 fix(deps): update rust crate zbus to 3.14.1 [CI:BUILD] RPM: Fix ELN build and cleanup spec

bump to v1.8.0-dev

Changes in version 1.7.0:

fix(deps): update rust crate tokio to 1.29

netavark: make --config required for dns fix(deps): update rust crate serdejson to 1.0.99 fix(deps): update rust crate clap to 4.3.8 [CI:BUILD] Packit: add Fedora downstream tasks run cargo update fix(deps): update rust crate serdejson to 1.0.97 fix(deps): update rust crate sha2 to 0.10.7 fix(deps): update rust crate clap to 4.3.4 chore(deps): update dependency containers/automationimages to v20230614 fix(deps): update rust crate clap to 4.3.3 fix(deps): update rust crate log to 0.4.19 aardvark: fix missleading dns disabled log firewall: add NETAVARKISOLATION3 chain for strict isolation docs: fix link to getting started fix(deps): update rust crate serde to 1.0.164 netlink: fix incorrect info log for delroute dhcp-proxy: apply new ip address/gateway test-dhcp: fix broekn hasip() check dhcp-proxy: actually implement renewing leases dhcp-proxy: simplify code dhcp-proxy: drop macaddr dependency dhcp-proxy: remove some unused traits fix(deps): update rust crate zbus to 3.13.1 fix(deps): update rust crate clap to 4.3.2 chore(deps): update rust crate oncecell to 1.18.0 fix(deps): update rust crate url to 2.4.0 fix(deps): update rust crate clap to 4.3.1 chore(deps): update dependency containers/automationimages to v20230601 chore(deps): update rust crate chrono to 0.4.26 chore(deps): update rust crate chrono to 0.4.25 fix(deps): update rust crate log to 0.4.18 chore(deps): update rust crate oncecell to 1.17.2 macvlan: add bclim option parseoption(): return option instead of default add nodefaultgateway option fix(deps): update rust crate clap to 4.3.0 chore(deps): update dependency containers/automationimages to v20230517 fix(deps): update rust crate serde to 1.0.163 Add ability to add static route fix(deps): update rust crate serde to 1.0.162 Cirrus: Update fedora name to match image fix(deps): update rust crate clap to 4.2.7 chore(deps): update dependency containers/automationimages to v20230426 correct typo in Makefile simplify path printing fix(deps): update rust crate tokio to 1.28 aardvark-dns pid: return better errors fix comment in Subnet definition aardvark: no error when aardvark config is not there fix(deps): update rust crate zbus to 3.12.0 fix(deps): update rust crate clap to 4.2.4 fix(deps): update rust crate clap to 4.2.2 fix(deps): update rust crate serdejson to 1.0.96 update clap to v4 fix(deps): update rust crate serde to 1.0.160

bump to v1.7.0-dev

Changes in version 1.6.0:

dhcp-proxy: fix typo for --activity-timeout

chore(deps): update dependency containers/automationimages to v20230405 dhcp-proxy: use better error when connection fails add documentation for netavark plugins add stderr example plugin to test stderr passthrough add netavark plugin driver add example error plugin add host-device example plugin plugin: add simple plugin interface netlink: add dumpaddresses netlink: add setlinkns dhcp-proxy: correctly exit > 0 on errors fix(deps): update rust crate tonic to 0.9 fix(deps): update rust crate mozim to 0.2.2 fix(deps): update rust crate serde to 1.0.159 fix(deps): update rust crate netlink-sys to 0.8.5 dhcp-proxy: create socket directory only when used dhcp-proxy: do not remove socket when running under systemd Makefile: netavark-dhcp-proxy.service use correct path fix(deps): update rust crate http to 0.2.9 chore(deps): update rust crate oncecell to 1.17.1 fix(deps): update rust-futures monorepo to 0.3.28 fix(deps): update rust crate serdejson to 1.0.95 chore(deps): update dependency containers/automationimages to v20230330 Disable Dependabot in favor of Renovate chore(deps): update rust crate chrono to 0.4.24 build(deps): bump ipnet from 2.7.1 to 2.7.2 build(deps): bump serde from 1.0.158 to 1.0.159 build(deps): bump serdejson from 1.0.94 to 1.0.95 update,main: dont write empty space when no networkdnsservers is given fix(deps): update rust crate tokio to 1.27 Quit Leasing when Client disconnects build(deps): bump mozim from 0.2.1 to 0.2.2 iptables: fix incorrect debug statement build(deps): bump serde from 1.0.156 to 1.0.158 iptables: port fw handle wildcard address correctly chore(deps): update dependency containers/automationimages to v20230320 build(deps): bump zbus from 3.11.0 to 3.11.1 build(deps): bump anyhow from 1.0.69 to 1.0.70 [CI:BUILD] Packit: trigger builds on commit to main branch Cirrus: Invalidate v2 bin cache Include Systemd Files in RPM Package Cirrus: Fix success failing on artifact extraction fix lint issue with new rust version 1.68 Cirrus: Update to newer CI VM images build(deps): bump serde from 1.0.152 to 1.0.156 combine dhcp-proxy and netavark into one binary update: should allow empty networkdnsservers build(deps): bump libc from 0.2.139 to 0.2.140 fix aarch64 ncat flake update to mozim 0.2.1 build(deps): bump zbus from 3.10.0 to 3.11.0 packit: Update build release tag correctly test: move proto option into runnctest() test: add netns pid param to port checks test: import podman code to check for ports cirrus.yaml: add new binaries in artprepscript fix netavark-dhcp-proxy binary in system unit import netavark-proxy-dhcp tests add buildproxyclient target add netavark-dhcp-proxy to rpm Fix dhcp-proxy build Merge nv-dhcp-proxy into nv fix default route metric test name build(deps): bump tokio from 1.25.0 to 1.26.0 Support none parameter on NETAVARKFW build(deps): bump anyhow from 1.0.68 to 1.0.69 Fix typos update netlink-packet-{route,core} to 0.15 and 0.5 build(deps): bump serdejson from 1.0.92 to 1.0.93 build(deps): bump zbus from 3.8.0 to 3.10.0 [CI:BUILD] Packit: initial enablement Allow custom cargo binary path build(deps): bump serdejson from 1.0.91 to 1.0.92 Cirrus: Reduce requested CPUs for compile-tasks bump to version 1.0.6-dev build(deps): bump netlink-sys from 0.8.3 to 0.8.4

Add renovate.json5

Added aardvark-dns as dependency requirement for netavark

Affected Software

15 affected componentsFixes available
All of the following
SUSE openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)
Any of the following
suse/aardvark-dns<1.10.0-150500.3.3.1
1.10.0-150500.3.3.1
suse/aardvark-dns-debuginfo<1.10.0-150500.3.3.1
1.10.0-150500.3.3.1
suse/netavark<1.10.2-150500.3.3.3
1.10.2-150500.3.3.3
suse/netavark-debuginfo<1.10.2-150500.3.3.3
1.10.2-150500.3.3.3
All of the following
SUSE SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64)
Any of the following
suse/aardvark-dns<1.10.0-150500.3.3.1
1.10.0-150500.3.3.1
suse/aardvark-dns-debuginfo<1.10.0-150500.3.3.1
1.10.0-150500.3.3.1
suse/netavark<1.10.2-150500.3.3.3
1.10.2-150500.3.3.3
suse/netavark-debuginfo<1.10.2-150500.3.3.3
1.10.2-150500.3.3.3
All of the following
SUSE Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64)
Any of the following
suse/aardvark-dns<1.10.0-150500.3.3.1
1.10.0-150500.3.3.1
suse/aardvark-dns-debuginfo<1.10.0-150500.3.3.1
1.10.0-150500.3.3.1
suse/netavark<1.10.2-150500.3.3.3
1.10.2-150500.3.3.3
suse/netavark-debuginfo<1.10.2-150500.3.3.3
1.10.2-150500.3.3.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade suse/aardvark-dns to a version that resolves this vulnerability.

    Fixed in 1.10.0-150500.3.3.1
  2. Upgrade

    Upgrade suse/aardvark-dns-debuginfo to a version that resolves this vulnerability.

    Fixed in 1.10.0-150500.3.3.1
  3. Upgrade

    Upgrade suse/netavark to a version that resolves this vulnerability.

    Fixed in 1.10.2-150500.3.3.3
  4. Upgrade

    Upgrade suse/netavark-debuginfo to a version that resolves this vulnerability.

    Fixed in 1.10.2-150500.3.3.3
  5. Upgrade

    Upgrade aardvark-dns to a version that resolves this vulnerability.

    Fixed in 1.10.0
  6. Upgrade

    Upgrade netavark to a version that resolves this vulnerability.

    Fixed in 1.10.2
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-2024-718=1
  8. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch openSUSE-SLE-15.5-2024-718=1
  9. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Micro-5.5-2024-718=1
  10. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch SUSE-SLE-Module-Containers-15-SP5-2024-718=1

Event History

Feb 29, 2024
Advisory Published
via SUSE·12:36 PM

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203