This update for pacemaker fixes the following issues: libcrmcommon: Avoid file descriptor leak in IPC client with async connection (bsc#1219323) libcrmcommon: Always output request= in XML output libcrmcommon: crmxmlescape() shouldn't stop on Unicode characters tools: crmattribute emits garbage for --node localhost or auto tools: Fix memory leak in crmmon with HTML output tools: crmmon segfaults when fencer connection is lost (bsc#1219220) attrd: Write Pacemaker Remote node attributes even if not in cache agents: Use attrdupdater dampen delay in SysInfo libcrmcommon: Check correct env vars in pcmknodeattrtarget() scheduler: Restore nvpair behavior without id-ref scheduler: Reject expression without op sooner libcrmcommon: Fix NULL dereference in expandidref() scheduler: Improve logs for invalid id-ref's pacemaker-attrd,libcrmcluster: Avoid use-after-free when remote node in cluster node cache libcrmcluster: Avoid use-after-free in trace log HealthSmart: Check the parameter values of checktemperature to avoid error output agents: Handle dampening parameter consistently and correctly crmresource: Make --wait wait for pending actions in CIB scheduler: Avoid double free with disabled recurring actions agents: HealthCPU - fix the validation of input controller: Don't try to execute agent action at shutdown tools: The dampen parameter is disabled when setting values with attrdupdater.

This update for qt6-base fixes the following issues: CVE-2023-51714: Fixed an incorrect integer overflow check (bsc#1218413).

This update for gstreamer-plugins-bad fixes the following issues: ZDI-CAN-22300: Fixed a buffer overflow in the AV1 video plugin (bsc#1218534).

This update for xorg-x11-server fixes the following issues: Security fixes: CVE-2023-6816: Fixed heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (bsc#1218582) CVE-2024-0229: Fixed reattaching to different master device may lead to out-of-bounds memory access (bsc#1218583) CVE-2024-21885: Fixed heap buffer overflow in XISendDeviceHierarchyEvent (bsc#1218584) CVE-2024-21886: Fixed heap buffer overflow in DisableDevice (bsc#1218585) Other: Fix vmware graphics driver crash (bsc#1218176) Fix xserver crash when Xinerama is enabled (bsc#1218240)

This update for xwayland fixes the following issues: CVE-2023-6816: Fixed heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (bsc#1218582) CVE-2024-0229: Fixed reattaching to different master device may lead to out-of-bounds memory access (bsc#1218583) CVE-2024-21885: Fixed heap buffer overflow in XISendDeviceHierarchyEvent (bsc#1218584) CVE-2024-21886: Fixed heap buffer overflow in DisableDevice (bsc#1218585)

This update for bluez fixes the following issues: CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300). CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

This update for redis7 fixes the following issues: CVE-2023-45145: Fixed a potential permission bypass due to a race condition during UNIX socket creation (bsc#1216376). The following non-security issues were fixed: Redis services are no longer disabled after an upgrade (bsc#1212119).

This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for bind fixes the following issues: Update to release 9.16.48: CVE-2023-50387: Fixed a denial-of-service caused by DNS messages containing a lot of DNSSEC signatures (bsc#1219823). CVE-2023-50868: Fixed a denial-of-service caused by NSEC3 closest encloser proof (bsc#1219826). CVE-2023-4408: Fixed a denial-of-service caused by DNS messages with many different names (bsc#1219851). CVE-2023-5517: Fixed a possible crash when nxdomain-redirect was enabled (bsc#1219852). CVE-2023-5679: Fixed a possible crash when bad interaction between DNS64 and serve-stale, when both of these features are enabled (bsc#1219853). CVE-2023-6516: Fixed excessive memory consumption when continuously trigger the cache database maintenance (bsc#1219854).

This update for openblas contains the following fixes: Added libopenblaspthreads0 to Package Hub SLE-15-SP5 for architecture s390 (no source changes) (bsc#1217608)

This update for samba fixes the following issues: samba was updated to version 4.17.9: CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend (bsc#1213174). CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173). CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172). CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171). CVE-2023-3347: Fixed issue where SMB2 packet signing not enforced (bsc#1213170). CVE-2020-25720: Fixed issue where creating child permission allowed full write to all attributes (bsc#1213386). Bugfixes: Fixed trust relationship failure (bsc#1213384). Backported --pidl-developer fixes. Fixed smbdscavenger crash when service smbd is stopped. Fixed issue where vfsfruit might cause a failing open for delete. Fixed named crashes on DLZ zone update. Fixed issue where winbind recurses into itself via rpcdlsad. Fixed clilist looping 100% CPU against pre-lanman2 servers. Fixed smbclient leaks fds with showacls. Fixed aes256 smb3 encryption algorithms not allowed in smb3sidparse(). Fixed winbindd getting stuck on NTSTATUSRPCSECPKGERROR. Fixed smbget memory leak if failed to download files recursively. Fixed log flood: smbdcalculateaccessmaskfsp: Access denied: message level should be lower. Fixed floating point exception (FPE) via clipullsend at source3/libsmb/clireadwrite.c. Fixed testtstreammoretcpusertimeoutspin fails intermittently on Rackspace GitLab runners. Reduce flapping of ridalloc test. Fixed unreliable largeldap test. Fixed filename parser not checking veto files smb.conf parameter. Fixed mdssvc may crash when initializing. Fixed broken large directory optimization for non-lcomp path elements Fixed streamsdepot failing to create streams. Fixed shadowcopy2 and streamsdepot issues. Fixed wbinfo -u fails on ad dc with >1000 users. Fixed winbindd idmap child contacting the domain controller without a need. Fixed idmapautorid may fail to map sids of trusted domains for the first time. Fixed idmaphash doesn't use IDTYPEBOTH for reverse mappings. Fixed net ads search -P doesn't work against servers in other domains. Fixed DS ACEs might be inherited to unrelated object classes. Fixed temporary smbXsrvtconglobal.tdb can't be parsed. Fixed setting veto files = /./ breaking listing directories (bsc#1212375). Fixed dsgetdcname assuming local system uses IPv4.

This update for libqt5-qtbase fixes the following issues: CVE-2023-32763: Fixed an overflow in QTextLayout (bsc#1211798).

This update for nodejs20 fixes the following issues: Update to 20.11.1: (security updates) CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-21896: Path traversal by monkey-patching Buffer internals (bsc#1219994).j CVE-2024-22017: setuid() does not drop all privileges due to iouring (bsc#1219995). CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-21891: Multiple permission model bypasses due to improper path traversal sequence sanitization (bsc#1219998). CVE-2024-21890: Improper handling of wildcards in --allow-fs-read and --allow-fs-write (bsc#1219999). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: undici version 5.28.3 (bsc#1220017). CVE-2024-24806: libuv version 1.48.0 (bsc#1219724). Update to 20.11.0: esm: add import.meta.dirname and import.meta.filename fs: add c++ fast path for writeFileSync utf8 module: remove useCustomLoadersIfPresent flag module: bootstrap module loaders in shadow realm src: add --disable-warning option src: create per isolate proxy env template src: make process binding data weak stream: use Array for Readable buffer stream: optimize creation testrunner: adds built in lcov reporter testrunner: add Date to the supported mock APIs testrunner, cli: add --test-timeout flag Update to 20.10.0: --experimental-default-type flag to flip module defaults The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected. Added flush option in file system functions for fs.writeFile functions Added experimental WebSocket client vm: fix V8 compilation cache support for vm.Script. This fixes performance regression since v16.x when support for importModuleDynamically was added to vm.Script

This update for aardvark-dns and netavark fixes the following issues: aardvark-dns was updated to version 1.10.0 (jsc#PED-7577): Changes in version 1.10.0:

chore(deps): update rust crate chrono to 0.4.32

chore(deps): update dependency containers/automationimages to v20240102 fix(deps): update rust crate futures-util to 0.3.30 fix(deps): update rust crate anyhow to 1.0.79 fix(deps): update rust crate tokio to 1.35.1 chore(deps): update dependency containers/automationimages to v20231208 fix(deps): update rust crate tokio to 1.35.0 fix duplicated IP CI flake server: remove unused kill switch

fix(deps): update rust crate clap to ~4.4.10

Changes in version 1.9.0:

run cargo update

chore(deps): update dependency containers/automationimages to v20231116 fix(deps): update rust crate tokio to 1.34.0 fix(deps): update rust crate async-broadcast to 0.6.0 update trust-dns to hickory fix(deps): update rust crate futures-util to 0.3.29 fix(deps): update rust crate trust-dns-server to 0.23.2 fix(deps): update rust crate trust-dns-proto to 0.23.2 tmt: initial enablement aardvark main: change error reporting chore(deps): update dependency containers/automationimages to v20231004 fix(deps): update rust crate trust-dns-proto to 0.23.1 fix(deps): update rust crate trust-dns-client to 0.23.1 clippy: some format fixes

fix(deps): update rust crate tokio to 1.33.0

Changes in version 1.8.0:

run cargo update

Packit: switch to @containers/packit-build team for copr failure notification comments [CI:BUILD] Packit: tag @lsm5 on copr build failures chore(deps): update rust crate chrono to 0.4.31 cargo: bump chrono to 0.4.30 test: IPv6 format is changed in v1.72.0 bump nix to 0.27.1 vendor: bump trustdnsproto and trustdnsclient to 0.23.0 fix(deps): update rust crate trust-dns-server to 0.23.0 [CI:BUILD] rpm: spdx compatible license field fix(deps): update rust crate anyhow to 1.0.75 fix(deps): update rust crate tokio to 1.32.0 chore(deps): update dependency containers/automationimages to v20230816 fix(deps): update rust crate tokio to 1.31.0 fix(deps): update rust crate anyhow to 1.0.74 fix(deps): update rust crate anyhow to 1.0.73 fix(deps): update rust crate log to 0.4.20 chore(deps): update dependency containers/automationimages to v20230809 fix(deps): update rust crate tokio to 1.30.0 fix(deps): update rust crate clap to 4.3.21 packit: Build PRs into default packit COPRs chore(deps): update dependency containers/automationimages to v20230807 fix(deps): update rust crate anyhow to 1.0.72 fix(deps): update rust crate signal-hook to 0.3.17 fix(deps): update rust crate clap to 4.3.19 fix(deps): update rust crate clap to 4.3.15 fix(deps): update rust crate signal-hook to 0.3.16 [CI:BUILD] Packit: remove pre-sync action fix(deps): update rust crate clap to 4.3.11 fix(deps): update rust crate tokio to 1.29.1 fix(deps): update rust crate clap to 4.3.10

[CI:BUILD] RPM: cleanup spec and fix eln builds

Disable restricting builds only for tier1 platforms i.e. only for x8664 and aarch64 and enable for all.

Changes in version 1.7.0:

fix(deps): update rust crate tokio to 1.29.0

fix(deps): update rust crate clap to 4.3.8 fix(deps): update rust crate clap to 4.3.5 run cargo update [CI:BUILD] Packit: add Fedora downstream tasks fix(deps): update rust crate clap to 4.3.4 chore(deps): update dependency containers/automationimages to v20230614 fix(deps): update rust crate clap to 4.3.3 fix(deps): update rust crate log to 0.4.19 fix(deps): update rust crate clap to 4.3.2 fix(deps): update rust crate clap to 4.3.1 cirrus: remove verifyvendor task chore(deps): update dependency containers/automationimages to v20230601 fix(deps): update rust crate trust-dns-server to 0.22.1 chore(deps): update rust crate chrono to 0.4.26 fix(deps): update rust crate tokio to 1.28.2 fix(deps): update rust crate log to 0.4.18 chore(deps): update rust crate chrono to 0.4.25 fix(deps): update rust crate clap to 4.3.0 chore(deps): update dependency containers/automationimages to v20230517 fix(deps): update rust crate tokio to 1.28.1 chore(deps): update dependency containers/automationimages to v20230426 fix(deps): update rust crate clap to 4.2.7 fix(deps): update rust crate anyhow to 1.0.71 fix typo in makefile fix(deps): update rust crate tokio to 1.28.0 fix(deps): update rust crate clap to 4.2.5 fix(deps): update rust crate syslog to ^6.1.0 fix(deps): update rust crate clap to 4.2.4 fix(deps): update rust crate clap to 4.2.3 fix(deps): update rust crate clap to v4

chore(deps): update dependency containers/automationimages to v20230405

Changes in version 1.6.0:

fix(deps): update rust crate tokio to 1.27.0

use lower TTL for contianer entries fix(deps): update rust crate syslog to ^6.0.1 fix(deps): update rust crate futures-util to 0.3.28 chore(deps): update dependency containers/automationimages to v20230330 Disable Dependabot in favor of Renovate chore(deps): update dependency containers/automationimages to v20230320 build(deps): bump futures-util from 0.3.26 to 0.3.27 [CI:BUILD] Packit: trigger builds on commit to main branch build(deps): bump anyhow from 1.0.68 to 1.0.70 fix lint issue with new rust version 1.68 Cirrus: Update to newer CI VM images build(deps): bump chrono from 0.4.23 to 0.4.24 build(deps): bump libc from 0.2.139 to 0.2.140 build(deps): bump async-broadcast from 0.5.0 to 0.5.1 build(deps): bump signal-hook from 0.3.14 to 0.3.15 build(deps): bump futures-util from 0.3.25 to 0.3.26 build(deps): bump tokio from 1.25.0 to 1.26.0 [CI:DOCS] Clarify packit related comments [CI:BUILD] Packit: initial enablement Allow custom cargo binary path Switch to explicit platform list for cargo vendor-filterer Add renovate.json5 Cirrus: Groom rust cache before updating netavark was update to version 1.10.2 (jsc#PED-7577): Changes in version 1.10.2:

Fixed aardvark-dns handling

Do not perform network namespace detection on AV update

Changes in version 1.10.1:

Updated to nftables release 0.3 from crates.io

DISTROPACKAGE: fix incorrect vendored tar archive URL

Bump to 1.11.0-dev

Changes in version 1.10.0:

RPM: update .cargo/config before building

Added support for isolation to the nftables driver build(deps): bump h2 from 0.3.22 to 0.3.24 chore(deps): update rust crate chrono to 0.4.32 fix(deps): update rust crate envlogger to 0.11.0 chore(deps): update dependency containers/automationimages to v20240102 Bump nftables-rs to latest commit Netavark: nftables support fix(deps): update rust crate serdejson to 1.0.111 feat: added the --firewall-driver option Document how to generate a code coverage report for netavark fix(deps): update rust crate clap to ~4.4.12 fix(deps): update rust crate serdejson to 1.0.110 fix(deps): update rust-futures monorepo to 0.3.30 fix(deps): update rust crate nispor to 1.2.16 chore(deps): update rust crate tempfile to 3.9.0 Use tonic::transport::Uri instead of HTTP chore(deps): update dependency containers/automationimages to v20231208 fix(deps): update rust crate tokio to 1.35 dhcp-proxy: return actual error instead of generic one dhcp-proxy: skip set gateway if missing bump netlink-packet-route to 0.18.1 chore(deps): update rust crate oncecell to 1.19.0 fix(deps): update rust crate nispor to 1.2.15 fix(deps): update rust crate serde to 1.0.193 fix(deps): update rust crate clap to ~4.4.10 aardvark: show error if process is in wrong netns aardvark: remove unessesary unlock lockfile calls fix(deps): update rust crate url to 2.5.0

Bump working version to v1.10.0-dev

Changes in version 1.9.0:

test: fix syntax problem in helpers.bash

run cargo update use OsString/Path over String for file paths chore(deps): update dependency containers/automationimages to v20231116 firewalld-reload: fix CI tests firewalld-reload: prevent race which could leak fw rules fix(deps): update rust crate clap to ~4.4.8 CI: skip broken firewalld test fix(deps): update rust crate http to 0.2.11 rpm: add netavark-firewalld-reload.service to spec firewalld-reload: add integration tests firewall/state: make sure to ignore enoent on read firewall-reload: integrate actual logic to reload rules firewall/state: improve error messages firewall: add state functions to serialize configs firewalld: fix lint errors with rust v1.73 firewall: do not use full Network in NetworkStruct firewall: add dnsport to SetupNetwork add firewalld-reload subcommand fix(deps): update rust crate http to 0.2.10 fix(deps): update rust crate envlogger to 0.10.1 fix(deps): update rust crate tokio to 1.34 Update rust container build files bridge: force static mac on bridge interface fix(deps): update rust crate futures-core to 0.3.29 fix(deps): update rust crate serde to 1.0.190 fix(deps): update rust crate serdejson to 1.0.108 fix(deps): update rust crate sysctl to 0.5.5 fix(deps): update rust-futures monorepo to 0.3.29 CI: Drop CI VM distro name chore(deps): update dependency containers/automationimages to v20231004 fix(deps): update rust crate tokio to 1.33 build-sys: Filter to tier 2 Linux declaratively fix(deps): update rust crate sha2 to 0.10.8 fix podman.io community link

Bump to v1.9.0-dev

Changes in version 1.8.0:

run cargo update

Add vrf support for bridges Packit: switch to @containers/packit-build team for copr failure notification comments fix(deps): update rust crate nispor to 1.2.14 [CI:BUILD] Packit: tag @lsm5 on copr build failures chore(deps): update rust crate chrono to 0.4.31 fix(deps): update rust crate serdejson to 1.0.107 rust io safety: convert RawFd to BorrowedFd<> bump nix to 0.27.1 chore(deps): update rust crate chrono to 0.4.30 fix(deps): update rust crate serdejson to 1.0.106 chore(deps): update rust crate chrono to 0.4.29 fix(deps): update rust crate netlink-packet-route to 0.17.1 Bump tonic and prost Update container image to F38 Add ACCEPT rules in firewall for bridge network with internal dns. chore(deps): update rust crate tonic-build to 0.10 fix(deps): update rust crate nispor to 1.2.13 fix(deps): update rust crate serde to 1.0.188 Fix clippy warnings about formatting update chrono crate fix(deps): update rust crate url to 2.4.1 Add protoc dependency to README [CI:BUILD] rpm: spdx compatible license field fix(deps): update rust crate tokio to 1.32 chore(deps): update dependency containers/automationimages to v20230816 fix(deps): update rust crate serdejson to 1.0.105 fix(deps): update rust crate tokio to 1.31 fix(deps): update rust crate log to 0.4.20 run cargo update update tonic-build to 0.9.2 bump rust edition to 2021 iptables: drop invalid packages fix(deps): update rust crate tokio to 1.30 docs: Convert markdown with go-md2man instead of mandown fix(deps): update rust crate clap to 4.3.21 packit: Build PRs into default packit COPRs chore(deps): update dependency containers/automationimages to v20230807 fix(deps): update rust crate serde to 1.0.183 fix(deps): update rust crate serde to 1.0.181 fix(deps): update rust crate serde to 1.0.180 fix(deps): update rust crate serdejson to 1.0.104 fix(deps): update rust crate serde to 1.0.179 fix(deps): update rust crate serde to 1.0.176 fix(deps): update rust crate clap to 4.3.19 fix(deps): update rust crate serde to 1.0.175 fix(deps): update rust crate clap to 4.3.17 fix(deps): update rust crate clap to 4.3.15 fix(deps): update rust crate clap to 4.3.12 fix(deps): update rust crate serdejson to 1.0.103 [CI:BUILD] Packit: remove pre-sync action fix(deps): update rust crate serdejson to 1.0.102 fix(deps): update rust crate nispor to 1.2.12 macvlan: use netlink type for bclim bump netlink deps fix(deps): update rust crate serde to 1.0.171 fix(deps): update rust crate serde to 1.0.167 fix(deps): update rust crate clap to 4.3.11 fix(deps): update rust crate serde to 1.0.166 fix(deps): update rust crate serdejson to 1.0.100 iptables: improve error when ip6?tables commands are missing fix(deps): update rust crate clap to 4.3.10 fix(deps): update rust crate zbus to 3.14.1 [CI:BUILD] RPM: Fix ELN build and cleanup spec

bump to v1.8.0-dev

Changes in version 1.7.0:

fix(deps): update rust crate tokio to 1.29

netavark: make --config required for dns fix(deps): update rust crate serdejson to 1.0.99 fix(deps): update rust crate clap to 4.3.8 [CI:BUILD] Packit: add Fedora downstream tasks run cargo update fix(deps): update rust crate serdejson to 1.0.97 fix(deps): update rust crate sha2 to 0.10.7 fix(deps): update rust crate clap to 4.3.4 chore(deps): update dependency containers/automationimages to v20230614 fix(deps): update rust crate clap to 4.3.3 fix(deps): update rust crate log to 0.4.19 aardvark: fix missleading dns disabled log firewall: add NETAVARKISOLATION3 chain for strict isolation docs: fix link to getting started fix(deps): update rust crate serde to 1.0.164 netlink: fix incorrect info log for delroute dhcp-proxy: apply new ip address/gateway test-dhcp: fix broekn hasip() check dhcp-proxy: actually implement renewing leases dhcp-proxy: simplify code dhcp-proxy: drop macaddr dependency dhcp-proxy: remove some unused traits fix(deps): update rust crate zbus to 3.13.1 fix(deps): update rust crate clap to 4.3.2 chore(deps): update rust crate oncecell to 1.18.0 fix(deps): update rust crate url to 2.4.0 fix(deps): update rust crate clap to 4.3.1 chore(deps): update dependency containers/automationimages to v20230601 chore(deps): update rust crate chrono to 0.4.26 chore(deps): update rust crate chrono to 0.4.25 fix(deps): update rust crate log to 0.4.18 chore(deps): update rust crate oncecell to 1.17.2 macvlan: add bclim option parseoption(): return option instead of default add nodefaultgateway option fix(deps): update rust crate clap to 4.3.0 chore(deps): update dependency containers/automationimages to v20230517 fix(deps): update rust crate serde to 1.0.163 Add ability to add static route fix(deps): update rust crate serde to 1.0.162 Cirrus: Update fedora name to match image fix(deps): update rust crate clap to 4.2.7 chore(deps): update dependency containers/automationimages to v20230426 correct typo in Makefile simplify path printing fix(deps): update rust crate tokio to 1.28 aardvark-dns pid: return better errors fix comment in Subnet definition aardvark: no error when aardvark config is not there fix(deps): update rust crate zbus to 3.12.0 fix(deps): update rust crate clap to 4.2.4 fix(deps): update rust crate clap to 4.2.2 fix(deps): update rust crate serdejson to 1.0.96 update clap to v4 fix(deps): update rust crate serde to 1.0.160

bump to v1.7.0-dev

Changes in version 1.6.0:

dhcp-proxy: fix typo for --activity-timeout

chore(deps): update dependency containers/automationimages to v20230405 dhcp-proxy: use better error when connection fails add documentation for netavark plugins add stderr example plugin to test stderr passthrough add netavark plugin driver add example error plugin add host-device example plugin plugin: add simple plugin interface netlink: add dumpaddresses netlink: add setlinkns dhcp-proxy: correctly exit > 0 on errors fix(deps): update rust crate tonic to 0.9 fix(deps): update rust crate mozim to 0.2.2 fix(deps): update rust crate serde to 1.0.159 fix(deps): update rust crate netlink-sys to 0.8.5 dhcp-proxy: create socket directory only when used dhcp-proxy: do not remove socket when running under systemd Makefile: netavark-dhcp-proxy.service use correct path fix(deps): update rust crate http to 0.2.9 chore(deps): update rust crate oncecell to 1.17.1 fix(deps): update rust-futures monorepo to 0.3.28 fix(deps): update rust crate serdejson to 1.0.95 chore(deps): update dependency containers/automationimages to v20230330 Disable Dependabot in favor of Renovate chore(deps): update rust crate chrono to 0.4.24 build(deps): bump ipnet from 2.7.1 to 2.7.2 build(deps): bump serde from 1.0.158 to 1.0.159 build(deps): bump serdejson from 1.0.94 to 1.0.95 update,main: dont write empty space when no networkdnsservers is given fix(deps): update rust crate tokio to 1.27 Quit Leasing when Client disconnects build(deps): bump mozim from 0.2.1 to 0.2.2 iptables: fix incorrect debug statement build(deps): bump serde from 1.0.156 to 1.0.158 iptables: port fw handle wildcard address correctly chore(deps): update dependency containers/automationimages to v20230320 build(deps): bump zbus from 3.11.0 to 3.11.1 build(deps): bump anyhow from 1.0.69 to 1.0.70 [CI:BUILD] Packit: trigger builds on commit to main branch Cirrus: Invalidate v2 bin cache Include Systemd Files in RPM Package Cirrus: Fix success failing on artifact extraction fix lint issue with new rust version 1.68 Cirrus: Update to newer CI VM images build(deps): bump serde from 1.0.152 to 1.0.156 combine dhcp-proxy and netavark into one binary update: should allow empty networkdnsservers build(deps): bump libc from 0.2.139 to 0.2.140 fix aarch64 ncat flake update to mozim 0.2.1 build(deps): bump zbus from 3.10.0 to 3.11.0 packit: Update build release tag correctly test: move proto option into runnctest() test: add netns pid param to port checks test: import podman code to check for ports cirrus.yaml: add new binaries in artprepscript fix netavark-dhcp-proxy binary in system unit import netavark-proxy-dhcp tests add buildproxyclient target add netavark-dhcp-proxy to rpm Fix dhcp-proxy build Merge nv-dhcp-proxy into nv fix default route metric test name build(deps): bump tokio from 1.25.0 to 1.26.0 Support none parameter on NETAVARKFW build(deps): bump anyhow from 1.0.68 to 1.0.69 Fix typos update netlink-packet-{route,core} to 0.15 and 0.5 build(deps): bump serdejson from 1.0.92 to 1.0.93 build(deps): bump zbus from 3.8.0 to 3.10.0 [CI:BUILD] Packit: initial enablement Allow custom cargo binary path build(deps): bump serdejson from 1.0.91 to 1.0.92 Cirrus: Reduce requested CPUs for compile-tasks bump to version 1.0.6-dev build(deps): bump netlink-sys from 0.8.3 to 0.8.4

Add renovate.json5

Added aardvark-dns as dependency requirement for netavark

This update for openvswitch3 fixes the following issues: CVE-2023-3966: Fixed invalid memory access in Geneve with HW offload (bsc#1219465).

This update for wpasupplicant fixes the following issues: CVE-2023-52160: Bypassing WiFi Authentication (bsc#1219975).

This update for sudo fixes the following issues: CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for vim fixes the following issues: Updated to version 9.0 with patch level 1572. CVE-2023-2426: Fixed Out-of-range Pointer Offset use (bsc#1210996). CVE-2023-2609: Fixed NULL Pointer Dereference (bsc#1211256). CVE-2023-2610: Fixed nteger Overflow or Wraparound (bsc#1211257).

This update for libxml2 fixes the following issues: CVE-2023-39615: Fixed crafted xml can cause global buffer overflow (bsc#1214768).

This update for frr fixes the following issues: CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284). CVE-2023-41358: Fixed crash in bgpd/bgppacket.c (bsc#1214735). CVE-2023-41360: Fixed out-of-bounds read in bgpd/bgppacket.c (bsc#1214739). CVE-2023-3748: Fixed inifinite loop in babld message parsing may cause DoS (bsc#1213434). CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgpnlriparseflowspec (bsc#1215065).

This update for suse-module-tools fixes the following issues: Update to version 15.5.2: rpm-script: update bootloader after creating initramfs (bsc#1213822) rpm-script: generate initrd when INITRDINPOSTTRANS is set (bsc#1212957) cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066)

This update for conmon fixes the following issues: conmon is rebuild with go1.21 to capture current stability, bug and security fixes. (bsc#1215806)

This update for samba fixes the following issues: CVE-2023-4091: Fixed a bug where a client can truncate file with read-only permissions. (bsc#1215904) CVE-2023-42669: Fixed a bug in "rpcecho" development server which allows Denial of Service via sleep() call on AD DC. (bsc#1215905) CVE-2023-42670: Fixed the procedure number which was out of range when starting Active Directory Users and Computers. (bsc#1215906) CVE-2023-3961: Fixed an unsanitized client pipe name passed to localnpconnect(). (bsc#1215907) CVE-2023-4154: Fixed a bug in dirsync which allows SYSTEM access with only "GUIDDRSGETCHANGES" right. (bsc#1215908)

This update of cni fixes the following issues: rebuild the package with the go 1.21 security release (bsc#1212475).

This update of cni-plugins fixes the following issues: rebuild the package with the go 1.21 security release (bsc#1212475).

This update for fwupd fixes the following issues: fwupd/FuEngine failure messages in /var/log/messages in SLES15 SP5 (bsc#1212211)

This update of buildah fixes the following issues: rebuild the package with the go 1.21 security release (bsc#1212475).

This update for suse-module-tools fixes the following issues: Update to version 15.5.3:

CVE-2023-1829: Blacklisted the Linux kernel tcindex classifier module (bsc#1210335).

CVE-2023-23559: Blacklisted the Linux kernel RNDIS modules (bsc#1205767, jsc#PED-5731).

This update for grub2 fixes the following issues: Security fixes: - CVE-2023-4692: Fixed an out-of-bounds write at fs/ntfs.c which may lead to unsigned code execution. (bsc#1215935) - CVE-2023-4693: Fixed an out-of-bounds read at fs/ntfs.c which may lead to leak sensitive information. (bsc#1215936) Other fixes: - Fix a boot delay issue in PowerPC PXE boot (bsc#1201300)

This update for bind fixes the following issues: Update to release 9.16.42 Security Fixes: The overmem cleaning process has been improved, to prevent the cache from significantly exceeding the configured max-cache-size limit. (CVE-2023-2828) A query that prioritizes stale data over lookup triggers a fetch to refresh the stale data in cache. If the fetch is aborted for exceeding the recursion quota, it was possible for named to enter an infinite callback loop and crash due to stack overflow. This has been fixed. (CVE-2023-2911) Bug Fixes: Previously, it was possible for a delegation from cache to be returned to the client after the stale-answer-client-timeout duration. This has been fixed. [bsc#1212544, bsc#1212567, jsc#SLE-24600] Update to release 9.16.41 Bug Fixes: When removing delegations from an opt-out range, empty-non-terminal NSEC3 records generated by those delegations were not cleaned up. This has been fixed. [jsc#SLE-24600] Update to release 9.16.40 Bug Fixes: Logfiles using timestamp-style suffixes were not always correctly removed when the number of files exceeded the limit set by versions. This has been fixed for configurations which do not explicitly specify a directory path as part of the file argument in the channel specification. Performance of DNSSEC validation in zones with many DNSKEY records has been improved. Update to release 9.16.39 Feature Changes: libuv support for receiving multiple UDP messages in a single recvmmsg() system call has been tweaked several times between libuv versions 1.35.0 and 1.40.0; the current recommended libuv version is 1.40.0 or higher. New rules are now in effect for running with a different version of libuv than the one used at compilation time. These rules may trigger a fatal error at startup: Building against or running with libuv versions 1.35.0 and 1.36.0 is now a fatal error. Running with libuv version higher than 1.34.2 is now a fatal error when named is built against libuv version 1.34.2 or lower.

Running with libuv version higher than 1.39.0 is now a fatal error when named is built against libuv version 1.37.0, 1.38.0, 1.38.1, or 1.39.0.

This prevents the use of libuv versions that may trigger an assertion failure when receiving multiple UDP messages in a single system call. Bug Fixes: named could crash with an assertion failure when adding a new zone into the configuration file for a name which was already configured as a member zone for a catalog zone. This has been fixed. When named starts up, it sends a query for the DNSSEC key for each configured trust anchor to determine whether the key has changed. In some unusual cases, the query might depend on a zone for which the server is itself authoritative, and would have failed if it were sent before the zone was fully loaded. This has now been fixed by delaying the key queries until all zones have finished loading. [jsc#SLE-24600]