Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package firewalld for openSUSE:Factory checked in at 2026-07-17 18:46:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/firewalld (Old) and /work/SRC/openSUSE:Factory/.firewalld.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "firewalld" Fri Jul 17 18:46:47 2026 rev:98 rq:1365735 version:2.3.2 Changes: -------- --- /work/SRC/openSUSE:Factory/firewalld/firewalld.changes 2026-02-23 09:20:16.090864441 +0100 +++ /work/SRC/openSUSE:Factory/.firewalld.new.24530/firewalld.changes 2026-07-17 18:46:49.223864383 +0200 @@ -1,0 +2,47 @@ +Wed May 27 16:16:23 UTC 2026 - Rahul Jain <[email protected]> + + * Fix CVE-2026-4948: local unprivileged users can modify firewall + state due to D-Bus setter mis-authorizations (bsc#1260903) + [+ 0003-CVE-2026-4948-fix-dbus-setter-authorization.patch] + +------------------------------------------------------------------- +Wed Jan 21 08:12:36 UTC 2026 - Rahul Jain <[email protected]> + +- Update to New Version 2.3.2 +* doc(policy): add examples to man page +* doc(policies): correct word is asymmetric +* fix(doc): dbus: remove links to nonexistent IDs +* fix(policy): allow forward ports with ingress zone and egress HOST +* fix(server): load firewall rules before claiming dbus +* fix(nftables): ipset: add entries from GLib loop when idle +* fix(systemd): Requires dbus +* fix(nftables): use current pkttype keywords +* fix(systemd): use ProtectHome=tmpfs +* fix(policy): allow-host-ipv6: allow MLD packets +* fix(icmpv6): validate router codes +* fix(icmpv6): validate neighbor codes +* fix(icmpv6): validate redirect codes +* docs(zone): update default zone target description to mention that ICMP is accepted +* docs(zone): grammar fixes +* docs(zone): mention that the ACCEPT target allows forwarding out of the zone +* docs(zone): remove references to specific zone names in description of target attribute +* docs: use US spelling of behavior + +------------------------------------------------------------------- +Tue Jan 13 09:19:34 UTC 2026 - Rahul Jain <[email protected]> + +- Update to New Version 2.3.0 + +------------------------------------------------------------------- +Mon Jan 12 07:17:12 UTC 2026 - Rahul Jain <[email protected]> + +-Update to New Version 2.3.0 + It also includes all bug fixes since v2.3.0. + * feat(policy): add disable flag + * feat(client): policy: add disable flag + * feat(cli): policy: add disable flag + * feat(policy): increase maximum name length to 128 + * feat(cli): policy: support setting disable on sets + * feat(policy): set: add gateway + +------------------------------------------------------------------- Old: ---- firewalld-2.1.2.tar.bz2 New: ---- 0003-CVE-2026-4948-fix-dbus-setter-authorization.patch firewalld-2.3.2.tar.bz2 ----------(New B)---------- New: state due to D-Bus setter mis-authorizations (bsc#1260903) [+ 0003-CVE-2026-4948-fix-dbus-setter-authorization.patch] ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ firewalld.spec ++++++ --- /var/tmp/diff_new_pack.snP6jV/_old 2026-07-17 18:46:51.403938217 +0200 +++ /var/tmp/diff_new_pack.snP6jV/_new 2026-07-17 18:46:51.411938488 +0200 @@ -1,7 +1,7 @@ # # spec file for package firewalld # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -46,7 +46,7 @@ %global modprobe_d_files firewalld-sysctls.conf Name: firewalld%{?pkg_suffix} -Version: 2.1.2 +Version: 2.3.2 Release: 0 Summary: A firewall daemon with D-Bus interface providing a dynamic firewall License: GPL-2.0-or-later @@ -56,6 +56,7 @@ Source1: docker-zone.xml Patch0: 0001-Disable-FlushAllOnReload-option.patch Patch1: 0002-firewalld-runstatedir.patch +Patch2: 0003-CVE-2026-4948-fix-dbus-setter-authorization.patch BuildRequires: autoconf BuildRequires: automake BuildRequires: desktop-file-utils @@ -370,7 +371,6 @@ %dir %{_modprobedir} %{_modprobedir}/firewalld-sysctls.conf %config(noreplace) %{_sysconfdir}/firewalld/firewalld.conf -%config(noreplace) %{_sysconfdir}/firewalld/lockdown-whitelist.xml %if 0%{?suse_version} > 1550 %{_distconfdir}/logrotate.d/firewalld %else @@ -426,7 +426,7 @@ %attr(0755,root,root) %{_datadir}/firewalld/gtk3_chooserbutton.py* %attr(0755,root,root) %{_datadir}/firewalld/gtk3_niceexpander.py* %{_datadir}/applications/firewall-config.desktop -%{_datadir}/metainfo/firewall-config.appdata.xml +%{_datadir}/metainfo/org.firewalld.firewall-config.metainfo.xml %{_datadir}/icons/hicolor/*/apps/firewall-config*.* %{_datadir}/glib-2.0/schemas/org.fedoraproject.FirewallConfig.gschema.xml %{_mandir}/man1/firewall-config*.1%{?ext_man} ++++++ 0003-CVE-2026-4948-fix-dbus-setter-authorization.patch ++++++ >From 5fb3914ad830feff6cb2b0670457c60a323c6c6c Mon Sep 17 00:00:00 2001 From: Sizhe Zhao <[email protected]> Date: Tue, 31 Mar 2026 20:46:50 +0800 Subject: [PATCH] fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings} Reference: https://access.redhat.com/security/cve/cve-2026-4948 --- src/firewall/server/firewalld.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py index be6d0d4e6..26769fa74 100644 --- a/src/firewall/server/firewalld.py +++ b/src/firewall/server/firewalld.py @@ -941,7 +941,7 @@ def getZoneSettings2(self, zone, sender=None): log.debug1("getZoneSettings2(%s)", zone) return self.fw.zone.get_config_with_settings_dict(zone) - @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) + @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature="sa{sv}") @dbus_handle_exceptions def setZoneSettings2(self, zone, settings, sender=None): @@ -977,7 +977,7 @@ def getPolicySettings(self, policy, sender=None): log.debug1("policy.getPolicySettings(%s)", policy) return self.fw.policy.get_config_with_settings_dict(policy) - @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) + @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature="sa{sv}") @dbus_handle_exceptions def setPolicySettings(self, policy, settings, sender=None): ++++++ firewalld-2.1.2.tar.bz2 -> firewalld-2.3.2.tar.bz2 ++++++ ++++ 359223 lines of diff (skipped)
