Hey Sylvain, ti 14.7.2026 klo 12.51 Martin-Éric Racine ([email protected]) kirjoitti: > ti 14.7.2026 klo 12.14 Sylvain Beucler ([email protected]) kirjoitti: > > On 14/07/2026 09:00, Salvatore Bonaccorso wrote: > > > On Tue, Jul 14, 2026 at 08:41:51AM +0300, Martin-Éric Racine wrote: > > >> My dashboard shows CVE-2025-70102 as still being unfixed for > > >> oldoldstable. Since Bullseye is LTS at this point, this goes via the > > >> Security team. The enclosed patch includes the fix for the CVE and > > >> some basic packaging touchups to silence Lintian and CI. You're > > >> welcome to use it. > > > > There's no particular urgency for dhcpcd5 at the moment, > > I agree. These are minor fixes, and Bullseye is one month away from > moving to archive.d.o anyhow. > > > but if Martin-Éric wants, he can push an update following: > > https://lts-team.pages.debian.net/wiki/Development.html > > We can help with the administrative tasks. > > > - Please explain how you tested the update. > > See Bug#1141987. I don't have any Bullseye host left, but the fixes > are one-character changes that have been verified to boot on Bookworm > and Trixie.
Is the attached debdiff closer to what you had in mind? Martin-Éric
diff --git a/debian/changelog b/debian/changelog index 97a58386..1e3c6e6d 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,21 @@ +dhcpcd5 (7.1.0-2+deb11u1) bullseye-security; urgency=medium + + * [control] + = Put myself as Maintainer since I maintain subsequent releases. + * [copyright] + + Add myself to debian/* block. + * [patches] + + Cherry-pick upstream fix for CVE-2025-70102 (commit 117742d). + + Cherry-pick upstream fix for CVE-2026-56114 (commit 2f00c7b). + * [salsa-ci.yml] + + Implement basic CI support using the stock Debian pipeline include. + * [upstream] + + Add upstream PGP key to quiet Salsa CI uscan test. + * [watch] + = Update to current Github URL to quiet Salsa CI uscan test. + + -- Martin-Éric Racine <[email protected]> Tue, 14 Jul 2026 16:11:21 +0300 + dhcpcd5 (7.1.0-2) unstable; urgency=high * Apply upstream patches to fix potential security vulnerabilities: diff --git a/debian/control b/debian/control index 96abd6ac..d52e6170 100644 --- a/debian/control +++ b/debian/control @@ -1,7 +1,7 @@ Source: dhcpcd5 Section: net Priority: optional -Maintainer: Scott Leggett <[email protected]> +Maintainer: Martin-Éric Racine <[email protected]> Build-Depends: debhelper (>= 11) Standards-Version: 4.3.0 diff --git a/debian/copyright b/debian/copyright index ccb8a410..e4aa00ed 100644 --- a/debian/copyright +++ b/debian/copyright @@ -61,6 +61,7 @@ Copyright: 2010-2013 Roy Marples <[email protected]> 2013 Christoph Egger <[email protected]> 2014 Salvatore Bonaccorso <[email protected]> 2015 Daniel Echeverry <[email protected]> + 2026 Martin-Éric Racine <[email protected]> License: BSD-2 Files: debian/hooks/* diff --git a/debian/patches/0006_CVE-2025-70102_117742d.patch b/debian/patches/0006_CVE-2025-70102_117742d.patch new file mode 100644 index 00000000..8c2799e0 --- /dev/null +++ b/debian/patches/0006_CVE-2025-70102_117742d.patch @@ -0,0 +1,24 @@ +From 117742d755b591764036dd4218f314f748a3d2b7 Mon Sep 17 00:00:00 2001 +From: Roy Marples <[email protected]> +Date: Sun, 21 Dec 2025 08:31:52 +0000 +Subject: [PATCH] options: Ensure ldop is not NULL dereferenced (#568) + +ldop itself cannot be non NULL as it points to the location. +but *ldop CAN be NULL. + +Fixes #567. +--- + src/if-options.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/src/if-options.c ++++ b/src/if-options.c +@@ -1586,7 +1586,7 @@ + if (*edop) { + dop = &(*edop)->embopts; + dop_len = &(*edop)->embopts_len; +- } else if (ldop) { ++ } else if (*ldop) { + dop = &(*ldop)->embopts; + dop_len = &(*ldop)->embopts_len; + } else { diff --git a/debian/patches/0007_CVE-2026-56114_2f00c7b.patch b/debian/patches/0007_CVE-2026-56114_2f00c7b.patch new file mode 100644 index 00000000..3a277c28 --- /dev/null +++ b/debian/patches/0007_CVE-2026-56114_2f00c7b.patch @@ -0,0 +1,25 @@ +From 2f00c7bfc408b6582d331932dfa47829c4819029 Mon Sep 17 00:00:00 2001 +From: Roy Marples <[email protected]> +Date: Tue, 23 Jun 2026 02:06:55 +0100 +Subject: [PATCH] DHCPv6: Prefix exclude option can be 17 octets (#671) + +Well that's a simple off by one error + +Reported-by: CuB3y0nd <[email protected]> +--- + src/dhcp6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/dhcp6.c b/src/dhcp6.c +index 4a15319c..460040bd 100644 +--- a/src/dhcp6.c ++++ b/src/dhcp6.c +@@ -1060,7 +1060,7 @@ dhcp6_makemessage(struct interface *ifp) + + /* RFC6603 Section 4.2 */ + if (ap->prefix_exclude_len) { +- uint8_t exb[16], *ep, u8; ++ uint8_t exb[17], *ep, u8; + const uint8_t *pp; + + n = (size_t)((ap->prefix_exclude_len - diff --git a/debian/patches/series b/debian/patches/series index 960add30..55b14475 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -3,3 +3,6 @@ 0003-DHCP-Fix-a-potential-1-byte-read-overflow-with-DHO_O.patch 0004-auth-Use-consttime_memequal-3-to-compare-hashes.patch 0005-DHCPv6-Fix-a-potential-read-overflow-with-D6_OPTION_.patch +#7.1.0-2+deb11u1 +0006_CVE-2025-70102_117742d.patch +0007_CVE-2026-56114_2f00c7b.patch diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml new file mode 100644 index 00000000..98cf3bda --- /dev/null +++ b/debian/salsa-ci.yml @@ -0,0 +1,3 @@ +--- +include: + - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc new file mode 100644 index 00000000..06d4dd45 --- /dev/null +++ b/debian/upstream/signing-key.asc @@ -0,0 +1,37 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +xsBNBEkrCoIBCACyCfZ4qEaFPi33OT1EYDziIOb5KnvW3E9zP7O8oHGmhzi+v11X +AsShyiQCFaKD3QgQ/Ra5TV6mjfjV2fPjSXp6wVy9ojvmIFpvIgu1AQJIqkYl0jpV +JFNT1n9RcI3RkZdYYbxkncmp3M8NMhWo0Txpuw6dx2c7gLeQp0PQiwJUPiLS1rUw +KQLFGnPfvMu4koCoxeyYydijR8XuMmEk3KkYxqDKw81IljwhvOiJa9AVik01GMnE +C+9xQcrdaa5+0yqPt3n/9WrGk+yC2oLiSjGgJHNB7niU716gf5HVUYrqEdiuVw4+ +scSjEdCOmRoWcq6D84EIkoXXX0gurSLcHh7xABEBAAHNHlJveSBNYXJwbGVzIDxy +b3lAbWFycGxlcy5uYW1lPsLAkQQTAQgAOxYhBKeF7SdVlV2ek+pZ9ll/l+qa1FVJ +BQJkRp31AhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEFl/l+qa1FVJ +0u8H/2DUrOEsJYpCSRJTvVX+swpFlsnfq55z0/27QwbPmtHak61WTzfr8psBki4g +xKjpyVTpmvXhJVMzCVoMmUCRbYui2BCJ562yM7puxT3e6H8cCdjoezymkhPp9g2A +Xm2QuHvhVvSi1spilgDm5S3o7E6qeoz2NDkItnXuwYvc3uKAUIg9hfSRjXDopV+H +bo0G4pDI010hr3eRRmcZgPcvL4mzxeLasV9ZVFLCQ78C9h2+SzmkcOXE/SAFNT3J +sg7Z5ferEninNiFIDVSDFg9eunA/uhY45waggtjUSjsgCS4PcJnXsDz/dUCyUvNH +PHi48tImjP9oFXCQcMWYUZyIk9PNJVJveSBNYXJwbGVzIChOZXRCU0QpIDxyb3lA +TmV0QlNELm9yZz7CwHgEEwECACIFAkuAGkkCGwMGCwkIBwMCBhUIAgkKCwQWAgMB +Ah4BAheAAAoJEFl/l+qa1FVJHnMH/2zHxpWdNcfMCkOvUo9ZVGjS2K57fKCIb2EH +whyQPqFcY4OtFYNCJC75s4imY5ym24PCeFxxXG8GLMqgVtK5Bbrnx0UMI68x6UzP ++2ap+SBDFE7FaudCAbdX48ABkrHdLA7VzB+Bk/AbpqEIKz86o8NFVFdAxMLdwrLd +TjGG3figbGEOqBIlFog5c+9ijn8uvhRYW3dIb6b4hQ6laOfmZwKAThVhx3Dk9RBH +9DkHe7jD8+PJ05zdCgAa0cx7w7C/eMcpNNakPLASpgzCEmVCobgpuoEcZXmEv8hJ +ZYQ3bzzKEIHhzQNd5Ack7r7r5MrFspD6y5Q419DybL3NiU9gcdjOwE0ESSsK+gEI +AMOYyNnU8QvuP68M3ODgzy3NgqwUViZCTXKiaJhpCgQWTvVYHFMN/DSCBKIWjpJn +B11rVlzeRRO6sjOBl9wiIOCcvv20Soc2sRdysTH7K4stgLFIFXIqT9QxGeaJwe+l +oSwjtbrCZW7G90H4DMfhM/VbEZjv817434XNIAd3fn2sykOnwm9B8vMdy8jk1/vj ++/lmU/YYFkHLKausbkr+FHRaBLJyBBin/Po5D953BaSe/ATN2IGHSfPo0P4hqJ/G +8Tg8QTeBysDk1UpxePY4Sas/rlkmyi/4ssn65BwsUe9W4BxOjX4XO5Pkg368CVo8 +/rk13uGqzqFFFkShj1BaRtEAEQEAAcLAdgQYAQgAIAIbDBYhBKeF7SdVlV2ek+pZ +9ll/l+qa1FVJBQJkRpwjAAoJEFl/l+qa1FVJ5o4H/0M8J+BaAIRcmq6IPnRknvU9 +FiIXCXliuPOZm0a6Vc+U+a5rr8ErSJXzAK/IqtOzHn7KUrlHT/V6w5VRSmIFjR5e +JVXhdcYB9PywxBjr6ffD7v2X4EGhQCTNzrbwmsXP9PF5ES4s++hZa3XO0fbfxnwO +cu+4jJAENupk9lxduXlU2FIoKKctGpzW8RRmM8b5Afi0XLKfR8w+eL7HXtsIfYqo +QMSOuCupmNd+iWS+RZXm0yl30qnLzKs+ZMUvWgkkTZEUFR29yYnPLBQMcq0c7QVo +iCC8dtq0EwWROJeo+dVtczXZORQ3VPM880fBqy2Ppu61lL8OMUlLxmrxqPFakcY= +=S+ww +-----END PGP PUBLIC KEY BLOCK----- diff --git a/debian/watch b/debian/watch index b104fb31..9ff12d3e 100644 --- a/debian/watch +++ b/debian/watch @@ -1,3 +1,4 @@ -version=3 -https://roy.marples.name/downloads/dhcpcd/dhcpcd-([0-9\.]*)\.(?:zip|tgz|tbz|txz|(?:tar\.(?:gz|bz2|xz))) debian uupdate - +version=4 +opts="mode=git,pgpmode=gittag" \ +https://github.com/NetworkConfiguration/dhcpcd.git refs/tags/v([\d\.]+) \ +debian uupdate --no-symlink
