netbird/FreeBSD-ports
0
0
Fork 0
mirror of https://github.com/netbirdio/FreeBSD-ports.git synced 2026-05-22 18:42:42 -07:00
Code Issues Packages Projects Releases Wiki Activity

Security Patches for Plus 24.11/CE 2.7.2

Browse Source 
Patches security fixes in Plus 25.03/CE 2.8.0, but adapted for Plus 24.11/CE 2.7.2
This commit is contained in:
Jim Pingle
2025-05-16 15:36:40 +00:00
parent 082bdf82b6
commit 8ffb307ed8
12 changed files with 6451 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sysutils/pfSense-pkg-System_Patches/Makefile
+1 -1
View File
@@ -1,7 +1,7 @@
# $FreeBSD$
PORTNAME= pfSense-pkg-System_Patches
DISTVERSION= ${PRODUCT_VERSION}
DISTVERSION= 2.2.21
CATEGORIES= sysutils
MASTER_SITES= # empty
DISTFILES= # empty
sysutils/pfSense-pkg-System_Patches/files/usr/local/pkg/patches/0ff75cd0b9fb14c04c94c3585831a9f669be0a5d.patch
+48
View File
@@ -0,0 +1,48 @@
commit 0ff75cd0b9fb14c04c94c3585831a9f669be0a5d
Author: jim-p <jimp@netgate.com>
Date: Tue Apr 1 14:26:41 2025 -0400
Validation and output encoding of IPsec P1 interface. Fixes #16115
diff --git a/src/usr/local/www/vpn_ipsec.php b/src/usr/local/www/vpn_ipsec.php
index 90b8fcc9cd..c23d7da19d 100644
--- a/src/usr/local/www/vpn_ipsec.php
+++ b/src/usr/local/www/vpn_ipsec.php
@@ -351,7 +351,7 @@ $i = 0; foreach (config_get_path('ipsec/phase1', []) as $ph1ent):
<?php
if ($ph1ent['interface']) {
if (isset($iflabels[$ph1ent['interface']])) {
- $if = htmlspecialchars($iflabels[$ph1ent['interface']]);
+ $if = $iflabels[$ph1ent['interface']];
} else {
$if = sprintf("Interface not found: '%s'", $ph1ent['interface']);
}
@@ -359,10 +359,11 @@ $i = 0; foreach (config_get_path('ipsec/phase1', []) as $ph1ent):
$if = "WAN";
}
+ echo htmlspecialchars($if)."<br />";
if (!isset($ph1ent['mobile'])) {
- echo $if."<br />".$ph1ent['remote-gateway'];
+ echo $ph1ent['remote-gateway'];
} else {
- echo $if."<br /><strong>" . gettext("Mobile Clients") . "</strong>";
+ echo "<strong>" . gettext("Mobile Clients") . "</strong>";
}
?>
</td>
diff --git a/src/usr/local/www/vpn_ipsec_phase1.php b/src/usr/local/www/vpn_ipsec_phase1.php
index af1549bbb7..4897369708 100644
--- a/src/usr/local/www/vpn_ipsec_phase1.php
+++ b/src/usr/local/www/vpn_ipsec_phase1.php
@@ -216,6 +216,10 @@ if ($_POST['save']) {
/* input validation */
+ if (!array_key_exists($pconfig['interface'], build_interface_list())) {
+ $input_errors[] = gettext("Invalid interface.");
+ }
+
$method = $pconfig['authentication_method'];
// Unset ca and cert if not required to avoid storing in config
sysutils/pfSense-pkg-System_Patches/files/usr/local/pkg/patches/15844-widgetkey-validation-24.11.patch
+639
View File
File diff suppressed because it is too large Load Diff
sysutils/pfSense-pkg-System_Patches/files/usr/local/pkg/patches/15844-widgetkey-validation-ce-2.7.2.patch
+639
View File
File diff suppressed because it is too large Load Diff
sysutils/pfSense-pkg-System_Patches/files/usr/local/pkg/patches/15856-openvpn-mgmt-fix.patch
+150
View File
@@ -0,0 +1,150 @@
diff --git a/src/etc/inc/openvpn.inc b/src/etc/inc/openvpn.inc
index 5102d6ef5c..384e17356a 100644
--- a/src/etc/inc/openvpn.inc
+++ b/src/etc/inc/openvpn.inc
@@ -2291,14 +2291,22 @@ function openvpn_get_client_status($client, $socket) {
function openvpn_kill_client($port, $remipp, $client_id) {
global $g;
+ $killed = -1;
- //$tcpsrv = "tcp://127.0.0.1:{$port}";
- $tcpsrv = "unix://{$g['openvpn_base']}/{$port}/sock";
+ $port = basename($port);
+ $sock_path = "{$g['openvpn_base']}/{$port}/sock";
+ /* If the socket doesn't exist, or if the remote IP address and port are
+ * not valid, then do not proceed. */
+ if (!file_exists($sock_path) ||
+ !is_ipaddrwithport($remipp)) {
+ return $killed;
+ }
+ $socket = "unix://{$sock_path}";
$errval = null;
$errstr = null;
/* open a tcp connection to the management port of each server */
- $fp = @stream_socket_client($tcpsrv, $errval, $errstr, 1);
+ $fp = @stream_socket_client($socket, $errval, $errstr, 1);
$killed = -1;
if ($fp) {
stream_set_timeout($fp, 1);
diff --git a/src/usr/local/www/status_openvpn.php b/src/usr/local/www/status_openvpn.php
index 1cc6f617e8..daf2fa1123 100644
--- a/src/usr/local/www/status_openvpn.php
+++ b/src/usr/local/www/status_openvpn.php
@@ -37,13 +37,33 @@ require_once("openvpn.inc");
require_once("shortcuts.inc");
require_once("service-utils.inc");
+$servers = openvpn_get_active_servers();
+$sk_servers = openvpn_get_active_servers("p2p");
+$clients = openvpn_get_active_clients();
+
/* Handle AJAX */
if ($_POST['action']) {
if ($_POST['action'] == "kill") {
- $port = $_POST['port'];
- $remipp = $_POST['remipp'];
- $client_id = $_POST['client_id'];
- if (!empty($port) and !empty($remipp)) {
+ $port = $_POST['port'];
+ $remipp = $_POST['remipp'];
+ $client_id = $_POST['client_id'];
+ $error = false;
+
+ /* Validate remote IP address and port. */
+ if (!is_ipaddrwithport($remipp)) {
+ $error = true;
+ }
+ /* Validate submitted server ID */
+ $found_server = false;
+ foreach ($servers as $server) {
+ if ($port == $server['mgmt']) {
+ $found_server = true;
+ } else {
+ continue;
+ }
+ }
+
+ if (!$error && $found_server) {
$retval = openvpn_kill_client($port, $remipp, $client_id);
echo htmlentities("|{$port}|{$remipp}|{$retval}|");
} else {
@@ -64,24 +84,18 @@ if ($_POST['action']) {
}
}
-$servers = openvpn_get_active_servers();
-$sk_servers = openvpn_get_active_servers("p2p");
-$clients = openvpn_get_active_clients();
-
include("head.inc"); ?>
<form action="status_openvpn.php" method="get" name="iform">
<script type="text/javascript">
//<![CDATA[
function killClient(mport, remipp, client_id) {
- var busy = function(index,icon) {
- $(icon).bind("onclick","");
- $(icon).attr('src',$(icon).attr('src').replace("\.gif", "_d.gif"));
- $(icon).css("cursor","wait");
+ if (client_id === '') {
+ $('a[id="i:' + mport + ":" + remipp + '"]').first().children('i').removeClass().addClass('fa-solid fa-cog fa-spin text-danger');
+ } else {
+ $('a[id="i:' + mport + ":" + remipp + '"]').last().children('i').removeClass().addClass('fa-solid fa-cog fa-spin text-danger');
}
- $('img[name="i:' + mport + ":" + remipp + '"]').each(busy);
-
$.ajax(
"<?=$_SERVER['SCRIPT_NAME'];?>",
{
diff --git a/src/usr/local/www/widgets/widgets/openvpn.widget.php b/src/usr/local/www/widgets/widgets/openvpn.widget.php
index 12f2d399dd..f614ca9a3b 100644
--- a/src/usr/local/www/widgets/widgets/openvpn.widget.php
+++ b/src/usr/local/www/widgets/widgets/openvpn.widget.php
@@ -285,10 +285,28 @@ if (!function_exists('printPanel')) {
/* Handle AJAX */
if ($_POST['action']) {
if ($_POST['action'] == "kill") {
- $port = $_POST['port'];
- $remipp = $_POST['remipp'];
- $client_id = $_POST['client_id'];
- if (!empty($port) and !empty($remipp)) {
+ $servers = openvpn_get_active_servers();
+
+ $port = $_POST['port'];
+ $remipp = $_POST['remipp'];
+ $client_id = $_POST['client_id'];
+ $error = false;
+
+ /* Validate remote IP address and port. */
+ if (!is_ipaddrwithport($remipp)) {
+ $error = true;
+ }
+ /* Validate submitted server ID */
+ $found_server = false;
+ foreach ($servers as $server) {
+ if ($port == $server['mgmt']) {
+ $found_server = true;
+ } else {
+ continue;
+ }
+ }
+
+ if (!$error && $found_server) {
$retval = openvpn_kill_client($port, $remipp, $client_id);
echo htmlentities("|{$port}|{$remipp}|{$retval}|");
} else {
@@ -407,6 +425,11 @@ $widgetkey_nodash = str_replace("-", "", $widgetkey);
<script type="text/javascript">
//<![CDATA[
function killClient(mport, remipp, client_id) {
+ if (client_id === '') {
+ $('i[name="i:' + mport + ":" + remipp + '"]').first().removeClass().addClass('fa-solid fa-cog fa-spin text-danger');
+ } else {
+ $('i[name="i:' + mport + ":" + remipp + '"]').last().removeClass().addClass('fa-solid fa-cog fa-spin text-danger');
+ }
$.ajax(
"widgets/widgets/openvpn.widget.php",
sysutils/pfSense-pkg-System_Patches/files/usr/local/pkg/patches/6a92af14584d22f077e1421e952674f880cd5b6c-2_7_2.patch
+81
View File
@@ -0,0 +1,81 @@
diff --git a/src/usr/local/www/services_wol.php b/src/usr/local/www/services_wol.php
index 067142250d..9abd4a1d9c 100644
--- a/src/usr/local/www/services_wol.php
+++ b/src/usr/local/www/services_wol.php
@@ -81,7 +81,7 @@ if ($_POST['Submit'] || $_POST['mac']) {
$input_errors[] = gettext("A valid MAC address must be specified.");
}
- if (!$if) {
+ if (!$if || !array_key_exists($if, get_configured_interface_with_descr())) {
$input_errors[] = gettext("A valid interface must be specified.");
}
@@ -193,10 +193,10 @@ print $form;
<?php foreach ($a_wol as $i => $wolent): ?>
<tr>
<td>
- <?=convert_friendly_interface_to_friendly_descr($wolent['interface']);?>
+ <?=htmlspecialchars(convert_friendly_interface_to_friendly_descr($wolent['interface']));?>
</td>
<td>
- <a href="?mac=<?=$wolent['mac'];?>&amp;if=<?=$wolent['interface'];?>" usepost><?=strtolower($wolent['mac']);?></a>
+ <a href="?mac=<?=$wolent['mac'];?>&amp;if=<?=urlencode($wolent['interface']);?>" usepost><?=strtolower($wolent['mac']);?></a>
</td>
<td>
<?=htmlspecialchars($wolent['descr']);?>
@@ -204,7 +204,7 @@ print $form;
<td>
<a class="fa fa-pencil" title="<?=gettext('Edit Device')?>" href="services_wol_edit.php?id=<?=$i?>"></a>
<a class="fa fa-trash" title="<?=gettext('Delete Device')?>" href="services_wol.php?act=del&amp;id=<?=$i?>" usepost></a>
- <a class="fa fa-power-off" title="<?=gettext('Wake Device')?>" href="?mac=<?=$wolent['mac'];?>&amp;if=<?=$wolent['interface'];?>" usepost></a>
+ <a class="fa fa-power-off" title="<?=gettext('Wake Device')?>" href="?mac=<?=$wolent['mac'];?>&amp;if=<?=urlencode($wolent['interface']);?>" usepost></a>
</td>
</tr>
<?php endforeach?>
diff --git a/src/usr/local/www/services_wol_edit.php b/src/usr/local/www/services_wol_edit.php
index bda82b9d29..d74dc7b9ee 100644
--- a/src/usr/local/www/services_wol_edit.php
+++ b/src/usr/local/www/services_wol_edit.php
@@ -73,6 +73,10 @@ if ($_POST['save']) {
do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors);
+ if (!$_POST['interface'] || !array_key_exists($_POST['interface'], get_configured_interface_with_descr())) {
+ $input_errors[] = gettext("A valid interface must be specified.");
+ }
+
/* normalize MAC addresses - lowercase and convert Windows-ized hyphenated MACs to colon delimited */
$_POST['mac'] = trim(strtolower(str_replace("-", ":", $_POST['mac'])));
diff --git a/src/usr/local/www/widgets/widgets/wake_on_lan.widget.php b/src/usr/local/www/widgets/widgets/wake_on_lan.widget.php
index 00bbdb9f72..8a2e2b28f1 100644
--- a/src/usr/local/www/widgets/widgets/wake_on_lan.widget.php
+++ b/src/usr/local/www/widgets/widgets/wake_on_lan.widget.php
@@ -35,7 +35,7 @@ if (isset($config['wol']['wolentry']) && is_array($config['wol']['wolentry'])) {
// Constructs a unique key that will identify a WoL entry in the filter list.
if (!function_exists('get_wolent_key')) {
function get_wolent_key($wolent) {
- return ($wolent['interface'] . "|" . $wolent['mac']);
+ return (htmlspecialchars($wolent['interface']) . "|" . $wolent['mac']);
}
}
@@ -105,7 +105,7 @@ if (count($wolcomputers) > 0):
<?= $wolent['mac'] ?>
</td>
<td>
- <?= convert_friendly_interface_to_friendly_descr($wolent['interface']) ?>
+ <?= htmlspecialchars(convert_friendly_interface_to_friendly_descr($wolent['interface'])) ?>
</td>
<td>
<?php if ($status == 'expires'): ?>
@@ -117,7 +117,7 @@ if (count($wolcomputers) > 0):
<?php endif; ?>
</td>
<td>
- <a href="services_wol.php?mac=<?= $wolent['mac'] ?>&amp;if=<?= $wolent['interface']?>" usepost>
+ <a href="services_wol.php?mac=<?= $wolent['mac'] ?>&amp;if=<?= urlencode($wolent['interface']) ?>" usepost>
<i class="fa fa-power-off" data-toggle="tooltip" title="<?= gettext("Wake up!") ?>"></i>
</a>
</td>
sysutils/pfSense-pkg-System_Patches/files/usr/local/pkg/patches/6a92af14584d22f077e1421e952674f880cd5b6c.patch
+87
View File
@@ -0,0 +1,87 @@
commit 6a92af14584d22f077e1421e952674f880cd5b6c
Author: jim-p <jimp@netgate.com>
Date: Tue Apr 1 15:22:07 2025 -0400
Validation and output encoding of WOL interface. Fixes #16116
diff --git a/src/usr/local/www/services_wol.php b/src/usr/local/www/services_wol.php
index f3b8999872..44d9df7bc3 100644
--- a/src/usr/local/www/services_wol.php
+++ b/src/usr/local/www/services_wol.php
@@ -78,7 +78,7 @@ if ($_POST['Submit'] || $_POST['mac']) {
$input_errors[] = gettext("A valid MAC address must be specified.");
}
- if (!$if) {
+ if (!$if || !array_key_exists($if, get_configured_interface_with_descr())) {
$input_errors[] = gettext("A valid interface must be specified.");
}
@@ -190,10 +190,10 @@ print $form;
<?php foreach (config_get_path('wol/wolentry', []) as $i => $wolent): ?>
<tr>
<td>
- <?=convert_friendly_interface_to_friendly_descr($wolent['interface']);?>
+ <?=htmlspecialchars(convert_friendly_interface_to_friendly_descr($wolent['interface']));?>
</td>
<td>
- <a href="?mac=<?=$wolent['mac'];?>&amp;if=<?=$wolent['interface'];?>" usepost><?=strtolower($wolent['mac']);?></a>
+ <a href="?mac=<?=$wolent['mac'];?>&amp;if=<?=urlencode($wolent['interface']);?>" usepost><?=strtolower($wolent['mac']);?></a>
</td>
<td>
<?=htmlspecialchars($wolent['descr']);?>
@@ -201,7 +201,7 @@ print $form;
<td>
<a class="fa-solid fa-pencil" title="<?=gettext('Edit Device')?>" href="services_wol_edit.php?id=<?=$i?>"></a>
<a class="fa-solid fa-trash-can" title="<?=gettext('Delete Device')?>" href="services_wol.php?act=del&amp;id=<?=$i?>" usepost></a>
- <a class="fa-solid fa-power-off" title="<?=gettext('Wake Device')?>" href="?mac=<?=$wolent['mac'];?>&amp;if=<?=$wolent['interface'];?>" usepost></a>
+ <a class="fa-solid fa-power-off" title="<?=gettext('Wake Device')?>" href="?mac=<?=$wolent['mac'];?>&amp;if=<?=urlencode($wolent['interface']);?>" usepost></a>
</td>
</tr>
<?php endforeach?>
diff --git a/src/usr/local/www/services_wol_edit.php b/src/usr/local/www/services_wol_edit.php
index e2d04af440..c4a3797c59 100644
--- a/src/usr/local/www/services_wol_edit.php
+++ b/src/usr/local/www/services_wol_edit.php
@@ -70,6 +70,10 @@ if ($_POST['save']) {
do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors);
+ if (!$_POST['interface'] || !array_key_exists($_POST['interface'], get_configured_interface_with_descr())) {
+ $input_errors[] = gettext("A valid interface must be specified.");
+ }
+
/* normalize MAC addresses - lowercase and convert Windows-ized hyphenated MACs to colon delimited */
$_POST['mac'] = trim(strtolower(str_replace("-", ":", $_POST['mac'])));
diff --git a/src/usr/local/www/widgets/widgets/wake_on_lan.widget.php b/src/usr/local/www/widgets/widgets/wake_on_lan.widget.php
index 78d26ba299..70c576d0b0 100644
--- a/src/usr/local/www/widgets/widgets/wake_on_lan.widget.php
+++ b/src/usr/local/www/widgets/widgets/wake_on_lan.widget.php
@@ -47,7 +47,7 @@ $wolcomputers = config_get_path('wol/wolentry', []);
// Constructs a unique key that will identify a WoL entry in the filter list.
if (!function_exists('get_wolent_key')) {
function get_wolent_key($wolent) {
- return ($wolent['interface'] . "|" . $wolent['mac']);
+ return (htmlspecialchars($wolent['interface']) . "|" . $wolent['mac']);
}
}
@@ -117,7 +117,7 @@ if (count($wolcomputers) > 0):
<?= $wolent['mac'] ?>
</td>
<td>
- <?= convert_friendly_interface_to_friendly_descr($wolent['interface']) ?>
+ <?= htmlspecialchars(convert_friendly_interface_to_friendly_descr($wolent['interface'])) ?>
</td>
<td>
<?php if ($status == 'expires'): ?>
@@ -129,7 +129,7 @@ if (count($wolcomputers) > 0):
<?php endif; ?>
</td>
<td>
- <a href="services_wol.php?mac=<?= $wolent['mac'] ?>&amp;if=<?= $wolent['interface']?>" usepost>
+ <a href="services_wol.php?mac=<?= $wolent['mac'] ?>&amp;if=<?= urlencode($wolent['interface']) ?>" usepost>
<i class="fa-solid fa-power-off" data-toggle="tooltip" title="<?= gettext("Wake up!") ?>"></i>
</a>
</td>
sysutils/pfSense-pkg-System_Patches/files/usr/local/pkg/patches/acb-update-24.11.patch
+2250
View File
File diff suppressed because it is too large Load Diff
sysutils/pfSense-pkg-System_Patches/files/usr/local/pkg/patches/acb-update-ce-2.7.2.patch
+2288
View File
File diff suppressed because it is too large Load Diff
sysutils/pfSense-pkg-System_Patches/files/usr/local/pkg/patches/dfc70e51d556d8c1724bfc7f1fd5fe4b73faab3b.patch
+85
View File
@@ -0,0 +1,85 @@
commit dfc70e51d556d8c1724bfc7f1fd5fe4b73faab3b
Author: jim-p <jimp@netgate.com>
Date: Tue Apr 1 12:20:43 2025 -0400
Improve validation of Firewall Schedules. Fixes #16114
diff --git a/src/usr/local/www/firewall_schedule.php b/src/usr/local/www/firewall_schedule.php
index b05d259268..8ebf13e7a1 100644
--- a/src/usr/local/www/firewall_schedule.php
+++ b/src/usr/local/www/firewall_schedule.php
@@ -107,8 +107,8 @@ foreach (config_get_path('schedules/schedule', []) as $schedule):
$firstDayFound = false;
$firstPrint = false;
foreach ($tempmontharray as $monthtmp) {
- $month = $tempmontharray[$arraycounter];
- $day = $tempdayarray[$arraycounter];
+ $month = (int)$tempmontharray[$arraycounter];
+ $day = (int)$tempdayarray[$arraycounter];
if (!$firstDayFound) {
$firstDay = $day;
diff --git a/src/usr/local/www/firewall_schedule_edit.php b/src/usr/local/www/firewall_schedule_edit.php
index da66b59fa6..0ade9fd329 100644
--- a/src/usr/local/www/firewall_schedule_edit.php
+++ b/src/usr/local/www/firewall_schedule_edit.php
@@ -76,24 +76,18 @@ if (isset($id) && $a_schedules[$id]) {
}
if ($_POST['save']) {
-
- if (strtolower($_POST['name']) == "lan") {
- $input_errors[] = gettext("Schedule may not be named LAN.");
- }
-
- if (strtolower($_POST['name']) == "wan") {
- $input_errors[] = gettext("Schedule may not be named WAN.");
- }
-
- if (strtolower($_POST['name']) == "") {
+ if (empty($_POST['name'])) {
$input_errors[] = gettext("Schedule name cannot be blank.");
}
+ /* Schedule names are not directly referenced in firewall rules, so they
+ * do not have to follow this format, but since this limitation was
+ * already in place, it makes for convenient validation. */
if (!is_validaliasname($_POST['name'])) {
$input_errors[] = invalidaliasnamemsg($_POST['name'], gettext("schedule"));
}
- /* check for name conflicts */
+ /* Check for name conflicts */
foreach ($a_schedules as $schedule) {
if (isset($id) && ($a_schedules[$id]) && ($a_schedules[$id] === $schedule)) {
continue;
@@ -124,6 +118,17 @@ if ($_POST['save']) {
continue;
}
+ /* Valid schedule specifications are a comma-separated list containing
+ * or or more of:
+ *
+ * - Single digit "day of week" numbers: <1-7>
+ * - Specific days in the format: w<1-52>p<1-7>-m<1-12>d<1-31>
+ */
+ if (!preg_match('/^([1-7]|,|w(5[0-2]|[1-4][0-9]|[0-9])p([1-7])-m(1[0-2]|[1-9])d([12][0-9]|3[01]|[1-9]))+$/', $_POST['schedule' . $x])) {
+ $input_errors[] = sprintf(gettext("Invalid schedule specification in row %d."), $x+1);
+ continue;
+ }
+
$timerangeFound = true;
$timeparts = array();
$firstprint = false;
@@ -489,8 +494,9 @@ if ($getSchedule && !empty($pconfig['timerange'])) {
$tempdayarray = explode(",", $timerange['day']);
$arraycounter = 0;
foreach ($tempmontharray as $monthtmp) {
- $month = $tempmontharray[$arraycounter];
- $day = $tempdayarray[$arraycounter];
+ $month = (int)$tempmontharray[$arraycounter];
+ $day = (int)$tempdayarray[$arraycounter];
+
$daypos = date("w", mktime(0, 0, 0, date($month), date($day), date("Y")));
//if sunday, set position to 7 to get correct week number. This is due to php limitations on ISO-8601. When we move to php5.1 we can change this.
if ($daypos == 0) {
sysutils/pfSense-pkg-System_Patches/files/usr/local/pkg/patches/manifest.inc
+173
View File
@@ -25,6 +25,177 @@ global $recommended_patches;
* save space.
*/
$recommended_patches = [
[
'uniqid' => 'acb-update-24.11',
'versions' => ['24.11'],
'descr' => 'AutoConfigBackup Update',
'links' => [
[ 'text' => 'After applying this patch, consider changing the ACB device key' ],
[ 'text' => 'Redmine #12249',
'url' => 'https://redmine.pfsense.org/issues/12249', ],
[ 'text' => 'Redmine #15927',
'url' => 'https://redmine.pfsense.org/issues/15927', ],
[ 'text' => 'pfSense-SA-25_03.webgui',
'url' => 'https://docs.netgate.com/downloads/pfSense-SA-25_03.webgui.asc', ],
[ 'text' => 'CVE-2024-57273' ],
[ 'text' => 'Redmine #16010',
'url' => 'https://redmine.pfsense.org/issues/16010', ],
[ 'text' => 'Redmine #16011',
'url' => 'https://redmine.pfsense.org/issues/16011', ],
[ 'text' => 'Redmine #16012',
'url' => 'https://redmine.pfsense.org/issues/16012', ],
[ 'text' => 'Redmine #16013',
'url' => 'https://redmine.pfsense.org/issues/16013', ],
[ 'text' => 'Redmine #16014',
'url' => 'https://redmine.pfsense.org/issues/16014', ],
[ 'text' => 'Redmine #16015',
'url' => 'https://redmine.pfsense.org/issues/16015', ],
[ 'text' => 'Redmine #16016',
'url' => 'https://redmine.pfsense.org/issues/16016', ],
[ 'text' => 'pfSense-SA-25_04.webgui',
'url' => 'https://docs.netgate.com/downloads/pfSense-SA-25_04.webgui.asc', ],
[ 'text' => 'CVE-2024-57273' ],
],
'basedir' => '/',
'pathstrip' => 2,
'ignorewhitespace' => true,
],
[
'uniqid' => 'acb-update-ce-2.7.2',
'versions' => ['2.7.2'],
'descr' => 'AutoConfigBackup update',
'links' => [
[ 'text' => 'After applying this patch, consider changing the ACB device key' ],
[ 'text' => 'Redmine #12249',
'url' => 'https://redmine.pfsense.org/issues/12249', ],
[ 'text' => 'Redmine #15927',
'url' => 'https://redmine.pfsense.org/issues/15927', ],
[ 'text' => 'pfSense-SA-25_03.webgui',
'url' => 'https://docs.netgate.com/downloads/pfSense-SA-25_03.webgui.asc', ],
[ 'text' => 'CVE-2024-57273' ],
[ 'text' => 'Redmine #16010',
'url' => 'https://redmine.pfsense.org/issues/16010', ],
[ 'text' => 'Redmine #16011',
'url' => 'https://redmine.pfsense.org/issues/16011', ],
[ 'text' => 'Redmine #16012',
'url' => 'https://redmine.pfsense.org/issues/16012', ],
[ 'text' => 'Redmine #16013',
'url' => 'https://redmine.pfsense.org/issues/16013', ],
[ 'text' => 'Redmine #16014',
'url' => 'https://redmine.pfsense.org/issues/16014', ],
[ 'text' => 'Redmine #16015',
'url' => 'https://redmine.pfsense.org/issues/16015', ],
[ 'text' => 'Redmine #16016',
'url' => 'https://redmine.pfsense.org/issues/16016', ],
[ 'text' => 'pfSense-SA-25_04.webgui',
'url' => 'https://docs.netgate.com/downloads/pfSense-SA-25_04.webgui.asc', ],
[ 'text' => 'CVE-2024-57273' ],
],
'basedir' => '/',
'pathstrip' => 2,
'ignorewhitespace' => true,
],
[
'uniqid' => '15844-widgetkey-validation-24.11',
'versions' => ['24.11'],
'descr' => 'Fix Dashboard widget key validation',
'links' => [
[ 'text' => 'Redmine #15844',
'url' => 'https://redmine.pfsense.org/issues/15844', ],
[ 'text' => 'pfSense-SA-25_01.webgui',
'url' => 'https://docs.netgate.com/downloads/pfSense-SA-25_01.webgui.asc', ],
[ 'text' => 'CVE-2024-54779' ],
],
'basedir' => '/',
'pathstrip' => 2,
'ignorewhitespace' => true,
],
[
'uniqid' => '15844-widgetkey-validation-ce-2.7.2',
'versions' => ['2.7.2'],
'descr' => 'Fix Dashboard widget key validation',
'links' => [
[ 'text' => 'Redmine #15844',
'url' => 'https://redmine.pfsense.org/issues/15844', ],
[ 'text' => 'pfSense-SA-25_01.webgui',
'url' => 'https://docs.netgate.com/downloads/pfSense-SA-25_01.webgui.asc', ],
[ 'text' => 'CVE-2024-54779' ],
],
'basedir' => '/',
'pathstrip' => 2,
'ignorewhitespace' => true,
],
[
'uniqid' => '15856-openvpn-mgmt-fix',
'versions' => ['24.11', '2.7.2'],
'descr' => 'Fix OpenVPN status and widget validation',
'links' => [
[ 'text' => 'Redmine #15856',
'url' => 'https://redmine.pfsense.org/issues/15856', ],
[ 'text' => 'pfSense-SA-25_02.webgui',
'url' => 'https://docs.netgate.com/downloads/pfSense-SA-25_02.webgui.asc', ],
[ 'text' => 'CVE-2024-54780' ],
],
'basedir' => '/',
'pathstrip' => 2,
'ignorewhitespace' => true,
],
[
'uniqid' => 'dfc70e51d556d8c1724bfc7f1fd5fe4b73faab3b',
'versions' => ['24.11', '2.7.2'],
'descr' => 'Fix potential stored XSS in Firewall Schedules',
'links' => [
[ 'text' => 'Redmine #16114',
'url' => 'https://redmine.pfsense.org/issues/16114', ],
[ 'text' => 'pfSense-SA-25_05.webgui',
'url' => 'https://docs.netgate.com/downloads/pfSense-SA-25_05.webgui.asc', ],
],
'basedir' => '/',
'pathstrip' => 2,
'ignorewhitespace' => true,
],
[
'uniqid' => '0ff75cd0b9fb14c04c94c3585831a9f669be0a5d',
'versions' => ['24.11', '2.7.2'],
'descr' => 'Fix potential stored XSS in IPsec Phase 1',
'links' => [
[ 'text' => 'Redmine #16115',
'url' => 'https://redmine.pfsense.org/issues/16115', ],
[ 'text' => 'pfSense-SA-25_06.webgui',
'url' => 'https://docs.netgate.com/downloads/pfSense-SA-25_06.webgui.asc', ],
],
'basedir' => '/',
'pathstrip' => 2,
'ignorewhitespace' => true,
],
[
'uniqid' => '6a92af14584d22f077e1421e952674f880cd5b6c',
'versions' => ['24.11'],
'descr' => 'Fix potential stored XSS in Wake on LAN page and widget',
'links' => [
[ 'text' => 'Redmine #16116',
'url' => 'https://redmine.pfsense.org/issues/16116', ],
[ 'text' => 'pfSense-SA-25_07.webgui',
'url' => 'https://docs.netgate.com/downloads/pfSense-SA-25_07.webgui.asc', ],
],
'basedir' => '/',
'pathstrip' => 2,
'ignorewhitespace' => true,
],
[
'uniqid' => '6a92af14584d22f077e1421e952674f880cd5b6c-2_7_2',
'versions' => ['2.7.2'],
'descr' => 'Fix potential stored XSS in Wake on LAN page and widget',
'links' => [
[ 'text' => 'Redmine #16116',
'url' => 'https://redmine.pfsense.org/issues/16116', ],
[ 'text' => 'pfSense-SA-25_07.webgui',
'url' => 'https://docs.netgate.com/downloads/pfSense-SA-25_07.webgui.asc', ],
],
'basedir' => '/',
'pathstrip' => 2,
'ignorewhitespace' => true,
],
[
'uniqid' => '0d40856c780520b97f618252d9dfb0e6719e1944',
'versions' => ['24.11'],
@@ -246,6 +417,8 @@ $recommended_patches = [
[ 'text' => 'To apply, reboot OR restart PHP and the GUI from the console menu using option 16 then 11' ],
[ 'text' => 'Redmine #11268',
'url' => 'https://redmine.pfsense.org/issues/11268', ],
[ 'text' => 'Redmine #15893',
'url' => 'https://redmine.pfsense.org/issues/15893', ],
],
'basedir' => '/',
'pathstrip' => 2,
sysutils/pfSense-pkg-System_Patches/pkg-plist
+10 -1
View File
@@ -12,6 +12,7 @@ pkg/patches/0d40856c780520b97f618252d9dfb0e6719e1944.patch
pkg/patches/0d83ed084a987f3446a0cbdcf249fc5b8722726f.patch
pkg/patches/0e847960910ae9f14ca7b52c84be25fe4b9d1064.patch
pkg/patches/0fc7765c886ed60555750d12808f493d70918450.patch
pkg/patches/0ff75cd0b9fb14c04c94c3585831a9f669be0a5d.patch
pkg/patches/12827workaround.patch
pkg/patches/12cbb18a93c1f78e05806b6d3c90511e8967f43f.patch
pkg/patches/13915.patch
@@ -27,6 +28,9 @@ pkg/patches/15449.patch
pkg/patches/15525.patch
pkg/patches/15702.patch
pkg/patches/15778.patch
pkg/patches/15844-widgetkey-validation-24.11.patch
pkg/patches/15844-widgetkey-validation-ce-2.7.2.patch
pkg/patches/15856-openvpn-mgmt-fix.patch
pkg/patches/16076.patch
pkg/patches/16076_2.patch
pkg/patches/17630ffa48e33def331a65ee50f1ba1d2c3a5de5.patch
@@ -76,11 +80,13 @@ pkg/patches/57e299906c4525bcc89c728a6246495369178023.patch
pkg/patches/5841d5850265476100b719e60e38b65887cd1460.patch
pkg/patches/587dcb6ae708d144023879b509a1da9dd5dd0723.patch
pkg/patches/5eb325e0def04241684b4d2c9583f8ca9d8bc05e.patch
pkg/patches/6bf3e080f56facab1f00e29acd24dff62d5bd707.patch
pkg/patches/6021c3e059885ce3fff09e5b00df037db034ff14.patch
pkg/patches/611de84ae2d1e65217dbccb7e9db32a019bd8d97.patch
pkg/patches/66b989e824042c0cf5e75b1cb245b0ae13548949.patch
pkg/patches/68ed289190a383795194d3499728a0f6023f8a52.patch
pkg/patches/6a92af14584d22f077e1421e952674f880cd5b6c-2_7_2.patch
pkg/patches/6a92af14584d22f077e1421e952674f880cd5b6c.patch
pkg/patches/6bf3e080f56facab1f00e29acd24dff62d5bd707.patch
pkg/patches/6dc0750874b69373f8adbae9b0af223af13f5f4a.patch
pkg/patches/6df70417029defed162b539720e8baa03984f653.patch
pkg/patches/6f59a7f9fdfe3703667819fcbbd8b6f8cbec0d9f.patch
@@ -121,6 +127,8 @@ pkg/patches/a99c03dde3df7053747ec61607c0fb2e2c0a7d22.patch
pkg/patches/a9bdbd97984ff2ddefbceb2fe062fbe3a1c42d88.patch
pkg/patches/aac5bb5d396a1f1b18d59a532ad262a4d1085a40.patch
pkg/patches/aad64829622356cd761062e57f4a8224d1b145e4.patch
pkg/patches/acb-update-24.11.patch
pkg/patches/acb-update-ce-2.7.2.patch
pkg/patches/afcc0e9c97c1993ae6b95f886665fcb4375d26c7.patch
pkg/patches/b2fce958b8a2e80754b49eb3d17795757df6a76c.patch
pkg/patches/b5360f49fb3c1fdc36ebf13c20b68d4ff1e15fe6.patch
@@ -147,6 +155,7 @@ pkg/patches/d9fa4584e3fb63d6051e9f1db7655f931cb1be19.patch
pkg/patches/dcb4461336de2fe69ac173787c8bce66e93ce672.patch
pkg/patches/dcdb461733044d274c742832097b13a312045f37.patch
pkg/patches/ddb57f79e26e97e2a22f701016fc70a7d1c09ce4.patch
pkg/patches/dfc70e51d556d8c1724bfc7f1fd5fe4b73faab3b.patch
pkg/patches/e53f0573d853325dfb463eab8bfe59a9f4d6ce61.patch
pkg/patches/e573756c98d1181583fee0f7d818c6be0ea3da0e.patch
pkg/patches/e930812c680fa4adfc8d9330bec871ef57e1d1d5.patch