GitLab

A few days ago, it was announced [1] that sks-keyservers.net are no
longer maintainer and deprecated. Based on this, I switched to the same
server which is using upstream, in this case, lxc [2].

[1] https://www.root.cz/zpravicky/pool-servery-sks-keyservers-net-pro-pgp-skoncili/
(Czech version, but there is mentioned even source message)

[2] https://github.com/lxc/lxc/commit/f2a5d95d00a55bed27ef9920d67617cc75fecad8

This reverts commit 78f1f4a3.

A vulnerability was discovered in how wpa_supplicant processing P2P
(Wi-Fi Direct) group information from active group owners.
This issue was discovered by fuzz testing of wpa_supplicant by Google's
OSS-Fuzz.

https://w1.fi/security/2020-2/wpa_supplicant-p2p-group-info-processing-vulnerability.txt

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
[added the missing patch]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry-picked from commit 7c8c4f1)
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Fixes: CVE-2020-17525

Note:
This commit adds backported patches from unbound to
fix dnspooq security issues.

- CVE-2020-25681: heap overflow in RRSets sorting
- CVE-2020-25682: buffer overflow in extracting names from DNS packets
- CVE-2020-25683: heap overflow in DNSSEC validation
- CVE-2020-25684: cache poisoning issue via address/port
- CVE-2020-25685: cache poisoning issue via weak hash
- CVE-2020-25686: birthday attack via incorrect existing requests check
- CVE-2020-25687: heap overflow in DNSSEC validation
- CVE-2019-14834: memory leak via DHCP response creation

Notes:
Backported from https://github.com/openwrt/openwrt/commit/78c4c04dd7979a7f6d3cadeb1783b6c38d63b575

Fixes:
INFO:Running postinst of turris-version
/usr/lib/opkg/info//turris-version.postinst: /usr/lib/opkg/info/turris-version.postinst-pkg: line 18: syntax error: unterminated quoted string
Output from turris-version.postinst:
/usr/lib/opkg/info//turris-version.postinst: /usr/lib/opkg/info/turris-version.postinst-pkg: line 18: syntax error: unterminated quoted string

Fixes:
13b6311f ("turris-version: update for
version 3.11.22")

There are still some issues with opt-in experimental migration for
Turris 1.x. Let's disable it.

This reverts commit 1560394b.

This reverts commit 9038557a.

This commit was revert because for some users it breaks VPN PPTP.
We decided that is should be enought to remove kmod-nf-nathelper-extra
from user package list and add note about this vulnerability to errata.

In that case it's up to users if they decide to install affected kernel module.