dhcp: add upstream security fixes
authorBaruch Siach <baruch@tkos.co.il>
Sat, 3 Mar 2018 19:43:56 +0000 (21:43 +0200)
committerPeter Korsgaard <peter@korsgaard.com>
Sat, 3 Mar 2018 22:26:08 +0000 (23:26 +0100)
commit047cec5993223944d0765468f11aa137d3ade543
tree4b9e5506eb5d122a06e0a5fff8e47890a0b98af6
parent00fc361b0a1693e701485ab177e9d12b59652170
dhcp: add upstream security fixes

CVE-2018-5732: The DHCP client incorrectly handled certain malformed
responses. A remote attacker could use this issue to cause the DHCP
client to crash, resulting in a denial of service, or possibly execute
arbitrary code. In the default installation, attackers would be isolated
by the dhclient AppArmor profile.

CVE-2018-5733: The DHCP server incorrectly handled reference counting. A
remote attacker could possibly use this issue to cause the DHCP server
to crash, resulting in a denial of service.

Both issues are fixed in version 4.4.1. But we are close to release, so
backport the fixes instead of bumping version.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/dhcp/0003-Correct-buffer-overrun-in-pretty_print_option.patch [new file with mode: 0644]
package/dhcp/0004-Corrected-refcnt-loss-in-option-parsing.patch [new file with mode: 0644]