siosios
05-13-2023, 03:08 AM
The next Core Update has been released: IPFire 2.27 - Core Update 174. It is a traditional spring clean release which updates major parts of the core system and comes with a large number of bug fixes throughout.
This update also comes with a number of security patches in Apache, cURL and more, but none of them have been assessed as being exploitable on IPFire. Nevertheless, we intend to bring those updates to all of our users as soon as possible, and encourage speedy installation of Core Update 174.
Updated Toolchain
The "toolchain" includes the most basic parts to build software and consists of GCC as the compiler, Binutils as the assembler and linker, and glibc as the C standard library. They have been updated to their latest versions improving performance for all generated code and fixing bugs.
Although they are not as exciting for our users, they are the building blocks IPFire is founded on and make it the modern, fast and secure distribution that it is.
Bug Fixes
The OpenVPN (https://wiki.ipfire.org/configuration/services/openvpn) CGI will now display the expiry date of certificates.
Duplicate address issuance by the DHCP server in case of overlapping fixed leases has been corrected (#10629 (https://bugzilla.ipfire.org/show_bug.cgi?id=10629)).
Customizing the Snort/VRT GPLv2 Community IPS ruleset (https://wiki.ipfire.org/configuration/firewall/ips/rulesets) has been fixed (#12948 (https://bugzilla.ipfire.org/show_bug.cgi?id=12948)).
The logs of apcupsd are now accessible through the system log viewer (https://wiki.ipfire.org/configuration/logs/system) (#12950 (https://bugzilla.ipfire.org/show_bug.cgi?id=12950)), as are the logs of the HAProxy add-on (https://wiki.ipfire.org/addons/haproxy) (#12922 (https://bugzilla.ipfire.org/show_bug.cgi?id=12922)).
Several CGIs have received CSS cleanups, resulting in better appearance (#13024 (https://bugzilla.ipfire.org/show_bug.cgi?id=13024), #13039 (https://bugzilla.ipfire.org/show_bug.cgi?id=13039)).
The Content-Type header of e-mails generated by the core system itself and various add-ons (https://wiki.ipfire.org/configuration/system/mail_service) has been changed from multipart/mixed to multipart/alternative to avoid useless attachment icon display in some MUAs (#13040 (https://bugzilla.ipfire.org/show_bug.cgi?id=13040)).
Faulty CGI behaviour after toggling logging of dropped packages by the IP blocklists firewall component (https://wiki.ipfire.org/configuration/firewall/ipblocklist) has been fixed (#12979 (https://bugzilla.ipfire.org/show_bug.cgi?id=12979)).
An overly permissive regular expression for parsing unbound log data has been corrected.
The external traffic status page (https://wiki.ipfire.org/configuration/status/network_ext) will now always use the correct interface to display traffic data from.
efivar is now properly instructed to adjust instructions to the target architecture rather than that of the build host.
The CPU graph has been redesigned for systems with large numbers of processor cores (#12890 (https://bugzilla.ipfire.org/show_bug.cgi?id=12890)).
Reloading IP blocklists (https://wiki.ipfire.org/configuration/firewall/ipblocklist) after an update has been fixed (#13072 (https://bugzilla.ipfire.org/show_bug.cgi?id=13072)).
Miscellaneous
rng-tools has been moved from the core system to an add-on (#12900 (https://bugzilla.ipfire.org/show_bug.cgi?id=12900)).
Conversely, perl-TimeDate is now part of the core system, since it became a dependency of the OpenVPN (https://wiki.ipfire.org/configuration/services/openvpn) CGI.
Arne has worked a lot on bringing the RISC-V build up to speed.
IPFire's trust store has been synced against Mozilla's current trusted CA certificate bundle.
Useless Qualcomm Bluetooth firmware files are no longer shipped (IPFire dropped Bluetooth support a long time ago due to security reasons), saving a couple of megabytes on new and existing IPFire installations alike.
Updated packages: apache 2.4.56, apr 1.7.2, bind 9.16.38, binutils 2.40, boost 1.81.0, curl 7.88.1, elinks 0.16.0, ethtool 6.2, freetype 2.13.0, gcc 12.2.0, glibc 2.37, gnutls 3.8.0, grep 3.9, harfbuzz 7.0.1, intel-microcode 20230214, iproute2 6.2.0, libtirpc 1.3.3, liburcu 0.14.0, linux-firmware 20230210, lmdb 0.9.30, logwatch 7.8, lsof 4.98.0, pango 1.50.13, poppler 23.03.0, poppler-data 0.4.12, qpdf 11.3.0, rust 1.67.0, squid 5.8, strongswan 5.9.10 (fixes CVE-2023-26463 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-26463), which is not exploitable on IPFire unless heavily customized IPsec connections have been configured using the CLI rather than the IPsec web interface (https://wiki.ipfire.org/configuration/services/ipsec)), sudo 1.9.13p3, tzdata 2022g, wireless-regdb 2023-02-12, zstd 1.5.4
Updated add-ons: cups 2.4.2, dbus 1.14.6, epson-inkjet-printer-escpr 1.7.23, fetchmail 6.4.36, HAProxy 2.7.4, htop 3.2.2, make 4.4.1, monit 5.33.0, pcengines-apu-firmware 4.19.0.1, python3-setuptools 67.5.1, samba 4.17.5
As always, we thank all people contributing to this release in whatever shape and form. Please note IPFire is backed by volunteers, maintaining and improving this distribution in their spare time - should you like what we are doing, please donate (https://www.ipfire.org/donate) to keep the lights on, an consider becoming engaged in development (https://wiki.ipfire.org/devel) to distribute the load over more shoulders.
More... (https://blog.ipfire.org/post/ipfire-2-27-core-update-174-released)
This update also comes with a number of security patches in Apache, cURL and more, but none of them have been assessed as being exploitable on IPFire. Nevertheless, we intend to bring those updates to all of our users as soon as possible, and encourage speedy installation of Core Update 174.
Updated Toolchain
The "toolchain" includes the most basic parts to build software and consists of GCC as the compiler, Binutils as the assembler and linker, and glibc as the C standard library. They have been updated to their latest versions improving performance for all generated code and fixing bugs.
Although they are not as exciting for our users, they are the building blocks IPFire is founded on and make it the modern, fast and secure distribution that it is.
Bug Fixes
The OpenVPN (https://wiki.ipfire.org/configuration/services/openvpn) CGI will now display the expiry date of certificates.
Duplicate address issuance by the DHCP server in case of overlapping fixed leases has been corrected (#10629 (https://bugzilla.ipfire.org/show_bug.cgi?id=10629)).
Customizing the Snort/VRT GPLv2 Community IPS ruleset (https://wiki.ipfire.org/configuration/firewall/ips/rulesets) has been fixed (#12948 (https://bugzilla.ipfire.org/show_bug.cgi?id=12948)).
The logs of apcupsd are now accessible through the system log viewer (https://wiki.ipfire.org/configuration/logs/system) (#12950 (https://bugzilla.ipfire.org/show_bug.cgi?id=12950)), as are the logs of the HAProxy add-on (https://wiki.ipfire.org/addons/haproxy) (#12922 (https://bugzilla.ipfire.org/show_bug.cgi?id=12922)).
Several CGIs have received CSS cleanups, resulting in better appearance (#13024 (https://bugzilla.ipfire.org/show_bug.cgi?id=13024), #13039 (https://bugzilla.ipfire.org/show_bug.cgi?id=13039)).
The Content-Type header of e-mails generated by the core system itself and various add-ons (https://wiki.ipfire.org/configuration/system/mail_service) has been changed from multipart/mixed to multipart/alternative to avoid useless attachment icon display in some MUAs (#13040 (https://bugzilla.ipfire.org/show_bug.cgi?id=13040)).
Faulty CGI behaviour after toggling logging of dropped packages by the IP blocklists firewall component (https://wiki.ipfire.org/configuration/firewall/ipblocklist) has been fixed (#12979 (https://bugzilla.ipfire.org/show_bug.cgi?id=12979)).
An overly permissive regular expression for parsing unbound log data has been corrected.
The external traffic status page (https://wiki.ipfire.org/configuration/status/network_ext) will now always use the correct interface to display traffic data from.
efivar is now properly instructed to adjust instructions to the target architecture rather than that of the build host.
The CPU graph has been redesigned for systems with large numbers of processor cores (#12890 (https://bugzilla.ipfire.org/show_bug.cgi?id=12890)).
Reloading IP blocklists (https://wiki.ipfire.org/configuration/firewall/ipblocklist) after an update has been fixed (#13072 (https://bugzilla.ipfire.org/show_bug.cgi?id=13072)).
Miscellaneous
rng-tools has been moved from the core system to an add-on (#12900 (https://bugzilla.ipfire.org/show_bug.cgi?id=12900)).
Conversely, perl-TimeDate is now part of the core system, since it became a dependency of the OpenVPN (https://wiki.ipfire.org/configuration/services/openvpn) CGI.
Arne has worked a lot on bringing the RISC-V build up to speed.
IPFire's trust store has been synced against Mozilla's current trusted CA certificate bundle.
Useless Qualcomm Bluetooth firmware files are no longer shipped (IPFire dropped Bluetooth support a long time ago due to security reasons), saving a couple of megabytes on new and existing IPFire installations alike.
Updated packages: apache 2.4.56, apr 1.7.2, bind 9.16.38, binutils 2.40, boost 1.81.0, curl 7.88.1, elinks 0.16.0, ethtool 6.2, freetype 2.13.0, gcc 12.2.0, glibc 2.37, gnutls 3.8.0, grep 3.9, harfbuzz 7.0.1, intel-microcode 20230214, iproute2 6.2.0, libtirpc 1.3.3, liburcu 0.14.0, linux-firmware 20230210, lmdb 0.9.30, logwatch 7.8, lsof 4.98.0, pango 1.50.13, poppler 23.03.0, poppler-data 0.4.12, qpdf 11.3.0, rust 1.67.0, squid 5.8, strongswan 5.9.10 (fixes CVE-2023-26463 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-26463), which is not exploitable on IPFire unless heavily customized IPsec connections have been configured using the CLI rather than the IPsec web interface (https://wiki.ipfire.org/configuration/services/ipsec)), sudo 1.9.13p3, tzdata 2022g, wireless-regdb 2023-02-12, zstd 1.5.4
Updated add-ons: cups 2.4.2, dbus 1.14.6, epson-inkjet-printer-escpr 1.7.23, fetchmail 6.4.36, HAProxy 2.7.4, htop 3.2.2, make 4.4.1, monit 5.33.0, pcengines-apu-firmware 4.19.0.1, python3-setuptools 67.5.1, samba 4.17.5
As always, we thank all people contributing to this release in whatever shape and form. Please note IPFire is backed by volunteers, maintaining and improving this distribution in their spare time - should you like what we are doing, please donate (https://www.ipfire.org/donate) to keep the lights on, an consider becoming engaged in development (https://wiki.ipfire.org/devel) to distribute the load over more shoulders.
More... (https://blog.ipfire.org/post/ipfire-2-27-core-update-174-released)