From patchwork Thu Oct 22 16:42:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10458 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4j9X4q1dsrz3wpN for ; Thu, 22 Oct 2026 16:42:35 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4j9X4p1lpTz6bK for ; Thu, 22 Oct 2026 16:42:34 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4j9X4m2zMVz36WZ for ; Thu, 22 Oct 2026 16:42:32 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4j9X4c2lyMz2xLJ for ; Thu, 22 Oct 2026 16:42:24 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4j9X4b58jVz1tk; Thu, 22 Oct 2026 16:42:23 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1792687343; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=czKNGnv6QOEQSeujaxvNoQBsUbeJtqlzytkQpJLKCuA=; b=38OWFI+Gk+X2KTvPlkBa6lRlSwEsixN23bin+8UW4YJMve9MRbZdwwbC1x6Fhn0I1mLC3J nBhZj8cdjUs3iaDw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1792687343; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=czKNGnv6QOEQSeujaxvNoQBsUbeJtqlzytkQpJLKCuA=; b=RiyoR+TySw+BvCwjFzlrpsG1IpP+9Ri0hrhxwueg7E23XBDM84jsz/PHrl/49IghpuyLuI iqSMCmuCRKW/zcw5Xm7vSU8h2lE/t4TFYadaoLsNVVq0bluNfwtEHc4s7fGyC1QzCR9MGg cCr/DHmImIh0pOotW47s8rRVSmrf6Swd1Zq2S/jtaW0LoVvYAAs6zLXC1pLOD610Tsv7Cp 6W8oKjzdLbP5w146QLlGLel1sHBE0ODEgvUixFcnhXJQjD8xp8h+sWaXGGgZ1n+Y6NZIlC n8u0FdkVtm+K+NPOoIuelwSWMSeTBBZQdmTYa44EB3THGalL+BES+Z17woYOCQ== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] c-ares: Update to version 1.34.9 Date: Thu, 22 Oct 2026 18:42:11 +0200 Message-ID: <20261022164218.3359591-2-adolf.belka@ipfire.org> In-Reply-To: <20261022164218.3359591-1-adolf.belka@ipfire.org> References: <20261022164218.3359591-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 1.34.8 to 1.34.9 - Update of rootfile - 11 GHSA security fixes - Changelog 1.34.9 Security: * Memory corruption when an application cancels its lookups after a connection failure. Please see https://github.com/c-ares/c-ares/security/advisories/GHSA-wpr3-8q3r-4q8c * A DNS reply that arrived from a different server than the one queried could be accepted. Please see https://github.com/c-ares/c-ares/security/advisories/GHSA-fqh5-3x7m-wp44 * Use-after-free of a lookup after shutting down a failed connection. Please see https://github.com/c-ares/c-ares/security/advisories/GHSA-97vq-4mxv-7vhm * Use-after-free when an application cancels lookups from a callback, or shuts a channel down. Please see https://github.com/c-ares/c-ares/security/advisories/GHSA-rf6g-ww74-97qh * Use-after-free of a connection after the socket-state callback returns. Please see https://github.com/c-ares/c-ares/security/advisories/GHSA-mw23-pfg6-2x9r * Use-after-free when an application cancels lookups from a server-state callback. Please see https://github.com/c-ares/c-ares/security/advisories/GHSA-v33j-65h4-4ch8 * Use-after-free of a server record when an application changes its DNS servers from a callback. Please see https://github.com/c-ares/c-ares/security/advisories/GHSA-pj7p-v3cw-hq66 * Use-after-free of a cached DNS answer while the application is still reading it. Please see https://github.com/c-ares/c-ares/security/advisories/GHSA-grv7-fq5q-9vfc * Buffer overflow when `ares_dup()` or `ares_save_options()` runs while another thread changes the servers. Please see https://github.com/c-ares/c-ares/security/advisories/GHSA-ph6c-3cvx-mq6v * Uninitialized memory returned for a numeric IPv6 name with a prefix length. Please see https://github.com/c-ares/c-ares/security/advisories/GHSA-cfcv-8v2j-qj6r * The query cache could return an answer obtained using different EDNS options. Please see https://github.com/c-ares/c-ares/security/advisories/GHSA-wrgc-prmw-27xh Changes: * Answers served from the query cache now report their remaining TTL rather than the TTL originally received. * `ares_inet_pton()` rejects a "/bits" prefix length and returns 0, rather than -1, for any input it cannot parse. * UDP replies must now come from the server's port as well as its address. Custom `arecvfrom` socket functions (`ares_set_socket_functions_ex()` or `ares_set_socket_functions()`) must fill in the full source address, including the port. For compatibility, a reported port of 0 checks only the address, but such implementations are insecure and should be fixed. [PR #1370](https://github.com/c-ares/c-ares/pull/1370) * Document that socket functions and socket, configure and pending-write callbacks must not call c-ares functions on the same channel. [PR #1360](https://github.com/c-ares/c-ares/pull/1360) Bugfixes: * `ares_dup()`: don't leave the new channel bound to the source channel. [PR #1333](https://github.com/c-ares/c-ares/pull/1333) * `ares_init_options()`: don't report the default query cache as a caller-set option. [PR #1354](https://github.com/c-ares/c-ares/pull/1354) * Clamp DNS record TTLs to the signed int range used by public APIs. [PR #1313](https://github.com/c-ares/c-ares/pull/1313) * `ares_dns_write()`: reject messages larger than 64KB. [PR #1314](https://github.com/c-ares/c-ares/pull/1314) * `ares_dns_parse()`: accept legacy compressed RDATA names. [PR #1326](https://github.com/c-ares/c-ares/pull/1326) * `ares_parse_a_reply()`/`ares_parse_aaaa_reply()`: ignore a negative `*naddrttls`. [PR #1302](https://github.com/c-ares/c-ares/pull/1302) * select event backend: refuse descriptors >= `FD_SETSIZE` instead of overflowing `fd_set`. [PR #1312](https://github.com/c-ares/c-ares/pull/1312) * Strip inline comments from resolv.conf values. [PR #1276](https://github.com/c-ares/c-ares/pull/1276) * Ignore absurd resolv.conf retry/attempts values. [PR #1315](https://github.com/c-ares/c-ares/pull/1315) * Zero-initialize the server config when parsing nameserver URIs. [PR #1325](https://github.com/c-ares/c-ares/pull/1325) * URI parsing: roll back the ':' probe when it lands past the '@'. [PR #1265](https://github.com/c-ares/c-ares/pull/1265) * Do not assume `gethostname()` NUL-terminates its buffer. [PR #1269](https://github.com/c-ares/c-ares/pull/1269) * Combine the hash table seed with XOR instead of OR. [PR #1330](https://github.com/c-ares/c-ares/pull/1330) * Turn off stdio buffering when loading a file. [PR #939](https://github.com/c-ares/c-ares/pull/939) * Guard `pipe2()` on Apple platforms to prevent unguarded availability warnings. [PR #1328](https://github.com/c-ares/c-ares/pull/1328) Signed-off-by: Adolf Belka --- config/rootfiles/packages/c-ares | 2 +- lfs/c-ares | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/packages/c-ares b/config/rootfiles/packages/c-ares index 12a246147..cc09b90c1 100644 --- a/config/rootfiles/packages/c-ares +++ b/config/rootfiles/packages/c-ares @@ -7,7 +7,7 @@ #usr/lib/libcares.la #usr/lib/libcares.so usr/lib/libcares.so.2 -usr/lib/libcares.so.2.19.7 +usr/lib/libcares.so.2.19.8 #usr/lib/pkgconfig/libcares.pc #usr/share/man/man3/ares_cancel.3 #usr/share/man/man3/ares_create_query.3 diff --git a/lfs/c-ares b/lfs/c-ares index db68a8787..8efdb434a 100644 --- a/lfs/c-ares +++ b/lfs/c-ares @@ -26,7 +26,7 @@ include Config SUMMARY = Tools for asynchronous name resolves -VER = 1.34.8 +VER = 1.34.9 THISAPP = c-ares-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = c-ares -PAK_VER = 6 +PAK_VER = 7 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = b5a88811d8ee6a0c06737746a356bc1fc7c13416b11a0af3a2e6cab092d97adebb93234cf73b97a12b06b764f8562272a793961dc3367024c4322d923ac43f9f +$(DL_FILE)_BLAKE2 = b708d8e302f7b2b8dcd9a30b9faa0864506990ced276ad4718b2cc3bbabbd548dcf3493033e777787089ba58c60e65f84d6ff47097a93cf1f3367490a3b00ee8 install : $(TARGET)