From patchwork Thu Aug 13 13:39:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10139 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hLRLz5yrTz3wqM for ; Thu, 13 Aug 2026 13:40:27 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hLRLq1Zyvz7PG for ; Thu, 13 Aug 2026 13:40:19 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hLRLN2wWcz33xJ for ; Thu, 13 Aug 2026 13:39:56 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hLRLK5Z5lz2xMg for ; Thu, 13 Aug 2026 13:39:53 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hLRL92LBXzG9; Thu, 13 Aug 2026 13:39:45 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1786628385; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KTrdxr8NLTNEeJU4QUUEuSnVcH5+RqT0SI1+MSAXQjo=; b=1xCDnKpw0KrUibIRr74H5RhEiSwW8kRFvq/hKF9TzZEllqu9juxK5+bYb62EmS1Z5dwV/9 u+H8hBNOd/Kx/4CA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1786628385; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=KTrdxr8NLTNEeJU4QUUEuSnVcH5+RqT0SI1+MSAXQjo=; b=Lmebw7avIOk4lKFfTPQiWp7Qiq6ejhc3WuqrLecQIuE5bGA479XGRlLXcqDwqk28Po8F5e hdKzCO51w6MqocpjqRCnW0XS0A7X+t/qj+G1KnGmy+Yw43mc8HtouKWhT3sNfwYmdiLMfZ OWCV2HywvvKcOc2hmTXtOUvf5zeYEYmWYgHkEqLKe9OYInNT8VYoE79qEfFQ1uHf6MhaZk YEXpU4p4fqAocNy/2hQYLXHzNzzE8MydNQtHF+TBtehaxM+zEyXMnmJKPaz6gUJvsCqq09 Fm+XyQGBAJEf2E3mnV5r5J7om5YzKsFrWj4KmhGLlTNxj4Gp/pQXXkdlAopBoQ== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] aprutil: Update to version 1.6.5 Date: Thu, 13 Aug 2026 15:39:30 +0200 Message-ID: <20260813133942.2669472-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 1.6.3 to 1.6.5 - Update of rootfile - 5 CVE fixes in 1.6.4 - Changelog 1.6.5 *) Fix oracle DBD compilation errors introduced in 1.6.4. PR 70170. 1.6.4 *) SECURITY: CVE-2026-34502: Heap buffer overflow in APR memcached client (cve.mitre.org) Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3. Credits: Elhanan Haenel *) SECURITY: CVE-2026-34501: Apache Portable Runtime Utility: Heap buffer overflow in APR redis client (cve.mitre.org) Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue. Credits: Elhanan Haenel *) SECURITY: CVE-2026-34191: Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle (cve.mitre.org) Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue. Credits: Elhanan Haenel *) SECURITY: CVE-2026-32327: Apache Portable Runtime Utility: apr-util XML stack recursion crash (cve.mitre.org) A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue. Credits: Younghyo Cho @ CISLab, SeoulTech *) SECURITY: CVE-2025-49506: apr_password_validate() vulnerable to timing attack (cve.mitre.org) APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue. Credits: Michael Rowley *) apr_brigade: Don't split the final LF in apr_brigade_split_line() to avoid producing an empty bucket. PR 64273 [Barnim Dzwillo , Joe Orton] *) apr_brigade: Metadata buckets are now ignored in apr_brigade_split_line, apr_brigade_flatten and apr_brigade_to_iovec, fixing possible undefined behaviour. PR 68278 [Ben Kallus , Joe Orton] *) apr_crypto_openssl: Compatibility with OpenSSL 3. [Yann Ylavic] *) apr_crypto_openssl: use OPENSSL_init_crypto() to initialise OpenSSL on versions 1.1+. [Graham Leggett] *) apr_memcache: Fix name lookup to allow IPv6 as well as IPv4. [Lubos Uhliarik ] *) configure: Fix Berkeley DB detection with compilers enforcing strict C99 compliance. PR 66396. [Florian Weimer ] Signed-off-by: Adolf Belka --- config/rootfiles/common/aprutil | 2 +- lfs/aprutil | 15 ++++++++++----- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/config/rootfiles/common/aprutil b/config/rootfiles/common/aprutil index 489616a93..672c5a692 100644 --- a/config/rootfiles/common/aprutil +++ b/config/rootfiles/common/aprutil @@ -48,5 +48,5 @@ usr/lib/apr-util-1/apr_dbm_gdbm.so #usr/lib/libaprutil-1.la #usr/lib/libaprutil-1.so usr/lib/libaprutil-1.so.0 -usr/lib/libaprutil-1.so.0.6.3 +usr/lib/libaprutil-1.so.0.6.5 #usr/lib/pkgconfig/apr-util-1.pc diff --git a/lfs/aprutil b/lfs/aprutil index 556f75a22..39761715c 100644 --- a/lfs/aprutil +++ b/lfs/aprutil @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2023 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -25,7 +25,7 @@ include Config -VER = 1.6.3 +VER = 1.6.5 THISAPP = apr-util-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 5eb56c45ba9d87ff3e3769439a3a9a858a1947de68b34892c729f39736fc41117a41c630c3c4cfb07b444c4ee0d5853ec5be158e8fa0b0c0ab89f0cb51cc9c6d +$(DL_FILE)_BLAKE2 = ee11e45f0029b336c80536f0b98b48f044229d5b9d8669471a1f0641eee8aa6ddbd8f2249ce6116294dc3d3c5b8b939532c366e6208dafe325eeba1db2603300 install : $(TARGET) @@ -75,8 +75,13 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) - cd $(DIR_APP) && ./configure --prefix=/usr \ - --with-apr=/usr --with-gdbm=/usr --with-openssl=/usr --with-crypto --with-expat=/usr + cd $(DIR_APP) && ./configure \ + --prefix=/usr \ + --with-apr=/usr \ + --with-gdbm=/usr \ + --with-openssl=/usr \ + --with-crypto \ + --with-expat=/usr cd $(DIR_APP) && make $(MAKETUNING) cd $(DIR_APP) && make install