File _patchinfo of Package patchinfo.8504

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.8504

<patchinfo incident="8504">
  <issue tracker="cve" id="2018-14055"/>
  <issue tracker="cve" id="2018-14056"/>
  <issue tracker="bnc" id="1101281"></issue>
  <issue tracker="bnc" id="1101280"></issue>
  <category>security</category>
  <rating>moderate</rating>
  <packager>pluskalm</packager>
  <summary>Security update for znc</summary>
  <description>This update for znc fixes the following issues:

- Update to version 1.7.1
  * CVE-2018-14055: non-admin user could gain admin privileges and shell access
    by injecting values into znc.conf (bnc#1101281)
  * CVE-2018-14056: path traversal in HTTP handler via ../ in a web skin name.
    (bnc#1101280)
- Update to version 1.7.0
  * Make ZNC UI translateable to different languages
  * Configs written before ZNC 0.206 can't be read anymore
  * Implement IRCv3.2 capabilities away-notify, account-notify, extended-join
  * Implement IRCv3.2 capabilities echo-message, cap-notify on the "client side"
  * Update capability names as they are named in IRCv3.2:
    znc.in/server-time-iso→server-time, znc.in/batch→batch. Old names will
    continue working for a while, then will be removed in some future version.
  * Make ZNC request server-time from server when available
  * Add "AuthOnlyViaModule" global/user setting
  * Stop defaulting real name to "Got ZNC?"
  * Add SNI SSL client support
  * Add support for CIDR notation in allowed hosts list and in trusted proxy
    list
  * Add network-specific config for cert validation in addition to
    user-supplied fingerprints: TrustAllCerts, defaults to false, and TrustPKI,
    defaults to true.
  * Add /attach command for symmetry with /detach. Unlike /join it allows
    wildcards.
- Update to version 1.6.6:
  * Fix use-after-free in znc --makepem. It was broken for a long
    time, but started segfaulting only now. This is a useability
    fix, not a security fix, because self-signed (or signed by a
    CA) certificates can be created without using --makepem, and
    then combined into znc.pem.
</description>
</patchinfo>

Places

File _patchinfo of Package patchinfo.8504

Places