This is primarily a security release, fixing several vulnerabilities including CVE-2026-75883 and CVE-2026-85495. For more details on this and other vulnerabilities fixed, see the github advisories at
https://github.com/ppp-project/ppp/security/advisories?state=published These range in severity up to 6.8 (moderate). Many of the vulnerabilities are actually only of concern if pppd is installed setuid-root, which some distros still do, though 'make install' in this project does not install pppd setuid-root. Other changes include: A new environment variable is defined for scripts, called PPP_SCRIPT_INSTANCE, which contains the original name of the script (e.g., ip-up). This can be useful when the name in argv[0] gets lost because the script is executed by an interpreter. New options 'strict-script-checks', 'nostrict-script-checks', 'strict-secrets-files' and 'nostrict-secrets-files' have been added. The strict versions are the default, and the nostrict versions are privileged. 'strict-script-checks' enables checks on script files that are run as root (e.g., /etc/ppp/ip-up) to ensure that they are owned by root and not writable by group or other. 'strict-secrets-checks' enables checks on secrets files (such as /etc/ppp/chap-secrets) to ensure that they are not readable by group or other. Previously (and now with nostrict-secrets-checks) the check was done but only produced a warning; now by default pppd will refuse to use the file. For EAP-TLS and PEAP, the verification of the 'common name' in TLS certificates no longer stops the comparison at an embedded NUL character. The pppd man page now notes that the default verification mode is 'none' and that the 'suffix' verification mode doesn't check for a '.' in the common name before the matched suffix (this was the behaviour previously but the man page was incorrect). Many more options are now privileged, in particular all of the RADIUS plugin options, and almost all the options relating to EAP-TLS and PEAP. OpenSSL engine support in EAP-TLS is disabled by default, since engine support in OpenSSL 3 is deprecated. If you need it, use the --enable-openssl-engine flag to configure. Pppd can now run as non-root as long as it has the CAP_NET_ADMIN capability. In that case, scripts are run as the invoking user, the user can use privileged options (provided the pppd binary was not marked as setuid or with additional capabilities), and the ownership checks use the user's effective UID rather than 0. Various pppd options that take an integer argument now enforce sensible limits on the value. This aids in avoiding edge cases where vulnerabilities may lurk. EAP-SRP support has been removed. Previously it was disabled by default. Extra length checks have been added to ensure that the pppd code doesn't access outside the bounds of received packets, even when such accesses were harmless (i.e. within the bounds of the array that the received packet was stored in, and not affecting any result). Various other minor bug fixes and improvements, including man page updates. Signed-off-by: Richard Purdie <[email protected]> --- meta/recipes-connectivity/ppp/{ppp_2.5.3.bb => ppp_2.5.4.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-connectivity/ppp/{ppp_2.5.3.bb => ppp_2.5.4.bb} (98%) diff --git a/meta/recipes-connectivity/ppp/ppp_2.5.3.bb b/meta/recipes-connectivity/ppp/ppp_2.5.4.bb similarity index 98% rename from meta/recipes-connectivity/ppp/ppp_2.5.3.bb rename to meta/recipes-connectivity/ppp/ppp_2.5.4.bb index 18157821690..6f7977ece37 100644 --- a/meta/recipes-connectivity/ppp/ppp_2.5.3.bb +++ b/meta/recipes-connectivity/ppp/ppp_2.5.4.bb @@ -25,7 +25,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/${BP}.tar.gz \ file://[email protected] \ " -SRC_URI[sha256sum] = "ddda28dec8aca99a403ab6070d94ffd2b17d63e9a4c5509158e99e148f572d4f" +SRC_URI[sha256sum] = "379a630a40d858a1347f6592d671791dde12101697a743ef9900012f3765be31" inherit autotools pkgconfig systemd
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246303): https://lists.openembedded.org/g/openembedded-core/message/246303 Mute This Topic: https://lists.openembedded.org/mt/121353677/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
