*** This bug is a security vulnerability *** Public security bug reported:
Dracut 112 contains 7 security related commits (see https://github.com/dracut-ng/dracut/blob/main/NEWS.md): * **network-legacy:** sanitize DHCP values in dhclient-script.sh ([11577739](https://github.com/dracut-ng/dracut/commit/11577739221ff38c1fd29abbba51a6c797376ed6)) * **overlayfs-crypt:** prevent eval injection in parse_overlay_opts() ([584e95be](https://github.com/dracut-ng/dracut/commit/584e95bea90cedd12d9190e9b09bb45e1aa26b08)) * **dracut-lib:** sanitize variable assignments using eval ([4d2d812b](https://github.com/dracut-ng/dracut/commit/4d2d812bed056ca2c671612d960911b075c99dd9)) * **base:** add escape function implementing printf %q ([207c3397](https://github.com/dracut-ng/dracut/commit/207c339728eff81127469c2f6fe106447c781009)) * **systemd-networkd:** escape values from DHCP options ([b456aee2](https://github.com/dracut-ng/dracut/commit/b456aee2fc61c47db0d9a408634820969e7359df)) * **iscsi:** normalize initiator and target names ([843af3e7](https://github.com/dracut-ng/dracut/commit/843af3e751782285cd2bc7c9a3a9d33e843fb91d)) * **net-lib:** validate iSCSI LUN parameters ([05c02db9](https://github.com/dracut-ng/dracut/commit/05c02db994ca322371a40695a3cc223faa1c7258)) The dracut 112-2 package cherry-picks several commits for the upcoming 113 release (see debian/changelog): * Cherry-pick several upstream commits: - Security related fixes: + fix(net-lib): normalize iSCSI target names on the iqn./eui./naa. path + fix(iscsi): do not source the boot-time net-lib.sh into module-setup.sh + fix(iscsi): normalize the target name in the generated netroot= + fix(dracut): --remove globbing does not work + fix(dracut): --remove allows removing files from the host filesystem + refactor(net-lib): use strip_non_digits() to validate iSCSI LUN parameters + fix(net-lib): validate iSCSI port parameters + fix(base): sanitize message written by die() to the emergency hook + fix(iscsi): sanitize netroot= value passed to initqueue scripts The Ubuntu package in 26.04 and newer do not ship the network-legacy module. So the patches for network-legacy were skipped. ** Affects: dracut (Ubuntu) Importance: High Status: Fix Released ** Affects: dracut (Ubuntu Resolute) Importance: Undecided Status: New ** Also affects: dracut (Ubuntu Resolute) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2166887 Title: Security fixes for dracut To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/dracut/+bug/2166887/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
