Current File : //backups/router/usr/local/opnsense/changelog/22.7.3.htm
<p>Good day everyone,</p><p>Pick up the new FreeBSD security advisories while also introducing assorted reliability improvements. CRL now works again for elliptic curve with the adoption of version 3 of phpseclib. Wireless handling was improved due to PHP 8 errors and coding style issues. It is also the subject of further work for 23.1.</p><p>Here are the full patch notes:</p><p><ul><li>system: migrate CRL handling to phpseclib 3</li><li>system: run monitor reload inside system_routing_configure()</li><li>system: fix IPv6 link-local HTTP_REFERER check (contributed by Maurice Walker)</li><li>system: fix assorted PHP 8 warnings in the codebase</li><li>system: extend nameservers script return for debugging purposes, i.e. "configctl system list nameservers debug"</li><li>system: lighttpd obsoletion of server listing directive, disabled by default</li><li>system: decode stored CRL data before display (contributed by kulikov-a)</li><li>interfaces: update link-local matching pattern</li><li>interfaces: PPP is an exception, only created after interface configuration</li><li>interfaces: only remove known primary addresses in interface_bring_down()</li><li>interfaces: improve shell banner address return in prefix-only IPv6 case</li><li>interfaces: improve problematic <wireless/> node handling</li><li>interfaces: DHCP does not signal RELEASE</li><li>interfaces: web GUI locale sorts files differently when invoking ifctl</li><li>interfaces: improve legacy_interface_listget()</li><li>interfaces: only parse actual options in legacy_interfaces_details(), not nd6 options</li><li>firewall: implement a router file read fallback for new ifctl :slaac suffix</li><li>firewall: stick-address only in effect with pool option and multiple routers</li><li>firewall: remove dead pptpd server code</li><li>captive portal: lighttpd deprecation of legacy SSL options, disabled by default</li><li>dhcp: allow rapid-commit message exchange in IPv6 server (contributed by Maurice Walker)</li><li>firmware: major upgrade "pkgs" set was still unknown to plugin sync</li><li>intrusion detection: fix enable rule button and present active detail overwrite if present</li><li>ipsec: fixed widget link (contributed by Patrik Kernstock)</li><li>unbound: improve FQDN handling when address is moving in DHCP watcher</li><li>unbound: prevent DNS rebinding check and DNSSEC validation on explicit forwarded domains</li><li>unbound: restrict creation of PTR records for both the system domain and host overrides</li><li>unbound: add AAAA-only mode (contributed by Maurice Walker)</li><li>lang: fix syntax errors in French translation (contributed by kulikov-a)</li><li>ui: fix type cast issue in Bootgrid</li><li>plugins: os-ddclient relaxes validation of description field</li><li>plugins: os-frr 1.30[<a target="_blank" href="https://github.com/opnsense/plugins/blob/stable/22.7/net/frr/pkg-descr">1</a>]</li><li>plugins: os-nginx now uses simplified NAME_setup service handling</li><li>plugins: os-wireguard 1.12[<a target="_blank" href="https://github.com/opnsense/plugins/blob/stable/22.7/net/wireguard/pkg-descr">2</a>]</li><li>plugins: os-zabbix-agent 1.13[<a target="_blank" href="https://github.com/opnsense/plugins/blob/stable/22.7/net-mgmt/zabbix-agent/pkg-descr">3</a>]</li><li>plugins: os-zabbix-proxy 1.9[<a target="_blank" href="https://github.com/opnsense/plugins/blob/stable/22.7/net-mgmt/zabbix-proxy/pkg-descr">4</a>]</li><li>src: rc: improve NAME_setup integration</li><li>src: zlib: fix a bug when getting a gzip header extra field with inflate()[<a target="_blank" href="https://www.freebsd.org/security/advisories/FreeBSD-SA-22:13.zlib.asc">5</a>]</li><li>src: tzdata: import tzdata 2022b and 2022c[<a target="_blank" href="https://www.freebsd.org/security/advisories/FreeBSD-EN-22:20.tzdata.asc">6</a>]</li><li>ports: ldns 1.8.3[<a target="_blank" href="https://raw.githubusercontent.com/NLnetLabs/ldns/1.8.3/Changelog">7</a>]</li><li>ports: liblz4 1.9.4</li><li>ports: libxml 2.10.1[<a target="_blank" href="https://gitlab.gnome.org/GNOME/libxml2/-/blob/master/NEWS">8</a>]</li><li>ports: nss 3.82[<a target="_blank" href="https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_82.html">9</a>]</li><li>ports: phpseclib 3.0.14[<a target="_blank" href="https://github.com/phpseclib/phpseclib/releases/tag/3.0.14">10</a>]</li></ul></p><p>A hotfix release was issued as 22.7.3_2:</p><p><ul><li>system: work around phpseclib 3 flagging RSA-PSS as an invalid key alogrithm</li><li>system: check for existing X509 class before doing CRL update</li></ul></p><p><br>Stay safe,<br> Your OPNsense team</p>
Mini Shell