Packages changed: MicroOS-release (20260827 -> 20260828) apparmor bzip2 chrony (4.8 -> 4.9) libapparmor srt (1.5.6 -> 1.5.7) === Details === ==== MicroOS-release ==== Version update (20260827 -> 20260828) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== apparmor ==== - add changes-since-5.0.2.diff - several profile updates - fix compability with Swig 4.5 (boo#1275508) - drop upstreamed nslookup.diff - refresh kerberosclient-usrmerge.diff - add dovecot.diff with several dovecot profile updates (boo#1265453) ==== bzip2 ==== - Fix CVE-2026-42250, off‑by‑one error in the bzip2recover utility when processing a specially crafted file can lead to a crash (bsc#1266786) * CVE-2026-42250.patch ==== chrony ==== Version update (4.8 -> 4.9) Subpackages: chrony-pool-openSUSE - Add chrony-test-tolerance.patch: relax the clock-accuracy bounds of the offline holdover phase in the 129-reload simulation test. Its jitter is generated by clknetsim via glibc log(), which is not correctly-rounded and differs in the last ULP between architectures (armv7l and ppc64le vs x86_64 and aarch64). Without a server to correct it, that tiny difference grows past the default limit, making the test fail there although chronyd behaves correctly. - Update to 4.9: * New minstratum and maxstratum directives to bound which source strata are acceptable * New maxntsretry option on server/pool to cap the NTS-KE retry interval * New maxtxbuffers directive enabling hardware and kernel TX timestamps on non-Ethernet devices and tunnels * NTP-over-PTP updated to the final specification (RFC 10030) * seccomp filter updated -- we build with --enable-scfilter, so this is on the default path * Better local clock precision measurement, and client logging no longer costs server performance * Fixed ratelimit directives rejecting burst values over 32 * Fixed handling of hardware RX timestamps with a zero interface index * Further refclock, chronyc and OpenBSD changes: see upstream's NEWS for the full list - Drop chrony-libnettle4.patch: merged upstream, 4.9 carries the same NETTLE_VERSION_MAJOR guards verbatim - Bump the bundled clknetsim simulator 6ee99f50 -> 56b60ef2, now taken from the chrony project's own GitLab as 4.9's test/simulation/README directs. 4.9's simulation tests need clknetsim's new raw-socket support; against the old pin all 69 of them fail. ==== libapparmor ==== - add changes-since-5.0.2.diff - several profile updates - fix compability with Swig 4.5 (boo#1275508) - drop upstreamed nslookup.diff - refresh kerberosclient-usrmerge.diff - add dovecot.diff with several dovecot profile updates (boo#1265453) ==== srt ==== Version update (1.5.6 -> 1.5.7) - Update to version 1.5.7: + Security Notice: - This release includes important security hardening and multiple vulnerability fixes identified during extensive security audits of the SRT codebase. Several issues could allow memory corruption, protocol state manipulation, resource exhaustion, or misuse of auxiliary tools and CI infrastructure. - Users are strongly encouraged to upgrade to this version to benefit from these security improvements and protocol hardening measures. + Security Improvements: - Handshake and Encryption Security: . Fully remediated the KMREQ processing vulnerability by validating all incoming KM message lengths before they reach internal conversion and copy routines, protecting both HSv4 and HSv5 negotiation paths. . Completed the remediation of the encryption downgrade vulnerability by preventing post-establishment KMRSP messages from modifying the security state of already secured sessions. Additional protections were added for both HSv4 and HSv5 negotiation paths. . Added minimum MSS enforcement during connection negotiation to prevent undersized payload buffers that could otherwise lead to heap corruption and information disclosure during handshake generation. . Hardened handshake state processing to correctly derive connection state from the live connection status and prevent unintended state rollback caused by late or malformed handshake exchanges. - Data Plane Protection: . Fixed validation of ACK control messages to prevent send-buffer corruption caused by forged or malformed acknowledgements. Additional bounds checking now ensures that sequence number ranges remain valid before buffer state updates occur. . Added protection against invalid DROPREQ ranges. Reversed ranges and invalid sequence number distances are now rejected before modifying receiver buffer state. . Corrected receive-path connection status handling to prevent non-addressed packets from affecting unrelated connection attempts. - FEC Robustness: . Added payload-size validation in FEC clipping operations to prevent out-of-bounds writes when processing oversized payloads. . Introduced minimum-size validation for FEC control packets, eliminating integer-underflow conditions that could occur when processing malformed packets. . Added upper bounds for peer-supplied FEC configuration values and improved error handling to prevent excessive memory allocation during connection establishment. - Bonding Reliability: . Fixed a use-after-free condition in the bonding BACKUP send path. Internal member context tracking now safely handles members removed while locks are temporarily released, preventing dangling references during failover processing. - Application Hardening: . Added validation of remotely supplied filenames in the srt-file-transmit utility. Path separators, parent directory references, and platform-specific path manipulation patterns are now rejected before files are created. + Build and CI Security Enhancements: - Replaced the dynamic Codecov script download mechanism with a pinned and integrity-verified version. - Pinned ABI compatibility checker dependencies to specific versions and removed reliance on mutable default branches. - Improved GitHub workflow supply-chain protection by pinning third-party actions, container images, and external dependencies to known revisions. + Stability Improvements: - Fixed local connection teardown handling following rejected late handshakes, ensuring the local endpoint correctly terminates invalid connection states. - Improved error handling for FEC initialization failures and memory allocation exceptions, providing graceful connection rejection instead of abrupt failures. + Test Coverage: - Additional negative and security-focused test coverage has been added for: . Malformed KMRSP messages. . Encryption downgrade scenarios. . ACK validation. . DROPREQ malformed and reversed ranges. . FEC oversized payloads and invalid configurations. . Connection cleanup and shutdown paths.