0.15.1: bsc#1251461, CVE-2025-47911 and bsc#1251677, CVE-2025-58190 #2

Open
fstrba wants to merge 17 commits from fstrba/go-sendxmpp:leap-16.1 into leap-16.1
6 changed files with 112 additions and 8 deletions

View File

@@ -3,7 +3,7 @@
<param name="url">https://salsa.debian.org/mdosch/go-sendxmpp.git</param>
<param name="scm">git</param>
<param name="exclude">.git</param>
<param name="revision">v0.11.2</param>
<param name="revision">v0.15.1</param>
<param name="versionformat">@PARENT_TAG@</param>
<param name="changesgenerate">disable</param>
<param name="versionrewrite-pattern">v(.*)</param>

View File

@@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:345ee129d7ed87a1b7f90b3c2012357a744dd61f9a4dac97a8cc038065c9db7a
size 37443

BIN
go-sendxmpp-0.15.1.tar.gz LFS Normal file

Binary file not shown.

View File

@@ -1,3 +1,107 @@
-------------------------------------------------------------------
Tue Nov 11 12:48:38 UTC 2025 - Fridrich Strba <fstrba@suse.com>
- Update to 0.15.1:
Added
* Add XEP-0359 Origin-ID to messages (requires go-xmpp >= v0.2.18).
Changed
* HTTP upload: Ignore timeouts on disco IQs as some components do
not reply.
- Upgrades the embedded golang.org/x/net to 0.46.0
* Fixes: bsc#1251461, CVE-2025-47911: various algorithms with
quadratic complexity when parsing HTML documents
* Fixes: bsc#1251677, CVE-2025-58190: excessive memory consumption
by 'html.ParseFragment' when processing specially crafted input
-------------------------------------------------------------------
Tue Aug 19 06:18:37 UTC 2025 - Michael Vetter <mvetter@suse.com>
- Update to 0.15.0:
Added:
* Add flag --verbose to show debug information.
* Add flag --recipients to specify recipients by file.
* Add flag --retry-connect to try after a waiting time if the connection fails.
* Add flag --retry-connect-max to specify the amount of retry attempts.
* Add flag --legacy-pgp for using XEP-0027 PGP encryption with Ox keys.
* Add support for punycode domains.
Changed:
* Update gopenpgp library to v3.
* Improve error detection for MUC joins.
* Don't try to connect to other SRV record targets if error contains 'auth-failure'.
* Remove support for old SSDP version (via go-xmpp v0.2.15).
* Http-upload: Stop checking other disco items after finding upload component.
* Increase default TLS version to 1.3.
- bsc#1241814 (CVE-2025-22872): This update includes golang.org/x/net/html 0.43.0
-------------------------------------------------------------------
Tue Jan 28 13:22:45 UTC 2025 - Michael Vetter <mvetter@suse.com>
- Update to 0.14.1:
* Use prettier date format for error messages.
* Update XEP-0474 to version 0.4.0 (requires go-xmpp >= 0.2.10).
-------------------------------------------------------------------
Mon Dec 30 11:04:08 UTC 2024 - Michael Vetter <mvetter@suse.com>
- Update to 0.14.0:
Added:
* Add --fast-invalidate to allow invalidating the FAST token.
Changed:
* Don't create legacy Ox private key directory in ~/.local/share/go-sendxmpp/oxprivkeys.
* Delete legacy Ox private key directory if it's empty.
* Show proper error if saved FAST mechanism isn't usable with current TLS version (requires go-xmpp >= 0.2.9).
* Print debug output to stdout, not stderr (requires go-xmpp >= 0.2.9).
* Show RECV: and SEND: prefix for debug output (requires go-xmpp >= 0.2.9).
* Delete stored fast token if --fast-invalidate and --fast-off are set.
* Show error when FAST creds are stored but non-FAST mechanism is requested.
-------------------------------------------------------------------
Mon Dec 16 10:58:14 UTC 2024 - Michael Vetter <mvetter@suse.com>
- Update to 0.13.0:
Added:
* Add --anonymous to support anonymous authentication (requires go-xmpp >= 0.2.8).
* Add XEP-0480: SASL Upgrade Tasks support (requires go-xmpp >= 0.2.8).
* Add support for see-other-host stream error (requires go-xmpp >= 0.2.8).
Changed:
* Don't automatically try other auth mechanisms if FAST authentication fails.
-------------------------------------------------------------------
Tue Nov 26 07:44:14 UTC 2024 - Michael Vetter <mvetter@suse.com>
- Update to 0.12.1:
Changed:
* Print error instead of quitting if a message of type error is received.
* Allow upload of multiple files.
Added:
* Add flag --suppress-root-warning to suppress the warning when go-sendxmpp is used by the root user.
-------------------------------------------------------------------
Tue Nov 26 07:43:44 UTC 2024 - Michael Vetter <mvetter@suse.com>
- Update to 0.12.0:
Added:
* Add possibility to look up direct TLS connection endpoint via hostmeta2 (requires xmppsrv >= 0.3.3).
* Add flag --allow-plain to allow PLAIN authentication (requires go-xmpp >= 0.2.5).
Changed:
* Disable PLAIN authentication per default.
* Disable PLAIN authentication after first use of a SCRAM auth mechanism (overrides --allow-plain) (requires
go-xmpp >= 0.2.5).
-------------------------------------------------------------------
Sat Oct 26 17:42:16 UTC 2024 - Michael Vetter <mvetter@suse.com>
- Update to 0.11.4:
* Fix bug in SCRAM-SHA-256-PLUS (via go-xmpp >= 0.2.4).
-------------------------------------------------------------------
Sat Oct 26 17:41:55 UTC 2024 - Michael Vetter <mvetter@suse.com>
- Update to 0.11.3:
* Add go-xmpp library version to --version output (requires go-xmpp >= 0.2.2).
* Fix XEP-0474: SASL SCRAM Downgrade Protection hash calculation bug (via go-xmpp >= v0.2.3).
* [gocritic]: Improve code quality.
-------------------------------------------------------------------
Wed Sep 18 05:38:31 UTC 2024 - Michael Vetter <mvetter@suse.com>

View File

@@ -1,7 +1,7 @@
#
# spec file for package go-sendxmpp
#
# Copyright (c) 2024 SUSE LLC
# Copyright (c) 2025 SUSE LLC and contributors
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -17,7 +17,7 @@
Name: go-sendxmpp
Version: 0.11.2
Version: 0.15.1
Release: 0
Summary: A little tool to send messages to an XMPP contact or MUC
License: BSD-2-Clause

BIN
vendor.tar.gz LFS

Binary file not shown.