Update submodules from pool/lldpd#1 and create patchinfo.20260622082905583388.93181000773252/_patchinfo

2026-06-22 10:29:05 +02:00
parent ba99772faf
commit 777984f57f
2 changed files with 54 additions and 1 deletions
@@ -0,0 +1,53 @@
+<patchinfo>
+  <issue tracker="cve" id="2026-46433">VUL-0: CVE-2026-46433: lldpd:: Denial of Service due to heap buffer over-read when processing VLAN-tagged Ethernet frames</issue>
+  <packager>pluskalm</packager>
+  <rating>moderate</rating>
+  <category>security</category>
+  <summary>Security update for lldpd</summary>
+  <description>This update for lldpd fixes the following issues:
+
+Changes in lldpd:
+
+- Update to version 1.0.22
+  * Fix CVE-2026-46433, out-of-bound read access when removing
+    VLAN tag (#787).
+  * Reject 0-length management address in LLDP.
+  * Fix race condition when creating the control socket.
+  * Fix FDP MAC address.
+  * Fix memory leak in the BSD bridge query path.
+  * Fix duplicate management addresses when merging EDP VLAN
+    frames.
+
+- Update to version 1.0.21
+  Changes:
+  * Add "configure lldp portdescription-source" to choose how to
+    populate port description.
+  Fix:
+  * Fix path traversal vulnerabilities in the privileged process.
+  * Fix arbitrary file deletion in the privileged process.
+  * Fix accuracy of Dot3 MAU types advertised and add support for
+    200G and 400G.
+  * Fix detection of wireless interfaces.
+
+- Update to version 1.0.20
+  Changes:
+  * Enable fast start unconditionally (and move its configuration
+    in "configure lldp").
+  * Make VLAN advertisements configurable.
+  Fix:
+  * Do not break zero-copy traffic on Linux.
+  * Fix crash on rapid addition/removal of interfaces.
+  * Fix management address selection when pattern is a negative
+    IP address.
+
+- Update to version 1.0.19
+  Changes:
+  * Add cvlan/svlan/tpmr capabilities.
+  * Add lldpctl_watch_sync_unblock to liblldpctl.
+  * Add C++ wrapper for lldpctl.
+  Fix:
+  * Fix AppArmor policy for /run/lldpd/lldpd.socket.lock.
+  * Do not query stats for a down interface on Linux.
+</description>
+  <package>lldpd</package>
+</patchinfo>