mirror of
https://github.com/openwrt/packages.git
synced 2026-10-13 03:37:43 +04:00
Alexandru Ardelean
71dc6b7bda
3.0.3 is a security/vulnerability release on the stable 3.0 series.
Notable fixes since 3.0.2:
* **CVE-2026-3608** — A large number of bracket pairs in a JSON payload
sent to any endpoint caused a stack overflow during recursive parsing.
The exploit does not need a syntactically valid command, so it bypasses
RBAC and the command filters on the High-Availability endpoints
(upstream #4275 / #4288 / #4387).
* Null dereference when configuring the Control Agent with a socket
entry that lacks the mandatory ``socket-name`` is now caught
(#4388, #4365).
* UNIX command sockets are created group-writable so Stork 2.4.0+ and
other tooling using the configured group can talk to the daemon
(#4398, #4260).
Upstream's release notes flag "no incompatible changes" and "no known
issues" for this bump.
All current patches still apply cleanly.
Release notes:
https://ftp.isc.org/isc/kea/3.0.3/Kea-3.0.3-ReleaseNotes.txt
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit eb538bd758)