diff --git a/source/CE_releases.rst b/source/CE_releases.rst index 6707bdfa..d2edb36b 100644 --- a/source/CE_releases.rst +++ b/source/CE_releases.rst @@ -8,7 +8,7 @@ Community Edition :width: 600px :align: center -As of January 2015 there have been *246* releases leading to the latest version *23.1.1* +As of January 2015 there have been *247* releases leading to the latest version *23.1.2* named "Quintessential Quail". diff --git a/source/releases/BE_20.7.rst b/source/releases/BE_20.7.rst index cd35c0d8..68fe678f 100644 --- a/source/releases/BE_20.7.rst +++ b/source/releases/BE_20.7.rst @@ -431,7 +431,7 @@ Here are the full patch notes: * src: assorted multicast group join/leave corrections * src: fix vmx driver packet loss and degraded performance `[4] `__ * src: fix memory corruption in USB network device driver `[5] `__ -* src: fix multiple vulnerabilities in sqlite3 `[6] `__ +* src: fix multiple vulnerabilities in sqlite `[6] `__ * src: fix sendmsg(2) privilege escalation `[7] `__ * ports: perl 5.32.0 `[8] `__ * ports: squid 4.12 `[9] `__ diff --git a/source/releases/BE_22.4.rst b/source/releases/BE_22.4.rst index 56b4e735..441c6d9a 100644 --- a/source/releases/BE_22.4.rst +++ b/source/releases/BE_22.4.rst @@ -127,7 +127,7 @@ Here are the full patch notes: * ports: openvpn 2.5.7 `[12] `__ * ports: php 7.4.30 `[13] `__ * ports: py-certifi 2022.5.18.1 -* ports: sqlite3 3.38.5 `[14] `__ +* ports: sqlite 3.38.5 `[14] `__ * ports: strongswan 5.9.6 `[15] `__ * ports: sudo 1.9.11p2 `[16] `__ * ports: unbound 1.16.0 `[17] `__ diff --git a/source/releases/CE_20.7.rst b/source/releases/CE_20.7.rst index cd35c0d8..68fe678f 100644 --- a/source/releases/CE_20.7.rst +++ b/source/releases/CE_20.7.rst @@ -431,7 +431,7 @@ Here are the full patch notes: * src: assorted multicast group join/leave corrections * src: fix vmx driver packet loss and degraded performance `[4] `__ * src: fix memory corruption in USB network device driver `[5] `__ -* src: fix multiple vulnerabilities in sqlite3 `[6] `__ +* src: fix multiple vulnerabilities in sqlite `[6] `__ * src: fix sendmsg(2) privilege escalation `[7] `__ * ports: perl 5.32.0 `[8] `__ * ports: squid 4.12 `[9] `__ diff --git a/source/releases/CE_22.1.rst b/source/releases/CE_22.1.rst index dd639e62..68ce4365 100644 --- a/source/releases/CE_22.1.rst +++ b/source/releases/CE_22.1.rst @@ -138,7 +138,7 @@ Here are the full patch notes: * ports: openvpn 2.5.7 `[8] `__ * ports: php 7.4.30 `[9] `__ * ports: py-certifi 2022.5.18.1 -* ports: sqlite3 3.38.5 `[10] `__ +* ports: sqlite 3.38.5 `[10] `__ * ports: sudo 1.9.11p2 `[11] `__ * ports: unbound 1.16.0 `[12] `__ diff --git a/source/releases/CE_23.1.rst b/source/releases/CE_23.1.rst index d0b20bec..d3760355 100644 --- a/source/releases/CE_23.1.rst +++ b/source/releases/CE_23.1.rst @@ -29,6 +29,80 @@ can be found below as well. * Full mirror list: https://opnsense.org/download/ +-------------------------------------------------------------------------- +23.1.2 (March 07, 2023) +-------------------------------------------------------------------------- + + +This is mainly a reliability update with fixes in assorted subsystems. +Of note is the OpenVPN authentication framework rewrite in order to take +advantage of the upcoming OpenVPN 2.6 deferred authentication feature and +the fix for DHCP renew behaviour that was reported on 23.1. + +The roadmap for 23.7 was published, but at this point mainly consists of +MVC/API porting efforts for existing static pages. While the rewrite is +not strictly necessary from a user perspective it will move us a lot closer +to our mission goal to introduce privilege separation and to provide an API +for all components. + +Here are the full patch notes: + +* system: use singleton boot detection everywhere +* system: protect against more stray scripts on boot +* system: several shell_safe() conversions +* system: when applying auto-far default route make sure the local address is not empty +* system: refactor system_default_route() to prevent empty $gateway +* system: create system_resolver_configure() and cron job support +* system: add simple script and configd action to list current group membership (configctl auth list groups) +* system: prevent alias reload in routing reconfiguration like we do in rc.syshook monitor reload +* interfaces: protect against empty GIF host route +* interfaces: fix parsing of device names with a dot in packet capture +* interfaces: force newip calls through DHCP/PPP/OVPN on IPv4 +* interfaces: force newip calls through DHCP/PPP on IPv6 +* firewall: fix NAT dropdowns ignoring VIPs +* firewall: fix validation of alias names such as "A_BC" +* fIrewall: show all applicable floating rules when inspecting interface rules +* firewall: prevent networks from being sent to DNS resolver in update_tables.py +* reporting: make all status mapping colors configurable for themes in the Unbound DNS page +* dnsmasq: add dns_forward_max, cache_size and local_ttl options to GUI (contributed by Dr. Uwe Meyer-Gruhl) +* firmware: remove retired LibreSSL flavour handling and annotations +* ipsec: reqid should not be provided on mobile sessions +* ipsec: validate pool names on connections page +* ipsec: allow "@" character in all other eap_id fields for new connections +* ipsec: add connection data to XMLRPC sync +* ipsec: "Dynamic gateway" (rightallowany) option should be translated to 0.0.0.0/0,::/0 +* network time: remove "disable monitor" to get rid of log warnings (contributed by Dr. Uwe Meyer-Gruhl) +* openvpn: replace authentication handler to prepare for upcoming OpenVPN 2.6 with deferred authentication +* openvpn: rename -cipher option to --data-ciphers-fallback and adjust GUI accordingly +* unbound: fix typo in logger and create a pipe early in dnsbl_module.py (contributed by kulikov-a) +* unbound: fix type cast to prevent unnecessary updateBlocklist action +* unbound: add missing blocklist +* ui: solve deprecation in PHP via html_safe() wrapper +* wizard: unbound hardened DNSSEC setting moved +* plugins: os-acme-client 3.16 `[1] `__ +* plugins: os-crowdsec 1.0.2 `[2] `__ +* plugins: os-rfc2136 1.8 `[3] `__ +* plugins: os-theme-cicada 1.33 (contributed by Team Rebellion) +* plugins: os-theme-tucan 1.26 (contributed by Team Rebellion) +* plugins: os-theme-vicuna 1.44 (contributed by Team Rebellion) +* src: fix multiple OpenSSL vulnerabilities `[4] `__ +* src: pfsync: support deferring IPv6 packets +* src: pfsync: add missing bucket lock +* src: pfsync: ensure 'error' is always initialised +* ports: filterlog 0.7 fixes unknown TCP option print +* ports: lighttpd 1.4.69 `[5] `__ +* ports: monit 5.33.0 `[6] `__ +* ports: nss 3.88.1 `[7] `__ +* ports: openldap 2.6.4 `[8] `__ +* ports: openssh 9.2p1 `[9] `__ +* ports: php 8.1.16 `[10] `__ +* ports: phalcon 5.2.1 `[11] `__ +* ports: sqlite 3.41.0 `[12] `__ +* ports: strongswan 5.9.10 `[13] `__ +* ports: sudo 1.9.13p2 `[14] `__ + + + -------------------------------------------------------------------------- 23.1.1 (February 15, 2023) -------------------------------------------------------------------------- @@ -116,7 +190,7 @@ Here are the full patch notes: * ports: dnsmasq 2.89 `[8] `__ * ports: dpinger 3.3 `[9] `__ * ports: lighttpd 1.4.68 `[10] `__ -* ports: openssh-portable 9.1p1 `[11] `__ +* ports: openssh 9.1p1 `[11] `__ * ports: openssl 1.1.1t `[12] `__ * ports: php 8.1.15 `[13] `__