version 1.25, 2014/10/19 21:08:19 |
version 1.26, 2014/11/17 19:55:00 |
|
|
A source code patch exists which remedies this problem.</a> |
A source code patch exists which remedies this problem.</a> |
<p> |
<p> |
|
|
|
<li><a name="013_pfctl"></a> |
|
<font color="#009000"><strong>013: SECURITY FIX: November 17, 2014</strong></font> |
|
<i>All architectures</i><br> |
|
PF rules of the form "pass from {192.0.2.1 2001:db8::1} to (pppoe0)" will |
|
apply an incorrect /32 mask to the dynamic IPv6 address, allowing access to |
|
a wide address range rather than the intended single host. |
|
As a workaround, list the IPv4 address last, i.e. "{2001:db8::1 192.0.2.1}". |
|
<br> |
|
<a href="http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/013_pfctl.patch.sig"> |
|
A source code patch exists which remedies this problem.</a> |
|
<p> |
|
|
</ul> |
</ul> |
|
|
</body> |
</body> |