diff --git a/package/netsnmp/0002-Add-Linux-6.7-compatibility-parsing-proc-net-snmp.patch b/package/netsnmp/0001-Add-Linux-6.7-compatibility-parsing-proc-net-snmp.patch similarity index 100% rename from package/netsnmp/0002-Add-Linux-6.7-compatibility-parsing-proc-net-snmp.patch rename to package/netsnmp/0001-Add-Linux-6.7-compatibility-parsing-proc-net-snmp.patch diff --git a/package/netsnmp/0001-snmp_agent-disallow-SET-with-NULL-varbind.patch b/package/netsnmp/0001-snmp_agent-disallow-SET-with-NULL-varbind.patch deleted file mode 100644 index 3a6321d7a7..0000000000 --- a/package/netsnmp/0001-snmp_agent-disallow-SET-with-NULL-varbind.patch +++ /dev/null @@ -1,72 +0,0 @@ -From b07627fa67c686b07d1eab123cf3e4887a2a93aa Mon Sep 17 00:00:00 2001 -From: Bill Fenner -Date: Fri, 25 Nov 2022 08:41:24 -0800 -Subject: [PATCH] snmp_agent: disallow SET with NULL varbind - -Upstream: https://github.com/net-snmp/net-snmp/commit/4589352dac3ae111c7621298cf231742209efd9b - -[Thomas: this commit was merged as part of -https://github.com/net-snmp/net-snmp/pull/490/commits, which fixes -https://github.com/net-snmp/net-snmp/issues/474 (CVE-2022-44792) and -https://github.com/net-snmp/net-snmp/issues/475 (CVE-2022-44793). The -other two commits merged as part of this pull request are related to -adding a non-regression test for this, which is not relevant for the -security fix itself.] - -Signed-off-by: Thomas Petazzoni ---- - agent/snmp_agent.c | 32 ++++++++++++++++++++++++++++++++ - 1 file changed, 32 insertions(+) - -diff --git a/agent/snmp_agent.c b/agent/snmp_agent.c -index 867d0c166f..3f678fe2df 100644 ---- a/agent/snmp_agent.c -+++ b/agent/snmp_agent.c -@@ -3719,12 +3719,44 @@ netsnmp_handle_request(netsnmp_agent_session *asp, int status) - return 1; - } - -+static int -+check_set_pdu_for_null_varbind(netsnmp_agent_session *asp) -+{ -+ int i; -+ netsnmp_variable_list *v = NULL; -+ -+ for (i = 1, v = asp->pdu->variables; v != NULL; i++, v = v->next_variable) { -+ if (v->type == ASN_NULL) { -+ /* -+ * Protect SET implementations that do not protect themselves -+ * against wrong type. -+ */ -+ DEBUGMSGTL(("snmp_agent", "disallowing SET with NULL var for varbind %d\n", i)); -+ asp->index = i; -+ return SNMP_ERR_WRONGTYPE; -+ } -+ } -+ return SNMP_ERR_NOERROR; -+} -+ - int - handle_pdu(netsnmp_agent_session *asp) - { - int status, inclusives = 0; - netsnmp_variable_list *v = NULL; - -+#ifndef NETSNMP_NO_WRITE_SUPPORT -+ /* -+ * Check for ASN_NULL in SET request -+ */ -+ if (asp->pdu->command == SNMP_MSG_SET) { -+ status = check_set_pdu_for_null_varbind(asp); -+ if (status != SNMP_ERR_NOERROR) { -+ return status; -+ } -+ } -+#endif /* NETSNMP_NO_WRITE_SUPPORT */ -+ - /* - * for illegal requests, mark all nodes as ASN_NULL - */ --- -2.41.0 - diff --git a/package/netsnmp/netsnmp.hash b/package/netsnmp/netsnmp.hash index e1e9d10898..7898941271 100644 --- a/package/netsnmp/netsnmp.hash +++ b/package/netsnmp/netsnmp.hash @@ -1,7 +1,7 @@ # Locally calculated after checking pgp signature at -# https://sourceforge.net/projects/net-snmp/files/net-snmp/5.9.3/net-snmp-5.9.3.tar.gz.asc -# using key D0F8F495DA6160C44EFFBF10F07B9D2DACB19FD6 -sha256 2097f29b7e1bf3f1300b4bae52fa2308d0bb8d5d3998dbe02f9462a413a2ef0a net-snmp-5.9.3.tar.gz +# https://sourceforge.net/projects/net-snmp/files/net-snmp/5.9.4/net-snmp-5.9.4.tar.gz.asc +# using key 6E6718AEF1EB5C65C32D1B2A356BC0B552D53CAB +sha256 8b4de01391e74e3c7014beb43961a2d6d6fa03acc34280b9585f4930745b0544 net-snmp-5.9.4.tar.gz # Hash for license file sha256 ed869ea395a1f125819a56676385ab0557a21507764bf56f2943302011381e59 COPYING diff --git a/package/netsnmp/netsnmp.mk b/package/netsnmp/netsnmp.mk index 6575ff1afa..499e1d9477 100644 --- a/package/netsnmp/netsnmp.mk +++ b/package/netsnmp/netsnmp.mk @@ -4,7 +4,7 @@ # ################################################################################ -NETSNMP_VERSION = 5.9.3 +NETSNMP_VERSION = 5.9.4 NETSNMP_SITE = https://downloads.sourceforge.net/project/net-snmp/net-snmp/$(NETSNMP_VERSION) NETSNMP_SOURCE = net-snmp-$(NETSNMP_VERSION).tar.gz NETSNMP_LICENSE = Various BSD-like