Re: FreeBSD Errata Notice FreeBSD-EN-26:11.dhclient

Is it intended that no 'release/14.3.0-p13' and 'release/14.4.0-p3'
*tags* have been created?

On Fri, May 1, 2026 at 7:12 PM FreeBSD Errata Notices
<[email protected]> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> =============================================================================
> FreeBSD-EN-26:11.dhclient                                       Errata Notice
>                                                           The FreeBSD Project
>
> Topic:          dhclient(8) lease validation is too strict
>
> Category:       core
> Module:         dhclient
> Announced:      2026-05-01
> Affects:        All supported versions of FreeBSD.
> Corrected:      2026-04-30 21:07:00 UTC (stable/15, 15.0-STABLE)
>                 2026-05-01 15:08:46 UTC (releng/15.0, 15.0-RELEASE-p8)
>                 2026-04-30 21:07:11 UTC (stable/14, 14.4-STABLE)
>                 2026-05-01 15:08:37 UTC (releng/14.4, 14.4-RELEASE-p4)
>                 2026-05-01 15:08:30 UTC (releng/14.3, 14.3-RELEASE-p13)
>                 2026-04-30 21:07:24 UTC (stable/13, 13.5-STABLE)
>                 2026-05-01 15:08:19 UTC (releng/13.5, 13.5-RELEASE-p14)
>
> For general information regarding FreeBSD Errata Notices and Security
> Advisories, including descriptions of the fields above, security
> branches, and the following sections, please visit
> <URL:https://security.FreeBSD.org/>.
>
> Note: While FreeBSD 13.5 is end of life (EOL) as of May 1st, 2026, the
> Security Team has decided to patch this issue as it was identified and a fix
> was in-flight before the EOL date.
>
> I.   Background
>
> dhclient(8) is the default IPv4 DHCP client used on FreeBSD.  It is
> responsible for contacting DHCP servers on a network segment and for
> initialising and configuring network interfaces based on received
> information.
>
> When processing a DHCP offer, dhclient passes various parameters provided by
> the server to dhclient-script(8).  DHCP options, as documented in
> dhcp-options(5), are passed via the environment.
>
> II.  Problem Description
>
> The patch for FreeBSD-SA-26:15.dhclient introduced some validation of the
> boot file DHCP option to prevent unescaped values from being written to the
> stored lease file.  This validation is overly strict and rejects Windows
> paths.
>
> III. Impact
>
> The overly strict validation may cause dhclient(8) to reject valid leases.
>
> IV.  Workaround
>
> No workaround is available.  Systems not running dhclient(8) are not
> affected.
>
> V.   Solution
>
> Upgrade your system to a supported FreeBSD stable or release / security
> branch (releng) dated after the correction date.
>
> Perform one of the following:
>
> 1) To update your system installed from base system packages:
>
> Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64
> platforms, which were installed using base system packages, can be updated
> via the pkg(8) utility:
>
> # pkg upgrade -r FreeBSD-base
>
> 2) To update your system installed from binary distribution sets:
>
> Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
> or the i386 platform on FreeBSD 13, which were not installed using base
> system packages, can be updated via the freebsd-update(8) utility:
>
> # freebsd-update fetch
> # freebsd-update install
>
> 3) To update your system via a source code patch:
>
> The following patches have been verified to apply to the applicable
> FreeBSD release branches.
>
> a) Download the relevant patch from the location below, and verify the
> detached PGP signature using your PGP utility.
>
> # fetch https://security.FreeBSD.org/patches/EN-26:11/dhclient.patch
> # fetch https://security.FreeBSD.org/patches/EN-26:11/dhclient.patch.asc
> # gpg --verify dhclient.patch.asc
>
> b) Apply the patch.  Execute the following commands as root:
>
> # cd /usr/src
> # patch < /path/to/patch
>
> c) Recompile the operating system using buildworld and installworld as
> described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
>
> Restart the applicable daemons, or reboot the system.
>
> VI.  Correction details
>
> This issue is corrected as of the corresponding Git commit hash in the
> following stable and release branches:
>
> Branch/path                             Hash                     Revision
> - -------------------------------------------------------------------------
> stable/15/                              252f603d1704    stable/15-n283453
> releng/15.0/                            dc8762cfb6e2  releng/15.0-n281035
> stable/14/                              2f9478ad42c4    stable/14-n274094
> releng/14.4/                            dfcb69cdb07e  releng/14.4-n273699
> releng/14.3/                            5bad905eb37f  releng/14.3-n271499
> stable/13/                              b1ece85741db    stable/13-n259871
> releng/13.5/                            b362b6b6c8f2  releng/13.5-n259221
> - -------------------------------------------------------------------------
>
> Run the following command to see which files were modified by a
> particular commit:
>
> # git show --stat <commit hash>
>
> Or visit the following URL, replacing NNNNNN with the hash:
>
> <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
>
> To determine the commit count in a working tree (for comparison against
> nNNNNNN in the table above), run:
>
> # git rev-list --count --first-parent HEAD
>
> VII. References
>
> <URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294886>
>
> The latest revision of this advisory is available at
> <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:11.dhclient.asc>
> -----BEGIN PGP SIGNATURE-----
>
> iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmn0xiAbFIAAAAAABAAO
> bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvJnEQAJ8ZYWjGt7iYjMkOZiM1
> I7NLl7RygvIWU25ThAOXlA7zPA7LbS23+nca4QlNdvTVkpcfsCrmxhJYY4ymkZh7
> QuEVDEp20n02S7362S9kCpmp3NDXQvuCPNt8zRel4ek3u/b8/9KCASL1jN+1eSgR
> G8ZVWVheRzKgsaYJsDIyX0AjNk41gQk8ASYoWjeIk5F14kFk3ozlfJTrBL2XlOuL
> J28P47d5lEgU2x04xLSZF9xQrF1I13XZa8pMtogF3aveTXXVzHDJFZIcppu0uQYY
> tp9uvyQ6NnzNPBXWztVCJ+eRdxS4RLp3Dp3U9/3GrqVuCfG8BO7kE5OhcjO0EPVC
> lmvXBJLqQnsodEQA0BysAsMxlMcw+n6z0np2DFdFCkyLrPCx3Bm+D/WRLngRcp4s
> +FBIgoF+ywUXVwLRkVJeCsQJTNzVhneq8rtcfE6LdJoIgW/oOUyNEJTBpgvhXmz6
> /pmW47cmNY+CFWCXAL/7fLZVX1dYvEpSn+Iqqs8Efr2OFfQqRXZunJXNXnKuMtfT
> p82Hl////cHObQSqlI95J5yJmdBzOxlpzHTwSLVTD5SfvAcN3PzN3hRhFFqG8lg5
> HV64Fu1xPqLX1mthTw1Sbng5mTUL+MJ5BN26M+UevYZBi02m5nMUyjWH+D4Bn3RS
> gajZ9Z16VPgdlPsNPihqsx7k
> =Ro3y
> -----END PGP SIGNATURE-----
>