Re: FreeBSD Errata Notice FreeBSD-EN-26:11.dhclient

On Sun, May 3, 2026 at 3:00 PM Anton Saietskii <[email protected]> wrote:
>
> Is it intended that no 'release/14.3.0-p13' and 'release/14.4.0-p3'
> *tags* have been created?
Sorry, 'release/14.3.0-p13' and 'release/14.4.0-p4'.

> On Fri, May 1, 2026 at 7:12 PM FreeBSD Errata Notices
> <[email protected]> wrote:
> >
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA512
> >
> > =============================================================================
> > FreeBSD-EN-26:11.dhclient                                       Errata Notice
> >                                                           The FreeBSD Project
> >
> > Topic:          dhclient(8) lease validation is too strict
> >
> > Category:       core
> > Module:         dhclient
> > Announced:      2026-05-01
> > Affects:        All supported versions of FreeBSD.
> > Corrected:      2026-04-30 21:07:00 UTC (stable/15, 15.0-STABLE)
> >                 2026-05-01 15:08:46 UTC (releng/15.0, 15.0-RELEASE-p8)
> >                 2026-04-30 21:07:11 UTC (stable/14, 14.4-STABLE)
> >                 2026-05-01 15:08:37 UTC (releng/14.4, 14.4-RELEASE-p4)
> >                 2026-05-01 15:08:30 UTC (releng/14.3, 14.3-RELEASE-p13)
> >                 2026-04-30 21:07:24 UTC (stable/13, 13.5-STABLE)
> >                 2026-05-01 15:08:19 UTC (releng/13.5, 13.5-RELEASE-p14)
> >
> > For general information regarding FreeBSD Errata Notices and Security
> > Advisories, including descriptions of the fields above, security
> > branches, and the following sections, please visit
> > <URL:https://security.FreeBSD.org/>.
> >
> > Note: While FreeBSD 13.5 is end of life (EOL) as of May 1st, 2026, the
> > Security Team has decided to patch this issue as it was identified and a fix
> > was in-flight before the EOL date.
> >
> > I.   Background
> >
> > dhclient(8) is the default IPv4 DHCP client used on FreeBSD.  It is
> > responsible for contacting DHCP servers on a network segment and for
> > initialising and configuring network interfaces based on received
> > information.
> >
> > When processing a DHCP offer, dhclient passes various parameters provided by
> > the server to dhclient-script(8).  DHCP options, as documented in
> > dhcp-options(5), are passed via the environment.
> >
> > II.  Problem Description
> >
> > The patch for FreeBSD-SA-26:15.dhclient introduced some validation of the
> > boot file DHCP option to prevent unescaped values from being written to the
> > stored lease file.  This validation is overly strict and rejects Windows
> > paths.
> >
> > III. Impact
> >
> > The overly strict validation may cause dhclient(8) to reject valid leases.
> >
> > IV.  Workaround
> >
> > No workaround is available.  Systems not running dhclient(8) are not
> > affected.
> >
> > V.   Solution
> >
> > Upgrade your system to a supported FreeBSD stable or release / security
> > branch (releng) dated after the correction date.
> >
> > Perform one of the following:
> >
> > 1) To update your system installed from base system packages:
> >
> > Systems running a 15.0-RELEASE version of FreeBSD on the amd64 or arm64
> > platforms, which were installed using base system packages, can be updated
> > via the pkg(8) utility:
> >
> > # pkg upgrade -r FreeBSD-base
> >
> > 2) To update your system installed from binary distribution sets:
> >
> > Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
> > or the i386 platform on FreeBSD 13, which were not installed using base
> > system packages, can be updated via the freebsd-update(8) utility:
> >
> > # freebsd-update fetch
> > # freebsd-update install
> >
> > 3) To update your system via a source code patch:
> >
> > The following patches have been verified to apply to the applicable
> > FreeBSD release branches.
> >
> > a) Download the relevant patch from the location below, and verify the
> > detached PGP signature using your PGP utility.
> >
> > # fetch https://security.FreeBSD.org/patches/EN-26:11/dhclient.patch
> > # fetch https://security.FreeBSD.org/patches/EN-26:11/dhclient.patch.asc
> > # gpg --verify dhclient.patch.asc
> >
> > b) Apply the patch.  Execute the following commands as root:
> >
> > # cd /usr/src
> > # patch < /path/to/patch
> >
> > c) Recompile the operating system using buildworld and installworld as
> > described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
> >
> > Restart the applicable daemons, or reboot the system.
> >
> > VI.  Correction details
> >
> > This issue is corrected as of the corresponding Git commit hash in the
> > following stable and release branches:
> >
> > Branch/path                             Hash                     Revision
> > - -------------------------------------------------------------------------
> > stable/15/                              252f603d1704    stable/15-n283453
> > releng/15.0/                            dc8762cfb6e2  releng/15.0-n281035
> > stable/14/                              2f9478ad42c4    stable/14-n274094
> > releng/14.4/                            dfcb69cdb07e  releng/14.4-n273699
> > releng/14.3/                            5bad905eb37f  releng/14.3-n271499
> > stable/13/                              b1ece85741db    stable/13-n259871
> > releng/13.5/                            b362b6b6c8f2  releng/13.5-n259221
> > - -------------------------------------------------------------------------
> >
> > Run the following command to see which files were modified by a
> > particular commit:
> >
> > # git show --stat <commit hash>
> >
> > Or visit the following URL, replacing NNNNNN with the hash:
> >
> > <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
> >
> > To determine the commit count in a working tree (for comparison against
> > nNNNNNN in the table above), run:
> >
> > # git rev-list --count --first-parent HEAD
> >
> > VII. References
> >
> > <URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=294886>
> >
> > The latest revision of this advisory is available at
> > <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:11.dhclient.asc>
> > -----BEGIN PGP SIGNATURE-----
> >
> > iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmn0xiAbFIAAAAAABAAO
> > bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvJnEQAJ8ZYWjGt7iYjMkOZiM1
> > I7NLl7RygvIWU25ThAOXlA7zPA7LbS23+nca4QlNdvTVkpcfsCrmxhJYY4ymkZh7
> > QuEVDEp20n02S7362S9kCpmp3NDXQvuCPNt8zRel4ek3u/b8/9KCASL1jN+1eSgR
> > G8ZVWVheRzKgsaYJsDIyX0AjNk41gQk8ASYoWjeIk5F14kFk3ozlfJTrBL2XlOuL
> > J28P47d5lEgU2x04xLSZF9xQrF1I13XZa8pMtogF3aveTXXVzHDJFZIcppu0uQYY
> > tp9uvyQ6NnzNPBXWztVCJ+eRdxS4RLp3Dp3U9/3GrqVuCfG8BO7kE5OhcjO0EPVC
> > lmvXBJLqQnsodEQA0BysAsMxlMcw+n6z0np2DFdFCkyLrPCx3Bm+D/WRLngRcp4s
> > +FBIgoF+ywUXVwLRkVJeCsQJTNzVhneq8rtcfE6LdJoIgW/oOUyNEJTBpgvhXmz6
> > /pmW47cmNY+CFWCXAL/7fLZVX1dYvEpSn+Iqqs8Efr2OFfQqRXZunJXNXnKuMtfT
> > p82Hl////cHObQSqlI95J5yJmdBzOxlpzHTwSLVTD5SfvAcN3PzN3hRhFFqG8lg5
> > HV64Fu1xPqLX1mthTw1Sbng5mTUL+MJ5BN26M+UevYZBi02m5nMUyjWH+D4Bn3RS
> > gajZ9Z16VPgdlPsNPihqsx7k
> > =Ro3y
> > -----END PGP SIGNATURE-----
> >