rpms/firewalld
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings}

Browse Source 
Resolves: RHEL-218161
This commit is contained in:
Eric Garver 2026-07-29 14:14:23 -04:00
parent 38f99c9410
commit 84002260d3
2 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
0070-v2.5.0-fix-policy-use-PK_ACTION_CONFIG-for-set-ZoneSettings.patch Normal file
View File

@ -0,0 +1,37 @@
From 2fb1b1da56a68566e69c1ce9b5e1f7074399c1f5 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 31 Mar 2026 20:46:50 +0800
Subject: [PATCH] v2.5.0: fix(policy): use PK_ACTION_CONFIG for
set{ZoneSettings2,PolicySettings}
Reference: https://access.redhat.com/security/cve/cve-2026-4948
(cherry picked from commit 5fb3914ad830feff6cb2b0670457c60a323c6c6c)
---
src/firewall/server/firewalld.py | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py
index e43ddb959f41..d47f50116f0e 100644
--- a/src/firewall/server/firewalld.py
+++ b/src/firewall/server/firewalld.py
@@ -946,7 +946,7 @@ class FirewallD(DbusServiceObject):
log.debug1("getZoneSettings2(%s)", zone)
return self.fw.zone.get_config_with_settings_dict(zone)
- @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
+ @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature='sa{sv}')
@dbus_handle_exceptions
def setZoneSettings2(self, zone, settings, sender=None):
@@ -970,7 +970,7 @@ class FirewallD(DbusServiceObject):
log.debug1("policy.getPolicySettings(%s)", policy)
return self.fw.policy.get_config_with_settings_dict(policy)
- @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO)
+ @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG)
@dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature='sa{sv}')
@dbus_handle_exceptions
def setPolicySettings(self, policy, settings, sender=None):
--
2.53.0

6
firewalld.spec
View File

@ -1,7 +1,7 @@
Summary: A firewall daemon with D-Bus interface providing a dynamic firewall
Name: firewalld
Version: 1.3.4
Release: 19%{?dist}
Release: 20%{?dist}
URL: http://www.firewalld.org
License: GPLv2+
Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.bz2
@ -74,6 +74,7 @@ Patch66: 0066-v2.5.0-chore-fw_policy-support-timeouts.patch
Patch67: 0067-v2.5.0-fix-policy-support-timeouts.patch
Patch68: 0068-v2.5.0-fix-cli-policy-allow-timeout-with-ingress-zon.patch
Patch69: 0069-v2.5.0-test-policy-verify-timeout-works.patch
Patch70: 0070-v2.5.0-fix-policy-use-PK_ACTION_CONFIG-for-set-ZoneSettings.patch
BuildArch: noarch
BuildRequires: autoconf
BuildRequires: automake
@ -297,6 +298,9 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite
%{_mandir}/man1/firewall-config*.1*
%changelog
* Wed Jul 26 2026 Eric Garver <egarver@redhat.com> - 1.3.4-20
- fix(policy): use PK_ACTION_CONFIG for set{ZoneSettings2,PolicySettings} (CVE-2026-4948)
* Fri Jul 10 2026 Eric Garver <egarver@redhat.com> - 1.3.4-19
- fix(zone): forward: support timeout
- fix(policy): support timeouts