Dear all,

Today we are switching pf stateful tracking of ICMPv6 neighbour discoveries off in order to fix the previous instability with the FreeBSD security advisory first shipped in 24.7.1. We do this in order to provide the same reliable IPv6 functionality that was on all previous versions prior to 24.7.1 at the cost of resurfacing CVE-2024-6640 until a better solution has been devised. A link to the long and difficult upstream bug report is included below.

But that is not all. The GUI gains snapshot support on ZFS installations by implementing what is called "boot environments" which allows one to move seamlessly from one snapshot to another via reboot. This functionality can also be accessed from the boot loader menu option "8" for a quick recovery ensuring that at least one other snapshot was created to boot into. A very special thank you to Sheridan Computers for contributing this feature.

Here are the full patch notes:

A hotfix release was issued as 24.7.3_1:


Stay safe,
Your OPNsense team