All of lore.kernel.org
 help / color / mirror / Atom feed
* [Buildroot] [PATCH 1/2] package/libzlib: fix CPE vendor id
@ 2022-08-29 17:14 Marcus Hoffmann
  2022-08-29 17:14 ` [Buildroot] [next v2 1/2] package/python-paho-mqtt: bump to 1.6.1 Marcus Hoffmann
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Marcus Hoffmann @ 2022-08-29 17:14 UTC (permalink / raw)
  To: buildroot; +Cc: Davide Viti, Asaf Kahlon

Can be found in this CVE entry for example:
https://nvd.nist.gov/vuln/detail/CVE-2022-37434

Signed-off-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>
---
 package/libzlib/libzlib.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/libzlib/libzlib.mk b/package/libzlib/libzlib.mk
index 933732d6ba..431c48739a 100644
--- a/package/libzlib/libzlib.mk
+++ b/package/libzlib/libzlib.mk
@@ -11,7 +11,7 @@ LIBZLIB_LICENSE = Zlib
 LIBZLIB_LICENSE_FILES = README
 LIBZLIB_INSTALL_STAGING = YES
 LIBZLIB_PROVIDES = zlib
-LIBZLIB_CPE_ID_VENDOR = gnu
+LIBZLIB_CPE_ID_VENDOR = zlib
 LIBZLIB_CPE_ID_PRODUCT = zlib
 
 # It is not possible to build only a shared version of zlib, so we build both
-- 
2.25.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [Buildroot] [next v2 1/2] package/python-paho-mqtt: bump to 1.6.1
  2022-08-29 17:14 [Buildroot] [PATCH 1/2] package/libzlib: fix CPE vendor id Marcus Hoffmann
@ 2022-08-29 17:14 ` Marcus Hoffmann
  2022-08-31 20:24   ` Yann E. MORIN
  2022-08-29 17:14 ` [Buildroot] [PATCH 2/2] package/libzlib: backport security fix for CVE-2022-37434 Marcus Hoffmann
  2022-08-30 21:29 ` [Buildroot] [PATCH 1/2] package/libzlib: fix CPE vendor id Arnout Vandecappelle
  2 siblings, 1 reply; 6+ messages in thread
From: Marcus Hoffmann @ 2022-08-29 17:14 UTC (permalink / raw)
  To: buildroot; +Cc: Davide Viti, Asaf Kahlon

We need to switch to the github download as the sdist published to pypi
doesn't package the epl-v20 license file isn't included there:

https://github.com/eclipse/paho.mqtt.python/pull/635

License changed to EPL-2.0 or EDLv1.0

Changelog:
https://github.com/eclipse/paho.mqtt.python/blob/master/ChangeLog.txt
Signed-off-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>
---
Changes v1 -> v2:
  - switch to github download to have license file in source tarball
  - update license hashes

 package/python-paho-mqtt/python-paho-mqtt.hash | 10 +++++-----
 package/python-paho-mqtt/python-paho-mqtt.mk   |  9 ++++-----
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/package/python-paho-mqtt/python-paho-mqtt.hash b/package/python-paho-mqtt/python-paho-mqtt.hash
index bf3993e919..dbf9ee89f6 100644
--- a/package/python-paho-mqtt/python-paho-mqtt.hash
+++ b/package/python-paho-mqtt/python-paho-mqtt.hash
@@ -1,6 +1,6 @@
-# md5 from https://pypi.python.org/pypi/paho-mqtt/json, sha256 locally computed
-md5  e3ac29cd5dc247a01083a2a8f3fddd08  paho-mqtt-1.4.0.tar.gz
-sha256  e440a052b46d222e184be3be38676378722072fcd4dfd2c8f509fb861a7b0b79  paho-mqtt-1.4.0.tar.gz
-sha256  76f13729e84e9222e543303df00f87d1b2c0995b6a505cd859a285667e44babb  LICENSE.txt
+# locally computed
+md5  00c3381d7deacc7ac8b220f3b9d689c6  python-paho-mqtt-1.6.1.tar.gz
+sha256	6e35c1be242a901fc9c00bad7d37b5cc4a497f398dfceb4ed0d8018a959be650  python-paho-mqtt-1.6.1.tar.gz
+sha256	66408b049249c3bdb0ba1ed285f5422ce67e371d40151bebd4d806af454ffe7c  LICENSE.txt
 sha256  e8cf7d54ea46c19aba793983889b7f7425e1ebfcaaccec764a7db091646e203c  edl-v10
-sha256  3b9be6b894d0769de796e653571ff6cef494913c0ce78c35a97db939e7d9087c  epl-v10
+sha256	8c349f80764d0648e645f41ef23772a70c995a0924b5235f735f4a3d09df127c  epl-v20
diff --git a/package/python-paho-mqtt/python-paho-mqtt.mk b/package/python-paho-mqtt/python-paho-mqtt.mk
index d192749e1e..3ff5f9e57a 100644
--- a/package/python-paho-mqtt/python-paho-mqtt.mk
+++ b/package/python-paho-mqtt/python-paho-mqtt.mk
@@ -4,11 +4,10 @@
 #
 ################################################################################
 
-PYTHON_PAHO_MQTT_VERSION = 1.4.0
-PYTHON_PAHO_MQTT_SOURCE = paho-mqtt-$(PYTHON_PAHO_MQTT_VERSION).tar.gz
-PYTHON_PAHO_MQTT_SITE = https://files.pythonhosted.org/packages/25/63/db25e62979c2a716a74950c9ed658dce431b5cb01fde29eb6cba9489a904
-PYTHON_PAHO_MQTT_LICENSE = EPL-1.0 or EDLv1.0
-PYTHON_PAHO_MQTT_LICENSE_FILES = LICENSE.txt edl-v10 epl-v10
+PYTHON_PAHO_MQTT_VERSION = 1.6.1
+PYTHON_PAHO_MQTT_SITE = $(call github,eclipse,paho.mqtt.python,v$(PYTHON_PAHO_MQTT_VERSION))
+PYTHON_PAHO_MQTT_LICENSE = EPL-2.0 or EDLv1.0
+PYTHON_PAHO_MQTT_LICENSE_FILES = LICENSE.txt epl-v20 edl-v10
 PYTHON_PAHO_MQTT_SETUP_TYPE = setuptools
 
 $(eval $(python-package))
-- 
2.25.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [Buildroot] [PATCH 2/2] package/libzlib: backport security fix for CVE-2022-37434
  2022-08-29 17:14 [Buildroot] [PATCH 1/2] package/libzlib: fix CPE vendor id Marcus Hoffmann
  2022-08-29 17:14 ` [Buildroot] [next v2 1/2] package/python-paho-mqtt: bump to 1.6.1 Marcus Hoffmann
@ 2022-08-29 17:14 ` Marcus Hoffmann
  2022-09-18  7:43   ` Peter Korsgaard
  2022-08-30 21:29 ` [Buildroot] [PATCH 1/2] package/libzlib: fix CPE vendor id Arnout Vandecappelle
  2 siblings, 1 reply; 6+ messages in thread
From: Marcus Hoffmann @ 2022-08-29 17:14 UTC (permalink / raw)
  To: buildroot; +Cc: Davide Viti, Asaf Kahlon

See: https://security-tracker.debian.org/tracker/CVE-2022-37434
Signed-off-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>
---
 package/libzlib/0002-fix-CVE-2022-37434.patch | 35 +++++++++++++++++++
 .../0003-fix-CVE-2022-37434-regression.patch  | 32 +++++++++++++++++
 package/libzlib/libzlib.mk                    |  3 ++
 3 files changed, 70 insertions(+)
 create mode 100644 package/libzlib/0002-fix-CVE-2022-37434.patch
 create mode 100644 package/libzlib/0003-fix-CVE-2022-37434-regression.patch

diff --git a/package/libzlib/0002-fix-CVE-2022-37434.patch b/package/libzlib/0002-fix-CVE-2022-37434.patch
new file mode 100644
index 0000000000..a61be48536
--- /dev/null
+++ b/package/libzlib/0002-fix-CVE-2022-37434.patch
@@ -0,0 +1,35 @@
+From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001
+From: Mark Adler <fork@madler.net>
+Date: Sat, 30 Jul 2022 15:51:11 -0700
+Subject: [PATCH] Fix a bug when getting a gzip header extra field with
+ inflate().
+
+If the extra field was larger than the space the user provided with
+inflateGetHeader(), and if multiple calls of inflate() delivered
+the extra header data, then there could be a buffer overflow of the
+provided space. This commit assures that provided space is not
+exceeded.
+
+Backported from: eff308af425b67093bab25f80f1ae950166bece1
+Signed-off-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>
+---
+ inflate.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/inflate.c b/inflate.c
+index 7be8c6366..7a7289749 100644
+--- a/inflate.c
++++ b/inflate.c
+@@ -763,9 +763,10 @@ int flush;
+                 copy = state->length;
+                 if (copy > have) copy = have;
+                 if (copy) {
++                    len = state->head->extra_len - state->length;
+                     if (state->head != Z_NULL &&
+-                        state->head->extra != Z_NULL) {
+-                        len = state->head->extra_len - state->length;
++                        state->head->extra != Z_NULL &&
++                        len < state->head->extra_max) {
+                         zmemcpy(state->head->extra + len, next,
+                                 len + copy > state->head->extra_max ?
+                                 state->head->extra_max - len : copy);
diff --git a/package/libzlib/0003-fix-CVE-2022-37434-regression.patch b/package/libzlib/0003-fix-CVE-2022-37434-regression.patch
new file mode 100644
index 0000000000..46a58710d2
--- /dev/null
+++ b/package/libzlib/0003-fix-CVE-2022-37434-regression.patch
@@ -0,0 +1,32 @@
+From 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d Mon Sep 17 00:00:00 2001
+From: Mark Adler <fork@madler.net>
+Date: Mon, 8 Aug 2022 10:50:09 -0700
+Subject: [PATCH] Fix extra field processing bug that dereferences NULL
+ state->head.
+
+The recent commit to fix a gzip header extra field processing bug
+introduced the new bug fixed here.
+
+Backported from: 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d
+Signed-off-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>
+---
+ inflate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/inflate.c b/inflate.c
+index 7a7289749..2a3c4fe98 100644
+--- a/inflate.c
++++ b/inflate.c
+@@ -763,10 +763,10 @@ int flush;
+                 copy = state->length;
+                 if (copy > have) copy = have;
+                 if (copy) {
+-                    len = state->head->extra_len - state->length;
+                     if (state->head != Z_NULL &&
+                         state->head->extra != Z_NULL &&
+-                        len < state->head->extra_max) {
++                        (len = state->head->extra_len - state->length) <
++                            state->head->extra_max) {
+                         zmemcpy(state->head->extra + len, next,
+                                 len + copy > state->head->extra_max ?
+                                 state->head->extra_max - len : copy);
diff --git a/package/libzlib/libzlib.mk b/package/libzlib/libzlib.mk
index 431c48739a..f75502326b 100644
--- a/package/libzlib/libzlib.mk
+++ b/package/libzlib/libzlib.mk
@@ -14,6 +14,9 @@ LIBZLIB_PROVIDES = zlib
 LIBZLIB_CPE_ID_VENDOR = zlib
 LIBZLIB_CPE_ID_PRODUCT = zlib
 
+# 0002-fix-CVE-2022-37434.patch
+LIBZLIB_IGNORE_CVES = CVE-2022-37434
+
 # It is not possible to build only a shared version of zlib, so we build both
 # shared and static, unless we only want the static libs, and we eventually
 # selectively remove what we do not want
-- 
2.25.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/libzlib: fix CPE vendor id
  2022-08-29 17:14 [Buildroot] [PATCH 1/2] package/libzlib: fix CPE vendor id Marcus Hoffmann
  2022-08-29 17:14 ` [Buildroot] [next v2 1/2] package/python-paho-mqtt: bump to 1.6.1 Marcus Hoffmann
  2022-08-29 17:14 ` [Buildroot] [PATCH 2/2] package/libzlib: backport security fix for CVE-2022-37434 Marcus Hoffmann
@ 2022-08-30 21:29 ` Arnout Vandecappelle
  2 siblings, 0 replies; 6+ messages in thread
From: Arnout Vandecappelle @ 2022-08-30 21:29 UTC (permalink / raw)
  To: Marcus Hoffmann, buildroot; +Cc: Davide Viti, Asaf Kahlon



On 29/08/2022 19:14, Marcus Hoffmann wrote:
> Can be found in this CVE entry for example:
> https://nvd.nist.gov/vuln/detail/CVE-2022-37434
> 
> Signed-off-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>

  Applied both to master, thanks.

  I extended the commit message with the URLs into the CPE database search for 
the right and the wrong vendor.

  Regards,
  Arnout

> ---
>   package/libzlib/libzlib.mk | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/package/libzlib/libzlib.mk b/package/libzlib/libzlib.mk
> index 933732d6ba..431c48739a 100644
> --- a/package/libzlib/libzlib.mk
> +++ b/package/libzlib/libzlib.mk
> @@ -11,7 +11,7 @@ LIBZLIB_LICENSE = Zlib
>   LIBZLIB_LICENSE_FILES = README
>   LIBZLIB_INSTALL_STAGING = YES
>   LIBZLIB_PROVIDES = zlib
> -LIBZLIB_CPE_ID_VENDOR = gnu
> +LIBZLIB_CPE_ID_VENDOR = zlib
>   LIBZLIB_CPE_ID_PRODUCT = zlib
>   
>   # It is not possible to build only a shared version of zlib, so we build both
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [Buildroot] [next v2 1/2] package/python-paho-mqtt: bump to 1.6.1
  2022-08-29 17:14 ` [Buildroot] [next v2 1/2] package/python-paho-mqtt: bump to 1.6.1 Marcus Hoffmann
@ 2022-08-31 20:24   ` Yann E. MORIN
  0 siblings, 0 replies; 6+ messages in thread
From: Yann E. MORIN @ 2022-08-31 20:24 UTC (permalink / raw)
  To: Marcus Hoffmann; +Cc: Davide Viti, Asaf Kahlon, buildroot

Marcus, All,

On 2022-08-29 19:14 +0200, Marcus Hoffmann spake thusly:
> We need to switch to the github download as the sdist published to pypi
> doesn't package the epl-v20 license file isn't included there:
> 
> https://github.com/eclipse/paho.mqtt.python/pull/635
> 
> License changed to EPL-2.0 or EDLv1.0

The LICENSE.txt file read *and*, not _or_, so I fixed that in the commit
log, and in the .mk [0]

> Changelog:
> https://github.com/eclipse/paho.mqtt.python/blob/master/ChangeLog.txt
> Signed-off-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>
> ---
> Changes v1 -> v2:
>   - switch to github download to have license file in source tarball
>   - update license hashes
> 
>  package/python-paho-mqtt/python-paho-mqtt.hash | 10 +++++-----
>  package/python-paho-mqtt/python-paho-mqtt.mk   |  9 ++++-----
>  2 files changed, 9 insertions(+), 10 deletions(-)
> 
> diff --git a/package/python-paho-mqtt/python-paho-mqtt.hash b/package/python-paho-mqtt/python-paho-mqtt.hash
> index bf3993e919..dbf9ee89f6 100644
> --- a/package/python-paho-mqtt/python-paho-mqtt.hash
> +++ b/package/python-paho-mqtt/python-paho-mqtt.hash
> @@ -1,6 +1,6 @@
> -# md5 from https://pypi.python.org/pypi/paho-mqtt/json, sha256 locally computed
> -md5  e3ac29cd5dc247a01083a2a8f3fddd08  paho-mqtt-1.4.0.tar.gz
> -sha256  e440a052b46d222e184be3be38676378722072fcd4dfd2c8f509fb861a7b0b79  paho-mqtt-1.4.0.tar.gz
> -sha256  76f13729e84e9222e543303df00f87d1b2c0995b6a505cd859a285667e44babb  LICENSE.txt
> +# locally computed
> +md5  00c3381d7deacc7ac8b220f3b9d689c6  python-paho-mqtt-1.6.1.tar.gz

md5 is weak, we only keep one when supplied by upstream, but we do not
add locally computed ones [1], so I dropped it.

[1] https://nightly.buildroot.org/manual.html#adding-packages-hash

> +sha256	6e35c1be242a901fc9c00bad7d37b5cc4a497f398dfceb4ed0d8018a959be650  python-paho-mqtt-1.6.1.tar.gz
> +sha256	66408b049249c3bdb0ba1ed285f5422ce67e371d40151bebd4d806af454ffe7c  LICENSE.txt

Fields are supposed to be separated by two spaces, not a TAB (though
that is supported for historical reasons).

>  sha256  e8cf7d54ea46c19aba793983889b7f7425e1ebfcaaccec764a7db091646e203c  edl-v10
> -sha256  3b9be6b894d0769de796e653571ff6cef494913c0ce78c35a97db939e7d9087c  epl-v10
> +sha256	8c349f80764d0648e645f41ef23772a70c995a0924b5235f735f4a3d09df127c  epl-v20
> diff --git a/package/python-paho-mqtt/python-paho-mqtt.mk b/package/python-paho-mqtt/python-paho-mqtt.mk
> index d192749e1e..3ff5f9e57a 100644
> --- a/package/python-paho-mqtt/python-paho-mqtt.mk
> +++ b/package/python-paho-mqtt/python-paho-mqtt.mk
> @@ -4,11 +4,10 @@
>  #
>  ################################################################################
>  
> -PYTHON_PAHO_MQTT_VERSION = 1.4.0
> -PYTHON_PAHO_MQTT_SOURCE = paho-mqtt-$(PYTHON_PAHO_MQTT_VERSION).tar.gz
> -PYTHON_PAHO_MQTT_SITE = https://files.pythonhosted.org/packages/25/63/db25e62979c2a716a74950c9ed658dce431b5cb01fde29eb6cba9489a904
> -PYTHON_PAHO_MQTT_LICENSE = EPL-1.0 or EDLv1.0
> -PYTHON_PAHO_MQTT_LICENSE_FILES = LICENSE.txt edl-v10 epl-v10
> +PYTHON_PAHO_MQTT_VERSION = 1.6.1
> +PYTHON_PAHO_MQTT_SITE = $(call github,eclipse,paho.mqtt.python,v$(PYTHON_PAHO_MQTT_VERSION))
> +PYTHON_PAHO_MQTT_LICENSE = EPL-2.0 or EDLv1.0

[0] here, I changed to: EPL-2.0, EDLv1.0

Applied to next with the above fixes, thanks.

Regards,
Yann E. MORIN.

> +PYTHON_PAHO_MQTT_LICENSE_FILES = LICENSE.txt epl-v20 edl-v10
>  PYTHON_PAHO_MQTT_SETUP_TYPE = setuptools
>  
>  $(eval $(python-package))
> -- 
> 2.25.1
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [Buildroot] [PATCH 2/2] package/libzlib: backport security fix for CVE-2022-37434
  2022-08-29 17:14 ` [Buildroot] [PATCH 2/2] package/libzlib: backport security fix for CVE-2022-37434 Marcus Hoffmann
@ 2022-09-18  7:43   ` Peter Korsgaard
  0 siblings, 0 replies; 6+ messages in thread
From: Peter Korsgaard @ 2022-09-18  7:43 UTC (permalink / raw)
  To: Marcus Hoffmann; +Cc: Davide Viti, Asaf Kahlon, buildroot

>>>>> "Marcus" == Marcus Hoffmann <marcus.hoffmann@othermo.de> writes:

 > See: https://security-tracker.debian.org/tracker/CVE-2022-37434
 > Signed-off-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>

Committed to 2022.05.x and 2022.02.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-09-18  7:44 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-08-29 17:14 [Buildroot] [PATCH 1/2] package/libzlib: fix CPE vendor id Marcus Hoffmann
2022-08-29 17:14 ` [Buildroot] [next v2 1/2] package/python-paho-mqtt: bump to 1.6.1 Marcus Hoffmann
2022-08-31 20:24   ` Yann E. MORIN
2022-08-29 17:14 ` [Buildroot] [PATCH 2/2] package/libzlib: backport security fix for CVE-2022-37434 Marcus Hoffmann
2022-09-18  7:43   ` Peter Korsgaard
2022-08-30 21:29 ` [Buildroot] [PATCH 1/2] package/libzlib: fix CPE vendor id Arnout Vandecappelle

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.