From: Arnout Vandecappelle <arnout@mind.be>
To: Peter Korsgaard <peter@korsgaard.com>, buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH] package/gzip: security bump to version 1.12
Date: Tue, 19 Apr 2022 22:32:50 +0200 [thread overview]
Message-ID: <711e2b71-6bdf-c6c5-8659-a78dc569b3ef@mind.be> (raw)
In-Reply-To: <20220419112544.993456-1-peter@korsgaard.com>
On 19/04/2022 13:25, Peter Korsgaard wrote:
> Fixes the following security issues:
>
> - CVE-2022-1271: An arbitrary file write vulnerability was found in GNU
> gzip's zgrep utility. When zgrep is applied on the attacker's chosen file
> name (for example, a crafted file name), this can overwrite an attacker's
> content to an arbitrary attacker-selected file. This flaw occurs due to
> insufficient validation when processing filenames with two or more
> newlines where selected content and the target file names are embedded in
> crafted multi-line file names. This flaw allows a remote, low privileged
> attacker to force zgrep to write arbitrary files on the system.
>
> https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
I applied the patch that Marcus sent 8 minutes earlier instad.
Regards,
Arnout
> ---
> package/gzip/gzip.hash | 4 ++--
> package/gzip/gzip.mk | 2 +-
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/package/gzip/gzip.hash b/package/gzip/gzip.hash
> index 1cf73ff912..80b86f4797 100644
> --- a/package/gzip/gzip.hash
> +++ b/package/gzip/gzip.hash
> @@ -1,6 +1,6 @@
> # Locally calculated after checking pgp signature
> -# https://ftp.gnu.org/gnu/gzip/gzip-1.11.tar.xz.sig
> +# https://ftp.gnu.org/gnu/gzip/gzip-1.12.tar.xz.sig
> # using key 155D3FC500C834486D1EEA677FD9FCCB000BEEEE
> -sha256 9b9a95d68fdcb936849a4d6fada8bf8686cddf58b9b26c9c4289ed0c92a77907 gzip-1.11.tar.xz
> +sha256 ce5e03e519f637e1f814011ace35c4f87b33c0bbabeec35baf5fbd3479e91956 gzip-1.12.tar.xz
> # Locally calculated
> sha256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903 COPYING
> diff --git a/package/gzip/gzip.mk b/package/gzip/gzip.mk
> index 92588fcdb8..2092df363c 100644
> --- a/package/gzip/gzip.mk
> +++ b/package/gzip/gzip.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -GZIP_VERSION = 1.11
> +GZIP_VERSION = 1.12
> GZIP_SOURCE = gzip-$(GZIP_VERSION).tar.xz
> GZIP_SITE = $(BR2_GNU_MIRROR)/gzip
> # Some other tools expect it to be in /bin
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
prev parent reply other threads:[~2022-04-19 20:32 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-19 11:25 [Buildroot] [PATCH] package/gzip: security bump to version 1.12 Peter Korsgaard
2022-04-19 20:32 ` Arnout Vandecappelle [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=711e2b71-6bdf-c6c5-8659-a78dc569b3ef@mind.be \
--to=arnout@mind.be \
--cc=buildroot@buildroot.org \
--cc=peter@korsgaard.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.