All of lore.kernel.org
 help / color / mirror / Atom feed
From: Steve Sakoman <steve@sakoman.com>
To: jhofstee@victronenergy.com
Cc: ross@burtonini.com, openembedded-core@lists.openembedded.org
Subject: Re: [OE-core] [PATCH][dunfell] zlib: backport the fix for CVE-2018-25032
Date: Sat, 9 Apr 2022 08:14:45 -1000	[thread overview]
Message-ID: <CAOSpxda2R7S=qJ73nHVr-rA78=6KPG0Y_0ysCQczgYjZAZ=gFA@mail.gmail.com> (raw)
In-Reply-To: <f4e17d13-71cc-b25b-9a56-207ca89c76cd@victronenergy.com>

On Tue, Apr 5, 2022 at 9:05 AM Jeroen Hofstee via
lists.openembedded.org
<jhofstee=victronenergy.com@lists.openembedded.org> wrote:
>
> Hello Ross,
>
> On 3/29/22 15:07, Ross Burton via lists.openembedded.org wrote:
> > Signed-off-by: Ross Burton <ross.burton@arm.com>
> > ---
> >   .../zlib/zlib/CVE-2018-25032.patch            | 347 ++++++++++++++++++
> >   meta/recipes-core/zlib/zlib_1.2.11.bb         |   1 +
> >   2 files changed, 348 insertions(+)
> >   create mode 100644 meta/recipes-core/zlib/zlib/CVE-2018-25032.patch
> >
> > diff --git a/meta/recipes-core/zlib/zlib/CVE-2018-25032.patch b/meta/recipes-core/zlib/zlib/CVE-2018-25032.patch
> > new file mode 100644
> > index 00000000000..5cb61836419
> > --- /dev/null
> > +++ b/meta/recipes-core/zlib/zlib/CVE-2018-25032.patch
> > @@ -0,0 +1,347 @@
> > +CVE: CVE-2018-25032
> > +Upstream-Status: Backport
> > +Signed-off-by: Ross Burton <ross.burton@arm.com>
> > +
> >
> It seems there _might_ be another patch needed.
>
> https://github.com/madler/zlib/issues/605
> https://github.com/madler/zlib/commit/4346a16853e19b45787ce933666026903fb8f3f8.patch

I did a dunfell autobuilder run with the second patch added, but
unfortunately still get the same failures.

So until we fix those I can't take this CVE patch :-(

Steve

> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#164052): https://lists.openembedded.org/g/openembedded-core/message/164052
> Mute This Topic: https://lists.openembedded.org/mt/90107518/3620601
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [steve@sakoman.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>


  reply	other threads:[~2022-04-11 17:18 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-03-29 13:07 [PATCH][dunfell] zlib: backport the fix for CVE-2018-25032 Ross Burton
2022-03-29 19:49 ` [OE-core] " Steve Sakoman
2022-03-30 20:40   ` Ross Burton
2022-03-30 22:57     ` Steve Sakoman
2022-04-04 15:22       ` Steve Sakoman
2022-04-11 17:31         ` Ralph Siemsen
2022-04-11 17:52           ` Steve Sakoman
2022-04-11 18:17             ` Ralph Siemsen
2022-04-11 18:58               ` Steve Sakoman
2022-04-11 22:30                 ` Ralph Siemsen
2022-04-11 22:42                   ` Steve Sakoman
2022-04-12  1:33                     ` Ralph Siemsen
2022-04-12  2:12                       ` Steve Sakoman
2022-04-12 16:07                         ` Ralph Siemsen
2022-04-12 21:49                           ` Steve Sakoman
2022-04-13  1:21                             ` Ralph Siemsen
2022-04-13 15:31                               ` Steve Sakoman
     [not found]                               ` <16E57E79FD292EFA.13992@lists.openembedded.org>
2022-04-13 16:02                                 ` Steve Sakoman
2022-04-13 16:41                                   ` Mike Crowe
2022-04-13 17:37                                     ` Steve Sakoman
2022-04-13 17:50                                       ` Jose Quaresma
2022-04-13 19:16                                       ` Steve Sakoman
2022-04-13 18:02                                     ` Ralph Siemsen
2022-04-13 18:19                                       ` Steve Sakoman
2022-04-13 19:05                                         ` Ralph Siemsen
2022-04-13 21:39                                           ` Steve Sakoman
2022-04-13 21:41                                             ` Richard Purdie
2022-04-13 21:44                                               ` Steve Sakoman
2022-04-14  2:47                                                 ` Ralph Siemsen
2022-04-14  3:00                                                   ` Steve Sakoman
     [not found]                                                   ` <16E5A41A6E4FF34A.8845@lists.openembedded.org>
2022-04-14  3:02                                                     ` Steve Sakoman
2022-04-14  3:03                                                       ` Steve Sakoman
2022-04-13 17:11                                   ` Jose Quaresma
     [not found]                                   ` <16E583EB139C493B.16998@lists.openembedded.org>
2022-04-13 17:41                                     ` Jose Quaresma
2022-03-31  0:24     ` Mittal, Anuj
2022-04-05 19:04 ` Jeroen Hofstee
2022-04-09 18:14   ` Steve Sakoman [this message]
2022-04-10 21:21     ` Jeroen Hofstee

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAOSpxda2R7S=qJ73nHVr-rA78=6KPG0Y_0ysCQczgYjZAZ=gFA@mail.gmail.com' \
    --to=steve@sakoman.com \
    --cc=jhofstee@victronenergy.com \
    --cc=openembedded-core@lists.openembedded.org \
    --cc=ross@burtonini.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.