From mboxrd@z Thu Jan 1 00:00:00 1970 From: Fabrice Fontaine Date: Sat, 17 Aug 2019 21:36:27 +0200 Subject: [Buildroot] [PATCH/next 1/1] package/lxc: security bump to version 3.2.1 In-Reply-To: <20190817154123.377b3d77@windsurf.home> References: <20190816170315.8763-1-fontaine.fabrice@gmail.com> <20190817154123.377b3d77@windsurf.home> Message-ID: List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: buildroot@busybox.net Hello Thomas, Le sam. 17 ao?t 2019 ? 15:41, Thomas Petazzoni a ?crit : > > On Fri, 16 Aug 2019 19:03:15 +0200 > Fabrice Fontaine wrote: > > > - lxc switched from gnutls to openssl since version 3.2.0 and > > https://github.com/lxc/lxc/commit/fa2bb6ba532c5e7f92df8cbae50a68af519f9997 > > - lxc needs a glibc or musl toolchain since version 3.2.0 and > > https://github.com/lxc/lxc/commit/6400238d08cdf1ca20d49bafb85f4e224348bf9d > > - This version includes a security fix (named CVE-2019-5736 on runC): > > https://github.com/lxc/lxc/commit/6400238d08cdf1ca20d49bafb85f4e224348bf9d > > > > Signed-off-by: Fabrice Fontaine > > We normally apply security bumps to master. But this one seems like a > quite major bump, and it also disables the package for uClibc. Yes I know that's why I marked it for next. > > Does it make sense to backport just the security fix in master ? I could but this fix will add the glibc or musl toolchain dependency. > > Thomas > -- > Thomas Petazzoni, CTO, Bootlin > Embedded Linux and Kernel engineering > https://bootlin.com Best Regards, Fabrice