[Buildroot] [PATCH 1/1] package/capnproto: security bump to version 0.9.2

[Buildroot] [PATCH 1/1] package/capnproto: security bump to version 0.9.2

[Fabrice Fontaine]

Fix CVE-2022-46149: Cap'n Proto is a data interchange format and remote
procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1,
0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust
implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to
out-of-bounds read due to logic error handling list-of-list. This issue
may lead someone to remotely segfault a peer by sending it a malicious
message, if the victim performs certain actions on a list-of-pointer
type. Exfiltration of memory is possible if the victim performs
additional certain actions on a list-of-pointer type. To be vulnerable,
an application must perform a specific sequence of actions, described in
the GitHub Security Advisory. The bug is present in inlined code,
therefore the fix will require rebuilding dependent applications. Cap'n
Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and
0.10.3.

https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx
https://dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
 package/capnproto/capnproto.hash | 2 +-
 package/capnproto/capnproto.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/capnproto/capnproto.hash b/package/capnproto/capnproto.hash
index 7fd0e6158b..c3233e7c8b 100644
--- a/package/capnproto/capnproto.hash
+++ b/package/capnproto/capnproto.hash
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  daf49f794560f715e2f4651c842aaece2d065d4216834c5c3d3254962e35b535  capnproto-0.9.1.tar.gz
+sha256  4fe1ca8ab90859f33f08d2c4fcd7099e2983b0b946beecebd2fe051e3a64c67e  capnproto-0.9.2.tar.gz
 sha256  9564998c8d7f270a61a8b89869a8d17a9d5e3783b64027788b5e339ec8479e10  LICENSE
diff --git a/package/capnproto/capnproto.mk b/package/capnproto/capnproto.mk
index 7fc07043fb..23f128455a 100644
--- a/package/capnproto/capnproto.mk
+++ b/package/capnproto/capnproto.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CAPNPROTO_VERSION = 0.9.1
+CAPNPROTO_VERSION = 0.9.2
 CAPNPROTO_SITE = $(call github,capnproto,capnproto,v$(CAPNPROTO_VERSION))
 CAPNPROTO_LICENSE = MIT
 CAPNPROTO_LICENSE_FILES = LICENSE
-- 
2.35.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/capnproto: security bump to version 0.9.2

[Thomas Petazzoni via buildroot]

On Thu,  8 Dec 2022 21:21:04 +0100
Fabrice Fontaine <fontaine.fabrice@gmail.com> wrote:

> Fix CVE-2022-46149: Cap'n Proto is a data interchange format and remote
> procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1,
> 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust
> implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to
> out-of-bounds read due to logic error handling list-of-list. This issue
> may lead someone to remotely segfault a peer by sending it a malicious
> message, if the victim performs certain actions on a list-of-pointer
> type. Exfiltration of memory is possible if the victim performs
> additional certain actions on a list-of-pointer type. To be vulnerable,
> an application must perform a specific sequence of actions, described in
> the GitHub Security Advisory. The bug is present in inlined code,
> therefore the fix will require rebuilding dependent applications. Cap'n
> Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and
> 0.10.3.
> 
> https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx
> https://dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.html
> 
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> ---
>  package/capnproto/capnproto.hash | 2 +-
>  package/capnproto/capnproto.mk   | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/capnproto: security bump to version 0.9.2

[Peter Korsgaard]

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > Fix CVE-2022-46149: Cap'n Proto is a data interchange format and remote
 > procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1,
 > 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust
 > implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to
 > out-of-bounds read due to logic error handling list-of-list. This issue
 > may lead someone to remotely segfault a peer by sending it a malicious
 > message, if the victim performs certain actions on a list-of-pointer
 > type. Exfiltration of memory is possible if the victim performs
 > additional certain actions on a list-of-pointer type. To be vulnerable,
 > an application must perform a specific sequence of actions, described in
 > the GitHub Security Advisory. The bug is present in inlined code,
 > therefore the fix will require rebuilding dependent applications. Cap'n
 > Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and
 > 0.10.3.

 > https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx
 > https://dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.html

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Committed to 2022.11.x and 2022.02.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot