[Buildroot] [PATCH] package/libsoup3: security bump to version 3.6.1

[Buildroot] [PATCH] package/libsoup3: security bump to version 3.6.1

[Peter Korsgaard]

Fixes the following security vulnerabilities:

CVE-2024-52531: GNOME libsoup before 3.6.1 allows a buffer overflow in
applications that perform conversion to UTF-8 in
soup_header_parse_param_list_strict.  Input received over the network cannot
trigger this.

https://www.cve.org/CVERecord?id=CVE-2024-52531

CVE-2024-52532: GNOME libsoup before 3.6.1 has an infinite loop, and memory
consumption.  during the reading of certain patterns of WebSocket data from
clients.

https://www.cve.org/CVERecord?id=CVE-2024-52532

Changelog: https://gitlab.gnome.org/GNOME/libsoup/-/blob/3.6.1/NEWS

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/libsoup3/libsoup3.hash | 4 ++--
 package/libsoup3/libsoup3.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/libsoup3/libsoup3.hash b/package/libsoup3/libsoup3.hash
index 37ecd2db84..23af347903 100644
--- a/package/libsoup3/libsoup3.hash
+++ b/package/libsoup3/libsoup3.hash
@@ -1,4 +1,4 @@
-# From https://download.gnome.org/sources/libsoup/3.6/libsoup-3.6.0.sha256sum
-sha256  62959f791e8e8442f8c13cedac8c4919d78f9120d5bb5301be67a5e53318b4a3  libsoup-3.6.0.tar.xz
+# From https://download.gnome.org/sources/libsoup/3.6/libsoup-3.6.1.sha256sum
+sha256  ceb1f1aa2bdd73b2cd8159d3998c96c55ef097ef15e4b4f36029209fa18af838  libsoup-3.6.1.tar.xz
 # Locally calculated
 sha256  b7993225104d90ddd8024fd838faf300bea5e83d91203eab98e29512acebd69c  COPYING
diff --git a/package/libsoup3/libsoup3.mk b/package/libsoup3/libsoup3.mk
index f8a7e26159..f2f96c2def 100644
--- a/package/libsoup3/libsoup3.mk
+++ b/package/libsoup3/libsoup3.mk
@@ -5,7 +5,7 @@
 ################################################################################
 
 LIBSOUP3_VERSION_MAJOR = 3.6
-LIBSOUP3_VERSION = $(LIBSOUP3_VERSION_MAJOR).0
+LIBSOUP3_VERSION = $(LIBSOUP3_VERSION_MAJOR).1
 LIBSOUP3_SOURCE = libsoup-$(LIBSOUP3_VERSION).tar.xz
 LIBSOUP3_SITE = https://download.gnome.org/sources/libsoup/$(LIBSOUP3_VERSION_MAJOR)
 LIBSOUP3_LICENSE = LGPL-2.0+
-- 
2.39.5

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libsoup3: security bump to version 3.6.1

[Julien Olivain]

On 15/12/2024 11:07, Peter Korsgaard wrote:
> Fixes the following security vulnerabilities:
> 
> CVE-2024-52531: GNOME libsoup before 3.6.1 allows a buffer overflow in
> applications that perform conversion to UTF-8 in
> soup_header_parse_param_list_strict.  Input received over the network 
> cannot
> trigger this.
> 
> https://www.cve.org/CVERecord?id=CVE-2024-52531
> 
> CVE-2024-52532: GNOME libsoup before 3.6.1 has an infinite loop, and 
> memory
> consumption.  during the reading of certain patterns of WebSocket data 
> from
> clients.
> 
> https://www.cve.org/CVERecord?id=CVE-2024-52532
> 
> Changelog: https://gitlab.gnome.org/GNOME/libsoup/-/blob/3.6.1/NEWS
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Applied to master, thanks.

> ---
>  package/libsoup3/libsoup3.hash | 4 ++--
>  package/libsoup3/libsoup3.mk   | 2 +-
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/package/libsoup3/libsoup3.hash 
> b/package/libsoup3/libsoup3.hash
> index 37ecd2db84..23af347903 100644
> --- a/package/libsoup3/libsoup3.hash
> +++ b/package/libsoup3/libsoup3.hash
> @@ -1,4 +1,4 @@
> -# From 
> https://download.gnome.org/sources/libsoup/3.6/libsoup-3.6.0.sha256sum
> -sha256  
> 62959f791e8e8442f8c13cedac8c4919d78f9120d5bb5301be67a5e53318b4a3  
> libsoup-3.6.0.tar.xz
> +# From 
> https://download.gnome.org/sources/libsoup/3.6/libsoup-3.6.1.sha256sum
> +sha256  
> ceb1f1aa2bdd73b2cd8159d3998c96c55ef097ef15e4b4f36029209fa18af838  
> libsoup-3.6.1.tar.xz
>  # Locally calculated
>  sha256  
> b7993225104d90ddd8024fd838faf300bea5e83d91203eab98e29512acebd69c  
> COPYING
> diff --git a/package/libsoup3/libsoup3.mk 
> b/package/libsoup3/libsoup3.mk
> index f8a7e26159..f2f96c2def 100644
> --- a/package/libsoup3/libsoup3.mk
> +++ b/package/libsoup3/libsoup3.mk
> @@ -5,7 +5,7 @@
>  
> ################################################################################
> 
>  LIBSOUP3_VERSION_MAJOR = 3.6
> -LIBSOUP3_VERSION = $(LIBSOUP3_VERSION_MAJOR).0
> +LIBSOUP3_VERSION = $(LIBSOUP3_VERSION_MAJOR).1
>  LIBSOUP3_SOURCE = libsoup-$(LIBSOUP3_VERSION).tar.xz
>  LIBSOUP3_SITE = 
> https://download.gnome.org/sources/libsoup/$(LIBSOUP3_VERSION_MAJOR)
>  LIBSOUP3_LICENSE = LGPL-2.0+
> --
> 2.39.5
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libsoup3: security bump to version 3.6.1

[Peter Korsgaard]

On 12/15/24 11:07, Peter Korsgaard wrote:
> Fixes the following security vulnerabilities:
> 
> CVE-2024-52531: GNOME libsoup before 3.6.1 allows a buffer overflow in
> applications that perform conversion to UTF-8 in
> soup_header_parse_param_list_strict.  Input received over the network cannot
> trigger this.
> 
> https://www.cve.org/CVERecord?id=CVE-2024-52531
> 
> CVE-2024-52532: GNOME libsoup before 3.6.1 has an infinite loop, and memory
> consumption.  during the reading of certain patterns of WebSocket data from
> clients.
> 
> https://www.cve.org/CVERecord?id=CVE-2024-52532
> 
> Changelog: https://gitlab.gnome.org/GNOME/libsoup/-/blob/3.6.1/NEWS
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed to 2024.02.x and 2024.11.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot