Re: [Buildroot] [PATCH 1/1] package/xz: add security patches fixing CVE-2025-31115

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Julien" == Julien Olivain <ju.o@free.fr> writes:

 > This commit adds four upstream patches fixing the CVE-2025-31115
 > vulnerability. The reason there is four patches instead of one is to
 > exactly follow the advisory recommendation [1], which proposes the
 > patch [2]. This patch is in fact a concatenation of four commits. In
 > Buildroot, we track package patches as formatted by git, with extra
 > "Upstream:" headers. The patch [2] was split here in four for a
 > clearer traceability.

 > With the addition of those patches, the XZ_IGNORE_CVES is set
 > accordingly.

 > Fixes:
 > https://www.cve.org/CVERecord?id=CVE-2025-31115

 > [1] https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2
 > [2] https://tukaani.org/xz/xz-cve-2025-31115.patch

 > Signed-off-by: Julien Olivain <ju.o@free.fr>
 > ---
 > Patch tested in:
 > https://gitlab.com/jolivain/buildroot/-/jobs/9989403875

 > Note: I am aware that another security bump was proposed in:
 > https://patchwork.ozlabs.org/project/buildroot/patch/20250501092633.84651-1-kadambini.nema@gmail.com/
 > This proposal is including both the major version bump (from 5.6.4 to
 > 5.8.1) and the CVE-2025-31115 security fix. This makes LTS branch
 > maintenance harder.

 > I propose this patch instead to help the LTS branches. The 5.8.1
 > bump can be applied right after.

Agreed. Committed, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot