From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 808DEC433F5 for ; Wed, 29 Sep 2021 18:09:00 +0000 (UTC) Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 8E2BF61529 for ; Wed, 29 Sep 2021 18:08:59 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 8E2BF61529 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=korsgaard.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=buildroot.org Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 394F960EAA; Wed, 29 Sep 2021 18:08:59 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QBagmPrIUYBT; Wed, 29 Sep 2021 18:08:58 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by smtp3.osuosl.org (Postfix) with ESMTP id 94D8E60762; Wed, 29 Sep 2021 18:08:57 +0000 (UTC) Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by ash.osuosl.org (Postfix) with ESMTP id D89801BF842 for ; Wed, 29 Sep 2021 18:08:55 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id C81F140319 for ; Wed, 29 Sep 2021 18:08:55 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qDQzCmF-xDx6 for ; Wed, 29 Sep 2021 18:08:54 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.8.0 Received: from relay3-d.mail.gandi.net (relay3-d.mail.gandi.net [217.70.183.195]) by smtp4.osuosl.org (Postfix) with ESMTPS id 77A4340310 for ; Wed, 29 Sep 2021 18:08:54 +0000 (UTC) Received: (Authenticated sender: peter@casa-korsgaard.com) by relay3-d.mail.gandi.net (Postfix) with ESMTPSA id 1317960004 for ; Wed, 29 Sep 2021 18:08:50 +0000 (UTC) Received: from peko by dell.be.48ers.dk with local (Exim 4.92) (envelope-from ) id 1mVe0g-0003pZ-CN for buildroot@buildroot.org; Wed, 29 Sep 2021 20:08:50 +0200 From: Peter Korsgaard To: buildroot@buildroot.org References: <20210918164248.20023-1-peter@korsgaard.com> Date: Wed, 29 Sep 2021 20:08:50 +0200 In-Reply-To: <20210918164248.20023-1-peter@korsgaard.com> (Peter Korsgaard's message of "Sat, 18 Sep 2021 18:42:46 +0200") Message-ID: <87o88bmez1.fsf@dell.be.48ers.dk> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Subject: Re: [Buildroot] [PATCH] package/botan: add upstream security fix for CVE-2021-40529 X-BeenThere: buildroot@buildroot.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: buildroot-bounces@buildroot.org Sender: "buildroot" >>>>> "Peter" == Peter Korsgaard writes: > Fixes the following security issue: > - CVE-2021-40529: The ElGamal implementation in Botan through 2.18.1, as > used in Thunderbird and other products, allows plaintext recovery because, > during interaction between two cryptographic libraries, a certain > dangerous combination of the prime defined by the receiver's public key, > the generator defined by the receiver's public key, and the sender's > ephemeral exponents can lead to a cross-configuration attack against > OpenPGP > For more details, see the upstream bug and issue writeup: > - https://github.com/randombit/botan/pull/2790 > - https://ibm.github.io/system-security-research-updates/2021/07/20/insecurity-elgamal-pt1 > Signed-off-by: Peter Korsgaard Committed to 2021.02.x, 2021.05.x and 2021.08.x, thanks. -- Bye, Peter Korsgaard _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot