From: Peter Korsgaard <peter@korsgaard.com>
To: Julien Olivain <ju.o@free.fr>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH] package/libgcrypt: bump version to 1.2.3
Date: Tue, 01 Sep 2026 23:11:58 +0200 [thread overview]
Message-ID: <87y0dkwuap.fsf@dell.be.48ers.dk> (raw)
In-Reply-To: <ec4ac307d4302d02182457be822cfb6c@free.fr> (Julien Olivain's message of "Tue, 01 Sep 2026 22:48:12 +0200")
>>>>> "Julien" == Julien Olivain <ju.o@free.fr> writes:
> Hi Peter,
> The commit title says "1.2.3" but should rather be "1.12.3".
Ups, indeed ;)
> On 01/09/2026 21:27, Peter Korsgaard wrote:
>> Release notes:
>> https://lists.gnu.org/archive/html/info-gnu/2026-08/msg00007.html
>> Contains a number of bugfixes, some of which may have (low severity)
>> security impact. As stated by Werner Koch:
>> All in all we received 26 reports alone from ANSSI but as even the
>> reporter
>> mentioned, the real world attack severity is not critical. Thus we
>> don't
>> consider 1.12.3 a security fix release. There are some bugs which
>> should
>> be fixed to avoid crashes, and thus may lead to DoS. However,
>> 16384 bit
>> RSA keys can also be used for a practical DoS; it all depends on
>> your use
>> case.
>> https://www.openwall.com/lists/oss-security/2026/08/31/11
>> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
>> ---
> [...]
>> diff --git a/package/libgcrypt/libgcrypt.mk
>> b/package/libgcrypt/libgcrypt.mk
>> index 0bc281da42..a49897fd4f 100644
>> --- a/package/libgcrypt/libgcrypt.mk
>> +++ b/package/libgcrypt/libgcrypt.mk
>> @@ -4,7 +4,7 @@
>> #
>> ################################################################################
>> -LIBGCRYPT_VERSION = 1.12.2
>> +LIBGCRYPT_VERSION = 1.12.3
> Also, this new version introduces build failures:
> https://gitlab.com/jolivain/buildroot/-/pipelines/2810830147
> For reference, the previous version 1.12.2 passes test-pkg:
> https://gitlab.com/jolivain/buildroot/-/pipelines/2810888453
> Since those fixes are described as low severity, we should probably
> fix those before merging this bump.
Yes, I will take a look - Thanks.
--
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
prev parent reply other threads:[~2026-09-01 21:12 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-01 19:27 [Buildroot] [PATCH] package/libgcrypt: bump version to 1.2.3 Peter Korsgaard
2026-09-01 20:48 ` Julien Olivain via buildroot
2026-09-01 21:11 ` Peter Korsgaard [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87y0dkwuap.fsf@dell.be.48ers.dk \
--to=peter@korsgaard.com \
--cc=buildroot@buildroot.org \
--cc=ju.o@free.fr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.