All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Yann E. MORIN" <yann.morin.1998@free.fr>
To: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH 1/1] package/mbedtls: security bump to version 2.28.7
Date: Sat, 27 Jan 2024 21:15:34 +0100	[thread overview]
Message-ID: <ZbVkZpQp7NuPiOsX@landeda> (raw)
In-Reply-To: <20240126222324.1790975-1-fontaine.fabrice@gmail.com>

Fabrice, All,

On 2024-01-26 23:23 +0100, Fabrice Fontaine spake thusly:
> - Fix CVE-2024-23170 and CVE-2024-23775
> - Mbed TLS is now released under a dual Apache-2.0 OR GPL-2.0-or-later
>   license. Users may choose which license they take the code under:
>   https://github.com/Mbed-TLS/mbedtls/commit/f429557c5900d3b90bd10a21b228f719e80f81a2
> 
> https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/
> https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/
> https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.6
> https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.7
> 
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Applied to master, thanks.

Regards,
Yann E. MORIN.

> ---
>  package/mbedtls/mbedtls.hash | 6 +++---
>  package/mbedtls/mbedtls.mk   | 4 ++--
>  2 files changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/package/mbedtls/mbedtls.hash b/package/mbedtls/mbedtls.hash
> index d0cd0b2105..3ec151a859 100644
> --- a/package/mbedtls/mbedtls.hash
> +++ b/package/mbedtls/mbedtls.hash
> @@ -1,4 +1,4 @@
> -# From https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.4:
> -sha256  849e86b626e42ded6bf67197b64aa771daa54e2a7e2868dc67e1e4711959e5e3  mbedtls-2.28.5.tar.gz
> +# From https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.7:
> +sha256  1df6073f0cf6a4e1953890bf5e0de2a8c7e6be50d6d6c69fa9fefcb1d14e981a  mbedtls-2.28.7.tar.gz
>  # Locally calculated
> -sha256  cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  LICENSE
> +sha256  9b405ef4c89342f5eae1dd828882f931747f71001cfba7d114801039b52ad09b  LICENSE
> diff --git a/package/mbedtls/mbedtls.mk b/package/mbedtls/mbedtls.mk
> index 1b941e04f4..cdb4aef4f4 100644
> --- a/package/mbedtls/mbedtls.mk
> +++ b/package/mbedtls/mbedtls.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -MBEDTLS_VERSION = 2.28.5
> +MBEDTLS_VERSION = 2.28.7
>  MBEDTLS_SITE = $(call github,ARMmbed,mbedtls,v$(MBEDTLS_VERSION))
>  MBEDTLS_CONF_OPTS = \
>  	-DCMAKE_C_FLAGS="$(TARGET_CFLAGS) -std=c99" \
> @@ -12,7 +12,7 @@ MBEDTLS_CONF_OPTS = \
>  	-DENABLE_TESTING=OFF \
>  	-DMBEDTLS_FATAL_WARNINGS=OFF
>  MBEDTLS_INSTALL_STAGING = YES
> -MBEDTLS_LICENSE = Apache-2.0
> +MBEDTLS_LICENSE = Apache-2.0 or GPL-2.0+
>  MBEDTLS_LICENSE_FILES = LICENSE
>  MBEDTLS_CPE_ID_VENDOR = arm
>  MBEDTLS_CPE_ID_PRODUCT = mbed_tls
> -- 
> 2.43.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

  reply	other threads:[~2024-01-27 20:15 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-01-26 22:23 [Buildroot] [PATCH 1/1] package/mbedtls: security bump to version 2.28.7 Fabrice Fontaine
2024-01-27 20:15 ` Yann E. MORIN [this message]
2024-02-28 16:42   ` Peter Korsgaard

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ZbVkZpQp7NuPiOsX@landeda \
    --to=yann.morin.1998@free.fr \
    --cc=buildroot@buildroot.org \
    --cc=fontaine.fabrice@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.