Re: [Buildroot] [PATCH v2] package/cannelloni: security bump to version 2.1.2

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

On Fri, Sep 18, 2026 at 09:22:48AM +0200, Yegor Yefremov via buildroot wrote:
> From: Yegor Yefremov <yegorslists@googlemail.com>
> 
> For change log, see:
> 
> https://github.com/mguentner/cannelloni/releases/tag/v2.0.1
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.0
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.1
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.2
> 
> 2.1.2 fixes CVE-2026-37539 (CVSS 3.1 score 9.8, CWE-121): a stack based
> buffer overflow in CAN frame parsing, in parseCANFrame() in parser.cpp
> and decodeFrame() in decoder.cpp, allowing remote attackers to cause a
> denial of service (crash) or possibly execute arbitrary code via
> crafted CAN FD frames.
> 
> The advisory names v2.0.0 explicitly, so the version used so far is
> affected. The CVE is not reported by
> https://security.buildroot.org/master/component/cannelloni because its
> NVD entry has no CPE data (vendor and product are both "n/a") and can
> therefore not be matched against the package version.
> 
> Apart from the security fix, 2.0.0..2.1.2 contains only a handful of
> changes: undeliverable frames are dropped after a timeout on a broken
> CAN bus, variable length arrays are gone, the default remote address is
> fixed, and pthreads are looked up with the CMake module instead of by
> hand. 2.1.1 is a maintenance release only, as the 2.1.0 tag pointed to
> a commit that was not the final one.
> 
> Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
> Assisted-by: Claude:claude-opus-5

Applied to master, thanks!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot