Re: [Buildroot] [PATCH] package/libgcrypt: bump version to 1.2.3

[Julien Olivain via buildroot <buildroot@buildroot.org>]

Hi Peter,

The commit title says "1.2.3" but should rather be "1.12.3".

On 01/09/2026 21:27, Peter Korsgaard wrote:
> Release notes:
> https://lists.gnu.org/archive/html/info-gnu/2026-08/msg00007.html
> 
> Contains a number of bugfixes, some of which may have (low severity)
> security impact.  As stated by Werner Koch:
> 
>  All in all we received 26 reports alone from ANSSI but as even the 
> reporter
>  mentioned, the real world attack severity is not critical.  Thus we 
> don't
>  consider 1.12.3 a security fix release.  There are some bugs which 
> should
>  be fixed to avoid crashes, and thus may lead to DoS.  However, 16384 
> bit
>  RSA keys can also be used for a practical DoS; it all depends on your 
> use
>  case.
> 
> https://www.openwall.com/lists/oss-security/2026/08/31/11
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
> ---
[...]
> diff --git a/package/libgcrypt/libgcrypt.mk 
> b/package/libgcrypt/libgcrypt.mk
> index 0bc281da42..a49897fd4f 100644
> --- a/package/libgcrypt/libgcrypt.mk
> +++ b/package/libgcrypt/libgcrypt.mk
> @@ -4,7 +4,7 @@
>  #
>  
> ################################################################################
> 
> -LIBGCRYPT_VERSION = 1.12.2
> +LIBGCRYPT_VERSION = 1.12.3

Also, this new version introduces build failures:
https://gitlab.com/jolivain/buildroot/-/pipelines/2810830147

For reference, the previous version 1.12.2 passes test-pkg:
https://gitlab.com/jolivain/buildroot/-/pipelines/2810888453

Since those fixes are described as low severity, we should probably
fix those before merging this bump.

>  LIBGCRYPT_SOURCE = libgcrypt-$(LIBGCRYPT_VERSION).tar.bz2
>  LIBGCRYPT_LICENSE = LGPL-2.1+
>  LIBGCRYPT_LICENSE_FILES = COPYING.LIB
> --
> 2.47.3

Best regards,

Julien.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot