* [Buildroot] [PATCH 1/2] package/clamav: ignore CVE-2016-1405
@ 2022-07-31 11:25 Bernd Kuhls
2022-07-31 11:25 ` [Buildroot] [PATCH 2/2] package/clamav: security bump version to 0.103.7 Bernd Kuhls
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Bernd Kuhls @ 2022-07-31 11:25 UTC (permalink / raw)
To: buildroot
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
package/clamav/clamav.mk | 2 ++
1 file changed, 2 insertions(+)
diff --git a/package/clamav/clamav.mk b/package/clamav/clamav.mk
index 10856ed971..bb95cb8d2b 100644
--- a/package/clamav/clamav.mk
+++ b/package/clamav/clamav.mk
@@ -12,6 +12,8 @@ CLAMAV_LICENSE_FILES = COPYING COPYING.bzip2 COPYING.file COPYING.getopt \
COPYING.unrar COPYING.zlib
CLAMAV_CPE_ID_VENDOR = clamav
CLAMAV_SELINUX_MODULES = clamav
+# affects only Cisco devices
+CLAMAV_IGNORE_CVES += CVE-2016-1405
CLAMAV_DEPENDENCIES = \
host-pkgconf \
libcurl \
--
2.30.2
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [Buildroot] [PATCH 2/2] package/clamav: security bump version to 0.103.7
2022-07-31 11:25 [Buildroot] [PATCH 1/2] package/clamav: ignore CVE-2016-1405 Bernd Kuhls
@ 2022-07-31 11:25 ` Bernd Kuhls
2022-09-13 16:04 ` Peter Korsgaard
2022-08-01 20:40 ` [Buildroot] [PATCH 1/2] package/clamav: ignore CVE-2016-1405 Thomas Petazzoni via buildroot
` (2 subsequent siblings)
3 siblings, 1 reply; 6+ messages in thread
From: Bernd Kuhls @ 2022-07-31 11:25 UTC (permalink / raw)
To: buildroot
Release notes:
https://blog.clamav.net/2022/07/clamav-01037-01041-and-01051-patch.html
By bumping the vendored UnRAR library to version 6.1.7 in commit
https://github.com/Cisco-Talos/clamav/commit/b709eac4003ad01b609615cbbb86c7d5b3821d92
CVE-2022-30333 was fixed.
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
package/clamav/clamav.hash | 2 +-
package/clamav/clamav.mk | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/package/clamav/clamav.hash b/package/clamav/clamav.hash
index 579b0ec89e..60439400ee 100644
--- a/package/clamav/clamav.hash
+++ b/package/clamav/clamav.hash
@@ -1,5 +1,5 @@
# Locally calculated
-sha256 aaa12e3dc19f1d323b1c50d7a10fa8af557e4390149e864d59bde39b6ad9ba33 clamav-0.103.6.tar.gz
+sha256 1e34c31f600cb3b5bd1bf76690590cdeebe9409b330959b1c0f77d421bb17e50 clamav-0.103.7.tar.gz
sha256 0c4fd2fa9733fc9122503797648710851e4ee6d9e4969dd33fcbd8c63cd2f584 COPYING
sha256 d72a145c90918184a05ef65a04c9e6f7466faa59bc1b82c8f6a8ddc7ddcb9bed COPYING.bzip2
sha256 dfb818a0d41411c6fb1c193c68b73018ceadd1994bda41ad541cbff292894bc6 COPYING.file
diff --git a/package/clamav/clamav.mk b/package/clamav/clamav.mk
index bb95cb8d2b..dfdc416601 100644
--- a/package/clamav/clamav.mk
+++ b/package/clamav/clamav.mk
@@ -4,7 +4,7 @@
#
################################################################################
-CLAMAV_VERSION = 0.103.6
+CLAMAV_VERSION = 0.103.7
CLAMAV_SITE = https://www.clamav.net/downloads/production
CLAMAV_LICENSE = GPL-2.0
CLAMAV_LICENSE_FILES = COPYING COPYING.bzip2 COPYING.file COPYING.getopt \
--
2.30.2
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/clamav: ignore CVE-2016-1405
2022-07-31 11:25 [Buildroot] [PATCH 1/2] package/clamav: ignore CVE-2016-1405 Bernd Kuhls
2022-07-31 11:25 ` [Buildroot] [PATCH 2/2] package/clamav: security bump version to 0.103.7 Bernd Kuhls
@ 2022-08-01 20:40 ` Thomas Petazzoni via buildroot
[not found] ` <20220801224054.740d6ace__3080.66242593981$1659386482$gmane$org@windsurf>
2022-09-13 16:04 ` Peter Korsgaard
3 siblings, 0 replies; 6+ messages in thread
From: Thomas Petazzoni via buildroot @ 2022-08-01 20:40 UTC (permalink / raw)
To: Bernd Kuhls; +Cc: buildroot
On Sun, 31 Jul 2022 13:25:41 +0200
Bernd Kuhls <bernd.kuhls@t-online.de> wrote:
> Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
> ---
> package/clamav/clamav.mk | 2 ++
> 1 file changed, 2 insertions(+)
Both applied. I am not sure why your PATCH 1/2 was marked as "Handled
Elsewhere" in patchwork, this looks odd, we rarely use this state (if
ever?), so I assume this was a mistake.
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/clamav: ignore CVE-2016-1405
[not found] ` <20220801224054.740d6ace__3080.66242593981$1659386482$gmane$org@windsurf>
@ 2022-08-01 21:07 ` Bernd Kuhls
0 siblings, 0 replies; 6+ messages in thread
From: Bernd Kuhls @ 2022-08-01 21:07 UTC (permalink / raw)
To: buildroot
Am Mon, 1 Aug 2022 22:40:54 +0200 schrieb Thomas Petazzoni via buildroot:
> Both applied. I am not sure why your PATCH 1/2 was marked as "Handled
> Elsewhere" in patchwork, this looks odd, we rarely use this state (if
> ever?), so I assume this was a mistake.
Hi Thomas,
no, this was intentional. I marked all the IGNORE_CVE patches that way
because "elsewhere" for me means NIST ;)
Regards, Bernd
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/clamav: ignore CVE-2016-1405
2022-07-31 11:25 [Buildroot] [PATCH 1/2] package/clamav: ignore CVE-2016-1405 Bernd Kuhls
` (2 preceding siblings ...)
[not found] ` <20220801224054.740d6ace__3080.66242593981$1659386482$gmane$org@windsurf>
@ 2022-09-13 16:04 ` Peter Korsgaard
3 siblings, 0 replies; 6+ messages in thread
From: Peter Korsgaard @ 2022-09-13 16:04 UTC (permalink / raw)
To: Bernd Kuhls; +Cc: buildroot
>>>>> "Bernd" == Bernd Kuhls <bernd.kuhls@t-online.de> writes:
> Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Committed to 2022.05.x and 2022.02.x, thanks.
--
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Buildroot] [PATCH 2/2] package/clamav: security bump version to 0.103.7
2022-07-31 11:25 ` [Buildroot] [PATCH 2/2] package/clamav: security bump version to 0.103.7 Bernd Kuhls
@ 2022-09-13 16:04 ` Peter Korsgaard
0 siblings, 0 replies; 6+ messages in thread
From: Peter Korsgaard @ 2022-09-13 16:04 UTC (permalink / raw)
To: Bernd Kuhls; +Cc: buildroot
>>>>> "Bernd" == Bernd Kuhls <bernd.kuhls@t-online.de> writes:
> Release notes:
> https://blog.clamav.net/2022/07/clamav-01037-01041-and-01051-patch.html
> By bumping the vendored UnRAR library to version 6.1.7 in commit
> https://github.com/Cisco-Talos/clamav/commit/b709eac4003ad01b609615cbbb86c7d5b3821d92
> CVE-2022-30333 was fixed.
> Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Committed to 2022.05.x and 2022.02.x, thanks.
--
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-09-13 16:04 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-07-31 11:25 [Buildroot] [PATCH 1/2] package/clamav: ignore CVE-2016-1405 Bernd Kuhls
2022-07-31 11:25 ` [Buildroot] [PATCH 2/2] package/clamav: security bump version to 0.103.7 Bernd Kuhls
2022-09-13 16:04 ` Peter Korsgaard
2022-08-01 20:40 ` [Buildroot] [PATCH 1/2] package/clamav: ignore CVE-2016-1405 Thomas Petazzoni via buildroot
[not found] ` <20220801224054.740d6ace__3080.66242593981$1659386482$gmane$org@windsurf>
2022-08-01 21:07 ` Bernd Kuhls
2022-09-13 16:04 ` Peter Korsgaard
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox