From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH] package/jq: security bump to version 1.8.1
Date: Mon, 18 Aug 2025 23:06:11 +0200 [thread overview]
Message-ID: <20250818230611.7173e721@windsurf> (raw)
In-Reply-To: <20250818133632.862010-1-angelo.compagnucci@gmail.com>
Hello Angelo,
On Mon, 18 Aug 2025 15:36:32 +0200
Angelo Compagnucci <angelo.compagnucci@gmail.com> wrote:
> Changelog:
> https://github.com/jqlang/jq/releases/tag/jq-1.8.1
>
> Fixes the following security issues:
>
> - CVE-2025-49014
> Fix heap use after free in f_strftime, f_strflocaltime.
>
> - GHSA-f946-j5j2-4w5m
> Fix stack overflow in node_min_byte_len of oniguruma.
>
> Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
> ---
> package/jq/jq.hash | 2 +-
> package/jq/jq.mk | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
Thanks for the patch, however this commit breaks "make legal-info" for
the jq package:
ERROR: while checking hashes from package/jq/jq.hash
ERROR: COPYING has wrong sha256 hash:
ERROR: expected: ea9e53f5974239869c51ace8bb6849c9751dee7c9d592180957987a1a133caff
ERROR: got : ad2b4a266b2268939c1446979759706077421cf906a203aa188c6f396e8cfd74
ERROR: Incomplete download, or man-in-the-middle (MITM) attack
make: *** [package/jq/jq.mk:29: jq-legal-info] Error 1
Could you have a look?
Thanks a lot!
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
prev parent reply other threads:[~2025-08-18 21:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-18 13:36 [Buildroot] [PATCH] package/jq: security bump to version 1.8.1 Angelo Compagnucci
2025-08-18 21:06 ` Thomas Petazzoni via buildroot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250818230611.7173e721@windsurf \
--to=buildroot@buildroot.org \
--cc=angelo.compagnucci@gmail.com \
--cc=thomas.petazzoni@bootlin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox