Re: [Buildroot] [PATCH v2] package/cannelloni: security bump to version 2.1.2

["Raphaël Mélotte via buildroot" <buildroot@buildroot.org>]

In reply of:
> For change log, see:
> 
> https://github.com/mguentner/cannelloni/releases/tag/v2.0.1
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.0
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.1
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.2
> 
> 2.1.2 fixes CVE-2026-37539 (CVSS 3.1 score 9.8, CWE-121): a stack based
> buffer overflow in CAN frame parsing, in parseCANFrame() in parser.cpp
> and decodeFrame() in decoder.cpp, allowing remote attackers to cause a
> denial of service (crash) or possibly execute arbitrary code via
> crafted CAN FD frames.
> 
> The advisory names v2.0.0 explicitly, so the version used so far is
> affected. The CVE is not reported by
> https://security.buildroot.org/master/component/cannelloni because its
> NVD entry has no CPE data (vendor and product are both "n/a") and can
> therefore not be matched against the package version.
> 
> Apart from the security fix, 2.0.0..2.1.2 contains only a handful of
> changes: undeliverable frames are dropped after a timeout on a broken
> CAN bus, variable length arrays are gone, the default remote address is
> fixed, and pthreads are looked up with the CMake module instead of by
> hand. 2.1.1 is a maintenance release only, as the 2.1.0 tag pointed to
> a commit that was not the final one.
> 
> Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
> Assisted-by: Claude:claude-opus-5

Applied to 2025.02.x, 2026.08.x. Thanks

> ---
> 
> Changes v1 -> v2 (suggested by Thomas Petazzoni):
> - Retitle as a security bump, as 2.1.2 fixes CVE-2026-37539
> - Describe the CVE, confirm that the 2.0.0 we had is affected, explain
>   why security.buildroot.org does not report it, and summarize the
>   remaining 2.0.0..2.1.2 changes
> - Link the change logs of all releases in 2.0.0..2.1.2, not just 2.1.2
> 
>  package/cannelloni/cannelloni.hash | 2 +-
>  package/cannelloni/cannelloni.mk   | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/package/cannelloni/cannelloni.hash b/package/cannelloni/cannelloni.hash
> index 625e43d157..6b45d497e4 100644
> --- a/package/cannelloni/cannelloni.hash
> +++ b/package/cannelloni/cannelloni.hash
> @@ -1,3 +1,3 @@
>  # Locally computed
> -sha256  3dde63727549d4a39154e78b95f4a5dad96af236ca6cef531f347c0b923c74d5  cannelloni-2.0.0.tar.gz
> +sha256  c704707f7dd9f1ed64e9195097809f8882c03b1fa0a79864b8e3bf286521e3d7  cannelloni-2.1.2.tar.gz
>  sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  gpl-2.0.txt
> diff --git a/package/cannelloni/cannelloni.mk b/package/cannelloni/cannelloni.mk
> index 7978cfccf5..2e6a61545e 100644
> --- a/package/cannelloni/cannelloni.mk
> +++ b/package/cannelloni/cannelloni.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -CANNELLONI_VERSION = 2.0.0
> +CANNELLONI_VERSION = 2.1.2
>  CANNELLONI_SITE = $(call github,mguentner,cannelloni,v$(CANNELLONI_VERSION))
>  CANNELLONI_LICENSE = GPL-2.0
>  CANNELLONI_LICENSE_FILES = gpl-2.0.txt
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot