Buildroot Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [Buildroot] [PATCH 1/1] package/strongswan: security bump to version 5.9.4
@ 2021-10-24 21:54 Fabrice Fontaine
  2021-10-26 19:35 ` Arnout Vandecappelle
  2021-10-27 10:22 ` Peter Korsgaard
  0 siblings, 2 replies; 3+ messages in thread
From: Fabrice Fontaine @ 2021-10-24 21:54 UTC (permalink / raw)
  To: buildroot; +Cc: Fabrice Fontaine, Jérôme Pouiller

- Fixed a denial-of-service vulnerability in the gmp plugin that was
  caused by an integer overflow when processing RSASSA-PSS signatures
  with very large salt lengths. This vulnerability has been registered
  as CVE-2021-41990.
- Fixed a denial-of-service vulnerability in the in-memory certificate
  cache if certificates are replaced and a very large random value
  caused an integer overflow. This vulnerability has been registered as
  CVE-2021-41991.

https://www.strongswan.org/blog/2021/10/18/strongswan-vulnerability-(cve-2021-41991).html

https://github.com/strongswan/strongswan/blob/5.9.4/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
 package/strongswan/strongswan.hash | 6 +++---
 package/strongswan/strongswan.mk   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package/strongswan/strongswan.hash b/package/strongswan/strongswan.hash
index a19b311458..69b3547f91 100644
--- a/package/strongswan/strongswan.hash
+++ b/package/strongswan/strongswan.hash
@@ -1,7 +1,7 @@
-# From http://download.strongswan.org/strongswan-5.9.1.tar.bz2.md5
-md5  1f4db969d072e120dc12d1c116a0f658  strongswan-5.9.1.tar.bz2
+# From http://download.strongswan.org/strongswan-5.9.4.tar.bz2.md5
+md5  9c387eb77f0159fdefbcf7e81c905c35  strongswan-5.9.4.tar.bz2
 # Calculated based on the hash above
-sha256  a337c9fb63d973b8440827755c784031648bf423b7114a04918b0b00fd42cafb  strongswan-5.9.1.tar.bz2
+sha256  45fdf1a4c2af086d8ff5b76fd7b21d3b6f0890f365f83bf4c9a75dda26887518  strongswan-5.9.4.tar.bz2
 # Locally calculated
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING
 sha256  2292e21797754548dccdef9eef6aee7584e552fbd890fa914e1de8d3577d23f0  LICENSE
diff --git a/package/strongswan/strongswan.mk b/package/strongswan/strongswan.mk
index 2967682767..850bb7326e 100644
--- a/package/strongswan/strongswan.mk
+++ b/package/strongswan/strongswan.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-STRONGSWAN_VERSION = 5.9.1
+STRONGSWAN_VERSION = 5.9.4
 STRONGSWAN_SOURCE = strongswan-$(STRONGSWAN_VERSION).tar.bz2
 STRONGSWAN_SITE = http://download.strongswan.org
 STRONGSWAN_LICENSE = GPL-2.0+
-- 
2.33.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH 1/1] package/strongswan: security bump to version 5.9.4
  2021-10-24 21:54 [Buildroot] [PATCH 1/1] package/strongswan: security bump to version 5.9.4 Fabrice Fontaine
@ 2021-10-26 19:35 ` Arnout Vandecappelle
  2021-10-27 10:22 ` Peter Korsgaard
  1 sibling, 0 replies; 3+ messages in thread
From: Arnout Vandecappelle @ 2021-10-26 19:35 UTC (permalink / raw)
  To: Fabrice Fontaine, buildroot; +Cc: Jérôme Pouiller



On 24/10/2021 23:54, Fabrice Fontaine wrote:
> - Fixed a denial-of-service vulnerability in the gmp plugin that was
>    caused by an integer overflow when processing RSASSA-PSS signatures
>    with very large salt lengths. This vulnerability has been registered
>    as CVE-2021-41990.
> - Fixed a denial-of-service vulnerability in the in-memory certificate
>    cache if certificates are replaced and a very large random value
>    caused an integer overflow. This vulnerability has been registered as
>    CVE-2021-41991.
> 
> https://www.strongswan.org/blog/2021/10/18/strongswan-vulnerability-(cve-2021-41991).html
> 
> https://github.com/strongswan/strongswan/blob/5.9.4/NEWS
> 
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

  Applied to master, thanks.

  Regards,
  Arnout

> ---
>   package/strongswan/strongswan.hash | 6 +++---
>   package/strongswan/strongswan.mk   | 2 +-
>   2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/package/strongswan/strongswan.hash b/package/strongswan/strongswan.hash
> index a19b311458..69b3547f91 100644
> --- a/package/strongswan/strongswan.hash
> +++ b/package/strongswan/strongswan.hash
> @@ -1,7 +1,7 @@
> -# From http://download.strongswan.org/strongswan-5.9.1.tar.bz2.md5
> -md5  1f4db969d072e120dc12d1c116a0f658  strongswan-5.9.1.tar.bz2
> +# From http://download.strongswan.org/strongswan-5.9.4.tar.bz2.md5
> +md5  9c387eb77f0159fdefbcf7e81c905c35  strongswan-5.9.4.tar.bz2
>   # Calculated based on the hash above
> -sha256  a337c9fb63d973b8440827755c784031648bf423b7114a04918b0b00fd42cafb  strongswan-5.9.1.tar.bz2
> +sha256  45fdf1a4c2af086d8ff5b76fd7b21d3b6f0890f365f83bf4c9a75dda26887518  strongswan-5.9.4.tar.bz2
>   # Locally calculated
>   sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING
>   sha256  2292e21797754548dccdef9eef6aee7584e552fbd890fa914e1de8d3577d23f0  LICENSE
> diff --git a/package/strongswan/strongswan.mk b/package/strongswan/strongswan.mk
> index 2967682767..850bb7326e 100644
> --- a/package/strongswan/strongswan.mk
> +++ b/package/strongswan/strongswan.mk
> @@ -4,7 +4,7 @@
>   #
>   ################################################################################
>   
> -STRONGSWAN_VERSION = 5.9.1
> +STRONGSWAN_VERSION = 5.9.4
>   STRONGSWAN_SOURCE = strongswan-$(STRONGSWAN_VERSION).tar.bz2
>   STRONGSWAN_SITE = http://download.strongswan.org
>   STRONGSWAN_LICENSE = GPL-2.0+
> 
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH 1/1] package/strongswan: security bump to version 5.9.4
  2021-10-24 21:54 [Buildroot] [PATCH 1/1] package/strongswan: security bump to version 5.9.4 Fabrice Fontaine
  2021-10-26 19:35 ` Arnout Vandecappelle
@ 2021-10-27 10:22 ` Peter Korsgaard
  1 sibling, 0 replies; 3+ messages in thread
From: Peter Korsgaard @ 2021-10-27 10:22 UTC (permalink / raw)
  To: Fabrice Fontaine; +Cc: Jérôme Pouiller, buildroot

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > - Fixed a denial-of-service vulnerability in the gmp plugin that was
 >   caused by an integer overflow when processing RSASSA-PSS signatures
 >   with very large salt lengths. This vulnerability has been registered
 >   as CVE-2021-41990.
 > - Fixed a denial-of-service vulnerability in the in-memory certificate
 >   cache if certificates are replaced and a very large random value
 >   caused an integer overflow. This vulnerability has been registered as
 >   CVE-2021-41991.

 > https://www.strongswan.org/blog/2021/10/18/strongswan-vulnerability-(cve-2021-41991).html

 > https://github.com/strongswan/strongswan/blob/5.9.4/NEWS

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Committed to 2021.02.x and 2021.08.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-10-27 10:22 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-10-24 21:54 [Buildroot] [PATCH 1/1] package/strongswan: security bump to version 5.9.4 Fabrice Fontaine
2021-10-26 19:35 ` Arnout Vandecappelle
2021-10-27 10:22 ` Peter Korsgaard

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox