Re: [Buildroot] [PATCH 2/2] package/suricata: security bump to version 6.0.14

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > - Fix CVE-2023-35852: In Suricata before 6.0.13 (when there is an
 >   adversary who controls an external source of rules), a dataset
 >   filename, that comes from a rule, may trigger absolute or relative
 >   directory traversal, and lead to write access to a local filesystem.
 >   This is addressed in 6.0.13 by requiring allow-absolute-filenames and
 >   allow-write (in the datasets rules configuration section) if an
 >   installation requires traversal/writing in this situation.
 > - Fix CVE-2023-35853: In Suricata before 6.0.13, an adversary who
 >   controls an external source of Lua rules may be able to execute Lua
 >   code. This is addressed in 6.0.13 by disabling Lua unless allow-rules
 >   is true in the security lua configuration section.
 > - Drop first patch (not needed since
 >   https://github.com/OISF/suricata/commit/c8a3aa608eaae1acbaf33dba8a7c1a3cbfeb4285)

 > https://github.com/OISF/suricata/blob/suricata-6.0.14/ChangeLog

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
 > ---
 >  .checkpackageignore                           |  3 +-
 >  ...ure-proper-shabang-on-python-scripts.patch | 47 -------------------
 >  ...low-the-user-to-override-RUST_TARGET.patch | 35 --------------
 >  package/suricata/suricata.hash                |  2 +-
 >  package/suricata/suricata.mk                  |  5 +-
 >  5 files changed, 4 insertions(+), 88 deletions(-)
 >  delete mode 100644 package/suricata/0001-python-ensure-proper-shabang-on-python-scripts.patch
 >  delete mode 100644 package/suricata/0002-configure.ac-allow-the-user-to-override-RUST_TARGET.patch

Hmm, did you mean to rename patch 0002 rather than delete it?

 > diff --git a/.checkpackageignore b/.checkpackageignore
 > index b41ab6918e..61de4d79a1 100644
 > --- a/.checkpackageignore
 > +++ b/.checkpackageignore
 > @@ -1360,8 +1360,7 @@ package/statserial/0001-ncurses-link.patch Upstream
 >  package/stunnel/S50stunnel Indent Shellcheck Variables
 >  package/sudo/0001-configure.ac-fix-openssl-static-build.patch Upstream
 >  package/supervisor/S99supervisord Variables
 > -package/suricata/0001-python-ensure-proper-shabang-on-python-scripts.patch Upstream
 > -package/suricata/0002-configure.ac-allow-the-user-to-override-RUST_TARGET.patch Upstream
 > +package/suricata/0001-configure.ac-allow-the-user-to-override-RUST_TARGET.patch Upstream

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot