[Buildroot] [PATCH] package/unrar: bump to version 7.2.7

[Buildroot] [PATCH] package/unrar: bump to version 7.2.7

[Shubham Chakraborty]

Upstream does not provide a per-release change log for the unrarsrc
tarball itself, only for WinRAR. Fixed from Repology/rarlab that
7.2.7 is the latest unrarsrc release available at:

 - https://www.rarlab.com/rar/unrarsrc-7.2.7.tar.gz
 - https://www.rarlab.com/WhatsNew.txt

While at it, mark CVE-2022-30333 as ignored, since it was already
fixed upstream in 6.1.2 and is falsely flagged by buildroot autobuilder for this
package.

Fixes CVE-2022-30333 (false positive, patched since 6.1.2/6.1.7).
 - https://nvd.nist.gov/vuln/detail/CVE-2022-30333
 - https://security-tracker.debian.org/tracker/CVE-2022-30333

Tested with:
 - utils/test-pkg -p unrar

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
---
 package/unrar/unrar.hash | 2 +-
 package/unrar/unrar.mk   | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/package/unrar/unrar.hash b/package/unrar/unrar.hash
index 65dcab4464..8679c01adc 100644
--- a/package/unrar/unrar.hash
+++ b/package/unrar/unrar.hash
@@ -1,3 +1,3 @@
 # Locally computed:
-sha256  d1afa67ef4121ebc5986815699e05db0ce8648499e5dca854f282a4c3f72c003  unrarsrc-7.2.6.tar.gz
+sha256  01d903a7dcf413cb2925696d7796e48e38d471f79bfe7ef3ad2aebf6c12dbefd  unrarsrc-7.2.7.tar.gz
 sha256  6ecc1687808b7d66b24f874755abfed7464d9751ed0001cd4e8e5d9bf397ff8a  license.txt
diff --git a/package/unrar/unrar.mk b/package/unrar/unrar.mk
index c829a2ebbb..5886fe480f 100644
--- a/package/unrar/unrar.mk
+++ b/package/unrar/unrar.mk
@@ -4,13 +4,16 @@
 #
 ################################################################################
 
-UNRAR_VERSION = 7.2.6
+UNRAR_VERSION = 7.2.7
 UNRAR_SOURCE = unrarsrc-$(UNRAR_VERSION).tar.gz
 UNRAR_SITE = https://www.rarlab.com/rar
 UNRAR_LICENSE = unrar
 UNRAR_LICENSE_FILES = license.txt
 UNRAR_CPE_ID_VENDOR = rarlab
 
+# CVE-2022-30333 was fixed in 6.1.2
+UNRAR_IGNORE_CVES += CVE-2022-30333
+
 define UNRAR_BUILD_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE) CXX="$(TARGET_CXX)" STRIP="/bin/true" \
 		CXXFLAGS="$(TARGET_CXXFLAGS) -pthread -std=c++11" \
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/unrar: bump to version 7.2.7

[Thomas Petazzoni via buildroot]

Hello,

On Mon, Jul 13, 2026 at 05:07:07PM +0530, Shubham Chakraborty wrote:
> Upstream does not provide a per-release change log for the unrarsrc
> tarball itself, only for WinRAR. Fixed from Repology/rarlab that
> 7.2.7 is the latest unrarsrc release available at:
> 
>  - https://www.rarlab.com/rar/unrarsrc-7.2.7.tar.gz
>  - https://www.rarlab.com/WhatsNew.txt
> 
> While at it, mark CVE-2022-30333 as ignored, since it was already
> fixed upstream in 6.1.2 and is falsely flagged by buildroot autobuilder for this
> package.
> 
> Fixes CVE-2022-30333 (false positive, patched since 6.1.2/6.1.7).
>  - https://nvd.nist.gov/vuln/detail/CVE-2022-30333
>  - https://security-tracker.debian.org/tracker/CVE-2022-30333

Where do you see as being flagged affecting unrar in Buildroot? The
NVD database says this CVE affects versions up to 6.12. We're using
7.2.7, so we're not vulnerable.

https://security.buildroot.org/master/component/unrar doesn't show any
known vulnerability.

Could you clarify?

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot