[Buildroot] [PATCH] package/unrar: bump to version 7.2.7

[Buildroot] [PATCH] package/unrar: bump to version 7.2.7

[Shubham Chakraborty]

Upstream does not provide a per-release change log for the unrarsrc
tarball itself, only for WinRAR. Fixed from Repology/rarlab that
7.2.7 is the latest unrarsrc release available at:

 - https://www.rarlab.com/rar/unrarsrc-7.2.7.tar.gz
 - https://www.rarlab.com/WhatsNew.txt

While at it, mark CVE-2022-30333 as ignored, since it was already
fixed upstream in 6.1.2 and is falsely flagged by buildroot autobuilder for this
package.

Fixes CVE-2022-30333 (false positive, patched since 6.1.2/6.1.7).
 - https://nvd.nist.gov/vuln/detail/CVE-2022-30333
 - https://security-tracker.debian.org/tracker/CVE-2022-30333

Tested with:
 - utils/test-pkg -p unrar

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
---
 package/unrar/unrar.hash | 2 +-
 package/unrar/unrar.mk   | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/package/unrar/unrar.hash b/package/unrar/unrar.hash
index 65dcab4464..8679c01adc 100644
--- a/package/unrar/unrar.hash
+++ b/package/unrar/unrar.hash
@@ -1,3 +1,3 @@
 # Locally computed:
-sha256  d1afa67ef4121ebc5986815699e05db0ce8648499e5dca854f282a4c3f72c003  unrarsrc-7.2.6.tar.gz
+sha256  01d903a7dcf413cb2925696d7796e48e38d471f79bfe7ef3ad2aebf6c12dbefd  unrarsrc-7.2.7.tar.gz
 sha256  6ecc1687808b7d66b24f874755abfed7464d9751ed0001cd4e8e5d9bf397ff8a  license.txt
diff --git a/package/unrar/unrar.mk b/package/unrar/unrar.mk
index c829a2ebbb..5886fe480f 100644
--- a/package/unrar/unrar.mk
+++ b/package/unrar/unrar.mk
@@ -4,13 +4,16 @@
 #
 ################################################################################
 
-UNRAR_VERSION = 7.2.6
+UNRAR_VERSION = 7.2.7
 UNRAR_SOURCE = unrarsrc-$(UNRAR_VERSION).tar.gz
 UNRAR_SITE = https://www.rarlab.com/rar
 UNRAR_LICENSE = unrar
 UNRAR_LICENSE_FILES = license.txt
 UNRAR_CPE_ID_VENDOR = rarlab
 
+# CVE-2022-30333 was fixed in 6.1.2
+UNRAR_IGNORE_CVES += CVE-2022-30333
+
 define UNRAR_BUILD_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE) CXX="$(TARGET_CXX)" STRIP="/bin/true" \
 		CXXFLAGS="$(TARGET_CXXFLAGS) -pthread -std=c++11" \
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/unrar: bump to version 7.2.7

[Thomas Petazzoni via buildroot]

Hello,

On Mon, Jul 13, 2026 at 05:07:07PM +0530, Shubham Chakraborty wrote:
> Upstream does not provide a per-release change log for the unrarsrc
> tarball itself, only for WinRAR. Fixed from Repology/rarlab that
> 7.2.7 is the latest unrarsrc release available at:
> 
>  - https://www.rarlab.com/rar/unrarsrc-7.2.7.tar.gz
>  - https://www.rarlab.com/WhatsNew.txt
> 
> While at it, mark CVE-2022-30333 as ignored, since it was already
> fixed upstream in 6.1.2 and is falsely flagged by buildroot autobuilder for this
> package.
> 
> Fixes CVE-2022-30333 (false positive, patched since 6.1.2/6.1.7).
>  - https://nvd.nist.gov/vuln/detail/CVE-2022-30333
>  - https://security-tracker.debian.org/tracker/CVE-2022-30333

Where do you see as being flagged affecting unrar in Buildroot? The
NVD database says this CVE affects versions up to 6.12. We're using
7.2.7, so we're not vulnerable.

https://security.buildroot.org/master/component/unrar doesn't show any
known vulnerability.

Could you clarify?

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/unrar: bump to version 7.2.7

[Shubham Chakraborty]

[-- Attachment #1.1: Type: text/plain, Size: 1517 bytes --]

Hi Thomas,

The Buildroot autobuilder reports that CVE-2022-30333 affects unrar
in the stable branches (specifically 2026.05.x, 2026.02.x, and 2025.02.x),
as shown
in the automated emails.

Best regards,

Shubham Chakraborty


On Tue, 18 Aug 2026, 1:56 am Thomas Petazzoni, <thomas.petazzoni@bootlin.com>
wrote:

> Hello,
>
> On Mon, Jul 13, 2026 at 05:07:07PM +0530, Shubham Chakraborty wrote:
> > Upstream does not provide a per-release change log for the unrarsrc
> > tarball itself, only for WinRAR. Fixed from Repology/rarlab that
> > 7.2.7 is the latest unrarsrc release available at:
> >
> >  - https://www.rarlab.com/rar/unrarsrc-7.2.7.tar.gz
> >  - https://www.rarlab.com/WhatsNew.txt
> >
> > While at it, mark CVE-2022-30333 as ignored, since it was already
> > fixed upstream in 6.1.2 and is falsely flagged by buildroot autobuilder
> for this
> > package.
> >
> > Fixes CVE-2022-30333 (false positive, patched since 6.1.2/6.1.7).
> >  - https://nvd.nist.gov/vuln/detail/CVE-2022-30333
> >  - https://security-tracker.debian.org/tracker/CVE-2022-30333
>
> Where do you see as being flagged affecting unrar in Buildroot? The
> NVD database says this CVE affects versions up to 6.12. We're using
> 7.2.7, so we're not vulnerable.
>
> https://security.buildroot.org/master/component/unrar doesn't show any
> known vulnerability.
>
> Could you clarify?
>
> Best regards,
>
> Thomas
> --
> Thomas Petazzoni, co-owner and CEO, Bootlin
> Embedded Linux and Kernel engineering and training
> https://bootlin.com
>

[-- Attachment #1.2: Type: text/html, Size: 2737 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/unrar: bump to version 7.2.7

[Thomas Petazzoni via buildroot]

Hello,

On Thu, Aug 20, 2026 at 10:32:08PM +0530, Shubham Chakraborty wrote:

> The Buildroot autobuilder reports that CVE-2022-30333 affects unrar 
> in the stable branches (specifically 2026.05.x, 2026.02.x, and 2025.02.x), as
> shown in the automated emails.

But then for our stable branches the question is whether we want to
bump unrar or just backport the CVE fix. Also, if you don't explain
such things in the commit log, how are we expected to guess?

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot