Re: [Buildroot] [PATCH] package/cannelloni: bump to version 2.1.2

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello,

On Thu, Aug 20, 2026 at 02:02:53PM +0200, yegorslists--- via buildroot wrote:
> From: Yegor Yefremov <yegorslists@googlemail.com>
> 
> For change log, see:
> 
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.2

Thanks for the patch, however this is just the change log
2.1.1..2.1.2, and it actually fixes a CVE.

Did you look at the 2.0.0..2.1.2 changes? Any security fix in there?
Or was the CVE fixed in 2.1.2 introduced after 2.0.0, making 2.0.0 not
vulnerable?

According to
https://security.buildroot.org/master/component/cannelloni we are
indeed not affected by any known CVE. But I guess that wrong because
the CVE fixed in 2.1.2 apparently affects 2.0.0 according to the
advisory:

   Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame
   parsing in parser.cpp in function parseCANFrame, and decoder.cpp in
   function decodeFrame allowing remote attackers to cause a denial of
   service (crash) or possibly execute arbitrary code via crafted CAN
   FD frames.

Looking at the git history, it seems like there are very little
changes in 2.0.0..2.1.2 so it is probably OK to do the version bump to
fix the security issue, but the patch should be titled "security bump
to 2.1.2".

Could you resend an updated version of the patch, with improved title
and commit log?

Thanks a lot!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot