[Buildroot] [PATCH] package/cannelloni: bump to version 2.1.2

[Buildroot] [PATCH] package/cannelloni: bump to version 2.1.2

[yegorslists--- via buildroot]

From: Yegor Yefremov <yegorslists@googlemail.com>

For change log, see:

https://github.com/mguentner/cannelloni/releases/tag/v2.1.2

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
---
 package/cannelloni/cannelloni.hash | 2 +-
 package/cannelloni/cannelloni.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/cannelloni/cannelloni.hash b/package/cannelloni/cannelloni.hash
index 625e43d157..6b45d497e4 100644
--- a/package/cannelloni/cannelloni.hash
+++ b/package/cannelloni/cannelloni.hash
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  3dde63727549d4a39154e78b95f4a5dad96af236ca6cef531f347c0b923c74d5  cannelloni-2.0.0.tar.gz
+sha256  c704707f7dd9f1ed64e9195097809f8882c03b1fa0a79864b8e3bf286521e3d7  cannelloni-2.1.2.tar.gz
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  gpl-2.0.txt
diff --git a/package/cannelloni/cannelloni.mk b/package/cannelloni/cannelloni.mk
index 7978cfccf5..2e6a61545e 100644
--- a/package/cannelloni/cannelloni.mk
+++ b/package/cannelloni/cannelloni.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CANNELLONI_VERSION = 2.0.0
+CANNELLONI_VERSION = 2.1.2
 CANNELLONI_SITE = $(call github,mguentner,cannelloni,v$(CANNELLONI_VERSION))
 CANNELLONI_LICENSE = GPL-2.0
 CANNELLONI_LICENSE_FILES = gpl-2.0.txt
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/cannelloni: bump to version 2.1.2

[Thomas Petazzoni via buildroot]

Hello,

On Thu, Aug 20, 2026 at 02:02:53PM +0200, yegorslists--- via buildroot wrote:
> From: Yegor Yefremov <yegorslists@googlemail.com>
> 
> For change log, see:
> 
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.2

Thanks for the patch, however this is just the change log
2.1.1..2.1.2, and it actually fixes a CVE.

Did you look at the 2.0.0..2.1.2 changes? Any security fix in there?
Or was the CVE fixed in 2.1.2 introduced after 2.0.0, making 2.0.0 not
vulnerable?

According to
https://security.buildroot.org/master/component/cannelloni we are
indeed not affected by any known CVE. But I guess that wrong because
the CVE fixed in 2.1.2 apparently affects 2.0.0 according to the
advisory:

   Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame
   parsing in parser.cpp in function parseCANFrame, and decoder.cpp in
   function decodeFrame allowing remote attackers to cause a denial of
   service (crash) or possibly execute arbitrary code via crafted CAN
   FD frames.

Looking at the git history, it seems like there are very little
changes in 2.0.0..2.1.2 so it is probably OK to do the version bump to
fix the security issue, but the patch should be titled "security bump
to 2.1.2".

Could you resend an updated version of the patch, with improved title
and commit log?

Thanks a lot!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH v2] package/cannelloni: security bump to version 2.1.2

[Yegor Yefremov via buildroot]

From: Yegor Yefremov <yegorslists@googlemail.com>

For change log, see:

https://github.com/mguentner/cannelloni/releases/tag/v2.0.1
https://github.com/mguentner/cannelloni/releases/tag/v2.1.0
https://github.com/mguentner/cannelloni/releases/tag/v2.1.1
https://github.com/mguentner/cannelloni/releases/tag/v2.1.2

2.1.2 fixes CVE-2026-37539 (CVSS 3.1 score 9.8, CWE-121): a stack based
buffer overflow in CAN frame parsing, in parseCANFrame() in parser.cpp
and decodeFrame() in decoder.cpp, allowing remote attackers to cause a
denial of service (crash) or possibly execute arbitrary code via
crafted CAN FD frames.

The advisory names v2.0.0 explicitly, so the version used so far is
affected. The CVE is not reported by
https://security.buildroot.org/master/component/cannelloni because its
NVD entry has no CPE data (vendor and product are both "n/a") and can
therefore not be matched against the package version.

Apart from the security fix, 2.0.0..2.1.2 contains only a handful of
changes: undeliverable frames are dropped after a timeout on a broken
CAN bus, variable length arrays are gone, the default remote address is
fixed, and pthreads are looked up with the CMake module instead of by
hand. 2.1.1 is a maintenance release only, as the 2.1.0 tag pointed to
a commit that was not the final one.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
---

Changes v1 -> v2 (suggested by Thomas Petazzoni):
- Retitle as a security bump, as 2.1.2 fixes CVE-2026-37539
- Describe the CVE, confirm that the 2.0.0 we had is affected, explain
  why security.buildroot.org does not report it, and summarize the
  remaining 2.0.0..2.1.2 changes
- Link the change logs of all releases in 2.0.0..2.1.2, not just 2.1.2

 package/cannelloni/cannelloni.hash | 2 +-
 package/cannelloni/cannelloni.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/cannelloni/cannelloni.hash b/package/cannelloni/cannelloni.hash
index 625e43d157..6b45d497e4 100644
--- a/package/cannelloni/cannelloni.hash
+++ b/package/cannelloni/cannelloni.hash
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  3dde63727549d4a39154e78b95f4a5dad96af236ca6cef531f347c0b923c74d5  cannelloni-2.0.0.tar.gz
+sha256  c704707f7dd9f1ed64e9195097809f8882c03b1fa0a79864b8e3bf286521e3d7  cannelloni-2.1.2.tar.gz
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  gpl-2.0.txt
diff --git a/package/cannelloni/cannelloni.mk b/package/cannelloni/cannelloni.mk
index 7978cfccf5..2e6a61545e 100644
--- a/package/cannelloni/cannelloni.mk
+++ b/package/cannelloni/cannelloni.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CANNELLONI_VERSION = 2.0.0
+CANNELLONI_VERSION = 2.1.2
 CANNELLONI_SITE = $(call github,mguentner,cannelloni,v$(CANNELLONI_VERSION))
 CANNELLONI_LICENSE = GPL-2.0
 CANNELLONI_LICENSE_FILES = gpl-2.0.txt
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/cannelloni: security bump to version 2.1.2

[Thomas Petazzoni via buildroot]

On Fri, Sep 18, 2026 at 09:22:48AM +0200, Yegor Yefremov via buildroot wrote:
> From: Yegor Yefremov <yegorslists@googlemail.com>
> 
> For change log, see:
> 
> https://github.com/mguentner/cannelloni/releases/tag/v2.0.1
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.0
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.1
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.2
> 
> 2.1.2 fixes CVE-2026-37539 (CVSS 3.1 score 9.8, CWE-121): a stack based
> buffer overflow in CAN frame parsing, in parseCANFrame() in parser.cpp
> and decodeFrame() in decoder.cpp, allowing remote attackers to cause a
> denial of service (crash) or possibly execute arbitrary code via
> crafted CAN FD frames.
> 
> The advisory names v2.0.0 explicitly, so the version used so far is
> affected. The CVE is not reported by
> https://security.buildroot.org/master/component/cannelloni because its
> NVD entry has no CPE data (vendor and product are both "n/a") and can
> therefore not be matched against the package version.
> 
> Apart from the security fix, 2.0.0..2.1.2 contains only a handful of
> changes: undeliverable frames are dropped after a timeout on a broken
> CAN bus, variable length arrays are gone, the default remote address is
> fixed, and pthreads are looked up with the CMake module instead of by
> hand. 2.1.1 is a maintenance release only, as the 2.1.0 tag pointed to
> a commit that was not the final one.
> 
> Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
> Assisted-by: Claude:claude-opus-5

Applied to master, thanks!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/cannelloni: security bump to version 2.1.2

[Raphaël Mélotte via buildroot]

In reply of:
> For change log, see:
> 
> https://github.com/mguentner/cannelloni/releases/tag/v2.0.1
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.0
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.1
> https://github.com/mguentner/cannelloni/releases/tag/v2.1.2
> 
> 2.1.2 fixes CVE-2026-37539 (CVSS 3.1 score 9.8, CWE-121): a stack based
> buffer overflow in CAN frame parsing, in parseCANFrame() in parser.cpp
> and decodeFrame() in decoder.cpp, allowing remote attackers to cause a
> denial of service (crash) or possibly execute arbitrary code via
> crafted CAN FD frames.
> 
> The advisory names v2.0.0 explicitly, so the version used so far is
> affected. The CVE is not reported by
> https://security.buildroot.org/master/component/cannelloni because its
> NVD entry has no CPE data (vendor and product are both "n/a") and can
> therefore not be matched against the package version.
> 
> Apart from the security fix, 2.0.0..2.1.2 contains only a handful of
> changes: undeliverable frames are dropped after a timeout on a broken
> CAN bus, variable length arrays are gone, the default remote address is
> fixed, and pthreads are looked up with the CMake module instead of by
> hand. 2.1.1 is a maintenance release only, as the 2.1.0 tag pointed to
> a commit that was not the final one.
> 
> Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
> Assisted-by: Claude:claude-opus-5

Applied to 2025.02.x, 2026.08.x. Thanks

> ---
> 
> Changes v1 -> v2 (suggested by Thomas Petazzoni):
> - Retitle as a security bump, as 2.1.2 fixes CVE-2026-37539
> - Describe the CVE, confirm that the 2.0.0 we had is affected, explain
>   why security.buildroot.org does not report it, and summarize the
>   remaining 2.0.0..2.1.2 changes
> - Link the change logs of all releases in 2.0.0..2.1.2, not just 2.1.2
> 
>  package/cannelloni/cannelloni.hash | 2 +-
>  package/cannelloni/cannelloni.mk   | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/package/cannelloni/cannelloni.hash b/package/cannelloni/cannelloni.hash
> index 625e43d157..6b45d497e4 100644
> --- a/package/cannelloni/cannelloni.hash
> +++ b/package/cannelloni/cannelloni.hash
> @@ -1,3 +1,3 @@
>  # Locally computed
> -sha256  3dde63727549d4a39154e78b95f4a5dad96af236ca6cef531f347c0b923c74d5  cannelloni-2.0.0.tar.gz
> +sha256  c704707f7dd9f1ed64e9195097809f8882c03b1fa0a79864b8e3bf286521e3d7  cannelloni-2.1.2.tar.gz
>  sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  gpl-2.0.txt
> diff --git a/package/cannelloni/cannelloni.mk b/package/cannelloni/cannelloni.mk
> index 7978cfccf5..2e6a61545e 100644
> --- a/package/cannelloni/cannelloni.mk
> +++ b/package/cannelloni/cannelloni.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -CANNELLONI_VERSION = 2.0.0
> +CANNELLONI_VERSION = 2.1.2
>  CANNELLONI_SITE = $(call github,mguentner,cannelloni,v$(CANNELLONI_VERSION))
>  CANNELLONI_LICENSE = GPL-2.0
>  CANNELLONI_LICENSE_FILES = gpl-2.0.txt
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot