* [Buildroot] [PATCH] package/cannelloni: bump to version 2.1.2 @ 2026-08-20 12:02 yegorslists--- via buildroot 2026-09-17 15:17 ` Thomas Petazzoni via buildroot 2026-09-18 7:22 ` [Buildroot] [PATCH v2] package/cannelloni: security " Yegor Yefremov via buildroot 0 siblings, 2 replies; 5+ messages in thread From: yegorslists--- via buildroot @ 2026-08-20 12:02 UTC (permalink / raw) To: buildroot From: Yegor Yefremov <yegorslists@googlemail.com> For change log, see: https://github.com/mguentner/cannelloni/releases/tag/v2.1.2 Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> --- package/cannelloni/cannelloni.hash | 2 +- package/cannelloni/cannelloni.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/cannelloni/cannelloni.hash b/package/cannelloni/cannelloni.hash index 625e43d157..6b45d497e4 100644 --- a/package/cannelloni/cannelloni.hash +++ b/package/cannelloni/cannelloni.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 3dde63727549d4a39154e78b95f4a5dad96af236ca6cef531f347c0b923c74d5 cannelloni-2.0.0.tar.gz +sha256 c704707f7dd9f1ed64e9195097809f8882c03b1fa0a79864b8e3bf286521e3d7 cannelloni-2.1.2.tar.gz sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 gpl-2.0.txt diff --git a/package/cannelloni/cannelloni.mk b/package/cannelloni/cannelloni.mk index 7978cfccf5..2e6a61545e 100644 --- a/package/cannelloni/cannelloni.mk +++ b/package/cannelloni/cannelloni.mk @@ -4,7 +4,7 @@ # ################################################################################ -CANNELLONI_VERSION = 2.0.0 +CANNELLONI_VERSION = 2.1.2 CANNELLONI_SITE = $(call github,mguentner,cannelloni,v$(CANNELLONI_VERSION)) CANNELLONI_LICENSE = GPL-2.0 CANNELLONI_LICENSE_FILES = gpl-2.0.txt -- 2.34.1 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH] package/cannelloni: bump to version 2.1.2 2026-08-20 12:02 [Buildroot] [PATCH] package/cannelloni: bump to version 2.1.2 yegorslists--- via buildroot @ 2026-09-17 15:17 ` Thomas Petazzoni via buildroot 2026-09-18 7:22 ` [Buildroot] [PATCH v2] package/cannelloni: security " Yegor Yefremov via buildroot 1 sibling, 0 replies; 5+ messages in thread From: Thomas Petazzoni via buildroot @ 2026-09-17 15:17 UTC (permalink / raw) To: yegorslists; +Cc: buildroot Hello, On Thu, Aug 20, 2026 at 02:02:53PM +0200, yegorslists--- via buildroot wrote: > From: Yegor Yefremov <yegorslists@googlemail.com> > > For change log, see: > > https://github.com/mguentner/cannelloni/releases/tag/v2.1.2 Thanks for the patch, however this is just the change log 2.1.1..2.1.2, and it actually fixes a CVE. Did you look at the 2.0.0..2.1.2 changes? Any security fix in there? Or was the CVE fixed in 2.1.2 introduced after 2.0.0, making 2.0.0 not vulnerable? According to https://security.buildroot.org/master/component/cannelloni we are indeed not affected by any known CVE. But I guess that wrong because the CVE fixed in 2.1.2 apparently affects 2.0.0 according to the advisory: Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function decodeFrame allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted CAN FD frames. Looking at the git history, it seems like there are very little changes in 2.0.0..2.1.2 so it is probably OK to do the version bump to fix the security issue, but the patch should be titled "security bump to 2.1.2". Could you resend an updated version of the patch, with improved title and commit log? Thanks a lot! Thomas -- Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH v2] package/cannelloni: security bump to version 2.1.2 2026-08-20 12:02 [Buildroot] [PATCH] package/cannelloni: bump to version 2.1.2 yegorslists--- via buildroot 2026-09-17 15:17 ` Thomas Petazzoni via buildroot @ 2026-09-18 7:22 ` Yegor Yefremov via buildroot 2026-09-18 7:35 ` Thomas Petazzoni via buildroot 2026-09-25 14:47 ` Raphaël Mélotte via buildroot 1 sibling, 2 replies; 5+ messages in thread From: Yegor Yefremov via buildroot @ 2026-09-18 7:22 UTC (permalink / raw) To: buildroot; +Cc: thomas.petazzoni From: Yegor Yefremov <yegorslists@googlemail.com> For change log, see: https://github.com/mguentner/cannelloni/releases/tag/v2.0.1 https://github.com/mguentner/cannelloni/releases/tag/v2.1.0 https://github.com/mguentner/cannelloni/releases/tag/v2.1.1 https://github.com/mguentner/cannelloni/releases/tag/v2.1.2 2.1.2 fixes CVE-2026-37539 (CVSS 3.1 score 9.8, CWE-121): a stack based buffer overflow in CAN frame parsing, in parseCANFrame() in parser.cpp and decodeFrame() in decoder.cpp, allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted CAN FD frames. The advisory names v2.0.0 explicitly, so the version used so far is affected. The CVE is not reported by https://security.buildroot.org/master/component/cannelloni because its NVD entry has no CPE data (vendor and product are both "n/a") and can therefore not be matched against the package version. Apart from the security fix, 2.0.0..2.1.2 contains only a handful of changes: undeliverable frames are dropped after a timeout on a broken CAN bus, variable length arrays are gone, the default remote address is fixed, and pthreads are looked up with the CMake module instead of by hand. 2.1.1 is a maintenance release only, as the 2.1.0 tag pointed to a commit that was not the final one. Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> Assisted-by: Claude:claude-opus-5 --- Changes v1 -> v2 (suggested by Thomas Petazzoni): - Retitle as a security bump, as 2.1.2 fixes CVE-2026-37539 - Describe the CVE, confirm that the 2.0.0 we had is affected, explain why security.buildroot.org does not report it, and summarize the remaining 2.0.0..2.1.2 changes - Link the change logs of all releases in 2.0.0..2.1.2, not just 2.1.2 package/cannelloni/cannelloni.hash | 2 +- package/cannelloni/cannelloni.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/cannelloni/cannelloni.hash b/package/cannelloni/cannelloni.hash index 625e43d157..6b45d497e4 100644 --- a/package/cannelloni/cannelloni.hash +++ b/package/cannelloni/cannelloni.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 3dde63727549d4a39154e78b95f4a5dad96af236ca6cef531f347c0b923c74d5 cannelloni-2.0.0.tar.gz +sha256 c704707f7dd9f1ed64e9195097809f8882c03b1fa0a79864b8e3bf286521e3d7 cannelloni-2.1.2.tar.gz sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 gpl-2.0.txt diff --git a/package/cannelloni/cannelloni.mk b/package/cannelloni/cannelloni.mk index 7978cfccf5..2e6a61545e 100644 --- a/package/cannelloni/cannelloni.mk +++ b/package/cannelloni/cannelloni.mk @@ -4,7 +4,7 @@ # ################################################################################ -CANNELLONI_VERSION = 2.0.0 +CANNELLONI_VERSION = 2.1.2 CANNELLONI_SITE = $(call github,mguentner,cannelloni,v$(CANNELLONI_VERSION)) CANNELLONI_LICENSE = GPL-2.0 CANNELLONI_LICENSE_FILES = gpl-2.0.txt -- 2.34.1 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH v2] package/cannelloni: security bump to version 2.1.2 2026-09-18 7:22 ` [Buildroot] [PATCH v2] package/cannelloni: security " Yegor Yefremov via buildroot @ 2026-09-18 7:35 ` Thomas Petazzoni via buildroot 2026-09-25 14:47 ` Raphaël Mélotte via buildroot 1 sibling, 0 replies; 5+ messages in thread From: Thomas Petazzoni via buildroot @ 2026-09-18 7:35 UTC (permalink / raw) To: Yegor Yefremov; +Cc: buildroot On Fri, Sep 18, 2026 at 09:22:48AM +0200, Yegor Yefremov via buildroot wrote: > From: Yegor Yefremov <yegorslists@googlemail.com> > > For change log, see: > > https://github.com/mguentner/cannelloni/releases/tag/v2.0.1 > https://github.com/mguentner/cannelloni/releases/tag/v2.1.0 > https://github.com/mguentner/cannelloni/releases/tag/v2.1.1 > https://github.com/mguentner/cannelloni/releases/tag/v2.1.2 > > 2.1.2 fixes CVE-2026-37539 (CVSS 3.1 score 9.8, CWE-121): a stack based > buffer overflow in CAN frame parsing, in parseCANFrame() in parser.cpp > and decodeFrame() in decoder.cpp, allowing remote attackers to cause a > denial of service (crash) or possibly execute arbitrary code via > crafted CAN FD frames. > > The advisory names v2.0.0 explicitly, so the version used so far is > affected. The CVE is not reported by > https://security.buildroot.org/master/component/cannelloni because its > NVD entry has no CPE data (vendor and product are both "n/a") and can > therefore not be matched against the package version. > > Apart from the security fix, 2.0.0..2.1.2 contains only a handful of > changes: undeliverable frames are dropped after a timeout on a broken > CAN bus, variable length arrays are gone, the default remote address is > fixed, and pthreads are looked up with the CMake module instead of by > hand. 2.1.1 is a maintenance release only, as the 2.1.0 tag pointed to > a commit that was not the final one. > > Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> > Assisted-by: Claude:claude-opus-5 Applied to master, thanks! Best regards, Thomas Petazzoni -- Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCH v2] package/cannelloni: security bump to version 2.1.2 2026-09-18 7:22 ` [Buildroot] [PATCH v2] package/cannelloni: security " Yegor Yefremov via buildroot 2026-09-18 7:35 ` Thomas Petazzoni via buildroot @ 2026-09-25 14:47 ` Raphaël Mélotte via buildroot 1 sibling, 0 replies; 5+ messages in thread From: Raphaël Mélotte via buildroot @ 2026-09-25 14:47 UTC (permalink / raw) To: buildroot, Yegor Yefremov; +Cc: Raphaël Mélotte In reply of: > For change log, see: > > https://github.com/mguentner/cannelloni/releases/tag/v2.0.1 > https://github.com/mguentner/cannelloni/releases/tag/v2.1.0 > https://github.com/mguentner/cannelloni/releases/tag/v2.1.1 > https://github.com/mguentner/cannelloni/releases/tag/v2.1.2 > > 2.1.2 fixes CVE-2026-37539 (CVSS 3.1 score 9.8, CWE-121): a stack based > buffer overflow in CAN frame parsing, in parseCANFrame() in parser.cpp > and decodeFrame() in decoder.cpp, allowing remote attackers to cause a > denial of service (crash) or possibly execute arbitrary code via > crafted CAN FD frames. > > The advisory names v2.0.0 explicitly, so the version used so far is > affected. The CVE is not reported by > https://security.buildroot.org/master/component/cannelloni because its > NVD entry has no CPE data (vendor and product are both "n/a") and can > therefore not be matched against the package version. > > Apart from the security fix, 2.0.0..2.1.2 contains only a handful of > changes: undeliverable frames are dropped after a timeout on a broken > CAN bus, variable length arrays are gone, the default remote address is > fixed, and pthreads are looked up with the CMake module instead of by > hand. 2.1.1 is a maintenance release only, as the 2.1.0 tag pointed to > a commit that was not the final one. > > Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> > Assisted-by: Claude:claude-opus-5 Applied to 2025.02.x, 2026.08.x. Thanks > --- > > Changes v1 -> v2 (suggested by Thomas Petazzoni): > - Retitle as a security bump, as 2.1.2 fixes CVE-2026-37539 > - Describe the CVE, confirm that the 2.0.0 we had is affected, explain > why security.buildroot.org does not report it, and summarize the > remaining 2.0.0..2.1.2 changes > - Link the change logs of all releases in 2.0.0..2.1.2, not just 2.1.2 > > package/cannelloni/cannelloni.hash | 2 +- > package/cannelloni/cannelloni.mk | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/package/cannelloni/cannelloni.hash b/package/cannelloni/cannelloni.hash > index 625e43d157..6b45d497e4 100644 > --- a/package/cannelloni/cannelloni.hash > +++ b/package/cannelloni/cannelloni.hash > @@ -1,3 +1,3 @@ > # Locally computed > -sha256 3dde63727549d4a39154e78b95f4a5dad96af236ca6cef531f347c0b923c74d5 cannelloni-2.0.0.tar.gz > +sha256 c704707f7dd9f1ed64e9195097809f8882c03b1fa0a79864b8e3bf286521e3d7 cannelloni-2.1.2.tar.gz > sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 gpl-2.0.txt > diff --git a/package/cannelloni/cannelloni.mk b/package/cannelloni/cannelloni.mk > index 7978cfccf5..2e6a61545e 100644 > --- a/package/cannelloni/cannelloni.mk > +++ b/package/cannelloni/cannelloni.mk > @@ -4,7 +4,7 @@ > # > ################################################################################ > > -CANNELLONI_VERSION = 2.0.0 > +CANNELLONI_VERSION = 2.1.2 > CANNELLONI_SITE = $(call github,mguentner,cannelloni,v$(CANNELLONI_VERSION)) > CANNELLONI_LICENSE = GPL-2.0 > CANNELLONI_LICENSE_FILES = gpl-2.0.txt _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-09-25 14:47 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-08-20 12:02 [Buildroot] [PATCH] package/cannelloni: bump to version 2.1.2 yegorslists--- via buildroot 2026-09-17 15:17 ` Thomas Petazzoni via buildroot 2026-09-18 7:22 ` [Buildroot] [PATCH v2] package/cannelloni: security " Yegor Yefremov via buildroot 2026-09-18 7:35 ` Thomas Petazzoni via buildroot 2026-09-25 14:47 ` Raphaël Mélotte via buildroot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox