[Buildroot] [PATCH for 2025.02.x] package/swtpm: security bump to v0.8.3

[Buildroot] [PATCH for 2025.02.x] package/swtpm: security bump to v0.8.3

[Titouan Christophe via buildroot]

This fixes the following vulnerability:

- CVE-2026-75900: An out-of-bounds read vulnerability was found in swtpm's
                  SWTPM_NVRAM_CheckHeader() function

See the release notes:
https://github.com/stefanberger/swtpm/releases/tag/v0.8.3

(alternative to commit b6a653e5fc31ab9e0e0b105583a693938b59711a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
---
 package/swtpm/swtpm.hash | 4 +++-
 package/swtpm/swtpm.mk   | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/package/swtpm/swtpm.hash b/package/swtpm/swtpm.hash
index 934d3b6ee0..8d723886c4 100644
--- a/package/swtpm/swtpm.hash
+++ b/package/swtpm/swtpm.hash
@@ -1,2 +1,4 @@
-sha256  b281b4e8c39f68e1928675f788abc70072e4081152e129144359a8c5c304c06b  swtpm-0.8.2.tar.gz
+# Locally computed after verifying signature from
+# https://github.com/stefanberger/swtpm/releases/download/v0.8.3/v0.8.3.tar.gz.asc
+sha256  5c416e3a241d4adb61c66ac04ea46699885476c6c3aaa86011386e14fa4a67ea  swtpm-0.8.3.tar.gz
 sha256  19d27d6e96d07022e5e688f75c974f1ceb9aae9e90e0fccae68666d02099cc4b  LICENSE
diff --git a/package/swtpm/swtpm.mk b/package/swtpm/swtpm.mk
index 598d56cf1d..636a385db8 100644
--- a/package/swtpm/swtpm.mk
+++ b/package/swtpm/swtpm.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SWTPM_VERSION = 0.8.2
+SWTPM_VERSION = 0.8.3
 SWTPM_SITE = $(call github,stefanberger,swtpm,v$(SWTPM_VERSION))
 SWTPM_LICENSE = BSD-4-Clause
 SWTPM_LICENSE_FILES = LICENSE
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH for 2025.02.x] package/swtpm: security bump to v0.8.3

[Jarkko Sakkinen via buildroot]

On Mon, Nov 02, 2026 at 11:16:49AM +0100, Titouan Christophe wrote:
> This fixes the following vulnerability:
> 
> - CVE-2026-75900: An out-of-bounds read vulnerability was found in swtpm's
>                   SWTPM_NVRAM_CheckHeader() function
> 
> See the release notes:
> https://github.com/stefanberger/swtpm/releases/tag/v0.8.3
> 
> (alternative to commit b6a653e5fc31ab9e0e0b105583a693938b59711a)
> Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
> ---
>  package/swtpm/swtpm.hash | 4 +++-
>  package/swtpm/swtpm.mk   | 2 +-
>  2 files changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/package/swtpm/swtpm.hash b/package/swtpm/swtpm.hash
> index 934d3b6ee0..8d723886c4 100644
> --- a/package/swtpm/swtpm.hash
> +++ b/package/swtpm/swtpm.hash
> @@ -1,2 +1,4 @@
> -sha256  b281b4e8c39f68e1928675f788abc70072e4081152e129144359a8c5c304c06b  swtpm-0.8.2.tar.gz
> +# Locally computed after verifying signature from
> +# https://github.com/stefanberger/swtpm/releases/download/v0.8.3/v0.8.3.tar.gz.asc
> +sha256  5c416e3a241d4adb61c66ac04ea46699885476c6c3aaa86011386e14fa4a67ea  swtpm-0.8.3.tar.gz
>  sha256  19d27d6e96d07022e5e688f75c974f1ceb9aae9e90e0fccae68666d02099cc4b  LICENSE
> diff --git a/package/swtpm/swtpm.mk b/package/swtpm/swtpm.mk
> index 598d56cf1d..636a385db8 100644
> --- a/package/swtpm/swtpm.mk
> +++ b/package/swtpm/swtpm.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -SWTPM_VERSION = 0.8.2
> +SWTPM_VERSION = 0.8.3
>  SWTPM_SITE = $(call github,stefanberger,swtpm,v$(SWTPM_VERSION))
>  SWTPM_LICENSE = BSD-4-Clause
>  SWTPM_LICENSE_FILES = LICENSE
> -- 
> 2.55.0
> 

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

Br, Jarkko
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot