kumquat-buildroot/package/cryptsetup/cryptsetup.hash

# From https://www.kernel.org/pub/linux/utils/cryptsetup/v2.3/sha256sums.asc
sha256  9d16eebb96b53b514778e813019b8dd15fea9fec5aafde9fae5febf59df83773  cryptsetup-2.3.4.tar.xz
sha256  45670cce8b6a0ddd66c8016cd8ccef6cd71f35717cbacc7f1e895b3855207b33  COPYING
sha256  8c33cc37871654ec7ed87e6fbb896c8cf33ef5ef05b1611a5aed857596ffafa5  COPYING.LGPL
package/cryptsetup: bump to version 2.3.3 - Update indentation in hash file (two spaces) - Send patch upstream Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> 2020-06-21 20:56:24 +02:00			`# From https://www.kernel.org/pub/linux/utils/cryptsetup/v2.3/sha256sums.asc`
package/cryptsetup: security bump to version 2.3.4 Fix CVE-2020-14382: A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting itself as LUKS2 container. The bug is in segments validation code in file 'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct crypt_device cd, json_object hdr_jobj) where the code does not check for possible overflow on memory allocation used for intervals array (see statement "intervals = malloc(first_backup * sizeof(intervals));"). Due to the bug, library can be tricked* to expect such allocation was successful but for far less memory then originally expected. Later it may read data FROM image crafted by an attacker and actually write such data BEYOND allocated memory. https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.3/v2.3.4-ReleaseNotes Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2020-10-25 15:39:12 +01:00			`sha256 9d16eebb96b53b514778e813019b8dd15fea9fec5aafde9fae5febf59df83773 cryptsetup-2.3.4.tar.xz`
package/cryptsetup: bump to version 2.3.3 - Update indentation in hash file (two spaces) - Send patch upstream Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> 2020-06-21 20:56:24 +02:00			`sha256 45670cce8b6a0ddd66c8016cd8ccef6cd71f35717cbacc7f1e895b3855207b33 COPYING`
			`sha256 8c33cc37871654ec7ed87e6fbb896c8cf33ef5ef05b1611a5aed857596ffafa5 COPYING.LGPL`