NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/capnproto: security bump to version 0.9.2

Browse Source 
Fix CVE-2022-46149: Cap'n Proto is a data interchange format and remote
procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1,
0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust
implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to
out-of-bounds read due to logic error handling list-of-list. This issue
may lead someone to remotely segfault a peer by sending it a malicious
message, if the victim performs certain actions on a list-of-pointer
type. Exfiltration of memory is possible if the victim performs
additional certain actions on a list-of-pointer type. To be vulnerable,
an application must perform a specific sequence of actions, described in
the GitHub Security Advisory. The bug is present in inlined code,
therefore the fix will require rebuilding dependent applications. Cap'n
Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and
0.10.3.

https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx
https://dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Fabrice Fontaine 2022-12-08 21:21:04 +01:00 committed by Thomas Petazzoni
parent 66f3cc0b96
commit 040ab175df
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package/capnproto/capnproto.hash
View File

@ -1,3 +1,3 @@
# Locally calculated
sha256 daf49f794560f715e2f4651c842aaece2d065d4216834c5c3d3254962e35b535 capnproto-0.9.1.tar.gz
sha256 4fe1ca8ab90859f33f08d2c4fcd7099e2983b0b946beecebd2fe051e3a64c67e capnproto-0.9.2.tar.gz
sha256 9564998c8d7f270a61a8b89869a8d17a9d5e3783b64027788b5e339ec8479e10 LICENSE

2
package/capnproto/capnproto.mk
View File

@ -4,7 +4,7 @@
#
################################################################################
CAPNPROTO_VERSION = 0.9.1
CAPNPROTO_VERSION = 0.9.2
CAPNPROTO_SITE = $(call github,capnproto,capnproto,v$(CAPNPROTO_VERSION))
CAPNPROTO_LICENSE = MIT
CAPNPROTO_LICENSE_FILES = LICENSE