From 040ab175df6337bf39a609adea07a7756c309be8 Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Thu, 8 Dec 2022 21:21:04 +0100 Subject: [PATCH] package/capnproto: security bump to version 0.9.2 Fix CVE-2022-46149: Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error handling list-of-list. This issue may lead someone to remotely segfault a peer by sending it a malicious message, if the victim performs certain actions on a list-of-pointer type. Exfiltration of memory is possible if the victim performs additional certain actions on a list-of-pointer type. To be vulnerable, an application must perform a specific sequence of actions, described in the GitHub Security Advisory. The bug is present in inlined code, therefore the fix will require rebuilding dependent applications. Cap'n Proto has C++ fixes available in versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3. https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx https://dwrensha.github.io/capnproto-rust/2022/11/30/out_of_bounds_memory_access_bug.html Signed-off-by: Fabrice Fontaine Signed-off-by: Thomas Petazzoni --- package/capnproto/capnproto.hash | 2 +- package/capnproto/capnproto.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/capnproto/capnproto.hash b/package/capnproto/capnproto.hash index 7fd0e6158b..c3233e7c8b 100644 --- a/package/capnproto/capnproto.hash +++ b/package/capnproto/capnproto.hash @@ -1,3 +1,3 @@ # Locally calculated -sha256 daf49f794560f715e2f4651c842aaece2d065d4216834c5c3d3254962e35b535 capnproto-0.9.1.tar.gz +sha256 4fe1ca8ab90859f33f08d2c4fcd7099e2983b0b946beecebd2fe051e3a64c67e capnproto-0.9.2.tar.gz sha256 9564998c8d7f270a61a8b89869a8d17a9d5e3783b64027788b5e339ec8479e10 LICENSE diff --git a/package/capnproto/capnproto.mk b/package/capnproto/capnproto.mk index 7fc07043fb..23f128455a 100644 --- a/package/capnproto/capnproto.mk +++ b/package/capnproto/capnproto.mk @@ -4,7 +4,7 @@ # ################################################################################ -CAPNPROTO_VERSION = 0.9.1 +CAPNPROTO_VERSION = 0.9.2 CAPNPROTO_SITE = $(call github,capnproto,capnproto,v$(CAPNPROTO_VERSION)) CAPNPROTO_LICENSE = MIT CAPNPROTO_LICENSE_FILES = LICENSE