From 0c29b4281d5a1c55739c62438f8d7676d7a16823 Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Sat, 4 Mar 2023 14:52:58 +0100 Subject: [PATCH] package/exfat: security bump to version 1.4.0 - Fix CVE-2022-29973: relan exFAT 1.3.0 allows local users to obtain sensitive information (data from deleted files in the filesystem) in certain situations involving offsets beyond ValidDataLength. - libfuse3 is supported since https://github.com/relan/exfat/commit/7cbc1544a4f68d8b4d33b187a053fc554405c56e https://github.com/relan/exfat/releases/tag/v1.4.0 Signed-off-by: Fabrice Fontaine Signed-off-by: Peter Korsgaard --- package/exfat/Config.in | 2 +- package/exfat/exfat.hash | 2 +- package/exfat/exfat.mk | 6 ++++-- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/package/exfat/Config.in b/package/exfat/Config.in index c0b4eabe11..c0ed2570d9 100644 --- a/package/exfat/Config.in +++ b/package/exfat/Config.in @@ -4,7 +4,7 @@ config BR2_PACKAGE_EXFAT depends on BR2_USE_MMU # libfuse depends on BR2_USE_WCHAR depends on !BR2_STATIC_LIBS # libfuse - select BR2_PACKAGE_LIBFUSE + select BR2_PACKAGE_LIBFUSE3 if !BR2_PACKAGE_LIBFUSE help A full-featured exFAT file system implementation for GNU/Linux and other Unix-like systems as a FUSE module. diff --git a/package/exfat/exfat.hash b/package/exfat/exfat.hash index b40fc7f0e5..c6082a403a 100644 --- a/package/exfat/exfat.hash +++ b/package/exfat/exfat.hash @@ -1,3 +1,3 @@ # Locally calculated -sha256 07652136064da5e4d32df5555f88c138ffa4835a23b88a5bae2015f21006e0d3 fuse-exfat-1.3.0.tar.gz +sha256 a1cfedc55e0e7a12c184605aa0f0bf44b24a3fb272449b20b2c8bbe6edb3001e fuse-exfat-1.4.0.tar.gz sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING diff --git a/package/exfat/exfat.mk b/package/exfat/exfat.mk index c0ef77a113..a8efe5b0ba 100644 --- a/package/exfat/exfat.mk +++ b/package/exfat/exfat.mk @@ -4,10 +4,12 @@ # ################################################################################ -EXFAT_VERSION = 1.3.0 +EXFAT_VERSION = 1.4.0 EXFAT_SITE = https://github.com/relan/exfat/releases/download/v$(EXFAT_VERSION) EXFAT_SOURCE = fuse-exfat-$(EXFAT_VERSION).tar.gz -EXFAT_DEPENDENCIES = libfuse host-pkgconf +EXFAT_DEPENDENCIES = \ + $(if $(BR2_PACKAGE_LIBFUSE3),libfuse3,libfuse) \ + host-pkgconf EXFAT_LICENSE = GPL-2.0+ EXFAT_LICENSE_FILES = COPYING EXFAT_CPE_ID_VENDOR = exfat_project