NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/micropython: security bump to version 1.22.0

Browse Source 
- Use official tarball
- Update hash of license file (some packages have been added or removed
  but the list of licenses is the same)
- Fix CVE-2023-7158: A vulnerability was found in MicroPython up to
  1.21.0. It has been classified as critical. Affected is the function
  slice_indices of the file objslice.c. The manipulation leads to
  heap-based buffer overflow. It is possible to launch the attack
  remotely. The exploit has been disclosed to the public and may be
  used. Upgrading to version 1.22.0 is able to address this issue. It is
  recommended to upgrade the affected component. The identifier of this
  vulnerability is VDB-249180.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
This commit is contained in:
Fabrice Fontaine 2024-01-08 23:00:26 +01:00 committed by Yann E. MORIN
parent c87746afef
commit 1e12b7dd49
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
package/micropython/micropython.hash
View File

@ -1,3 +1,3 @@
#locally computed
sha256 c980ad7e742491df0dc10db2958137dbbf9aa7a8009e102fc75f4c0cac2d6b5e micropython-1.19.1.tar.gz
sha256 0f678c2abd7fe2cfca36693630506bbcbdfc219bd04bf4a02fe3b094ae4c666f LICENSE
sha256 a042764f0b6f6d92b267454c5bd5afcb83fc3900119f2583672aac571e661924 micropython-1.22.0.tar.xz
sha256 d9e0e0395867c899090e150213bc2b417e970c17355a8d48300089875b3c8037 LICENSE

5
package/micropython/micropython.mk
View File

@ -4,8 +4,9 @@
#
################################################################################
MICROPYTHON_VERSION = 1.19.1
MICROPYTHON_SITE = $(call github,micropython,micropython,v$(MICROPYTHON_VERSION))
MICROPYTHON_VERSION = 1.22.0
MICROPYTHON_SITE = https://micropython.org/resources/source
MICROPYTHON_SOURCE = micropython-$(MICROPYTHON_VERSION).tar.xz
# Micropython has a lot of code copied from other projects, and also a number
# of submodules for various libs. However, we don't even clone the submodules,
# and most of the copied code is not used in the unix build.