From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Thu, 12 Oct 2023 08:24:04 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qqp77-005TuL-57 for lore@lore.pengutronix.de; Thu, 12 Oct 2023 08:24:04 +0200 Received: from localhost ([127.0.0.1] helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1qqp75-0006Hr-P3; Thu, 12 Oct 2023 08:24:03 +0200 Received: from mail.thorsis.com ([92.198.35.195]) by metis.whiteo.stw.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qqp6j-0006HT-Gx for ptxdist@pengutronix.de; Thu, 12 Oct 2023 08:23:43 +0200 Date: Thu, 12 Oct 2023 08:22:39 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=thorsis.com; s=default; t=1697091820; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:content-type:content-type:in-reply-to:in-reply-to: references:references; bh=VSwARm7C5l8L2UMVrJgDhM/XvWppuOxi1OGGWpOAksU=; b=gXHYX+Vdp7cdmKZn/5/qeoA8dJbb5sEJsMxTDboi7mpaly/u/FIxQrWSDBSjIkegpUtMHL 7bhgaFRJSi3IL2mPU7uKM5U4/vE2V/pX9cZvT0/EV+UMcRgxnXNQbH81q4Rp6qyEDwRwIo 8/T0dhoSQ4fe41wDJgjKtkoPkVFtpG1BBEtMSDLHYwragRaOS8wNew/BCagJUZ+wvzojjK Nt5LqYUxCrf2HpQxt+W3/l2OMhLCTBDmvNhj4AxV3xe+nC3qnjiQtAaM6qpGQo3Je8K5ra XeS29MP+qafXe6u0FiM1fbeHR+PIYGbPU6ipul+oIPSSwXpK0KymkT/jE/I1PQ== From: Alexander Dahl To: ptxdist@pengutronix.de Message-ID: <20231012-gaining-recycling-7fbcc78e2c38@ifak-system.com> Mail-Followup-To: ptxdist@pengutronix.de References: <20231011180236.1768772-1-christian.melki@t2data.com> Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20231011180236.1768772-1-christian.melki@t2data.com> X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-2.8 required=4.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2 Subject: Re: [ptxdist] [PATCH] libcurl: Version bump. 8.3.0 -> 8.4.0 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Hei hei, Am Wed, Oct 11, 2023 at 08:02:36PM +0200 schrieb Christian Melki: > Mostly smaller fixes. > https://curl.se/changes.html#8_4_0 > > Plugs two CVEs: > CVE-2023-38546 cookie injection with none file > CVE-2023-38545 SOCKS5 heap buffer overflow For anyone interested, there's a nice read up on that heap overflow in the blog of the maintainer: https://daniel.haxx.se/blog/2023/10/11/how-i-made-a-heap-overflow-in-curl/ Greets Alex > > Signed-off-by: Christian Melki > --- > rules/libcurl.make | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/rules/libcurl.make b/rules/libcurl.make > index ad615bd87..61797e9ae 100644 > --- a/rules/libcurl.make > +++ b/rules/libcurl.make > @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_LIBCURL) += libcurl > # > # Paths and names > # > -LIBCURL_VERSION := 8.3.0 > -LIBCURL_MD5 := 2fc6cf5cefa8b73e3826aa24befdccff > +LIBCURL_VERSION := 8.4.0 > +LIBCURL_MD5 := 8424597f247da68b6041dd7f9ca367fe > LIBCURL := curl-$(LIBCURL_VERSION) > LIBCURL_SUFFIX := tar.xz > LIBCURL_URL := https://curl.se/download/$(LIBCURL).$(LIBCURL_SUFFIX) > -- > 2.34.1 > >