* [ptxdist] [PATCH] screen: Version bump. 5.0.0 -> 5.0.1
@ 2025-05-15 17:38 Christian Melki
2025-05-16 7:46 ` Michael Olbrich
2025-05-16 22:02 ` [ptxdist] [APPLIED] " Michael Olbrich
0 siblings, 2 replies; 5+ messages in thread
From: Christian Melki @ 2025-05-15 17:38 UTC (permalink / raw)
To: ptxdist
Security and other fixes.
https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html
Security fixes:
CVE-2025-46805: do NOT send signals with root privileges
CVE-2025-46804: avoid file existence test information leaks
CVE-2025-46803: apply safe PTY default mode of 0620
CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher
CVE-2025-23395: reintroduce lf_secreopen() for logfile
* Forward patchset, applies cleanly.
Signed-off-by: Christian Melki <christian.melki@t2data.com>
---
.../{screen-5.0.0 => screen-5.0.1}/0001-suppress_remap.patch | 0
patches/{screen-5.0.0 => screen-5.0.1}/autogen.sh | 0
patches/{screen-5.0.0 => screen-5.0.1}/series | 0
rules/screen.make | 4 ++--
4 files changed, 2 insertions(+), 2 deletions(-)
rename patches/{screen-5.0.0 => screen-5.0.1}/0001-suppress_remap.patch (100%)
rename patches/{screen-5.0.0 => screen-5.0.1}/autogen.sh (100%)
rename patches/{screen-5.0.0 => screen-5.0.1}/series (100%)
diff --git a/patches/screen-5.0.0/0001-suppress_remap.patch b/patches/screen-5.0.1/0001-suppress_remap.patch
similarity index 100%
rename from patches/screen-5.0.0/0001-suppress_remap.patch
rename to patches/screen-5.0.1/0001-suppress_remap.patch
diff --git a/patches/screen-5.0.0/autogen.sh b/patches/screen-5.0.1/autogen.sh
similarity index 100%
rename from patches/screen-5.0.0/autogen.sh
rename to patches/screen-5.0.1/autogen.sh
diff --git a/patches/screen-5.0.0/series b/patches/screen-5.0.1/series
similarity index 100%
rename from patches/screen-5.0.0/series
rename to patches/screen-5.0.1/series
diff --git a/rules/screen.make b/rules/screen.make
index 1bac9b8b8..69a65a9b8 100644
--- a/rules/screen.make
+++ b/rules/screen.make
@@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_SCREEN) += screen
#
# Paths and names
#
-SCREEN_VERSION := 5.0.0
-SCREEN_MD5 := befc115989242ed4bceeff8d8bfeb4e6
+SCREEN_VERSION := 5.0.1
+SCREEN_MD5 := 4306c5446abd48b7899a211c4d0456b2
SCREEN := screen-$(SCREEN_VERSION)
SCREEN_SUFFIX := tar.gz
SCREEN_URL := $(call ptx/mirror, GNU, screen/$(SCREEN).$(SCREEN_SUFFIX))
--
2.34.1
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [ptxdist] [PATCH] screen: Version bump. 5.0.0 -> 5.0.1
2025-05-15 17:38 [ptxdist] [PATCH] screen: Version bump. 5.0.0 -> 5.0.1 Christian Melki
@ 2025-05-16 7:46 ` Michael Olbrich
2025-05-16 16:25 ` Christian Melki
2025-05-16 22:02 ` [ptxdist] [APPLIED] " Michael Olbrich
1 sibling, 1 reply; 5+ messages in thread
From: Michael Olbrich @ 2025-05-16 7:46 UTC (permalink / raw)
To: Christian Melki; +Cc: ptxdist
On Thu, May 15, 2025 at 07:38:51PM +0200, Christian Melki wrote:
> Security and other fixes.
> https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html
>
> Security fixes:
> CVE-2025-46805: do NOT send signals with root privileges
> CVE-2025-46804: avoid file existence test information leaks
> CVE-2025-46803: apply safe PTY default mode of 0620
> CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher
> CVE-2025-23395: reintroduce lf_secreopen() for logfile
>
> * Forward patchset, applies cleanly.
>
> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> ---
> .../{screen-5.0.0 => screen-5.0.1}/0001-suppress_remap.patch | 0
> patches/{screen-5.0.0 => screen-5.0.1}/autogen.sh | 0
> patches/{screen-5.0.0 => screen-5.0.1}/series | 0
> rules/screen.make | 4 ++--
> 4 files changed, 2 insertions(+), 2 deletions(-)
> rename patches/{screen-5.0.0 => screen-5.0.1}/0001-suppress_remap.patch (100%)
> rename patches/{screen-5.0.0 => screen-5.0.1}/autogen.sh (100%)
> rename patches/{screen-5.0.0 => screen-5.0.1}/series (100%)
>
> diff --git a/patches/screen-5.0.0/0001-suppress_remap.patch b/patches/screen-5.0.1/0001-suppress_remap.patch
> similarity index 100%
> rename from patches/screen-5.0.0/0001-suppress_remap.patch
> rename to patches/screen-5.0.1/0001-suppress_remap.patch
> diff --git a/patches/screen-5.0.0/autogen.sh b/patches/screen-5.0.1/autogen.sh
> similarity index 100%
> rename from patches/screen-5.0.0/autogen.sh
> rename to patches/screen-5.0.1/autogen.sh
> diff --git a/patches/screen-5.0.0/series b/patches/screen-5.0.1/series
> similarity index 100%
> rename from patches/screen-5.0.0/series
> rename to patches/screen-5.0.1/series
> diff --git a/rules/screen.make b/rules/screen.make
> index 1bac9b8b8..69a65a9b8 100644
> --- a/rules/screen.make
> +++ b/rules/screen.make
> @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_SCREEN) += screen
> #
> # Paths and names
> #
> -SCREEN_VERSION := 5.0.0
> -SCREEN_MD5 := befc115989242ed4bceeff8d8bfeb4e6
> +SCREEN_VERSION := 5.0.1
> +SCREEN_MD5 := 4306c5446abd48b7899a211c4d0456b2
Hmm, I'm getting a different md5 here. Can you check what is going on here?
Michael
> SCREEN := screen-$(SCREEN_VERSION)
> SCREEN_SUFFIX := tar.gz
> SCREEN_URL := $(call ptx/mirror, GNU, screen/$(SCREEN).$(SCREEN_SUFFIX))
> --
> 2.34.1
>
>
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [ptxdist] [PATCH] screen: Version bump. 5.0.0 -> 5.0.1
2025-05-16 7:46 ` Michael Olbrich
@ 2025-05-16 16:25 ` Christian Melki
2025-05-16 17:55 ` Michael Olbrich
0 siblings, 1 reply; 5+ messages in thread
From: Christian Melki @ 2025-05-16 16:25 UTC (permalink / raw)
To: Michael Olbrich; +Cc: ptxdist
Hi Michael.
Yeah. Looks like release mishaps.
They didn't release the tarball for +72h after the announcement.
And it seems that the first one (the one I sent) was botched.
You can see the my (and others) complaint in these threads:
https://www.phoronix.com/forums/forum/software/general-linux-open-source/1546098-gnu-screen-5-0-1-released-due-to-several-security-vulnerabilities/page2
https://lists.gnu.org/archive/html/screen-devel/2025-05/msg00018.html
At this point I'd just update the md5 since they reused the same version
number. Do you want me to send a new one?
Regards,
Christian
On 5/16/25 9:46 AM, Michael Olbrich wrote:
> On Thu, May 15, 2025 at 07:38:51PM +0200, Christian Melki wrote:
>> Security and other fixes.
>> https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html
>>
>> Security fixes:
>> CVE-2025-46805: do NOT send signals with root privileges
>> CVE-2025-46804: avoid file existence test information leaks
>> CVE-2025-46803: apply safe PTY default mode of 0620
>> CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher
>> CVE-2025-23395: reintroduce lf_secreopen() for logfile
>>
>> * Forward patchset, applies cleanly.
>>
>> Signed-off-by: Christian Melki <christian.melki@t2data.com>
>> ---
>> .../{screen-5.0.0 => screen-5.0.1}/0001-suppress_remap.patch | 0
>> patches/{screen-5.0.0 => screen-5.0.1}/autogen.sh | 0
>> patches/{screen-5.0.0 => screen-5.0.1}/series | 0
>> rules/screen.make | 4 ++--
>> 4 files changed, 2 insertions(+), 2 deletions(-)
>> rename patches/{screen-5.0.0 => screen-5.0.1}/0001-suppress_remap.patch (100%)
>> rename patches/{screen-5.0.0 => screen-5.0.1}/autogen.sh (100%)
>> rename patches/{screen-5.0.0 => screen-5.0.1}/series (100%)
>>
>> diff --git a/patches/screen-5.0.0/0001-suppress_remap.patch b/patches/screen-5.0.1/0001-suppress_remap.patch
>> similarity index 100%
>> rename from patches/screen-5.0.0/0001-suppress_remap.patch
>> rename to patches/screen-5.0.1/0001-suppress_remap.patch
>> diff --git a/patches/screen-5.0.0/autogen.sh b/patches/screen-5.0.1/autogen.sh
>> similarity index 100%
>> rename from patches/screen-5.0.0/autogen.sh
>> rename to patches/screen-5.0.1/autogen.sh
>> diff --git a/patches/screen-5.0.0/series b/patches/screen-5.0.1/series
>> similarity index 100%
>> rename from patches/screen-5.0.0/series
>> rename to patches/screen-5.0.1/series
>> diff --git a/rules/screen.make b/rules/screen.make
>> index 1bac9b8b8..69a65a9b8 100644
>> --- a/rules/screen.make
>> +++ b/rules/screen.make
>> @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_SCREEN) += screen
>> #
>> # Paths and names
>> #
>> -SCREEN_VERSION := 5.0.0
>> -SCREEN_MD5 := befc115989242ed4bceeff8d8bfeb4e6
>> +SCREEN_VERSION := 5.0.1
>> +SCREEN_MD5 := 4306c5446abd48b7899a211c4d0456b2
>
> Hmm, I'm getting a different md5 here. Can you check what is going on here?
>
> Michael
>
>> SCREEN := screen-$(SCREEN_VERSION)
>> SCREEN_SUFFIX := tar.gz
>> SCREEN_URL := $(call ptx/mirror, GNU, screen/$(SCREEN).$(SCREEN_SUFFIX))
>> --
>> 2.34.1
>>
>>
>>
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [ptxdist] [PATCH] screen: Version bump. 5.0.0 -> 5.0.1
2025-05-16 16:25 ` Christian Melki
@ 2025-05-16 17:55 ` Michael Olbrich
0 siblings, 0 replies; 5+ messages in thread
From: Michael Olbrich @ 2025-05-16 17:55 UTC (permalink / raw)
To: Christian Melki; +Cc: ptxdist
On Fri, May 16, 2025 at 06:25:56PM +0200, Christian Melki wrote:
> Hi Michael.
>
> Yeah. Looks like release mishaps.
> They didn't release the tarball for +72h after the announcement.
> And it seems that the first one (the one I sent) was botched.
> You can see the my (and others) complaint in these threads:
>
> https://www.phoronix.com/forums/forum/software/general-linux-open-source/1546098-gnu-screen-5-0-1-released-due-to-several-security-vulnerabilities/page2
>
> https://lists.gnu.org/archive/html/screen-devel/2025-05/msg00018.html
>
> At this point I'd just update the md5 since they reused the same version
> number. Do you want me to send a new one?
I'll modify the commit, not need to send a new version.
Michael
> Regards,
> Christian
>
>
> On 5/16/25 9:46 AM, Michael Olbrich wrote:
> > On Thu, May 15, 2025 at 07:38:51PM +0200, Christian Melki wrote:
> >> Security and other fixes.
> >> https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html
> >>
> >> Security fixes:
> >> CVE-2025-46805: do NOT send signals with root privileges
> >> CVE-2025-46804: avoid file existence test information leaks
> >> CVE-2025-46803: apply safe PTY default mode of 0620
> >> CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher
> >> CVE-2025-23395: reintroduce lf_secreopen() for logfile
> >>
> >> * Forward patchset, applies cleanly.
> >>
> >> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> >> ---
> >> .../{screen-5.0.0 => screen-5.0.1}/0001-suppress_remap.patch | 0
> >> patches/{screen-5.0.0 => screen-5.0.1}/autogen.sh | 0
> >> patches/{screen-5.0.0 => screen-5.0.1}/series | 0
> >> rules/screen.make | 4 ++--
> >> 4 files changed, 2 insertions(+), 2 deletions(-)
> >> rename patches/{screen-5.0.0 => screen-5.0.1}/0001-suppress_remap.patch (100%)
> >> rename patches/{screen-5.0.0 => screen-5.0.1}/autogen.sh (100%)
> >> rename patches/{screen-5.0.0 => screen-5.0.1}/series (100%)
> >>
> >> diff --git a/patches/screen-5.0.0/0001-suppress_remap.patch b/patches/screen-5.0.1/0001-suppress_remap.patch
> >> similarity index 100%
> >> rename from patches/screen-5.0.0/0001-suppress_remap.patch
> >> rename to patches/screen-5.0.1/0001-suppress_remap.patch
> >> diff --git a/patches/screen-5.0.0/autogen.sh b/patches/screen-5.0.1/autogen.sh
> >> similarity index 100%
> >> rename from patches/screen-5.0.0/autogen.sh
> >> rename to patches/screen-5.0.1/autogen.sh
> >> diff --git a/patches/screen-5.0.0/series b/patches/screen-5.0.1/series
> >> similarity index 100%
> >> rename from patches/screen-5.0.0/series
> >> rename to patches/screen-5.0.1/series
> >> diff --git a/rules/screen.make b/rules/screen.make
> >> index 1bac9b8b8..69a65a9b8 100644
> >> --- a/rules/screen.make
> >> +++ b/rules/screen.make
> >> @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_SCREEN) += screen
> >> #
> >> # Paths and names
> >> #
> >> -SCREEN_VERSION := 5.0.0
> >> -SCREEN_MD5 := befc115989242ed4bceeff8d8bfeb4e6
> >> +SCREEN_VERSION := 5.0.1
> >> +SCREEN_MD5 := 4306c5446abd48b7899a211c4d0456b2
> >
> > Hmm, I'm getting a different md5 here. Can you check what is going on here?
> >
> > Michael
> >
> >> SCREEN := screen-$(SCREEN_VERSION)
> >> SCREEN_SUFFIX := tar.gz
> >> SCREEN_URL := $(call ptx/mirror, GNU, screen/$(SCREEN).$(SCREEN_SUFFIX))
> >> --
> >> 2.34.1
> >>
> >>
> >>
> >
>
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [ptxdist] [APPLIED] screen: Version bump. 5.0.0 -> 5.0.1
2025-05-15 17:38 [ptxdist] [PATCH] screen: Version bump. 5.0.0 -> 5.0.1 Christian Melki
2025-05-16 7:46 ` Michael Olbrich
@ 2025-05-16 22:02 ` Michael Olbrich
1 sibling, 0 replies; 5+ messages in thread
From: Michael Olbrich @ 2025-05-16 22:02 UTC (permalink / raw)
To: ptxdist; +Cc: Christian Melki
Thanks, applied as d9580d7b036bfc7c4070c3364b1d76422fe03fe4.
Michael
[sent from post-receive hook]
On Sat, 17 May 2025 00:02:56 +0200, Christian Melki <christian.melki@t2data.com> wrote:
> Security and other fixes.
> https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html
>
> Security fixes:
> CVE-2025-46805: do NOT send signals with root privileges
> CVE-2025-46804: avoid file existence test information leaks
> CVE-2025-46803: apply safe PTY default mode of 0620
> CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher
> CVE-2025-23395: reintroduce lf_secreopen() for logfile
>
> * Forward patchset, applies cleanly.
>
> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> Message-Id: <20250515173851.1147261-1-christian.melki@t2data.com>
> [mol: update md5 because the initial tarball was replaced almost immediately]
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
>
> diff --git a/patches/screen-5.0.0/0001-suppress_remap.patch b/patches/screen-5.0.1/0001-suppress_remap.patch
> similarity index 100%
> rename from patches/screen-5.0.0/0001-suppress_remap.patch
> rename to patches/screen-5.0.1/0001-suppress_remap.patch
> diff --git a/patches/screen-5.0.0/autogen.sh b/patches/screen-5.0.1/autogen.sh
> similarity index 100%
> rename from patches/screen-5.0.0/autogen.sh
> rename to patches/screen-5.0.1/autogen.sh
> diff --git a/patches/screen-5.0.0/series b/patches/screen-5.0.1/series
> similarity index 100%
> rename from patches/screen-5.0.0/series
> rename to patches/screen-5.0.1/series
> diff --git a/rules/screen.make b/rules/screen.make
> index 1bac9b8b847f..f3b0b8716ae8 100644
> --- a/rules/screen.make
> +++ b/rules/screen.make
> @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_SCREEN) += screen
> #
> # Paths and names
> #
> -SCREEN_VERSION := 5.0.0
> -SCREEN_MD5 := befc115989242ed4bceeff8d8bfeb4e6
> +SCREEN_VERSION := 5.0.1
> +SCREEN_MD5 := fb5e5dfc9353225c2d6929777344b1a6
> SCREEN := screen-$(SCREEN_VERSION)
> SCREEN_SUFFIX := tar.gz
> SCREEN_URL := $(call ptx/mirror, GNU, screen/$(SCREEN).$(SCREEN_SUFFIX))
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-05-16 22:03 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-05-15 17:38 [ptxdist] [PATCH] screen: Version bump. 5.0.0 -> 5.0.1 Christian Melki
2025-05-16 7:46 ` Michael Olbrich
2025-05-16 16:25 ` Christian Melki
2025-05-16 17:55 ` Michael Olbrich
2025-05-16 22:02 ` [ptxdist] [APPLIED] " Michael Olbrich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox