From 4dc8e8b6f927bcfd11302a3cee68ea958cc266dc Mon Sep 17 00:00:00 2001 From: Yegor Yefremov Date: Fri, 18 Sep 2026 09:22:48 +0200 Subject: [PATCH] package/cannelloni: security bump to version 2.1.2 For change log, see: https://github.com/mguentner/cannelloni/releases/tag/v2.0.1 https://github.com/mguentner/cannelloni/releases/tag/v2.1.0 https://github.com/mguentner/cannelloni/releases/tag/v2.1.1 https://github.com/mguentner/cannelloni/releases/tag/v2.1.2 2.1.2 fixes CVE-2026-37539 (CVSS 3.1 score 9.8, CWE-121): a stack based buffer overflow in CAN frame parsing, in parseCANFrame() in parser.cpp and decodeFrame() in decoder.cpp, allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted CAN FD frames. The advisory names v2.0.0 explicitly, so the version used so far is affected. The CVE is not reported by https://security.buildroot.org/master/component/cannelloni because its NVD entry has no CPE data (vendor and product are both "n/a") and can therefore not be matched against the package version. Apart from the security fix, 2.0.0..2.1.2 contains only a handful of changes: undeliverable frames are dropped after a timeout on a broken CAN bus, variable length arrays are gone, the default remote address is fixed, and pthreads are looked up with the CMake module instead of by hand. 2.1.1 is a maintenance release only, as the 2.1.0 tag pointed to a commit that was not the final one. Signed-off-by: Yegor Yefremov Assisted-by: Claude:claude-opus-5 Signed-off-by: Thomas Petazzoni --- package/cannelloni/cannelloni.hash | 2 +- package/cannelloni/cannelloni.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/cannelloni/cannelloni.hash b/package/cannelloni/cannelloni.hash index 625e43d157..6b45d497e4 100644 --- a/package/cannelloni/cannelloni.hash +++ b/package/cannelloni/cannelloni.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 3dde63727549d4a39154e78b95f4a5dad96af236ca6cef531f347c0b923c74d5 cannelloni-2.0.0.tar.gz +sha256 c704707f7dd9f1ed64e9195097809f8882c03b1fa0a79864b8e3bf286521e3d7 cannelloni-2.1.2.tar.gz sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 gpl-2.0.txt diff --git a/package/cannelloni/cannelloni.mk b/package/cannelloni/cannelloni.mk index 7978cfccf5..2e6a61545e 100644 --- a/package/cannelloni/cannelloni.mk +++ b/package/cannelloni/cannelloni.mk @@ -4,7 +4,7 @@ # ################################################################################ -CANNELLONI_VERSION = 2.0.0 +CANNELLONI_VERSION = 2.1.2 CANNELLONI_SITE = $(call github,mguentner,cannelloni,v$(CANNELLONI_VERSION)) CANNELLONI_LICENSE = GPL-2.0 CANNELLONI_LICENSE_FILES = gpl-2.0.txt