From d70df3ab44159f297d562af47e164d00c724ba28 Mon Sep 17 00:00:00 2001 From: Akhilesh Nema Date: Sat, 1 Feb 2025 16:21:02 -0800 Subject: [PATCH] package/socat: security bump to version 1.8.0.2 It fixes an arbitrary file overwrite vulnerability in the readline.sh. (CVE-2024-54661) see - http://www.dest-unreach.org/socat/contrib/socat-secadv9.html README hash changed due to version update. Note: Buildroot is not impacted by this vulnerability as the readline.sh is not installed on target. Quoting changelog [1]: Mitigating factors: readline.sh is usually neither installed in a bin directory nor is it documented. Major Linux distributions install it in examples/ or doc/; however it is invoked by test.sh script. [1] https://repo.or.cz/socat.git/blob/refs/tags/tag-1.8.0.2:/CHANGES Signed-off-by: Akhilesh Nema [Julien: add note that Buildroot is not impacted in commit log] Signed-off-by: Julien Olivain --- package/socat/socat.hash | 6 +++--- package/socat/socat.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/socat/socat.hash b/package/socat/socat.hash index 70c6e6a8f1..136dce4a71 100644 --- a/package/socat/socat.hash +++ b/package/socat/socat.hash @@ -1,8 +1,8 @@ # From http://www.dest-unreach.org/socat/download.md5sum -md5 e53a6e8e8594ac87476fe4ae361bbcd1 socat-1.8.0.1.tar.bz2 +md5 7272fe53d51c63ca0e08e0339681803a socat-1.8.0.2.tar.bz2 # From http://www.dest-unreach.org/socat/download.sha256sum -sha256 6a283565db7cf86292c6f70504c58abb03e29888adeed5a6c5f3457e803c1b81 socat-1.8.0.1.tar.bz2 +sha256 adc07a9c2723527cf6568d2fb96559794cf9c254a4bc2edd36f7f3789e9f7625 socat-1.8.0.2.tar.bz2 # Locally calculated -sha256 6c07bae42bf0a919c9dd6583f76cc9020a472652dcdad3e84923074a1f412d75 README +sha256 a18cf021c6380e8ef212c7a95460aff2d96fe9e2146bb09058651bc3b86f4d43 README sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING sha256 fd9e48ca316a5032069b9521f4f4b4d9b1c60365012bae1e62286bcd5bd2e761 COPYING.OpenSSL diff --git a/package/socat/socat.mk b/package/socat/socat.mk index 84d9cd3cf8..aa9a94aec4 100644 --- a/package/socat/socat.mk +++ b/package/socat/socat.mk @@ -4,7 +4,7 @@ # ################################################################################ -SOCAT_VERSION = 1.8.0.1 +SOCAT_VERSION = 1.8.0.2 SOCAT_SOURCE = socat-$(SOCAT_VERSION).tar.bz2 SOCAT_SITE = http://www.dest-unreach.org/socat/download SOCAT_LICENSE = GPL-2.0 with OpenSSL exception