From e278e4a68ed5a70db56e24cc83ee27e69bde8217 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Mon, 29 Dec 2025 10:07:14 +0100 Subject: [PATCH] package/libconfuse: add CVE trailer in patch Since Buildroot commit [1] the patches that fixes a security vulnerability needs to reference the fixed vulnerability. This patch adds the relevant information to the patch header and adds the `Upstream` trailer. [1] 1167d0ff3d docs/manual: mention CVE trailer Signed-off-by: Thomas Perale Signed-off-by: Thomas Petazzoni (cherry picked from commit ba51d53019bbc6f862b87389a90695a3dbe0670c) Signed-off-by: Thomas Perale --- .checkpackageignore | 1 - ...001-Fix-163-unterminated-username-used-with-getpwnam.patch | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.checkpackageignore b/.checkpackageignore index f555bec09e..2053988215 100644 --- a/.checkpackageignore +++ b/.checkpackageignore @@ -566,7 +566,6 @@ package/libcdaudio/0001-libcdaudio-enable-autoreconf.patch lib_patch.Upstream package/libcec/0001-cecloader-h-fix-null-return.patch lib_patch.Upstream package/libcgi/0001-CMakeLists.txt-honour-BUILD_TESTING.patch lib_patch.Upstream package/libcgicc/0001-disable-documentation-option.patch lib_patch.Sob lib_patch.Upstream -package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch lib_patch.Upstream package/libcorrect/0002-CMakeLists.txt-conditionally-use-fsanitize-address.patch lib_patch.Upstream package/libcuefile/0001-fix-static-link.patch lib_patch.Upstream package/libdaemon/0001-testd-use-unistd-h-instead-of-sys-unistd-h.patch lib_patch.Upstream diff --git a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch b/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch index 9ff3f5ec1c..44e15468ac 100644 --- a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch +++ b/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch @@ -5,8 +5,8 @@ Subject: [PATCH] Fix #163: unterminated username used with getpwnam() Signed-off-by: Joachim Wiberg -[Retrieved (and backported) from: -https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b] +CVE: CVE-2022-40320 +Upstream: https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b Signed-off-by: Fabrice Fontaine --- src/confuse.c | 10 ++++++----