From fe357abb84877b836f0fca129e83e55c14be2067 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 30 Dec 2025 09:19:05 +0100 Subject: [PATCH] package/patch: add CVE trailer in patches Since Buildroot commit [1] the patches that fixes a security vulnerability needs to reference the fixed vulnerability. This patch adds the relevant information to the patches header as well as the `Upstream` trailer. [1] 1167d0ff3d docs/manual: mention CVE trailer Signed-off-by: Thomas Perale Signed-off-by: Thomas Petazzoni (cherry picked from commit 74b079d9e916062629148ba79374998762e1998a) Signed-off-by: Thomas Perale --- .checkpackageignore | 4 ---- .../patch/0001-Fix-segfault-with-mangled-rename-patch.patch | 4 ++-- ...x-arbitrary-command-execution-in-ed-style-patches-.patch | 4 ++-- ...0004-Invoke-ed-directly-instead-of-using-the-shell.patch | 6 ++++-- ...t-follow-symlinks-unless--follow-symlinks-is-given.patch | 5 +++-- 5 files changed, 11 insertions(+), 12 deletions(-) diff --git a/.checkpackageignore b/.checkpackageignore index 55d54aa5be..abf8af59fd 100644 --- a/.checkpackageignore +++ b/.checkpackageignore @@ -865,11 +865,7 @@ package/opusfile/0001-Propagate-allocation-failure-from-ogg_sync_buffer.patch li package/owfs/S55owserver Shellcheck lib_sysv.Variables package/owfs/S60owfs Shellcheck lib_sysv.Variables package/owl-linux/0001-fix-for-linux-3.3.x.patch lib_patch.Upstream -package/patch/0001-Fix-segfault-with-mangled-rename-patch.patch lib_patch.Upstream package/patch/0002-Allow-input-files-to-be-missing-for-ed-style-patches.patch lib_patch.Upstream -package/patch/0003-Fix-arbitrary-command-execution-in-ed-style-patches-.patch lib_patch.Upstream -package/patch/0004-Invoke-ed-directly-instead-of-using-the-shell.patch lib_patch.Upstream -package/patch/0005-Don-t-follow-symlinks-unless--follow-symlinks-is-given.patch lib_patch.Upstream package/patchelf/0001-Add-option-to-make-the-rpath-relative-under-a-specif.patch lib_patch.Upstream package/paxtest/0001-genpaxtest-move-log-location.patch lib_patch.Upstream package/paxtest/0002-paxtest-page-alignment-ARM-and-NIOS2-arch.patch lib_patch.Upstream diff --git a/package/patch/0001-Fix-segfault-with-mangled-rename-patch.patch b/package/patch/0001-Fix-segfault-with-mangled-rename-patch.patch index 19a67573c4..1b8d954025 100644 --- a/package/patch/0001-Fix-segfault-with-mangled-rename-patch.patch +++ b/package/patch/0001-Fix-segfault-with-mangled-rename-patch.patch @@ -7,10 +7,10 @@ http://savannah.gnu.org/bugs/?53132 * src/pch.c (intuit_diff_type): Ensure that two filenames are specified for renames and copies (fix the existing check). +CVE: CVE-2018-6951 +Upstream: https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=f290f48a621867084884bfff87f8093c15195e6a Signed-off-by: Baruch Siach --- -Patch status: upstream commit f290f48a6218 - src/pch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/package/patch/0003-Fix-arbitrary-command-execution-in-ed-style-patches-.patch b/package/patch/0003-Fix-arbitrary-command-execution-in-ed-style-patches-.patch index b44bdd0fac..18497c153b 100644 --- a/package/patch/0003-Fix-arbitrary-command-execution-in-ed-style-patches-.patch +++ b/package/patch/0003-Fix-arbitrary-command-execution-in-ed-style-patches-.patch @@ -10,11 +10,11 @@ instead of rejecting them and carrying on. * tests/ed-style: New test case. * tests/Makefile.am (TESTS): Add test case. +CVE: CVE-2018-1000156 +Upstream: https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=123eaff0d5d1aebe128295959435b9ca5909c26d [baruch: drop test hunks to avoid autoreconf] Signed-off-by: Baruch Siach --- -Upstream status: commit 123eaff0d5d1 - src/pch.c | 91 ++++++++++++++++++++++++++++++++++++++++--------------- tests/Makefile.am | 1 + tests/ed-style | 41 +++++++++++++++++++++++++ diff --git a/package/patch/0004-Invoke-ed-directly-instead-of-using-the-shell.patch b/package/patch/0004-Invoke-ed-directly-instead-of-using-the-shell.patch index ae64d58b93..7ede9300e4 100644 --- a/package/patch/0004-Invoke-ed-directly-instead-of-using-the-shell.patch +++ b/package/patch/0004-Invoke-ed-directly-instead-of-using-the-shell.patch @@ -5,8 +5,10 @@ Subject: Invoke ed directly instead of using the shell * src/pch.c (do_ed_script): Invoke ed directly instead of using a shell command to avoid quoting vulnerabilities. -[Retrieved from: -https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0] + +CVE: CVE-2018-20969 +CVE: CVE-2019-13638 +Upstream: https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0 Signed-off-by: Fabrice Fontaine --- src/pch.c | 6 ++---- diff --git a/package/patch/0005-Don-t-follow-symlinks-unless--follow-symlinks-is-given.patch b/package/patch/0005-Don-t-follow-symlinks-unless--follow-symlinks-is-given.patch index e07ae0c670..c0e63081e2 100644 --- a/package/patch/0005-Don-t-follow-symlinks-unless--follow-symlinks-is-given.patch +++ b/package/patch/0005-Don-t-follow-symlinks-unless--follow-symlinks-is-given.patch @@ -9,8 +9,9 @@ the O_NOFOLLOW flag to avoid following symlinks. So far, we were only doing that consistently for input files. * src/util.c (create_backup): When creating empty backup files, (re)create them with O_CREAT | O_EXCL to avoid following symlinks in that case as well. -[Retrieved from: -https://git.savannah.gnu.org/cgit/patch.git/commit/?id=dce4683cbbe107a95f1f0d45fabc304acfb5d71a] + +CVE: CVE-2019-13636 +Upstream: https://git.savannah.gnu.org/cgit/patch.git/commit/?id=dce4683cbbe107a95f1f0d45fabc304acfb5d71a Signed-off-by: Fabrice Fontaine --- src/inp.c | 12 ++++++++++--