mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-19 16:40:46 -09:00
62afdce87f
This commit patches the following vulnerability:
- CVE-2026-41989:
Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow
and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
https://www.cve.org/CVERecord?id=CVE-2026-41989
This has already been addressed on the master branch by the package bump
[1].
[1] 93f486ac56 package/libgcrypt: bump version to 1.12.2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
45 lines
1.3 KiB
Makefile
45 lines
1.3 KiB
Makefile
################################################################################
|
|
#
|
|
# libgcrypt
|
|
#
|
|
################################################################################
|
|
|
|
LIBGCRYPT_VERSION = 1.11.1
|
|
LIBGCRYPT_SOURCE = libgcrypt-$(LIBGCRYPT_VERSION).tar.bz2
|
|
LIBGCRYPT_LICENSE = LGPL-2.1+
|
|
LIBGCRYPT_LICENSE_FILES = COPYING.LIB
|
|
LIBGCRYPT_SITE = https://gnupg.org/ftp/gcrypt/libgcrypt
|
|
LIBGCRYPT_INSTALL_STAGING = YES
|
|
LIBGCRYPT_DEPENDENCIES = libgpg-error
|
|
LIBGCRYPT_CONFIG_SCRIPTS = libgcrypt-config
|
|
LIBGCRYPT_CPE_ID_VENDOR = gnupg
|
|
|
|
# 0002-CVE-2026-41989.patch
|
|
LIBGCRYPT_IGNORE_CVES += CVE-2026-41989
|
|
|
|
# Patching configure.ac and Makefile.am in 0001
|
|
LIBGCRYPT_AUTORECONF = YES
|
|
LIBGCRYPT_CONF_ENV += GPGRT_CONFIG=$(STAGING_DIR)/usr/bin/gpgrt-config
|
|
LIBGCRYPT_CONF_OPTS = \
|
|
--disable-tests \
|
|
$(if $(BR2_OPTIMIZE_0),--disable-ppc-crypto-support,) \
|
|
--with-gpg-error-prefix=$(STAGING_DIR)/usr
|
|
|
|
# disable asm for broken archs
|
|
ifeq ($(BR2_i386)$(BR2_m68k_cf),y)
|
|
LIBGCRYPT_CONF_OPTS += --disable-asm
|
|
endif
|
|
|
|
# Code doesn't build in thumb mode
|
|
ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y)
|
|
LIBGCRYPT_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -marm"
|
|
endif
|
|
|
|
HOST_LIBGCRYPT_DEPENDENCIES = host-libgpg-error
|
|
HOST_LIBGCRYPT_CONF_OPTS = \
|
|
--disable-tests \
|
|
--with-gpg-error-prefix=$(HOST_DIR)
|
|
|
|
$(eval $(autotools-package))
|
|
$(eval $(host-autotools-package))
|