[{"id":1764330,"web_url":"http://patchwork.ozlabs.org/comment/1764330/","msgid":"<20170906214900.33c989d5@windsurf.lan>","list_archive_url":null,"date":"2017-09-06T19:49:00","subject":"Re: [Buildroot] [PATCH] subversion: security bump to version 1.9.7","submitter":{"id":2230,"url":"http://patchwork.ozlabs.org/api/people/2230/","name":"Thomas Petazzoni","email":"thomas.petazzoni@free-electrons.com"},"content":"Hello,\n\nOn Wed, 6 Sep 2017 17:40:39 +0200, Peter Korsgaard wrote:\n> Fixes CVE-2017-9800: Arbitrary code execution on clients through malicious\n> svn+ssh URLs in svn:externals and svn:sync-from-url\n> \n> For more details, see\n> http://subversion.apache.org/security/CVE-2017-9800-advisory.txt\n> \n> Signed-off-by: Peter Korsgaard \n> ---\n> package/subversion/subversion.hash | 7 +++----\n> package/subversion/subversion.mk | 2 +-\n> 2 files changed, 4 insertions(+), 5 deletions(-)\n\nApplied to master, thanks.\n\nThomas","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","buildroot@lists.busybox.net"],"Delivered-To":["patchwork-incoming@bilbo.ozlabs.org","buildroot@osuosl.org"],"Authentication-Results":"ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=busybox.net\n\t(client-ip=140.211.166.136; helo=silver.osuosl.org;\n\tenvelope-from=buildroot-bounces@busybox.net;\n\treceiver=)","Received":["from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136])\n\t(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xnZ0P4vFWz9sCZ\n\tfor ;\n\tThu, 7 Sep 2017 05:49:09 +1000 (AEST)","from localhost (localhost [127.0.0.1])\n\tby silver.osuosl.org (Postfix) with ESMTP id 57FAF30B65;\n\tWed, 6 Sep 2017 19:49:07 +0000 (UTC)","from silver.osuosl.org ([127.0.0.1])\n\tby localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id 3HCyPtZOP6gR; Wed, 6 Sep 2017 19:49:06 +0000 (UTC)","from ash.osuosl.org (ash.osuosl.org [140.211.166.34])\n\tby silver.osuosl.org (Postfix) with ESMTP id 9B8E030B6C;\n\tWed, 6 Sep 2017 19:49:06 +0000 (UTC)","from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137])\n\tby ash.osuosl.org (Postfix) with ESMTP id 6F96A1C06F2\n\tfor ;\n\tWed, 6 Sep 2017 19:49:04 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n\tby fraxinus.osuosl.org (Postfix) with ESMTP id 685CD878E7\n\tfor ;\n\tWed, 6 Sep 2017 19:49:04 +0000 (UTC)","from fraxinus.osuosl.org ([127.0.0.1])\n\tby localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id UZkfAgGfMs51 for ;\n\tWed, 6 Sep 2017 19:49:03 +0000 (UTC)","from mail.free-electrons.com (mail.free-electrons.com [62.4.15.54])\n\tby fraxinus.osuosl.org (Postfix) with ESMTP id 045F186FC3\n\tfor ; Wed, 6 Sep 2017 19:49:03 +0000 (UTC)","by mail.free-electrons.com (Postfix, from userid 110)\n\tid 4AD3E209D6; Wed, 6 Sep 2017 21:49:00 +0200 (CEST)","from windsurf.lan (LFbn-1-15130-153.w86-206.abo.wanadoo.fr\n\t[86.206.236.153])\n\tby mail.free-electrons.com (Postfix) with ESMTPSA id 1D3DD20958;\n\tWed, 6 Sep 2017 21:49:00 +0200 (CEST)"],"X-Virus-Scanned":["amavisd-new at osuosl.org","amavisd-new at osuosl.org"],"X-Greylist":"domain auto-whitelisted by SQLgrey-1.7.6","Date":"Wed, 6 Sep 2017 21:49:00 +0200","From":"Thomas Petazzoni ","To":"Peter Korsgaard ","Message-ID":"<20170906214900.33c989d5@windsurf.lan>","In-Reply-To":"<20170906154039.21569-1-peter@korsgaard.com>","References":"<20170906154039.21569-1-peter@korsgaard.com>","Organization":"Free Electrons","X-Mailer":"Claws Mail 3.14.1 (GTK+ 2.24.31; x86_64-redhat-linux-gnu)","MIME-Version":"1.0","Cc":"buildroot@buildroot.org","Subject":"Re: [Buildroot] [PATCH] subversion: security bump to version 1.9.7","X-BeenThere":"buildroot@busybox.net","X-Mailman-Version":"2.1.18-1","Precedence":"list","List-Id":"Discussion and development of buildroot ","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"buildroot-bounces@busybox.net","Sender":"\"buildroot\" "}},{"id":1764405,"web_url":"http://patchwork.ozlabs.org/comment/1764405/","msgid":"<87vakvcx8q.fsf@dell.be.48ers.dk>","list_archive_url":null,"date":"2017-09-06T21:50:45","subject":"Re: [Buildroot] [PATCH] subversion: security bump to version 1.9.7","submitter":{"id":42365,"url":"http://patchwork.ozlabs.org/api/people/42365/","name":"Peter Korsgaard","email":"peter@korsgaard.com"},"content":">>>>> \"Peter\" == Peter Korsgaard writes:\n\n > Fixes CVE-2017-9800: Arbitrary code execution on clients through malicious\n > svn+ssh URLs in svn:externals and svn:sync-from-url\n\n > For more details, see\n > http://subversion.apache.org/security/CVE-2017-9800-advisory.txt\n\n > Signed-off-by: Peter Korsgaard \n\nCommitted to 2017.02.x, thanks.","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","buildroot@lists.busybox.net"],"Delivered-To":["patchwork-incoming@bilbo.ozlabs.org","buildroot@osuosl.org"],"Authentication-Results":["ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=busybox.net\n\t(client-ip=140.211.166.137; helo=fraxinus.osuosl.org;\n\tenvelope-from=buildroot-bounces@busybox.net;\n\treceiver=)","ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"IU2HjSoC\"; dkim-atps=neutral"],"Received":["from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137])\n\t(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xnchw4V56z9s8J\n\tfor ;\n\tThu, 7 Sep 2017 07:50:56 +1000 (AEST)","from localhost (localhost [127.0.0.1])\n\tby fraxinus.osuosl.org (Postfix) with ESMTP id B38358782F;\n\tWed, 6 Sep 2017 21:50:53 +0000 (UTC)","from fraxinus.osuosl.org ([127.0.0.1])\n\tby localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id C9GqimVzFU6y; Wed, 6 Sep 2017 21:50:52 +0000 (UTC)","from ash.osuosl.org (ash.osuosl.org [140.211.166.34])\n\tby fraxinus.osuosl.org (Postfix) with ESMTP id 2B87A8777A;\n\tWed, 6 Sep 2017 21:50:52 +0000 (UTC)","from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136])\n\tby ash.osuosl.org (Postfix) with ESMTP id 9DBE01C27D7\n\tfor ;\n\tWed, 6 Sep 2017 21:50:50 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n\tby silver.osuosl.org (Postfix) with ESMTP id 9448A2F7AA\n\tfor ;\n\tWed, 6 Sep 2017 21:50:50 +0000 (UTC)","from silver.osuosl.org ([127.0.0.1])\n\tby localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id p93pBnJWfyLD for ;\n\tWed, 6 Sep 2017 21:50:49 +0000 (UTC)","from mail-wm0-f50.google.com (mail-wm0-f50.google.com\n\t[74.125.82.50])\n\tby silver.osuosl.org (Postfix) with ESMTPS id 7F2EE2F5BB\n\tfor ; Wed, 6 Sep 2017 21:50:49 +0000 (UTC)","by mail-wm0-f50.google.com with SMTP id f199so441428wme.0\n\tfor ; Wed, 06 Sep 2017 14:50:49 -0700 (PDT)","from dell.be.48ers.dk (d51A5BC31.access.telenet.be.\n\t[81.165.188.49]) by smtp.gmail.com with ESMTPSA id\n\tj5sm1621075edd.54.2017.09.06.14.50.46 for \n\t(version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256);\n\tWed, 06 Sep 2017 14:50:46 -0700 (PDT)","from peko by dell.be.48ers.dk with local (Exim 4.88)\n\t(envelope-from ) id 1dpiDd-0004yZ-OF\n\tfor buildroot@buildroot.org; Wed, 06 Sep 2017 23:50:45 +0200"],"X-Virus-Scanned":["amavisd-new at osuosl.org","amavisd-new at osuosl.org"],"X-Greylist":"domain auto-whitelisted by SQLgrey-1.7.6","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;\n\th=sender:from:to:subject:references:date:in-reply-to:message-id\n\t:user-agent:mime-version;\n\tbh=/fzvpxYgzlsObks4vQ4DNLO7kuakefD3ild1vIdQgCo=;\n\tb=IU2HjSoC83/1iLvwPxOeBrnRLRdX3kAeVQOxtLmH2PTciRym3KFu8Dx6LhhLYwuAbs\n\tvtUh4ygke3uPhFZlrr1qkO320M2FfJ53jJPtg707q7kJs432YLEQsUZ2vxJV1Ey8RZ8B\n\tVGu/diYqMn7USGKHEEJLRxaZ5HOaBdZiuX+j+paBYtROMC9OeKFwHQiBGbVVKOCah0xX\n\tGF04Fdke8tdFkqPNyG+eCaXDd8FKTOOh9+NCwlozKlXgKdWoiLmzhaqirkDkAzCYvg/u\n\tYSW9A3z3nfLvhngJQQXi1VIyidsiXWt0x0hSbTElycinnZ3JTEspxlS44lkaZ+SeGVMn\n\t1/8g==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:sender:from:to:subject:references:date\n\t:in-reply-to:message-id:user-agent:mime-version;\n\tbh=/fzvpxYgzlsObks4vQ4DNLO7kuakefD3ild1vIdQgCo=;\n\tb=YvONV1hxuXNG7tAlhq/+m9xoZUoPDxmJOZcI/yy42tpBwyG8thOFqNt0LkKaNsRaWF\n\t6qYDSFoaPnS0uhoWGmH3LOPnMuX9XMfTPH5IVYq/XxxtyvfcLk9Lb1UhBJvtIJ2lUUhm\n\t2Mq42bVD06PN/jadXUpzsZQb3I2OCl7GEikAb5TxaGPe8lYoIARCgldnStvueHJkPKVy\n\tSUuAWfO31jSk4EcuNdObSjsjc9zvSkiagMNBAArrYtkEjfxwPKFpd8aZnlNgFSOPYvjR\n\tsPA+0kQ5xctgEH9PrJLs38Xsi+fd5zHglZyY/7hL8FResFMbu4u6vJNDi8Xl7BZ/OfMY\n\tJEqQ==","X-Gm-Message-State":"AHPjjUjgvdSgQvUxoebpbxKJcdAqd5Y26VzxHFsEsDItsj8Ol/6g0BfH\n\tlGA86Fn/BJbvqY/H6OU=","X-Google-Smtp-Source":"ADKCNb53aeIlCokIQ1CMAeXY8paCLVlYMcNgpjlVS2RVZ6zulwFmvEY5yq1UsPKURpDx8VAJ8PCfbA==","X-Received":"by 10.80.154.229 with SMTP id p92mr846119edb.24.1504734647533;\n\tWed, 06 Sep 2017 14:50:47 -0700 (PDT)","From":"Peter Korsgaard ","To":"buildroot@buildroot.org","References":"<20170906154039.21569-1-peter@korsgaard.com>","Date":"Wed, 06 Sep 2017 23:50:45 +0200","In-Reply-To":"<20170906154039.21569-1-peter@korsgaard.com> (Peter Korsgaard's\n\tmessage of \"Wed, 6 Sep 2017 17:40:39 +0200\")","Message-ID":"<87vakvcx8q.fsf@dell.be.48ers.dk>","User-Agent":"Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)","MIME-Version":"1.0","Subject":"Re: [Buildroot] [PATCH] subversion: security bump to version 1.9.7","X-BeenThere":"buildroot@busybox.net","X-Mailman-Version":"2.1.18-1","Precedence":"list","List-Id":"Discussion and development of buildroot ","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"buildroot-bounces@busybox.net","Sender":"\"buildroot\" "}},{"id":1787781,"web_url":"http://patchwork.ozlabs.org/comment/1787781/","msgid":"<87sheivk5h.fsf@dell.be.48ers.dk>","list_archive_url":null,"date":"2017-10-16T21:48:42","subject":"Re: [Buildroot] [PATCH] subversion: security bump to version 1.9.7","submitter":{"id":42365,"url":"http://patchwork.ozlabs.org/api/people/42365/","name":"Peter Korsgaard","email":"peter@korsgaard.com"},"content":">>>>> \"Peter\" == Peter Korsgaard writes:\n\n > Fixes CVE-2017-9800: Arbitrary code execution on clients through malicious\n > svn+ssh URLs in svn:externals and svn:sync-from-url\n\n > For more details, see\n > http://subversion.apache.org/security/CVE-2017-9800-advisory.txt\n\n > Signed-off-by: Peter Korsgaard \n\nCommitted to 2017.08.x, thanks.","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","buildroot@lists.busybox.net"],"Delivered-To":["patchwork-incoming@bilbo.ozlabs.org","buildroot@osuosl.org"],"Authentication-Results":["ozlabs.org;\n\tspf=pass (mailfrom) smtp.mailfrom=busybox.net\n\t(client-ip=140.211.166.133; helo=hemlock.osuosl.org;\n\tenvelope-from=buildroot-bounces@busybox.net;\n\treceiver=)","ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"ILM1oi5B\"; dkim-atps=neutral"],"Received":["from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133])\n\t(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3yGBm65Vhyz9sRW\n\tfor ;\n\tTue, 17 Oct 2017 08:48:54 +1100 (AEDT)","from localhost (localhost [127.0.0.1])\n\tby hemlock.osuosl.org (Postfix) with ESMTP id 3AAB987472;\n\tMon, 16 Oct 2017 21:48:52 +0000 (UTC)","from hemlock.osuosl.org ([127.0.0.1])\n\tby localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id i+9d5MIBZYrw; Mon, 16 Oct 2017 21:48:49 +0000 (UTC)","from ash.osuosl.org (ash.osuosl.org [140.211.166.34])\n\tby hemlock.osuosl.org (Postfix) with ESMTP id 3A765873DC;\n\tMon, 16 Oct 2017 21:48:49 +0000 (UTC)","from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138])\n\tby ash.osuosl.org (Postfix) with ESMTP id 80B091CEC57\n\tfor ;\n\tMon, 16 Oct 2017 21:48:47 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n\tby whitealder.osuosl.org (Postfix) with ESMTP id 775AA8663C\n\tfor ;\n\tMon, 16 Oct 2017 21:48:47 +0000 (UTC)","from whitealder.osuosl.org ([127.0.0.1])\n\tby localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id 9WpuXXzOA7q5 for ;\n\tMon, 16 Oct 2017 21:48:47 +0000 (UTC)","from mail-wm0-f48.google.com (mail-wm0-f48.google.com\n\t[74.125.82.48])\n\tby whitealder.osuosl.org (Postfix) with ESMTPS id A78D786638\n\tfor ; Mon, 16 Oct 2017 21:48:46 +0000 (UTC)","by mail-wm0-f48.google.com with SMTP id l68so84598wmd.5\n\tfor ; Mon, 16 Oct 2017 14:48:46 -0700 (PDT)","from dell.be.48ers.dk (d51a5bc31.access.telenet.be.\n\t[81.165.188.49]) by smtp.gmail.com with ESMTPSA id\n\ti6sm5588450edk.3.2017.10.16.14.48.43 for \n\t(version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256);\n\tMon, 16 Oct 2017 14:48:44 -0700 (PDT)","from peko by dell.be.48ers.dk with local (Exim 4.88)\n\t(envelope-from ) id 1e4DFa-0003VE-Rx\n\tfor buildroot@buildroot.org; Mon, 16 Oct 2017 23:48:42 +0200"],"X-Virus-Scanned":["amavisd-new at osuosl.org","amavisd-new at osuosl.org"],"X-Greylist":"domain auto-whitelisted by SQLgrey-1.7.6","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;\n\th=sender:from:to:subject:references:date:in-reply-to:message-id\n\t:user-agent:mime-version;\n\tbh=8b6Qq5KBg6pULzN3cdheZrJx875YVD2lISJ8y8iFkFs=;\n\tb=ILM1oi5BsdhfKTL1Fh67JWbbFBPyxTQwWl2v9Y6CPpsfB2ep816eocBiIWNRp8Mg32\n\tqlQPh99zl8PYMkKMYHWu37KHYeAA/j7qcupKEMzBjpVnkKiRaClmtNuUG4cWNqMAHtLq\n\tLS7UoZvK+f0jzpCwOiUdrQs2ly7QIgSTfpdc0t2yJ3yPAozY7TrgMARG63PuUv7U7pTl\n\tp2mZc7Brq12FmiyUoR+rxp0PI17rH3/r0EK03lhG59HIWoANXmk1ojQEWdzo74BTRE5z\n\tAFrRBELgYnGjvlGd5KUFqRNmvLWRSbBnPWjQ5BCQQDfpYDi+jEpY8HeufG9Gtdo5Y3I/\n\t8Ylw==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:sender:from:to:subject:references:date\n\t:in-reply-to:message-id:user-agent:mime-version;\n\tbh=8b6Qq5KBg6pULzN3cdheZrJx875YVD2lISJ8y8iFkFs=;\n\tb=ck//FlCqEhN9NBIX5BWSCknBegQvtkfrBrCMUueHRpRwEMOKLXU6NyU6WnMF8Mox5+\n\tuhcJAuoPhMyFCU6VuUdug9rC21vW0YJQpHUSbnMbzm9oJyOUCQs1CcBbAU9MsiCZxnpP\n\t4GibjeO0LRIovRxKMXhk6+n1zzbiL1n2WXCguSQKEeAnAOk5QGDT7U7tML66fluCP4nE\n\tcvYT+iLHscjhbVFWWfV6fjoEUl3GO7pa8l8gFiMqdmW5brvF4nXTigSUHDMBTw3A8jH2\n\tz3CAtCBXW07Q+s4O90+Hk8ZOd0FCPZ1gwZ4Anp70X7giTTW8v6PV6r/P38FaTrHLVI6m\n\tAelQ==","X-Gm-Message-State":"AMCzsaWEzSc12ItESn4Ne2vEMbYtav587qFD6oBH45Qys4CqbPDNMRyg\n\tdb7sWnQBxcBLimbTN9DyYIM7E0iY","X-Google-Smtp-Source":"ABhQp+TrJMxJOLyD98v5JybHYd6Rz83eFNy4508qiyeUfl6WEBV4aG1n8TChCeHx3xndvmROZch5PA==","X-Received":"by 10.80.128.133 with SMTP id 5mr2682747edb.114.1508190524789;\n\tMon, 16 Oct 2017 14:48:44 -0700 (PDT)","From":"Peter Korsgaard ","To":"buildroot@buildroot.org","References":"<20170906154039.21569-1-peter@korsgaard.com>","Date":"Mon, 16 Oct 2017 23:48:42 +0200","In-Reply-To":"<20170906154039.21569-1-peter@korsgaard.com> (Peter Korsgaard's\n\tmessage of \"Wed, 6 Sep 2017 17:40:39 +0200\")","Message-ID":"<87sheivk5h.fsf@dell.be.48ers.dk>","User-Agent":"Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)","MIME-Version":"1.0","Subject":"Re: [Buildroot] [PATCH] subversion: security bump to version 1.9.7","X-BeenThere":"buildroot@busybox.net","X-Mailman-Version":"2.1.18-1","Precedence":"list","List-Id":"Discussion and development of buildroot ","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"buildroot-bounces@busybox.net","Sender":"\"buildroot\" "}}]