From patchwork Thu Aug 18 05:43:03 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Baruch Siach X-Patchwork-Id: 660329 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3sFFQx3vmBz9t17 for ; Thu, 18 Aug 2016 15:44:24 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id CE11F8A63D; Thu, 18 Aug 2016 05:44:21 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JnWU9UMarP4F; Thu, 18 Aug 2016 05:44:19 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by hemlock.osuosl.org (Postfix) with ESMTP id ED36F87BD9; Thu, 18 Aug 2016 05:44:18 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by ash.osuosl.org (Postfix) with ESMTP id B017E1C26B5 for ; Thu, 18 Aug 2016 05:44:17 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id AD5468B9AC for ; Thu, 18 Aug 2016 05:44:17 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k3wYOamuKpLC for ; Thu, 18 Aug 2016 05:44:15 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mx.tkos.co.il (guitar.tcltek.co.il [192.115.133.116]) by whitealder.osuosl.org (Postfix) with ESMTPS id DC952870BD for ; Thu, 18 Aug 2016 05:44:14 +0000 (UTC) Received: from tarshish.tkos.co.il (unknown [10.0.8.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx.tkos.co.il (Postfix) with ESMTPSA id 3F693440535; Thu, 18 Aug 2016 08:44:10 +0300 (IDT) From: Baruch Siach To: buildroot@busybox.net Date: Thu, 18 Aug 2016 08:43:03 +0300 Message-Id: <5d03002e20fce24f208b804c7f2d68c0955e325c.1471498983.git.baruch@tkos.co.il> X-Mailer: git-send-email 2.8.1 Subject: [Buildroot] [PATCH] libgcrypt: security bump to version to version 1.7.3 X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" Fixes CVE-2016-6316: Bug in the mixing functions of Libgcrypt's random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. Signed-off-by: Baruch Siach --- package/libgcrypt/libgcrypt.hash | 6 +++--- package/libgcrypt/libgcrypt.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/libgcrypt/libgcrypt.hash b/package/libgcrypt/libgcrypt.hash index 63148d4a15b0..885f83172b67 100644 --- a/package/libgcrypt/libgcrypt.hash +++ b/package/libgcrypt/libgcrypt.hash @@ -1,4 +1,4 @@ -# From https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000392.html -sha1 85a6a936bcab4c3c05f5efbf6ce847f23d35c0c4 libgcrypt-1.7.2.tar.bz2 +# From https://lists.gnu.org/archive/html/info-gnu/2016-08/msg00008.html +sha1 5a034291e7248592605db448481478e6c963aa9c libgcrypt-1.7.3.tar.bz2 # Calculated based on the hash above -sha256 3d35df906d6eab354504c05d749a9b021944cb29ff5f65c8ef9c3dd5f7b6689f libgcrypt-1.7.2.tar.bz2 +sha256 ddac6111077d0a1612247587be238c5294dd0ee4d76dc7ba783cc55fb0337071 libgcrypt-1.7.3.tar.bz2 diff --git a/package/libgcrypt/libgcrypt.mk b/package/libgcrypt/libgcrypt.mk index 5ee488dd8e34..31f4d6cdf375 100644 --- a/package/libgcrypt/libgcrypt.mk +++ b/package/libgcrypt/libgcrypt.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBGCRYPT_VERSION = 1.7.2 +LIBGCRYPT_VERSION = 1.7.3 LIBGCRYPT_SOURCE = libgcrypt-$(LIBGCRYPT_VERSION).tar.bz2 LIBGCRYPT_LICENSE = LGPLv2.1+ LIBGCRYPT_LICENSE_FILES = COPYING.LIB