From 2286c4a02cc0a22d1c902ed8e4cb997faefd72d1 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Fri, 1 May 2026 14:30:11 +0200 Subject: [PATCH] package/python-lmdb: security bump version to 2.2.0 https://github.com/jnwatson/py-lmdb/blob/py-lmdb_2.2.0/ChangeLog Version 2.1.0 fixes the following CVEs: - **CVE-2019-16224**: heap buffer overflow via `MDB_DUPFIXED` without `MDB_DUPSORT` in on-disk `md_flags`. (#429) - **CVE-2019-16225**: `SIGSEGV` from `P_DIRTY` flag set on mmap'd disk pages, causing `mdb_page_touch()` to skip copy-on-write. (#429) - **CVE-2019-16226**: out-of-bounds `memmove` in `mdb_node_del` via corrupt `mn_hi` making `NODEDSZ()` huge. (#429) - **CVE-2019-16227**: NULL pointer dereference of `mc_xcursor` when `F_DUPDATA` is set on a node in a non-DUPSORT database. (#429) - **CVE-2019-16228**: divide-by-zero from zero `mm_psize` in meta page header. (#429) Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain --- package/python-lmdb/python-lmdb.hash | 4 ++-- package/python-lmdb/python-lmdb.mk | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/python-lmdb/python-lmdb.hash b/package/python-lmdb/python-lmdb.hash index 679d552d1c..ad111605bc 100644 --- a/package/python-lmdb/python-lmdb.hash +++ b/package/python-lmdb/python-lmdb.hash @@ -1,5 +1,5 @@ # md5, sha256 from https://pypi.org/pypi/lmdb/json -md5 de895e4a88eeb179aa0c185a08523d62 lmdb-1.8.1.tar.gz -sha256 44ef24033929e9cc227a7e17287473c452b462d716f118db885c667c80f57429 lmdb-1.8.1.tar.gz +md5 f6f491b825302966f63b3fdee2ef80fd lmdb-2.2.0.tar.gz +sha256 53020e20305c043ea6e68089bc242d744fba6073cdb268332299ba6dda2886d4 lmdb-2.2.0.tar.gz # Locally computed sha256 checksums sha256 310fe25c858a9515fc8c8d7d1f24a67c9496f84a91e0a0e41ea9975b1371e569 LICENSE diff --git a/package/python-lmdb/python-lmdb.mk b/package/python-lmdb/python-lmdb.mk index dbdc80bfda..ba3d257fdd 100644 --- a/package/python-lmdb/python-lmdb.mk +++ b/package/python-lmdb/python-lmdb.mk @@ -4,9 +4,9 @@ # ################################################################################ -PYTHON_LMDB_VERSION = 1.8.1 +PYTHON_LMDB_VERSION = 2.2.0 PYTHON_LMDB_SOURCE = lmdb-$(PYTHON_LMDB_VERSION).tar.gz -PYTHON_LMDB_SITE = https://files.pythonhosted.org/packages/23/19/392f028e7ebcc1cc8212fe8a315a909b7a556278456f0bab9234d3a3b665 +PYTHON_LMDB_SITE = https://files.pythonhosted.org/packages/21/44/d94934efaf8f887b6959f131fde740fcaa831edfd13eb5425574637cddd5 PYTHON_LMDB_LICENSE = OLDAP-2.8 PYTHON_LMDB_LICENSE_FILES = LICENSE PYTHON_LMDB_DEPENDENCIES = host-python-cffi host-python-patch-ng