From 8a2fb5068217795a2640e5e66ddcf082b7e8d509 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Tue, 21 Apr 2026 20:48:29 +0200 Subject: [PATCH] package/opensc: security bump version to 0.27.1 https://github.com/OpenSC/OpenSC/blob/0.27.1/NEWS Switched to sha256 tarball hash provided by upstream. Removed patch which is included in this release. Fixes the following CVEs: * CVE-2025-13763: Several uses of potentially uninitialized memory detected by fuzzers * CVE-2025-49010: Possible write beyond buffer bounds during processing of GET RESPONSE APDU * CVE-2025-66215: Possible write beyond buffer bounds in oberthur driver * CVE-2025-66038: Possible read beyond buffer bounds when parsing historical bytes in PIV driver * CVE-2025-66037: Possible buffer overrun while parsing SPKI Signed-off-by: Bernd Kuhls Signed-off-by: Marcus Hoffmann (cherry picked from commit baa0a1365335560bdfec6339cfb4b5785dafe3c9) Signed-off-by: Thomas Perale --- ...ble-wrap-unwrap-test-until-OpenSC-17.patch | 41 ------------------- package/opensc/opensc.hash | 4 +- package/opensc/opensc.mk | 2 +- 3 files changed, 3 insertions(+), 44 deletions(-) delete mode 100644 package/opensc/0001-pkcs11-tool-disable-wrap-unwrap-test-until-OpenSC-17.patch diff --git a/package/opensc/0001-pkcs11-tool-disable-wrap-unwrap-test-until-OpenSC-17.patch b/package/opensc/0001-pkcs11-tool-disable-wrap-unwrap-test-until-OpenSC-17.patch deleted file mode 100644 index 9bf601370a..0000000000 --- a/package/opensc/0001-pkcs11-tool-disable-wrap-unwrap-test-until-OpenSC-17.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 768c9bfcd91206f0d85cd4757fde48e00850a014 Mon Sep 17 00:00:00 2001 -From: Thomas Petazzoni -Date: Mon, 6 Jan 2025 22:36:10 +0100 -Subject: [PATCH] pkcs11-tool: disable wrap/unwrap test until OpenSC#1796 is - resolved - -Similar to ab74fae4d71d1705b77b9459141987a95dcfc91e ("pkcs11-tool: -disable wrap/unwrap test until OpenSC#1796 is resolved"), but for -0.26, since OpenSC#1796 is still open. - -Signed-off-by: Thomas Petazzoni -Upstream: https://github.com/OpenSC/OpenSC/pull/3303 ---- - src/tools/pkcs11-tool.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/tools/pkcs11-tool.c b/src/tools/pkcs11-tool.c -index d701d76d6..871a39977 100644 ---- a/src/tools/pkcs11-tool.c -+++ b/src/tools/pkcs11-tool.c -@@ -7681,7 +7681,7 @@ static int test_verify(CK_SESSION_HANDLE sess) - return errors; - } - --#if OPENSC_VERSION_MAJOR == 0 && OPENSC_VERSION_MINOR <= 25 -+#if OPENSC_VERSION_MAJOR == 0 && OPENSC_VERSION_MINOR <= 26 - #else - #ifdef ENABLE_OPENSSL - static int wrap_unwrap(CK_SESSION_HANDLE session, -@@ -7805,7 +7805,7 @@ static int wrap_unwrap(CK_SESSION_HANDLE session, - */ - static int test_unwrap(CK_SESSION_HANDLE sess) - { --#if OPENSC_VERSION_MAJOR == 0 && OPENSC_VERSION_MINOR <= 25 -+#if OPENSC_VERSION_MAJOR == 0 && OPENSC_VERSION_MINOR <= 26 - /* temporarily disable test, see https://github.com/OpenSC/OpenSC/issues/1796 */ - return 0; - #else --- -2.47.1 - diff --git a/package/opensc/opensc.hash b/package/opensc/opensc.hash index e12d2d4bfa..b24a6bca98 100644 --- a/package/opensc/opensc.hash +++ b/package/opensc/opensc.hash @@ -1,5 +1,5 @@ -# Computed locally from https://https://github.com/OpenSC/OpenSC/releases/ -sha256 837baead45e1505260d868871056150ede6e73d35460a470f2595a9e5e75f82b opensc-0.26.0.tar.gz +# From https://github.com/OpenSC/OpenSC/releases/tag/0.27.1 +sha256 976f4a23eaf3397a1a2c3a7aac80bf971a8c3d829c9a79f06145bfaeeae5eca7 opensc-0.27.1.tar.gz # Computed locally sha256 376b54d4c5f4aa99421823fa4da93e3ab73096fce2400e89858632aa7da24a14 COPYING diff --git a/package/opensc/opensc.mk b/package/opensc/opensc.mk index 11d1507d45..dbc83c2b0e 100644 --- a/package/opensc/opensc.mk +++ b/package/opensc/opensc.mk @@ -4,7 +4,7 @@ # ################################################################################ -OPENSC_VERSION = 0.26.0 +OPENSC_VERSION = 0.27.1 OPENSC_SITE = https://github.com/OpenSC/OpenSC/releases/download/$(OPENSC_VERSION) OPENSC_LICENSE = LGPL-2.1+ OPENSC_LICENSE_FILES = COPYING