mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 08:30:47 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/rauc: security bump to version 1.15.2

Browse Source 
Fixes the following security issue:

CVE-2026-34155: Improper Signing of Plain Bundles Exceeding 2 GiB

RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB
cause an integer overflow which results in a signature which covers only the
first few bytes of the payload.  Given such a bundle with a legitimate
signature, an attacker can modify the part of the payload which is not
covered by the signature.

Bundles using the recommended 'verity' or 'crypt' formats are not affected.

For more details, see the advisory:
https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hx

https://github.com/rauc/rauc/releases/tag/v1.15.2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6e4a136363)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Peter Korsgaard
2026-03-27 19:21:53 +01:00
committed by Thomas Perale
parent 2745326e6c
commit bd446d02af
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/rauc/rauc.hash
View File

@@ -1,3 +1,3 @@
# Locally calculated after checking pgp signature
sha256 603dafa5085b6b964c74d5f57a154a1489af2b415dd20c6ff1447815d02c094f rauc-1.15.1.tar.xz
sha256 127a24cde208c65b837ae978c695a00730f1094ee8b6c7d48cf58ef846eae340 rauc-1.15.2.tar.xz
sha256 20e50fe7aae3e56378ebf0417d9de904f55a0e61e4df315333e632a4d3555d95 COPYING

2
package/rauc/rauc.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
RAUC_VERSION = 1.15.1
RAUC_VERSION = 1.15.2
RAUC_SITE = https://github.com/rauc/rauc/releases/download/v$(RAUC_VERSION)
RAUC_SOURCE = rauc-$(RAUC_VERSION).tar.xz
RAUC_LICENSE = LGPL-2.1