mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 08:30:47 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/gnutls: security bump to version 3.8.12

Browse Source 
Fixes the following security vulnerabilities:

CVE-2026-1584: libgnutls: Fix NULL pointer dereference in PSK binder
verification

A TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello
could lead to a denial of service attack via crashing the server.
The updated code guards against the problematic dereference.

CVE-2025-14831: libgnutls: Fix name constraint processing performance issue

Verifying certificates with pathological amounts of name constraints
could lead to a denial of service attack via resource exhaustion.
Reworked processing algorithms exhibit better performance characteristics.

For more details, see the release notes:
https://lists.gnupg.org/pipermail/gnutls-help/2026-February/004914.html

Drop now upstreamed 0001-audit-crau-fix-compilation-with-gcc-11.patch:
f5666f8f1f

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Peter Korsgaard
2026-02-10 09:01:52 +01:00
committed by Julien Olivain
parent f56dc6b122
commit e91cf0ae73
3 changed files with 3 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
package/gnutls/0001-audit-crau-fix-compilation-with-gcc-11.patch
View File

@@ -1,67 +0,0 @@
From 2bbae7644a2292410b53f98fd0035c40bf8750a5 Mon Sep 17 00:00:00 2001
From: Julien Olivain <ju.o@free.fr>
Date: Sun, 23 Nov 2025 18:17:19 +0100
Subject: [PATCH] audit: crau: fix compilation with gcc < 11
If the CRAU_MAYBE_UNUSED macro is unset, the crau.h file tries to
automatically detect an appropriate value for it.
This autodetection is using the cpp special operator
`__has_c_attribute` [1], introduced in gcc 11 [2].
When compiling with a gcc older than version 11, the compilation fails
with the error:
In file included from audit.h:22,
from audit.c:26:
crau/crau.h:255:23: error: missing binary operator before token "("
__has_c_attribute (__maybe_unused__)
^
This has been observed, for example, in Rocky Linux 8.10, which
contains a gcc v8.5.0.
The issue happens because the test for the `__has_c_attribute`
availability and the test for the `__maybe_unused__` attribute
are in the same directive. Those tests should be separated in
two different directives, following the same logic described in
the `__has_builtin` documentation [3].
This issue was found in Buildroot, after updating gnutls to
version 3.8.11 in [4].
This commit fixes the issue by splitting the test in two.
[1] https://gcc.gnu.org/onlinedocs/cpp/_005f_005fhas_005fc_005fattribute.html
[2] https://gcc.gnu.org/gcc-11/changes.html#c
[3] https://gcc.gnu.org/onlinedocs/cpp/_005f_005fhas_005fbuiltin.html
[4] https://gitlab.com/buildroot.org/buildroot/-/commit/81dbfe1c2ae848b4eb1f896198d13455df50e548
Upstream: https://gitlab.com/gnutls/gnutls/-/merge_requests/2045
Reported-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
lib/crau/crau.h | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/lib/crau/crau.h b/lib/crau/crau.h
index 0d4f9f13e..53d33555b 100644
--- a/lib/crau/crau.h
+++ b/lib/crau/crau.h
@@ -251,9 +251,10 @@ void crau_data(struct crau_context_stack_st *stack, ...)
# else
# ifndef CRAU_MAYBE_UNUSED
-# if defined(__has_c_attribute) && \
- __has_c_attribute (__maybe_unused__)
-# define CRAU_MAYBE_UNUSED [[__maybe_unused__]]
+# if defined(__has_c_attribute)
+# if __has_c_attribute (__maybe_unused__)
+# define CRAU_MAYBE_UNUSED [[__maybe_unused__]]
+# endif
# elif defined(__GNUC__)
# define CRAU_MAYBE_UNUSED __attribute__((__unused__))
# endif
--
2.51.1

4
package/gnutls/gnutls.hash
View File

@@ -1,6 +1,6 @@
# Locally calculated after checking pgp signature
# https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.11.tar.xz.sig
sha256 91bd23c4a86ebc6152e81303d20cf6ceaeb97bc8f84266d0faec6e29f17baa20 gnutls-3.8.11.tar.xz
# https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.12.tar.xz.sig
sha256 a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51 gnutls-3.8.12.tar.xz
# Locally calculated
sha256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986 COPYING
sha256 20e50fe7aae3e56378ebf0417d9de904f55a0e61e4df315333e632a4d3555d95 COPYING.LESSERv2

2
package/gnutls/gnutls.mk
View File

@@ -6,7 +6,7 @@
# When bumping, make sure *all* --without-libfoo-prefix options are in GNUTLS_CONF_OPTS
GNUTLS_VERSION_MAJOR = 3.8
GNUTLS_VERSION = $(GNUTLS_VERSION_MAJOR).11
GNUTLS_VERSION = $(GNUTLS_VERSION_MAJOR).12
GNUTLS_SOURCE = gnutls-$(GNUTLS_VERSION).tar.xz
GNUTLS_SITE = https://www.gnupg.org/ftp/gcrypt/gnutls/v$(GNUTLS_VERSION_MAJOR)
GNUTLS_LICENSE = LGPL-2.1+ (core library)