mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-08 08:30:47 -09:00
6e4a136363
Fixes the following security issue: CVE-2026-34155: Improper Signing of Plain Bundles Exceeding 2 GiB RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB cause an integer overflow which results in a signature which covers only the first few bytes of the payload. Given such a bundle with a legitimate signature, an attacker can modify the part of the payload which is not covered by the signature. Bundles using the recommended 'verity' or 'crypt' formats are not affected. For more details, see the advisory: https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hx https://github.com/rauc/rauc/releases/tag/v1.15.2 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Julien Olivain <ju.o@free.fr>
4 lines
225 B
Plaintext
4 lines
225 B
Plaintext
# Locally calculated after checking pgp signature
|
|
sha256 127a24cde208c65b837ae978c695a00730f1094ee8b6c7d48cf58ef846eae340 rauc-1.15.2.tar.xz
|
|
sha256 20e50fe7aae3e56378ebf0417d9de904f55a0e61e4df315333e632a4d3555d95 COPYING
|