dcaratti pushed to wpa_supplicant (rawhide). "P2P: Fix a corner case
in peer addition based on PD Request (..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 09:50:43 UTC
From d60627e92920793877b58b290fcbd4b4e8e95f04 Mon Sep 17 00:00:00 2001
From: Davide Caratti <dcaratti(a)redhat.com>
Date: Mar 01 2021 09:40:38 +0000
Subject: P2P: Fix a corner case in peer addition based on PD Request
CVE-2021-27803
Upstream advisory:
https://w1.fi/security/2021-1/wpa_supplicant-p2p-provision-discovery-proc...
Signed-off-by: Davide Caratti <dcaratti(a)redhat.com>
---
diff --git a/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch b/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
new file mode 100644
index 0000000..1942bb3
--- /dev/null
+++ b/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
@@ -0,0 +1,50 @@
+From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <jouni(a)codeaurora.org>
+Date: Tue, 8 Dec 2020 23:52:50 +0200
+Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD Request
+
+p2p_add_device() may remove the oldest entry if there is no room in the
+peer table for a new peer. This would result in any pointer to that
+removed entry becoming stale. A corner case with an invalid PD Request
+frame could result in such a case ending up using (read+write) freed
+memory. This could only by triggered when the peer table has reached its
+maximum size and the PD Request frame is received from the P2P Device
+Address of the oldest remaining entry and the frame has incorrect P2P
+Device Address in the payload.
+
+Fix this by fetching the dev pointer again after having called
+p2p_add_device() so that the stale pointer cannot be used.
+
+Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
+Signed-off-by: Jouni Malinen <jouni(a)codeaurora.org>
+---
+ src/p2p/p2p_pd.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c
+index 3994ec03f86b..05fd593494ef 100644
+--- a/src/p2p/p2p_pd.c
++++ b/src/p2p/p2p_pd.c
+@@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2p_data *p2p, const u8 *sa,
+ goto out;
+ }
+
++ dev = p2p_get_device(p2p, sa);
+ if (!dev) {
+- dev = p2p_get_device(p2p, sa);
+- if (!dev) {
+- p2p_dbg(p2p,
+- "Provision Discovery device not found "
+- MACSTR, MAC2STR(sa));
+- goto out;
+- }
++ p2p_dbg(p2p,
++ "Provision Discovery device not found "
++ MACSTR, MAC2STR(sa));
++ goto out;
+ }
+ } else if (msg.wfd_subelems) {
+ wpabuf_free(dev->info.wfd_subelems);
+--
+2.25.1
+
diff --git a/wpa_supplicant.spec b/wpa_supplicant.spec
index 6fb8bc5..95aaa37 100644
--- a/wpa_supplicant.spec
+++ b/wpa_supplicant.spec
@@ -9,7 +9,7 @@ Summary: WPA/WPA2/IEEE 802.1X Supplicant
Name: wpa_supplicant
Epoch: 1
Version: 2.9
-Release: 11%{?dist}
+Release: 12%{?dist}
License: BSD
Source0: http://w1.fi/releases/%{name}-%{version}.tar.gz
Source1: wpa_supplicant.conf
@@ -46,6 +46,9 @@ Patch10: 0001-dbus-Export-OWE-capability-and-OWE-BSS-key_mgmt.patch
#fix for CVE-2021-0326
Patch11: 0001-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch
+#fix for CVE-2021-27803
+Patch12: 0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch
+
URL: http://w1.fi/wpa_supplicant/
%if %with gui
@@ -205,6 +208,9 @@ chmod -R 0644 wpa_supplicant/examples/*.py
%changelog
+* Mon Mar 1 2021 Davide Caratti <dcaratti(a)redhat.com> - 1:2.9-12
+- Fix a corner case in peer addition based on PD Request (CVE-2021-27803)
+
* Thu Feb 4 2021 Davide Caratti <dcaratti(a)redhat.com> - 1:2.9-11
- Fix copying of secondary device types for P2P group client (CVE-2021-0326)
https://src.fedoraproject.org/rpms/wpa_supplicant/c/d60627e92920793877b58...
3Â years, 2Â months
rjones pushed to ocaml-lablgl (rawhide). "Rebuild for updated
ocaml-labltk"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 09:48:57 UTC
From d56a92c9fe08e639c8ebbc537fd2cd2eb4ecbdef Mon Sep 17 00:00:00 2001
From: Richard W.M. Jones <rjones(a)redhat.com>
Date: Mar 01 2021 09:47:50 +0000
Subject: Rebuild for updated ocaml-labltk
---
diff --git a/ocaml-lablgl.spec b/ocaml-lablgl.spec
index 5cba38b..b3bce7a 100644
--- a/ocaml-lablgl.spec
+++ b/ocaml-lablgl.spec
@@ -3,7 +3,7 @@
Name: ocaml-lablgl
Epoch: 1
Version: 1.06
-Release: 19%{?dist}
+Release: 20%{?dist}
Summary: LablGL is an OpenGL interface for Objective Caml
License: BSD
@@ -129,6 +129,9 @@ popd
%changelog
+* Mon Mar 1 2021 Richard W.M. Jones <rjones(a)redhat.com> - 1:1.06-20
+- Rebuild for updated ocaml-labltk
+
* Mon Mar 1 09:37:07 GMT 2021 Richard W.M. Jones <rjones(a)redhat.com> - 1:1.06-19
- OCaml 4.12.0 build
https://src.fedoraproject.org/rpms/ocaml-lablgl/c/d56a92c9fe08e639c8ebbc5...
3Â years, 2Â months
vcrhonek pushed to hwdata (rawhide). "New upstream version 0.345"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 09:48:27 UTC
From a39c4f97b9b5eb1fd7cb87788ec48f593b41d8ca Mon Sep 17 00:00:00 2001
From: Vitezslav Crhonek <vcrhonek(a)redhat.com>
Date: Mar 01 2021 09:48:16 +0000
Subject: New upstream version 0.345
---
diff --git a/.gitignore b/.gitignore
index bfa2f27..2955791 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-/v0.344.tar.gz
+/v0.345.tar.gz
diff --git a/hwdata.spec b/hwdata.spec
index 66c80c6..cd26b5d 100644
--- a/hwdata.spec
+++ b/hwdata.spec
@@ -1,6 +1,6 @@
Name: hwdata
Summary: Hardware identification and configuration data
-Version: 0.344
+Version: 0.345
Release: 1%{?dist}
License: GPLv2+
Source: https://github.com/vcrhonek/hwdata/archive/v%{version}.tar.gz
@@ -30,6 +30,9 @@ such as the pci.ids and usb.ids databases.
%{_datadir}/%{name}/*
%changelog
+* Mon Mar 01 2021 Vitezslav Crhonek <vcrhonek(a)redhat.com> - 0.345-1
+- Update pci, usb and vendor ids
+
* Mon Feb 01 2021 Vitezslav Crhonek <vcrhonek(a)redhat.com> - 0.344-1
- Update pci, usb and vendor ids
diff --git a/sources b/sources
index 03b8387..8e9bcd7 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (v0.344.tar.gz) = 69adff88c68152168bacc814b105a310206d82c86ca62125c42c6c5511381d2bbba6b523406abe80dfe593e54dae3c263dceec52701d4be70aa6b0b14920ffd2
+SHA512 (v0.345.tar.gz) = 2e975c7cc16a20bd6e0f36cce5d7c2bfa35531e98fd9607be7ec81c87e343afc898910df4f50cfa592498012b09040062d0156c7f6696df876eab47ecf06c276
https://src.fedoraproject.org/rpms/hwdata/c/a39c4f97b9b5eb1fd7cb87788ec48...
3Â years, 2Â months
rjones pushed to ocaml-findlib (rawhide). "Rebuild for updated
ocaml-labltk"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 09:48:03 UTC
From 6e79c64f1bd47a064b55b4d68eb45630301965f8 Mon Sep 17 00:00:00 2001
From: Richard W.M. Jones <rjones(a)redhat.com>
Date: Mar 01 2021 09:47:54 +0000
Subject: Rebuild for updated ocaml-labltk
---
diff --git a/ocaml-findlib.spec b/ocaml-findlib.spec
index 00a9f44..ebaad05 100644
--- a/ocaml-findlib.spec
+++ b/ocaml-findlib.spec
@@ -1,6 +1,6 @@
Name: ocaml-findlib
Version: 1.8.1
-Release: 24%{?dist}
+Release: 25%{?dist}
Summary: Objective CAML package manager and build helper
License: BSD
@@ -99,6 +99,9 @@ make install \
%changelog
+* Mon Mar 1 2021 Richard W.M. Jones <rjones(a)redhat.com> - 1.8.1-25
+- Rebuild for updated ocaml-labltk
+
* Mon Mar 1 09:37:08 GMT 2021 Richard W.M. Jones <rjones(a)redhat.com> - 1.8.1-24
- OCaml 4.12.0 build
https://src.fedoraproject.org/rpms/ocaml-findlib/c/6e79c64f1bd47a064b55b4...
3Â years, 2Â months
rjones pushed to ocaml-labltk (rawhide). "New upstream version
8.06.10. (..more)"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 09:43:25 UTC
From 64c4e0ae4e5f91c6b1e14cf505c46978996530af Mon Sep 17 00:00:00 2001
From: Richard W.M. Jones <rjones(a)redhat.com>
Date: Mar 01 2021 09:42:13 +0000
Subject: New upstream version 8.06.10.
Now hosted on github.
---
diff --git a/.gitignore b/.gitignore
index 5791030..cb52f52 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@
/labltk-8.06.3.tar.gz
/labltk-8.06.4.tar.gz
/labltk-8.06.5.tar.gz
+/8.06.10.tar.gz
diff --git a/ocaml-labltk.spec b/ocaml-labltk.spec
index 00c7537..74d1fef 100644
--- a/ocaml-labltk.spec
+++ b/ocaml-labltk.spec
@@ -5,15 +5,15 @@
%endif
Name: ocaml-labltk
-Version: 8.06.5
-Release: 23%{?dist}
+Version: 8.06.10
+Release: 1%{?dist}
Summary: Tcl/Tk interface for OCaml
License: LGPLv2+ with exceptions
-URL: https://forge.ocamlcore.org/projects/labltk/
-Source0: https://forge.ocamlcore.org/frs/download.php/1727/labltk-%{version}.tar.gz
+URL: https://github.com/garrigue/labltk
+Source0: https://github.com/garrigue/labltk/archive/8.06.10.tar.gz
# This adds debugging (-g) everywhere.
Patch1: labltk-8.06.0-enable-debugging.patch
@@ -117,6 +117,10 @@ install -m 0644 camltk/*.o $RPM_BUILD_ROOT%{_libdir}/ocaml/labltk
%changelog
+* Mon Mar 1 22:24:19 GMT 2021 Richard W.M. Jones <rjones(a)redhat.com> - 8.06.10-1
+- New upstream version 8.06.10.
+- Now hosted on github.
+
* Sun Feb 28 22:24:19 GMT 2021 Richard W.M. Jones <rjones(a)redhat.com> - 8.06.5-23
- Bump release and rebuild.
diff --git a/sources b/sources
index adc94e9..7e942e4 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (labltk-8.06.5.tar.gz) = 8a6bfefd1ba8ef1fb54c284a06067007dd48833a475e24c787c0c2100a30a5ab018606ca3e79fd0fa323b6759de0ae3c7e6ef881e662bf1d7f84e920c7bebe7a
+SHA512 (8.06.10.tar.gz) = ef797d21adac48ca5ed35d95ad05fee26f9b6c99b0510909f6087abb9580b8efd219ca65b1efddb170b5409567d83eaaac0473898f5f4db3e15ae4f39df364c8
https://src.fedoraproject.org/rpms/ocaml-labltk/c/64c4e0ae4e5f91c6b1e14cf...
3Â years, 2Â months
adelton pushed to swid-tools (rawhide). "Rebased to 0.8.12."
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 09:43:20 UTC
From 6bd37f43e0a8a55bd720f7f3aa923c13cd017151 Mon Sep 17 00:00:00 2001
From: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Mar 01 2021 09:43:07 +0000
Subject: Rebased to 0.8.12.
---
diff --git a/.gitignore b/.gitignore
index 28e48bb..d875db3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@
/rpm2swidtag-0.8.9.tar.gz
/rpm2swidtag-0.8.10.tar.gz
/rpm2swidtag-0.8.11.tar.gz
+/rpm2swidtag-0.8.12.tar.gz
diff --git a/sources b/sources
index c39495e..f4be5b9 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (rpm2swidtag-0.8.11.tar.gz) = 5cd1aae99f74f0722fedd32467ab7c8162987d289d8527f46fb738854c40731038e374359a7f1502cf942640bd0c8209bf380210e296348fdd9625b09c574e0b
+SHA512 (rpm2swidtag-0.8.12.tar.gz) = fdd96355bcfbcf4933b61bde4bf150f1843b397ab5cc5d84dac149c3f0d1e4fb3aac50718cbee3f2bcdc103b0d90cf5a22355b66666522557f91ec99f828de86
diff --git a/swid-tools.spec b/swid-tools.spec
index aaeb7a0..ef3c588 100644
--- a/swid-tools.spec
+++ b/swid-tools.spec
@@ -3,8 +3,8 @@
Summary: Tools for producing SWID tags for rpm packages and inspecting the SWID tags
Name: swid-tools
-Version: 0.8.11
-Release: 4%{?dist}
+Version: 0.8.12
+Release: 1%{?dist}
License: ASL 2.0
URL: https://github.com/swidtags/rpm2swidtag
Source0: https://github.com/swidtags/%{upstream_name}/releases/download/%{upstream...
@@ -97,6 +97,9 @@ if rpm -q rpm2swidtag dnf-plugin-swidtags 2> /dev/null | grep -E -q '(rpm2swidta
fi
%changelog
+* Mon Mar 01 2021 Jan Pazdziora <jpazdziora(a)redhat.com> - 0.8.12-1
+- Rebased to 0.8.12.
+
* Mon Mar 01 2021 Jan Pazdziora <jpazdziora(a)redhat.com> - 0.8.11-4
- Revert the 1900816 workaround.
https://src.fedoraproject.org/rpms/swid-tools/c/6bd37f43e0a8a55bd720f7f3a...
3Â years, 2Â months
nsella pushed to libdnf (f32). "Update to 0.58.0"
by notificationsï¼ fedoraproject.org
Notification time stamped 2021-03-01 09:42:39 UTC
From 40fe427d8f9be220ba2ae171b8d950cb72c9d3c8 Mon Sep 17 00:00:00 2001
From: Nicola Sella <nsella(a)redhat.com>
Date: Mar 01 2021 09:31:33 +0000
Subject: Update to 0.58.0
---
diff --git a/.gitignore b/.gitignore
index 1d727e8..9c0b3d7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,3 +47,4 @@
/libdnf-0.54.2.tar.gz
/libdnf-0.55.0.tar.gz
/libdnf-0.55.2.tar.gz
+/libdnf-0.58.0.tar.gz
diff --git a/libdnf.spec b/libdnf.spec
index 542ac11..7a5e190 100644
--- a/libdnf.spec
+++ b/libdnf.spec
@@ -4,8 +4,8 @@
%global dnf_conflict 4.3.0
%global swig_version 3.0.12
%global libdnf_major_version 0
-%global libdnf_minor_version 55
-%global libdnf_micro_version 2
+%global libdnf_minor_version 58
+%global libdnf_micro_version 0
%define __cmake_in_source_build 1
@@ -311,6 +311,25 @@ popd
%endif
%changelog
+* Mon Mar 01 2021 Nicola Sella <nsella(a)redhat.com> - 0.58.0-1
+- Update to 0.58.0
+- Option: Add reset() method
+- Add OptionBinds::getOption() method
+- [context] Add dnf_repo_conf_from_gkeyfile() and dnf_repo_conf_reset()
+- [context] Add support for options: minrate, throttle, bandwidth, timeout
+- [context] Remove g_key_file_get_string() from dnf_repo_set_keyfile_data()
+- Add ASAN_OPTIONS for test_libdnf_main
+- [context,API] Functions for accessing main/global configuration options
+- [context,API] Function for adding setopt
+- Add getter for modular obsoletes from ModuleMetadata
+- Add ModulePackage.getStaticContext() and getRequires()
+- Add compatible layer for MdDocuments v2
+- Fix modular queries with the new solver
+- Improve formatting of error string for modules
+- Fix load/update FailSafe
+- Add a new option module_obsoletes
+- Add new API applyObsoletes() function to apply modular obsoletes
+
* Wed Dec 02 2020 Nicola Sella <nsella(a)redhat.com> - 0.55.2-1
- Update to 0.55.2
- Improve performance of query installed() and available()
diff --git a/sources b/sources
index 80b866a..3374ed1 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (libdnf-0.55.2.tar.gz) = 1c2844e6ba2e53287d5c67b9e01b7c6731d867bb5c23846261b40234979cc0ccb92916c429ed5e106af3e94115c288ffafa92981dd7833e65c5015912465043f
+SHA512 (libdnf-0.58.0.tar.gz) = 1f73888a592b1eec49e27cc6786a85c1ed828f3a715f8f3fa9c429aac0ea70005524372b35d9a2b92a343d7962e86f0d117f4015cb8c4337057075da8964b1ea
https://src.fedoraproject.org/rpms/libdnf/c/40fe427d8f9be220ba2ae171b8d95...
3Â years, 2Â months