mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-07-27 07:27:12 +00:00
Code Issues Projects Releases Wiki Activity

diffoscope: fix CVE-2024-25711

Browse Source 
diffoscope before 256 allows directory traversal via an embedded
filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa,
may be disclosed to an attacker. This occurs because the value of the
gpg --use-embedded-filenames option is trusted.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-25711

Upstream patches:
https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/458f7f04bc053a0066aa7d2fd3251747d4899476

(From OE-Core rev: da4977e9414361a30eb322d1456a664515b35693)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Jiaying Song
2024-12-04 18:21:18 +08:00
committed by Steve Sakoman
parent 450857b441
commit 82902b3d64
2 changed files with 117 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-support/diffoscope/diffoscope_208.bb
+1
View File
@@ -12,6 +12,7 @@ PYPI_PACKAGE = "diffoscope"
inherit pypi setuptools3
SRC_URI += " file://CVE-2024-25711.patch"
SRC_URI[sha256sum] = "2c5c0ac1159eefce158154849fe67f0f527dffc5295bfd3ca1aef14962ffcbcb"
RDEPENDS:${PN} += "binutils vim squashfs-tools python3-libarchive-c python3-magic python3-rpm"