Re: [Buildroot] [PATCH v2] package/botan: security bump to version 3.11.1
Julien Olivain via buildroot <[email protected]>
| Newsgroups | net.busybox.buildroot |
|---|---|
| Message-ID | <[email protected]> |
On 20/04/2026 21:07, Shubham Chakraborty wrote: > - Update BOTAN_VERSION to 3.11.1 > - Remove > 0001-Add-more-value-barriers-to-avoid-compiler-induced-side-channels.patch > as it is already integrated upstream in this version. > > Fixed in 3.11.1: > - CVE-2026-35580: Resolve certificate verification bypass bug > introduced > in 3.11.0 (GH #5500) > - CVE-2026-35582: Resolve TLS 1.3 client authentication bypass (GH > #5599) > > Fixed in 3.11.0: > - CVE-2026-32877: Fix a heap over-read during SM2 decryption (GH #5450) > - CVE-2026-32883: Fix an OCSP response forgery vulnerability (GH #5449) > - CVE-2026-32884: Fix a name constraints bypass for DNS names (GH > #5448) > > - Remove the --disable-altivec configuration option as it has been > removed > from the Botan build system in version 3.x > - Optimize the --disable-neon logic using the yx pattern. > In Botan 3.x, the --disable-neon flag is specifically targeted at the > arm32 architecture. Furthermore, Buildroot's BR2_ARM_CPU_HAS_NEON > variable is only defined for 32-bit ARM, which previously caused a > false-positive --disable-neon flag to be passed on AArch64 builds > - Update license.txt hash in botan.hash due to the copyright year > update > to 2026 > > https://botan.randombit.net/news.html#version-3-11-1-2026-03-31 > > Signed-off-by: Shubham Chakraborty <[email protected]> Applied to master, thanks. _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot