package/lxc: security bump to version 3.0.3
authorFabrice Fontaine <fontaine.fabrice@gmail.com>
Sun, 2 Dec 2018 09:08:38 +0000 (10:08 +0100)
committerThomas Petazzoni <thomas.petazzoni@bootlin.com>
Mon, 3 Dec 2018 08:09:44 +0000 (09:09 +0100)
commitdf6a01af235c02104e88ea771a5e9c74698d1aba
treeac25eb08c3a88395dfef4820aeb2bca607029a85
parent29e77c070bfea2e1028ddb77d38374e83f8ac18f
package/lxc: security bump to version 3.0.3

This bump also includes the fix for CVE-2018-6556 released in 3.0.2 via
commit "CVE 2018-6556: verify netns fd in lxc-user-nic": lxc-user-nic
when asked to delete a network interface will unconditionally open a
user provided path:
https://github.com/lxc/lxc/commit/c1cf54ebf251fdbad1e971679614e81649f1c032

This code path may be used by an unprivileged user to check for the
existence of a path which they wouldn't otherwise be able to reach. It
may also be used to trigger side effects by causing a (read-only) open
of special kernel files (ptmx, proc, sys).

Also add a dependency on gcc >= 4.7
(https://github.com/lxc/lxc/issues/2592)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
package/lxc/Config.in
package/lxc/lxc.hash
package/lxc/lxc.mk