From d4dbcb036a8f3708eca974be3d6a62b1b4ca6bb0 Mon Sep 17 00:00:00 2001 From: Baruch Siach Date: Tue, 15 Jan 2019 18:37:28 +0200 Subject: [PATCH] gnupg2: security bump to version 2.2.12 Fixes CVE-2018-1000858: Cross Site Request Forgery with arbitrary HTTPS GET requests via HTTP redirect. https://sektioneins.de/en/advisories/advisory-012018-gnupg-wkd.html Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard --- package/gnupg2/gnupg2.hash | 8 ++++---- package/gnupg2/gnupg2.mk | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package/gnupg2/gnupg2.hash b/package/gnupg2/gnupg2.hash index a367effcab..f985e11ad3 100644 --- a/package/gnupg2/gnupg2.hash +++ b/package/gnupg2/gnupg2.hash @@ -1,7 +1,7 @@ -# From https://lists.gnupg.org/pipermail/gnupg-announce/2018q3/000428.html -sha1 3e87504e2ca317718aa9b6299947ebf7e906b54e gnupg-2.2.10.tar.bz2 +# From https://lists.gnupg.org/pipermail/gnupg-announce/2018q4/000433.html +sha1 2aeccc35ea8034306ff7a1072b84abbaa79619c3 gnupg-2.2.12.tar.bz2 # Calculated based on the hash above and signature -# https://gnupg.org/ftp/gcrypt/gnupg/gnupg-2.2.10.tar.bz2.sig +# https://gnupg.org/ftp/gcrypt/gnupg/gnupg-2.2.12.tar.bz2.sig # using key D8692123C4065DEA5E0F3AB5249B39D24F25E3B6 -sha256 799dd37a86a1448732e339bd20440f4f5ee6e69755f6fd7a73ee8af30840c915 gnupg-2.2.10.tar.bz2 +sha256 db030f8b4c98640e91300d36d516f1f4f8fe09514a94ea9fc7411ee1a34082cb gnupg-2.2.12.tar.bz2 sha256 bc2d6664f6276fa0a72d57633b3ae68dc7dcb677b71018bf08c8e93e509f1357 COPYING diff --git a/package/gnupg2/gnupg2.mk b/package/gnupg2/gnupg2.mk index 64329522d5..9365e960f2 100644 --- a/package/gnupg2/gnupg2.mk +++ b/package/gnupg2/gnupg2.mk @@ -4,7 +4,7 @@ # ################################################################################ -GNUPG2_VERSION = 2.2.10 +GNUPG2_VERSION = 2.2.12 GNUPG2_SOURCE = gnupg-$(GNUPG2_VERSION).tar.bz2 GNUPG2_SITE = https://gnupg.org/ftp/gcrypt/gnupg GNUPG2_LICENSE = GPL-3.0+ -- 2.30.2