""" This release fixes vulnerabilities in the FIT image code. Most important one is fixed with "FIT: resolve FIT images case-sensitively". This vulnerability allowed to trick barebox into verifying one FIT image node while booting another. The issue showed up in a security audit and is fixed in this release, stable updates for v2026.04 and v2026.08 will follow shortly.
Another issue fixed is that a hash node in a FIT image defines its algorithm. We used to look only at the first hash node. If that says crc32 then barebox would use that to verify the image data. This is changed to iterate over the available algos from strong to weak and see if one of them can verify the image data. crc32, md5 and sha1 are explicitly no longer allowed. Note that this vulnerability requires a signed FIT image with crc32 as hashing algorithm, something a properly signed FIT image shouldn't have, but as crc32 used to be the pre-secure-boot standard, it could well have leaked into images. On the brighter side this release adds support for the Novarq Tactical 1000 board which is a switch built around the Microchip LAN9696. Also the PXA support has been revived, with the PXA3xx as a fully supported device tree platform. """ Signed-off-by: Richard Purdie <[email protected]> --- meta/recipes-bsp/barebox/barebox-common.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meta/recipes-bsp/barebox/barebox-common.inc b/meta/recipes-bsp/barebox/barebox-common.inc index a9f0593e27f..d94798193b3 100644 --- a/meta/recipes-bsp/barebox/barebox-common.inc +++ b/meta/recipes-bsp/barebox/barebox-common.inc @@ -3,6 +3,6 @@ SECTION = "bootloaders" LIC_FILES_CHKSUM = "file://COPYING;md5=f5125d13e000b9ca1f0d3364286c4192" -PV = "2026.08.0" +PV = "2026.09.0" SRC_URI = "https://barebox.org/download/barebox-${PV}.tar.bz2"; -SRC_URI[sha256sum] = "5b270cbde7f2fc6a78ff6e748eef788bbc04571682e2f2e964cd15a2e009774c" +SRC_URI[sha256sum] = "491b504c8a79b5a4e30c419b824916b7329bad8abfe34987ba066bafa1fbcfc5"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246297): https://lists.openembedded.org/g/openembedded-core/message/246297 Mute This Topic: https://lists.openembedded.org/mt/121353670/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
