On Mon Oct 5, 2026 at 11:06 AM CEST, Yoann Congal via lists.openembedded.org wrote: > On Wed Sep 30, 2026 at 10:16 AM CEST, Mathieu Dubois-Briand via > lists.openembedded.org wrote: >> Version 10.49 28-September-2026 >> ------------------------------- >> >> This is a security-only release, to address GHSA-r9hj-j2rw-4q3m. >> >> Compared to 10.48, this release has only a minimal code change to prevent an >> out-of-bounds write with arbitrary data. An attacker-controlled regex pattern >> is required, and applications are only affected if using the >> pcre2_jit_stack_create() and pcre2_jit_stack_assign() APIs to provide a >> growable >> JIT stack, and then matching against a pattern with unusually high JIT stack >> usage, such as a large number of capturing groups. >> >> The implications of an out-of-bounds write could include arbitrary code >> execution. >> >> The issue is not a regression and affects releases 10.48 and earlier. >> >> Signed-off-by: Mathieu Dubois-Briand <[email protected]> >> --- >> meta/recipes-support/libpcre/{libpcre2_10.48.bb => libpcre2_10.49.bb} | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/meta/recipes-support/libpcre/libpcre2_10.48.bb >> b/meta/recipes-support/libpcre/libpcre2_10.49.bb >> similarity index 96% >> rename from meta/recipes-support/libpcre/libpcre2_10.48.bb >> rename to meta/recipes-support/libpcre/libpcre2_10.49.bb >> index 56791171c238..5fa7c3db3b4c 100644 >> --- a/meta/recipes-support/libpcre/libpcre2_10.48.bb >> +++ b/meta/recipes-support/libpcre/libpcre2_10.49.bb >> @@ -20,7 +20,7 @@ SRC_URI = >> "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \ >> GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"; >> UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$" >> >> -SRC_URI[sha256sum] = >> "b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed" >> +SRC_URI[sha256sum] = >> "53c156e1ba416a20da8e65395daa132da0d80e76910424caca3fcdae7831d384" >> >> CVE_PRODUCT = "pcre2" >> > > Hello, > > Shouldn't this patch have removed > meta/recipes-support/libpcre/libpcre2/testoutput3C ? > > See: > https://git.openembedded.org/openembedded-core/commit/?id=3c447001749427b151dc2e6f08c790bac77b1c43 > > Regards,
Hi, I assumed it had to stay for this release, but my tests are proving me wrong. I will send a patch to remove it. Thanks, Mathieu -- Mathieu Dubois-Briand, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247244): https://lists.openembedded.org/g/openembedded-core/message/247244 Mute This Topic: https://lists.openembedded.org/mt/121505014/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
