Repository navigation
expat 2.9.0 for CVE-2026-77214, with iana-etc 20260930, cmake 4.4.4 and openssh 10.6p1 - #229
Merged
Merged
Conversation
…len against the buffer it was given (CVE-2026-77214) and fixes an integer overflow in expat_realloc on 32-bit targets (CVE-2026-102633), signed by the same subkey of the pinned key as 2.8.5 The image's python3 reads XML through the system expat (--with-system-expat), so pyexpat carries the fix. x86_64 does not reach the 32-bit overflow. 2.9.0 also drops the attribute-info and minimum-size features, both off by default and never enabled by the recipe, and moves the library to libexpat.so.1.13.0, still libexpat.so.1. The release signature verifies against subkey CB8DE70A90CFBF6C3BF5CC5696262ACFFBD3AEC6 of the pinned 3176EF7DB2367F1FCA4F306B1F9B0E909AF37285.
…tries of 2026-09-30; data files only, nothing is built
…nted feature or interface; the binary the chroot runs and the source fallback move together, and the sum list that names both is signed by the pinned key Upstream's note for 4.4.4 says only that implementation updates were made for ecosystem changes and regressions. cmake builds json-c and nothing else here and is not in the image. cmake-4.4.4-SHA-256.txt.asc verifies against subkey C6C265324BBEBDC350B513D02D2CEF1034921684 of the pinned CBA23971357C2E6590D9EFD3EC8FEF3A7BFB4EDA.
…a row for a current pin
…n (dates converted with the wrong daylight-saving offset, so a certificate could carry an expiry an hour off) is the only one the image can reach, since ssh-keygen is all it builds; signed by the pinned key Everything else in the release is sshd, ssh and sftp: the LZ77 compression side channel, GSSAPI credential handling, sftp path validation, the "restrict" keyword and tunnel forwarding, usernames with $ and \ on the command line. None of those programs is built (build/recipes/openssh.sh makes ssh-keygen alone, for -Y verification). Upstream says it will now release more often; the pin follows. The tarball's signature verifies against the pinned 7168B983815A5EEF59A4ADFD2A3F414E736060BA.
DevomB
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The pin gate on main went red on 2026-10-05 when three upstreams released. Each pin moves to the release instead of taking a review row.
XML_ParseBuffernow checkslenagainst the buffer it handed out; CVE-2026-102633, an integer overflow inexpat_reallocon 32-bit targets, which x86_64 does not reach. The image's python3 is built--with-system-expat, so pyexpat carries the fix. The release drops two features that were off by default and never enabled here (attribute info, minimum size) and moves the library to libexpat.so.1.13.0, still libexpat.so.1. Signature verified against the same subkey of the pinned key that signed 2.8.5./etc/servicesand/etc/protocolsfrom IANA's registries of 2026-09-30. Data files, nothing is built.Proof: CI's pin gate on this branch, and a Distro run, since stage 04 rebuilds from expat on.