mirrors/buildroot
0
0
Fork 0
mirror of https://git.busybox.net/buildroot.git synced 2024-11-27 07:23:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

package/zsh: security bump to version 5.8.1

Browse Source 
Fixes the following security issue:

- CVE-2021-45444: In zsh before 5.8.1, an attacker can achieve code
  execution if they control a command output inside the prompt, as
  demonstrated by a %F argument.  This occurs because of recursive
  PROMPT_SUBST expansion.

The 5.8.1 release is not listed in MD5SUM, so drop the md5 hash.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ca6c2ee3da)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Peter Korsgaard 2022-02-18 14:30:55 +01:00
parent 15d2938c24
commit f45f6bae0d
2 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
package/zsh/zsh.hash
View File

@ -1,7 +1,3 @@
# From http://www.zsh.org/pub/MD5SUM
md5 e02a5428620b3dd268800c7843b3dd4d zsh-5.8.tar.xz
# Calculated based on the hash above and after checking signature
# http://www.zsh.org/pub/zsh-5.8.tar.xz.asc
sha256 dcc4b54cc5565670a65581760261c163d720991f0d06486da61f8d839b52de27 zsh-5.8.tar.xz
# Locally calculated
sha256 b6973520bace600b4779200269b1e5d79e5f505ac4952058c11ad5bbf0dd9919 zsh-5.8.1.tar.xz
sha256 d06fdf3ef9b1ec69d6b9e170b0a9516fbad3523261ff1668bde3bfea6e0ef5f5 LICENCE

2
package/zsh/zsh.mk
View File

@ -4,7 +4,7 @@
#
################################################################################
ZSH_VERSION = 5.8
ZSH_VERSION = 5.8.1
ZSH_SITE = http://www.zsh.org/pub
ZSH_SOURCE = zsh-$(ZSH_VERSION).tar.xz
ZSH_DEPENDENCIES = ncurses