main/libgcrypt: fix CVE-2019-12904

ref #10692 Closes GH-9727
alpinelinux · Jul 28, 2019 · 5b4846d · 5b4846d
1 parent 578c419
commit 5b4846d
Show file tree

Hide file tree

Showing 2 changed files with 485 additions and 5 deletions.
diff --git a/main/libgcrypt/APKBUILD b/main/libgcrypt/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libgcrypt
 pkgver=1.8.4
-pkgrel=0
+pkgrel=1
 pkgdesc="general purpose crypto library based on the code used in GnuPG"
 url="http://www.gnupg.org"
 arch="all"
@@ -10,15 +10,19 @@ depends=""
 depends_dev="libgpg-error-dev"
 makedepends="$depends_dev texinfo"
 subpackages="$pkgname-dev $pkgname-doc"
-source="https://www.gnupg.org/ftp/gcrypt/libgcrypt/$pkgname-$pkgver.tar.bz2"
+source="https://www.gnupg.org/ftp/gcrypt/libgcrypt/$pkgname-$pkgver.tar.bz2
+	CVE-2019-12904.patch
+	"
 builddir="$srcdir"/$pkgname-$pkgver
 options="!checkroot"
 
 # secfixes:
+#   1.8.4-r1:
+#     - CVE-2019-12904
 #   1.8.3-r0:
-#   - CVE-2018-0495
+#     - CVE-2018-0495
 
-build () {
+build() {
 	cd "$builddir"
 
 	local _arch_configure=
@@ -58,4 +62,5 @@ package() {
 	rm -f ${pkgdir}/usr/share/info/dir
 }
 
-sha512sums="b831fc337eb14806897e224b0d1e78d1f8e9db91dffa818a015a4aa104144e2d971e5a855904907ee2bb9990a9d526de32d6787e1cae98e28a65c3258b2b1ea1  libgcrypt-1.8.4.tar.bz2"
+sha512sums="b831fc337eb14806897e224b0d1e78d1f8e9db91dffa818a015a4aa104144e2d971e5a855904907ee2bb9990a9d526de32d6787e1cae98e28a65c3258b2b1ea1  libgcrypt-1.8.4.tar.bz2
+36f5f7f99e2c4f28207f91a7a500c3bca81044027b6d37ed0399e395a36638b37c0dff3145854a6caa2e9383722862b37a82bde1af520f06a9f4b327df1ec0af  CVE-2019-12904.patch"