Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[qt5-base] patch CVE-2023-43114 #34166

Merged
merged 3 commits into from Oct 3, 2023

Conversation

carsten-grimm
Copy link
Contributor

Fix #34164

  • Changes comply with the maintainer guide
  • SHA512s are updated for each updated download
  • The "supports" clause reflects platforms that may be fixed by this new version
  • Any fixed CI baseline entries are removed from that file.
  • Any patches that are no longer applied are deleted from the port's directory.
  • The version database is fixed by rerunning ./vcpkg x-add-version --all and committing the result.
  • Only one version is added to each modified port's versions file.

This PR applies the official patch for CVE-2023-43114 from the corresponding security advisory by Qt.

The second vunerability from the security advisory, CVE-2023-4863, needs to be applied to qt5-imageformats, separately.

@carsten-grimm
Copy link
Contributor Author

@carsten-grimm please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

  • (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
  • (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree

@carsten-grimm
Copy link
Contributor Author

carsten-grimm commented Sep 29, 2023

The pipeline for arm_neon_android fails. From the logs:

2023-09-29T20:21:04.2243168Z WARNING: The resource with name 'AndContainerRegistry' and type 'Microsoft.ContainerRegistry/registries' could not be found in subscription 'CPP_GITHUB (7fcb00fa-a761-49de-8a2f-d67190e62882)'.
2023-09-29T20:21:04.2244029Z Using 'andcontainerregistry.azurecr.io' as the default registry login server.
2023-09-29T20:21:04.2386118Z ERROR: Could not connect to the registry login server 'andcontainerregistry.azurecr.io'. Please verify that the registry exists and the URL 'https://andcontainerregistry.azurecr.io/v2/' is reachable from your environment.
2023-09-29T20:21:04.2387569Z Try running 'az acr check-health -n AndContainerRegistry --yes' to diagnose this issue.
2023-09-29T20:21:04.3655515Z ##[error]Bash exited with code '1'.

I suspect that this is an issue with the pipeline itself.

@dg0yt
Copy link
Contributor

dg0yt commented Sep 30, 2023

Add an empty commit to trigger CI without invalidating the cache.

git commit --allow-empty -m CI
git push

@carsten-grimm carsten-grimm marked this pull request as ready for review September 30, 2023 12:28
@BillyONeal BillyONeal merged commit d24cd80 into microsoft:master Oct 3, 2023
15 checks passed
@BillyONeal
Copy link
Member

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[qt5-base] patch CVE-2023-43114
3 participants