From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Wed, 16 Sep 2026 15:59:17 +0200 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1x6qAP-002oJP-0v for lore@lore.pengutronix.de; Wed, 16 Sep 2026 15:59:17 +0200 Authentication-Results: mx1.white.stw.pengutronix.de; dkim=pass header.d=lists.infradead.org header.s=bombadil.20210309 header.b="Hgal/rYq"; spf=pass (mx1.white.stw.pengutronix.de: domain of "barebox-bounces+lore=pengutronix.de@lists.infradead.org" designates 2607:7c80:54:3::133 as permitted sender) smtp.mailfrom="barebox-bounces+lore=pengutronix.de@lists.infradead.org"; dmarc=none Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id 1C85520216C for ; Wed, 16 Sep 2026 15:59:17 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: Content-Type:In-Reply-To:From:References:To:Subject:MIME-Version:Date: Message-ID:Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From :Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=XO2i1RY+12VXzvBk5Dl5GXQJQJMOLmB0j/5dojRfiqs=; b=Hgal/rYqLmtuduuwNiieQLZhCk Mxi8bgFhWTYi/BqgmCywFq4auRNc0RfZXmQdwbBYWmYp+hVe94xA70n7mzaEMCM48b/+PHF4C2EmN FW8SCDvYHb3At4UzO8M7ESkeUGmc+ZeeD7oiNmn6N57altWOJ7ALjdIRXMyG7aPdVSKXQDAx58Mv9 NELeGtY/ZlhDDBT41RAaBuujEPkVCf2PUO+7Lc1sFQ2K1E3oh4x+QgXp1ZO2v974H5VljEEz4ZTDw 8CChwJb6teO/LVmqrbc/L/xNbTDcMjKQISuXsqSgmWKdn3mVCToPD9UN55qsUwjbzYkrLxM1F8zZy OmmRJvuQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x6q93-00000009Ljz-2YhO; Wed, 16 Sep 2026 13:57:53 +0000 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1x6q8z-00000009LjS-44W4 for barebox@lists.infradead.org; Wed, 16 Sep 2026 13:57:51 +0000 Received: from [0.0.0.0] (ptz.office.stw.pengutronix.de [IPv6:2a0a:edc0:0:900:1d::77]) (Authenticated sender: afa@pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id BBBB9202169; Wed, 16 Sep 2026 15:57:46 +0200 (CEST) Message-ID: <0c5a32a3-3112-44a7-9bd8-2b8f53219912@pengutronix.de> Date: Wed, 16 Sep 2026 15:57:46 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Security Advisory (Was: Re: v2026.08.1 and v2026.04.2) To: Sascha Hauer , barebox@lists.infradead.org References: Content-Language: en-US From: Ahmad Fatoum In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260916_065750_179572_A941543C X-CRM114-Status: UNSURE ( 9.92 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -1.9 (-) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: On 9/16/26 15:17, Sascha Hauer wrote: > Along with barebox-2026.09.0 we also have two stable releases with the > FIT image vulnerabilities mentioned in the v2026.09.0 announcement > fixed. > > Users u [...] Content analysis details: (-1.9 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 DMARC_MISSING Missing DMARC policy X-BeenThere: barebox@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "barebox" X-Rspamd-Server: mx1 X-Stat-Signature: f69uby6truhcoj8he1suaerepfrs8wei X-Rspamd-Queue-Id: 1C85520216C X-Spamd-Result: default: False [-57.61 / 15.00]; RECEIVED_AUTHENTICATED_BY_MX1(-50.00)[]; BAYES_HAM(-3.00)[99.99%]; DWL_DNSWL_MED(-2.00)[infradead.org:dkim]; KNOWN_LIST_ID(-1.00)[barebox.lists.infradead.org]; RCVD_DKIM_ARC_DNSWL_MED(-0.50)[]; RCVD_IN_DNSWL_MED(-0.40)[2607:7c80:54:3::133:from,2a0a:edc0:0:900:1d::77:received]; R_SPF_ALLOW(-0.20)[+mx:c]; MAILLIST(-0.20)[mailman]; R_DKIM_ALLOW(-0.20)[lists.infradead.org:s=bombadil.20210309]; MIME_GOOD(-0.10)[text/plain]; HAS_LIST_UNSUB(-0.01)[]; RCPT_COUNT_TWO(0.00)[2]; RECEIVED_HELO_LOCALHOST(0.00)[]; DMARC_NA(0.00)[pengutronix.de]; ARC_NA(0.00)[]; FORWARDED(0.00)[barebox@lists.infradead.org]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; MIME_TRACE(0.00)[0:+]; RCVD_COUNT_THREE(0.00)[3]; RCVD_TLS_LAST(0.00)[]; TAGGED_FROM(0.00)[lore=pengutronix.de]; FROM_NEQ_ENVFROM(0.00)[a.fatoum@pengutronix.de,barebox-bounces@lists.infradead.org]; MID_RHS_MATCH_FROM(0.00)[]; NEURAL_HAM(-0.00)[-1.000]; FORGED_SENDER_FORWARDING(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; DKIM_TRACE(0.00)[lists.infradead.org:+]; ASN(0.00)[asn:7247, ipnet:2607:7c80:54::/48, country:US]; FORGED_SENDER(0.00)[a.fatoum@pengutronix.de,barebox-bounces@lists.infradead.org]; FORGED_SENDER_MAILLIST(0.00)[] X-Rspamd-Action: no action On 9/16/26 15:17, Sascha Hauer wrote: > Along with barebox-2026.09.0 we also have two stable releases with the > FIT image vulnerabilities mentioned in the v2026.09.0 announcement > fixed. > > Users using FIT image based secure boot are urged to update to one of > these versions. > > A Github security advisory is currently under review and a CVE has been > requested. I'll keep you noticed once both are available. We're still waiting on the CVE, but the advisory is published here: https://github.com/barebox/barebox/security/advisories/GHSA-jhvm-7xq8-rvgm We strongly recommend updating if you depend on barebox to verify FIT signatures. Ahmad > > Sascha > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |