* v2026.08.1 and v2026.04.2
@ 2026-09-16 13:17 Sascha Hauer
2026-09-16 13:57 ` Security Advisory (Was: Re: v2026.08.1 and v2026.04.2) Ahmad Fatoum
0 siblings, 1 reply; 2+ messages in thread
From: Sascha Hauer @ 2026-09-16 13:17 UTC (permalink / raw)
To: barebox
Along with barebox-2026.09.0 we also have two stable releases with the
FIT image vulnerabilities mentioned in the v2026.09.0 announcement
fixed.
Users using FIT image based secure boot are urged to update to one of
these versions.
A Github security advisory is currently under review and a CVE has been
requested. I'll keep you noticed once both are available.
Sascha
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
^ permalink raw reply [flat|nested] 2+ messages in thread
* Security Advisory (Was: Re: v2026.08.1 and v2026.04.2)
2026-09-16 13:17 v2026.08.1 and v2026.04.2 Sascha Hauer
@ 2026-09-16 13:57 ` Ahmad Fatoum
0 siblings, 0 replies; 2+ messages in thread
From: Ahmad Fatoum @ 2026-09-16 13:57 UTC (permalink / raw)
To: Sascha Hauer, barebox
On 9/16/26 15:17, Sascha Hauer wrote:
> Along with barebox-2026.09.0 we also have two stable releases with the
> FIT image vulnerabilities mentioned in the v2026.09.0 announcement
> fixed.
>
> Users using FIT image based secure boot are urged to update to one of
> these versions.
>
> A Github security advisory is currently under review and a CVE has been
> requested. I'll keep you noticed once both are available.
We're still waiting on the CVE, but the advisory is published here:
https://github.com/barebox/barebox/security/advisories/GHSA-jhvm-7xq8-rvgm
We strongly recommend updating if you depend on barebox to verify
FIT signatures.
Ahmad
>
> Sascha
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-16 13:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-16 13:17 v2026.08.1 and v2026.04.2 Sascha Hauer
2026-09-16 13:57 ` Security Advisory (Was: Re: v2026.08.1 and v2026.04.2) Ahmad Fatoum
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox