Skip to content

[zlib] Fix CVE-2022-37434#26792

Merged
vicroms merged 4 commits intomicrosoft:masterfrom
Faaux:zlib-CVE-2022-37434
Sep 26, 2022
Merged

[zlib] Fix CVE-2022-37434#26792
vicroms merged 4 commits intomicrosoft:masterfrom
Faaux:zlib-CVE-2022-37434

Conversation

@Faaux
Copy link
Copy Markdown
Contributor

@Faaux Faaux commented Sep 14, 2022

Describe the pull request

  • What does your PR fix?

    Fixes CVE-2022-37434 for zlib through 1.2.12

  • Which triplets are supported/not supported? Have you updated the [CI baseline]

Same as before

  • Does your PR follow the maintainer guide?

    Yes

  • If you have added/updated a port: Have you run ./vcpkg x-add-version --all and committed the result?

    Yes

@ghost
Copy link
Copy Markdown

ghost commented Sep 14, 2022

CLA assistant check
All CLA requirements met.

@Faaux
Copy link
Copy Markdown
Contributor Author

Faaux commented Sep 14, 2022

Hope this all works out (first time contributing), corresponding issue: #26790

github-actions[bot]
github-actions bot previously approved these changes Sep 15, 2022
@FrankXie05 FrankXie05 added the category:port-bug The issue is with a library, which is something the port should already support label Sep 15, 2022
github-actions[bot]
github-actions bot previously approved these changes Sep 15, 2022
github-actions[bot]
github-actions bot previously approved these changes Sep 16, 2022
@FrankXie05 FrankXie05 linked an issue Sep 16, 2022 that may be closed by this pull request
@FrankXie05 FrankXie05 added the info:needs-maintainer-attention Lets the current 'on rotation' vcpkg maintainer know they need to look at this. label Sep 20, 2022
@FrankXie05 FrankXie05 added requires:author-response and removed info:needs-maintainer-attention Lets the current 'on rotation' vcpkg maintainer know they need to look at this. labels Sep 20, 2022
Co-authored-by: Frank <65999885+FrankXie05@users.noreply.github.com>
Copy link
Copy Markdown

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a new experimental fast check for PR issues. Please let us know if this bot is helpful!

PRs must add only one version and must not modify any published versions

When making any changes to a library, the version or port-version in vcpkg.json or CONTROL must be modified.

error: checked-in files for zlib have changed but the version was not updated
version: 1.2.12#2
old SHA: 026d6d9651ff45fd010acbc952c303d7069f2be8
new SHA: d40d86865ecbcc5b54d21f840dd2212556aeadd5
Did you remember to update the version or port version?
Use --overwrite-version to bypass this check
***No files were updated***

@FrankXie05
Copy link
Copy Markdown
Contributor

/azp run

@azure-pipelines
Copy link
Copy Markdown

Azure Pipelines successfully started running 1 pipeline(s).

@FrankXie05 FrankXie05 added the info:needs-maintainer-attention Lets the current 'on rotation' vcpkg maintainer know they need to look at this. label Sep 23, 2022
@dan-shaw dan-shaw added the requires:vcpkg-team-review This PR or issue requires someone on the vcpkg team to take a further look. label Sep 26, 2022
@vicroms vicroms removed the requires:vcpkg-team-review This PR or issue requires someone on the vcpkg team to take a further look. label Sep 26, 2022
@vicroms vicroms merged commit 143bc76 into microsoft:master Sep 26, 2022
@Neustradamus
Copy link
Copy Markdown

@madler has done the new build, the 1.2.13 has been released with the CVE-2022-37434 fix.

@FrankXie05
Copy link
Copy Markdown
Contributor

@Neustradamus You can submit a new issue to update zlib and remove the patch.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

category:port-bug The issue is with a library, which is something the port should already support info:needs-maintainer-attention Lets the current 'on rotation' vcpkg maintainer know they need to look at this.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[zlib] patch CVE-2022-37434

7 participants