Skip to content

Nopatch lua CVE-2020-15889 #153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dmcilvaney merged 3 commits into from
Sep 29, 2020
Merged

Nopatch lua CVE-2020-15889 #153

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
926225d
nopatch lua CVE-2020-15889
dmcilvaney Sep 28, 2020
77d4198
Update manifests
dmcilvaney Sep 28, 2020
0f14d52
Fix version typo
dmcilvaney Sep 29, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions SPECS/lua/CVE-2020-15889.nopatch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
# CVE-2020-15889 is in the Lua generational garbage collection code, which is new to 5.4.0. 5.3.5 is not affected.
56 changes: 30 additions & 26 deletions SPECS/lua/lua.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
Summary: Programming language
Name: lua
Version: 5.3.5
Release: 6%{?dist}
Release: 7%{?dist}
License: MIT
URL: https://www.lua.org
Group: Development/Tools
Expand All @@ -13,6 +13,8 @@ Distribution: Mariner
Source0: https://www.lua.org/ftp/%{name}-%{version}.tar.gz
Source1: %{LICENSE_PATH}
Patch0: lua-5.3.4-shared_library-1.patch
# CVE-2020-15889 is in the Lua generational garbage collection code, which is new to 5.4.0. 5.3.5 is not affected.
Patch1: CVE-2020-15889.nopatch
BuildRequires: readline-devel
Requires: readline

Expand All @@ -22,8 +24,8 @@ applications. Lua is also frequently used as a general-purpose, stand-alone
language. Lua is free software

%package devel
Summary: Libraries and header files for lua
Requires: %{name} = %{version}
Summary: Libraries and header files for lua
Requires: %{name} = %{version}
%description devel
Static libraries and header files for the support library for lua

Expand All @@ -39,33 +41,33 @@ make V=%{majmin} R=%{version} VERBOSE=1 %{?_smp_mflags} linux

%install
make %{?_smp_mflags} \
V=%{majmin} \
R=%{version} \
INSTALL_TOP=%{buildroot}/usr TO_LIB="liblua.so \
liblua.so.%{majmin} liblua.so.%{version}" \
INSTALL_DATA="cp -d" \
INSTALL_MAN=%{buildroot}/usr/share/man/man1 \
install
V=%{majmin} \
R=%{version} \
INSTALL_TOP=%{buildroot}/usr TO_LIB="liblua.so \
liblua.so.%{majmin} liblua.so.%{version}" \
INSTALL_DATA="cp -d" \
INSTALL_MAN=%{buildroot}/usr/share/man/man1 \
install
install -vdm 755 %{buildroot}%{_libdir}/pkgconfig
cat > %{buildroot}%{_libdir}/pkgconfig/lua.pc <<- "EOF"
V=%{majmin}
R=%{version}
V=%{majmin}
R=%{version}

prefix=/usr
INSTALL_BIN=${prefix}/bin
INSTALL_INC=${prefix}/include
INSTALL_LIB=${prefix}/lib
INSTALL_MAN=${prefix}/man/man1
exec_prefix=${prefix}
libdir=${exec_prefix}/lib
includedir=${prefix}/include
prefix=/usr
INSTALL_BIN=${prefix}/bin
INSTALL_INC=${prefix}/include
INSTALL_LIB=${prefix}/lib
INSTALL_MAN=${prefix}/man/man1
exec_prefix=${prefix}
libdir=${exec_prefix}/lib
includedir=${prefix}/include

Name: Lua
Description: An Extensible Extension Language
Version: ${R}
Requires:
Libs: -L${libdir} -llua -lm
Cflags: -I${includedir}
Name: Lua
Description: An Extensible Extension Language
Version: ${R}
Requires:
Libs: -L${libdir} -llua -lm
Cflags: -I${includedir}
EOF
rmdir %{buildroot}%{_libdir}/lua/5.3
rmdir %{buildroot}%{_libdir}/lua
Expand All @@ -91,6 +93,8 @@ rm -rf %{buildroot}
%{_libdir}/liblua.so

%changelog
* Mon Sep 28 2020 Daniel McIlvaney <damcilva@microsoft.com> 5.3.5-7
- Nopatch CVE-2020-15889 since it only affects 5.4.0
* Tue Aug 11 2020 Mateusz Malisz <mamalisz@microsoft.com> 5.3.5-6
- Append -fPIC and -O2 to CFLAGS to fix build issues.
* Fri Jul 31 2020 Leandro Pereira <leperei@microsoft.com> 5.3.5-5
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/pkggen_core_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@ libltdl-2.4.6-5.cm1.aarch64.rpm
libltdl-devel-2.4.6-5.cm1.aarch64.rpm
pcre-libs-8.42-4.cm1.aarch64.rpm
krb5-1.17-3.cm1.aarch64.rpm
lua-5.3.5-6.cm1.aarch64.rpm
lua-5.3.5-7.cm1.aarch64.rpm
mariner-rpm-macros-1.0-3.cm1.noarch.rpm
mariner-check-macros-1.0-3.cm1.noarch.rpm
libassuan-2.5.1-3.cm1.aarch64.rpm
Expand Down
2 changes: 1 addition & 1 deletion toolkit/resources/manifests/package/pkggen_core_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@ libltdl-2.4.6-5.cm1.x86_64.rpm
libltdl-devel-2.4.6-5.cm1.x86_64.rpm
pcre-libs-8.42-4.cm1.x86_64.rpm
krb5-1.17-3.cm1.x86_64.rpm
lua-5.3.5-6.cm1.x86_64.rpm
lua-5.3.5-7.cm1.x86_64.rpm
mariner-rpm-macros-1.0-3.cm1.noarch.rpm
mariner-check-macros-1.0-3.cm1.noarch.rpm
libassuan-2.5.1-3.cm1.x86_64.rpm
Expand Down
6 changes: 3 additions & 3 deletions toolkit/resources/manifests/package/toolchain_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,9 +225,9 @@ libxml2-python-2.9.10-2.cm1.aarch64.rpm
libxslt-1.1.34-2.cm1.aarch64.rpm
libxslt-debuginfo-1.1.34-2.cm1.aarch64.rpm
libxslt-devel-1.1.34-2.cm1.aarch64.rpm
lua-5.3.5-6.cm1.aarch64.rpm
lua-debuginfo-5.3.5-6.cm1.aarch64.rpm
lua-devel-5.3.5-6.cm1.aarch64.rpm
lua-5.3.5-7.cm1.aarch64.rpm
lua-debuginfo-5.3.5-7.cm1.aarch64.rpm
lua-devel-5.3.5-7.cm1.aarch64.rpm
lvm2-2.03.05-5.cm1.aarch64.rpm
lvm2-debuginfo-2.03.05-5.cm1.aarch64.rpm
lvm2-devel-2.03.05-5.cm1.aarch64.rpm
Expand Down
6 changes: 3 additions & 3 deletions toolkit/resources/manifests/package/toolchain_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,9 +225,9 @@ libxml2-python-2.9.10-2.cm1.x86_64.rpm
libxslt-1.1.34-2.cm1.x86_64.rpm
libxslt-debuginfo-1.1.34-2.cm1.x86_64.rpm
libxslt-devel-1.1.34-2.cm1.x86_64.rpm
lua-5.3.5-6.cm1.x86_64.rpm
lua-debuginfo-5.3.5-6.cm1.x86_64.rpm
lua-devel-5.3.5-6.cm1.x86_64.rpm
lua-5.3.5-7.cm1.x86_64.rpm
lua-debuginfo-5.3.5-7.cm1.x86_64.rpm
lua-devel-5.3.5-7.cm1.x86_64.rpm
lvm2-2.03.05-5.cm1.x86_64.rpm
lvm2-debuginfo-2.03.05-5.cm1.x86_64.rpm
lvm2-devel-2.03.05-5.cm1.x86_64.rpm
Expand Down