Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update zlib to 1.2.12 #5994

Merged
merged 1 commit into from
May 30, 2022
Merged

Conversation

antedeguemon
Copy link
Contributor

This pull request bumps the built-in zlib version from 1.2.11 to 1.2.12 due to CVE-2018-25032.

The integrity of the zlib source contained in this pull request can be verified with:

# path to the internal zlib source used by otp
internal_zlib_path="./otp/erts/emulator/zlib"
# path to the up-to-date zlib source download from original zlib repository
original_zlib_path="./zlib"  

# note: '-v mk' excludes otp's custom makefile 
files=$(ls -1 $internal_zlib_path | grep -v "\.mk") 

for file in $files
do
    md5sum "$original_zlib_path/$file"
    md5sum "$internal_zlib_path/$file"    
done

Closes #5993 - see madler/zlib#605 for more details on the zlib issue.

@CLAassistant
Copy link

CLAassistant commented May 16, 2022

CLA assistant check
All committers have signed the CLA.

@github-actions
Copy link
Contributor

github-actions bot commented May 16, 2022

CT Test Results

       3 files     125 suites   37m 49s ⏱️
1 445 tests 1 403 ✔️ 42 💤 0
1 744 runs  1 685 ✔️ 59 💤 0

Results for commit 204a0ad.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

// Erlang/OTP Github Action Bot

@rickard-green rickard-green added the team:VM Assigned to OTP team VM label May 16, 2022
@bjorng
Copy link
Contributor

bjorng commented May 23, 2022

Thanks for your pull request.

Since we want to release for all of our supported releases, can you please rebase the branch onto the tag OTP-23.3.4? I recommend that you squash the commit while doing so.

Fix broken zlib link in docs
@antedeguemon
Copy link
Contributor Author

@bjorng it is done! 😄

@bjorng bjorng added the testing currently being tested, tag is used by OTP internal CI label May 25, 2022
@bjorng
Copy link
Contributor

bjorng commented May 25, 2022

Thanks! Added to our daily builds.

@bjorng bjorng merged commit 1fa6c18 into erlang:master May 30, 2022
@bjorng
Copy link
Contributor

bjorng commented May 30, 2022

Thanks! Now merged to maint and master, and queued for the release in the upcoming emergency patches.

IngelaAndin pushed a commit that referenced this pull request Jun 8, 2022
* update_zlib_1_2_12/GH-5994/OTP-18123:
  Update zlib to 1.2.12
IngelaAndin pushed a commit that referenced this pull request Jun 9, 2022
* update_zlib_1_2_12/GH-5994/OTP-18123:
  Update zlib to 1.2.12
IngelaAndin pushed a commit that referenced this pull request Jun 21, 2022
* update_zlib_1_2_12/GH-5994/OTP-18123:
  Update zlib to 1.2.12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
team:VM Assigned to OTP team VM testing currently being tested, tag is used by OTP internal CI
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update built-in zlib to fix CVE-2018-25032
4 participants