GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — SecurityPkg: Update libspdm by os-d · Pull Request #6460 · tianocore/edk2

Conversation

@os-d

@os-d os-d commented Nov 22, 2024

Copy link
Copy Markdown
Contributor

Description

This patch updates libspdm to pull in various bug fixes, but primarily commit ca4854be3325bd8fc7f2c714574d17aac2d4e13b which updates libspdm's MbedTLS submodule to v3.6.2, fixing CVE https://nvd.nist.gov/vuln/detail/CVE-2023-37920 there. This CVE does not affect libspdm or edk2, but automatic CVE scanning tools see the bad version of the certifi pip module in the edk2/libspdm code trees and flag these projects as failing.
libspdm has been updated to pull in the newer MbedTLS that fixes this issue and this patch updates edk2 to pull in the newer libspdm.

  • Breaking change?
    • Breaking change - Does this PR cause a break in build or boot behavior?
    • Examples: Does it add a new library class or move a module to a different repo.
  • Impacts security?
    • Security - Does this PR have a direct security impact?
    • Examples: Crypto algorithm change or buffer overflow fix.
  • Includes tests?
    • Tests - Does this PR include any explicit test code?
    • Examples: Unit tests or integration tests.

How This Was Tested

CI tests.

Integration Instructions

N/A.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@os-d
SecurityPkg: Update libspdm
f5535c8 
This patch updates libspdm to pull in various bug fixes,
but primarily commit ca4854be3325bd8fc7f2c714574d17aac2d4e13b
which updates libspdm's MbedTLS submodule to v3.6.2, fixing
CVE https://nvd.nist.gov/vuln/detail/CVE-2023-37920 there.
This CVE does not affect libspdm or edk2, but automatic
CVE scanning tools see the bad version of the certifi
pip module in the edk2/libspdm code trees and flag these
projects as failing.
libspdm has been updated to pull in the newer MbedTLS that
fixes this issue and this patch updates edk2 to pull in
the newer libspdm.

Signed-off-by: Oliver Smith-Denny <[email protected]>
@github-actions github-actions Bot added the impact:security This change has a direct security impact such as changing a crypto algorithm. label Nov 22, 2024
@tianocore-assign-reviewers
tianocore-assign-reviewers Bot requested a review from jyao1 November 22, 2024 16:03
jyao1
jyao1 approved these changes Nov 26, 2024
View reviewed changes
@jyao1 jyao1 added the push Auto push patch series in PR if all checks pass label Nov 26, 2024
@mergify
Merge branch 'master' into libspdm_update
79773e8
@mergify
mergify Bot merged commit 7eff71f into tianocore:master Nov 26, 2024
@os-d
os-d deleted the libspdm_update branch November 26, 2024 16:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@jyao1 jyao1 jyao1 approved these changes
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

impact:security This change has a direct security impact such as changing a crypto algorithm. push Auto push patch series in PR if all checks pass

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@os-d @jyao1
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.