[Buildroot] [git commit branch/2021.02.x] package/busybox: security bump to version 1.33.2

commit: https://git.buildroot.net/buildroot/commit/?id=7f48212a2efffe7654f5e6fcb974aff555c5a03c
branch: https://git.buildroot.net/buildroot/commit/?id=refs/heads/2021.02.x

Fixes the following vulnerabilities:

- CVE-2021-42374: An out-of-bounds heap read in Busybox's unlzma applet
  leads to information leak and denial of service when crafted
  LZMA-compressed input is decompressed

- CVE-2021-42375: An incorrect handling of a special element in Busybox's
  ash applet leads to denial of service when processing a crafted shell
  command, due to the shell mistaking specific characters for reserved
  characters.  This may be used for DoS under rare conditions of filtered
  command input

- CVE-2021-42376: A NULL pointer dereference in Busybox's hush applet leads
  to denial of service when processing a crafted shell command, due to
  missing validation after a \x03 delimiter character.  This may be used for
  DoS under very rare conditions of filtered command input.

- CVE-2021-42377: An attacker-controlled pointer free in Busybox's hush
  applet leads to denial of service and possible code execution when
  processing a crafted shell command, due to the shell mishandling the &&&
  string.  This may be used for remote code execution under rare conditions
  of filtered command input.

For details, see:
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/busybox/busybox.hash | 2 +-
 package/busybox/busybox.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/busybox/busybox.hash b/package/busybox/busybox.hash
index 3e9c30cad0..354db4bc5b 100644
--- a/package/busybox/busybox.hash
+++ b/package/busybox/busybox.hash

@@ -1,5 +1,5 @@
 # From https://busybox.net/downloads/busybox-1.33.1.tar.bz2.sha256
-sha256  12cec6bd2b16d8a9446dd16130f2b92982f1819f6e1c5f5887b6db03f5660d28  busybox-1.33.1.tar.bz2
+sha256  6843ba7977081e735fa0fdb05893e3c002c8c5ad7c9c80da206e603cc0ac47e7  busybox-1.33.2.tar.bz2
 # Locally computed
 sha256  bbfc9843646d483c334664f651c208b9839626891d8f17604db2146962f43548  LICENSE
 sha256  b5a136ed67798e51fe2e0ca0b2a21cb01b904ff0c9f7d563a6292e276607e58f  archival/libarchive/bz/LICENSE

diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk
index 413939e28d..101b37c5ec 100644
--- a/package/busybox/busybox.mk
+++ b/package/busybox/busybox.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-BUSYBOX_VERSION = 1.33.1
+BUSYBOX_VERSION = 1.33.2
 BUSYBOX_SITE = https://www.busybox.net/downloads
 BUSYBOX_SOURCE = busybox-$(BUSYBOX_VERSION).tar.bz2
 BUSYBOX_LICENSE = GPL-2.0, bzip2-1.0.4

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot