Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package cryptsetup for openSUSE:Factory checked in at 2026-09-17 15:15:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cryptsetup (Old) and /work/SRC/openSUSE:Factory/.cryptsetup.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cryptsetup" Thu Sep 17 15:15:51 2026 rev:140 rq:1378262 version:2.8.8 Changes: -------- --- /work/SRC/openSUSE:Factory/cryptsetup/cryptsetup.changes 2026-07-26 11:27:03.471798419 +0200 +++ /work/SRC/openSUSE:Factory/.cryptsetup.new.383539/cryptsetup.changes 2026-09-17 15:16:06.860647192 +0200 @@ -1,0 +2,51 @@ +Mon Sep 14 07:19:06 UTC 2026 - Pedro Monreal <[email protected]> + +- Update to 2.8.8: + * integritysetup: add support for keyed discards. + An integrity device in standalone mode, with a keyed integrity + algorithm like HMAC and enabled discards (TRIM), could be + vulnerable to wiping part of the device using a discard pattern. + This issue can be worked around by using a keyed discards filler. + Once set, it is set permanently for the integrity device and + cannot be reverted. + Integritysetup now supports a new --allow-discards-keyed option. + Once used, it will upgrade the superblock and activate keyed + discards. + After the upgrade, keyed discards are always used, even with the + old --allow-discards option. + Keyed discard is available since Linux kernel 7.3. + Note: Integritysetup was intended to be used with non-cryptographic + integrity protection only. If you need cryptographic protection, + use LUKS2 and AEAD (discards are not supported). + * Avoid time-of-check/time-of-use (TOCTOU) issue in LUKS header + restore. The LUKS header restore function validates the provided + header file and then reopens the same file path to restore the + LUKS header. In a specifically crafted environment, a symlink + flip could occur between validating and restoring the header, + resulting in a different file being used for the LUKS header + restore (potentially leaking the file content). + The libcryptsetup now opens the device only once. The issue + affects both LUKS1 and LUKS2. + Note: LUKS header backup/restore is a system administrative task + (similar to filesystem backup/restore) that must run in a secure + environment. Such a backup is usually a multi-step process, and + it is up to the caller to ensure security of that environment. + * BITLK: harden metadata validation. + If a crafted BITLK (BitLocker-compatible) image is opened, the + allocated buffer size for the key can be incorrect. This can + happen if the encryption is changed from AES-CBC-128 to a mode with + an Elephant diffuser, without recalculating the stored key. Also, + the data offset can be intentionally wrong, which could lead to an + infinite loop when parsing metadata. + Note that creating such an incorrect image requires knowledge of + the disk password, as MAC protects the metadata, and this MAC is + checked by cryptsetup. + * Fix possible integer overflow in LUKS metadata parsing. + On systems with a 32-bit integer size, the anti-forensic (AF) + data size calculation could overflow, causing an application crash. + * cryptsetup: fix local memory corruption bug in reencrypt init. + If a device intended for reencryption contains more than 16 active + LUKS2 keyslots or tokens, the reencryption initialization could + corrupt internal memory, leading to an application crash. + +------------------------------------------------------------------- Old: ---- cryptsetup-2.8.7.tar.sign cryptsetup-2.8.7.tar.xz New: ---- cryptsetup-2.8.8.tar.sign cryptsetup-2.8.8.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cryptsetup.spec ++++++ --- /var/tmp/diff_new_pack.NPvUgJ/_old 2026-09-17 15:16:09.513758382 +0200 +++ /var/tmp/diff_new_pack.NPvUgJ/_new 2026-09-17 15:16:09.515758466 +0200 @@ -18,7 +18,7 @@ %define so_ver 12 Name: cryptsetup -Version: 2.8.7 +Version: 2.8.8 Release: 0 Summary: Setup program for dm-crypt Based Encrypted Block Devices License: CC-BY-SA-4.0 AND LGPL-2.0-or-later WITH cryptsetup-OpenSSL-exception ++++++ cryptsetup-2.8.7.tar.xz -> cryptsetup-2.8.8.tar.xz ++++++ /work/SRC/openSUSE:Factory/cryptsetup/cryptsetup-2.8.7.tar.xz /work/SRC/openSUSE:Factory/.cryptsetup.new.383539/cryptsetup-2.8.8.tar.xz differ: char 15, line 1
