From 1acf8e02890f498b425a39d593dc0fd0c7315246 Mon Sep 17 00:00:00 2001
From: Daniel Micay <daniel.micay@grapheneos.org>
Date: Tue, 8 Apr 2025 22:06:59 -0400
Subject: [PATCH] fix upstream RecoverySystem.verifyPackage(...) vulnerability

---
 static/releases.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/static/releases.html b/static/releases.html
index 42730d62..c2fe6522 100644
--- a/static/releases.html
+++ b/static/releases.html
@@ -576,6 +576,7 @@
                     <p>Changes since the 2025040700 release:</p>
 
                     <ul>
+                        <li>fix upstream RecoverySystem.verifyPackage(...) vulnerability (this was not directly exploitable due to there being 2 layers of update package signature verification and downgrade protection, but the first layer of protection should work properly to avoid a vulnerability in the 2nd layer being exploited)</li>
                         <li>Vanadium: update to <a href="https://github.com/GrapheneOS/Vanadium/releases/tag/135.0.7049.79.0">version 135.0.7049.79.0</a></li>
                     </ul>
                 </article>