| Message ID | 20230319191212.666401-1-fontaine.fabrice@gmail.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [1/1] package/libmicrohttpd: security bump to version 0.9.76 | expand |
>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes: > Fix CVE-2023-27371: GNU libmicrohttpd before 0.9.76 allows remote DoS > (Denial of Service) due to improper parsing of a multipart/form-data > boundary in the postprocessor.c MHD_create_post_processor() method. This > allows an attacker to remotely send a malicious HTTP POST packet that > includes one or more '\0' bytes in a multipart/form-data boundary field, > which - assuming a specific heap layout - will result in an > out-of-bounds read and a crash in the find_boundary() function. > https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg00000.html > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Committed, thanks.
>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes: > Fix CVE-2023-27371: GNU libmicrohttpd before 0.9.76 allows remote DoS > (Denial of Service) due to improper parsing of a multipart/form-data > boundary in the postprocessor.c MHD_create_post_processor() method. This > allows an attacker to remotely send a malicious HTTP POST packet that > includes one or more '\0' bytes in a multipart/form-data boundary field, > which - assuming a specific heap layout - will result in an > out-of-bounds read and a crash in the find_boundary() function. > https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg00000.html > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Committed to 2023.02.x and 2022.02.x, thanks.
diff --git a/package/libmicrohttpd/libmicrohttpd.hash b/package/libmicrohttpd/libmicrohttpd.hash index 7f95e78a6e..ce30e2ba11 100644 --- a/package/libmicrohttpd/libmicrohttpd.hash +++ b/package/libmicrohttpd/libmicrohttpd.hash @@ -1,3 +1,3 @@ # Locally calculated -sha256 9278907a6f571b391aab9644fd646a5108ed97311ec66f6359cebbedb0a4e3bb libmicrohttpd-0.9.75.tar.gz +sha256 f0b1547b5a42a6c0f724e8e1c1cb5ce9c4c35fb495e7d780b9930d35011ceb4c libmicrohttpd-0.9.76.tar.gz sha256 7399547209438c93f9b90297954698773d4846cea44cde5ca982c84c45952a3b COPYING diff --git a/package/libmicrohttpd/libmicrohttpd.mk b/package/libmicrohttpd/libmicrohttpd.mk index f75178bc0a..4e7b72b65c 100644 --- a/package/libmicrohttpd/libmicrohttpd.mk +++ b/package/libmicrohttpd/libmicrohttpd.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBMICROHTTPD_VERSION = 0.9.75 +LIBMICROHTTPD_VERSION = 0.9.76 LIBMICROHTTPD_SITE = $(BR2_GNU_MIRROR)/libmicrohttpd LIBMICROHTTPD_LICENSE_FILES = COPYING LIBMICROHTTPD_CPE_ID_VENDOR = gnu
Fix CVE-2023-27371: GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function. https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg00000.html Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> --- package/libmicrohttpd/libmicrohttpd.hash | 2 +- package/libmicrohttpd/libmicrohttpd.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)