diff mbox series

[v2] package/libmicrohttpd: ignore CVE-2025-59777 and CVE-2025-62689

Message ID 20260901114951.2675876-1-yegorslists@googlemail.com
State New
Headers show
Series [v2] package/libmicrohttpd: ignore CVE-2025-59777 and CVE-2025-62689 | expand

Commit Message

yegorslists--- via buildroot Sept. 1, 2026, 11:49 a.m. UTC 
From: Yegor Yefremov <yegorslists@googlemail.com>

Both CVEs affect the experimental WebSocket helper library
(src/microhttpd_ws, installed as libmicrohttpd_ws.so), as stated in the
originating JPCERT/CC advisory JVN76719218:

  "The vulnerability exists in libmicrohttpd_ws.so, which is generated
   when building with the --enable-experimental option."

That directory is guarded by AM_CONDITIONAL([HAVE_EXPERIMENTAL]) in
src/Makefile.am, and --enable-experimental defaults to "no". Buildroot
never passes it, so no Buildroot version has ever built the vulnerable
code. Upstream removed the module outright in commit
ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b ("remove broken experimental
code", 13651 deletions), first released in 1.0.3.

An ignore is needed rather than a version bump, because the NVD entries
for both CVEs share a single CPE match criteria that encodes the affected
range as

  cpe:2.3:a:gnu:libmicrohttpd:*:*:*:*:*:*:*:*, versionEndExcluding 2025-09-16

i.e. the author date of the fix commit instead of a version number. Since
support/scripts/cve.py compares versions using LooseVersion, every 1.0.x
version evaluates as smaller than "2025-09-16" and is reported as
affected, no matter how far the package gets bumped.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
---
Changes v1 -> v2:
  - describe why Buildroot was never affected by these CVEs

 package/libmicrohttpd/libmicrohttpd.mk | 8 ++++++++
 1 file changed, 8 insertions(+)
diff mbox series

Patch

diff --git a/package/libmicrohttpd/libmicrohttpd.mk b/package/libmicrohttpd/libmicrohttpd.mk
index 8756adb4c6..43e9766106 100644
--- a/package/libmicrohttpd/libmicrohttpd.mk
+++ b/package/libmicrohttpd/libmicrohttpd.mk
@@ -10,6 +10,14 @@  LIBMICROHTTPD_LICENSE_FILES = COPYING
 LIBMICROHTTPD_CPE_ID_VENDOR = gnu
 LIBMICROHTTPD_INSTALL_STAGING = YES
 LIBMICROHTTPD_DEPENDENCIES = host-pkgconf
+
+# Both affect the experimental WebSocket library (src/microhttpd_ws,
+# libmicrohttpd_ws.so), which is only built with --enable-experimental.
+# That option defaults to "no" and we never pass it, so no Buildroot
+# version has ever been affected. Upstream removed the code outright in
+# commit ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b, released in 1.0.3.
+LIBMICROHTTPD_IGNORE_CVES += CVE-2025-59777 CVE-2025-62689
+
 LIBMICROHTTPD_CONF_OPTS = --disable-curl --disable-examples
 LIBMICROHTTPD_CFLAGS = $(TARGET_CFLAGS) -std=c99