[Buildroot] [PATCH] package/darkhttpd: security bump to version 1.15
Peter Korsgaard
peter at korsgaard.com
Sun Jan 28 07:56:57 UTC 2024
>>>>> "Yann" == Yann E MORIN <yann.morin.1998 at free.fr> writes:
> Peter, All,
> On 2024-01-26 14:57 +0100, Peter Korsgaard spake thusly:
>> Fixes the following security issues:
>>
>> CVE-2024-23770: Local Leak of Authentication Parameter in Process List
>>
>> CVE-2024-23771: Basic Auth Timing Attack
>>
>> https://security.opensuse.org/2024/01/22/darkhttpd-basic-auth-issues.html
>>
>> Notice that CVE-2024-23770 is only documented as a known weakness, not
>> fixed.
>>
>> Also change the license logic to use the dedicated COPYING file available
>> since 1.14:
>>
>> https://github.com/emikulic/darkhttpd/commit/a8ae2b1de069588cad23d79a5392445ee9590fcd
>>
>> This license is ISC, not MIT - So adjust DARKHTTPD_LICENSE to match.
> This means the licensing stuff should be backported to the maintenance
> branches, and should thus have been a separate patch prior to the
> version bump.
> But since this is a security fix, I guess you'll want to backport the
> version bump too. And since the odlest stable, 2023.02, already had
> darkhttpd 1.14, it is possibe to backport the version bump to all
> maintenance branches.
> Thus, I considered splitting, got slightly cat-distracted, and pushed
> without splitting.
Hehe ;) That was indeed also the reason why I didn't do the effort to
split it in multiple patches.
--
Bye, Peter Korsgaard
More information about the buildroot
mailing list