Re: [Buildroot] [PATCH] package/darkhttpd: security bump to version 1.15

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Yann" == Yann E MORIN <yann.morin.1998@free.fr> writes:

 > Peter, All,
 > On 2024-01-26 14:57 +0100, Peter Korsgaard spake thusly:
 >> Fixes the following security issues:
 >> 
 >> CVE-2024-23770: Local Leak of Authentication Parameter in Process List
 >> 
 >> CVE-2024-23771: Basic Auth Timing Attack
 >> 
 >> https://security.opensuse.org/2024/01/22/darkhttpd-basic-auth-issues.html
 >> 
 >> Notice that CVE-2024-23770 is only documented as a known weakness, not
 >> fixed.
 >> 
 >> Also change the license logic to use the dedicated COPYING file available
 >> since 1.14:
 >> 
 >> https://github.com/emikulic/darkhttpd/commit/a8ae2b1de069588cad23d79a5392445ee9590fcd
 >> 
 >> This license is ISC, not MIT - So adjust DARKHTTPD_LICENSE to match.

 > This means the licensing stuff should be backported to the maintenance
 > branches, and should thus have been a separate patch prior to the
 > version bump.

 > But since this is a security fix, I guess you'll want to backport the
 > version bump too. And since the odlest stable, 2023.02, already had
 > darkhttpd 1.14, it is possibe to backport the version bump to all
 > maintenance branches.

 > Thus, I considered splitting, got slightly cat-distracted, and pushed
 > without splitting.

Hehe ;) That was indeed also the reason why I didn't do the effort to
split it in multiple patches.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot