Re: [Buildroot] [PATCH 1/1] package/turbolua: security bump version to 2.1.5

[Julien Olivain via buildroot <buildroot@buildroot.org>]

On 09/09/2026 12:29, Bernd Kuhls wrote:
> https://github.com/kernelsauce/turbo/releases/tag/v2.1.5
> 
> https://github.com/kernelsauce/turbo/releases/tag/v2.1.4
> Security fixes:
> 
> HTTP header injection: header values were only checked for a literal
>  \r\n, so a lone \r or \n could still split a header. Now rejected on
>  either character.
> 
> Transfer-Encoding requests are now rejected with 501 instead of 
> silently
>  mishandled, closing a request smuggling avenue.
> 
> A real default request body size cap (128 MB) with a 413 response,
>  previously unbounded.
> 
> Secure cookie signature now binds the cookie name, so a value signed 
> for
>  one cookie can no longer be replayed under a different name.
>  Verification failures return the default value instead of raising.
> 
> Constant-time comparison for the secure cookie HMAC, previously a
>  timing-leaky ==.
> 
> util.secure_random_bytes reads real OS entropy (/dev/urandom,
>  BCryptGenRandom on Windows) for WebSocket masks and util.rand_str,
>  previously math.random.
> 
> WebSocket: unmasked client frames are rejected per RFC 6455, and
>  fragmented message reassembly is capped to max_buffer_size to close a
>  memory exhaustion path.
> 
> StaticFileHandler decodes the request path before the traversal check,
>  closing a bypass.
> 
> Fixed a 32-byte-per-malformed-request memory leak in the C header 
> parser
>  wrapper (found via libFuzzer).
> 
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot