Re: [Buildroot] [PATCH] package/darkhttpd: security bump to version 1.15

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

>>>>> "Yann" == Yann E MORIN <yann.morin.1998@free.fr> writes:
 >> Peter, All,
 >> On 2024-01-26 14:57 +0100, Peter Korsgaard spake thusly:
 >>> Fixes the following security issues:
 >>> 
 >>> CVE-2024-23770: Local Leak of Authentication Parameter in Process List
 >>> 
 >>> CVE-2024-23771: Basic Auth Timing Attack
 >>> 
 >>> https://security.opensuse.org/2024/01/22/darkhttpd-basic-auth-issues.html
 >>> 
 >>> Notice that CVE-2024-23770 is only documented as a known weakness, not
 >>> fixed.
 >>> 
 >>> Also change the license logic to use the dedicated COPYING file available
 >>> since 1.14:
 >>> 
 >>> https://github.com/emikulic/darkhttpd/commit/a8ae2b1de069588cad23d79a5392445ee9590fcd
 >>> 
 >>> This license is ISC, not MIT - So adjust DARKHTTPD_LICENSE to match.

 >> This means the licensing stuff should be backported to the maintenance
 >> branches, and should thus have been a separate patch prior to the
 >> version bump.

 >> But since this is a security fix, I guess you'll want to backport the
 >> version bump too. And since the odlest stable, 2023.02, already had
 >> darkhttpd 1.14, it is possibe to backport the version bump to all
 >> maintenance branches.

 >> Thus, I considered splitting, got slightly cat-distracted, and pushed
 >> without splitting.

 > Hehe ;) That was indeed also the reason why I didn't do the effort to
 > split it in multiple patches.

Committed to 2023.02.x and 2023.11.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot