[Buildroot] [PATCH v2] package/libmicrohttpd: ignore CVE-2025-59777 and CVE-2025-62689

[Buildroot] [PATCH v2] package/libmicrohttpd: ignore CVE-2025-59777 and CVE-2025-62689

[yegorslists--- via buildroot]

From: Yegor Yefremov <yegorslists@googlemail.com>

Both CVEs affect the experimental WebSocket helper library
(src/microhttpd_ws, installed as libmicrohttpd_ws.so), as stated in the
originating JPCERT/CC advisory JVN76719218:

  "The vulnerability exists in libmicrohttpd_ws.so, which is generated
   when building with the --enable-experimental option."

That directory is guarded by AM_CONDITIONAL([HAVE_EXPERIMENTAL]) in
src/Makefile.am, and --enable-experimental defaults to "no". Buildroot
never passes it, so no Buildroot version has ever built the vulnerable
code. Upstream removed the module outright in commit
ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b ("remove broken experimental
code", 13651 deletions), first released in 1.0.3.

An ignore is needed rather than a version bump, because the NVD entries
for both CVEs share a single CPE match criteria that encodes the affected
range as

  cpe:2.3:a:gnu:libmicrohttpd:*:*:*:*:*:*:*:*, versionEndExcluding 2025-09-16

i.e. the author date of the fix commit instead of a version number. Since
support/scripts/cve.py compares versions using LooseVersion, every 1.0.x
version evaluates as smaller than "2025-09-16" and is reported as
affected, no matter how far the package gets bumped.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
---
Changes v1 -> v2:
  - describe why Buildroot was never affected by these CVEs

 package/libmicrohttpd/libmicrohttpd.mk | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/package/libmicrohttpd/libmicrohttpd.mk b/package/libmicrohttpd/libmicrohttpd.mk
index 8756adb4c6..43e9766106 100644
--- a/package/libmicrohttpd/libmicrohttpd.mk
+++ b/package/libmicrohttpd/libmicrohttpd.mk
@@ -10,6 +10,14 @@ LIBMICROHTTPD_LICENSE_FILES = COPYING
 LIBMICROHTTPD_CPE_ID_VENDOR = gnu
 LIBMICROHTTPD_INSTALL_STAGING = YES
 LIBMICROHTTPD_DEPENDENCIES = host-pkgconf
+
+# Both affect the experimental WebSocket library (src/microhttpd_ws,
+# libmicrohttpd_ws.so), which is only built with --enable-experimental.
+# That option defaults to "no" and we never pass it, so no Buildroot
+# version has ever been affected. Upstream removed the code outright in
+# commit ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b, released in 1.0.3.
+LIBMICROHTTPD_IGNORE_CVES += CVE-2025-59777 CVE-2025-62689
+
 LIBMICROHTTPD_CONF_OPTS = --disable-curl --disable-examples
 LIBMICROHTTPD_CFLAGS = $(TARGET_CFLAGS) -std=c99
 
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/libmicrohttpd: ignore CVE-2025-59777 and CVE-2025-62689

[Thomas Petazzoni via buildroot]

Hello Yegor,

On Tue, Sep 01, 2026 at 01:49:51PM +0200, yegorslists--- via buildroot wrote:
> From: Yegor Yefremov <yegorslists@googlemail.com>
> 
> Both CVEs affect the experimental WebSocket helper library
> (src/microhttpd_ws, installed as libmicrohttpd_ws.so), as stated in the
> originating JPCERT/CC advisory JVN76719218:
> 
>   "The vulnerability exists in libmicrohttpd_ws.so, which is generated
>    when building with the --enable-experimental option."
> 
> That directory is guarded by AM_CONDITIONAL([HAVE_EXPERIMENTAL]) in
> src/Makefile.am, and --enable-experimental defaults to "no". Buildroot
> never passes it, so no Buildroot version has ever built the vulnerable
> code. Upstream removed the module outright in commit
> ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b ("remove broken experimental
> code", 13651 deletions), first released in 1.0.3.
> 
> An ignore is needed rather than a version bump, because the NVD entries
> for both CVEs share a single CPE match criteria that encodes the affected
> range as
> 
>   cpe:2.3:a:gnu:libmicrohttpd:*:*:*:*:*:*:*:*, versionEndExcluding 2025-09-16
> 
> i.e. the author date of the fix commit instead of a version number. Since
> support/scripts/cve.py compares versions using LooseVersion, every 1.0.x
> version evaluates as smaller than "2025-09-16" and is reported as
> affected, no matter how far the package gets bumped.

Thanks a lot, but this is not the right fix I'm afraid. The right fix
is to send an e-mail to NVD at cpe_dictionary@nist.gov to ask them to
update the CVE entry. They are responsive. You just need to explain
very clearly which commit fixed the vulnerability, in which release it
was integrated, and they will fix the CVE description.

Once this is done, we can potentially accept as a temporary measure to
add those IGNORE_CVES entry.

The way I see this is like patches: if you don't "upstream" the fix of
the CVE metadata, then we will have to keep those IGNORE_CVES entries
forever, which is not desirable.

Thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/libmicrohttpd: ignore CVE-2025-59777 and CVE-2025-62689

[Yegor Yefremov via buildroot]

Hi Thomas,

On Fri, Sep 18, 2026 at 9:51 PM Thomas Petazzoni
<thomas.petazzoni@bootlin.com> wrote:
>
> Hello Yegor,
>
> On Tue, Sep 01, 2026 at 01:49:51PM +0200, yegorslists--- via buildroot wrote:
> > From: Yegor Yefremov <yegorslists@googlemail.com>
> >
> > Both CVEs affect the experimental WebSocket helper library
> > (src/microhttpd_ws, installed as libmicrohttpd_ws.so), as stated in the
> > originating JPCERT/CC advisory JVN76719218:
> >
> >   "The vulnerability exists in libmicrohttpd_ws.so, which is generated
> >    when building with the --enable-experimental option."
> >
> > That directory is guarded by AM_CONDITIONAL([HAVE_EXPERIMENTAL]) in
> > src/Makefile.am, and --enable-experimental defaults to "no". Buildroot
> > never passes it, so no Buildroot version has ever built the vulnerable
> > code. Upstream removed the module outright in commit
> > ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b ("remove broken experimental
> > code", 13651 deletions), first released in 1.0.3.
> >
> > An ignore is needed rather than a version bump, because the NVD entries
> > for both CVEs share a single CPE match criteria that encodes the affected
> > range as
> >
> >   cpe:2.3:a:gnu:libmicrohttpd:*:*:*:*:*:*:*:*, versionEndExcluding 2025-09-16
> >
> > i.e. the author date of the fix commit instead of a version number. Since
> > support/scripts/cve.py compares versions using LooseVersion, every 1.0.x
> > version evaluates as smaller than "2025-09-16" and is reported as
> > affected, no matter how far the package gets bumped.
>
> Thanks a lot, but this is not the right fix I'm afraid. The right fix
> is to send an e-mail to NVD at cpe_dictionary@nist.gov to ask them to
> update the CVE entry. They are responsive. You just need to explain
> very clearly which commit fixed the vulnerability, in which release it
> was integrated, and they will fix the CVE description.
>
> Once this is done, we can potentially accept as a temporary measure to
> add those IGNORE_CVES entry.
>
> The way I see this is like patches: if you don't "upstream" the fix of
> the CVE metadata, then we will have to keep those IGNORE_CVES entries
> forever, which is not desirable.

I filed a request a week ago. Till now no answer :-(

Regards,
Yegor
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/libmicrohttpd: ignore CVE-2025-59777 and CVE-2025-62689

[Yegor Yefremov via buildroot]

On Fri, Oct 2, 2026 at 3:55 PM Yegor Yefremov
<yegorslists@googlemail.com> wrote:
>
> Hi Thomas,
>
> On Fri, Sep 18, 2026 at 9:51 PM Thomas Petazzoni
> <thomas.petazzoni@bootlin.com> wrote:
> >
> > Hello Yegor,
> >
> > On Tue, Sep 01, 2026 at 01:49:51PM +0200, yegorslists--- via buildroot wrote:
> > > From: Yegor Yefremov <yegorslists@googlemail.com>
> > >
> > > Both CVEs affect the experimental WebSocket helper library
> > > (src/microhttpd_ws, installed as libmicrohttpd_ws.so), as stated in the
> > > originating JPCERT/CC advisory JVN76719218:
> > >
> > >   "The vulnerability exists in libmicrohttpd_ws.so, which is generated
> > >    when building with the --enable-experimental option."
> > >
> > > That directory is guarded by AM_CONDITIONAL([HAVE_EXPERIMENTAL]) in
> > > src/Makefile.am, and --enable-experimental defaults to "no". Buildroot
> > > never passes it, so no Buildroot version has ever built the vulnerable
> > > code. Upstream removed the module outright in commit
> > > ff13abc1c1d7d2b30d69d5c0bd4a237e1801c50b ("remove broken experimental
> > > code", 13651 deletions), first released in 1.0.3.
> > >
> > > An ignore is needed rather than a version bump, because the NVD entries
> > > for both CVEs share a single CPE match criteria that encodes the affected
> > > range as
> > >
> > >   cpe:2.3:a:gnu:libmicrohttpd:*:*:*:*:*:*:*:*, versionEndExcluding 2025-09-16
> > >
> > > i.e. the author date of the fix commit instead of a version number. Since
> > > support/scripts/cve.py compares versions using LooseVersion, every 1.0.x
> > > version evaluates as smaller than "2025-09-16" and is reported as
> > > affected, no matter how far the package gets bumped.
> >
> > Thanks a lot, but this is not the right fix I'm afraid. The right fix
> > is to send an e-mail to NVD at cpe_dictionary@nist.gov to ask them to
> > update the CVE entry. They are responsive. You just need to explain
> > very clearly which commit fixed the vulnerability, in which release it
> > was integrated, and they will fix the CVE description.
> >
> > Once this is done, we can potentially accept as a temporary measure to
> > add those IGNORE_CVES entry.
> >
> > The way I see this is like patches: if you don't "upstream" the fix of
> > the CVE metadata, then we will have to keep those IGNORE_CVES entries
> > forever, which is not desirable.
>
> I filed a request a week ago. Till now no answer :-(

I got the answer. Both CVEs are no longer valid for the current
version. The patch can be dismissed.

Yegor
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/libmicrohttpd: ignore CVE-2025-59777 and CVE-2025-62689

[Thomas Petazzoni via buildroot]

On Thu, Oct 08, 2026 at 04:01:30PM +0200, Yegor Yefremov wrote:

> > I filed a request a week ago. Till now no answer :-(
> 
> I got the answer. Both CVEs are no longer valid for the current
> version. The patch can be dismissed.

Thanks a lot!

In the future: it is fine for me if you send <pkg>_IGNORE_CVES entries
as long as an e-mail to fix the NVD database is also sent. It's a bit
like having the patch locally and upstreaming the fix. Once the fix is
upstreamed (NVD database is fixed), the <pkg>_IGNORE_CVES entry can be
dropped. And if we forget to drop it, the CVE checker tool in
Buildroot is supposed to tell us: "you have a <pkg>_IGNORE_CVES entry
for CVE-YYYY-ABCABC but this CVE isn't affecting the version of the
package in Buildroot", which is a hint that the entry is stale.

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot