mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-24 01:42:07 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libhttpserver: security bump to version 2.0.1

Browse Source 
Version 2.0.1 fixes an unauthenticated remote denial of service in
version 2.0.0. A single multipart/form-data request containing a file
part without a name attribute can terminate the server process. The
issue is rated high severity with a CVSS 3.1 score of 7.5.

The release also replaces the blocking-start pthread mutex and condition
variable with C++20 atomic wait and notify operations. The existing C++20,
GCC 11 and threads requirements cover this change.

https://github.com/etr/libhttpserver/releases/tag/2.0.1
https://github.com/etr/libhttpserver/security/advisories/GHSA-q8g6-h8wv-pr43

Signed-off-by: Stephan Hoffmann <sho@relinux.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Stephan Hoffmann
2026-10-19 14:17:26 +02:00
committed by Thomas Petazzoni
parent 05dc49017c
commit 5c248f335f
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/libhttpserver/libhttpserver.hash
View File

@@ -1,3 +1,3 @@
# Locally computed:
sha256 c44d67aba1e4b6767c0fbb895e1acd643601c1e3ee3de7705a59ed09bcd8c92e libhttpserver-2.0.0.tar.gz
sha256 cd6a53302415143abff2db2b92e59d3de837652243717c873d4fb41fe22fbb70 libhttpserver-2.0.1.tar.gz
sha256 5df07007198989c622f5d41de8d703e7bef3d0e79d62e24332ee739a452af62a COPYING.LESSER

2
package/libhttpserver/libhttpserver.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
LIBHTTPSERVER_VERSION = 2.0.0
LIBHTTPSERVER_VERSION = 2.0.1
LIBHTTPSERVER_SITE = $(call github,etr,libhttpserver,$(LIBHTTPSERVER_VERSION))
LIBHTTPSERVER_LICENSE = LGPL-2.1+
LIBHTTPSERVER_LICENSE_FILES = COPYING.LESSER