From 848d7dc51f1ce2576cb071b0f91063e4687cc088 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Mon, 29 Dec 2025 10:07:10 +0100 Subject: [PATCH] package/lua-http: add CVE trailer in patch Since Buildroot commit [1] the patches that fixes a security vulnerability needs to reference the fixed vulnerability. This patch adds the relevant information to the patch header. [1] 1167d0ff3d docs/manual: mention CVE trailer Signed-off-by: Thomas Perale Signed-off-by: Thomas Petazzoni --- ...01-http-h1_stream-handle-EOF-when-body_read_type-length.patch | 1 + 1 file changed, 1 insertion(+) diff --git a/package/lua-http/0001-http-h1_stream-handle-EOF-when-body_read_type-length.patch b/package/lua-http/0001-http-h1_stream-handle-EOF-when-body_read_type-length.patch index fdbf5243f5..7672ff3794 100644 --- a/package/lua-http/0001-http-h1_stream-handle-EOF-when-body_read_type-length.patch +++ b/package/lua-http/0001-http-h1_stream-handle-EOF-when-body_read_type-length.patch @@ -8,6 +8,7 @@ then return `EPIPE`. This fixes a potential infinite draining loop when trying to trying to `:shutdown()` a stream. +CVE: CVE-2023-4540 Upstream: https://github.com/daurnimator/lua-http/commit/ddab2835c583d45dec62680ca8d3cbde55e0bae6 Signed-off-by: Francois Perrad ---