From c407ccec92b359382b1eef42312e61c40d9b91b3 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Thu, 7 Aug 2025 22:54:39 +0200 Subject: [PATCH] package/libhtp: security bump to v0.5.51 For more information on the release, see: - https://github.com/OISF/libhtp/releases/tag/0.5.51 - https://github.com/OISF/libhtp/releases/tag/0.5.50 - https://github.com/OISF/libhtp/compare/0.5.49...0.5.51 This fixes the following vulnerability: - CVE-2025-53537 LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak that can starve the process of memory, leading to loss of visibility. To workaround this issue, set `suricata.yaml app-layer.protocols.http.libhtp.default-config.lzma- enabled` to false. This issue is fixed in version 0.5.51. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-53537 - https://github.com/OISF/libhtp/security/advisories/GHSA-v3qq-h8mh-vph7 Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain (cherry picked from commit 0e450a0b0837e74d1378c25c1254dfc3696c3262) Signed-off-by: Thomas Perale --- package/libhtp/libhtp.hash | 2 +- package/libhtp/libhtp.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/libhtp/libhtp.hash b/package/libhtp/libhtp.hash index 2e93586f7a..11105f8586 100644 --- a/package/libhtp/libhtp.hash +++ b/package/libhtp/libhtp.hash @@ -1,3 +1,3 @@ # Locally computed: -sha256 214395f8b42011154e133dfb4e94d15e4e3e3e12535e744a4c1eec8687d12c18 libhtp-0.5.49.tar.gz +sha256 699475c2e512d5af05312e808f1f759a5d3c4cb154e73d82eaa6906ceacfaeb4 libhtp-0.5.51.tar.gz sha256 87c93904e5434c81622ea690c2b90097b9f162aaa92a96542649a157dbf98d15 LICENSE diff --git a/package/libhtp/libhtp.mk b/package/libhtp/libhtp.mk index bb6559bc92..a986a79f1d 100644 --- a/package/libhtp/libhtp.mk +++ b/package/libhtp/libhtp.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBHTP_VERSION = 0.5.49 +LIBHTP_VERSION = 0.5.51 LIBHTP_SITE = $(call github,OISF,libhtp,$(LIBHTP_VERSION)) LIBHTP_LICENSE = BSD-3-Clause LIBHTP_LICENSE_FILES = LICENSE