mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-23 15:54:21 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/shellinabox: add CVE trailer in patch

Browse Source 
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header
and adds the `Upstream` trailer.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7c9166cd86)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2025-12-30 09:19:04 +01:00
parent f81cb193a8
commit d23ec514a8
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.checkpackageignore
View File

@@ -1031,7 +1031,6 @@ package/shadowsocks-libev/0003-lib-Makefile.am-remove-static-from-LDFLAGS.patch
package/shairport-sync/S99shairport-sync Shellcheck lib_sysv.Indent lib_sysv.Variables
package/shared-mime-info/0001-Remove-incorrect-dependency-from-install-data-hook.patch lib_patch.Upstream
package/shellinabox/0001-Makefile-disable-always-building-statically.patch lib_patch.Upstream
package/shellinabox/0002-CVE-2018-16789-fix-for-broken-multipart-form-data.patch lib_patch.Upstream
package/skeleton-init-systemd/fakeroot_tmpfiles.sh Shellcheck
package/slang/0001-slsh-libs.patch lib_patch.Upstream
package/smcroute/S41smcroute NotExecutable lib_sysv.Indent lib_sysv.Variables

4
package/shellinabox/0002-CVE-2018-16789-fix-for-broken-multipart-form-data.patch
View File

@@ -4,7 +4,9 @@ Date: Fri, 26 Oct 2018 11:51:15 +0200
Subject: [PATCH] fix for broken multipart/form-data
Malformed multipart/form-data payload results in infinite loop and thus denial of service
[Upstream status: https://github.com/shellinabox/shellinabox/pull/446]
CVE: CVE-2018-16789
Upstream: https://github.com/shellinabox/shellinabox/pull/446
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
libhttp/url.c | 3 +++