From d23ec514a8da2a319537dca54b97a18cf0c7bc53 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 30 Dec 2025 09:19:04 +0100 Subject: [PATCH] package/shellinabox: add CVE trailer in patch Since Buildroot commit [1] the patches that fixes a security vulnerability needs to reference the fixed vulnerability. This patch adds the relevant information to the patch header and adds the `Upstream` trailer. [1] 1167d0ff3d docs/manual: mention CVE trailer Signed-off-by: Thomas Perale Signed-off-by: Thomas Petazzoni (cherry picked from commit 7c9166cd86a4d984d019996b58d7a68052a1639f) Signed-off-by: Thomas Perale --- .checkpackageignore | 1 - ...02-CVE-2018-16789-fix-for-broken-multipart-form-data.patch | 4 +++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.checkpackageignore b/.checkpackageignore index 2e33117c5d..55d54aa5be 100644 --- a/.checkpackageignore +++ b/.checkpackageignore @@ -1031,7 +1031,6 @@ package/shadowsocks-libev/0003-lib-Makefile.am-remove-static-from-LDFLAGS.patch package/shairport-sync/S99shairport-sync Shellcheck lib_sysv.Indent lib_sysv.Variables package/shared-mime-info/0001-Remove-incorrect-dependency-from-install-data-hook.patch lib_patch.Upstream package/shellinabox/0001-Makefile-disable-always-building-statically.patch lib_patch.Upstream -package/shellinabox/0002-CVE-2018-16789-fix-for-broken-multipart-form-data.patch lib_patch.Upstream package/skeleton-init-systemd/fakeroot_tmpfiles.sh Shellcheck package/slang/0001-slsh-libs.patch lib_patch.Upstream package/smcroute/S41smcroute NotExecutable lib_sysv.Indent lib_sysv.Variables diff --git a/package/shellinabox/0002-CVE-2018-16789-fix-for-broken-multipart-form-data.patch b/package/shellinabox/0002-CVE-2018-16789-fix-for-broken-multipart-form-data.patch index 4b15f419e3..5067833056 100644 --- a/package/shellinabox/0002-CVE-2018-16789-fix-for-broken-multipart-form-data.patch +++ b/package/shellinabox/0002-CVE-2018-16789-fix-for-broken-multipart-form-data.patch @@ -4,7 +4,9 @@ Date: Fri, 26 Oct 2018 11:51:15 +0200 Subject: [PATCH] fix for broken multipart/form-data Malformed multipart/form-data payload results in infinite loop and thus denial of service -[Upstream status: https://github.com/shellinabox/shellinabox/pull/446] + +CVE: CVE-2018-16789 +Upstream: https://github.com/shellinabox/shellinabox/pull/446 Signed-off-by: Fabrice Fontaine --- libhttp/url.c | 3 +++