Fix the following vulnerability:
- CVE-2025-46728
cpp-httplib is a C++ header-only HTTP/HTTPS server and client library.
Prior to version 0.20.1, the library fails to enforce configured size
limits on incoming request bodies when `Transfer-Encoding: chunked` is
used or when no `Content-Length` header is provided. A remote attacker
can send a chunked request without the terminating zero-length chunk,
causing uncontrolled memory allocation on the server. This leads to
potential exhaustion of system memory and results in a server crash or
unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits
during parsing. If the limit is exceeded at any point during reading,
the connection is terminated immediately. A short-term workaround
through a Reverse Proxy is available. If updating the library
immediately is not feasible, deploy a reverse proxy (e.g., Nginx,
HAProxy) in front of the `cpp-httplib` application. Configure the
proxy to enforce maximum request body size limits, thereby stopping
excessively large requests before they reach the vulnerable library
code.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-46728
- 7b752106ac
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The each_cpe() method is careful that some CVEs have no
"configurations", but some CVEs such as
https://nvd.nist.gov/vuln/detail/CVE-2025-32915 apparently have a
"configurations" node, but no "nodes" inside the "configurations",
causing an exception:
Traceback (most recent call last):
File "/home/buildroot/buildroot-stats/./support/scripts/pkg-stats", line 1382, in <module>
__main__()
File "/home/buildroot/buildroot-stats/./support/scripts/pkg-stats", line 1371, in __main__
check_package_cves(args.nvd_path, packages)
File "/home/buildroot/buildroot-stats/./support/scripts/pkg-stats", line 679, in check_package_cves
check_package_cve_affects(cve, cpe_product_pkgs)
File "/home/buildroot/buildroot-stats/./support/scripts/pkg-stats", line 638, in check_package_cve_affects
for product in cve.affected_products:
^^^^^^^^^^^^^^^^^^^^^
File "/home/buildroot/buildroot-stats/support/scripts/cve.py", line 185, in affected_products
return set(cpe_product(p['id']) for p in self.each_cpe())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/buildroot/buildroot-stats/support/scripts/cve.py", line 185, in <genexpr>
return set(cpe_product(p['id']) for p in self.each_cpe())
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/buildroot/buildroot-stats/support/scripts/cve.py", line 173, in each_cpe
for node in nodes['nodes']:
~~~~~^^^^^^^^^
KeyError: 'nodes'
Fixes:
54f8d97c91 ("support/scripts/pkg-stats: adapt to NVD v2 json format")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Romain:
- add reference to buildroot commit introducing the issue
- a similar patch was sent by Daniel Lang (thanks!)]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Update the kernel, U-Boot, ATF tags, as well as documentation, used by
the LS1046A-FRWY to the latest Linux Factory release.
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
[Julien: add missing BR2_TARGET_UBOOT_NEEDS_GNUTLS=y]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the kernel, U-Boot, ATF tags, as well as documentation, used by
the LS1046A-RDB to the latest Linux Factory release.
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
[Julien: add missing BR2_TARGET_UBOOT_NEEDS_GNUTLS=y]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the kernel, U-Boot, ATF tags, as well as documentation, used by
the LS1043A-RDB to the latest Linux Factory release.
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
[Julien:
- add missing BR2_TARGET_UBOOT_NEEDS_GNUTLS=y
- replace "LS1028A-RDB" by "LS1043A-RDB" in commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the kernel, U-Boot, ATF tags, as well as documentation, used by
the LS1028A-RDB to the latest Linux Factory release.
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
[Julien: add missing BR2_TARGET_UBOOT_NEEDS_GNUTLS=y]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The commit we were previously on, 45e6925, was the head of the master
branch and now became tag lf-6.12.20-2.0.0, which we can use as is.
Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This is nominally a bugfix release which now also includes the patch we
previously backported, so we can remove it.
However, it also introduced some breakage:
- Builds with older toolchains (like br-arm-full-static, GCC 9) fail
because the introduction of C23 [[fallthrough]] to the code was not
properly gated on compiler support.
- Compiling for x86 without SSE2 support (e.g. with
bootlin-x86-i686-musl) fails because the check for native half-with
float arithmetic support on the target was not strict enough.
Import unreleased upstream patches that fix these issues.
Release notes: https://github.com/intel/tinycbor/releases/tag/v0.6.1
Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Add OP-TEE OS Support. NXP BSP lf-6.12.3-1.0.0 version.
The i.MX93 Boot Container requires a raw TEE binary without a TEE header.
Update the imx9-bootloader-prepare.sh script and Config.in accordingly
to ensure compatibility with this requirement.
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Breno Lima <breno.lima@nxp.com>
Reviewed-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
[Julien: remove empty line in hash file to fix check-package error]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This new version v0.6.0-11-g7e06aa3 (lastest git commit)
supports more bayer formats:
b5ad78a1c6
Signed-off-by: Sébastien Tisserand <sebastien.tisserand@armadeus.com>
Reviewed-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
[Julien: use "git describe --tags --abbrev=40" format in _VERSION]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream FRR accepts --enable-multipath=N in the range 1-999. Buildroot
previously hardcoded 256.
Add a config integer to set the maximum ECMP paths at build time, keeping
256 as the default. Lower values help match hardware limits or reduce
memory; higher values are useful for software routing or lab testing.
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
[Julien:
- reword commit log title
- replace python '%' formatting with '+' concatenation
- remove IP address assertion in test controller as it
is already in sample script
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
From 0.9.1 the pyroute2 core is async, the synchronous API remains
available as a wrapper.
Upstream changelog:
https://github.com/svinota/pyroute2/blob/0.9.4/CHANGELOG.rst
pyroute2 now requires the python3 ssl module at runtime. This is
reflected in Config.in.
Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
[Julien:
- add comment in commit log about new ssl runtime dependency
- add runtime comment in Config.in
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Release e-mail:
https://inbox.sourceware.org/libc-alpha/5906001.DvuYhMxLoT@pinacolada/
Major new features:
* The following ISO C23 function families (introduced in TS
18661-4:2015) are now supported in <math.h>. Each family includes
functions for float, double, long double, _FloatN and _FloatNx, and a
type-generic macro in <tgmath.h>.
- Power and absolute-value functions: compoundn, pown, powr, rootn,
rsqrt.
* On Linux, the pthread_gettid_np function has been added.
* The ISO C2Y family of unsigned abs functions, i.e. uabs, ulabs,
ullabs, and uimaxabs, is now supported.
* On Linux, the <termios.h> interface now supports arbitrary baud rates;
speed_t is redefined to simply be the baud rate specified as an
unsigned int, which matches the kernel interface.
* The thread-local cache in malloc (tcache) now supports caching of
large blocks. This feature can be enabled by setting the tunable
glibc.malloc.tcache_max to a larger value (max 4194304). Tcache is
also significantly faster for small sizes.
* A new configure option, "--enable-sframe", can be used to enable
SFrame support of the GNU C Libraries. SFrame is a new stack trace
information format which can be used by backtrace. It requires
binutils with a minimum version of 2.45.
* Support for lightweight stack guard pages via madvise and the
MADV_GUARD_INSTALL flag has been added to pthread_create.
* Additional optimized and correctly rounded mathematical functions have
been imported from the CORE-MATH project, in particular acospif,
asinpif, atanpif, atan2pif, cospif, sinpif, tanpif.
* The testsuite has been significantly extended, including coverage of
the functionality of the printf and scanf function families in many
variants.
* The manual has been significantly extended and updated, particularly
the threads, terminal, filesystem, resource, and math chapters.
* Code has been added to detect the x86-64 Intel Arrow Lake, Panther
Lake, Clearwater Forest, and Diamond Rapids microarchitectures.
* Regarding S390, support for the new z17 platform has been added.
Deprecated and removed features, and other changes affecting compatibility:
* The glibc.rtld.execstack tunable now supports a compatibility mode to
allow programs that require an executable stack through dynamically
loaded shared libraries.
* On Linux, the <termio.h> header and the definition of struct termio
in <sys/ioctl.h> have been removed. The termio interface has been
obsolete since the very first version of POSIX.1 in 1988, replaced
with <termios.h>.
* The support for TX lock elision of pthread mutexes has been deprecated
on all architectures and will be removed in the next release.
* On AArch64 Linux targets supporting the Scalable Matrix Extension
(SME), setjmp and sigsetjmp will disable the ZA state of SME.
Changes to build and runtime requirements:
* GCC 12.1 or later is now required to build the GNU C Library.
* GNU Binutils 2.39 or later is now required to build the GNU C Library.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: resolve conflict with commit feaf53585a]
Signed-off-by: Julien Olivain <ju.o@free.fr>
glibc 2.42 drops <termio.h>, so the libsanitizer code needs to be
adjusted accordingly, by backporting upstream gcc fixes.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien:
- renumbered 14.3.0/0003 patch to 14.3.0/0004
- renumbered 15.1.0/0002 patch to 15.1.0/0004
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
From the release notes:
(https://github.com/redis/redis/blob/8.2.0/00-RELEASENOTES)
===========================================================
8.2 GA (v8.2.0) Released Mon 4 Aug 2025 15:00:00 IST
===========================================================
This is the General Availability release of Redis Open Source 8.2.
- Streams - new commands: `XDELEX` and `XACKDEL`; extension to `XADD` and `XTRIM`
- Bitmap - `BITOP`: new operators: `DIFF`, `DIFF1`, `ANDOR`, and `ONE`
- Query Engine - new SVS-VAMANA vector index type which supports vector compression
- More than 15 performance and resource utilization improvements
- New metrics: per-slot usage metrics, key size distributions for basic data types, and more
Note: the full release note mention three CVEs fixed in 8.1.x and 8.2.x
series. Those security fixes were already included in version 8.0.2 and
8.0.3, already in Buildroot. Therefore, this commit is not marked as
security related.
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add comment in commit log about CVE in release note]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit b55957fa65 ("CHANGES: Update for 2025.02.3" added an entry for
2025.02.3, but forgot to add an empty line after the title. Fix that.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit f30bf62f53 ("CHANGES: update for 2025.02.4") added the release to
the top of the file instead of below 2025.05-rc1. Fix that and indent with
a tab like the other releases.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since this package hasn't had a proper release in a while this patch set
the CPE_VERSION and CPE_UPDATE to the latest tags available.
The annotation available on NVD all refers to this last available
version `cpe:2.3:a:luajit:luajit:2.1.0:beta3:*:*:*:*:*:*`.
See https://nvd.nist.gov/vuln/detail/CVE-2020-15890 for instance.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
