mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-23 15:54:21 -09:00
9e9f3b9a15
For release note, see:
https://github.com/encode/starlette/releases/tag/0.47.2
This fixes the following vulnerability:
- CVE-2025-54121:
Starlette is a lightweight ASGI (Asynchronous Server Gateway
Interface) framework/toolkit, designed for building async web services
in Python. In versions 0.47.1 and below, when parsing a multi-part
form with large files (greater than the default max spool size)
starlette will block the main thread to roll the file over to disk.
This blocks the event thread which means the application can't accept
new connections. The UploadFile code has a minor bug where instead of
just checking for self._in_memory, the logic should also check if the
additional bytes will cause a rollover. The vulnerability is fixed in
version 0.47.2.
https://www.cve.org/CVERecord?id=CVE-2025-54121
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Reviewed-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien: add link to release note]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8945ea3e67)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
17 lines
653 B
Makefile
17 lines
653 B
Makefile
################################################################################
|
|
#
|
|
# python-starlette
|
|
#
|
|
################################################################################
|
|
|
|
PYTHON_STARLETTE_VERSION = 0.47.2
|
|
PYTHON_STARLETTE_SOURCE = starlette-$(PYTHON_STARLETTE_VERSION).tar.gz
|
|
PYTHON_STARLETTE_SITE = https://files.pythonhosted.org/packages/04/57/d062573f391d062710d4088fa1369428c38d51460ab6fedff920efef932e
|
|
PYTHON_STARLETTE_SETUP_TYPE = hatch
|
|
PYTHON_STARLETTE_LICENSE = BSD-3-Clause
|
|
PYTHON_STARLETTE_LICENSE_FILES = LICENSE.md
|
|
PYTHON_STARLETTE_CPE_ID_VENDOR = encode
|
|
PYTHON_STARLETTE_CPE_ID_PRODUCT = starlette
|
|
|
|
$(eval $(python-package))
|