mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-10-19 15:22:02 -09:00
720f5672db
https://github.com/kernelsauce/turbo/releases/tag/v2.1.5
https://github.com/kernelsauce/turbo/releases/tag/v2.1.4
Security fixes:
HTTP header injection: header values were only checked for a literal
\r\n, so a lone \r or \n could still split a header. Now rejected on
either character.
Transfer-Encoding requests are now rejected with 501 instead of silently
mishandled, closing a request smuggling avenue.
A real default request body size cap (128 MB) with a 413 response,
previously unbounded.
Secure cookie signature now binds the cookie name, so a value signed for
one cookie can no longer be replayed under a different name.
Verification failures return the default value instead of raising.
Constant-time comparison for the secure cookie HMAC, previously a
timing-leaky ==.
util.secure_random_bytes reads real OS entropy (/dev/urandom,
BCryptGenRandom on Windows) for WebSocket masks and util.rand_str,
previously math.random.
WebSocket: unmasked client frames are rejected per RFC 6455, and
fragmented message reassembly is capped to max_buffer_size to close a
memory exhaustion path.
StaticFileHandler decodes the request path before the traversal check,
closing a bypass.
Fixed a 32-byte-per-malformed-request memory leak in the C header parser
wrapper (found via libFuzzer).
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15a422cee1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at https://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches