From patchwork Sun Oct 13 16:11:51 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pierre-Jean Texier X-Patchwork-Id: 1175851 Return-Path: X-Original-To: incoming-buildroot@patchwork.ozlabs.org Delivered-To: patchwork-incoming-buildroot@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=busybox.net (client-ip=140.211.166.137; helo=fraxinus.osuosl.org; envelope-from=buildroot-bounces@busybox.net; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=quarantine dis=none) header.from=koncepto.io Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=koncepto.io header.i=@koncepto.io header.b="ftI1dLyi"; dkim-atps=neutral Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 46rmtd4xzCz9sP4 for ; Mon, 14 Oct 2019 03:12:41 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 2147485CA8; Sun, 13 Oct 2019 16:12:37 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9x0Txmead53K; Sun, 13 Oct 2019 16:12:36 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by fraxinus.osuosl.org (Postfix) with ESMTP id 9F1AE85F56; Sun, 13 Oct 2019 16:12:36 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by ash.osuosl.org (Postfix) with ESMTP id E8EBB1BF3B9 for ; Sun, 13 Oct 2019 16:12:33 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id E380F87A62 for ; Sun, 13 Oct 2019 16:12:33 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FnIi1cQMNbCx for ; Sun, 13 Oct 2019 16:12:32 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from koncepto.io (koncepto.io [195.154.119.111]) by hemlock.osuosl.org (Postfix) with ESMTPS id 901CC879DB for ; Sun, 13 Oct 2019 16:12:32 +0000 (UTC) Received: from menoah.home (lfbn-1-6734-38.w90-120.abo.wanadoo.fr [90.120.168.38]) by koncepto.io (Postfix) with ESMTPSA id 9357A600BD; Sun, 13 Oct 2019 18:12:23 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=koncepto.io; s=default; t=1570983143; bh=t4AJ6F2/Vfh/cMg9tq+mUaz0mA7CIk//N7r3IeQYbv0=; h=From:To:Cc:Subject:Date:From; b=ftI1dLyiZ80KOrIctr1gB3OszMh30VPRsF3iL5kExiHHoVgZ9jZFvq699e+vKIdmx VuC0lcr0Dq/N8Dcity51sFYeYfSep5MNxwafv5BDRnbmks6/iaxT2S5uKxSqjg3iiM aQ5fR229ZSGOWUw34I+SFKVZGwDP3qPn9ZW6EhioeWqri1DqeKXbJwHQ2eETIkQtRi GaqRcvlhbPphVOtqWPnds7+i86py/KwXdOa4E+R2//TmgnKIp27f+UYa920s5smKxq pu9gIrFBM1uCAyBxEuNCYEQFXoYcoSrdlZLpCVlJuL8v9DJXJlNfLVhbEn+rczBJNe nj2Y70athfDbw== From: Pierre-Jean Texier To: buildroot@buildroot.org Date: Sun, 13 Oct 2019 18:11:51 +0200 Message-Id: <1570983112-25650-1-git-send-email-pjtexier@koncepto.io> X-Mailer: git-send-email 2.7.4 Subject: [Buildroot] [PATCH] package/mongoose: security bump to version 6.16 X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Pierre-Jean Texier MIME-Version: 1.0 Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" Fixes the following security vulnerability: CVE-2019-13503: mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read. See https://github.com/cesanta/mongoose/releases/tag/6.16 Signed-off-by: Pierre-Jean Texier --- package/mongoose/mongoose.hash | 2 +- package/mongoose/mongoose.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/mongoose/mongoose.hash b/package/mongoose/mongoose.hash index 92f35a7..d380131 100644 --- a/package/mongoose/mongoose.hash +++ b/package/mongoose/mongoose.hash @@ -1,3 +1,3 @@ # Locally computed: -sha256 ed9b44690f9660d25562e45472d486c086bcc916bf49f39f22e0a90444d44454 mongoose-6.15.tar.gz +sha256 1f20f2781862560ddf3203dfb0e6fcf248a68bf92aefbeafb9d2a629c4767c02 mongoose-6.16.tar.gz sha256 fdc34eeea97327d75c83492abd34f1a3200c53dec04422ecda8071dc60a36d10 LICENSE diff --git a/package/mongoose/mongoose.mk b/package/mongoose/mongoose.mk index c4a703d..bb40de2 100644 --- a/package/mongoose/mongoose.mk +++ b/package/mongoose/mongoose.mk @@ -4,7 +4,7 @@ # ################################################################################ -MONGOOSE_VERSION = 6.15 +MONGOOSE_VERSION = 6.16 MONGOOSE_SITE = $(call github,cesanta,mongoose,$(MONGOOSE_VERSION)) MONGOOSE_LICENSE = GPL-2.0 MONGOOSE_LICENSE_FILES = LICENSE