mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-07 16:10:37 -09:00
fd313c4ceb
Fix the following vulnerability:
- CVE-2025-46728
cpp-httplib is a C++ header-only HTTP/HTTPS server and client library.
Prior to version 0.20.1, the library fails to enforce configured size
limits on incoming request bodies when `Transfer-Encoding: chunked` is
used or when no `Content-Length` header is provided. A remote attacker
can send a chunked request without the terminating zero-length chunk,
causing uncontrolled memory allocation on the server. This leads to
potential exhaustion of system memory and results in a server crash or
unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits
during parsing. If the limit is exceeded at any point during reading,
the connection is terminated immediately. A short-term workaround
through a Reverse Proxy is available. If updating the library
immediately is not feasible, deploy a reverse proxy (e.g., Nginx,
HAProxy) in front of the `cpp-httplib` application. Configure the
proxy to enforce maximum request body size limits, thereby stopping
excessively large requests before they reach the vulnerable library
code.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-46728
- 7b752106ac
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
(cherry picked from commit aea7c89396)
Signed-off-by: Julien Olivain <ju.o@free.fr>
49 lines
1.3 KiB
Makefile
49 lines
1.3 KiB
Makefile
################################################################################
|
|
#
|
|
# cpp-httplib
|
|
#
|
|
################################################################################
|
|
|
|
CPP_HTTPLIB_VERSION = 0.19.0
|
|
CPP_HTTPLIB_SITE = $(call github,yhirose,cpp-httplib,v$(CPP_HTTPLIB_VERSION))
|
|
CPP_HTTPLIB_LICENSE = MIT
|
|
CPP_HTTPLIB_LICENSE_FILES = LICENSE
|
|
CPP_HTTPLIB_CPE_ID_VALID = YES
|
|
CPP_HTTPLIB_INSTALL_STAGING = YES
|
|
CPP_HTTPLIB_CONF_OPTS = \
|
|
-Dcpp-httplib_test=false
|
|
|
|
# 0001-merge-commit-from-fork.patch
|
|
CPP_HTTPLIB_IGNORE_CVES += CVE-2025-46728
|
|
|
|
ifeq ($(BR2_PACKAGE_CPP_HTTPLIB_COMPILE),y)
|
|
CPP_HTTPLIB_CONF_OPTS += -Dcpp-httplib_compile=true
|
|
CPP_HTTPLIB_DEPENDENCIES += host-python3
|
|
else
|
|
# Header only library
|
|
CPP_HTTPLIB_INSTALL_TARGET = NO
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_OPENSSL),y)
|
|
CPP_HTTPLIB_CONF_OPTS += -Dcpp-httplib_openssl=enabled
|
|
CPP_HTTPLIB_DEPENDENCIES += openssl
|
|
else
|
|
CPP_HTTPLIB_CONF_OPTS += -Dcpp-httplib_openssl=disabled
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZLIB),y)
|
|
CPP_HTTPLIB_CONF_OPTS += -Dcpp-httplib_zlib=enabled
|
|
CPP_HTTPLIB_DEPENDENCIES += zlib
|
|
else
|
|
CPP_HTTPLIB_CONF_OPTS += -Dcpp-httplib_zlib=disabled
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_BROTLI),y)
|
|
CPP_HTTPLIB_CONF_OPTS += -Dcpp-httplib_brotli=enabled
|
|
CPP_HTTPLIB_DEPENDENCIES += brotli
|
|
else
|
|
CPP_HTTPLIB_CONF_OPTS += -Dcpp-httplib_brotli=disabled
|
|
endif
|
|
|
|
$(eval $(meson-package))
|