Titouan Christophe
eee0f6c078
Import all security patches from OpenEmbedded for libsoup.
This fixes the following 18 known vulnerabilities:
- CVE-2024-52530:
GNOME libsoup before 3.6.0 allows HTTP request smuggling in some
configurations because '\0' characters at the end of header names are
ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the
same as a "Transfer-Encoding: chunked" header.
https://www.cve.org/CVERecord?id=CVE-2024-52530
- CVE-2024-52531:
GNOME libsoup before 3.6.1 allows a buffer overflow in applications that
perform conversion to UTF-8 in soup_header_parse_param_list_strict.
There is a plausible way to reach this remotely via
soup_message_headers_get_content_type (e.g., an application may want to
retrieve the content type of a request or response).
https://www.cve.org/CVERecord?id=CVE-2024-52531
- CVE-2024-52532:
GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption.
During the reading of certain patterns of WebSocket data from clients.
https://www.cve.org/CVERecord?id=CVE-2024-52532
- CVE-2025-2784:
Libsoup: heap buffer over-read in `skip_insignificant_space`
when sniffing content
https://www.cve.org/CVERecord?id=CVE-2025-2784
- CVE-2025-4476:
Libsoup: null pointer dereference in libsoup may lead to denial of service
https://www.cve.org/CVERecord?id=CVE-2025-4476
- CVE-2025-4948:
Libsoup: integer underflow in soup_multipart_new_from_message() leading to
denial of service in libsoup
https://www.cve.org/CVERecord?id=CVE-2025-4948
- CVE-2025-4969:
Libsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.c
https://www.cve.org/CVERecord?id=CVE-2025-4969
- CVE-2025-32050:
Libsoup: integer overflow in append_param_quoted
https://www.cve.org/CVERecord?id=CVE-2025-32050
- CVE-2025-32052:
Libsoup: heap buffer overflow in sniff_unknown()
https://www.cve.org/CVERecord?id=CVE-2025-32052
- CVE-2025-32053:
Libsoup: heap buffer overflows in sniff_feed_or_html() and
skip_insignificant_space()
https://www.cve.org/CVERecord?id=CVE-2025-32053
- CVE-2025-32906:
Libsoup: out of bounds reads in soup_headers_parse_request()
https://www.cve.org/CVERecord?id=CVE-2025-32906
- CVE-2025-32910:
Libsoup: null pointer deference on libsoup via /auth/soup-auth-digest.c
through "soup_auth_digest_authenticate" on client when server omits the
"realm" parameter in an unauthorized response with digest authentication
https://www.cve.org/CVERecord?id=CVE-2025-32910
- CVE-2025-32911:
Libsoup: double free on soup_message_headers_get_content_disposition()
through "soup-message-headers.c" via "params" ghashtable value
https://www.cve.org/CVERecord?id=CVE-2025-32911
- CVE-2025-32912:
Libsoup: null pointer dereference in client when server omits the "nonce"
parameter in an unauthorized response with digest authentication
https://www.cve.org/CVERecord?id=CVE-2025-32912
- CVE-2025-32913:
Libsoup: null pointer dereference in
soup_message_headers_get_content_disposition when "filename" parameter is
present, but has no value in content-disposition header
https://www.cve.org/CVERecord?id=CVE-2025-32913
- CVE-2025-32914:
Libsoup: oob read on libsoup through function
"soup_multipart_new_from_message" in soup-multipart.c leads to crash or
exit of process
https://www.cve.org/CVERecord?id=CVE-2025-32914
- CVE-2025-46420:
Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c
https://www.cve.org/CVERecord?id=CVE-2025-46420
- CVE-2025-46421:
Libsoup: information disclosure may leads libsoup client sends authorization
header to a different host when being redirected by a server
https://www.cve.org/CVERecord?id=CVE-2025-46421
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
102 lines
3.0 KiB
Makefile
102 lines
3.0 KiB
Makefile
################################################################################
|
|
#
|
|
# libsoup
|
|
#
|
|
################################################################################
|
|
|
|
LIBSOUP_VERSION_MAJOR = 2.74
|
|
LIBSOUP_VERSION = $(LIBSOUP_VERSION_MAJOR).3
|
|
LIBSOUP_SOURCE = libsoup-$(LIBSOUP_VERSION).tar.xz
|
|
LIBSOUP_SITE = https://download.gnome.org/sources/libsoup/$(LIBSOUP_VERSION_MAJOR)
|
|
LIBSOUP_LICENSE = LGPL-2.0+
|
|
LIBSOUP_LICENSE_FILES = COPYING
|
|
LIBSOUP_CPE_ID_VENDOR = gnome
|
|
LIBSOUP_INSTALL_STAGING = YES
|
|
LIBSOUP_DEPENDENCIES = \
|
|
host-intltool \
|
|
host-libglib2 \
|
|
host-pkgconf \
|
|
libglib2 \
|
|
libpsl \
|
|
libxml2 \
|
|
sqlite \
|
|
$(TARGET_NLS_DEPENDENCIES)
|
|
|
|
# 0003-sniffer-fix-potential-overflow.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-2784
|
|
# 0004-headers-Strictly-dont-allow-NUL-bytes.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2024-52530
|
|
# 0005-headers-Be-more-robust-against-invalid-input.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2024-52531
|
|
# 0006-websocket-process-the-frame-as-soon-as-we-read-data.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2024-52532
|
|
# 0007-Fix-using-int-instead-of-size_t.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-32050
|
|
# 0008-Fix-heap-buffer-overflow.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-32052
|
|
# 0009-Fix-heap-buffer-overflow.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-32053
|
|
# 0010-headers-Handle-parsing-only-newlines.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-32906
|
|
# 0011-auth-digest-Handle-missing-realm-nonce.patch
|
|
# 0012-auth-digest-Handle-missing-nonce.patch
|
|
# 0013-auth-digest-Fix-leak.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-32910
|
|
# 0014-CVE-2025-32911.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-32911 CVE-2025-32913
|
|
# 0015-auth-digest-Handle-missing-nonce.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-32912
|
|
# 0016-CVE-2025-32914.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-32914
|
|
# 0017-auth-digest-fix-crash.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-4476
|
|
# 0018-soup_header_parse_quality_list-Fix-leak.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-46420
|
|
# 0019-session-Strip-authentication-credentials.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-46421
|
|
# 0020-soup-multipart-Verify-boundary-limits.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-4948
|
|
# 0021-soup-multipart-Verify-array-bounds.patch
|
|
LIBSOUP_IGNORE_CVES += CVE-2025-4969
|
|
|
|
LIBSOUP_LDFLAGS = $(TARGET_LDFLAGS) $(TARGET_NLS_LIBS)
|
|
|
|
LIBSOUP_CONF_OPTS = \
|
|
-Dgtk_doc=false \
|
|
-Dntlm=disabled \
|
|
-Dsysprof=disabled \
|
|
-Dtests=false \
|
|
-Dtls_check=false \
|
|
-Dvapi=disabled
|
|
|
|
ifeq ($(BR2_PACKAGE_BROTLI),y)
|
|
LIBSOUP_CONF_OPTS += -Dbrotli=enabled
|
|
LIBSOUP_DEPENDENCIES += brotli
|
|
else
|
|
LIBSOUP_CONF_OPTS += -Dbrotli=disabled
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_GOBJECT_INTROSPECTION),y)
|
|
LIBSOUP_CONF_OPTS += -Dintrospection=enabled
|
|
LIBSOUP_DEPENDENCIES += gobject-introspection
|
|
else
|
|
LIBSOUP_CONF_OPTS += -Dintrospection=disabled
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBKRB5),y)
|
|
LIBSOUP_CONF_OPTS += \
|
|
-Dgssapi=enabled \
|
|
-Dkrb5_config=$(STAGING_DIR)/usr/bin/krb5-config
|
|
LIBSOUP_DEPENDENCIES += libkrb5
|
|
else
|
|
LIBSOUP_CONF_OPTS += -Dgssapi=disabled
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBSOUP_GNOME),y)
|
|
LIBSOUP_CONF_OPTS += -Dgnome=true
|
|
else
|
|
LIBSOUP_CONF_OPTS += -Dgnome=false
|
|
endif
|
|
|
|
$(eval $(meson-package))
|