5b36e91fda
Fixed the following security issue: - CVE-2020-6097: An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1. A specially crafted sequence of RRQ-Multicast requests trigger an assert() call resulting in denial-of-service. An attacker can send a sequence of malicious packets to trigger this vulnerability. For more details, see the report: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1029 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
41 lines
1.2 KiB
Makefile
41 lines
1.2 KiB
Makefile
################################################################################
|
|
#
|
|
# atftp
|
|
#
|
|
################################################################################
|
|
|
|
ATFTP_VERSION = 0.7.2
|
|
ATFTP_SITE = http://sourceforge.net/projects/atftp/files
|
|
ATFTP_LICENSE = GPL-2.0+
|
|
ATFTP_LICENSE_FILES = LICENSE
|
|
# 0001-Makefile.am-link-against-libpthread-for-atftp.patch patches Makefile.am
|
|
ATFTP_AUTORECONF = YES
|
|
ATFTP_CONF_OPTS = --disable-libwrap --disable-mtftp
|
|
# For static we need to explicitly link against libpthread
|
|
ATFTP_LIBS = -lpthread
|
|
# -fgnu89-inline is needed to avoid multiple definition error with gcc 5. See
|
|
# https://gcc.gnu.org/gcc-5/porting_to.html.
|
|
ATFTP_CONF_ENV = LIBS="$(ATFTP_LIBS)" \
|
|
CFLAGS="$(TARGET_CFLAGS) -fgnu89-inline"
|
|
|
|
# 0004-Fix-for-DoS-issue-CVE-2020-6097.patch
|
|
ATFTP_IGNORE_CVES += CVE-2020-6097
|
|
|
|
ifeq ($(BR2_PACKAGE_READLINE),y)
|
|
ATFTP_DEPENDENCIES += readline
|
|
ATFTP_CONF_OPTS += --enable-libreadline
|
|
# For static, readline links with ncurses
|
|
ATFTP_LIBS += -lncurses
|
|
else
|
|
ATFTP_CONF_OPTS += --disable-libreadline
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_PCRE),y)
|
|
ATFTP_DEPENDENCIES += pcre
|
|
ATFTP_CONF_OPTS += --enable-libpcre
|
|
else
|
|
ATFTP_CONF_OPTS += --disable-libpcre
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|