f466c88ec2
Fixes the following security issue:
CVE-2019-13132: a remote, unauthenticated client connecting to a
libzmq application, running with a socket listening with CURVE
encryption/authentication enabled, may cause a stack overflow and
overwrite the stack with arbitrary data, due to a buffer overflow in
the library. Users running public servers with the above configuration
are highly encouraged to upgrade as soon as possible, as there are no
known mitigations. All versions from 4.0.0 and upwards are affected.
Thank you Fang-Pen Lin for finding the issue and reporting it!
Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Peter: mention security impact]
(cherry picked from commit 45e5cd5a2b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
72 lines
2.0 KiB
Makefile
72 lines
2.0 KiB
Makefile
################################################################################
|
|
#
|
|
# zeromq
|
|
#
|
|
################################################################################
|
|
|
|
ZEROMQ_VERSION = 4.3.2
|
|
ZEROMQ_SITE = https://github.com/zeromq/libzmq/releases/download/v$(ZEROMQ_VERSION)
|
|
ZEROMQ_INSTALL_STAGING = YES
|
|
ZEROMQ_DEPENDENCIES = util-linux
|
|
ZEROMQ_CONF_OPTS = --without-documentation
|
|
ZEROMQ_LICENSE = LGPL-3.0+ with exceptions
|
|
ZEROMQ_LICENSE_FILES = COPYING COPYING.LESSER
|
|
|
|
# Assume these flags are always available. It is true, at least for
|
|
# SOCK_CLOEXEC, since linux v2.6.27.
|
|
# Note: the flag TCP_KEEPALIVE is NOT available so we do not include it.
|
|
ZEROMQ_CONF_ENV = libzmq_cv_sock_cloexec=yes \
|
|
libzmq_cv_so_keepalive=yes \
|
|
libzmq_cv_tcp_keepcnt=yes \
|
|
libzmq_cv_tcp_keepidle=yes \
|
|
libzmq_cv_tcp_keepintvl=yes
|
|
|
|
# Internal error, aborting at dwarf2cfi.c:2752 in connect_traces
|
|
# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58864
|
|
ifeq ($(BR2_m68k_cf),y)
|
|
ZEROMQ_CONF_OPTS += CXXFLAGS="$(TARGET_CXXFLAGS) -fno-defer-pop"
|
|
endif
|
|
|
|
# Only tools/curve_keygen.c needs this, but it doesn't hurt to pass it
|
|
# for the rest of the build as well (which automatically includes stdc++).
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
ZEROMQ_CONF_OPTS += LIBS=-lstdc++
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZEROMQ_NORM),y)
|
|
ZEROMQ_CONF_OPTS += --with-norm
|
|
ZEROMQ_DEPENDENCIES += norm
|
|
else
|
|
ZEROMQ_CONF_OPTS += --without-norm
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZEROMQ_PGM),y)
|
|
ZEROMQ_DEPENDENCIES += host-pkgconf openpgm
|
|
ZEROMQ_CONF_OPTS += --with-pgm
|
|
else
|
|
ZEROMQ_CONF_OPTS += --without-pgm
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZEROMQ_DRAFTS),y)
|
|
ZEROMQ_CONF_OPTS += --enable-drafts
|
|
else
|
|
ZEROMQ_CONF_OPTS += --disable-drafts
|
|
endif
|
|
|
|
# ZeroMQ uses libsodium if it's available.
|
|
ifeq ($(BR2_PACKAGE_LIBSODIUM),y)
|
|
ZEROMQ_DEPENDENCIES += libsodium
|
|
ZEROMQ_CONF_OPTS += --with-libsodium="$(STAGING_DIR)/usr"
|
|
else
|
|
ZEROMQ_CONF_OPTS += --without-libsodium
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBUNWIND),y)
|
|
ZEROMQ_DEPENDENCIES += libunwind
|
|
ZEROMQ_CONF_OPTS += --enable-libunwind
|
|
else
|
|
ZEROMQ_CONF_OPTS += --disable-libunwind
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|