cf686670b9
CVE-2023-31038 affects log4cxx only if ODBC is supported. While CVE-2023-31038 has been fixed in newer versions of log4cxx, there is quite a huge gap to do a version bump, and the commit that fixes CVE-2023-31038 could not be identified. Therefore, we want to rely on the fact that our log4cxx package does not support ODBC: there is indeed no explicit dependency on our unixodbc package in log4cxx.mk. However, log4cxx automatically detects if ODBC is available and if it is, it uses it. So what we do in this commit is backport an upstream commit, which adds explicitly options to enable/disable ODBC and ESMTP support, and we use them to (1) always disable ODBC and (2) explicitly enable/disable ESMTP support. Thanks to ODBC being disabled, we're not affected by CVE-2023-31038. Of course, there is a potential regression for users who were relying on the implicit unixodbc dependency, but as we could not identify the commit fixing the CVE-2023-31038, this is the best we can do at the moment. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
43 lines
1.2 KiB
Makefile
43 lines
1.2 KiB
Makefile
################################################################################
|
|
#
|
|
# log4cxx
|
|
#
|
|
################################################################################
|
|
|
|
LOG4CXX_VERSION = 0.13.0
|
|
LOG4CXX_SITE = https://archive.apache.org/dist/logging/log4cxx/$(LOG4CXX_VERSION)
|
|
LOG4CXX_SOURCE = apache-log4cxx-$(LOG4CXX_VERSION).tar.gz
|
|
LOG4CXX_INSTALL_STAGING = YES
|
|
LOG4CXX_LICENSE = Apache-2.0
|
|
LOG4CXX_LICENSE_FILES = LICENSE
|
|
LOG4CXX_CPE_ID_VENDOR = apache
|
|
# We do not support ODBC functionality
|
|
LOG4CXX_IGNORE_CVES = CVE-2023-31038
|
|
|
|
# Note: if you want to support odbc, make sure CVE-2023-31038 is fixed
|
|
LOG4CXX_CONF_OPTS = \
|
|
-DAPR_CONFIG_EXECUTABLE=$(STAGING_DIR)/usr/bin/apr-1-config \
|
|
-DAPR_UTIL_CONFIG_EXECUTABLE=$(STAGING_DIR)/usr/bin/apu-1-config \
|
|
-DLOG4CXX_ENABLE_ODBC=OFF
|
|
|
|
LOG4CXX_DEPENDENCIES = apr apr-util
|
|
|
|
ifeq ($(BR2_PACKAGE_BOOST),y)
|
|
LOG4CXX_DEPENDENCIES += boost
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBESMTP),y)
|
|
LOG4CXX_CONF_OPTS += -DLOG4CXX_ENABLE_LIBESMTP=ON
|
|
LOG4CXX_DEPENDENCIES += libesmtp
|
|
else
|
|
LOG4CXX_CONF_OPTS += -DLOG4CXX_ENABLE_LIBESMTP=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_USE_WCHAR),y)
|
|
LOG4CXX_CONF_OPTS += -DLOG4CXX_WCHAR_T=ON
|
|
else
|
|
LOG4CXX_CONF_OPTS += -DLOG4CXX_WCHAR_T=OFF
|
|
endif
|
|
|
|
$(eval $(cmake-package))
|