kumquat-buildroot/package/libiec61850/libiec61850.mk
Fabrice Fontaine 3663d810ca package/libiec61850: fix CVE-2020-15158
In libIEC61850 before version 1.4.3, when a message with COTP message
length field with value < 4 is received an integer underflow will happen
leading to heap buffer overflow. This can cause an application crash or
on some platforms even the execution of remote code. If your application
is used in open networks or there are untrusted nodes in the network it
is highly recommend to apply the patch. This was patched with commit
033ab5b. Users of version 1.4.x should upgrade to version 1.4.3 when
available. As a workaround changes of commit 033ab5b can be applied to
older versions.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-01-09 23:34:20 +01:00

19 lines
617 B
Makefile

################################################################################
#
# libiec61850
#
################################################################################
LIBIEC61850_VERSION = 1.4.2.1
LIBIEC61850_SITE = $(call github,mz-automation,libiec61850,v$(LIBIEC61850_VERSION))
LIBIEC61850_INSTALL_STAGING = YES
LIBIEC61850_LICENSE = GPL-3.0+
LIBIEC61850_LICENSE_FILES = COPYING
LIBIEC61850_CONF_OPTS = -DBUILD_EXAMPLES=OFF \
-DBUILD_PYTHON_BINDINGS=OFF
# 0003-COTP-fixed-possible-heap-buffer-overflow-when-handling-message.patch
LIBIEC61850_IGNORE_CVES += CVE-2020-15158
$(eval $(cmake-package))