kumquat-buildroot/package/putty/putty.mk
Fabrice Fontaine 1352b59eb2 package/putty: fix CVE-2021-36367
PuTTY through 0.75 proceeds with establishing an SSH session even if it
has never sent a substantive authentication response. This makes it
easier for an attacker-controlled SSH server to present a later spoofed
authentication prompt (that the attacker can use to capture credential
data, and use that data for purposes that are undesired by the client
user).

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-07-17 12:02:21 +02:00

25 lines
644 B
Makefile

################################################################################
#
# putty
#
################################################################################
PUTTY_VERSION = 0.75
PUTTY_SITE = http://the.earth.li/~sgtatham/putty/$(PUTTY_VERSION)
PUTTY_LICENSE = MIT
PUTTY_LICENSE_FILES = LICENCE
PUTTY_CPE_ID_VENDOR = putty
PUTTY_CONF_OPTS = --disable-gtktest
# 0002-New-option-to-reject-trivial-success-of-userauth.patch
PUTTY_IGNORE_CVES += CVE-2021-36367
ifeq ($(BR2_PACKAGE_LIBGTK2),y)
PUTTY_CONF_OPTS += --with-gtk=2
PUTTY_DEPENDENCIES += libgtk2
else
PUTTY_CONF_OPTS += --without-gtk
endif
$(eval $(autotools-package))