9002b818be
A vulnerability was found in obgm libcoap 4.3.4. It has been rated as critical. Affected by this issue is the function get_split_entry of the file src/coap_oscore.c of the component Configuration File Handler. The manipulation leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-252206 is the identifier assigned to this vulnerability. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
38 lines
1.2 KiB
Makefile
38 lines
1.2 KiB
Makefile
################################################################################
|
|
#
|
|
# libcoap
|
|
#
|
|
################################################################################
|
|
|
|
LIBCOAP_VERSION = 4.3.4
|
|
LIBCOAP_SITE = $(call github,obgm,libcoap,v$(LIBCOAP_VERSION))
|
|
LIBCOAP_INSTALL_STAGING = YES
|
|
LIBCOAP_LICENSE = BSD-2-Clause
|
|
LIBCOAP_LICENSE_FILES = COPYING LICENSE
|
|
LIBCOAP_CPE_ID_VENDOR = libcoap
|
|
LIBCOAP_DEPENDENCIES = host-pkgconf
|
|
LIBCOAP_CONF_OPTS = \
|
|
--disable-examples --disable-examples-source --without-tinydtls
|
|
LIBCOAP_AUTORECONF = YES
|
|
|
|
# 0001-coap_oscore-c-Fix-parsing-OSCORE-configuration-information.patch
|
|
LIBCOAP_IGNORE_CVES += CVE-2024-0962
|
|
|
|
ifeq ($(BR2_PACKAGE_GNUTLS),y)
|
|
LIBCOAP_DEPENDENCIES += gnutls
|
|
LIBCOAP_CONF_OPTS += \
|
|
--enable-dtls --with-gnutls --without-mbedtls --without-openssl
|
|
else ifeq ($(BR2_PACKAGE_LIBOPENSSL),y)
|
|
LIBCOAP_DEPENDENCIES += openssl
|
|
LIBCOAP_CONF_OPTS += \
|
|
--enable-dtls --without-gnutls --without-mbedtls --with-openssl
|
|
else ifeq ($(BR2_PACKAGE_MBEDTLS),y)
|
|
LIBCOAP_DEPENDENCIES += mbedtls
|
|
LIBCOAP_CONF_OPTS += \
|
|
--enable-dtls --without-gnutls --with-mbedtls --without-openssl
|
|
else
|
|
LIBCOAP_CONF_OPTS += --disable-dtls
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|