kumquat-buildroot/package/libcoap/libcoap.mk
Fabrice Fontaine 9002b818be package/libcoap: fix CVE-2024-0962
A vulnerability was found in obgm libcoap 4.3.4. It has been rated as
critical. Affected by this issue is the function get_split_entry of the
file src/coap_oscore.c of the component Configuration File Handler. The
manipulation leads to stack-based buffer overflow. The attack may be
launched remotely. The exploit has been disclosed to the public and may
be used. It is recommended to apply a patch to fix this issue.
VDB-252206 is the identifier assigned to this vulnerability.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-03-01 22:01:58 +01:00

38 lines
1.2 KiB
Makefile

################################################################################
#
# libcoap
#
################################################################################
LIBCOAP_VERSION = 4.3.4
LIBCOAP_SITE = $(call github,obgm,libcoap,v$(LIBCOAP_VERSION))
LIBCOAP_INSTALL_STAGING = YES
LIBCOAP_LICENSE = BSD-2-Clause
LIBCOAP_LICENSE_FILES = COPYING LICENSE
LIBCOAP_CPE_ID_VENDOR = libcoap
LIBCOAP_DEPENDENCIES = host-pkgconf
LIBCOAP_CONF_OPTS = \
--disable-examples --disable-examples-source --without-tinydtls
LIBCOAP_AUTORECONF = YES
# 0001-coap_oscore-c-Fix-parsing-OSCORE-configuration-information.patch
LIBCOAP_IGNORE_CVES += CVE-2024-0962
ifeq ($(BR2_PACKAGE_GNUTLS),y)
LIBCOAP_DEPENDENCIES += gnutls
LIBCOAP_CONF_OPTS += \
--enable-dtls --with-gnutls --without-mbedtls --without-openssl
else ifeq ($(BR2_PACKAGE_LIBOPENSSL),y)
LIBCOAP_DEPENDENCIES += openssl
LIBCOAP_CONF_OPTS += \
--enable-dtls --without-gnutls --without-mbedtls --with-openssl
else ifeq ($(BR2_PACKAGE_MBEDTLS),y)
LIBCOAP_DEPENDENCIES += mbedtls
LIBCOAP_CONF_OPTS += \
--enable-dtls --without-gnutls --with-mbedtls --without-openssl
else
LIBCOAP_CONF_OPTS += --disable-dtls
endif
$(eval $(autotools-package))