diff options
| author | Minjae Kim <flowergom@gmail.com> | 2021-12-17 22:08:23 -0800 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-12-30 16:59:16 +0000 |
| commit | 1e13a3f9146b7ff8f660980c81574aa08843e4c5 (patch) | |
| tree | a81053ad356258d58a74d83f5e172054afc90d2f /scripts/lib/wic/pluginbase.py | |
| parent | 9564dc31cb906f2c80746858eb9977b43886e723 (diff) | |
| download | poky-1e13a3f9146b7ff8f660980c81574aa08843e4c5.tar.gz | |
inetutils: fix CVE-2021-40491
The ftp client in GNU Inetutils before 2.2 does not validate addresses
returned by PASV/LSPV responses to make sure they match the server
address. This is similar to CVE-2020-8284 for curl.
References:
https://nvd.nist.gov/vuln/detail/CVE-2021-40491
Patch from:
https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd
(From OE-Core rev: 22de3b937dda28a6aa4113549f32f36d67b6751d)
Signed-off-by: Minjae Kim <flowergom@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'scripts/lib/wic/pluginbase.py')
0 files changed, 0 insertions, 0 deletions