mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-15 18:27:12 +00:00
Code Issues Projects Releases Wiki Activity

libwebsockets: upgrade 4.5.8 -> 5.0.0

Browse Source 
Release notes: [1]

Solves (at least) CVE-2026-19773 and CVE-2026-78161.
[2] claims that there are many security fixes available.

Drop patch included in this release.
Drop LIB_SUFFIX which now only throws deprecation warning.
Disable WERROR to keep build green.

Add new option http3 to packageconfig and disable it as it cannot use
openssl which is now enabled for ssl package option.
It can be used together with openssl for ssl and gnutls for https but
that would be weird.
Added possibility to switch gnutls as SSL backend.

License-Update: Addend additional files [3]

[1] https://github.com/warmcat/libwebsockets/blob/v5.0.0/README.md?plain=1#L29
[2] https://github.com/warmcat/libwebsockets/commit/ed1d8f3bc5b7772f283f05d77dec3b4ced0c95b3
[3] https://github.com/warmcat/libwebsockets/commit/a64f8d72c7442d8a982cce5fc0754d87c8db7ee7

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Peter Marko authored and Khem Raj committed 2026-10-09 10:01:42 -07:00
1 parent 3e423e21e5
commit 201c25456e
2 files changed
+10 -52
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-10650.patch
-46
View File
@@ -1,46 +0,0 @@
From 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498 Mon Sep 17 00:00:00 2001
From: Biniam F Demissie <biniamfd@gmail.com>
Date: Wed, 13 May 2026 04:25:55 +0100
Subject: [PATCH] ssh: plugin: add limit to resource exhaustion
CVE: CVE-2026-10650
Upstream-Status: Backport [https://github.com/warmcat/libwebsockets/commit/3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
plugins/ssh-base/sshd.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/plugins/ssh-base/sshd.c b/plugins/ssh-base/sshd.c
index ea35cb8b7..c849644d4 100644
--- a/plugins/ssh-base/sshd.c
+++ b/plugins/ssh-base/sshd.c
@@ -1,7 +1,7 @@
/*
* libwebsockets - small server side websockets and web server implementation
*
- * Copyright (C) 2010 - 2019 Andy Green <andy@warmcat.com>
+ * Copyright (C) 2010 - 2026 Andy Green <andy@warmcat.com>
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to
@@ -28,6 +28,8 @@
#include <string.h>
#include <stdlib.h>
+#define LWS_SSH_MAX_PACKET_SIZE (256 * 1024)
+
void *sshd_zalloc(size_t s)
{
void *p = malloc(s);
@@ -592,6 +594,11 @@ again:
pss->parser_state = SSHS_MSG_PADDING;
pss->ctr = 0;
pss->pos = 4;
+
+ if (pss->msg_len > LWS_SSH_MAX_PACKET_SIZE) {
+ lwsl_notice("msg size %u exceeds maximum\n", pss->msg_len);
+ goto bail;
+ }
if (pss->msg_len < 2 + 4) {
lwsl_notice("illegal msg size\n");
goto bail;
meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb → meta-oe/recipes-connectivity/libwebsockets/libwebsockets_5.0.0.bb
+10 -6
View File
@@ -1,15 +1,15 @@
SUMMARY = "Canonical libwebsockets.org websocket library"
HOMEPAGE = "https://libwebsockets.org/"
LICENSE = "Apache-2.0 AND BSD-3-Clause AND MIT AND OFL-1.1 AND Zlib"
LIC_FILES_CHKSUM = "file://LICENSE;md5=b5d391cc7929bcba238f9ba6805f7574"
LIC_FILES_CHKSUM = "file://LICENSE;md5=d1d99ab4e0f1be7992a891906e47add2"
DEPENDS = "zlib"
DEPENDS:append:class-native = " libcap-native"
SRCREV = "fbb0baf6af9c4324f0f1591734c78b0089b599d4"
SRCREV = "2491a1b101283cf7886d05033345b7e821825319"
SRCBRANCH = "v${@oe.utils.trim_version("${PV}", 2)}-stable"
SRC_URI = " \
git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.5-stable;tag=v${PV} \
file://CVE-2026-10650.patch \
git://github.com/warmcat/libwebsockets.git;protocol=https;branch=${SRCBRANCH};tag=v${PV} \
"
UPSTREAM_CHECK_URI = "https://github.com/warmcat/${BPN}/releases"
@@ -20,25 +20,29 @@ inherit cmake pkgconfig
PACKAGECONFIG ?= "libuv client server http2 ssl ${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"
PACKAGECONFIG[client] = "-DLWS_WITHOUT_CLIENT=OFF,-DLWS_WITHOUT_CLIENT=ON,"
PACKAGECONFIG[http2] = "-DLWS_WITH_HTTP2=ON,-DLWS_WITH_HTTP2=OFF,"
PACKAGECONFIG[http3] = "-DLWS_WITH_HTTP3=ON -DLWS_ROLE_QUIC=ON,-DLWS_WITH_HTTP3=OFF -DLWS_ROLE_QUIC=OFF,gnutls"
PACKAGECONFIG[ipv6] = "-DLWS_IPV6=ON,-DLWS_IPV6=OFF,"
PACKAGECONFIG[libevent] = "-DLWS_WITH_LIBEVENT=ON,-DLWS_WITH_LIBEVENT=OFF,libevent"
PACKAGECONFIG[libev] = "-DLWS_WITH_LIBEV=ON,-DLWS_WITH_LIBEV=OFF,libev"
PACKAGECONFIG[libuv] = "-DLWS_WITH_LIBUV=ON,-DLWS_WITH_LIBUV=OFF,libuv"
PACKAGECONFIG[server] = "-DLWS_WITHOUT_SERVER=OFF,-DLWS_WITHOUT_SERVER=ON,"
PACKAGECONFIG[ssl] = "-DLWS_WITH_SSL=ON,-DLWS_WITH_SSL=OFF,openssl libcap"
PACKAGECONFIG[ssl] = "-DLWS_WITH_SSL=ON,-DLWS_WITH_SSL=OFF,${SSL_DEPENDENCY} libcap"
PACKAGECONFIG[gnutls] = "-DLWS_WITH_GNUTLS=ON,-DLWS_WITH_GNUTLS=OFF,gnutls"
PACKAGECONFIG[static] = "-DLWS_WITH_STATIC=ON,-DLWS_WITH_STATIC=OFF -DLWS_LINK_TESTAPPS_DYNAMIC=ON,"
PACKAGECONFIG[systemd] = "-DLWS_WITH_SDEVENT=ON,-DLWS_WITH_SDEVENT=OFF,systemd"
PACKAGECONFIG[examples] = "-DLWS_WITH_MINIMAL_EXAMPLES=ON,-DLWS_WITH_MINIMAL_EXAMPLES=OFF"
SSL_DEPENDENCY = "${@bb.utils.contains('PACKAGECONFIG', 'gnutls', '', 'openssl', d)}"
python __anonymous() {
if bb.utils.contains('PACKAGECONFIG', 'systemd', True, False, d) and not bb.utils.contains('DISTRO_FEATURES', 'systemd', True, False, d):
bb.fatal("PACKAGECONFIG contains systemd but DISTRO_FEATURES doesn't")
}
EXTRA_OECMAKE += " \
-DLIB_SUFFIX=${@d.getVar('baselib').replace('lib', '')} \
-DLWS_WITHOUT_TESTAPPS=ON \
-DLWS_HAVE_HMAC_CTX_new=ON \
-DDISABLE_WERROR=ON \
"
do_compile:prepend() {