Thanks, applied as 0003443832618110b4159628975d154fca64f12b. Michael
[sent from post-receive hook] On Fri, 11 Nov 2022 15:31:12 +0100, Christian Melki <christian.me...@t2data.com> wrote: > Usual churn of new options and fixes. > https://curl.se/changes.html#7_86_0 > > Notable changes is the addition of the websockets API. > https://curl.se/docs/security.html > This release plugs CVEs: > CVE-2022-42916: HSTS bypass via IDN > CVE-2022-42915: HTTP proxy double-free > CVE-2022-35260: .netrc parser out-of-bounds access > CVE-2022-32221: POST following PUT confusion > > * Explicitly disable the websockets API for now. > > Signed-off-by: Christian Melki <christian.me...@t2data.com> > Message-Id: <20221026094309.767626-1-christian.me...@t2data.com> > Signed-off-by: Michael Olbrich <m.olbr...@pengutronix.de> > > diff --git a/rules/libcurl.make b/rules/libcurl.make > index 4097462c5721..c4f528f69333 100644 > --- a/rules/libcurl.make > +++ b/rules/libcurl.make > @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_LIBCURL) += libcurl > # > # Paths and names > # > -LIBCURL_VERSION := 7.85.0 > -LIBCURL_MD5 := 131f76c84016c45806b902330a74164f > +LIBCURL_VERSION := 7.86.0 > +LIBCURL_MD5 := 19a2165f37941a6f412afc924e750568 > LIBCURL := curl-$(LIBCURL_VERSION) > LIBCURL_SUFFIX := tar.xz > LIBCURL_URL := https://curl.se/download/$(LIBCURL).$(LIBCURL_SUFFIX) > @@ -90,6 +90,7 @@ LIBCURL_CONF_OPT := \ > --enable-get-easy-options \ > --disable-alt-svc \ > --enable-hsts \ > + --disable-websockets \ > --without-schannel \ > --without-secure-transport \ > --without-amissl \
