A lightweight RPC library based on XML and HTTP
5e6b354824
Backport upstream SVN revision 3342 to fix HTML injection vulnerability (CVE-2026-15928) in the Abyss HTTP server component of xmlrpc-c. The fix escapes HTML control characters in URIs, filenames, and error messages rendered in HTTP responses, preventing injection via crafted directory/file names or error text. CVE: CVE-2026-15928 Upstream patches: - https://sourceforge.net/p/xmlrpc-c/code/3342/ Resolves: RHEL-223865 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir |
||
|---|---|---|
| .gitignore | ||
| 0001-add-meson-buildsystem-definitions.patch | ||
| 0001-Remove-trace-statements-accidentally-committed-with-.patch | ||
| 0001-xmlrpc_server_abyss-use-va_args-properly.patch | ||
| 0002-chmod-x-xml-rpc-api2txt.patch | ||
| 0002-Use-proper-datatypes-for-long-long.patch | ||
| 0003-allow-30x-redirections.patch | ||
| 0004-Add-missing-validation-of-encoding-CVE-2022-25235.patch | ||
| 0005-lib-Prevent-more-integer-overflows-CVE-2022-22822-to.patch | ||
| 0006-Prevent-integer-overflow-on-m_groupSize-in-doProlog-.patch | ||
| 0007-Address-segfault-found-in-CVE-2023-52425.patch | ||
| 0008-Prevent-integer-overflow-or-wraparound-CVE-2024-4549.patch | ||
| 0009-Restrict-XML-Entity-Expansion-Depth-in-libexpat-CVE-.patch | ||
| 0010-Add-missing-files-for-the-benchmark-tests.patch | ||
| 0011-Fix-HTML-injection-CVE-2026-15928.patch | ||
| 0012-meson-add-html.c-to-libxmlrpc_abyss-sources.patch | ||
| sources | ||
| xmlrpc-c.spec | ||