import libmicrohttpd-0.9.59-3.el8

SOURCES/cve-2023-27371.patch

@@ -0,0 +1,13 @@
+diff --git a/src/microhttpd/postprocessor.c b/src/microhttpd/postprocessor.c
+index 8b710ea..427d4c6 100644
+--- a/src/microhttpd/postprocessor.c
++++ b/src/microhttpd/postprocessor.c
+@@ -310,7 +310,7 @@ MHD_create_post_processor (struct MHD_Connection *connection,
+ 	return NULL; /* failed to determine boundary */
+       boundary += MHD_STATICSTR_LEN_ ("boundary=");
+       blen = strlen (boundary);
+-      if ( (blen == 0) ||
++      if ( (blen < 2) ||
+            (blen * 2 + 2 > buffer_size) )
+         return NULL;            /* (will be) out of memory or invalid boundary */
+       if ( (boundary[0] == '"') &&

SPECS/libmicrohttpd.spec

@@ -1,12 +1,13 @@
 Name:           libmicrohttpd
 Version:        0.9.59
-Release:        2%{?dist}
+Release:        3%{?dist}
 Epoch:          1
 Summary:        Lightweight library for embedding a webserver in applications
 License:        LGPLv2+
 URL:            http://www.gnu.org/software/libmicrohttpd/
 Source0:        https://ftp.gnu.org/gnu/libmicrohttpd/%{name}-%{version}.tar.gz
 Patch0:         gnutls-utilize-system-crypto-policy.patch
+Patch1:         cve-2023-27371.patch
 
 BuildRequires:  autoconf, automake, libtool, gettext-devel
 BuildRequires:  texinfo
@@ -111,9 +112,14 @@ fi
 %doc html
 
 %changelog
-* Wed Jul 26 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 1:0.9.59-2
+* Wed Jul 26 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 1:0.9.59-3
 - Rebuilt for MSVSphere 8.8
 
+* Thu Apr 06 2023 Pavel Šimovec <psimovec@redhat.com> - 1:0.9.59-3
+- Add cve-2023-27371.patch
+  Related: rhbz#2174639
+  CVE-2023-27371
+
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.9.59-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild