Vulnerability to CVE-2018-12684

[CharlyReux]

Hi, great project!

As part of a research experiment, we developed a tool that allows us to crawl through existing vulnerabilities in upstream projects, that are potentially not fixed in fork.
We have a suspicion that your repository, which shares commits withhttps://github.com/civetweb/civetweb is still vulnerable to CVE-2018-12684

The vulnerability has been fixed upstream via this commit civetweb/civetweb@8fd069f

However, we could not find the patch applied in this repository

libhttp/src/httplib_ssi.c

Line 205 in cec0e67

if ( ! memcmp( buf + 5, "include", 7 ) ) {

If possible, we would like to know whether it is indeed vulnerable to the vulnerability we described.

Your insight would be very valuable for our experiment.
Do not hesitate to contact us if you want more information.
Thanks again.

[lammertb]

Thanks for bringing this up.
The source file indeed contains the unpatched code.
I will apply the patch mentioned in CVE-2018-12684