[21.02] cyrus-sasl: patch CVE-2019-19906

[paper42]

Maintainer: @flyn-org
Compile tested: aarch64, Turris MOX, OpenWrt 21.02

Description: https://nvd.nist.gov/vuln/detail/CVE-2019-19906

[flyn-org]

Looks good. Recommend merge.

The fix is tracked upstream, but cyrus-sasl has been slow in the past to make new releases. I recommend moving forward with the local patch.

[PolynomialDivision]

I don't understand why adding this fix only to 21.02? If master is also affected, please do it against master, I will merge it and backport using git cherry-pick -x ...?

[paper42]

I don't understand why adding this fix only to 21.02? If master is also affected, please do it against master, I will merge it and backport using git cherry-pick -x ...?

@PolynomialDivision I submitted the same PR for master - #17112 and 19.07 - #17114, if cherry pick -x is preferred, could you close these two PRs, merge the one targeting master and cherry pick to both stable branches? Thanks.

[PolynomialDivision]

I don't understand why adding this fix only to 21.02? If master is also affected, please do it against master, I will merge it and backport using git cherry-pick -x ...?

@PolynomialDivision I submitted the same PR for master - #17112 and 19.07 - #17114, if cherry pick -x is preferred, could you close these two PRs, merge the one targeting master and cherry pick to both stable branches? Thanks.

Did not see them. Yeah we use cherry-pick -x f7717bd382d4f03c6353beaaf198d29a34c8e6ab. Can you just update both remaining PRs?

[paper42]

Yeah we use cherry-pick -x f7717bd382d4f03c6353beaaf198d29a34c8e6ab. Can you just update both remaining PRs?

sure, done