e8cf6198b3
Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data. https://lists.nongnu.org/archive/html/lynx-dev/2021-08/msg00002.html Upstream unfortunately does not provide a public VCS (only source snapshots), so fetch the security patch from Debian. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> (cherry picked from commit 5bb9d79f276551c8fb7a774d8c7bd0f47a9e9809) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>