| Message ID | cover.1794387482.git.yoann.congal@smile.fr |
|---|---|
| State | Not Applicable, archived |
| Headers | show |
On Wed Nov 11, 2026 at 10:02 AM CET, Yoann Congal wrote: > Please review this set of changes for wrynose and have comments back by > end of day Thursday, November 12. > > Passed a-full on autobuilder: > https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/5102 > * qemuarm64-musl-ptest failed with 15814 – qemuarm64 musl ptest failures > retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/109/builds/1543 > > The following changes since commit 2285da08068a6d1b4a64c9a52d85a58be50e4679: > > openssh: fix CVE-2026-123158 (aka "sshhole") (2026-11-06 17:15:59 +0100) > > are available in the Git repository at: > > https://git.openembedded.org/openembedded-core-contrib stable/wrynose-review > https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review > > for you to fetch changes up to 33a6bd6cc8a9a976902081642414bd67adc74879: > > populate_sdk_ext: Fix locale error handling in SDK (2026-11-11 00:22:27 +0100) I forgot to highlight 2 patches: * "dropbear: add follow-up patches for CVE-2019-6111" I think this is a worthy fix but it has user-visible consequences: `scp -r host:dir <existing dir>` now exits 1 instead of overwriting files (which is the vulnerability being fixed). * "python3-urllib3: Fix CVE-2026-97687" May throw a new warning in a unsecure configuration (related to TLS and proxies) that will be dropped in futur version. User code fix might be needed to avoid the warning (but the code will still work). > ---------------------------------------------------------------- > > Adrian Freihofer (1): > kernel-fit-image: add FIT_LOADABLE_* variables to do_compile vardeps > > Benjamin Robin (4): > spdx_common: simplify get_patched_src() implementation > spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src() > spdx_common: In get_patched_src() ensure kernel dir name to be ${BP} > package: no longer modify paths in save_debugsources_info() > > Bruce Ashfield (3): > linux-yocto/6.18: aufs: refresh to upstream aufs6.18 > linux-yocto/6.18: update to v6.18.57 > linux-yocto/6.18: update to v6.18.59 > > Deepak Rathore (1): > gnupg: Fix CVE-2026-105712 > > Jaipaul Cheernam (1): > bind: upgrade 9.20.29 -> 9.20.30 > > Jeroen Hofstee (1): > python3-pip: patch the vendored python3-certifi > > Jinwang Li (5): > bluez5: Fix error handling for AVDTP_OPEN cmd > bluez5: Fix GET_CONFIGURATION cmd > bluez5: Return correct error when SEP is inuse > bluez5: Fix ABORT response being discarded > bluez5: Fix u128_to_string skipping data[4] > > Peter Marko (7): > boost: patch CVE-2023-34399 > go: upgrade 1.26.9 -> 1.26.10 > glib-2.0: patch CVE-2026-16118 > python3: upgrade 3.14.9 -> 3.14.10 > systemd: add iproute2-devlink runtime dependency to udev > dropbear: add follow-up patches for CVE-2019-6111 > dropbear: patch CVE-2026-35385 > > Richard Purdie (2): > recipe_sanity: Drop rename overwrite detection > populate_sdk_ext: Fix locale error handling in SDK > > Ross Burton (4): > python3: upgrade 3.14.7 -> 3.14.9 > python3: skip test.test_readline.TestHistoryManipulation on musl > piglit: fix build with Python 3.14.9 > groff: build less in groff-native > > Shantanu Majumdar (1): > gstreamer1.0-plugins-bad: use gtk+3 dependency name > > Theo Gaige (Schneider Electric) (1): > python3-pyelftools: add missing runtime dependencies > > Yoann Congal (1): > scripts/install-buildtools: Update to 6.0.4 > > Yogita Urade (3): > python3-urllib3: Fix CVE-2026-44432 > python3-urllib3: Fix CVE-2026-97687 > python3-urllib3: Fix CVE-2026-97688 > > meta/classes-recipe/kernel-fit-image.bbclass | 14 +- > meta/classes-recipe/populate_sdk_ext.bbclass | 2 +- > meta/classes/recipe_sanity.bbclass | 21 - > meta/lib/oe/package.py | 54 +-- > meta/lib/oe/spdx30_tasks.py | 1 - > meta/lib/oe/spdx_common.py | 125 +++-- > ...1-avoid-start-failure-with-bind-user.patch | 2 +- > ...kport-ax_prog_cc_for_build.m4-macros.patch | 2 +- > ...d-V-and-start-log-hide-build-options.patch | 4 +- > ...ching-for-json-headers-searches-sysr.patch | 4 +- > .../recipes-connectivity/bind/bind/conf.patch | 2 +- > ...t.d-add-support-for-read-only-rootfs.patch | 2 +- > .../bind/make-etc-initd-bind-stop-work.patch | 2 +- > .../bind/{bind_9.20.29.bb => bind_9.20.30.bb} | 2 +- > meta/recipes-connectivity/bluez5/bluez5.inc | 5 + > ...0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch | 36 ++ > ...ix-error-handling-for-AVDTP_OPEN-cmd.patch | 48 ++ > ...turn-correct-error-when-SEP-is-inuse.patch | 32 ++ > ...x-Fix-ABORT-response-being-discarded.patch | 44 ++ > ...p-Fix-u128_to_string-skipping-data-4.patch | 33 ++ > .../dropbear/dropbear/CVE-2019-6111-01.patch | 364 ++++++++++++++ > .../dropbear/dropbear/CVE-2019-6111-02.patch | 43 ++ > .../dropbear/dropbear/CVE-2019-6111-03.patch | 34 ++ > .../dropbear/dropbear/CVE-2019-6111-04.patch | 43 ++ > .../dropbear/dropbear/CVE-2026-35385.patch | 42 ++ > .../recipes-core/dropbear/dropbear_2025.89.bb | 5 + > .../glib-2.0/files/CVE-2026-16118.patch | 48 ++ > meta/recipes-core/glib-2.0/glib.inc | 1 + > meta/recipes-core/systemd/systemd_259.5.bb | 1 + > .../go/{go-1.26.9.inc => go-1.26.10.inc} | 2 +- > ..._1.26.9.bb => go-binary-native_1.26.10.bb} | 6 +- > ...1.26.9.bb => go-cross-canadian_1.26.10.bb} | 0 > ...go-cross_1.26.9.bb => go-cross_1.26.10.bb} | 0 > ...sssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} | 0 > ...untime_1.26.9.bb => go-runtime_1.26.10.bb} | 0 > .../go/{go_1.26.9.bb => go_1.26.10.bb} | 0 > .../python3-pip/0001-Remove-emsign-437.patch | 142 ++++++ > ...tore-unaffected-emSign-roots-439-440.patch | 108 +++++ > .../python/python3-pip_26.0.1.bb | 2 + > .../python/python3-pyelftools_0.32.bb | 8 +- > .../python3-urllib3/CVE-2026-44432.patch | 157 ++++++ > .../python3-urllib3/CVE-2026-97687_p1.patch | 277 +++++++++++ > .../python3-urllib3/CVE-2026-97687_p2.patch | 450 ++++++++++++++++++ > .../CVE-2026-97688-regression.patch | 29 ++ > .../python3-urllib3/CVE-2026-97688.patch | 107 +++++ > .../python/python3-urllib3_2.6.3.bb | 5 + > ...shebang-overflow-on-python-config.py.patch | 2 +- > ...-use-prefix-value-from-build-configu.patch | 2 +- > ...-qemu-wrapper-when-gathering-profile.patch | 2 +- > ...est_sysconfig-for-posix_user-purelib.patch | 2 +- > .../python/python3/makerace.patch | 2 +- > .../{python3_3.14.7.bb => python3_3.14.10.bb} | 7 +- > .../groff/files/build-less.patch | 24 + > meta/recipes-extended/groff/groff_1.24.1.bb | 8 +- > ...-reproducible_mtime-should-be-an-int.patch | 33 ++ > meta/recipes-graphics/piglit/piglit_git.bb | 1 + > .../linux/linux-yocto-rt_6.18.bb | 6 +- > .../linux/linux-yocto-tiny_6.18.bb | 6 +- > meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +- > .../gstreamer1.0-plugins-bad_1.28.5.bb | 2 +- > .../boost/boost/CVE-2023-34399.patch | 35 ++ > meta/recipes-support/boost/boost_1.90.0.bb | 1 + > .../gnupg/CVE-2026-105712-regression.patch | 39 ++ > .../gnupg/gnupg/CVE-2026-105712.patch | 194 ++++++++ > meta/recipes-support/gnupg/gnupg_2.5.17.bb | 2 + > scripts/install-buildtools | 4 +- > 66 files changed, 2554 insertions(+), 151 deletions(-) > rename meta/recipes-connectivity/bind/{bind_9.20.29.bb => bind_9.20.30.bb} (97%) > create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch > create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch > create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch > create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch > create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch > create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch > create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch > create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch > create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch > create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch > create mode 100644 meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch > rename meta/recipes-devtools/go/{go-1.26.9.inc => go-1.26.10.inc} (90%) > rename meta/recipes-devtools/go/{go-binary-native_1.26.9.bb => go-binary-native_1.26.10.bb} (80%) > rename meta/recipes-devtools/go/{go-cross-canadian_1.26.9.bb => go-cross-canadian_1.26.10.bb} (100%) > rename meta/recipes-devtools/go/{go-cross_1.26.9.bb => go-cross_1.26.10.bb} (100%) > rename meta/recipes-devtools/go/{go-crosssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} (100%) > rename meta/recipes-devtools/go/{go-runtime_1.26.9.bb => go-runtime_1.26.10.bb} (100%) > rename meta/recipes-devtools/go/{go_1.26.9.bb => go_1.26.10.bb} (100%) > create mode 100644 meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch > create mode 100644 meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch > create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch > create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch > create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch > create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch > create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch > rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.10.bb} (98%) > create mode 100644 meta/recipes-extended/groff/files/build-less.patch > create mode 100644 meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch > create mode 100644 meta/recipes-support/boost/boost/CVE-2023-34399.patch > create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch > create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch
Please review this set of changes for wrynose and have comments back by end of day Thursday, November 12. Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/5102 * qemuarm64-musl-ptest failed with 15814 – qemuarm64 musl ptest failures retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/109/builds/1543 The following changes since commit 2285da08068a6d1b4a64c9a52d85a58be50e4679: openssh: fix CVE-2026-123158 (aka "sshhole") (2026-11-06 17:15:59 +0100) are available in the Git repository at: https://git.openembedded.org/openembedded-core-contrib stable/wrynose-review https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/wrynose-review for you to fetch changes up to 33a6bd6cc8a9a976902081642414bd67adc74879: populate_sdk_ext: Fix locale error handling in SDK (2026-11-11 00:22:27 +0100) ---------------------------------------------------------------- Adrian Freihofer (1): kernel-fit-image: add FIT_LOADABLE_* variables to do_compile vardeps Benjamin Robin (4): spdx_common: simplify get_patched_src() implementation spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src() spdx_common: In get_patched_src() ensure kernel dir name to be ${BP} package: no longer modify paths in save_debugsources_info() Bruce Ashfield (3): linux-yocto/6.18: aufs: refresh to upstream aufs6.18 linux-yocto/6.18: update to v6.18.57 linux-yocto/6.18: update to v6.18.59 Deepak Rathore (1): gnupg: Fix CVE-2026-105712 Jaipaul Cheernam (1): bind: upgrade 9.20.29 -> 9.20.30 Jeroen Hofstee (1): python3-pip: patch the vendored python3-certifi Jinwang Li (5): bluez5: Fix error handling for AVDTP_OPEN cmd bluez5: Fix GET_CONFIGURATION cmd bluez5: Return correct error when SEP is inuse bluez5: Fix ABORT response being discarded bluez5: Fix u128_to_string skipping data[4] Peter Marko (7): boost: patch CVE-2023-34399 go: upgrade 1.26.9 -> 1.26.10 glib-2.0: patch CVE-2026-16118 python3: upgrade 3.14.9 -> 3.14.10 systemd: add iproute2-devlink runtime dependency to udev dropbear: add follow-up patches for CVE-2019-6111 dropbear: patch CVE-2026-35385 Richard Purdie (2): recipe_sanity: Drop rename overwrite detection populate_sdk_ext: Fix locale error handling in SDK Ross Burton (4): python3: upgrade 3.14.7 -> 3.14.9 python3: skip test.test_readline.TestHistoryManipulation on musl piglit: fix build with Python 3.14.9 groff: build less in groff-native Shantanu Majumdar (1): gstreamer1.0-plugins-bad: use gtk+3 dependency name Theo Gaige (Schneider Electric) (1): python3-pyelftools: add missing runtime dependencies Yoann Congal (1): scripts/install-buildtools: Update to 6.0.4 Yogita Urade (3): python3-urllib3: Fix CVE-2026-44432 python3-urllib3: Fix CVE-2026-97687 python3-urllib3: Fix CVE-2026-97688 meta/classes-recipe/kernel-fit-image.bbclass | 14 +- meta/classes-recipe/populate_sdk_ext.bbclass | 2 +- meta/classes/recipe_sanity.bbclass | 21 - meta/lib/oe/package.py | 54 +-- meta/lib/oe/spdx30_tasks.py | 1 - meta/lib/oe/spdx_common.py | 125 +++-- ...1-avoid-start-failure-with-bind-user.patch | 2 +- ...kport-ax_prog_cc_for_build.m4-macros.patch | 2 +- ...d-V-and-start-log-hide-build-options.patch | 4 +- ...ching-for-json-headers-searches-sysr.patch | 4 +- .../recipes-connectivity/bind/bind/conf.patch | 2 +- ...t.d-add-support-for-read-only-rootfs.patch | 2 +- .../bind/make-etc-initd-bind-stop-work.patch | 2 +- .../bind/{bind_9.20.29.bb => bind_9.20.30.bb} | 2 +- meta/recipes-connectivity/bluez5/bluez5.inc | 5 + ...0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch | 36 ++ ...ix-error-handling-for-AVDTP_OPEN-cmd.patch | 48 ++ ...turn-correct-error-when-SEP-is-inuse.patch | 32 ++ ...x-Fix-ABORT-response-being-discarded.patch | 44 ++ ...p-Fix-u128_to_string-skipping-data-4.patch | 33 ++ .../dropbear/dropbear/CVE-2019-6111-01.patch | 364 ++++++++++++++ .../dropbear/dropbear/CVE-2019-6111-02.patch | 43 ++ .../dropbear/dropbear/CVE-2019-6111-03.patch | 34 ++ .../dropbear/dropbear/CVE-2019-6111-04.patch | 43 ++ .../dropbear/dropbear/CVE-2026-35385.patch | 42 ++ .../recipes-core/dropbear/dropbear_2025.89.bb | 5 + .../glib-2.0/files/CVE-2026-16118.patch | 48 ++ meta/recipes-core/glib-2.0/glib.inc | 1 + meta/recipes-core/systemd/systemd_259.5.bb | 1 + .../go/{go-1.26.9.inc => go-1.26.10.inc} | 2 +- ..._1.26.9.bb => go-binary-native_1.26.10.bb} | 6 +- ...1.26.9.bb => go-cross-canadian_1.26.10.bb} | 0 ...go-cross_1.26.9.bb => go-cross_1.26.10.bb} | 0 ...sssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} | 0 ...untime_1.26.9.bb => go-runtime_1.26.10.bb} | 0 .../go/{go_1.26.9.bb => go_1.26.10.bb} | 0 .../python3-pip/0001-Remove-emsign-437.patch | 142 ++++++ ...tore-unaffected-emSign-roots-439-440.patch | 108 +++++ .../python/python3-pip_26.0.1.bb | 2 + .../python/python3-pyelftools_0.32.bb | 8 +- .../python3-urllib3/CVE-2026-44432.patch | 157 ++++++ .../python3-urllib3/CVE-2026-97687_p1.patch | 277 +++++++++++ .../python3-urllib3/CVE-2026-97687_p2.patch | 450 ++++++++++++++++++ .../CVE-2026-97688-regression.patch | 29 ++ .../python3-urllib3/CVE-2026-97688.patch | 107 +++++ .../python/python3-urllib3_2.6.3.bb | 5 + ...shebang-overflow-on-python-config.py.patch | 2 +- ...-use-prefix-value-from-build-configu.patch | 2 +- ...-qemu-wrapper-when-gathering-profile.patch | 2 +- ...est_sysconfig-for-posix_user-purelib.patch | 2 +- .../python/python3/makerace.patch | 2 +- .../{python3_3.14.7.bb => python3_3.14.10.bb} | 7 +- .../groff/files/build-less.patch | 24 + meta/recipes-extended/groff/groff_1.24.1.bb | 8 +- ...-reproducible_mtime-should-be-an-int.patch | 33 ++ meta/recipes-graphics/piglit/piglit_git.bb | 1 + .../linux/linux-yocto-rt_6.18.bb | 6 +- .../linux/linux-yocto-tiny_6.18.bb | 6 +- meta/recipes-kernel/linux/linux-yocto_6.18.bb | 24 +- .../gstreamer1.0-plugins-bad_1.28.5.bb | 2 +- .../boost/boost/CVE-2023-34399.patch | 35 ++ meta/recipes-support/boost/boost_1.90.0.bb | 1 + .../gnupg/CVE-2026-105712-regression.patch | 39 ++ .../gnupg/gnupg/CVE-2026-105712.patch | 194 ++++++++ meta/recipes-support/gnupg/gnupg_2.5.17.bb | 2 + scripts/install-buildtools | 4 +- 66 files changed, 2554 insertions(+), 151 deletions(-) rename meta/recipes-connectivity/bind/{bind_9.20.29.bb => bind_9.20.30.bb} (97%) create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-GET_CONFIGURATION-cmd.patch create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Fix-error-handling-for-AVDTP_OPEN-cmd.patch create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-avdtp-Return-correct-error-when-SEP-is-inuse.patch create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-gobex-Fix-ABORT-response-being-discarded.patch create mode 100644 meta/recipes-connectivity/bluez5/bluez5/0001-obexd-pbap-Fix-u128_to_string-skipping-data-4.patch create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-01.patch create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-02.patch create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-03.patch create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2019-6111-04.patch create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2026-35385.patch create mode 100644 meta/recipes-core/glib-2.0/files/CVE-2026-16118.patch rename meta/recipes-devtools/go/{go-1.26.9.inc => go-1.26.10.inc} (90%) rename meta/recipes-devtools/go/{go-binary-native_1.26.9.bb => go-binary-native_1.26.10.bb} (80%) rename meta/recipes-devtools/go/{go-cross-canadian_1.26.9.bb => go-cross-canadian_1.26.10.bb} (100%) rename meta/recipes-devtools/go/{go-cross_1.26.9.bb => go-cross_1.26.10.bb} (100%) rename meta/recipes-devtools/go/{go-crosssdk_1.26.9.bb => go-crosssdk_1.26.10.bb} (100%) rename meta/recipes-devtools/go/{go-runtime_1.26.9.bb => go-runtime_1.26.10.bb} (100%) rename meta/recipes-devtools/go/{go_1.26.9.bb => go_1.26.10.bb} (100%) create mode 100644 meta/recipes-devtools/python/python3-pip/0001-Remove-emsign-437.patch create mode 100644 meta/recipes-devtools/python/python3-pip/0002-Restore-unaffected-emSign-roots-439-440.patch create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-44432.patch create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p1.patch create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97687_p2.patch create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688-regression.patch create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-97688.patch rename meta/recipes-devtools/python/{python3_3.14.7.bb => python3_3.14.10.bb} (98%) create mode 100644 meta/recipes-extended/groff/files/build-less.patch create mode 100644 meta/recipes-graphics/piglit/piglit/0001-tests-serializer-reproducible_mtime-should-be-an-int.patch create mode 100644 meta/recipes-support/boost/boost/CVE-2023-34399.patch create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch