From patchwork Sat Nov 7 06:25:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 103341 Received: from a27-191.smtp-out.us-west-2.amazonses.com (a27-191.smtp-out.us-west-2.amazonses.com [54.240.27.191]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.4630.1794032731697870095 for ; Fri, 06 Nov 2026 22:25:31 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=DZnIAifJ; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=Uk9Kuv7z; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.191, mailfrom: 010101a1b4af025b-c783e036-e85b-445d-8726-e0639cc77b6a-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1794032730; h=Content-Type:MIME-Version:From:To:Subject:Message-Id:Date; bh=lUbpdLDAhz4NZk3xFOHQPZgSouVWrtUNo1IpOmHFF9s=; b=DZnIAifJaXPgHTU/6DENuq87myvzENj5kVwQVZjyDRvbLwWnRcI20TWvcaGgdauB DB1zNIbUQRMzbZX99gQLcHvZ6PJ4uvWvERXV0cCcLSaKH/qohjr2nfr1AnWCprEUoAX avHKOHROK7SdZOtmyWcEzoWvmnG7eJwfSbsVK6/c= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1794032730; h=Content-Type:MIME-Version:From:To:Subject:Message-Id:Date:Feedback-ID; bh=lUbpdLDAhz4NZk3xFOHQPZgSouVWrtUNo1IpOmHFF9s=; b=Uk9Kuv7zI+tKAMNCxxuE5KSLdRWtbgYR6vEtIrnmHogafv9ccH7g9/G3bRvdt+eK R+opZxVl4/4CNcxbqt7TMY0cggKszolsA5kRTb48TwK8MdI1BU4rwE7NUDYsJ1P+TI3 A5cIKM8W54U6GSDMg3CcjhMrCAO3pRZsWdEnERJw= MIME-Version: 1.0 From: auh@yoctoproject.org To: openembedded-core@lists.openembedded.org Subject: [AUH] libmodulemd: upgrading to 2.15.4 SUCCEEDED Message-ID: <010101a1b4af025b-c783e036-e85b-445d-8726-e0639cc77b6a-000000@us-west-2.amazonses.com> Date: Sat, 7 Nov 2026 06:25:30 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.11.07-54.240.27.191 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Sat, 07 Nov 2026 06:25:41 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249725 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *libmodulemd* to *2.15.4* has Succeeded. Next steps: - apply the patch: git am 0001-libmodulemd-upgrade-2.15.3-2.15.4.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From c70950dedf2f33c14778e314fcc71910f00c5fc1 Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Sat, 7 Nov 2026 05:29:19 +0000 Subject: [PATCH] libmodulemd: upgrade 2.15.3 -> 2.15.4 2.15.4 2026-11-06 Possibly incompatible fixes: - Compressed YAML files which decompress to much are rejected (CVE-2026-92823). If libmodulemd is built with "rpmio" feature, modulemd_module_index_update_from_file() decompresses compressed input files. Small compressed files can decompress to very large data. Then processing the large data consumes unexpectedly large amount of memory. This amplification of use of resources can be interpreted as a denial of service. To avoid it, a limit for decompressed data was imposed. The limit is a maximum of 64 MiB and 64 times the compressed size of the input file. When the limit is reached, a Glib warning is emitted and modulemd_module_index_update_from_file() returns FALSE. This flaw was added with aad63a59ca02be2cc7afb6e6c8a0c3bd5a036dd6 commit ("Add helpers for reading compressed files") and first released in 2.8.0 version. - Introduce a recursion limit for YAML documents (CVE-2026-92822). Parsing a modulemd document with "xmd" YAML tree with enormously nested nodes may exhaust all heap or stack memory when duplicating subdocuments in modulemd_yaml_parse_document_type_internal(). This is fixed by adding a "recursion_limit" build-time option defining a maximal depth of acceptable YAML documents. Default is 64. This flaw was confirmed in current 2.15.3 version and back to 1.4.0 version. Earlier versions might be affected as well. Other fixes: - Iterating over checksums in modulemd_module_stream_v2_emit_rpm_map() was fixed (CVE-2026-92824). When serializing a module index into a YAML string where a number of hash types was different from a number of hashes of a particular type in "rpm-map" modulemd-v2 YAML element, not all hashes were serialized or an invalid memory was read. This flaw was introduced with b5abf3bbedd211a403122fccfec192581e2bbe8f commit ("Add rpm-map to ModuleStreamV2") and first released in 2.2.0 version. - Harden modulemd_module_add_translation() against null-pointer dereferences. - Harden modulemd_module_add_obsoletes() against null-pointer dereferences. --- .../{libmodulemd_2.15.3.bb => libmodulemd_2.15.4.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-devtools/libmodulemd/{libmodulemd_2.15.3.bb => libmodulemd_2.15.4.bb} (94%) diff --git a/meta/recipes-devtools/libmodulemd/libmodulemd_2.15.3.bb b/meta/recipes-devtools/libmodulemd/libmodulemd_2.15.4.bb similarity index 94% rename from meta/recipes-devtools/libmodulemd/libmodulemd_2.15.3.bb rename to meta/recipes-devtools/libmodulemd/libmodulemd_2.15.4.bb index 4627e53428..52558707b5 100644 --- a/meta/recipes-devtools/libmodulemd/libmodulemd_2.15.3.bb +++ b/meta/recipes-devtools/libmodulemd/libmodulemd_2.15.4.bb @@ -6,7 +6,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=25a3927bff3ee4f5b21bcb0ed3fcd6bb" SRC_URI = "git://github.com/fedora-modularity/libmodulemd;protocol=https;branch=main;tag=${PV}" -SRCREV = "a8f1c5b1243a8e844a276094007a2bbf8a13b40f" +SRCREV = "2f75d47da15a4e4847c3deeb3101b58ad67a0723" inherit meson gobject-introspection pkgconfig manpages