mbox series

[meta-python,scarthgap,0/9] python3-aiohttp: fix multiple CVEs

Message ID 20260831045744.3321483-1-dkelaiya@cisco.com
Headers show
Series python3-aiohttp: fix multiple CVEs | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Aug. 31, 2026, 4:57 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Backport nine upstream aiohttp security fixes to the 3.9.5 recipe on
scarthgap.

The corresponding fixes are available in aiohttp 3.14.0 and 3.14.1.
Carry them as focused backports instead of upgrading the recipe because
the 3.14 release also introduces new APIs, deprecations, and
backward-incompatible behavior outside the security scope.

The individual commits retain the upstream fix provenance and public
advisory references for each CVE.

Testing:
- Applied the nine layer commits to the upstream scarthgap baseline.
- Applied all nine embedded patches to aiohttp 3.9.5 in series order
  with no conflicts or fuzz.
- Package build and image build validation completed successfully.

Darsh Kelaiya (9):
 python3-aiohttp: fix CVE-2025-69224
 python3-aiohttp: fix CVE-2025-69227
 python3-aiohttp: fix CVE-2025-69229
 python3-aiohttp: fix CVE-2025-69223
 python3-aiohttp: fix CVE-2026-22815
 python3-aiohttp: fix CVE-2026-34514
 python3-aiohttp: fix CVE-2026-34513
 python3-aiohttp: fix CVE-2026-34993
 python3-aiohttp: fix CVE-2026-34518

 .../python3-aiohttp/CVE-2025-69224.patch      |  161 +
 .../python3-aiohttp/CVE-2025-69227.patch      |  163 +
 .../python3-aiohttp/CVE-2025-69229_p1.patch   |  113 +
 .../python3-aiohttp/CVE-2025-69229_p2.patch   |  256 +
 .../python3-aiohttp/CVE-2025-69223.patch      |  848 +
 .../python3-aiohttp/CVE-2026-22815.patch      | 1020 +
 .../python3-aiohttp/CVE-2026-34514.patch      |   65 +
 .../python3-aiohttp/CVE-2026-34513.patch      |  211 +
 .../python3-aiohttp/CVE-2026-34993.patch      |  364 +
 .../python3-aiohttp/CVE-2026-34518.patch      |   64 +
 .../python/python3-aiohttp_3.9.5.bb           |   19 +
 11 files changed, 3284 insertions(+)
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2025-69224.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2025-69227.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2025-69229_p1.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2025-69229_p2.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2025-69223.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-22815.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-34514.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-34513.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-34993.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-34518.patch