[meta-networking,6/8] wolfssl: mark fixed CVEs as patched

Message ID	20260420093323.357053-6-skandigraun@gmail.com
State	Accepted
Headers	show Return-Path: <skandigraun@gmail.com> ip: 209.85.128.42, mailfrom: skandigraun@gmail.com) From: Gyorgy Sarvari <skandigraun@gmail.com> To: openembedded-devel@lists.openembedded.org Subject: [meta-networking][PATCH 6/8] wolfssl: mark fixed CVEs as patched Date: Mon, 20 Apr 2026 11:33:21 +0200 Message-ID: <20260420093323.357053-6-skandigraun@gmail.com> In-Reply-To: <20260420093323.357053-1-skandigraun@gmail.com> References: <20260420093323.357053-1-skandigraun@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[meta-networking,1/8] ngtcp2: upgrade 1.22.0 -> 1.22.1 \| expand [meta-networking,1/8] ngtcp2: upgrade 1.22.0 -> 1.22.1 [meta-oe,2/8] openjpeg: patch CVE-2026-6192 [meta-oe,3/8] protobuf, python3-protobuf: ignore CVE-2026-6409 [meta-python,4/8] python3-grpcio: ignore CVE-2026-33186 [meta-python,5/8] python3-pillow: upgrade 12.1.1 -> 12.2.0 [meta-networking,6/8] wolfssl: mark fixed CVEs as patched [meta-oe,7/8] xdg-desktop-portal: upgrade 1.20.3 -> 1.20.4 [meta-oe,8/8] xrdp: upgrade 0.10.5 -> 0.10.6

Message ID

20260420093323.357053-6-skandigraun@gmail.com

State

Accepted

Headers

From: Gyorgy Sarvari <skandigraun@gmail.com>
To: openembedded-devel@lists.openembedded.org
Subject: [meta-networking][PATCH 6/8] wolfssl: mark fixed CVEs as patched
Date: Mon, 20 Apr 2026 11:33:21 +0200
Message-ID: <20260420093323.357053-6-skandigraun@gmail.com>
In-Reply-To: <20260420093323.357053-1-skandigraun@gmail.com>
References: <20260420093323.357053-1-skandigraun@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[meta-networking,1/8] ngtcp2: upgrade 1.22.0 -> 1.22.1 | expand

Commit Message

Gyorgy Sarvari April 20, 2026, 9:33 a.m. UTC

Details:  https://nvd.nist.gov/vuln/detail/CVE-2026-5188
https://nvd.nist.gov/vuln/detail/CVE-2026-5392
https://nvd.nist.gov/vuln/detail/CVE-2026-5393
https://nvd.nist.gov/vuln/detail/CVE-2026-5447
https://nvd.nist.gov/vuln/detail/CVE-2026-5448
https://nvd.nist.gov/vuln/detail/CVE-2026-5460
https://nvd.nist.gov/vuln/detail/CVE-2026-5466
https://nvd.nist.gov/vuln/detail/CVE-2026-5479
https://nvd.nist.gov/vuln/detail/CVE-2026-5500

All of these CVEs are fixed in the current recipe version, however
NVD tracks them without version. Each NVD advisory references the
corresponding fix, and each of them are contained in 5.9.1.

Mark all of them as patched explicitly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 .../recipes-connectivity/wolfssl/wolfssl_5.9.1.bb        | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
index 22ab04a02c..2978ff1cc1 100644
--- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
+++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.1.bb
@@ -51,10 +51,19 @@  CVE_STATUS[CVE-2026-0819] = "fixed-version: fixed in 5.9.0"
 CVE_STATUS[CVE-2026-2646] = "fixed-version: fixed in 5.9.0"
 CVE_STATUS[CVE-2026-3503] = "fixed-version: fixed in 5.9.0"
 CVE_STATUS[CVE-2026-3548] = "fixed-version: fixed in 5.9.0"
+CVE_STATUS[CVE-2026-5188] = "fixed-version: fixed in 5.9.1"
 CVE_STATUS[CVE-2026-5194] = "fixed-version: fixed in 5.9.1"
 CVE_STATUS[CVE-2026-5263] = "fixed-version: fixed in 5.9.1"
 CVE_STATUS[CVE-2026-5264] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5392] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5393] = "fixed-version: fixed in 5.9.1"
 CVE_STATUS[CVE-2026-5446] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5447] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5448] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5460] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5466] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5479] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2026-5500] = "fixed-version: fixed in 5.9.1"
 CVE_STATUS[CVE-2026-5503] = "fixed-version: fixed in 5.9.1"
 CVE_STATUS[CVE-2026-5504] = "fixed-version: fixed in 5.9.1"
 CVE_STATUS[CVE-2026-5507] = "fixed-version: fixed in 5.9.1"

[meta-networking,6/8] wolfssl: mark fixed CVEs as patched

Commit Message

Patch