[meta-webserver,wrynose,11/11] nginx: Ignore CVE-2026-60005

Message ID	20261016032056.409095-12-hthakar@cisco.com
State	New
Headers	show Return-Path: <hthakar@cisco.com> ip: 173.37.86.77, mailfrom: hthakar@cisco.com) IronPort-Data: A9a23:Ft/t66JBAPPNG1evFE+RgJQlxSXFcZb7ZxGr2PjKsXjdYENS0jVTn DcaDTzQPKnbMzTzeNpzOouw9BgFv5/TyNZiTAEd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8g2cqajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1WLVsHLbMn1t0nAHNI+ t8aBz4hVw6c0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSAVbAtQIvIROPB4towMDUY358VW62BI ZBENHw2MEuojx5nYj/7DLo+gOehhXDlWzZZs1mS46Ew5gA/ySQsi+a0bIGJJ43iqcN9olaVo WWf3GLFGQghLuWS+BmE62+Pmbqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+rfSnh0qWX9NEN 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRul7fDWkfRTkHY9sj3CMreQEXO payt4uBLVRSXHe9ExpxKp/8QeuOBBUo IronPort-HdrOrdr: A9a23:BylQBKnU3ZOkbVkby5YMujKiNAPpDfL03DAbv31ZSRFFG/FwWf rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDTYNykdsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfjLqWzLzM2fqbQ0/ Gnl7J6mwY= From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com> To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [meta-webserver][wrynose][PATCH 11/11] nginx: Ignore CVE-2026-60005 Date: Thu, 15 Oct 2026 20:20:56 -0700 Message-Id: <20261016032056.409095-12-hthakar@cisco.com> In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com> References: <20261016032056.409095-1-hthakar@cisco.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	nginx: Security fixes \| expand [meta-webserver,wrynose,00/11] nginx: Security fixes [meta-webserver,wrynose,01/11] nginx: Fix CVE-2026-40701 [meta-webserver,wrynose,02/11] nginx: fix CVE-2026-42934 [meta-webserver,wrynose,03/11] nginx: fix CVE-2026-42946 [meta-webserver,wrynose,04/11] nginx: fix CVE-2026-42945 [meta-webserver,wrynose,05/11] nginx: fix CVE-2026-9256 [meta-webserver,wrynose,06/11] nginx: fix CVE-2026-42055 [meta-webserver,wrynose,07/11] nginx: fix CVE-2026-48142 [meta-webserver,wrynose,08/11] nginx: fix CVE-2026-42533 [meta-webserver,wrynose,09/11] nginx: fix CVE-2026-56434 [meta-webserver,wrynose,10/11] nginx: Ignore CVE-2026-40460 [meta-webserver,wrynose,11/11] nginx: Ignore CVE-2026-60005

Message ID

20261016032056.409095-12-hthakar@cisco.com

State

New

Headers

IronPort-Data: A9a23:Ft/t66JBAPPNG1evFE+RgJQlxSXFcZb7ZxGr2PjKsXjdYENS0jVTn
 DcaDTzQPKnbMzTzeNpzOouw9BgFv5/TyNZiTAEd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t
 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0
 T/Oi5eHYgH8g2cqajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T
 vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/
 /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1WLVsHLbMn1t0nAHNI+
 t8aBz4hVw6c0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSAVbAtQIvIROPB4towMDUY358VW62BI
 ZBENHw2MEuojx5nYj/7DLo+gOehhXDlWzZZs1mS46Ew5gA/ySQsi+a0bIGJJ43iqcN9olaVo
 WWf3GLFGQghLuWS+BmE62+Pmbqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+rfSnh0qWX9NEN
 1dS/TIjq6U3/kGnQtTxGRqirxa5UgU0QdFcFag+rQqK0KeRul7fDWkfRTkHY9sj3CMreQEXO
 payt4uBLVRSXHe9ExpxKp/8QeuOBBUo
IronPort-HdrOrdr: A9a23:BylQBKnU3ZOkbVkby5YMujKiNAPpDfL03DAbv31ZSRFFG/FwWf
 rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5
 uIHZITNDTYNykdsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfjLqWzLzM2fqbQ0/
 Gnl7J6mwY=
From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)"
 <hthakar@cisco.com>
To: openembedded-devel@lists.openembedded.org
Cc: xe-linux-external@cisco.com
Subject: [meta-webserver][wrynose][PATCH 11/11] nginx: Ignore CVE-2026-60005
Date: Thu, 15 Oct 2026 20:20:56 -0700
Message-Id: <20261016032056.409095-12-hthakar@cisco.com>
In-Reply-To: <20261016032056.409095-1-hthakar@cisco.com>
References: <20261016032056.409095-1-hthakar@cisco.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

nginx: Security fixes | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 3:20 a.m. UTC

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2026-60005 affects the optional ngx_http_slice_module [1].
- The slice module is not built by default and requires the explicit
  --with-http_slice_module configure option, which neither Wrynose nginx
  recipe enables by default [1][2].
- Mark the CVE not applicable only when that option is absent; report it
  as unpatched when a bbappend enables the module.

Reference:
[1] https://github.com/advisories/GHSA-vxcv-h5wj-jxr5
[2] https://nginx.org/en/docs/configure.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb | 1 +
 meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb | 1 +
 2 files changed, 2 insertions(+)

diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb
index ca8e7129fb..d087ae8804 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb
@@ -24,3 +24,4 @@  SRC_URI[sha256sum] = "2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee
 CVE_STATUS[CVE-2025-53859] = "cpe-stable-backport: Fix is included in 1.28.1"
 CVE_STATUS[CVE-2026-1642] = "fixed-version: fixed since v1.28.2"
 CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}"
+CVE_STATUS[CVE-2026-60005] = "${@ 'unpatched' if '--with-http_slice_module' in ( (d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_slice_module is not enabled' }"
diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb
index 2aae2091a0..3b57994069 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb
@@ -26,3 +26,4 @@  LIC_FILES_CHKSUM = "file://LICENSE;md5=79da1c70d587d3a199af9255ad393f99"
 SRC_URI[sha256sum] = "673f8fb8c0961c44fbd9410d6161831453609b44063d3f2948253fc2b5692139"
 
 CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}"
+CVE_STATUS[CVE-2026-60005] = "${@ 'unpatched' if '--with-http_slice_module' in ( (d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_slice_module is not enabled' }"

[meta-webserver,wrynose,11/11] nginx: Ignore CVE-2026-60005

Commit Message

Patch