| Message ID | 20261105115526.634289-2-leon.anavi@konsulko.com |
|---|---|
| State | New |
| Headers | show |
| Series | [meta-python,01/19] python3-apispec: Upgrade 6.10.0 -> 6.10.1 | expand |
diff --git a/meta-python/recipes-devtools/python/python3-autobahn/0001-Skip-march-guessing-for-external-cross-toolchains.patch b/meta-python/recipes-devtools/python/python3-autobahn/0001-Skip-march-guessing-for-external-cross-toolchains.patch index 7573b1f5a6..a5e1b0928b 100644 --- a/meta-python/recipes-devtools/python/python3-autobahn/0001-Skip-march-guessing-for-external-cross-toolchains.patch +++ b/meta-python/recipes-devtools/python/python3-autobahn/0001-Skip-march-guessing-for-external-cross-toolchains.patch @@ -1,4 +1,4 @@ -From bfcf66157dab06a8f4f718cc0016e799f6b9e284 Mon Sep 17 00:00:00 2001 +From 77c79aa0e048e4bea40eb794a623c36ff1ec3fbc Mon Sep 17 00:00:00 2001 From: Leon Anavi <leon.anavi@konsulko.com> Date: Mon, 20 Jul 2026 15:52:32 +0300 Subject: [PATCH] Skip -march guessing for external cross toolchains diff --git a/meta-python/recipes-devtools/python/python3-autobahn_26.10.2.bb b/meta-python/recipes-devtools/python/python3-autobahn_26.11.1.bb similarity index 87% rename from meta-python/recipes-devtools/python/python3-autobahn_26.10.2.bb rename to meta-python/recipes-devtools/python/python3-autobahn_26.11.1.bb index 03ea85111f..681f46e5b2 100644 --- a/meta-python/recipes-devtools/python/python3-autobahn_26.10.2.bb +++ b/meta-python/recipes-devtools/python/python3-autobahn_26.11.1.bb @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=49165a577911c4178e915dc26e2802a3" SRC_URI += "file://0001-Skip-march-guessing-for-external-cross-toolchains.patch" -SRC_URI[sha256sum] = "6c69fca89106567060941c5568e67a5369738813d883db4e3d62b76f0a2c497e" +SRC_URI[sha256sum] = "1a081ca27ad5a0a04d3c7ca07b2caa6d324b8004383e36ae6eede1d5053e23b0" CVE_PRODUCT = "autobahn"
Upgrade to release 26.11.1: - Security: parse the HTTP headers of the WebSocket opening handshake strictly (RFC 9112, RFC 9110). The header block was split with str.splitlines(), which also splits on VT, FF, FS, GS, RS, NEL and on a bare CR or LF, so a peer could make autobahn see header lines that a front proxy treats as part of a header value, for example an X-Forwarded-For used with trustXForwardedFor. Lines are now separated by CRLF only. ⚠ behaviour change — a header block with a bare CR or LF, obs-fold, whitespace before the colon, an invalid header name, a header line without a colon (was skipped), or a control character in a header value or the status line is rejected: the server fails the handshake with HTTP 400, the client fails the handshake or the proxy CONNECT. A bare LF is rejected deliberately, although RFC 9112 allows accepting it as a line end. obs-text (0x80-0xFF) in header values is still allowed, and header values are trimmed of SP and HTAB only. This fixes advisory GHSA-2gqc-mwv3-66rp - Security: raise the floors of the compress extra (and so all) to brotli>=1.2.1 (CPython) and brotlicffi>=1.2.1.0 (PyPy), the releases with the fix for CVE-2026-111497, an out-of-bounds write in the brotli decoder that permits remote code execution. permessage-brotli decodes data sent by the WebSocket peer; it is not used unless an application offers or accepts it. The brotli 1.0.10 and 1.1.1 backports of the fix are not enough, since the permessage-brotli receive path needs the decompression limit of brotli 1.2. New tests check the declared floors and the installed version - Add tests for the HTTP header parsing of the WebSocket opening handshake, on the server, the client and the explicit proxy CONNECT, run on Twisted and asyncio Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> --- ...0001-Skip-march-guessing-for-external-cross-toolchains.patch | 2 +- ...{python3-autobahn_26.10.2.bb => python3-autobahn_26.11.1.bb} | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename meta-python/recipes-devtools/python/{python3-autobahn_26.10.2.bb => python3-autobahn_26.11.1.bb} (87%)