From patchwork Wed Dec 24 07:49:27 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 77381 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D51ACE74AE1 for ; Wed, 24 Dec 2025 07:49:39 +0000 (UTC) Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.116514.1766562579389527649 for ; Tue, 23 Dec 2025 23:49:39 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20230601 header.b=NmMx4p0e; spf=pass (domain: gmail.com, ip: 209.85.210.173, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-7bc248dc16aso4696856b3a.0 for ; Tue, 23 Dec 2025 23:49:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766562579; x=1767167379; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=g7et1Aksk0iudhrrGVg2qTrzupBbTieJznCGdw23jnA=; b=NmMx4p0e7/WIebQ62kz1BJqJUDt/sx0G/yII4+mnUN2nse3bntow/sq0fLHN76YAuG Xka/aYgo7ZIDVdAxAmMXpZhDTCNNRCiFvQ/v6rV2jDVBsR7s5EGN6CIDDWRO93SVfnAh Hmu3n/hhqtvrRy5WnIyMvLKuex2Os9sUqM13/vgh7Gjvv/26BC6Lgn1qZmc0U2/vHayW XPEpw97xg86UQCn99+R0lFu+R/aOCw63dOA1EMOMivQooePFAkHFh4OJv4pX9JEGBt9F UYlJ0iNisWVnncVuQVcEng//OfLLRe/3ZF3vwYmN1jeWhvHP6eT+U3yBIK+hMMI3O6Kl 5+vQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766562579; x=1767167379; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=g7et1Aksk0iudhrrGVg2qTrzupBbTieJznCGdw23jnA=; b=Zx6dUYHhzmGGX7xs4vxK+AgL/BoU7VhQ18ryufBAhLFQcBdEx9yf89B91mnQfzHXVs bx561/mfSoSzqFc18cYU5wpLwyErDOEXJRuONf4QwlYFrMbBQH1l0Tmg7HCGNoq8sHLW sNxWcDE43uQ1K8g7RRlvKtyUdHLw5YIGJjAnr9l6bpKz6NJI3/FNX5fMissZD6BMshUw UBEttsNsjR9rd7E63i1K3yJB1WaC9Jv7Lx1KbbOfaqk9nnQmHQBEW8fnHlAc6UF1T5Ds 4QL4Utl0juitns2zjLavvAUmlcnwbP3YnR9vBT7cI6G70SfHiXrY53JmLL0inLiH+AVn fJdQ== X-Gm-Message-State: AOJu0YwENdKWZtBa1TyN8h3x5/ui55zz4PVfM8NNe0qgvD91SkQ/f10U 01PgxytHOGV08Vpe22hRSnCdlHNmAaNFN8yJHMol/luASda5m0KHaMJ9D0uYSQ== X-Gm-Gg: AY/fxX4E341UnkwvuMDsJYhB53/kXDHKG68npkfEf4heuHzMUItdgDb8/J/neWlFORK Sm2NfABN3/7/2F4n8WgI6cQxv+/SBD+TAnsctONWx5Ldc7Vyn3liqx7Pthesb3wmWwIN9NRVUkW UG2TAmRITIY20TDuQ8FPO596aUJdbijkPbctFnjaXCFmOuU+RJlhVOFTRYIA8/vjqmHHTnlktad gbDTTrBcUpWMCal3bTNItpl2m+3M/PnLCi/sM8csipvcgMBuecVhvzFdmhNpj+B3fRY6PI0/pvp pPWusg+JFgRgWF0DXO5PRBH9jB1NKnpho0PcjQYVaZsZep868NgFbC2c41o/v4SpwMziiOeD/h0 N5O9YBpbrx0Qds9zwn4GbhkKqFyjDQKMka2073ykhdMVKXvPvLLf3ATYP3m8VPwj0cSiz4L4oKk Djj8r0xlcy9qcpyBuzyF712hdZ X-Google-Smtp-Source: AGHT+IGqOxg/1fhPINj3rTelWZOjfU7teUmMdVIAeWcS3S6xWPIyOK/ledcRhzuLTeHYrLGH3Wu5fQ== X-Received: by 2002:a05:6a20:939e:b0:366:14b2:310 with SMTP id adf61e73a8af0-376aa0eda7fmr14977823637.67.1766562578443; Tue, 23 Dec 2025 23:49:38 -0800 (PST) Received: from NVAPF55DW0D-IPD.. ([165.225.124.226]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c1e7ca0b587sm13847084a12.33.2025.12.23.23.49.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Dec 2025 23:49:38 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][scarthgap][PATCH 1/6] dovecot: upgrade 2.3.21 -> 2.3.21.1 Date: Wed, 24 Dec 2025 13:19:27 +0530 Message-ID: <20251224074932.1379914-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 24 Dec 2025 07:49:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/122845 From: Ankur Tyagi Release Notes: - CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage. - CVE-2024-23185: Abnormally large email headers are now truncated or discarded, with a limit of 10MB on a single header and 50MB for all the headers of all the parts of an email. - oauth2: Dovecot would send client_id and client_secret as POST parameters to introspection server. These need to be optionally in Basic auth instead as required by OIDC specification. - oauth2: JWT key type check was too strict. - oauth2: JWT token audience was not validated against client_id as required by OIDC specification. - oauth2: XOAUTH2 and OAUTHBEARER mechanisms were not giving out protocol specific error message on all errors. This broke OIDC discovery. - oauth2: JWT aud validation was not performed if aud was missing from token, but was configured on Dovecot. Signed-off-by: Ankur Tyagi --- .../dovecot/{dovecot_2.3.21.bb => dovecot_2.3.21.1.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-networking/recipes-support/dovecot/{dovecot_2.3.21.bb => dovecot_2.3.21.1.bb} (97%) diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.3.21.bb b/meta-networking/recipes-support/dovecot/dovecot_2.3.21.1.bb similarity index 97% rename from meta-networking/recipes-support/dovecot/dovecot_2.3.21.bb rename to meta-networking/recipes-support/dovecot/dovecot_2.3.21.1.bb index c626f26457..48e1e8a832 100644 --- a/meta-networking/recipes-support/dovecot/dovecot_2.3.21.bb +++ b/meta-networking/recipes-support/dovecot/dovecot_2.3.21.1.bb @@ -13,7 +13,7 @@ SRC_URI = "http://dovecot.org/releases/2.3/dovecot-${PV}.tar.gz \ file://0001-m4-Check-for-libunwind-instead-of-libunwind-generic.patch \ file://0001-auth-Fix-handling-passdbs-with-identical-driver-args.patch \ " -SRC_URI[sha256sum] = "05b11093a71c237c2ef309ad587510721cc93bbee6828251549fc1586c36502d" +SRC_URI[sha256sum] = "2d90a178c4297611088bf7daae5492a3bc3d5ab6328c3a032eb425d2c249097e" DEPENDS = "openssl xz zlib bzip2 libcap icu libtirpc bison-native" CFLAGS += "-I${STAGING_INCDIR}/tirpc" From patchwork Wed Dec 24 07:49:28 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 77385 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9BB3E75422 for ; Wed, 24 Dec 2025 07:49:49 +0000 (UTC) Received: from mail-pf1-f179.google.com (mail-pf1-f179.google.com [209.85.210.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.116907.1766562586163041634 for ; Tue, 23 Dec 2025 23:49:46 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20230601 header.b=KoS4XsIf; spf=pass (domain: gmail.com, ip: 209.85.210.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f179.google.com with SMTP id d2e1a72fcca58-7bab7c997eeso6558029b3a.0 for ; Tue, 23 Dec 2025 23:49:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766562585; x=1767167385; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=J1LMekRdgFt35f0VGNsYV6+wEusolRNj5VHPTWGAy94=; b=KoS4XsIfwC3DGnbiV/Q7Bqg1FL0bUlMMXRiWiRmllxQgsg7/M4wFRbeEhpQd3X4Xpk KHhASVCI9F/hu6b3OnfuJ6+y+qfWM8Q8kaN7WRvYBRcNA6tZdy7UlcEGh55v+3ecibpP G3uXOwMDBDIicAE+AsrEAsvkUt+I5kQj89Bj5nAYPQpjzK6yreV5rchUHp1/N3iXE2UF ZTJSfytPCaLf4jADMmhysGWQMsIbW5XMZcvv8X9E393hHwLOJU3fbgiGrERyhEiuPZkC pkT2UEO9i7/yBRf/nHKaDRNtH8XJ2shMO0wz5GZiOuNNqNuChUaZpSuP1JnBuWxvXuX+ 6ihg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766562585; x=1767167385; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=J1LMekRdgFt35f0VGNsYV6+wEusolRNj5VHPTWGAy94=; b=RNayNKfcPSP4uiL3QV0rY9MGPwXy2gcGiMjgZ4lnctDzEbpVl+eF1Xl0dlu/Ac3sSL 3wPoP+wtIZ7TNwFcxMeslopsYPnPmaJzNI3q85aGzjHhsKZj6voYyNYCq0cqfNJV1gfw 7qOm0RigVVs+JRnMTuIYw902WDITsQdOkv0WVosJSUUGC0Y0uKp6+DVUjNYccPyFS3ZX D1AvY4J3fb1YD+5I90ZKbYwgrdYODOxiw4ogsj9+ODI5e6mac8QdnkeKDWvq448s9CyU yHJFwJ2aqMc7zaa2dbUmP/XqmenArD8vx90/SxilI4lld1rcmoxL8jYLneSq66sXL0jn kLFA== X-Gm-Message-State: AOJu0YwyeWJ4YSzNXnb+Xe4YzSz00ZxP7H0EqJGeu2SHGrYKf1GqqO4R IpjqOGJadIGM2IvfpoRRJm1jyjeoS6nnI/yjAiZDIsxSbQgU8vl+2Zc9xnUFzA== X-Gm-Gg: AY/fxX5YSY0M8aDlk3RYEj0fG5xSy0O07a+/55Tj0D7MJ1dHRPBun7uQsE54kvbf7+b YZIoq69ZKbODrtfJhUGMRQgPs07VUcc+Xuo7DV1Iw3TMIsML/WoQg0Lz3HMj0zxIOh6KLZyPA0E U5zuK+TUxyCcNoJSNI6BiP1Nef7lp98vLQANy+9wLEvdBI0QiZWblcKk/OY2NuVWlenDzvXVhaV JgBTkteI0lKBnjOMd1b5lBetfL7ftfj0Uk19Tnzzp5/rAbCNw5Jw9dSD4znBt72Bb6DZbnPB1ZF wu6a/twSHVxPaM7CjqWXVGWqyVxMJ9xDRuD0i5vU7VuP8zJLKtUc0IvzP0YkWVYg1i7e8pDuftd KDQAFBDIUdD1WWKxDNbm1e/ZOk20P+po6lMjnsSIIdevAtS0zc3t+kPKiPbA80EqzghUSl6mO8s r6zabeiAQOHvo10/X185WnwmSQ X-Google-Smtp-Source: AGHT+IFu2Da4XUEPNk3fHSdYMK34US43+BTlvpcxhV92rAc5ZlkGHQYBAAXB/+CtDudRtVakL+vO2w== X-Received: by 2002:a05:6a20:244d:b0:366:1e11:11e6 with SMTP id adf61e73a8af0-376a88c865dmr16728228637.4.1766562580636; Tue, 23 Dec 2025 23:49:40 -0800 (PST) Received: from NVAPF55DW0D-IPD.. ([165.225.124.226]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c1e7ca0b587sm13847084a12.33.2025.12.23.23.49.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Dec 2025 23:49:40 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][scarthgap][PATCH 2/6] libiec61850: patch CVE-2024-45969 Date: Wed, 24 Dec 2025 13:19:28 +0530 Message-ID: <20251224074932.1379914-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251224074932.1379914-1-ankur.tyagi85@gmail.com> References: <20251224074932.1379914-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 24 Dec 2025 07:49:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/122847 From: Ankur Tyagi Details https://nvd.nist.gov/vuln/detail/CVE-2024-45969 Signed-off-by: Ankur Tyagi --- .../libiec61850/files/CVE-2024-45969.patch | 32 +++++++++++++++++++ .../libiec61850/libiec61850_1.5.3.bb | 1 + 2 files changed, 33 insertions(+) create mode 100644 meta-networking/recipes-connectivity/libiec61850/files/CVE-2024-45969.patch diff --git a/meta-networking/recipes-connectivity/libiec61850/files/CVE-2024-45969.patch b/meta-networking/recipes-connectivity/libiec61850/files/CVE-2024-45969.patch new file mode 100644 index 0000000000..99caab9cf1 --- /dev/null +++ b/meta-networking/recipes-connectivity/libiec61850/files/CVE-2024-45969.patch @@ -0,0 +1,32 @@ +From 9dfac54daace18d3d3b0ef09d8beecc562e29c1d Mon Sep 17 00:00:00 2001 +From: Michael Zillgith +Date: Wed, 27 Mar 2024 12:26:58 +0000 +Subject: [PATCH] - ACSE: added check for minimum message size (LIB61850-438) + +CVE: CVE-2024-45969 +Upstream-Status: Backport [https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33] +(cherry picked from commit 7afa40390b26ad1f4cf93deaa0052fe7e357ef33) +Signed-off-by: Ankur Tyagi +--- + src/mms/iso_acse/acse.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/src/mms/iso_acse/acse.c b/src/mms/iso_acse/acse.c +index f46b024d..40ecafe0 100644 +--- a/src/mms/iso_acse/acse.c ++++ b/src/mms/iso_acse/acse.c +@@ -420,6 +420,14 @@ AcseConnection_parseMessage(AcseConnection* self, ByteBuffer* message) + { + AcseIndication indication = ACSE_ERROR; + ++ if (message == NULL || message->size < 1) ++ { ++ if (DEBUG_ACSE) ++ printf("ACSE: invalid message - no payload\n"); ++ ++ return ACSE_ERROR; ++ } ++ + uint8_t* buffer = message->buffer; + + int messageSize = message->size; diff --git a/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.5.3.bb b/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.5.3.bb index 20dd447c7e..ea8c16e3dc 100644 --- a/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.5.3.bb +++ b/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.5.3.bb @@ -21,6 +21,7 @@ SRC_URI = "git://github.com/mz-automation/${BPN}.git;branch=v1.5;protocol=https file://CVE-2024-26529.patch \ file://CVE-2024-45970.patch \ file://CVE-2024-45971.patch \ + file://CVE-2024-45969.patch \ " S = "${WORKDIR}/git" From patchwork Wed Dec 24 07:49:29 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 77382 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC7F5E7491E for ; Wed, 24 Dec 2025 07:49:49 +0000 (UTC) Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.116515.1766562584211209027 for ; Tue, 23 Dec 2025 23:49:44 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20230601 header.b=Setpa2f4; spf=pass (domain: gmail.com, ip: 209.85.210.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-7b8e49d8b35so7059104b3a.3 for ; Tue, 23 Dec 2025 23:49:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766562583; x=1767167383; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=g+cCn7Eg628Z73NWX24oNSUCwZxTqR/Aa4W4wePMh+s=; b=Setpa2f4MJ03nim5hZEWCMFXE0c4FHJm6BwqJKiqPhI35q/ztwJ5wWy6nimz5eYCIU 08QHCBOKgFo7JaTYC1tzpy105HuibFClRcbVPJwRHfmQBNnsR8TDk02m+PwJmL8UBbED icZaGDxLjRLxRZ8zimvTUSx9YC3VH448gY2rkS9cJmi48s3rItHx2kJuIveBPCjuSuwB 3LOuCUwNUyb22x3SDbk1GyWAvFyvM4qsqkS6i2NQ8JNV4qA/ybNwtTJFAnMf6WPUDrWz uDvj/+zky91EMWGDd4GaGTLP0RQSKK/qT21KRUIu7CV81z7j+I9Nd6QOfwVISWG1TYZQ jYZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766562583; x=1767167383; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=g+cCn7Eg628Z73NWX24oNSUCwZxTqR/Aa4W4wePMh+s=; b=qRAtNfGnwAHAJ8Cpc32N50jNRAOL9dAmToWwgiz2/aUHjQKoE8VC0+fgMveA1lNL1C /gIY4rkCZKBC8FmlnyTFYTXiGrQdn8Y35RR+tYyuEtUrKrgFe9mflve+Q4OjKZANGfwo 5uxSx2Wkj6Ry34g4XPJDijfoGAVrsN/DuZYPjyZ4NCnR7Adx30ERUgsbLezxvCtP6G0b u2+DH13idoTEzoeIE2LeKBYlgS0fPiO/TOs77jiZ14/Vzl/OwnNb0Ipi64567hdHYGbk uAhufnci4OamgFsUvRGayLLYUzJAi0p5foF+x3GmZuA5WPAc2JPpft+bylpiFkiiIkjj ieXA== X-Gm-Message-State: AOJu0YzTI37JHfQW8xbnLGb7Fp9hac1Qwthx7ecNantD2NUy1zcffivP 0KjRJeGM2noE4ABvnmGqIFiLBT4NnOLK4yaeuaExipcniN9D+TzmrmrIx6MvDw== X-Gm-Gg: AY/fxX5Vdg7o4z6AmoNl60nOt97IeHXttEypkTV0XjxuHGIhLfUYkUJLFI2TGyQ7KBR /F9Egf7pxJsSEc96VBrI/aObqlEHqU/7LkkqNnzY4UW753ERQ5b4lp1Ai92JUzSGHT/XKSX8Hw2 jznVTNqEIUqQQrCGLKUuhPqBxsJqJjS1/SlGPPdFLKJlhzl0NShofkp1zPN5K25ai2W6UaKC7Oe xCPP4Yaciw81pEzIOpa1CSNvguFoau/gRzHZ+Jtvh/PRnLVHAVNdQuxXTpiTWfSDvjWA2YDuGx+ fuwcj0/Z0/iFB5STNjeSE39xVxPS0ZA7GQQhCnzNUPb+5hf8miunH1kPFJqKHaaeHnEm0eCmf2y DvDuafd/nJodGXR5nV8UrCjZPEkLkIb+tWjdoqUIH4NoT6YaOLKRiXUf1Y08X4eYYhEOzeGUwPk OMNKrB9y52Yj0Gm5KIqs9nx0fM X-Google-Smtp-Source: AGHT+IGE1MSlDXbmabO1WcTchpGj1pyND4ZHzYd6jUlWdElqCXDylp655PIH3ac9FEVzHw14DbJNNg== X-Received: by 2002:a05:6a20:918b:b0:366:14ac:e1e0 with SMTP id adf61e73a8af0-376ab1ea654mr16950176637.70.1766562583296; Tue, 23 Dec 2025 23:49:43 -0800 (PST) Received: from NVAPF55DW0D-IPD.. ([165.225.124.226]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c1e7ca0b587sm13847084a12.33.2025.12.23.23.49.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Dec 2025 23:49:42 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Peter Marko , Khem Raj , Ankur Tyagi Subject: [oe][meta-networking][scarthgap][PATCH 3/6] libmemcached: ignore CVE-2023-27478 Date: Wed, 24 Dec 2025 13:19:29 +0530 Message-ID: <20251224074932.1379914-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251224074932.1379914-1-ankur.tyagi85@gmail.com> References: <20251224074932.1379914-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 24 Dec 2025 07:49:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/122846 From: Peter Marko Per [1] this is fixed by [2]. The commit message says that it is reverting feature added in: $ git tag --no-contains d7a0084 | grep 1.0.18 1.0.18 This recipe is for the original memcached which is unmaintained now. Hence the ignore instead of upgrade. [1] https://nvd.nist.gov/vuln/detail/CVE-2023-27478 [2] https://github.com/awesomized/libmemcached/commit/48dcc61a Signed-off-by: Peter Marko Signed-off-by: Khem Raj (cherry picked from commit 607a44649189a29e6f547ce89b41ba332a45946a) Signed-off-by: Ankur Tyagi --- .../recipes-support/libmemcached/libmemcached_1.0.18.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-support/libmemcached/libmemcached_1.0.18.bb b/meta-networking/recipes-support/libmemcached/libmemcached_1.0.18.bb index 56778c0483..e4646d79ef 100644 --- a/meta-networking/recipes-support/libmemcached/libmemcached_1.0.18.bb +++ b/meta-networking/recipes-support/libmemcached/libmemcached_1.0.18.bb @@ -8,3 +8,5 @@ SRC_URI += "\ " SRC_URI[md5sum] = "b3958716b4e53ddc5992e6c49d97e819" SRC_URI[sha256sum] = "e22c0bb032fde08f53de9ffbc5a128233041d9f33b5de022c0978a2149885f82" + +CVE_STATUS[CVE-2023-27478] = "fixed-version: this problem was not yet introduced in 1.0.18" From patchwork Wed Dec 24 07:49:30 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 77383 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA909E75423 for ; Wed, 24 Dec 2025 07:49:49 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.116908.1766562587372258873 for ; Tue, 23 Dec 2025 23:49:47 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20230601 header.b=KKmLtvKA; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-34ab8e0df53so5492604a91.3 for ; Tue, 23 Dec 2025 23:49:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766562586; x=1767167386; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=rsjRLkuS0z1VROVcKbZYeCURH4IUiCTmrPxb6WmiFhA=; b=KKmLtvKA8SbwpyU8Mqmlv4sR+64ToJoWG8B9hVJJ5abNy2Ozsl/AHQglmCaG6kKUWX TlYvLjK2oRqpZ/iPkTvZLNKWHpTFIiYBjmDtFxUZOGQlqvMsJprTeqNoXEs8V4cvC3pG 4bW6x+Apct6PtsESaqfZYAvTa0+IG1IB2ToFWoREQ/lXn+WKxv8te+vAzj9anJfaj9AN 2Lj+B3sGgg6KEgT4j5Yqxw+bz5KEz7Rh/2efbRNN1nMlS290xZ8wKpIm/O5EJWOs3/BB fR+3HCt9Q0D75ErntF2ATLE/Qat/g/h2TWr2FExCudU9WJcdTDPjpag6KprSSTJLyq7A PEJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766562586; x=1767167386; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=rsjRLkuS0z1VROVcKbZYeCURH4IUiCTmrPxb6WmiFhA=; b=VAuC8uwBqWrggOI3FqzZGhfBuu/cObnT6x/vgoDBCAAkai5Hmx/wWOEF+wkS39vM9D L6u4LpXsb9RSYxbDOvhtqtnQwsCeXrJwi14SbZglFQBMVLFSJLM6S+l4zzX9b+MaWKFK P9m1Efsx+wr6m+xkf9pV+Xu4easIBEOspNk00dkdXS6hqx0on9LfFXBQqq2WxZM7U7BC jO10ixJbXK2IvZJAdvNrJV/IKIOK9bag2tIzTrPjrBkUZ2tR0ReAFUtDwb3N7dUqVrBT fmCUU6BRjG21qAlxVz8rjyerhNZQV0Y4rzgOc6E1sDXeFqwGK+yFoLYg9Jo39bR/01EL S3wQ== X-Gm-Message-State: AOJu0YxEQAYaT/cZgpMXgFZbqK1gS/lWyqkY8DK0H4BLEgkUDkUBLNMJ UsH5VpwN8/2NR9ja4BTdOAT95fFMkBpmCvtnmsgM/rb21Ae/zNIE2rEO74Ykxg== X-Gm-Gg: AY/fxX73+gKez4H7xsG35BmrB6VvHWQP81fs3djIXdc1Xb1MDQ7tDau6ZzQUYPgmtdz 8ACk3tH5qXWnaKpuz8EDw7poivvsJhH/YuEzVFpGEPQsXBSCZ0xTCm74UiCCZo5EZHwI3RzE65s J6KuNjiSLUIbvEuiZog2AxxpzV/QPyfa8gbCKEiDnmcFpP/zFjzd6hsMQ+xcyp4vyywIfjOSm3R L1R3AmwZLEUBOwuNgPDwLSWiOjT4O2sOC062C7Ggt91Low5j1yXipoE8hbh+94x/VOZGRbB3ob2 kJ6T8lZC3FKrnq48X/xMIK77k3YlUmerVsISOMDqMW35EOSU4cSl//t0z7Wfffsl3hZA/9QX++E D432+Rp57rXaidgg7IydHqkCi1ATNiEfNHDzd88LI1xKvw4cPWJhylG2HMzxUZLV2dw4mgLjQjy oAgFkkMGzRn98R21xt3lUrsrDw X-Google-Smtp-Source: AGHT+IGn9g9jyR4gkvjv3mo14dia0UdnOsP/dMmh1bcTObJ63QE4xWHKIZuN2YzEejIH+gGpWqEF8w== X-Received: by 2002:a05:6a21:6d9f:b0:366:584c:62fa with SMTP id adf61e73a8af0-376a7af606cmr18357282637.21.1766562586389; Tue, 23 Dec 2025 23:49:46 -0800 (PST) Received: from NVAPF55DW0D-IPD.. ([165.225.124.226]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c1e7ca0b587sm13847084a12.33.2025.12.23.23.49.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Dec 2025 23:49:45 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Gyorgy Sarvari , Khem Raj , Ankur Tyagi Subject: [oe][meta-networking][scarthgap][PATCH 4/6] libcoap: ignore CVE-2025-50518 Date: Wed, 24 Dec 2025 13:19:30 +0530 Message-ID: <20251224074932.1379914-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251224074932.1379914-1-ankur.tyagi85@gmail.com> References: <20251224074932.1379914-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 24 Dec 2025 07:49:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/122848 From: Gyorgy Sarvari Details: https://nvd.nist.gov/vuln/detail/CVE-2025-50518 The vulnerability is disputed by upstream, because the vulnerability requires a user error, incorrect library usage. See also an upstream discussion in a related (rejected) PR: https://github.com/obgm/libcoap/pull/1726 Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit 598176e1cb6c928e322e26d358e8d01ba9d5af0a) Signed-off-by: Ankur Tyagi --- meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb b/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb index 65bf455d9b..4f5a986858 100644 --- a/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb +++ b/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb @@ -62,3 +62,5 @@ PACKAGE_BEFORE_PN += "\ FILES:${PN}-bin = "${bindir}" FILES:${PN}-dev += "${datadir}/${BPN}/examples" + +CVE_STATUS[CVE-2025-50518] = "disputed: happens only when library is used incorrectly" From patchwork Wed Dec 24 07:49:31 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 77384 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9190E75424 for ; Wed, 24 Dec 2025 07:49:49 +0000 (UTC) Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.116516.1766562589255153052 for ; Tue, 23 Dec 2025 23:49:49 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20230601 header.b=HGEsleyE; spf=pass (domain: gmail.com, ip: 209.85.210.173, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-7f1243792f2so3957586b3a.1 for ; Tue, 23 Dec 2025 23:49:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766562588; x=1767167388; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=gUWD4GjDcwTxcJNf9OL3RflQyK9NKSsGngnbrAzgLYA=; b=HGEsleyEzrJnMSHM5fc83PJg12hhvBLs58jv43bAx6Yho5aZtXN41idm30Y/KMrmev xLfOEumO9YmI+L5tKbzeNipnpKCJAlRSsPx0RH4Ev/dR3Y2kKIU9ViSVEHQhU6X4zZ8u Q/5BseSvwL0NBUPqdSc5j7dO8qDSa2a3N9Xqw/IZfani+JcyKeztNaZpbK0x78VVCyGg qyWLANuWpnXawPRtCzWArG47F8riKyien+5XXPvYz95qBHDIP5V8HlKP3aC9zxrsnhkX L8xUSXRdoiY6e5Q17l8eto3JACXHjLfyEYeplAMyEIrbMn4XMAZdnRy4cfCf1q2yvmfh bExw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766562588; x=1767167388; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=gUWD4GjDcwTxcJNf9OL3RflQyK9NKSsGngnbrAzgLYA=; b=unlOJ5U7vLgI/Vd3sgu/GeQOLukcFdKFszODwavcYbPI8Ye506DKaQq6lSNVwOoodp +n6aucGCeaPP1Hk2wsX1zvok7vuq0KUs8u2A6Pj/RC8r8yerhwkJ+NHT90hXLrZoMy1R Fsydv2yHGP/q/eK/eAVNvKSq4WWnnhzPaq0V96n28/hVzxZg5NGeaeVzTGoz1SjBP3f3 J+Ouy7ovb8/wt49cpxxw+QSra0JIUR6nnX4FFHDnJjCysmasrsLsByLcq65ix9KT0cqo xY7CXOnOBXqvUOV3IFjfJMrlx2jVrerI+DTWPbRG7khciNV69ONSDpX0iWX1CWmBGT6/ HDxA== X-Gm-Message-State: AOJu0YysPXZWer/OBL823hTQq++9awH+VilrnQ+olCjLkzFjY6IsF9tU ol8nRK50TUgQJrqMzV1teV7rH9BXAfly+GZTe170c1B7H04/COmlVJlMbys+oQ== X-Gm-Gg: AY/fxX7PydpKtvQRO77GcrTuMZvrBFGiIk3+1qHzIh0uUr6ST8Vp2Cxq9rvXUzztxe9 XZo89qxkng0E30siUVPTwZ6JasfaBw68p2Css45ovF1PemkeNxoQ/wnoo7yCtOyiQfwBuValyrd QXNulk8Xg4Nu/JOUVFB8aLJgQzVzTOD/ZfcCofEqEbJFVjzwpGVj3WfE5GnLGWOR+mywSFCYadZ 0VqS/AznRH63GtYKDu/tdywTyhmVz4xnCKSqZqRSZn/tx3v6IKlTkpZKeMduJTXCfW8e/Mw0RH4 q5oHMiEsfj/uvtEyog3nFJ15GJuyYfelUXCXKdsiYbht0H7KkWJhNy0hYyqJfHmUZNjgxxzc7x7 +z4oZ1CGMGWsrldiIGLi2XcDYhV02lL/MsX3F9khQ6GjtZtdexG1OAbnD+mPyxNLnT8OaHKxlMv QpoeVKUDFZn3c6agjhQiztxbkA X-Google-Smtp-Source: AGHT+IGHSKR+/URya8Cms5hnyayzTWZQ//tGrCT7XMA/d84uYrFlogTHBC+E0IWrdZfIQ7gTQqG6fQ== X-Received: by 2002:a05:6a20:e290:b0:35f:6e12:184c with SMTP id adf61e73a8af0-376a9ace741mr16079997637.60.1766562588472; Tue, 23 Dec 2025 23:49:48 -0800 (PST) Received: from NVAPF55DW0D-IPD.. ([165.225.124.226]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c1e7ca0b587sm13847084a12.33.2025.12.23.23.49.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Dec 2025 23:49:48 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][scarthgap][PATCH 5/6] libcoap: ignore CVE-2023-51847 Date: Wed, 24 Dec 2025 13:19:31 +0530 Message-ID: <20251224074932.1379914-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251224074932.1379914-1-ankur.tyagi85@gmail.com> References: <20251224074932.1379914-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 24 Dec 2025 07:49:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/122849 From: Ankur Tyagi Details https://nvd.nist.gov/vuln/detail/CVE-2023-51847 The vulnerability exists in coap_threadsafe.c but thread safe support was added in version v4.5.3 [1] [1] https://github.com/obgm/libcoap/commit/c69c5d5af0a30859e90756f535e2ca21cdeda0b2 $ git tag --contains c69c5d5 v4.3.5 v4.3.5-rc1 v4.3.5-rc2 v4.3.5-rc3 v4.3.5a Signed-off-by: Ankur Tyagi --- meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb b/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb index 4f5a986858..9c45cd248e 100644 --- a/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb +++ b/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb @@ -64,3 +64,4 @@ FILES:${PN}-bin = "${bindir}" FILES:${PN}-dev += "${datadir}/${BPN}/examples" CVE_STATUS[CVE-2025-50518] = "disputed: happens only when library is used incorrectly" +CVE_STATUS[CVE-2023-51847] = "not-applicable-config: Doesn't apply to our configuration so we can safely ignore it." From patchwork Wed Dec 24 07:49:32 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 77386 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BCA30E75423 for ; Wed, 24 Dec 2025 07:49:59 +0000 (UTC) Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.116910.1766562591079698441 for ; Tue, 23 Dec 2025 23:49:51 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20230601 header.b=HPw3i1AV; spf=pass (domain: gmail.com, ip: 209.85.210.182, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-7b80fed1505so6037987b3a.3 for ; Tue, 23 Dec 2025 23:49:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766562590; x=1767167390; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Gwe4bFRpQ+pGJWCmHXDz3DtyyGFS4HKo9mhHLAKgofQ=; b=HPw3i1AV59oOcJMu2x03Q8jGuneIPEXBEoXWH4qIRmfNzbotGkRWNPafeaIkYFmpit vZyTSebJEAWSokgH9rRpBrKovjTizcWDniydQDdeLtpOdj8j29Y1w7XgjW+0Wc862eKi rup+rolOI5nNltr+BtsB6cuDWVqsy4PuZfp3+CodDyYD7ZMB3BgPHv6aDaRREdDqF6i6 4j9/VmOiT39B+M5X3nL+RvQWV7BvQdcZxsThAO1MIPKL+lox/Gd9GbcbE6UEzTHFeEqY +mrpU18qHpFPLzGj3ATCGFUCRosrx6FaCexBZ0AjBfJZRpEFet7lYb8Jxn/BGWWSpvu6 TRbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766562590; x=1767167390; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Gwe4bFRpQ+pGJWCmHXDz3DtyyGFS4HKo9mhHLAKgofQ=; b=MU4wlf5yx09qE0fEyfxVHMLYvymVMXu/T6lMFAFRK+LbdncpmkPVLFfazRgRNynbpL /fdzrxe5BbxVj9f0bA+Ou8LJRa167Fa1O0H8rj1XYl70rh7u503s0GZWl2iNFeyJmsCJ MuJurDdZ1FtudqxGd9K/bAa/oe0eb/BEC2qGkd8tFTgJ+A0YnlWA3YXDO81Qn1B9P2k2 Jo2SwaKoIgYllXD12YR/hls6IsYm/8i9coAkjrumw2UDN9ALia4uvtBtKjK8kfola7QL pxr9ixJmngBfx+hq/agP9Ic3a/pTR6JENGEN52fMgSvLRR9mpiuv0/s++yiD/3O0e7Qa RsUQ== X-Gm-Message-State: AOJu0YzyJ5m7qjkW5lj8DfqlifrQdHwfsufeIV2LaW1MpXk4zvoP7s0v 6BUCLulVPAYepfUVoxhdoeST4dnetMUbnct0jcZA3yGB6DlbPT8UoyUrdX3Kig== X-Gm-Gg: AY/fxX6vHTTU9Bk07XPnjveYm5g43QBnA2v+KuLaWgzVkGmnz43fRY50sUCgU3tI7B6 +Y3XkzLIiCCaOCQvwsHDCIiSkO3PygEk+JDIS3VITuHaYGYr9ivqNEnIDyhK+xYp8DsweR2AymX AB/KjTanp1D1wfxtyFAGNDSODyvsthnYBea+BeIazr1SMGN6deRchUT1JZVFeKz902/xhDV24eu GgDtEO61mR+wI5ptGbIooDjhUZej74nzSFh9tcd/t7M2DoxzLbtN+XjOb6qiknqC6qAzDc5Z0xP Hcbgfclvt8n3i2AV9c5biwTcMtqdM5qUd4s5QGf/CbehQEqxvlzDoMAAatAG7IJDNGUzwGrNNZk vDvT57rSm2F945LEweU2fCcSVeZ2s217Uu5GxCbL1/JF6n5v9Hx4TjKB54p66M+qfJZAScktguJ Jd58kRo5iMWgsKRaA/mtzn93Vk96NPtLXUnug= X-Google-Smtp-Source: AGHT+IGAB0lowC65jy4zeXF0L4E51P9XIBzWHrkTJcbCxSwZ+BMZK1UE8hzcdXCynIaMiGHBHrwkFQ== X-Received: by 2002:a05:6a20:430f:b0:364:131c:40dd with SMTP id adf61e73a8af0-376aa1f7e2fmr18655654637.37.1766562590273; Tue, 23 Dec 2025 23:49:50 -0800 (PST) Received: from NVAPF55DW0D-IPD.. ([165.225.124.226]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c1e7ca0b587sm13847084a12.33.2025.12.23.23.49.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 23 Dec 2025 23:49:49 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][scarthgap][PATCH 6/6] libcoap: patch CVE-2025-59391 Date: Wed, 24 Dec 2025 13:19:32 +0530 Message-ID: <20251224074932.1379914-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251224074932.1379914-1-ankur.tyagi85@gmail.com> References: <20251224074932.1379914-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 24 Dec 2025 07:49:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/122850 From: Ankur Tyagi Details https://nvd.nist.gov/vuln/detail/CVE-2025-59391 Signed-off-by: Ankur Tyagi --- .../libcoap/libcoap/CVE-2025-59391.patch | 88 +++++++++++++++++++ .../recipes-devtools/libcoap/libcoap_4.3.4.bb | 1 + 2 files changed, 89 insertions(+) create mode 100644 meta-networking/recipes-devtools/libcoap/libcoap/CVE-2025-59391.patch diff --git a/meta-networking/recipes-devtools/libcoap/libcoap/CVE-2025-59391.patch b/meta-networking/recipes-devtools/libcoap/libcoap/CVE-2025-59391.patch new file mode 100644 index 0000000000..7136481b05 --- /dev/null +++ b/meta-networking/recipes-devtools/libcoap/libcoap/CVE-2025-59391.patch @@ -0,0 +1,88 @@ +From 947bead23940cacf081f93c3e29f540e3e867b7b Mon Sep 17 00:00:00 2001 +From: Jon Shallow +Date: Thu, 4 Sep 2025 13:26:06 +0100 +Subject: [PATCH] OSCORE: Fix OSCORE configuration file parsing issue + +With a large boolean parameter value, (longer than "false"), memory +would be read past the "true" or "false" string boundaries in the ".rodata" +section when doing a memcmp(), potetially causing the application to crash +when calling coap_new_oscore_conf() with a specially crafted configuration +file. + +It also can provide a mechanism to determine the byte values following the +"true" or "false" string boundaries which could lead to accessing sensitive +information. The standard libcoap library does not have defined keys or +certificates. This can only be done by a specially crafted local application. + +Discovered by SecMate (https://secmate.dev). + +Now fixed. + +CVE: CVE-2025-59391 +Upstream-Status: Backport [https://github.com/obgm/libcoap/commit/da534de75edd1b3628a28908d30b0efbaa01be09] +(cherry picked from commit da534de75edd1b3628a28908d30b0efbaa01be09) +Signed-off-by: Ankur Tyagi +--- + src/coap_oscore.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/src/coap_oscore.c b/src/coap_oscore.c +index 2d7dd6d0..723b5ef5 100644 +--- a/src/coap_oscore.c ++++ b/src/coap_oscore.c +@@ -1675,6 +1675,7 @@ get_split_entry(const char **start, + const char *kend; + const char *split; + size_t i; ++ size_t len; + + retry: + kend = end = memchr(begin, '\n', size); +@@ -1751,9 +1752,10 @@ retry: + value->u.value_str.length = end - begin; + break; + case COAP_ENC_BOOL: +- if (memcmp("true", begin, end - begin) == 0) ++ len = (size_t)(end - begin); ++ if (len == 4 && memcmp("true", begin, len) == 0) + value->u.value_int = 1; +- else if (memcmp("false", begin, end - begin) == 0) ++ else if (len == 5 && memcmp("false", begin, len) == 0) + value->u.value_int = 0; + else + goto bad_entry; +@@ -1768,7 +1770,7 @@ bad_entry: + coap_log_warn("oscore_conf: Unrecognized configuration entry '%.*s'\n", + (int)(end - begin), + begin); +- return 0; ++ return -1; + } + + #undef CONFIG_ENTRY +@@ -1840,6 +1842,7 @@ coap_parse_oscore_conf_mem(coap_str_const_t conf_mem) { + coap_str_const_t keyword; + oscore_value_t value; + coap_oscore_conf_t *oscore_conf; ++ int split_ok = -1; + + oscore_conf = coap_malloc_type(COAP_STRING, sizeof(coap_oscore_conf_t)); + if (oscore_conf == NULL) +@@ -1858,7 +1861,7 @@ coap_parse_oscore_conf_mem(coap_str_const_t conf_mem) { + oscore_conf->break_recipient_key = 0; + + while (end > start && +- get_split_entry(&start, end - start, &keyword, &value)) { ++ (split_ok = get_split_entry(&start, end - start, &keyword, &value)) > 0) { + size_t i; + size_t j; + +@@ -1944,6 +1947,8 @@ coap_parse_oscore_conf_mem(coap_str_const_t conf_mem) { + goto error; + } + } ++ if (split_ok == -1) ++ goto error; + if (!oscore_conf->master_secret) { + coap_log_warn("oscore_conf: master_secret not defined\n"); + goto error; diff --git a/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb b/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb index 9c45cd248e..da0cf50f92 100644 --- a/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb +++ b/meta-networking/recipes-devtools/libcoap/libcoap_4.3.4.bb @@ -11,6 +11,7 @@ SRC_URI = "git://github.com/obgm/libcoap.git;branch=main;protocol=https \ file://run-ptest \ file://CVE-2024-0962.patch \ file://CVE-2024-31031.patch \ + file://CVE-2025-59391.patch \ " SRCREV = "5fd2f89ef068214130e5d60b7087ef48711fa615"