From patchwork Tue Aug 4 20:03:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 94532 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B759C55ABA for ; Tue, 4 Aug 2026 20:04:33 +0000 (UTC) Received: from mta-64-226.siemens.flowmailer.net (mta-64-226.siemens.flowmailer.net [185.136.64.226]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.25346.1785873868764384341 for ; Tue, 04 Aug 2026 13:04:30 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=kHbngs/e; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.226, mailfrom: fm-256628-20260804200425ff348191c40002078b-i4izyr@rts-flowmailer.siemens.com) Received: by mta-64-226.siemens.flowmailer.net with ESMTPSA id 20260804200425ff348191c40002078b for ; Tue, 04 Aug 2026 22:04:26 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc; bh=Z9Ugi7f4felHI6r7PJgP21A/0xSXok3dV1EAlN9wKlc=; b=kHbngs/ek6B1tDHBZANTWJQBQu67LXr97NWUlOBWnpO/+Y1IBRg9mJuPRgEf3WUJLa3hQO T7YI6qF6IRepJ3zsDEg+gbUroU/toDdot6f4XyDrdzcKHwbh3VhKWDks4d0dMm2raCbRZTgG w+9KSt4LpUxL8NW6EyqrtfD2fWc3BSc9xrAA1hWar01pkCKeIkBInneKXgTamjirraaSWHZ8 tGYjrVGXb9FE0rFeea8RT45alAOufkBF36T3Rr73ROyWBaDynzf4wh1pxHJwJxToiJE9gOjF EUP6adCSvIFMETJfh+9k86i96pjcyxZF9vYTv47IUAIXkra9hz4PHn9Q==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: peter.marko@siemens.com Subject: [wrynose][PATCH 1/6] connman: remove connection_manager from CVE_PRODUCTS Date: Tue, 4 Aug 2026 22:03:51 +0200 Message-ID: <20260804200356.2093270-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 04 Aug 2026 20:04:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242796 From: Peter Marko The only CVE with this product/cpr is CVE-2013-10036 which is for different connection manager and is showing up as false positive in CVE reports with current sbom-cve-check tooling. Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (From OE-Core rev: 5b2046bf757622ae46e66691119cebc504113993) Signed-off-by: Peter Marko --- meta/recipes-connectivity/connman/connman_2.0.bb | 2 -- 1 file changed, 2 deletions(-) diff --git a/meta/recipes-connectivity/connman/connman_2.0.bb b/meta/recipes-connectivity/connman/connman_2.0.bb index 6f7093301b..920745afc3 100644 --- a/meta/recipes-connectivity/connman/connman_2.0.bb +++ b/meta/recipes-connectivity/connman/connman_2.0.bb @@ -14,8 +14,6 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=12f884d2ae1ff87c09e5b7ccc2c4ca7e \ inherit autotools pkgconfig systemd update-rc.d update-alternatives -CVE_PRODUCT = "connman connection_manager" - DEPENDS = "dbus glib-2.0" SRC_URI = "${KERNELORG_MIRROR}/linux/network/${BPN}/${BP}.tar.xz \ From patchwork Tue Aug 4 20:03:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 94533 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E134C561E6 for ; Tue, 4 Aug 2026 20:04:33 +0000 (UTC) Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.25347.1785873871444982703 for ; Tue, 04 Aug 2026 13:04:31 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=kStGkkP4; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-256628-20260804200429024da973b1000207a2-g6yqqv@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 20260804200429024da973b1000207a2 for ; Tue, 04 Aug 2026 22:04:29 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=PH1Vpy2Ta1kN40TuONn95na4NEpO38SQGjbBNwtMgMY=; b=kStGkkP4vJ62bxSU0zbL5UpJZyBCunTjlwbGqmNWonYVXbZ+bFwKxKTZMp4uefK1yK4+Nb xLCbplAB0zy/9AMQWBC96ObaC8vy441j7ArmXknPOwDToha3dADBI5xMwvvRlD3AdcD8jjgN VwY1mSzbI3EK7wXNNRetifW9T8ek8OS+rdCHd+0aSOSskJmLG+Swymwa0975AnidF65BAfU8 tLPrOjyGmZA5tpUScZdsYyMeGs1pSTKBkJxRGtVOtAg17nUMLIKLDeRfir2KS7LK8jLJt1+1 m04H0kqorVgBk6AQFsyxlpg70CkcRpu1EtGQCVEy2ziq83mgbrhjKMkQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: peter.marko@siemens.com Subject: [wrynose][PATCH 2/6] p11-kit: upgrade 0.26.2 -> 0.26.4 Date: Tue, 4 Aug 2026 22:03:52 +0200 Message-ID: <20260804200356.2093270-2-peter.marko@siemens.com> In-Reply-To: <20260804200356.2093270-1-peter.marko@siemens.com> References: <20260804200356.2093270-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 04 Aug 2026 20:04:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242797 From: Richard Purdie Signed-off-by: Richard Purdie (From OE-Core rev: 4e58b57cdc5e25d6cb12b658f09fea7c91835430) Release Notes: * https://github.com/p11-glue/p11-kit/releases/tag/0.26.4 * Build fix * Update translations * https://github.com/p11-glue/p11-kit/releases/tag/0.26.3 * server: fixed stack exhaustion via unbounded recursion in RPC attribute parsing by enforcing a recursion depth limit (CVE-2026-13757) * fixed confusing error message when trying to store an existing cert with trust anchor * fixed assert when parsing p11-kit files with value (") * fixed numerous memory management issues * Build and test fixes Signed-off-by: Peter Marko --- .../p11-kit/{p11-kit_0.26.2.bb => p11-kit_0.26.4.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-support/p11-kit/{p11-kit_0.26.2.bb => p11-kit_0.26.4.bb} (97%) diff --git a/meta/recipes-support/p11-kit/p11-kit_0.26.2.bb b/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb similarity index 97% rename from meta/recipes-support/p11-kit/p11-kit_0.26.2.bb rename to meta/recipes-support/p11-kit/p11-kit_0.26.4.bb index 5f553f11bb..5a42d0dc50 100644 --- a/meta/recipes-support/p11-kit/p11-kit_0.26.2.bb +++ b/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb @@ -12,7 +12,7 @@ DEPENDS:append = "${@' glib-2.0' if d.getVar('GTKDOC_ENABLED') == 'True' else '' SRC_URI = "gitsm://github.com/p11-glue/p11-kit;branch=master;protocol=https;tag=${PV} \ " -SRCREV = "8e6e4e6d64d9fe91c62b0052c105b2b72d4c24ef" +SRCREV = "a14788849d1ef44422d679534a13821eab5bb5f4" PACKAGECONFIG ??= "" PACKAGECONFIG[manpages] = "-Dman=true,-Dman=false,libxslt-native" From patchwork Tue Aug 4 20:03:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 94534 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE067C55ABA for ; Tue, 4 Aug 2026 20:04:42 +0000 (UTC) Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net [185.136.64.227]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.25349.1785873876529371974 for ; Tue, 04 Aug 2026 13:04:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=BHZ1yyrf; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.227, mailfrom: fm-256628-20260804200434f61c882ed90002075a-3nxnbq@rts-flowmailer.siemens.com) Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 20260804200434f61c882ed90002075a for ; Tue, 04 Aug 2026 22:04:34 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=njuGLQs65Arqb7fSe/LWLG8USe1dGe7ldXoCGRBXa50=; b=BHZ1yyrfrZwOAvToNTPGKYEnmbsUXoXl3sjQ7gxAdNHsT3I4FkVwtEo0zKs0/7RoRZ20Cy D1R5AaptD3x0pFcKqARgQZe6MUUZj9LuecT7OA0blXOTtY+yYW+UNXkJcnRZ/sIM9YNMGPuG 2C23OwtE6NQUdmbYge2QxZH1S8eWR0aru36kaAWNQtOrHekGdX7vUV9tLX04vjMuCmiwhZWV M2pyq3WcGj3YDk0rw55Ia/Vmkgb7SUy20BBu39xDI4UkTAPt6UIyNmepUdzELUCP5QBGDKfg 56AO7yz/JZszDzDr6Tv8JcQyFMzDzzdlTtfOhIlzGNhvqI54FpmKoosw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: peter.marko@siemens.com Subject: [wrynose][PATCH 3/6] p11-kit: set status for CVE-2026-13757 Date: Tue, 4 Aug 2026 22:03:53 +0200 Message-ID: <20260804200356.2093270-3-peter.marko@siemens.com> In-Reply-To: <20260804200356.2093270-1-peter.marko@siemens.com> References: <20260804200356.2093270-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 04 Aug 2026 20:04:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242798 From: Peter Marko This is a RedHat version-less CVE. Per [1] this is fixed in 0.26.3. [1] https://security-tracker.debian.org/tracker/CVE-2026-13757 Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (From OE-Core rev: 3bb664fbba47febc9c26dd7f7965e508870a023f) Signed-off-by: Peter Marko --- meta/recipes-support/p11-kit/p11-kit_0.26.4.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb b/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb index 5a42d0dc50..fde122d3ca 100644 --- a/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb +++ b/meta/recipes-support/p11-kit/p11-kit_0.26.4.bb @@ -44,3 +44,4 @@ BBCLASSEXTEND = "native nativesdk" CFLAGS += "-Wno-error=incompatible-pointer-types" CVE_STATUS[CVE-2026-2100] = "fixed-version: fixed since 0.26.2" +CVE_STATUS[CVE-2026-13757] = "fixed-version: fixed since 0.26.3" From patchwork Tue Aug 4 20:03:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 94535 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0413C55822 for ; Tue, 4 Aug 2026 20:04:42 +0000 (UTC) Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net [185.136.64.227]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.25349.1785873876529371974 for ; Tue, 04 Aug 2026 13:04:39 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=KbQiNcv0; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.227, mailfrom: fm-256628-2026080420043883eb8268ba000207fc-0q7ho8@rts-flowmailer.siemens.com) Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 2026080420043883eb8268ba000207fc for ; Tue, 04 Aug 2026 22:04:38 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=vwMNVztz6ZypCyRieV3pFr+MMhkgcq20mSvR27YDVIM=; b=KbQiNcv0imZ91P2+ian/79PawLhQPmDwZ24ByTPb06prck85Yk0SlDDFzzx2uKCtTFP3NA leQh8dh78+PTJYJfmDbpJYP0oe9M3un11glrMtCXKdDbLyMmxmpO+Gu96rFIo0qQaxcE4h8S Z5+wVRSARG8ls/c6x0eW7o/301+ftju+ncWGisQhwGCQgztC3lYcfkmaHv1Pkos5JyUUTA/z Q90e0z33/dVcgxZNa+clnupzC2KTrZC6wGgow6mCMKWwCyqGnusWPdVrz5UOQb7GfieEtF8v Pl/5oyfmWVMu+/MJG6/hiG7ST2KqqWzTcU5gbeACTyjqftK+ijJnxUxA==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: peter.marko@siemens.com Subject: [wrynose][PATCH 4/6] libxml2: upgrade 2.15.2 -> 2.15.3 Date: Tue, 4 Aug 2026 22:03:54 +0200 Message-ID: <20260804200356.2093270-4-peter.marko@siemens.com> In-Reply-To: <20260804200356.2093270-1-peter.marko@siemens.com> References: <20260804200356.2093270-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 04 Aug 2026 20:04:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242799 From: Richard Purdie Signed-off-by: Richard Purdie (From OE-Core rev: fd9928e49da740d11f402e13b00cf5401c81d5cd) Release Notes: * https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.3 * Security * [CVE-2024-40896] Fix XXE protection in downstream code * Regressions * autotools: Use AC_CHECK_DECL to check for getentropy * xinclude: Fix fallback for text includes * io: Don't call getcwd in xmlParserGetDirectory * io: Fix return value of xmlFileRead * parser: Fix error return of xmlParseBalancedChunkMemory * Improvements * xinclude: Set error handler when parsing text * Undeprecate xmlKeepBlanksDefault Signed-off-by: Peter Marko --- ...ake-Fix-installation-directories-in-libxml2.patch | 12 ++++++------ meta/recipes-core/libxml/libxml2/install-tests.patch | 9 +++------ .../libxml/{libxml2_2.15.2.bb => libxml2_2.15.3.bb} | 2 +- 3 files changed, 10 insertions(+), 13 deletions(-) rename meta/recipes-core/libxml/{libxml2_2.15.2.bb => libxml2_2.15.3.bb} (97%) diff --git a/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch b/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch index 627f8472c3..d19b284866 100644 --- a/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch +++ b/meta/recipes-core/libxml/libxml2/0001-Revert-cmake-Fix-installation-directories-in-libxml2.patch @@ -1,4 +1,4 @@ -From 1a7e177a7315c856a2f0e3c2a17ee0fd9e297bc9 Mon Sep 17 00:00:00 2001 +From 803e6f21d3d7ef6399f6ffe58cd28fa6dc7b94e9 Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Mon, 26 May 2025 21:11:14 +0200 Subject: [PATCH] Revert "cmake: Fix installation directories in @@ -15,10 +15,10 @@ Signed-off-by: Peter Marko 3 files changed, 7 insertions(+), 18 deletions(-) diff --git a/configure.ac b/configure.ac -index aaa02e3..fb241bb 100644 +index d8dc4e1..633334a 100644 --- a/configure.ac +++ b/configure.ac -@@ -1065,17 +1065,6 @@ AC_SUBST(XML_PRIVATE_LIBS) +@@ -1008,17 +1008,6 @@ AC_SUBST(XML_PRIVATE_LIBS) AC_SUBST(XML_PRIVATE_CFLAGS) AC_SUBST(XML_INCLUDEDIR) @@ -37,7 +37,7 @@ index aaa02e3..fb241bb 100644 AC_DEFINE_UNQUOTED([XML_SYSCONFDIR], ["$XML_SYSCONFDIR"], [System configuration directory (/etc)]) diff --git a/libxml2-config.cmake.in b/libxml2-config.cmake.in -index e040a75..dc0d6b8 100644 +index ff6433f..b775cfe 100644 --- a/libxml2-config.cmake.in +++ b/libxml2-config.cmake.in @@ -24,17 +24,20 @@ @@ -66,10 +66,10 @@ index e040a75..dc0d6b8 100644 set(LIBXML2_LIBRARIES ${LIBXML2_LIBRARY}) set(LIBXML2_INCLUDE_DIRS ${LIBXML2_INCLUDE_DIR}) diff --git a/meson.build b/meson.build -index 98bc6e3..3ef0bd0 100644 +index 2cfecb6..f78da31 100644 --- a/meson.build +++ b/meson.build -@@ -599,9 +599,6 @@ config_cmake = configuration_data() +@@ -593,9 +593,6 @@ config_cmake = configuration_data() config_cmake.set('LIBXML_MAJOR_VERSION', v_maj) config_cmake.set('LIBXML_MINOR_VERSION', v_min) config_cmake.set('LIBXML_MICRO_VERSION', v_mic) diff --git a/meta/recipes-core/libxml/libxml2/install-tests.patch b/meta/recipes-core/libxml/libxml2/install-tests.patch index 9269536af0..996ade614e 100644 --- a/meta/recipes-core/libxml/libxml2/install-tests.patch +++ b/meta/recipes-core/libxml/libxml2/install-tests.patch @@ -1,4 +1,4 @@ -From 3381232bab7217b9cb47e7cc765c8380192069b0 Mon Sep 17 00:00:00 2001 +From c6b547e06beb0f0ba99e30d036f055eaed9ec4dc Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Fri, 17 Oct 2025 14:15:36 +0800 Subject: [PATCH] add yocto-specific install-ptest target @@ -15,10 +15,10 @@ Signed-off-by: Hongxu Jia 1 file changed, 8 insertions(+) diff --git a/Makefile.am b/Makefile.am -index 19ec305..64bf28a 100644 +index 0a2a729..7ca5bad 100644 --- a/Makefile.am +++ b/Makefile.am -@@ -29,6 +29,14 @@ check_PROGRAMS = \ +@@ -30,6 +30,14 @@ check_PROGRAMS = \ testparser \ testrecurse @@ -33,6 +33,3 @@ index 19ec305..64bf28a 100644 bin_PROGRAMS = xmllint bin_SCRIPTS = xml2-config --- -2.34.1 - diff --git a/meta/recipes-core/libxml/libxml2_2.15.2.bb b/meta/recipes-core/libxml/libxml2_2.15.3.bb similarity index 97% rename from meta/recipes-core/libxml/libxml2_2.15.2.bb rename to meta/recipes-core/libxml/libxml2_2.15.3.bb index 9181949ea5..02507d8042 100644 --- a/meta/recipes-core/libxml/libxml2_2.15.2.bb +++ b/meta/recipes-core/libxml/libxml2_2.15.3.bb @@ -21,7 +21,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt file://CVE-2026-11979.patch \ " -SRC_URI[archive.sha256sum] = "c8b9bc81f8b590c33af8cc6c336dbff2f53409973588a351c95f1c621b13d09d" +SRC_URI[archive.sha256sum] = "78262a6e7ac170d6528ebfe2efccdf220191a5af6a6cd61ea4a9a9a5042c7a07" SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273" CVE_STATUS[CVE-2025-6170] = "fixed-version: fixed in version 2.14.5" From patchwork Tue Aug 4 20:03:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 94537 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F364DC55822 for ; Tue, 4 Aug 2026 20:04:52 +0000 (UTC) Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net [185.136.64.227]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.25352.1785873884541944998 for ; Tue, 04 Aug 2026 13:04:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=L82trQIT; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.227, mailfrom: fm-256628-2026080420044270b655d486000207ee-ed9g25@rts-flowmailer.siemens.com) Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 2026080420044270b655d486000207ee for ; Tue, 04 Aug 2026 22:04:43 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=3dU4YmJALPkDOnqZAlPprArxpGnobTPci1BuVenuvfw=; b=L82trQIT/B2MPSOklwbcgq1wfVHTzIFQh4pplhkx6vcIYN1Bwthu3BDsgIJfRnjLZ0obvc bFlHKxrZ/jb8wCrTdd+qHi8Blz7lURwdx6hkuKtBLXL8M6bGxT8h7FnHYP0H0zUiQEZwYFKZ IXqNP9I+OmtKUUzNZynYvAWZ/Qq31Rgsl8m1k4J9y0nTaCx4D3o2LOuibMXmcKeXy+GsyPC+ joDhMax7wk8rKhpsQlouockqAP4WDL3r79WO5tAUUqv2u723XwhmTurWiTm1XHF7MiciPSuY a8ontya8PbggLG6oU3TXx7SXpnIqodeuFUn5ssdRB/iodWpa8gZQ4SPw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: peter.marko@siemens.com Subject: [wrynose][PATCH 5/6] libxml2: set status for CVE-2026-6732 Date: Tue, 4 Aug 2026 22:03:55 +0200 Message-ID: <20260804200356.2093270-5-peter.marko@siemens.com> In-Reply-To: <20260804200356.2093270-1-peter.marko@siemens.com> References: <20260804200356.2093270-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 04 Aug 2026 20:04:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242800 From: Peter Marko This is a version-less RedHat CVE. [1] points to [2] and [3]. These were backported as [4] and [5] in v2.15.3. [1] https://security-tracker.debian.org/tracker/CVE-2026-6732 [2] https://gitlab.gnome.org/GNOME/libxml2/-/commit/226b560837b90dea9b14431eca6e6fda8fb01ab4 [3] https://gitlab.gnome.org/GNOME/libxml2/-/commit/7cea3fd1557437b88f2c7b5e1b71a2d5fb152b55 [4] https://gitlab.gnome.org/GNOME/libxml2/-/commit/ad0f009a8366860272acb8e05c41a401798f2855 [5] https://gitlab.gnome.org/GNOME/libxml2/-/commit/65d0fe61c6f36ee40431aeb041ea703e839ff60d Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 7a75c7c8485cb9225f1714c4c08e1fd05a95f145) Signed-off-by: Peter Marko --- meta/recipes-core/libxml/libxml2_2.15.3.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-core/libxml/libxml2_2.15.3.bb b/meta/recipes-core/libxml/libxml2_2.15.3.bb index 02507d8042..abf9889b3f 100644 --- a/meta/recipes-core/libxml/libxml2_2.15.3.bb +++ b/meta/recipes-core/libxml/libxml2_2.15.3.bb @@ -25,6 +25,7 @@ SRC_URI[archive.sha256sum] = "78262a6e7ac170d6528ebfe2efccdf220191a5af6a6cd61ea4 SRC_URI[testtar.sha256sum] = "c6b2d42ee50b8b236e711a97d68e6c4b5c8d83e69a2be4722379f08702ea7273" CVE_STATUS[CVE-2025-6170] = "fixed-version: fixed in version 2.14.5" +CVE_STATUS[CVE-2026-6732] = "fixed-version: fixed in version 2.15.3" BINCONFIG = "${bindir}/xml2-config" From patchwork Tue Aug 4 20:03:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 94536 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E10E0C55ABA for ; Tue, 4 Aug 2026 20:04:52 +0000 (UTC) Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net [185.136.64.227]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.25352.1785873884541944998 for ; Tue, 04 Aug 2026 13:04:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=Mbk3bzDK; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.227, mailfrom: fm-256628-2026080420044605b05c8d30000207d3-59qwku@rts-flowmailer.siemens.com) Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 2026080420044605b05c8d30000207d3 for ; Tue, 04 Aug 2026 22:04:46 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=WyWaJUsFRGWUloFfHjwp9Fih22G3Xb8yp3ttzzOCsbg=; b=Mbk3bzDK7zhuwLD14vZ9coYvZqAcUEZqXVppPXXQebCVBc+l1Yw+Z+TAxexmEv1jM2bwXp Oox0ShuUt9oXddu6726wo7QasJxvXSYg00OCZ/7zd1lOeH0wpHIi6ZGThmQ3DrVLVLM91Xvx dzojFZk8JeVpxvIrOkb0DlpWZUCwR4a4cAhgXzv32vL7j+tgLJ80XuIg3SznaAMsS2rDQeMf 3fA4uF1tDS4hdfabkwbVIFOCz/tUu80E3cKw3fflpp14JBEF7ySNKC7zJymw0s3nnjtHzE7/ Z+bVtBjLuLbOixsSvEt8vdTeEBDj2Mn4rprk4bAO5h9KBI1fpNvMkDhw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: peter.marko@siemens.com Subject: [wrynose][PATCH 6/6] python3-cryptography(-vectors): upgrade 46.0.5 -> 46.0.7 Date: Tue, 4 Aug 2026 22:03:56 +0200 Message-ID: <20260804200356.2093270-6-peter.marko@siemens.com> In-Reply-To: <20260804200356.2093270-1-peter.marko@siemens.com> References: <20260804200356.2093270-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 04 Aug 2026 20:04:52 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242801 From: Peter Marko Both releases consists of single commit on [1] Changelog [2]: * 46.0.7 - 2026-01-27 * SECURITY ISSUE: Fixed an issue where non-contiguous buffers could be passed to APIs that accept Python buffers, which could lead to buffer overflow. CVE-2026-39892 * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6. * 46.0.6 - 2026-03-25 * SECURITY ISSUE: Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug, including those used by the Web PKI. Credit to Oleh Konko (1seal) for reporting the issue. CVE-2026-34073 [1] https://github.com/pyca/cryptography/commits/46.0.x/ [2] https://github.com/pyca/cryptography/blob/46.0.7/CHANGELOG.rst Signed-off-by: Peter Marko --- meta/recipes-devtools/python/python3-cryptography-common.inc | 2 +- meta/recipes-devtools/python/python3-cryptography-vectors.bb | 2 +- meta/recipes-devtools/python/python3-cryptography.bb | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/meta/recipes-devtools/python/python3-cryptography-common.inc b/meta/recipes-devtools/python/python3-cryptography-common.inc index 4e4434bd66..0515cf7705 100644 --- a/meta/recipes-devtools/python/python3-cryptography-common.inc +++ b/meta/recipes-devtools/python/python3-cryptography-common.inc @@ -3,4 +3,4 @@ # # Additionally AUH will detect that they share this .inc file and # perform a lockstep upgrade for both. -PV = "46.0.5" +PV = "46.0.7" diff --git a/meta/recipes-devtools/python/python3-cryptography-vectors.bb b/meta/recipes-devtools/python/python3-cryptography-vectors.bb index 800bf1b0e0..9047e690ea 100644 --- a/meta/recipes-devtools/python/python3-cryptography-vectors.bb +++ b/meta/recipes-devtools/python/python3-cryptography-vectors.bb @@ -12,7 +12,7 @@ require python3-cryptography-common.inc SRC_URI += "file://0001-pyproject.toml-bump-uv_build-version-requirement.patch \ file://0001-bump-uv_build-to-0.10.0-14271.patch \ " -SRC_URI[sha256sum] = "ffbccee9455201c01b37c63d65d9f83b362d40c2bed9caac248ebbdfa4e4fc7c" +SRC_URI[sha256sum] = "08f3d13846fdd86d4c1138a88c695cee203b3dd3825c784d64a3b06d000cdda1" PYPI_PACKAGE = "cryptography_vectors" diff --git a/meta/recipes-devtools/python/python3-cryptography.bb b/meta/recipes-devtools/python/python3-cryptography.bb index 42e8c5ff19..7f9bde15d0 100644 --- a/meta/recipes-devtools/python/python3-cryptography.bb +++ b/meta/recipes-devtools/python/python3-cryptography.bb @@ -11,7 +11,7 @@ LDSHARED += "-pthread" # NOTE: Make sure to keep this recipe at the same version as python3-cryptography-vectors # Upgrade both recipes at the same time require python3-cryptography-common.inc -SRC_URI[sha256sum] = "abace499247268e3757271b2f1e244b36b06f8515cf27c4d49468fc9eb16e93d" +SRC_URI[sha256sum] = "e4cfd68c5f3e0bfdad0d38e023239b96a2fe84146481852dffbcca442c245aa5" SRC_URI += "file://0001-pyproject.toml-remove-benchmark-disable-option.patch \ file://check-memfree.py \