From patchwork Wed Sep 2 10:04:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97059 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36A51C624D5 for ; Wed, 2 Sep 2026 10:05:26 +0000 (UTC) Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9334.1788343520603711854 for ; Wed, 02 Sep 2026 03:05:20 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=EtHC1O9s; spf=pass (domain: gmail.com, ip: 209.85.216.50, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-39647aa9d52so979841a91.0 for ; Wed, 02 Sep 2026 03:05:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343520; x=1788948320; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=h6enS8Gjl5jR2WaReTZRQu4+oEFV7IviOs11sy0WnPw=; b=EtHC1O9sUMFWemWjRigy1Vi1XDoBMl1yEixQVHXeUsft1SkigSzSF+xfkdpZDaiI+J Wt4rqah+yWWvV/jIaZWOwip34epTdKA4PxYBC8bjNScHgsNFOfaOA6NpLlBj7nhxSdIL 7pNEb8DLq5LvPK6+/4U+/DYEL6vz51yMP6J9X8HhCu4MsF22LG0vai55pjN85tZkPIxm u5gtw9m66d8ttLXzu4ZNNLW5xBrn49GSQd76Mwaq4EpYNzfh/udVdsgDo1y6BLjaNeVn V8nSk8kRcRqOhldVTonge8G5t7ki8nqGDZVhExz5ttigJuTyexh4/Wh4U1m9C5ifGXai J4aw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343520; x=1788948320; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=h6enS8Gjl5jR2WaReTZRQu4+oEFV7IviOs11sy0WnPw=; b=Ac7va5ATV3JaBXdTfeArwvbMZUIgApmBEAOeObW8q86f7vO8Y5lgxX6ZJxmCKpGbJZ iuc5yBX+czArPveMbmlype04CJMj4U7IKupsSiiddyPXqpIFFwQy0sANB508s5se0AF+ 44WgeYIxl7baDFoLnblA6crsWeLtZxQ0IyAdG3vir0lobOQfn9KOtxJuRQTrJGEuAl+b DV/4PYAuBG8Ht5tcRhuyV8K6xijODk0lvq76Zr+owNR4/tKkUefKRhZxiAhqmCuFaiRC aL//AHUP/yrVFtYfEYGJcE6u1wxq8MvBH96cwTUxC49KXRwvMXkSNlGWt+syxHck55UA Cf1w== X-Gm-Message-State: AFuF++nvKL3eX1Y+RFf4laMsxbntfk//j0s5G9jM6b/0g36Fr7gQZ77c Ssaja7SHVcK8tXZt83k18UEJRw6QMJ6QlF8TQlHE2eJaE9zFCdq6lUVGDKz0+ngG X-Gm-Gg: AYBFou29fonTfU1y3OdEZlEaEtRf+73a2b/SLhmVQZePv/giO1B0nt9izugtoBN/HFB CLkn8U/5oMlftZuL0l/gAaXxXL9OfbyVyxqNTax2ATaJFoa7Xn24WQXISpgsH/8jk5meoCoQqFk rm6+MXpZJKhCAkWE0YGvE+hJGxHbmDUWg7DeM5gmoTkuWu+N+rva8oe8OVqpeny8deS2PvvaAIg aI5Bnz7ZXFvUoP2DyABBC9edN2QhKbkUxS7xxK8oSLc3Tfak40qAbMaD7kxtGeiNlVtx6OL/SGK xb0tcZrffk8Dzu2m8OwulsOqdnwucMq/Mu24+bJX/yTy+N1YoZDYT1OF5+Dh5GjP1unopSpmebW PnE3QQf43euYqtEQrwUJQxUQKOnDjHc2hVs3TJLX73qwSGnFTxzhfg4pNLBhh7C+RXC97p2dByR HILUAsMqG2DJZQ9CUXKl3tm2ZYkw3kmeKDRLxBPBUDvIxaP3b5onBCCmKkrkCIlTJuk+tS6GuLd KGR82APVIU= X-Received: by 2002:a17:90a:da8d:b0:38e:c232:9d2c with SMTP id 98e67ed59e1d1-39af57d3181mr1559300a91.2.1788343519952; Wed, 02 Sep 2026 03:05:19 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:19 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Wang Mingyu , Khem Raj , Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 1/28] libmxml: upgrade 4.0.4 -> 4.0.5 Date: Wed, 2 Sep 2026 22:04:43 +1200 Message-ID: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129632 From: Wang Mingyu Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj (cherry picked from commit 7e505c34533b265a6da539126f4b25b9c6843f40) Changelog: https://github.com/michaelrsweet/mxml/releases/tag/v4.0.5 Signed-off-by: Ankur Tyagi --- .../libmxml/{libmxml_4.0.4.bb => libmxml_4.0.5.bb} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename meta-oe/recipes-support/libmxml/{libmxml_4.0.4.bb => libmxml_4.0.5.bb} (92%) diff --git a/meta-oe/recipes-support/libmxml/libmxml_4.0.4.bb b/meta-oe/recipes-support/libmxml/libmxml_4.0.5.bb similarity index 92% rename from meta-oe/recipes-support/libmxml/libmxml_4.0.4.bb rename to meta-oe/recipes-support/libmxml/libmxml_4.0.5.bb index d692774f08..01142f6f0d 100644 --- a/meta-oe/recipes-support/libmxml/libmxml_4.0.4.bb +++ b/meta-oe/recipes-support/libmxml/libmxml_4.0.5.bb @@ -4,8 +4,8 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327" HOMEPAGE = "https://www.msweet.org/mxml/" BUGTRACKER = "https://github.com/michaelrsweet/mxml/issues" -SRC_URI = "git://github.com/michaelrsweet/mxml.git;branch=master;protocol=https" -SRCREV = "0d5afc4278d7a336d554602b951c2979c3f8f296" +SRC_URI = "git://github.com/michaelrsweet/mxml.git;branch=master;protocol=https;tag=v${PV}" +SRCREV = "18d5c7dd9c71ebc1d3f21fe1e0614300babdda84" # Package does not support out of tree builds. inherit autotools-brokensep From patchwork Wed Sep 2 10:04:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97060 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 37FB2C624D0 for ; Wed, 2 Sep 2026 10:05:26 +0000 (UTC) Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9032.1788343523292192490 for ; Wed, 02 Sep 2026 03:05:23 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=oFKWXr2q; spf=pass (domain: gmail.com, ip: 209.85.216.42, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-398a5aad413so748860a91.3 for ; Wed, 02 Sep 2026 03:05:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343523; x=1788948323; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=pfoDaQfvqXQcVLMu2Vx6363P6f7YkbQ695BN9BxgStQ=; b=oFKWXr2qFM5wHWUPRdf9soKcU8xLqNhvndB3HIrEGlwMzGgEcy9Ipi02zDL2AhDt8g rBEuELPZNYwprX8ajhi9OJUdcKRFUXHJQQM1AZy9GX9l4nyJpenJLgWpsQDLUPczJBK5 HohfKGmchc8lhBwBb7NTNzezm/lJCoPF9SuxzypgrOkaaiB4y0tD3SjsKij+lQfCgRoR PRnk+jpF/xv0UCa6pt/V+g1W7ZULGIrXm9Gsl/NgD9aVjx5OBA3ONz5arF1WxM+C0FrZ /bQzh9mrLzpLbMIaoDenCeekRrQ3n0FaAF5RxOwlwUA7Ca8gMoPO/Mjup9p7qbC+nNZ2 PpHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343523; x=1788948323; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=pfoDaQfvqXQcVLMu2Vx6363P6f7YkbQ695BN9BxgStQ=; b=KnJnAnqmA1AlIZ9wUms6ntuPRQJ1mdVp8enaPwREBs6C4OTDyH+wDDdLtLj1wWTbV+ YtxYcP0cz37V7Ag4TpR9lv3hzKO8bT6ngfDgUUznYNqFpsqWVn8quk/ZKWT0nfplMrn4 Ljdv0Ac3kbRMNgTl22AKboc8g2f74CuVHztxa1G5f9ge30uA+jx6hEF2f4HlYLbstxIu 7FdeeBLc5c5YE/9ARo/cX1ZrKOeMIOgaH/UPRq5zuE9jJAnSwUWqaAZdUDrL2v5h0eUF DBxpo9yis2pFsoSHYlgrY6TCrpQL6Y80UIWOHmcYMhq+UNn0u0WamPk/ES7/FsB99GvY B6uw== X-Gm-Message-State: AFuF++nxP7EOuhhcmD5tvjGYg/5r2QQ+ztfDdz82e+/9zMX+i5FSm6RM QDrfnPYyl7aHICOHWVIYOz3BMZhJ02UXMSsQAc+63dANdkX3OpN/0tqlprkR+0JG X-Gm-Gg: AYBFou1SQ2qn4cOjy/KhaTxiqgVU9blZuuCh5cR9I5+HyNV7+GEqtO7CFoNxCXnI0iW WxEH9HM9HWyXWok726k0Zi8JV++gYlXHLv05/5SfAEjl++btvaTMYnv7YsdIF+s/+NhHDGpcfoM EstoRj0UqsbaEtrr/xfAWzKTqNojhiI2dGUyxSyuch1nsWl1c9AXjldpEtrJ3VqY6b9HQ15H9gP 7ppeVJSszQuZQdct8moDjlWC8uggfys14Ji0vwABqU0mRY7BZkvyESgPS2Oiz2UWL15Gy6T/TUV eZD+PmzTOnWYCWTNoChO6dRycNWuTX4ba5Ou7O9BGCWDa/4q9lM7eeSEwjyMuk4BzP8xk75s71S QZzyub8ZpwY0Yf7/i0wiXAUxyhZq47TLo5bhDQ7m6eklx5/mweB3pfECHSQBKLXetdWLD11obDR 7dNli7wuXii3CpP7IUqj+6ytCNM+2epKuU3QpSxfAe2blO/sTFU3OaJOuwUS7Pq1VSReTz99T1 X-Received: by 2002:a17:90a:ec85:b0:395:5f43:4ec4 with SMTP id 98e67ed59e1d1-39aedc3b980mr5625380a91.0.1788343522510; Wed, 02 Sep 2026 03:05:22 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:22 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-oe][wrynose][PATCH 2/28] asyncmqtt: upgrade 10.3.0 -> 10.3.1 Date: Wed, 2 Sep 2026 22:04:44 +1200 Message-ID: <20260902100511.2105916-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129633 From: Ankur Tyagi Changelog: https://github.com/redboltz/async_mqtt/releases/tag/10.3.1 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 965ab7088da70d00d648216f54dbee88074cebe8) Signed-off-by: Ankur Tyagi --- .../asyncmqtt/{asyncmqtt_10.3.0.bb => asyncmqtt_10.3.1.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-connectivity/asyncmqtt/{asyncmqtt_10.3.0.bb => asyncmqtt_10.3.1.bb} (87%) diff --git a/meta-oe/recipes-connectivity/asyncmqtt/asyncmqtt_10.3.0.bb b/meta-oe/recipes-connectivity/asyncmqtt/asyncmqtt_10.3.1.bb similarity index 87% rename from meta-oe/recipes-connectivity/asyncmqtt/asyncmqtt_10.3.0.bb rename to meta-oe/recipes-connectivity/asyncmqtt/asyncmqtt_10.3.1.bb index 0e1e155356..ffa559e39e 100644 --- a/meta-oe/recipes-connectivity/asyncmqtt/asyncmqtt_10.3.0.bb +++ b/meta-oe/recipes-connectivity/asyncmqtt/asyncmqtt_10.3.1.bb @@ -7,7 +7,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=e4224ccaecb14d942c71d31bef20d78c" CVE_PRODUCT = "async_mqtt" SRC_URI = "git://github.com/redboltz/async_mqtt;protocol=http;branch=main;protocol=https;tag=${PV}" -SRCREV = "7129d72c1b9adf159bc506206df3fb422bb9fb84" +SRCREV = "0adc511b85358397d8ebb27c10f1ab62da3e3e05" DEPENDS = "openssl boost" From patchwork Wed Sep 2 10:04:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97063 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50843C624D5 for ; Wed, 2 Sep 2026 10:05:36 +0000 (UTC) Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9034.1788343526119500897 for ; Wed, 02 Sep 2026 03:05:26 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=saEI/z3n; spf=pass (domain: gmail.com, ip: 209.85.216.44, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-398b3c37877so1200862a91.0 for ; Wed, 02 Sep 2026 03:05:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343525; x=1788948325; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2zdgf9kYUj5tmmh2snFPdltnLBIA1hxRCkTabCggHR0=; b=saEI/z3nAt3dVNFMtU+i5cV5XAHVTR5MYEamE5l9jAg+B2wyre0cAuiZhum4/Qjleu 5JLvL0yZzXOTKHdYH/SlTyxTcChO7PLwx56hjKiJupAyypz/cfxszkoOboI88Tz9Vkqr 7feF6laMcnXd6+zA08hyb9qDRmo1rp4K15uAnlUKN2zstrIGPTJjN77dRCyek/KV+9MK zn/dS+2YsGig4wp7RT4fc7Glmx8k1X4KBnhLOiLT/h+YTa6TpLj8UM0adstLnH0JnWAN i8+ts+T0X0ZpluA29X2m0jfIiID5xS+JPy4hGwycPbc4HZswvjfR1t3sEe++UqRjdCqM m8nA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343525; x=1788948325; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=2zdgf9kYUj5tmmh2snFPdltnLBIA1hxRCkTabCggHR0=; b=UnRhgUohCFzu6vo7rXqIBtjX+n1Gdj/8YpAzbwKR1V53GbY9CFl7Y+KAGavRpTgHPv 89yG3RwMWV3K5DGaUeU2oKIlJmu4d2LPK9+3pyjlY5UsyRFLowi1qIdu9XW62O82hjK3 fHnv+dEWIjKCIzqakWGMJdbLxzff/gNaQ4Qd9FtZZMXQAgTWOcwgfkN33ppbgfJr7oma R1ShlAd4ScP4CJZoSif7m8e08huylAUw4Gy1Ys99woUJD/r448yi01AoiXs9j6cBWg3o T/6aYf2Cdxd0sXDduYKtQfBYCQPn8gGnJuSzgka1CYSNnfGyC1rUi1Y/cvGLFtH0jQNF NRJw== X-Gm-Message-State: AFuF++lLuw9XQqthJlMf9BCyv2m1xNuWYviErl+ge82/UnWEBZG7POKj LsPwiGd+h3YcicdUk3T1fyVvE0HxUaHicI70E4UlmiyxIzNOdhnGFYa4YtnkucC/ X-Gm-Gg: AYBFou3XEek8gkhU2FM8KGBykE/9q7TihNcHZvYpUqOtMQhtsHS+QMrLtzoWg3TWefB 5agFGET4PQ4/RE+H4XlRRclkJFGYgNs2Z8qFpVYlvI5qf5mja0EZEjBiWAvqFAsIPC4CPsUzUX7 i93Hei1iSChQkATbSue4E7eZLg3QYktH8iJQi0PZk9dAxbNYn/GIhM4od3+zoWbZPZoMy/PuL1I OpZslSpEHjpfgJot9LKnuQs6OrT6k9rHmRZDHe1E/GhBpnQ3Gu/QUy1LHKuIWEM61NJS+SW8NYY Ow5/GFFz4U1ro16E6Y/5vx+PABB4bynEfJMvT7/B0YKxVjd7V6itDZOGdEjLovdwBLK8yuTeb4s iB9y6ExQPJhpsYDWKHsisops+qKZNzRaapyFbuD3ltPL7LrbhcdYllP4iEFzLWlP425bhkay1nV dmOBwvQGkEpiV4wEVshpB5m/XF0rt04sLLN3KojowJcOd7nd2d+7YZGcWzEiNffoiGt5evfAMu X-Received: by 2002:a17:90b:28cd:b0:398:e96a:8999 with SMTP id 98e67ed59e1d1-39aee0e6633mr5457449a91.16.1788343525406; Wed, 02 Sep 2026 03:05:25 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:25 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Jason Schonberg , Khem Raj , Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 3/28] php: upgrade 8.5.9 -> 8.5.10 Date: Wed, 2 Sep 2026 22:04:45 +1200 Message-ID: <20260902100511.2105916-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129634 From: Jason Schonberg This is a bug fix release. Changelog: https://www.php.net/ChangeLog-8.php#8.5.10 Signed-off-by: Jason Schonberg Signed-off-by: Khem Raj (cherry picked from commit e5f8c8d53a49cc881dff5ce973fc21752bb50726) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-devtools/php/{php_8.5.9.bb => php_8.5.10.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-devtools/php/{php_8.5.9.bb => php_8.5.10.bb} (99%) diff --git a/meta-oe/recipes-devtools/php/php_8.5.9.bb b/meta-oe/recipes-devtools/php/php_8.5.10.bb similarity index 99% rename from meta-oe/recipes-devtools/php/php_8.5.9.bb rename to meta-oe/recipes-devtools/php/php_8.5.10.bb index bc249fd0d3..aab18777c7 100644 --- a/meta-oe/recipes-devtools/php/php_8.5.9.bb +++ b/meta-oe/recipes-devtools/php/php_8.5.10.bb @@ -32,7 +32,7 @@ UPSTREAM_CHECK_REGEX = "releases/tag/php-(?P\d+(\.\d+)+)" S = "${UNPACKDIR}/php-${PV}" -SRC_URI[sha256sum] = "703c082ad9d2946ac647f3596812300d2c62b360d2f31a999021692a9b39476c" +SRC_URI[sha256sum] = "d79bd4f3a9248e5cb5833766ba0d51cd35dd01b8727f23f30bcdba6fabc51d3e" CVE_STATUS_GROUPS += "CVE_STATUS_PHP" CVE_STATUS_PHP[status] = "fixed-version: The name of this product is exactly the same as github.com/emlog/emlog. CVE can be safely ignored." From patchwork Wed Sep 2 10:04:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97062 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25448C624D0 for ; Wed, 2 Sep 2026 10:05:36 +0000 (UTC) Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9336.1788343528823856887 for ; Wed, 02 Sep 2026 03:05:28 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=rt1cYGcB; spf=pass (domain: gmail.com, ip: 209.85.215.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-ca12086c06eso719351a12.0 for ; Wed, 02 Sep 2026 03:05:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343528; x=1788948328; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=n/lamRA8E4r4uT6kZQuydpvY62itbZPxjzpYwKDjY3c=; b=rt1cYGcBbZkwfy5GUo9DPNxoKwA6pfk0w10q/7AdQ8Pm04m9Hqc25QFDXTlOrD4B2I MkbJAcQ2R0GNW5W66ssuCdYXkIT80nyaMIxFmJJ7+BtJkoEbew8Mvj8w7P4/7seHcXm5 uoXk1vRkg5cpjHKt7OUI8s+MytwftC+FmRX+buj+tp2XlMD5M/8faA8YlszVoBSQJBen s7YsZzALIZA1YJNEIdi/YZOvv+7XWG9e0wZdS9726SBavfUsU0IKjqfPrbrQCnD3klIk J8R60JWHu4zgMtnNEA/ZtQySn8GqTTnqehjE9oRGDZT7m+ucab4Wc9C24ue45D8Hne1m v1tg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343528; x=1788948328; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=n/lamRA8E4r4uT6kZQuydpvY62itbZPxjzpYwKDjY3c=; b=NJYlbMh47joaebM3PB5I24P46aWzaUSXtE1mXoYxTdsA8c7MObVg6RmXyOQmcD4O8e AiZS8tThwuhiH8rkHBkjHAdgz0TQCtrpPt5brsBzXe8hdNbnBg1WOD5abb84xdjyQmKm 1DJllVfYZUUL77T863N3X/IvQsZyvMEIlvWBImnN1dAW36oKG7btGK1dh/h1yhQEgvGr vjWQa1G7Jt9PnigZC4IU2TUQXxeFOygn+yfNl663YpDoMAYGfV7t0z+ynYzURU6cYNj1 4Vrze3/PqfChEOHYoURnQMAqrchlbpkZajQ88bnP3NQctPiaYZjgF/xDvFZqqZJESM85 Ktcw== X-Gm-Message-State: AFuF++kbhd+KKl/M8sIgVOMcD70QxtPVz6hRWjEK1YpjlSHRM6851avm BjvtQAs/QWRsn76xC7Pf29k/Dh/wCYredt72TglgsB5EQkuiKKkHJJMiusJX5gEG X-Gm-Gg: AYBFou3E7fhRAnMe2J2sp0DXoMx2EvEecRsHXSy5JzAJoJm4TOy4faqwoST9stV1WpF ej6NnNHjN/2eaIuZIJgqG1pgT43JN6Y9/7HOFy02CVC3weZZJxLPoYvfzZ6d8MYfz/0MW1VBLLT A42sNAxqF6rm18ZrQA7wzkHRNtge10cao8dZ5aiEl3FtwqDqPcUfGihRFTRO8HUm8qoBs6f+SBp BSOxjPdu553b58gwlmYpB/SqdFX+Do6kOZFCWAZxe3qRrV4uFqXXV0GOWMKyieFiAKfb9KqwjCz EQkFz69YAJFtlatiC/7CJCghB/bA+a/uwXFDYd+RQvMOq/K+qid/zGChPtKanKTP8Db9CAGoFm6 rQmj0iYipc1IVP+/MlgFSitb1pvgZT0xHKahtTDbHoP3R/QX4CAxj5zFS0Mv+98/4u9MC/EGlsw J4vL06SkaZ/BRWCYSXmJ9PEU6Y3uAmGbkN9Ukeghi/jYKUKFU4vE9lhgIcA7tWtskWoo2fEmF5 X-Received: by 2002:a17:90b:4d87:b0:398:e436:370 with SMTP id 98e67ed59e1d1-39aedf66692mr4646663a91.2.1788343528057; Wed, 02 Sep 2026 03:05:28 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:27 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-networking][wrynose][PATCH 4/28] proftpd: upgrade 1.3.9c -> 1.3.9d Date: Wed, 2 Sep 2026 22:04:46 +1200 Message-ID: <20260902100511.2105916-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129635 From: Ankur Tyagi Changelog: https://github.com/proftpd/proftpd/blob/v1.3.9d/NEWS Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit f4b73e8ec1c5cbeac6a1cea104db3a30dadb41e3) Signed-off-by: Ankur Tyagi --- .../proftpd/{proftpd_1.3.9c.bb => proftpd_1.3.9d.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-networking/recipes-daemons/proftpd/{proftpd_1.3.9c.bb => proftpd_1.3.9d.bb} (99%) diff --git a/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9c.bb b/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb similarity index 99% rename from meta-networking/recipes-daemons/proftpd/proftpd_1.3.9c.bb rename to meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb index 95c9f3919c..8172ba3018 100644 --- a/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9c.bb +++ b/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb @@ -4,7 +4,7 @@ HOMEPAGE = "http://www.proftpd.org" LICENSE = "GPL-2.0-or-later" LIC_FILES_CHKSUM = "file://COPYING;md5=fb0d1484d11915fa88a6a7702f1dc184" -SRCREV = "78a1bea439969913d7002bfb16ee7f0f60e262b4" +SRCREV = "f59f248e26bdfa514443e42bf72a145641df635d" BRANCH = "1.3.9" SRC_URI = "git://github.com/proftpd/proftpd.git;branch=${BRANCH};protocol=https;tag=v${PV} \ From patchwork Wed Sep 2 10:04:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97064 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C97DC624D6 for ; Wed, 2 Sep 2026 10:05:36 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9338.1788343531796709003 for ; Wed, 02 Sep 2026 03:05:31 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=WMaGdqjX; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2d942c7cc2fso6834395ad.3 for ; Wed, 02 Sep 2026 03:05:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343531; x=1788948331; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8PRjE9P1KqSmH0O/CTCwAM6Ze80jNcv1SlYbDteEtbs=; b=WMaGdqjXbul+SZ4db0/5/X7AIyC5bEUCQbG6B/lvgb5bxyCSjXryARgHIjN1NuMy2n nHE62iFRi9AWUbWWwOCzI8ansSLyH1T/n6YaZ2J7Up9JgAg33W/dWkgFaWuKBlksV8go 6nmWoke/ERHrpkQCrnZ3MZqEKdGQaKxGheY1N6kBNt5fgVggFdjo/9UQDOQ+o0UWavtZ BumEqJrgdVFV1IHvKrkR/QvDZ+le6CQs8W/lvtj3cjPAK4sitqGWo5Sw3C+WfWs01RYx fnas+O+AclmzkvVbuLtR8FByok0Q/HEwa8DnxHDR5Myl49bWMQJ2JtRHNt/QHw4WfIaW j9gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343531; x=1788948331; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=8PRjE9P1KqSmH0O/CTCwAM6Ze80jNcv1SlYbDteEtbs=; b=mwMZtJbbTgB8UukOivqpz2v3RoVY8NIPdqxSAoQWc/4E8Va9HT1m1njRTRgh4I3lvf SJIhmLG7stC2iKoUrs40kFBS7n2k8/WBb3vOgJG/6nJYIAPxXWFLRsjntxwK1IxfhRxq SgUuL9556C4bxh8sa6dN16tL9pipnzsM+x2dkK8Shk6jZUR3TQHgAlHhVsW/SoIxr3Jr aKzvAakzJlPs3HeY7kkPyLGjgUhlk/1UwsB2fb3r6fcPDIBVrprmOY3RShCTGKrtfUMq 96LaOJA432Q3g5JtI9VDc2me0MpkIligLa8g5A0sBJS8yq9hQD+YqF8ayS3kpFAlUBGh WJlA== X-Gm-Message-State: AFuF++nClkoLR64ZRQtt5zMdO0PVEL9LTQpVdyYJ9Wfi2SgxN24xwVJ/ BgOBkTDK6KHXPr16LtHE0MtndzxRzurgPjkAAbzVrTTGZHIrq9wUXyxkN4HlAGCK X-Gm-Gg: AYBFou2muMQQXlhULMqTFPg31rZtC+La9fSfe6VzwFIXCTb8FXr5lBPwmB/Mq0mfQSB ZO6+OibAcR2v7J3M56dH96RLlqMISl+nBozQJAQFrQJnOt3labVFJLDi6ecvsBkwkwdH+sHXsLB EoptuZJagKBLrAFink80vKLXdoYgmTx1Eh3iu+inQjheLPXzduEbVVz0Hu7d8xz8W1wm3EzQ5N9 0XyQ4Qjd2mhDRqfQbUhLkgIrCl5AKCkks5Qo6faZDBArsIKJKnE0bwQp6A2QAnH9tXP4OyAT0i6 GFQKDFyu4W1tzVq6eY/2xDnIuwa+2ePjdVFdCoMcC9zmiRC8SpyAeYiTsxUddiIdTD2gzH55zIn 1u1c3EzzL+FGA5bAXap7fZV/oOtTlr7zcVnWiwoVdLrVjhHj6VYjUixLkWWwPdaJB9/TufdAv+C XUhqGEaRaGlkxHdPnGHvJJJ9znOlrX8sxyhBWJ8iday6IwmszwyLKIriYMtKvHKSNKYowIG0Rq X-Received: by 2002:a17:90a:d44e:b0:398:ceed:6d44 with SMTP id 98e67ed59e1d1-39aee1bdb29mr5640181a91.25.1788343530922; Wed, 02 Sep 2026 03:05:30 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:30 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 5/28] capnproto: ignore CVE-2026-59704 Date: Wed, 2 Sep 2026 22:04:47 +1200 Message-ID: <20260902100511.2105916-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129636 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-59704 Fixes: WARNING: capnproto-1.4.0-r0 do_sbom_cve_check_recipe: capnproto-1.4.0: Found unpatched CVEs: CVE-2026-59704 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-devtools/capnproto/capnproto_1.4.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-devtools/capnproto/capnproto_1.4.0.bb b/meta-oe/recipes-devtools/capnproto/capnproto_1.4.0.bb index 948ff80345..a42131b6e2 100644 --- a/meta-oe/recipes-devtools/capnproto/capnproto_1.4.0.bb +++ b/meta-oe/recipes-devtools/capnproto/capnproto_1.4.0.bb @@ -32,3 +32,4 @@ BBCLASSEXTEND = "native nativesdk" CVE_STATUS[CVE-2026-32239] = "fixed-version: fixed in 1.4.0" CVE_STATUS[CVE-2026-32240] = "fixed-version: fixed in 1.4.0" +CVE_STATUS[CVE-2026-59704] = "cpe-incorrect: the vulnerability is in Cap, which is a different project" From patchwork Wed Sep 2 10:04:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97061 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15F32C61DD6 for ; Wed, 2 Sep 2026 10:05:36 +0000 (UTC) Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9340.1788343533890909958 for ; Wed, 02 Sep 2026 03:05:33 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Jkui5Lpf; spf=pass (domain: gmail.com, ip: 209.85.216.54, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-398b1e63c49so2027035a91.0 for ; Wed, 02 Sep 2026 03:05:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343533; x=1788948333; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=jGDgyQN9x+2JwhBJleGRBrk6VEpgl1RgfkWUp96un/I=; b=Jkui5LpfgZ6ghqG3R1lI8PaeczELVGB8CgZRJYAqBngXQPPXgMxZvpuTzICgasWLKo AzsxIQt3f/z7EcmW84Dj4LiOq1xMbhKqhsML8B936Uh64ZVI3HkArxVLQQjFQeQhniBb u3b0kBsngp8bDswXkLFuXttOxKnTTPn54ELf+TM+B7/uJiQxgUHpDYTUk1nL+iMwyeV8 I6nB9ua9bGtkaNU4eOTib3ogctkilvQvXelgw+6fXfICwH2yOwT7hiBci3BhkfpyN48m wskz69CGEm37HA15h6nuxZiPATwxOa2r5/9sul4JfdRvwJbHT/3XSrnJsA7uTNzG+Zop 1MjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343533; x=1788948333; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=jGDgyQN9x+2JwhBJleGRBrk6VEpgl1RgfkWUp96un/I=; b=ZyUhIWdn0XJWpbTZ5ZFAxa9TvgHZPbSVTuqMJR0ty5U2YfzBrjy0cTNFjpykfV2bQG f8I0RvX4Q5NTGLiMXgJyRQ7N/3SAIpjxrArsL4DiDyyp9fWqjRa1owS5/hyvin11+vjI qpG0qpK+Tg2+cg8s6TodDI6aGW6ncbxPTORAheQDp/cWoBb9xH6R75C7YGoCxJzN8CKz Mzn8JNNaCh+W/5SwzlfQZ9tO3MRi0Ew8do0hXvf/NKCyhyB8l8UHR6Qqpe7bMuUlwppZ p6mshUboK1Uc8vr9KLWsINhxRW/JzXVLpH4nT1d11QK/qHw/vF7LwbbNHr8k6YUdoF5D jVSg== X-Gm-Message-State: AFuF++lMSqqf1l95abgOW6XGICpwd1pMe7qwXeY/6zNjQu19VJGax9M+ gOgorF3E/GuS2+DgZEeVrxaNq/aEkiQNe3RBlYzTXt4562UmiP9fnsk+mdL9K6EV X-Gm-Gg: AYBFou0rtjxm45bFqC1Gk5bXyjNtYTqHY/YWi2DPzW2BlCGf3F5+GARiTSX+zwhj8GI hWIUS3JfQh8OYGAxdS9ImeWIfiLy5yZnWiVB+mFxc3VMF9p7YlKxVy/xhxdpxAKTqJAcj9YWts3 /M/cDA86/Jkl1Y7RBiGXRYkjNu/JLl+vzlhEZYJR/8nSk4FsOCt22UXNLo1fp9oQ2ByuyQ16dxF yd2+iaomuXw267HmLkTlXGCCkt5yQJGveDx7hHx1pJqXNFNJGXv+KMmvdNqzB7Da1eulx2cIdXU 4QAyVCsJ0i04kBcu732/R/dLSxxmQPr8Lznvwx8pfhfR+IkpTKjroZwH2SkJVVde9+kwEQNq78w z/1Rs9udy1i5+jBJDjm3HV5lzapG8fgIzI9pTU2H40AVS1Lhhcv90g10mQa6srMO1C23Zofxxfv TCVNrmhCkcxwAEkOyOs7QwZSjwTXvfKAwJGvC+iF7r/5rD5jSQa7CDovviOnlROLQnBCUfN6Uiz JOn00/ORls= X-Received: by 2002:a17:90b:5445:b0:38f:657:6823 with SMTP id 98e67ed59e1d1-39af63f7f7amr1488504a91.8.1788343533189; Wed, 02 Sep 2026 03:05:33 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:32 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 6/28] bubblewrap: mark CVE-2026-41163 patched Date: Wed, 2 Sep 2026 22:04:48 +1200 Message-ID: <20260902100511.2105916-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129637 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-41163 Fixes: WARNING: bubblewrap-0.11.2-r0 do_sbom_cve_check_recipe: bubblewrap-0.11.2: Found unpatched CVEs: CVE-2026-41163 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-security/bubblewrap/bubblewrap_0.11.2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-security/bubblewrap/bubblewrap_0.11.2.bb b/meta-oe/recipes-security/bubblewrap/bubblewrap_0.11.2.bb index 7e63435e90..c9aa04891b 100644 --- a/meta-oe/recipes-security/bubblewrap/bubblewrap_0.11.2.bb +++ b/meta-oe/recipes-security/bubblewrap/bubblewrap_0.11.2.bb @@ -23,3 +23,5 @@ PACKAGES += "${PN}-zsh-completion" FILES:${PN}-zsh-completion = "${datadir}/zsh/site-functions" BBCLASSEXTEND = "native" + +CVE_STATUS[CVE-2026-41163] = "fixed-version: fixed in 0.11.2" From patchwork Wed Sep 2 10:04:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97067 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A517AC624D6 for ; Wed, 2 Sep 2026 10:05:46 +0000 (UTC) Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9041.1788343536453253358 for ; Wed, 02 Sep 2026 03:05:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=lNWrAS0t; spf=pass (domain: gmail.com, ip: 209.85.216.49, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-38ea87caafeso808974a91.3 for ; Wed, 02 Sep 2026 03:05:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343536; x=1788948336; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ltmi//KzsLPZOEADK4gVsgHUBswTDwzzlU7/ARXqpbM=; b=lNWrAS0tLDjGO4tc2fwc0Bg42P18cbe/EH/faZSNZJ4blLtAAQpVtQs1+BtSc/AfmX k+8gyWVNDZbg2f1FIqz2nYM1NOXVGuB2z5ihXdQfdVpGBXbfj+T3ab2Fky/Mu8zKNswh nXm/ftp66s2IDABo1CnC01id4GUU26M+UY/HBaooDdrLEipw0iyg0uFfcG9ToiLc1IpK s/HZ0tHzX4kv6LBpi6annWkIaTwqggzlnNQH+OYk3sX5dVZ+XL7zPuim5Qhm/Y3YkM+R aM3tqG3qqZG5tzThAilnRWGPnl3UL1BONYWoTBeXJkY8SUMlRUIMShgnSnIEkCZsmNjm FUFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343536; x=1788948336; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ltmi//KzsLPZOEADK4gVsgHUBswTDwzzlU7/ARXqpbM=; b=suAeB+w9fDB638aMGwSMd3erA+xTfBpH144LeB3+J8T66pByL/dpg/cRspRvcTZtIi Y1HPpkL5pcVofGF4HPi6m402ph2Qo09x2L9191AN7C59DJ4zMhHijIN3jlf4bv4Y/dEg 0OFnrHO8aeq6OgVPma3r3Z53QGSX+T6NNkV/uxf+h+QH88MT3uw5bq92HbK3xQ47cOom eA3BAju/2jsQiUBveRfkVdnutN0W7QRS4mUh/IzQThR8Fex/BtrkbNRAd/Mvp1TNml05 FCFuWbuGyMjbWwusprYLJ8z/QroJvgOuGgOl2/gDrNNFrBvCiXU7lnHBBaqb4KBWSHtj uonQ== X-Gm-Message-State: AFuF++ljUNUJyBPCEXRhxZZSbqDpP069HbvyAO3ncL1OCkc+Gxzqyfc9 a3wxQxYYG1KX6sfEso8O9VnghQqrdd/0eoFtgRHRUjj0fznDiE6jSQv83giUEg== X-Gm-Gg: AYBFou2myAenRd5YS2Phvy4atkwaf5xmRenLomMqbDynUIEl8+C5biIuM3igtXk7RmX WU+Sai555CNbEBn48b4l+Py7dY35XQym5fCAMnvqT4cToKStohd8kgf35dc26bSVsssx2BHI24f sef5X0/FAuRRmSu4pDtdaaXBovDlQ+qSfadTbDT70uq7fZuRLF63PWKfAMWBGBVKsy2lQKVoVcp nipfjPeDvEfJw+ng8yHcOUKC+3ONP6HL3zt/lJ8hmsNKoGCT5s9tMkZ1Tih00kMDB5pKprosqQ9 /ruxGtdZs5XT3TiX8Tjg5vn8e2FLKWKGJdJlDs+dcs4dbOhH79N7rD1tBBoouV49gJhf+ySVvC6 O09PhW/4RirRPhEqYYJ3S8aDBYSkMu9CXJbwWzBcLIWaSeRN9o47cKc+WA7B5xqkGfnzItCeMO5 DdV2ENk7y2z0gSW2X0kem+B1/i3KZNTj/cbwQ95FjwFKqmsMQpZPJKrxRFj4UwMA5G6qEVimK4 X-Received: by 2002:a17:90b:280a:b0:38e:250b:122f with SMTP id 98e67ed59e1d1-39aee085053mr5341466a91.16.1788343535637; Wed, 02 Sep 2026 03:05:35 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:35 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 7/28] bcc: mark CVE-2024-2314 patched Date: Wed, 2 Sep 2026 22:04:49 +1200 Message-ID: <20260902100511.2105916-7-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129638 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2024-2314 Fixes: WARNING: bcc-0.36.1-r0 do_sbom_cve_check_recipe: bcc-0.36.1: Found unpatched CVEs: CVE-2024-2314 Signed-off-by: Ankur Tyagi --- .../meta-python/recipes-devtools/bcc/bcc_0.36.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.36.1.bb b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.36.1.bb index 0d8bee5da4..69f5916f94 100644 --- a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.36.1.bb +++ b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.36.1.bb @@ -95,3 +95,5 @@ COMPATIBLE_HOST = "(x86_64.*|aarch64.*|powerpc64.*|riscv64.*)-linux" # path from the test binary WARN_QA:append = "${@bb.utils.contains('PTEST_ENABLED', '1', ' buildpaths', '', d)}" ERROR_QA:remove = "${@bb.utils.contains('PTEST_ENABLED', '1', 'buildpaths', '', d)}" + +CVE_STATUS[CVE-2024-2314] = "fixed-version: fixed in 0.36.1" From patchwork Wed Sep 2 10:04:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97068 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99BE5C624D5 for ; Wed, 2 Sep 2026 10:05:46 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9043.1788343539317068438 for ; Wed, 02 Sep 2026 03:05:39 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=HXNF4aW7; spf=pass (domain: gmail.com, ip: 209.85.214.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2d8f265cbe6so7865875ad.0 for ; Wed, 02 Sep 2026 03:05:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343539; x=1788948339; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=IqHz5ECACU28SgbqRpvrTIzHNxy9JVX5gaBURBZZkL8=; b=HXNF4aW7tA84iNKSHmat/dBTyUnzEOH4abEwpcgmh8TkQ11JZoMV0gGniLIe69U2hH W98YPgMmekqxhOSuQzM6yKBw9tspIMAZTPfiBLDfDr8h6XjqV/FqwMRvxGzEifNLFs4C FOOeX9PH2PAtlITLs1BpLnJRG82REBUFgLek07h8TAnxxQTHHlgJbRnLKR4/nC9jSCIv F9/dQDUcOmjaKd3GQH+O+Ej3cHmZtu2r6PJOB+k0l27n6RlgeRcVLHcmm3v6F1FPfdML GmJ8bkelcaDFspPnLvRl5SJmm6RpZqDo30IaFjjODz79CNadidNQ8GURY6G4u+QX9a+9 HRXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343539; x=1788948339; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=IqHz5ECACU28SgbqRpvrTIzHNxy9JVX5gaBURBZZkL8=; b=GeCwz3y+BBHoqiE1fx/XN6xx2eYwjF/lT9C/dUnuXEH2Kn72jaSc2CCltMaBfGXoMy hwttL6WwIwFUGklmLMdee+WExC01EoOm3BttXrXxzSTm6W0J8S6LzhNYCv+X2SHwPzFS yiqu6wABTLZlH4OuojMm8Gu9+1q+yMWh0PfGpNZbEb0FAoG0rsxe7vTM+ZLphrsqAHwc /+5gFL0JSd3RaB+nYpp04A2fLuiqQb0TdXMAHJA7nvhsL4Y8F2iqldlwtrBgSkdHKXUj GpzqC21gX8JER+ULI3P3jfDeRRS9eb9aPKlcsef+nP88LMdv9aych3K0QADG9uBbirjE X+qA== X-Gm-Message-State: AFuF++mhCDWQc89o6DIEMuTOALyqGCXmuM96Xk8XyGbRbzosjvY74H8b 68/lN/vN3loS/8SY5uixAsPeWvKZcqbm0eSnBgBa4WMwQasuDbPRdCNH6IfiKnr8 X-Gm-Gg: AYBFou0j5f5qEO0fcbdpJ37Tc0sKtXBI/wG6jet9S521J2TDJJk1RYJfp7tPXj7y5pi 5Mkei1obVutafjYFWbhLtLqkgLin9l/47xx+udcYEP03tSC7wvNAbblUvX3dPdiPkOFnu5KpgsB EepQxtq08mYEdsrCoI1S24QephB16rbdPH1suJphuBLPwsbt9vh54PFjUt5umdyd/lvcQXsClPU 6EwvjwjaXsLGTCIGYZAhUA74m99WHhVt7plS8yy/EQ8bS5wxynkip+A/R9VnIIEjB1StsTH0F49 aq+yLbb2lKFNf2TigEhmwXY2r8mW3uURXGTv8sPm8rHXoAjOWiFbZuoBzFfltb+rUa7lOJYJgog i0UmETeNilYRaWRtMxUvpBVt/MYc8nNSD4f8izj54PeMbtpI0ZTjCPngOP3/z4Bj++TgDNlS5x2 G1XaBDj/p8U/H7LtMJ9b+iIg8Rm1e1UHJtIhCwgarWyJafgEjZAuNFarcXsJprUNIxmVBLhDlQ X-Received: by 2002:a17:90a:e7cc:b0:396:b98b:a3c2 with SMTP id 98e67ed59e1d1-39aedf1b1ecmr4843149a91.8.1788343538625; Wed, 02 Sep 2026 03:05:38 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:37 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-webserver][wrynose][PATCH 8/28] cockpit: mark CVE-2024-2947 patched Date: Wed, 2 Sep 2026 22:04:50 +1200 Message-ID: <20260902100511.2105916-8-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129639 From: Ankur Tyagi commit[1] fixing the CVE is part of the upstream version. Details: https://nvd.nist.gov/vuln/detail/cve-2024-2947 Fixes: WARNING: cockpit-352-r0 do_sbom_cve_check_recipe: cockpit-352: Found unpatched CVEs: CVE-2024-2947 [1] https://github.com/cockpit-project/cockpit/commit/9c4cc9b6df632082538b53bdc8ee9ec1c5cad4da Signed-off-by: Ankur Tyagi --- meta-webserver/recipes-webadmin/cockpit/cockpit_352.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-webserver/recipes-webadmin/cockpit/cockpit_352.bb b/meta-webserver/recipes-webadmin/cockpit/cockpit_352.bb index 6b1fdcaeb1..77156c0f85 100644 --- a/meta-webserver/recipes-webadmin/cockpit/cockpit_352.bb +++ b/meta-webserver/recipes-webadmin/cockpit/cockpit_352.bb @@ -199,3 +199,4 @@ do_install:append() { } CVE_PRODUCT = "cockpit-project:cockpit" +CVE_STATUS[CVE-2024-2947] = "fixed-version: fixed in 352" From patchwork Wed Sep 2 10:04:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97066 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7252DC61DD6 for ; Wed, 2 Sep 2026 10:05:46 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9344.1788343542396169974 for ; Wed, 02 Sep 2026 03:05:42 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=ssYrZexn; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-3990fe066ebso662412a91.1 for ; Wed, 02 Sep 2026 03:05:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343542; x=1788948342; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=rc7qwSsjaBXVljvRVfLk4XEdefaGzQx2wEW83EEgNyk=; b=ssYrZexnfLmVFeb9XvNM1PMPksLEogWwsw9G51KK9wxIBK5pOyUvHgvNouR4Lan01+ cZ0NWIE1sw2PlOr4vAgDKZKMksJnt6ZYMIHuKW5euKp9ctfq4/+fA/ZfCk54cMYw0/8s XWWKGUyGHC1yFW/q3ZlmEx5+q0FAZdw9E783yWoRsFA9Ozn9RbQjULUczIguyebUtZNq BqgKiX+0/j3xg9T6Q+9QzJnu8bn1K68RBi9SCuTAP8k265eWjFa3UfWr+RDkzOB3GS6D J2jNfgpfrkhkKlzMttMJ8puNr3tz91jfAo/EECa0Lm2pOD4BxhHuq9jVFH9M09uxjo7w 6Hmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343542; x=1788948342; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=rc7qwSsjaBXVljvRVfLk4XEdefaGzQx2wEW83EEgNyk=; b=gjonQB5GWIndtxLH5FqaC9iD7sJwGKSOeMSRctSCwIs7w14M1UUAYETtrOMnCx5gqP sHd+kh15rJe8YkdpVHpGmLmN5C6LlR6DDsRBpsCgkxNewDdyjnYLvo04/VfQVAnwtgif uc7j1MdXK7vquSaWjLQ8F6BVio1kVXydMKZnyvop1lX3Irin/bpO9vjjEQ/Edoj/AGXh QXuLSAFDIn2jiP78NhkxUuNvkUMoqqT3+8e7cucnoMAr2sEHh/Zzm3PIcwGr0ncu5zh2 hfHsGQDzbW3SSL2Vbw6/OnMGgJ1FMeJ3qjTu4awROZbTzfwtPtzxWcAfcwr/NW9V9PQ/ uBxw== X-Gm-Message-State: AFuF++leL2AgDYlvKAjlslLEy91T01pY+iYAlRixSnepDMbERe/QGlN4 3L3Y1yG5hbcz/53sy8jzZd7GA2O8pGuW+uNiGRpJF/WPFs38/V6OTPkcbgniHLie X-Gm-Gg: AYBFou3OkIPXM8qYW9HOLxpN2tEwQlbrYIBsnNdYV0sThjsHzb32McsDJSmjwmYp+Dj ZDr9cPXjyBeb+jHs4RksWoGZehZZB7hwWf/5oOcvwdABYbuRbLJ2Yjyn6B4YOjT3vbHB9bFdHOu dabPRx8vjet2kaNZ1B3DCjFfAiNvbs7ov1o4XdaUbC01JMJyKhQzmjz9WEwIPnkVmtUxYrA0QU6 w6o+Fm3wjNo0JSUIwKhy0Sk/i6wjiiZpJvzqtt2Z3dgWVNhhbK82Bl7DbMjiYB2pQ+aQpJSniZj ygKIRvacBZX3FXW96wY9s6GVAjyU7Br4hyOIsaMsBxS+7H2zpur0QFanq4RxsSiLS14ziivkzn3 tVhlP2ZuC3U/vTlMK8ZkSHrXgsi2TF3G78KricDkmhQse8BPxrQkzJ0mevfD7rJzaZv7nfR0wo0 00F2eimZ0t1C4oFuHuQA1zv/85yoVyACTMbI33aLZrsD/fKzKrDQA60BviJGO4SlMqu8vdjLG6I Q== X-Received: by 2002:a17:90a:c106:b0:380:f85c:94b4 with SMTP id 98e67ed59e1d1-39aedf1a98dmr5808550a91.7.1788343541663; Wed, 02 Sep 2026 03:05:41 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:41 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 9/28] dool: patch CVE-2026-56651 Date: Wed, 2 Sep 2026 22:04:51 +1200 Message-ID: <20260902100511.2105916-9-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129640 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-56651 Signed-off-by: Ankur Tyagi --- .../dool/dool/CVE-2026-56651.patch | 47 +++++++++++++++++++ meta-oe/recipes-support/dool/dool_1.3.8.bb | 4 +- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch diff --git a/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch b/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch new file mode 100644 index 0000000000..e367884ca9 --- /dev/null +++ b/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch @@ -0,0 +1,47 @@ +From f5eb4fbf3977d919a2e9da8b73985a29d2878e56 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Majchrowicz?= +Date: Thu, 18 Jun 2026 10:52:27 +0200 +Subject: [PATCH] Neutralize formula-prefixed CSV output +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Michał Majchrowicz +(cherry picked from commit d5aa93b3d1939a83b2b10a7cd8af3c819930aea1) + +CVE: CVE-2026-56651 +Upstream-Status: Backport [https://github.com/scottchiefbaker/dool/commit/d5aa93b3d1939a83b2b10a7cd8af3c819930aea1] +Signed-off-by: Ankur Tyagi +--- + dool | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/dool b/dool +index 634ed9d..fc1015d 100755 +--- a/dool ++++ b/dool +@@ -3030,7 +3030,10 @@ def perform(update): + + # Prep the line for the CSV file + if op.output and step == op.delay: +- oline = oline + o.showcsv() + o.showcsvend(totlist, vislist) ++ csv_cell = o.showcsv() ++ if o.type == 's' and len(o.vars) == 1: ++ csv_cell = csv_quote_string_cell(csv_cell) ++ oline = oline + csv_cell + o.showcsvend(totlist, vislist) + + ### Put the output in the csv file + if op.output and step == op.delay: +@@ -3170,6 +3173,12 @@ def file_slurp(filename, size = -1): + + return ret + ++def csv_quote_string_cell(text): ++ "Quote free-form CSV string cells and neutralize spreadsheet formulas" ++ if text and text[0] in ('=', '+', '-', '@'): ++ text = "'" + text ++ return '"' + text.replace('"', '""') + '"' ++ + # Make human readable device names that are shorter + # + # Example mappings: diff --git a/meta-oe/recipes-support/dool/dool_1.3.8.bb b/meta-oe/recipes-support/dool/dool_1.3.8.bb index 1c7350e871..787bdab4f2 100644 --- a/meta-oe/recipes-support/dool/dool_1.3.8.bb +++ b/meta-oe/recipes-support/dool/dool_1.3.8.bb @@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=1ebbd3e34237af26da5dc08a4e440464" DEPENDS += "asciidoc-native xmlto-native" RDEPENDS:${PN} += "python3-core python3-misc python3-resource python3-shell python3-six python3-unixadmin" -SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV}" +SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV} \ + file://CVE-2026-56651.patch \ +" SRCREV = "b74503e2dfbca8ef01c284d40aa77dc82be308b9" From patchwork Wed Sep 2 10:04:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97065 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8CD54C624D0 for ; Wed, 2 Sep 2026 10:05:46 +0000 (UTC) Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9046.1788343544824035419 for ; Wed, 02 Sep 2026 03:05:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=XFfmbEe/; spf=pass (domain: gmail.com, ip: 209.85.216.48, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-39927410578so1605359a91.1 for ; Wed, 02 Sep 2026 03:05:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343544; x=1788948344; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=cyhuJzR9tpyIrcVpxZE/T8XLLTSJEu2KdUKtFnLTKcg=; b=XFfmbEe/TCXtGDTjbhMOMvIqHvtaJS9LUTcPSJ8lsfgD7FqoV/rj+DmZ1LfFr8vwXB GpjX1q71p4YNVVhu8GeLCGZW4XZG06v5CMyNk97KahJT9x/w554wm/3mnKgqF8Mg4T5e 4LdDnnwnTXQ5qN6LjQS6GO0JHF/ckN6yKKEXhYWQXg4T9kDDYPfWct9PzeVroOloHKyW 8uwtzR+0nY4ZxZqu08IOrTwmoMzPCCUIJXG5oUgE9VDDV0SsVVkNn13kscZC5SlmQP34 Ut4uMKhdid9TkyAauA7CMrK1/Q4uy+EpDzHwCrlogxsjJ9u9MqYV/uXL+pmWoS7M4KIL Okcg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343544; x=1788948344; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=cyhuJzR9tpyIrcVpxZE/T8XLLTSJEu2KdUKtFnLTKcg=; b=YSYuAEAV+9EkfEW47f/fC5nRP8ffm2PsyzHgc6+kWrn5a0Tc6oW/B0PYM9V/xEUBbm 9M9qtnD6++5jgtMaSwD16tvL0BcE6NaaUKYkuw9E5sulIt7U+0GMFy00tktt5ELXyCGj 4mXcfIzOCgqKnIw5OLUN+Pu4dXxittzaz3GCe4rdTQyqH721o68Vxl4K7I2Lx5tn/7bO IzMN8sd0a6lQIn0JwrukNZbAInyMfwgRzdK8q7NyqX0oQkDP66otVTucVyMdXElLQs3h D88mg6sKB+/hiYmOai0ruKk39121urxoujJfi4iYfOL1hAg0JCHRtoC81WrJtvH4I2dY ACwA== X-Gm-Message-State: AFuF++lY5illboo+OdtrfL68CrZVK+oxGUrJBSogPfFLg806YNXRo/KB KJwLHtkg6MLVc9mXaN0dX4EAMS536qhfj0kRnZuRAvmc7FsIa1dUjy+B9bW2D8vP X-Gm-Gg: AYBFou32n/y3dV2fAR0plnOPw8gRsNUM+yuOLojlKsia6nunhuoSpTOcGfxYWcHaPPZ YVTiNAkyLXp7edGRtiTQy0oknKrGqFSXODCqhdvhRlmLcOXpJugvPJ2P0YTJbHLDlxz6Yyyr5sr ca2lXf5nyjVn9Sbwq/mEtxSKXRCU0+Gy5jsG3hU+63nL7RlSbplhggTr+QNIKDHffM+LuvmizoV 5+YxkICB6fT5xGtODj55utvV6t7FUM5hjwgBXibkAtR2poFgYMSxISVn62Aj2ixy3AlwAOuBO7z elL1cbwI13Wc/GuM61ZZssmSomfFD4JbIs/ABcDGFJAAaUne7KPOrE76cxw3cNws7cDQuLYVa39 WVIduEg9SxR8OjtcuOuxucGwuR89l4XPAaUfPdCAuWl5vL493DLU3oJjEGZqIyqD2s9ZQUX0+Dc UAHw13+h7uuGRwB8H8+ibAoRuq/92PU5BcicwngYfRB00Bcdh1rmDZD16QaE1OjJn7XxFxfii0 X-Received: by 2002:a17:90b:4407:b0:398:9bd4:d13 with SMTP id 98e67ed59e1d1-39aee219427mr5412151a91.18.1788343544101; Wed, 02 Sep 2026 03:05:44 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:43 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 10/28] dool: patch CVE-2026-56652 Date: Wed, 2 Sep 2026 22:04:52 +1200 Message-ID: <20260902100511.2105916-10-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129641 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-56652 Signed-off-by: Ankur Tyagi --- .../dool/dool/CVE-2026-56652.patch | 35 +++++++++++++++++++ meta-oe/recipes-support/dool/dool_1.3.8.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch diff --git a/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch b/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch new file mode 100644 index 0000000000..c6806ae0c5 --- /dev/null +++ b/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch @@ -0,0 +1,35 @@ +From d20ba041a0f4968fdbc2745827f9af676339924f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Majchrowicz?= +Date: Thu, 18 Jun 2026 19:20:30 +0200 +Subject: [PATCH] Refuse symlinked devel log files +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Michał Majchrowicz +(cherry picked from commit 259fe40c7fa519020ef7a3f8ef8d61586b72ecc3) + +CVE: CVE-2026-56652 +Upstream-Status: Backport [https://github.com/scottchiefbaker/dool/commit/259fe40c7fa519020ef7a3f8ef8d61586b72ecc3] +Signed-off-by: Ankur Tyagi +--- + dool | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/dool b/dool +index fc1015d..2df407d 100755 +--- a/dool ++++ b/dool +@@ -2132,7 +2132,11 @@ def devel_log(msg): + if not DEBUG_FH: + log_file = "/tmp/dool-devel.log" + print("Writing devel log: '%s'" % log_file) +- DEBUG_FH = open(log_file, "w", 1) ++ flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC ++ if hasattr(os, 'O_NOFOLLOW'): ++ flags |= os.O_NOFOLLOW ++ fd = os.open(log_file, flags, 0o600) ++ DEBUG_FH = os.fdopen(fd, "w", 1) + + # Print out the header line for the devel log + DEBUG_FH.write("|Time |Since Prev |Description|\n"); diff --git a/meta-oe/recipes-support/dool/dool_1.3.8.bb b/meta-oe/recipes-support/dool/dool_1.3.8.bb index 787bdab4f2..2ab20a12e0 100644 --- a/meta-oe/recipes-support/dool/dool_1.3.8.bb +++ b/meta-oe/recipes-support/dool/dool_1.3.8.bb @@ -11,6 +11,7 @@ RDEPENDS:${PN} += "python3-core python3-misc python3-resource python3-shell pyth SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV} \ file://CVE-2026-56651.patch \ + file://CVE-2026-56652.patch \ " SRCREV = "b74503e2dfbca8ef01c284d40aa77dc82be308b9" From patchwork Wed Sep 2 10:04:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97071 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9F62C624D7 for ; Wed, 2 Sep 2026 10:05:56 +0000 (UTC) Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9349.1788343547709249339 for ; Wed, 02 Sep 2026 03:05:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=AmSvpIxM; spf=pass (domain: gmail.com, ip: 209.85.216.54, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-3964dfb5b9aso1074231a91.1 for ; Wed, 02 Sep 2026 03:05:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343547; x=1788948347; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Y8zVPyoCBe+vl7KXLE+AA8t7aRK1svBx1A08i3bRO7c=; b=AmSvpIxMRGbI2WEmwfyzog7+C8PJTNUpkSh1daW1Wkkg3j+sSg8kfGbmAmuPBBuUX6 acLIr4k/ELm9W0aHGYS/MbFu0ubOTzC3uAaeySZ9DhPX8eo+7FqGV+63gVI6+ySaaH77 eToy/sO1is9z9d55YbPPxmmuqKeLi5FjjWtnJ/6nrHwZUzEsbImMrPQnuFRXLskIy3J4 OSh698xoT9H2V4N8G0S0aVWvrpqE6SvWb8uKScKKqJZQXc9FkQucseC3jckIhvqWFz64 tcgnrXyc1+SChLwI4kxk8E4oe+/N0RH9SVSnoFyu21zbyGOIDgTii0MHP17ej6q1+8ej Oi0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343547; x=1788948347; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Y8zVPyoCBe+vl7KXLE+AA8t7aRK1svBx1A08i3bRO7c=; b=oHKURri4GpO8ihS0SZN9wmGyGhHIAXzIpUx2ebrqZIr3Muhb12PUvpDovf7vntlu+b 2lAYJASoXC8xBOPE/g6ph04gdeYfdGt56wxqYXXVKfFVb8/oN4ahAD3LmWVlSdBlaFAX pSjs96URd0K9OY/TeIzWAlMpe7f4M4WhvcISUQS0sXUfIkQ+TaU/GJjomgnC7M5Z9BNb ucyhnFH/DkMJPcWm1lvhKLjkyv7S4apI3oHgy4q75aoPG5KE+Sg2SK39G9rqfzJjlyiR Y/bHzl/rUpHQ50ShHrb7bR+nOiY1nGOUy1xqd+O4N2bNqLBkhM8pa0jyLRZj1/liOz+S ipWQ== X-Gm-Message-State: AFuF++ndkTy3Z4o9H0jbM/QMCLbJjVQThRW9zDS/wmjbNdws2Z2WW4tW sUc9Jrj6HGyUOBueVp33dQMn6L7hMiR0VibEip5K53T6+MCU6EBKn3z2xHH18g== X-Gm-Gg: AYBFou00nOn2Q0nft69rwRGh16hsisjGf32XzP8M8LFYPZFIxtdw9kUOW1e5VxbCJDH D7KiNf6HRZorpmQoaxfHHrxG/BolQr4k0Rn2ncauOT8J6sA8uORfLn5k9XxcvqrtVl1Mu71c+vZ c0qoCgCH2mq38dcsJtkzuebS3Qj56nFW3H1KeJrOlcqEcWxgQkr9gtb5L8+wuOvUz4c8DFmaX3K GVhutj0z2EKVFLIj7rJLWN30cW7bw6SRS3KnAickVMiUnci/LwgL/Q03pceYIhnSxOO3CZNAQN3 Bx9mEB9R4wnlf5ya3myA1A8AcbvHPQ+pvd+579kaLdOhGdG4hkVXUXHIl277vXXpz/YaE1HWhv6 gvTGmSz4M0l8dBbIOzvQEJPsqbERvwijY7HdY0IMIgbuqqq4YHQcDPrd+hKPInZE7hmjDxSdk4e pTidinn3j6wkkCWDm3C613x2V4HjpniJzE9pp7xlsBdHIgN7CRO5j4vFXROEcgSRy1g7mlUSTjw +/NzSEM9Hc= X-Received: by 2002:a17:90b:2649:b0:398:d6e6:4671 with SMTP id 98e67ed59e1d1-39aee249be6mr5290460a91.25.1788343547038; Wed, 02 Sep 2026 03:05:47 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:46 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][wrynose][PATCH 11/28] dovecot: ignore already fixed CVEs Date: Wed, 2 Sep 2026 22:04:53 +1200 Message-ID: <20260902100511.2105916-11-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129642 From: Ankur Tyagi Upstream has confirmed that these vulnerabilities are fixed, and Debian has also identified the relevant commits: CVE-2025-59028: https://security-tracker.debian.org/tracker/CVE-2025-59028 CVE-2025-59032: https://security-tracker.debian.org/tracker/CVE-2025-59032 CVE-2026-27859: https://security-tracker.debian.org/tracker/CVE-2026-27859 CVE-2026-27851: https://security-tracker.debian.org/tracker/CVE-2026-27851 CVE-2026-33603: https://security-tracker.debian.org/tracker/CVE-2026-33603 CVE-2026-40016: https://security-tracker.debian.org/tracker/CVE-2026-40016 CVE-2026-40020: https://security-tracker.debian.org/tracker/CVE-2026-40020 CVE-2026-42006: https://security-tracker.debian.org/tracker/CVE-2026-42006 Signed-off-by: Ankur Tyagi --- meta-networking/recipes-support/dovecot/dovecot_2.4.4.bb | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.4.4.bb b/meta-networking/recipes-support/dovecot/dovecot_2.4.4.bb index 6cac8de964..1edb8f50e3 100644 --- a/meta-networking/recipes-support/dovecot/dovecot_2.4.4.bb +++ b/meta-networking/recipes-support/dovecot/dovecot_2.4.4.bb @@ -86,3 +86,11 @@ CVE_STATUS[CVE-2026-0394] = "fixed-version: fixed since v2.4.1" CVE_STATUS[CVE-2026-24031] = "fixed-version: fixed since v2.4.3" CVE_STATUS[CVE-2026-27855] = "fixed-version: fixed since v2.4.3" CVE_STATUS[CVE-2026-27860] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2025-59028] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2025-59032] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2026-27859] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2026-27851] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-33603] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-40016] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-40020] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-42006] = "fixed-version: fixed in v2.4.4" From patchwork Wed Sep 2 10:04:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97072 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D955AC624D5 for ; Wed, 2 Sep 2026 10:05:56 +0000 (UTC) Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9048.1788343550103889938 for ; Wed, 02 Sep 2026 03:05:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=EEaris+f; spf=pass (domain: gmail.com, ip: 209.85.216.45, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-395cf2535acso901547a91.1 for ; Wed, 02 Sep 2026 03:05:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343549; x=1788948349; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ebLzq8rc+HLstywSNHPN8Nyy4yij8Bmj1sL1+pbwvKQ=; b=EEaris+flmZ+5smSMngmp8vdqq5tQchl2+1lXLaAbIsxJpkXF3f+oM9WlWVAeioskK VX50iNa0XeL/US2HxO6R1O2qjq0YkhflBF4HzMw7G0Qe17J245UxyYgWaVg2XFw863fK d12/F9+/7XjxV1/TzciUCKquOWDyJ4AsB0VlyYkWz2ceMM0AZqGy+x/FEMUtxMcNoUZM ESP5//oRGo+QBr/RvZTFq6UQV+DmuncMJF1mBhTVFEQLwG3kZv3xzj7P+ZKmEmjKZGyy dVdQK+AXGx6hXG2qxlyREkzzNQTwUzwF+FSN7bHR5pbrQYCTitVfKWUp9yEg9b0nGzQf PZ0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343549; x=1788948349; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ebLzq8rc+HLstywSNHPN8Nyy4yij8Bmj1sL1+pbwvKQ=; b=mNDPovCLa4WTC73AEpdUdTLRWwx0bZQ9K5d5EE8eqqET7hLfPJH4ueI0zJ5VUVGlql fXtBy5mAo4CMCK6Wy2dgkBaR37LkzeWSoaVAEl+95+vM0tdcxAyddaNKAd0o/zw2t9Gu eE/dAHCHOfggmQ+Ud3o4mdfFw5IxQ2UOL1ZHWwSiodlx2DhH9w6dYihhbiP3KDfmpSmH P4V35sp18P0uMNpntZ26cqGgdjsV/WsDRNSEvKowVgdD603xjTRMWb+hChIDdqItJEy5 FTY1yUCQTIFbRRKQnSThO9UdS54/TXxbK4wdhn/i0sLO3np0+Tp+1o4Ks5+mhateqLRb 4LUg== X-Gm-Message-State: AFuF++mYZ/N9upuNm0PklicV5k9Wqn5jl5FYGcignU/wEWBWVBj8C2Qg CBCeIBWbPzF0YVkrxx0kBqOFTbS00JHiTDNiaxCp9VL+EqyA9DPDO6MjZjSwhw== X-Gm-Gg: AYBFou013QZ6W1Yvb/zTxYz3fg0KolbvQG++F52B3cuKF/JBWe4MDA7P6zOP+POEvKq N/Lmt7QVln/K14j4ZIVuZlsJOCsaZILQ44ZBdfwhSgatm/U9MEpVPcLedc9z4SW3CcPv6t1e3py rUFyAL7F3kqDyG4XBzX+JYNvwJylIjb7D1S11u7p6oC6yyrkFjn5dWX/yGj4kJ8ZsYcWaWgDW1i uT6IR43QtvL1E3bA8fW44AVeiHWFQH4vOLy4X5Ag+M2MGo+rCRmOWYzyFvkpMaJdtcMsdydmo+q LC95Je5/dcWld+cYKKu/36/PHEMl0Gbc8m9b5B4/LRS223u0jgZnnsvARC9SUwSKxwSy2dAZlO/ zfn/cOX67jF4voSuACBiI+WK91clG3A7/va5RIQBOdsFDyzz2lumj3LCMiudBoI+C4Cz7QtEZqH gI8mjElBBp3BsCL6MNYGqdPTYtxtwdUi95fsul8N94LIGKr8niHamkflC7fJ6sfAIDis0d0B0E X-Received: by 2002:a17:90b:5445:b0:38f:657:6823 with SMTP id 98e67ed59e1d1-39af63f7f7amr1489730a91.8.1788343549383; Wed, 02 Sep 2026 03:05:49 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:49 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 12/28] editorconfig-core-c: ignore CVE-2024-53849 Date: Wed, 2 Sep 2026 22:04:54 +1200 Message-ID: <20260902100511.2105916-12-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129643 From: Ankur Tyagi PR[1] mentioned in the NVD[2] is already part of the upstream version. [1] https://github.com/editorconfig/editorconfig-core-c/pull/103 [2] https://nvd.nist.gov/vuln/detail/cve-2024-53849 Signed-off-by: Ankur Tyagi --- .../recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb index c6db2ef38c..319c1724c0 100644 --- a/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb +++ b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb @@ -15,3 +15,5 @@ DEPENDS = "pcre2" do_install:append() { sed -i -e 's|${STAGING_DIR_HOST}||g' ${D}${libdir}/cmake/EditorConfig/EditorConfigTargets.cmake } + +CVE_STATUS[CVE-2024-53849] = "fixed-version: fixed since v0.12.7" From patchwork Wed Sep 2 10:04:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97070 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE6FDC624D0 for ; Wed, 2 Sep 2026 10:05:56 +0000 (UTC) Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9051.1788343552431088292 for ; Wed, 02 Sep 2026 03:05:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=cO4GlwQr; spf=pass (domain: gmail.com, ip: 209.85.216.53, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-3964dfb5b9aso1074313a91.1 for ; Wed, 02 Sep 2026 03:05:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343552; x=1788948352; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4o99LDLQvCP6InGqJmy0+x4rInCYHJPoPzbB/aJo+WI=; b=cO4GlwQrFptaZVm/FbtZackcAosP7E49XYa6iCzhShaCg7KpLlCvjc6b7yixuW9uDy 0CF7V3DhSk/U9dALMVlOdwycFJBjTrmhZhIx2pkmlPJw/+TfD74RoNKbk9LxsiAjSdrD z3pXMfwkY+cNk/9MFY1UvzckRmHfwwc0xA8tuPp/o80TzAhoKtYUOF4ey96L4rnll1Wk OMi6DS82ilqxQqdlKEZ++EZ7D37U6bUBGgyQRHcin6S0Lg2nhTa95Jtt4eqNnKze4Gkk NqqYf3mhYRAml8fXohHSmroQHXnauTblcW4MUAWF0lC+uIeiEKy7V0QEVsr0FwEJH5nY IqCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343552; x=1788948352; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=4o99LDLQvCP6InGqJmy0+x4rInCYHJPoPzbB/aJo+WI=; b=GZZeKGMZGrrmTcMcKoGsESvedtwSEwhCISxTcni8XdM+FrlHDEUyTFZMUPpbAvdgfD JD89wm1iQ0pkodPXpHCytb9XnZsyubKsz+0pNRgruM0LdEnqKTnqiajDMPPwdEeZUsy/ X6zbg+c4v9k6oXU5lrtgbA/5TTtI91/NknjoILz4PoSIMT/V1KyaV4tcSWMoILpHAeIf qVnXIgV3c9IAYkrfbf4QakWi4/v5NJPWnrQRyIEak4YFEI1Os3MXsw0cw1cPhYpp6tJj 84t9p9USkqXUyqg15DySdXtjVL0p32y75fvRAOmYNb99/MY+cUbNjNZ2YHy/9iop9l9B oY3w== X-Gm-Message-State: AFuF++nI2id0pmYSVgFkf1jyrk4mB1XezgBLPZftM7AekNnb9aUF6cyK c5XX/i8aIJCEwbPpJVhSg14lNcjCcJtMnMCb0/YsYEbujRPaLRR6Sb2j56pdeA== X-Gm-Gg: AYBFou2V6fykPuEcKUNnfr4mefQPUTNDzrtOMqkNi0yWhmqUmgsVnnYlxOvpfJejT40 ZhlMad7iTc3xxEJCYA6EWkca+yClSB8ThccKwRU7lBZJYkV4sfIH+xFviek4ApVaAztJzv+VWad wMoRd6WNlp3r4y2pNCM1vxPHJBUowa5lcmMd7mUOtyCMUhvpNLCi07S3/PVnQEZ8FBP4lnqlHJg GUGgfXyG+FGbEpdGracDHW+RQXW1GUNi9/JB1h2TGcBSgzVaavypFA+B7rM/eQGv0R6v3oCCXm2 F1aqWrdYJM1CjUg/P7Fp/yTckkbmx6Cih02Idavs65wmtBMGkSX481rgQTQIBsk2HY7wkq53D0m xCrwck2rVazZwwxOxgjzodePzl0rgtWqSC0Tb+J0KUyT+JblAOaVkHDhsLxeThzgZfX47Vw0h69 gPSgVrCPrwp+VStu/3QN7RyGayJ/8c8aDrRafe9jZeJ3MPN8t8vxhQwJq+3xO9YSq33xoxQK/Z X-Received: by 2002:a17:90b:5824:b0:38e:bfe:81e9 with SMTP id 98e67ed59e1d1-39aedf66687mr5862942a91.1.1788343551668; Wed, 02 Sep 2026 03:05:51 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:51 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 13/28] editorconfig-core-c: patch CVE-2026-40489 Date: Wed, 2 Sep 2026 22:04:55 +1200 Message-ID: <20260902100511.2105916-13-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129644 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-40489 Signed-off-by: Ankur Tyagi --- .../editorconfig-core-c/CVE-2026-40489.patch | 39 +++++++++++++++++++ .../editorconfig-core-c_0.12.9.bb | 4 +- 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch diff --git a/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch new file mode 100644 index 0000000000..e328052314 --- /dev/null +++ b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c/CVE-2026-40489.patch @@ -0,0 +1,39 @@ +From 4d5fcd42739f0ae349efe4e9208c0f109bb7c141 Mon Sep 17 00:00:00 2001 +From: Hong Xu +Date: Tue, 14 Apr 2026 23:11:39 -0700 +Subject: [PATCH] Merge commit from fork + +Completes the buffer-overflow fix from #87, which bounded writes into +`pcre_str` but left the initial `strcpy` of `pattern` into `l_pattern` +at the top of `ec_glob` unguarded. Sufficiently long patterns smash the +stack before any of the bounds-checked code runs. + +Fix CVE-2026-40489 + +(cherry picked from commit 5159be88ad50641d9843289adda791ba300421ff) + +CVE: CVE-2026-40489 +Upstream-Status: Backport [https://github.com/editorconfig/editorconfig-core-c/commit/5159be88ad50641d9843289adda791ba300421ff] +Signed-off-by: Ankur Tyagi +--- + src/lib/ec_glob.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/lib/ec_glob.c b/src/lib/ec_glob.c +index d36076d..0e7f7ac 100644 +--- a/src/lib/ec_glob.c ++++ b/src/lib/ec_glob.c +@@ -96,8 +96,12 @@ int ec_glob(const char *pattern, const char *string) + _Bool are_braces_paired = 1; + UT_array * nums; /* number ranges */ + int ret = 0; ++ size_t pattern_len = strlen(pattern); + +- strcpy(l_pattern, pattern); ++ /* Reject patterns that would overflow l_pattern in the copy below. */ ++ if (pattern_len >= sizeof(l_pattern)) ++ return -1; ++ memcpy(l_pattern, pattern, pattern_len + 1); + p_pcre = pcre_str + 1; + pcre_str_end = pcre_str + 2 * PATTERN_MAX; + diff --git a/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb index 319c1724c0..8d182d0cd0 100644 --- a/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb +++ b/meta-oe/recipes-devtools/editorconfig/editorconfig-core-c_0.12.9.bb @@ -4,7 +4,9 @@ SECTION = "libs" LICENSE = "BSD-2-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=38f617473e9f7373b5e79baf437accf8" -SRC_URI = "git://github.com/editorconfig/editorconfig-core-c.git;protocol=https;branch=master" +SRC_URI = "git://github.com/editorconfig/editorconfig-core-c.git;protocol=https;branch=master \ + file://CVE-2026-40489.patch \ +" SRCREV = "e082c947e7f7b14240195d55c060a6e1eda1b0a1" From patchwork Wed Sep 2 10:04:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97069 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CC616C61DD6 for ; Wed, 2 Sep 2026 10:05:56 +0000 (UTC) Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9351.1788343554846433010 for ; Wed, 02 Sep 2026 03:05:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=S1sR0lAW; spf=pass (domain: gmail.com, ip: 209.85.215.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-cbe827e3cb4so1066824a12.3 for ; Wed, 02 Sep 2026 03:05:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343554; x=1788948354; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=cqoH0/2TaW1YwdZpgN6NdPvXVjJ+RZb1i4kv1nCuQHQ=; b=S1sR0lAWyhshyJsXNm/GoZXTXTHSvP6jE1P/OiR8Fl9zWBTxjLk4i1Y3+3/vkKSL7/ nQoI7GwIm3OLm5v74u1ATRPoo2OUK93EOdLiuMfSeghwwFAAubf9ysT/wqcSnD8rHjfY bU1se7TsZtkD+1cnNbg3u7TVMs+NiYANJIDDzMnVN72Ms7bPtfhhFHQ44HxMCs5rEYtQ L1/JYIjV7gu36n8cR2m6KXc6E/k1R3rUIhiIkW60P/y4ftFwSWGUSNSd+TQvpouQicfn npIMsaM0M2pdJZLwUYjWNreYRRNIUKu2n1tQp9OGtG5KKE/uxo88ZiFiiDhVTJa2hsmE bNJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343554; x=1788948354; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=cqoH0/2TaW1YwdZpgN6NdPvXVjJ+RZb1i4kv1nCuQHQ=; b=gQcz/WR35WBO2mzRyObCovwdpcCKwUlQkw2ru/iWH0MKkC89xGX5NXO2MDKSKoHOyd 4q/4lEZ3/Y+/x3NuAG53n+9f0zrGVpwHO7/IYV1hLOZ+jXrI5tkZghP8Bg5yeKslIvt2 dhX5RG18mf82VtdJs1UQirIoukGe238Tu3aD76JJSTayUXV733EzvNmYgnLD10xW2Q0s rj7hk1dvk8KsOtMGLoZuZICAbqYD3Q2oY8LGTxP4+/pke7ck+q1ppk+AjowmOGI88mIe 1ScVRun1gpDb12AMjMov+KNstXKd/NwHAjn6+VKIG0mKJeywklcOp9l2kFmu4+6gms/n yb/w== X-Gm-Message-State: AFuF++ngyQFN24XKKysXl+AeQJLrFL80qBuz/1tYMoDi0/wdwPPa/a/F tMatItyr++mMekdll6pJ0lL958vKo2DfgiOdEq+QO4EelP+TLJvfSGmLDzPXO4Yn X-Gm-Gg: AYBFou2qL3VS8OYo8v5nDD5t+SlWjO3OGRe1/LgNEb9iMxEH2/GwyYaxkiYlHso8ww4 brc/mVrz80DTOf9lEStmu+/sd0jG5jUPxW2ugirP8CAYtS/BU/T0pZp58CsuSOXbvsMPJfPA8WJ ed9kDhJGu1UMUOZPf5+e6bdqU5VVGA5tH21wHpykEJB6woNgbsVQxn+lRjbLyAtMEhH3Tz7LiZZ kxEJGfOM6BSYL+T//A0l/ClEDjmNAPflC0ObWkCupudyCgMDWP4FUx4Yb8T3OvThckfxctvrlDC x7nO7VdnVaYnpVtbNx8Js66EUsuY7Qte0bUP+S+lFlr9AVgjlVxJP+EXldzEHRC8tu67ZzZ69WV KoAwEVMSy6Ikll1IGxOhrqLr9656o9aNklQ9UqxbozKr7rs8+BXKgLidJuGfD/LZxKqjiWEaF50 DVZlMGusOghQiKsWvWr+9Wecin2Y2gwQukxH4I/r7JKOA6+tQJioGsVuw3t84CQ5I4bYkuDxxn X-Received: by 2002:a17:90b:4a8e:b0:38e:4114:d8c7 with SMTP id 98e67ed59e1d1-39aedcfc81bmr5385851a91.0.1788343554199; Wed, 02 Sep 2026 03:05:54 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:53 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][wrynose][PATCH 14/28] civetweb: ignore CVE-2026-5789 Date: Wed, 2 Sep 2026 22:04:56 +1200 Message-ID: <20260902100511.2105916-14-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:05:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129645 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-5789 Signed-off-by: Ankur Tyagi --- meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb b/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb index 0e13bc6deb..a22d08f05e 100644 --- a/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb +++ b/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/civetweb/civetweb.git;branch=master;protocol=https \ CVE_STATUS[CVE-2025-55763] = "fixed-version: The vulnerability is fixed in the used revision" CVE_STATUS[CVE-2025-9648] = "fixed-version: The vulnerability is fixed in the used revision" +CVE_STATUS[CVE-2026-5789] = "not-applicable-platform: Issue only applies on Windows" # civetweb supports building with make or cmake (although cmake lacks few features) inherit cmake From patchwork Wed Sep 2 10:04:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97077 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E722C624D6 for ; Wed, 2 Sep 2026 10:06:07 +0000 (UTC) Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9054.1788343557324937870 for ; Wed, 02 Sep 2026 03:05:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=VHYyBLNS; spf=pass (domain: gmail.com, ip: 209.85.214.182, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2d71a50caa9so11061935ad.0 for ; Wed, 02 Sep 2026 03:05:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343557; x=1788948357; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kAPH8U6ljllikBZLetDRmofKTDHa5/+GRx/xeI2MYrk=; b=VHYyBLNSJHJDYcbtr9Y+UiFN2N4A835AjQrudpQ5G6zOpjtZ68UnRJ/3Ls44V4+ZbG pnIH3zUlZMg3e3mSWHXdltEAEcsuX5Sqrjcu+IlfOycIkhqSoTB5GJfgf7995rX4HPjg urZ6r1wQmbvjfwfB5sPFsbZXmtdIIIoqhe+UFZSRuhQqdWD/V33eJA1shTfO7LQs+e1v UkuIU1daADV6SteeN/Wlmnv6uTBsvdcDqAI4Awiv65/y2nxnt2sqjzsabZEkcbzvz1yx e5un3UK1Afj/VOBFobR+PPZDalEsd/innEz9wT2AT5nwfWq9lpGSIBaTCPsjyeV+dZsB rQOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343557; x=1788948357; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=kAPH8U6ljllikBZLetDRmofKTDHa5/+GRx/xeI2MYrk=; b=hf9XON+mYWGYYmFGnyjgeDGQpxyfU/OVf9X2OZG3a5q/0yhF3vV2iJmEepevGm+6jz +IjiiEr1ZEaOCmXQfQ5bBK1ySF07Ob0IDKNG6GN9qJ5Zbj//2Y4Cy18KYzGY7Z6ub4Pu RkaMB4LrEYe4IQeGZ14DPksu+YptngLEMpXAH7vr5MmVUQwn0/zBNbMZGvXlsxzDGJ8u s8ptKer2vBGRAkR7rwgVSnr9pvAOu9tYqq7qSVES/Rg8StT9mqKkf3xGRPw+/NAWcziJ yuAr+HLw0yMXHsqIzF3BdTTC/1lReWMkB+XSTzpMjicDovJ/xIDNstrhYyqhu/laOdTg m8FQ== X-Gm-Message-State: AFuF++m9TMPYVcQstH/Fi3S9wd5nHbGdAFU2LIWNRY8w1gzrwuCJdOBV i3ztHWYoaRycLHAxSHczdBN/riq1Eq7GDWwy8yKbtnNNsmhFyqVqK7QDscUo/Unb X-Gm-Gg: AYBFou2nTUqSZ3zInIHRqYp9xsixM9HrK7/zicOXivYg0klBCrwjLCTFtBec5l+V5MO TlGdmDZ/DPkD4zYV6oo7DxfHpwUEHUTjI/J57d//YH/dgXTruwCdr5NK+f+oFVWB32VhIsKQoJ0 l337vrSzUMU9X53klt61AqyZ5oaupFmrT+g50+B65aYm0+gLgxvOQOTaZsZRAE/+qSH36J8rdIV ONAT4SqOOsy5B4vW0WtG7iZx5r/WRRq2wJX1KHFHpg9aE4SLdHup28NobruD6at7qMG3nG8d9sM 0p/s8VUvPbJ59/vgKphDEtHr95KcOIlwEWXUcsggWUfupkyo9qL9PG/xMBQ6ACZfWGEcbmMBCMd S/+I1N7oRi6zQdgUVdLXAMcBbr4Ai5w6Vht9WwmzaYDBgMiGWl7xcX28ILSkXWbBSCvAb/v0lyN 9TK6cdi2GM4n0fp1CisU08UDSmNOWPw0elNcgYj+ijFJQkZ+4od2CFYrMlJldey91f7ldC6qRxq 7/zIx1Uayo= X-Received: by 2002:a17:90b:2785:b0:398:9be5:b41e with SMTP id 98e67ed59e1d1-39aee285570mr5982606a91.25.1788343556699; Wed, 02 Sep 2026 03:05:56 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:56 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 15/28] eject: ignore CVE-2026-28065 Date: Wed, 2 Sep 2026 22:04:57 +1200 Message-ID: <20260902100511.2105916-15-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129646 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-28065 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/eject/eject_2.1.5.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/eject/eject_2.1.5.bb b/meta-oe/recipes-support/eject/eject_2.1.5.bb index aa0e86db12..90630ff791 100644 --- a/meta-oe/recipes-support/eject/eject_2.1.5.bb +++ b/meta-oe/recipes-support/eject/eject_2.1.5.bb @@ -34,3 +34,5 @@ ALTERNATIVE_PRIORITY[eject] = "100" ALTERNATIVE:${PN}-doc = "eject.1" ALTERNATIVE_LINK_NAME[eject.1] = "${mandir}/man1/eject.1" + +CVE_STATUS[CVE-2026-28065] = "cpe-incorrect: this CVE is for WordPress plugin or theme" From patchwork Wed Sep 2 10:04:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97076 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E9C4C624D7 for ; Wed, 2 Sep 2026 10:06:07 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9055.1788343559665189866 for ; Wed, 02 Sep 2026 03:05:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Z7MvaTAM; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-38dfe7eb825so790958a91.0 for ; Wed, 02 Sep 2026 03:05:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343559; x=1788948359; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=PD1rGJ6wlyiRrG15ajBfqo/kKv+9xdNOWc//4wgQtm0=; b=Z7MvaTAM68w3d76YPWfY0wBWeL3rDWL9nGXKnFDDNYRjR5rPO3qmdIahPZqaMXx1Vj JeoGuf1D/2YlBJuRugkET4DcXlbrNnwUFO2s0nYaCOncvpg863wr//ESCfp41nxx3Npl qL11W+c2KlfrDQv/d5aHG2D2M0Dz3nNNRbNh/IHpJMOErThJm82553ebyJ6vGQskRmw1 rMNtLdVDLKo0AA92HJVDUts/uC0PfLa00/RfTAk8mP0CZNWGLYs0Yf8o9fTVpdUXUQgI ao6bTZnhsAZvYkJ8kTknYcyqBL4OJmrTS6KCM61y+ExoTQId7BxpumDOVuDi9iAIzzwy lQAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343559; x=1788948359; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=PD1rGJ6wlyiRrG15ajBfqo/kKv+9xdNOWc//4wgQtm0=; b=e9BtHXznAGulsKpmnOGW/fN/Xeh/a69ZehhBmlppAA+2E9n2X+9ISkqIqlJO/gfCH/ g6KdTu06XVjneuAHSpRY0qEHXG3jQZRsLQk5NcPiyy9Y3ODvX4oWklfQtSkwSOyvDcs3 tqhuHQKVoAcnpBEdGV3X0EmYq/kURPnidDdP3QFi26vRcFEZsSv7KkDRqoUvfFcPVK9U cIlDDD0C2DSiUbtsQApVsAKvgohqA/YLCc15HAPN5tYg1EH6rgKUlmclIn5zc6LDkmyd ePXhzbEFOA8dEm+iNZcMvY4hUQ0FBXIABx9Nj4+wawXAFy35OPZv653z9bSstmBnJ/0v NZkA== X-Gm-Message-State: AFuF++mk1F38hq42mkD7w+ydjabFJitS0AwzwEx8eldMKioPFRibQ908 gUkp+PAQQxyseibdkjzdY0dBfX0tcJlqGWlF27b+qK23OLekuOAExiV8zvR35SId X-Gm-Gg: AYBFou3pGJlbtf0HtaFEqnNK7nOipO6bze4Ovyd+HtaZnPTxY1tx4EAiNes8Uqv4u89 wiS9CUw9RAs9y5lkRD0CjsJ/KEeKR8gWs/xv81EpPKBkwPFLN8ZVE6c6h18EuF+MIK6ttPyTx7H TM9n6u66L8QyU5yLCNPh//dPKp/24MStMC/P1TJj6vWTqxgx2bHT6+TwoHLb35p/nqXx7T7YsIT IpU6GYnOGfe23XYq/GABnndhBxK+J15vdw7dN9Ce49fVpbj7GH5R5k6fsuLuOAaoAZReMNJq/c2 dQBrMyf+/89J3t5ZzO4MlJcuKCoWSPsT4+mHyasXSlkzVX9zoG46/EGM8imN3lbbODGHNvw5y0F rHO+pAwknQllTqQ7dd5bAS05UjxtRLaQjDOEaD5SUGgSEqZXnzlNgu3DWGa8O6WFEV36ueaSd+e N3rOPqTFkq46gLvegVJt784Fi9DuVUonTORHa0qvFfWhAzbIbBb2BsVsYyUNW62V3Jp8AXnDm+ X-Received: by 2002:a17:90b:5908:b0:38e:5b59:c2ff with SMTP id 98e67ed59e1d1-39aedec4caamr5497844a91.3.1788343558965; Wed, 02 Sep 2026 03:05:58 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:05:58 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][wrynose][PATCH 16/28] firewalld: patch CVE-2026-4948 Date: Wed, 2 Sep 2026 22:04:58 +1200 Message-ID: <20260902100511.2105916-16-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129647 From: Ankur Tyagi Backport commit[1] identified by Debian as a fix. Details: https://nvd.nist.gov/vuln/detail/cve-2026-4948 [1] https://security-tracker.debian.org/tracker/CVE-2026-4948 Signed-off-by: Ankur Tyagi --- .../firewalld/files/CVE-2026-4948.patch | 38 +++++++++++++++++++ .../firewalld/firewalld_2.2.3.bb | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta-networking/dynamic-layers/meta-python/recipes-connectivity/firewalld/files/CVE-2026-4948.patch diff --git a/meta-networking/dynamic-layers/meta-python/recipes-connectivity/firewalld/files/CVE-2026-4948.patch b/meta-networking/dynamic-layers/meta-python/recipes-connectivity/firewalld/files/CVE-2026-4948.patch new file mode 100644 index 0000000000..6aa422e0c6 --- /dev/null +++ b/meta-networking/dynamic-layers/meta-python/recipes-connectivity/firewalld/files/CVE-2026-4948.patch @@ -0,0 +1,38 @@ +From 8e2d8aa579164220624d6cd6520d904fe27cfa48 Mon Sep 17 00:00:00 2001 +From: Sizhe Zhao +Date: Tue, 31 Mar 2026 20:46:50 +0800 +Subject: [PATCH] fix(policy): use PK_ACTION_CONFIG for + set{ZoneSettings2,PolicySettings} + +Reference: https://access.redhat.com/security/cve/cve-2026-4948 +(cherry picked from commit 5fb3914ad830feff6cb2b0670457c60a323c6c6c) + +CVE: CVE-2026-4948 +Upstream-Status: Backport [https://github.com/firewalld/firewalld/commit/5fb3914ad830feff6cb2b0670457c60a323c6c6c] +Signed-off-by: Ankur Tyagi +--- + src/firewall/server/firewalld.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py +index 62802528..9f969d8d 100644 +--- a/src/firewall/server/firewalld.py ++++ b/src/firewall/server/firewalld.py +@@ -938,7 +938,7 @@ class FirewallD(DbusServiceObject): + log.debug1("getZoneSettings2(%s)", zone) + return self.fw.zone.get_config_with_settings_dict(zone) + +- @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) ++ @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) + @dbus_service_method(config.dbus.DBUS_INTERFACE_ZONE, in_signature="sa{sv}") + @dbus_handle_exceptions + def setZoneSettings2(self, zone, settings, sender=None): +@@ -965,7 +965,7 @@ class FirewallD(DbusServiceObject): + log.debug1("policy.getPolicySettings(%s)", policy) + return self.fw.policy.get_config_with_settings_dict(policy) + +- @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG_INFO) ++ @dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG) + @dbus_service_method(config.dbus.DBUS_INTERFACE_POLICY, in_signature="sa{sv}") + @dbus_handle_exceptions + def setPolicySettings(self, policy, settings, sender=None): diff --git a/meta-networking/dynamic-layers/meta-python/recipes-connectivity/firewalld/firewalld_2.2.3.bb b/meta-networking/dynamic-layers/meta-python/recipes-connectivity/firewalld/firewalld_2.2.3.bb index e77df2ddbb..a89b93248f 100644 --- a/meta-networking/dynamic-layers/meta-python/recipes-connectivity/firewalld/firewalld_2.2.3.bb +++ b/meta-networking/dynamic-layers/meta-python/recipes-connectivity/firewalld/firewalld_2.2.3.bb @@ -7,6 +7,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" SRC_URI = "\ https://github.com/${BPN}/${BPN}/releases/download/v${PV}/${BP}.tar.bz2 \ + file://CVE-2026-4948.patch \ file://firewalld.init \ file://run-ptest \ " From patchwork Wed Sep 2 10:04:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97074 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 288C5C61DD6 for ; Wed, 2 Sep 2026 10:06:07 +0000 (UTC) Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9057.1788343562083211200 for ; Wed, 02 Sep 2026 03:06:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=ZKvNs07+; spf=pass (domain: gmail.com, ip: 209.85.215.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-cbedd5aece4so1598133a12.0 for ; Wed, 02 Sep 2026 03:06:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343561; x=1788948361; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=o9EtLU5AQwjrhd/FkU9qvVdRImMXqspyl7LwYxAO860=; b=ZKvNs07+wGIQ0gIJlftVW8ajK2ElibN/s7KuKe6jxHMrl4x8ps7eqnG1gGZFFehACD CqU8kcaZWcxWPU34pfSaTy7udGSj8tyKFEEQ8d8oTrK6MzsULZLs0rDM/IF6YlGyyxUF Es1mJ72aGGbnVIeg5cQwHdfHhV0WcOZ9CsHaVA3QNbaLzSnoeFxswsY86YcmsY498gQH y5XCIvquwcAwNXNRf/EjILKlVo+MLRQTf5O0bbaJS96Laf5M8DbyHFi1m9NtdjrCxN7v 2POPxKwD2NIn/1lbi9NyN2vU7bYxCR1Jzncs8nxfF2qUQNVcIGEednG1+YNqBt2/GjU+ Rz3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343561; x=1788948361; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=o9EtLU5AQwjrhd/FkU9qvVdRImMXqspyl7LwYxAO860=; b=ED79e/xy2Mya5wdN9YgpykPf3pPI2vvHL1JeEEoyNqNVzHfQapVhexqP8cVVLi8ogH sEOEug/v6yT3PtSbRsn3MBtJcI8lTJ8qRkJ8EF8FDegdlaww6dt566nsZR8DFaRKC8zG o0lOugwmOKJ4gp1jzlRUQHKIUuvwTyjHNsP2gNBjoKZ6JUvzc9+klfceLOzag1oQLorf jh3gByE8bmiV0PV0dUqYxSJyj/IzkSTF897ifxlILLytM4ImhL/19s3xBi5I8eXBMoIt kd4rL/C01vBKFPLu4S3TT3KwOL4lUAwCJNspDX29ODEQ4/zSSzYwsrPOdRFnSMnd3sjY r/fA== X-Gm-Message-State: AFuF++m3OFRXFv4dmoLbl75a4uBLaezRU0awj/gfNQ9i2dsHtR5oXM3l DK6FPKUQif+7End2kHajHSwEFMPhBV0l76NfKF1b2/o2w/i9hIB/muNHMhKKdygy X-Gm-Gg: AYBFou15WFUEdHSTrq6HRafRlzDuuoOYwdhe3QTclvJC0yLkzIYMVOlb8/mucIUh1L9 FHrAmOKu2Y0z0hiFO1Gq+R4mNJcudYPUPre/XwSYgND0dhC50f/s5AgjhO6Zw4lxh8Mi8rkhqIN h7JK50AVELRa21bRaRdUc+HdA/qGjrXCE1QnVdJeMnsKsDCUyyyj2uqmS1Hq5FzMutvFif3hcm2 cq099cWEXxQedSjxeFgMymb1FTBdg6mJEtqUCdiIqU9IS5FTppB+JKT/3YHO7HL1OX1m/toPpak wOMbOEMMV9MnwJm+I0oSzAImZN+EDxskFuarTBI9z7NrcYnE7tn+FuS7sTAIL2xxD9e60SoteQW TXRB3Lc2TDKGUNAtudGJcQUjiRxgxSJu9NCvFalxF+SUKoOqLGBiRwUqgb4PiNYFLXs74UQHZaR vy6Q8wblBLe5kixXiMfySulEMcSUxg1nTT0GpFvZ3lWhSbJgqDUPgKvb9pwXd1bKoP+xO8v6gs X-Received: by 2002:a17:90a:fc4e:b0:398:9bd3:d6d6 with SMTP id 98e67ed59e1d1-39af65ab8b1mr1448268a91.16.1788343561341; Wed, 02 Sep 2026 03:06:01 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.05.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:01 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 17/28] freeipmi: patch CVE-2026-50031 Date: Wed, 2 Sep 2026 22:04:59 +1200 Message-ID: <20260902100511.2105916-17-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129648 From: Ankur Tyagi Backport patches fixing bugs[1][2] associated with the CVE. Details: https://nvd.nist.gov/vuln/detail/cve-2026-50031 [1] https://savannah.gnu.org/bugs/index.php?68363 [2] https://savannah.gnu.org/bugs/index.php?68364 Signed-off-by: Ankur Tyagi --- .../freeipmi/freeipmi/CVE-2026-50031-1.patch | 33 +++++++++++++++++++ .../freeipmi/freeipmi/CVE-2026-50031-2.patch | 33 +++++++++++++++++++ .../freeipmi/freeipmi_1.6.17.bb | 5 ++- 3 files changed, 70 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-50031-1.patch create mode 100644 meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-50031-2.patch diff --git a/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-50031-1.patch b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-50031-1.patch new file mode 100644 index 0000000000..e73368f473 --- /dev/null +++ b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-50031-1.patch @@ -0,0 +1,33 @@ +From 651119e671c7a64e72a79218f87b9f397037383b Mon Sep 17 00:00:00 2001 +From: Albert Chu +Date: Tue, 19 May 2026 14:44:41 -0700 +Subject: [PATCH] ipmi-oem: fix potential stack corruption + +Problem: A buffer was incorrectly defined with a length of 256 bytes +when it should have been 65536 bytes. + +Update the buffer length. + +CVE: CVE-2026-50031 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/freeipmi.git/commit/?id=f49a6076b640d802a9a80064089e772b4baa5335] + +Dropped changes done to the ChangeLog file. + +Signed-off-by: Ankur Tyagi +--- + ipmi-oem/ipmi-oem-dell.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/ipmi-oem/ipmi-oem-dell.c b/ipmi-oem/ipmi-oem-dell.c +index cf3bad244..f322cdfb8 100644 +--- a/ipmi-oem/ipmi-oem-dell.c ++++ b/ipmi-oem/ipmi-oem-dell.c +@@ -4207,7 +4207,7 @@ ipmi_oem_dell_set_web_server_config (ipmi_oem_state_data_t *state_data) + int + ipmi_oem_dell_get_active_directory_config (ipmi_oem_state_data_t *state_data) + { +- uint8_t token_data[IPMI_OEM_MAX_BYTES]; ++ uint8_t token_data[IPMI_OEM_DELL_TOKEN_DATA_MAX]; + uint16_t expected_valid_field_mask = IPMI_OEM_DELL_EXTENDED_CONFIG_AD_CONFIGURATION_ALL_FIELD_MASK; + unsigned int token_data_read = 0; + unsigned int min_token_data_read = 0; diff --git a/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-50031-2.patch b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-50031-2.patch new file mode 100644 index 0000000000..b44799cffc --- /dev/null +++ b/meta-oe/recipes-support/freeipmi/freeipmi/CVE-2026-50031-2.patch @@ -0,0 +1,33 @@ +From 1a7113599aa8926f133b5686c7e9b460d009a4e0 Mon Sep 17 00:00:00 2001 +From: Albert Chu +Date: Tue, 19 May 2026 15:53:50 -0700 +Subject: [PATCH] ipmi-oem: fix potential stack overflow + +Problem: A buffer could incorrectly be overflowed in a fujitsu +command. + +Add a guardrail to ensure no overflow. + +CVE: CVE-2026-50031 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/freeipmi.git/commit/?id=60dd7014c0b1402c881ef389f4e79ebb7a9e26c4] + +Dropped changes to the ChangeLog file. + +Signed-off-by: Ankur Tyagi +--- + ipmi-oem/ipmi-oem-fujitsu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/ipmi-oem/ipmi-oem-fujitsu.c b/ipmi-oem/ipmi-oem-fujitsu.c +index 2f505229f..10220c9fc 100644 +--- a/ipmi-oem/ipmi-oem-fujitsu.c ++++ b/ipmi-oem/ipmi-oem-fujitsu.c +@@ -1384,6 +1384,8 @@ ipmi_oem_fujitsu_get_sel_entry_long_text (ipmi_oem_state_data_t *state_data) + } + + data_length = bytes_rs[15]; ++ if (data_length > IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH) ++ data_length = IPMI_OEM_FUJITSU_SEL_ENTRY_LONG_TEXT_MAX_DATA_LENGTH; + + /* Every response should be NUL terminated, not just the last + * component. diff --git a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb index 7970e0f563..f612caf3ac 100644 --- a/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb +++ b/meta-oe/recipes-support/freeipmi/freeipmi_1.6.17.bb @@ -13,7 +13,10 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504 \ file://COPYING.pstdout;md5=d32239bcb673463ab874e80d47fae504 \ file://COPYING.sunbmc;md5=c03f21cd76ff5caba6b890d1213cbfbb" -SRC_URI = "${GNU_MIRROR}/freeipmi/freeipmi-${PV}.tar.gz" +SRC_URI = "${GNU_MIRROR}/freeipmi/freeipmi-${PV}.tar.gz \ + file://CVE-2026-50031-1.patch \ + file://CVE-2026-50031-2.patch \ +" SRC_URI[sha256sum] = "16783d10faa28847a795cce0bf86deeaa72b8fbe71d1f0dc1101d13a6b501ec1" DEPENDS = "libgcrypt" From patchwork Wed Sep 2 10:05:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97073 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32069C624D0 for ; Wed, 2 Sep 2026 10:06:07 +0000 (UTC) Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9358.1788343564441572659 for ; Wed, 02 Sep 2026 03:06:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=aXLV5l/D; spf=pass (domain: gmail.com, ip: 209.85.216.48, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-3964dfb5a69so1096118a91.1 for ; Wed, 02 Sep 2026 03:06:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343564; x=1788948364; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=qRsfJezDNFcduTtxAmJUxaw+Nsz/FJPxCFWQzzs3RrI=; b=aXLV5l/DPD+pO3ZByHwXXwo7mnyKng1yxztTu20SC6JLFfz9pBf1Fr8MIWxdJfIaC4 z3ofyBd+jEYnJk5YGKJUFBOb9yKzbLmRuG/r72xv8g2/ZZ/cTyjslPdC9CK3yWas2YQT YDLaJQkgOrpz3oz/9W6fYYttWdBnf210eGRWH5GxZZDFpc2OFrYteMg4s5PaMSfh6sPv IxIZeiX1oTbzZ0dSnv5bGkVXjKDGtqOhxzVTOPZjO1BD0hlaUwEf8mXIvXC7H3s0qS9G NxwZLDvJNODRzSUdxM9mkmhEW3c38tOAChy+MoIKjnGqW5ehury3SuYJo+XpZmmhj+w2 EMgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343564; x=1788948364; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=qRsfJezDNFcduTtxAmJUxaw+Nsz/FJPxCFWQzzs3RrI=; b=ApdeoXQvBSCsi+9uqhS7K/hk3ChVHyj3Q8/JqRBGoZOl8FtzujNbxZEiYKlo/GCIL+ U0OmqMtLrSa0GtrVfyuM6tlQjJbukNd83+r+iPAKVklnEpnOt0+HOvavok5vMf4rE9iS ybvgpHGNRhLMVh0Tps2vtSQRI8ZZtdS3yo3ImnHueeWAbdVFTZkMRFEsE8k80YJnaG8z 5x3nHUZw0fZISEPdxbsCV/ocxej7Lf5tToWu2GSV8enpl2v8Y00YnQij27qEapLhw/WE dtDaf+C94e6PdTyrklaFVvl7x56fcToOuDwMcK3up51Bte89i86G7FiZp5wdccaAl9E8 nr2A== X-Gm-Message-State: AFuF++n3pDrXyPmv555Py0YMBUm7kC3nxToq755K2OlWqw1M48jS5HPr MSb6J1nb2Bu2aBM9EpEZNxwBidkpHz+vX9rWbNTWW/Cf5OVdR61uCi7QyN2V9gM8 X-Gm-Gg: AYBFou3gaY1Jwo1M/C8lE+ETFq1MlJEat/fszwyk88QtSvLFirympfa3Mpkl1ADAAf0 wnJezm6o8qCzmg9UVRf2YTTrlgLR4YfnX+1PG7vms+RY6X1kRkvBC700lNnRrGsLF3YkxVLzbg1 OfcwJ1M0qVRYHMG6kz4RDOSxrsf1mCV4qRHXzu1orATpbZdXqZXxYkOkz800FJIzFdmFvd94aSx UVwbrWl9sZcUBF/E/f7ZNUOdLEG2JfPNU4b2lQN9g7RufkxlBdf5I6n4z4eC+rsPqxhcz4PLQYF sTs+Br1WtpETiSAGpClDxDKpjBiV47ml+pKXqufyMeArq8+kUURMWrNVHnkq9DJLe2Ze/ZE0LIm ErsNc9XRLv7OkuRgPE/ausddcbQvNbRWpQ/7PwerwZTq0uGq32Vrhlotz02W1ogDUf3yOGX8ZX3 OIIXSCpP0M9i0/kVD2WLkkrBD0Byti2/zROxdDHYE8VyFMgg/Qrs50MN0YjwQ2m1d52oIbUK+O X-Received: by 2002:a17:90a:d604:b0:398:c9be:cca8 with SMTP id 98e67ed59e1d1-39aedf5e124mr5771135a91.2.1788343563710; Wed, 02 Sep 2026 03:06:03 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.06.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:03 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 18/28] haveged: ignore CVE-2026-41054 Date: Wed, 2 Sep 2026 22:05:00 +1200 Message-ID: <20260902100511.2105916-18-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129649 From: Ankur Tyagi Debian[1] also confirms the fixed version. Details: https://nvd.nist.gov/vuln/detail/cve-2026-41054 [1] https://security-tracker.debian.org/tracker/CVE-2026-41054 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-extended/haveged/haveged_1.9.23.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-extended/haveged/haveged_1.9.23.bb b/meta-oe/recipes-extended/haveged/haveged_1.9.23.bb index 9dd5f4d378..e04bcb89c1 100644 --- a/meta-oe/recipes-extended/haveged/haveged_1.9.23.bb +++ b/meta-oe/recipes-extended/haveged/haveged_1.9.23.bb @@ -21,3 +21,5 @@ EXTRA_OECONF = "\ " MIPS_INSTRUCTION_SET = "mips" + +CVE_STATUS[CVE-2026-41054] = "fixed-version: fixed since v1.9.21" From patchwork Wed Sep 2 10:05:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97075 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B65CC624D9 for ; Wed, 2 Sep 2026 10:06:07 +0000 (UTC) Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9360.1788343566733280310 for ; Wed, 02 Sep 2026 03:06:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=cb+8zCMP; spf=pass (domain: gmail.com, ip: 209.85.215.181, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f181.google.com with SMTP id 41be03b00d2f7-cc1cc97b84bso750870a12.1 for ; Wed, 02 Sep 2026 03:06:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343566; x=1788948366; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=dFSiDMmOLw4lL8OZXjQVwnzrCDy7sICdqOTpO9Jc9Uc=; b=cb+8zCMPCFQlLowI3pxp0PaKgWROMS76AC3cNDtNGil1NmZg6H2jyWWhgJLIaQPgin mmrpo2IGF1vyd+vHYq1xqbm60YxRKYMgpO3aI9i9byrjD1XY9K7MH/2xeKElk+qlLXLl MBBXtWJqXrcw/+mLLtM63lh8gZgER0/lRWmF8qv+XoYhdJVHahuRjI/gThl4zYpzlxN1 4ZnA89d9ei0IiSIP089MLxXF9L7KS/ubKG5gtDehCkf/OxQc2AgQSQTMwdt4bzfPRjRf Z0YWvXe4Pr0WL5YAwmdfTuJzQG/fAM8lC0vgDnHNBQUa8AYin17/1SWlQNoEBoBz0S4y r89Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343566; x=1788948366; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=dFSiDMmOLw4lL8OZXjQVwnzrCDy7sICdqOTpO9Jc9Uc=; b=J9vpwofZefLPxOy59Bv/HHLN4oJMElGV5UuveH4TkkbCkd75n93QI3iQKX2buqTFQw xrNWTzsWJuZo8HfG7TVnDt9rAPJWPgFiAqkp3n//aB5YuWLUweTQ31EiprILeg41u7i6 HeOa3T+CML/+GBzw2rlQSCrXr1Fm+WNQsTi0QVLOMjOucScw+S5YsHKNdRDh/8HkddHe 87xL1LI0SuLX7i70pStPSKH7dmV5SXbXhyE8C41b1fT2MRL/izsyWbl7GAUzYlcrxAKc Tgb+dyQD60pbjsX/5lATIyTeWxWFaaaQoLjiFAdaL4+r9QXY9ZHnj3ewKCXwSAAgRLqO KfOg== X-Gm-Message-State: AFuF++l0iNci9PQfi46NS2FZq+xioe8hhIvlRVDHGAQEekwxjF4KnaA/ 7c9Z1PQyQ4g1NXtlkPgFdJwD1cEodPW1B9rnk0ksf9ci1m60s+zraNtZhM1btyss X-Gm-Gg: AYBFou3vPL3azb+8NbndjeTVdq7UdEZo40Pi63CtlLH6x8o2/5LCtWk1G0mdBjoJTt6 UF3T3aj8XZDGHTB6d066NPglpHGxjn6mxYlh7vCYdR/jBbsRR4HTXhrTbt0Fkh4ejw5YaODbRiD JCA6DR+I82EUopQKS8zbNmea6ocsqeK4teu3AL8ijwtySVxuEn8k7bjrjLtxcVU/rh1Qqkjlg1/ KMs+1xkjS7Rx2mAZu2w3rE5922kWJGG3ljdTAZTNppoS7pn1/z/LYSZivDRKzjMnZQ3j/gEWRxP vV+nwVmpVL+H2g5MMtmsyZ4xYM+/PV62IKxlUkpI8E/EBlYUqA9p/iEGslKVHj+/L9SxOcofIgA +bD66JzU+3IpG8vVHnOZaHcdGCogRN02imsyCARivI3JU4MdP70fzk3nSpJgDmF+CKB/wx4JqPy gOcG+VGbDjr1lQLUbhDCUIwbKDVfO0/PkcRLIm4WnSxDKa5E0zvgHOdk+esDxOV9PGShEbzPGn X-Received: by 2002:a17:90b:4c05:b0:398:d93a:b343 with SMTP id 98e67ed59e1d1-39aedebf901mr5507637a91.3.1788343566068; Wed, 02 Sep 2026 03:06:06 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.06.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:05 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 19/28] gpm: ignore CVE-2025-4558 Date: Wed, 2 Sep 2026 22:05:01 +1200 Message-ID: <20260902100511.2105916-19-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129650 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2025-4558 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/gpm/gpm_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/gpm/gpm_git.bb b/meta-oe/recipes-support/gpm/gpm_git.bb index 155e56bdef..9c07f334b0 100644 --- a/meta-oe/recipes-support/gpm/gpm_git.bb +++ b/meta-oe/recipes-support/gpm/gpm_git.bb @@ -42,3 +42,5 @@ do_install:append () { } SYSTEMD_SERVICE:${PN} = "gpm.service" + +CVE_STATUS[CVE-2025-4558] = "cpe-incorrect: this CVE is for GPM from WormHole Tech" From patchwork Wed Sep 2 10:05:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97081 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82416C624D7 for ; Wed, 2 Sep 2026 10:06:17 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9361.1788343569259195790 for ; Wed, 02 Sep 2026 03:06:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=a8Wi74J/; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-398b3c37877so1201713a91.0 for ; Wed, 02 Sep 2026 03:06:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343569; x=1788948369; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MCf52Vv0ROM8KrPngRBMy0yj/ddtsp+R8p7u9ll/qp4=; b=a8Wi74J/4nQjNEinHp4Wd/+lrs2p1+CQdp+GHml5e45jp2+aOymmu4ZatwgPgCqXgM YAs7m88UOXAxmBEA4H91yYg0/62K9YgXhiT6yXAS257NYLEeYU3wW3rUzqzigLOlrN2H xlp7XVr3+EaB8d4IXzzxlknpBzflvXZiTm/7TZ5Eo85fEqkAmLgzOfBYL9ogwhI5ifeW Rtw9Z/gUz/f1tD9oJFl33YBXiWrjKMHqgygAQcQPP3iiPrIcJWQaweu+XJCH+uti7rJm y5rxZElP3SbFX79yGzLUTaFAa6qYRvo7mfQNwk1neqsUdYGXFs3Pn/LotrK2O//XX6QU i/Ig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343569; x=1788948369; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=MCf52Vv0ROM8KrPngRBMy0yj/ddtsp+R8p7u9ll/qp4=; b=ZxjTyXr7BojG+s0YbgonD9f1hhayOXl9/goSeqgNfdeX0igdfUq3/YLMm6aYecICOd RYqQ9vkJMZnWef8BaCeJlHyrG0VtA4OKOoNhfwXvvWbzdgBtMqAo5wYuPqxumGbwX7Yq DpJ7/7uQC+ME3bhKuCPyzbIaWqzvbmePT2mlw7N+vo2l9KCOBpiBgzG0HGsRzO0IdT2o QLB3rKRNZsZsuoWzqDa0Ru649Wd2uo0DysEdanB8vLkM2a4CVM9UK0rXnH2N6mQg7Ffo j0vwTid8IASw75WUcqONiOss4CwZGdJxsMAz0Nipo/d5C+dgKR0p4geeEgShmi+B5PuE bcMA== X-Gm-Message-State: AFuF++kGXHahjeS+eScSGuWBIEvxcvlQcWJQGsLPJE8mKc03IFfLChI4 FFtXz8V0pgne1miCvspihuzm311hpwEjpPkh2KaibV/pZyQuPAG09CBwX6xiwU36 X-Gm-Gg: AYBFou288ohcvjfQMVRXWuyHvHkxArM8ylx2RI6FhKafYVLCX0TamKgnuI6m+YA7Zot z0NXjb90cxu6URoAVEIW6fXdUp5PWZlqbT2/c7zH18TNt6f0l9lVqUGz/R6escuN4IQmrv+hfYF f9bTQwPA/1VdXz9wAnh8uGdYySs0JfsO8moMwUGu3RfPpZ3/joY/OnKg/A6cvqeJawAAwnInCG5 3JbgndRxCw2o7MUj9JrW0ShNUC6OAQYpxwN3APLn5nziIsCB1VF/C/YCeee9nQ1yQHvCcvaPWJE YLgNr8aNo+s0JA4gK0VZZhRvDU6qIghgOvxYOU8NGWQUDg6eUtJKLXdpacCaGZtczLF63pM5jeP MLXO+EHumOGvY5SDr0KeGdfwdy8rfio4+aLnSz3UyEF83g1HRp+FFLI/gFtxy/CnV7fEeppWIHQ G55cxx9gbWvLtM0OUkQ4kFyz2fShFJgAlas0Z82kLE6XX8oMIRYlQGHBQccPd3aHjcTBtiVTgy X-Received: by 2002:a17:90b:2687:b0:398:9c0c:7c71 with SMTP id 98e67ed59e1d1-39aee1f9788mr6117996a91.24.1788343568522; Wed, 02 Sep 2026 03:06:08 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.06.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:08 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 20/28] gpsd: patch CVE-2026-58459 Date: Wed, 2 Sep 2026 22:05:02 +1200 Message-ID: <20260902100511.2105916-20-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129651 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-58459 Signed-off-by: Ankur Tyagi --- .../gpsd/gpsd/CVE-2026-58459-1.patch | 48 +++++++++++++++ .../gpsd/gpsd/CVE-2026-58459-2.patch | 46 +++++++++++++++ .../gpsd/gpsd/CVE-2026-58459-3.patch | 58 +++++++++++++++++++ .../recipes-navigation/gpsd/gpsd_3.27.5.bb | 3 + 4 files changed, 155 insertions(+) create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch new file mode 100644 index 0000000000..aec3acdeb2 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch @@ -0,0 +1,48 @@ +From 485b793ee3a54865ff9d8efffd2fe9a309666be0 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Wed, 1 Jul 2026 17:55:57 -0700 +Subject: [PATCH 1/1] clients/gpsprof.py.in: Quote double quotes in title. + +Someone could use the double quote to break out of the +string and add gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 5581ba196d826a984fbfaf792b7d58535f9911ce) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/5581ba196d826a984fbfaf792b7d58535f9911ce] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 5c18f50ff..261e72665 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,6 +198,10 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + ++ # escape ", and \n, for gnuplot, to not break strings ++ desc = desc.replace('"', '\\042') ++ desc = desc.replace('\n', '') ++ + return desc + + def collect(self, verb, log_fp=None): +@@ -1262,10 +1266,10 @@ if __name__ == '__main__': + # Ship the plot to standard output + if not options.title: + options.title = plot.whatami() +- # escape " for gnuplot +- options.title = options.title.replace('"', '\\"') + if options.subtitle: + options.title += '\\n' + options.subtitle ++ # escape " for gnuplot, to not break strings ++ options.title = options.title.replace('"', '\\042') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch new file mode 100644 index 0000000000..dd50d27695 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch @@ -0,0 +1,46 @@ +From 6031dc96603d5537a650068a2f8d42ef90d9d32d Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Tue, 7 Jul 2026 13:41:54 -0700 +Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title. + +Someone could use the back tick to break out of the string and add +gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 1a6bb7bcbdf58aa940132e630870af061dc88537) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/1a6bb7bcbdf58aa940132e630870af061dc88537] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 261e72665..202214769 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,8 +198,9 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + +- # escape ", and \n, for gnuplot, to not break strings ++ # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') ++ desc = desc.replace('`', '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1268,8 +1269,9 @@ if __name__ == '__main__': + options.title = plot.whatami() + if options.subtitle: + options.title += '\\n' + options.subtitle +- # escape " for gnuplot, to not break strings ++ # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') ++ options.title = options.title.replace('"', '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch new file mode 100644 index 0000000000..a40edfe6d1 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch @@ -0,0 +1,58 @@ +From 54484dccf7265e51368eef03d99ea7a370c15e06 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Tue, 7 Jul 2026 14:23:56 -0700 +Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title. + +Second try. Also quote "terminal". + +Someone could use the back tick to break out of the string and add +gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 4c06658e988f4ced1a7a574ce082a22ef625df56) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/4c06658e988f4ced1a7a574ce082a22ef625df56] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 202214769..e91367ee3 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -200,7 +200,7 @@ class plotter(object): + + # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') +- desc = desc.replace('`', '\\140') ++ desc = desc.replace("\x60", '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1271,13 +1271,19 @@ if __name__ == '__main__': + options.title += '\\n' + options.subtitle + # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') +- options.title = options.title.replace('"', '\\140') ++ options.title = options.title.replace("\x60", '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: + term_opts = 'truecolor' +- sys.stdout.write("set terminal %s size 800,950 %s\n" +- "set termoption enhanced\n" ++ ++ # escape ", `, and \n, for gnuplot, to not break strings ++ options.terminal = options.terminal.replace('"', '\\042') ++ options.terminal = options.terminal.replace("\x60", '\\140') ++ options.terminal = options.terminal.replace('\n', '') ++ ++ sys.stdout.write('set terminal "%s" size 800,950 %s\n' ++ 'set termoption enhanced\n' + % (options.terminal, term_opts)) + # double quotes on title so \n is parsed by gnuplot + sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title) diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb index f7ca367fa4..7819dc532d 100644 --- a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb +++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb @@ -8,6 +8,9 @@ BUGTRACKER = "https://gitlab.com/gpsd/gpsd/-/issues" HOMEPAGE = "https://gpsd.io/" SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \ + file://CVE-2026-58459-1.patch \ + file://CVE-2026-58459-2.patch \ + file://CVE-2026-58459-3.patch \ file://gpsd.init \ " SRC_URI[sha256sum] = "409873f5048462ef1ac413a51ab35caa8b50b31be62b3347bee1cc2994e7c649" From patchwork Wed Sep 2 10:05:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97080 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D77AC624D5 for ; Wed, 2 Sep 2026 10:06:17 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9362.1788343571415225159 for ; Wed, 02 Sep 2026 03:06:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=K6Bb+ln3; spf=pass (domain: gmail.com, ip: 209.85.214.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2d6f9e2f681so8829075ad.3 for ; Wed, 02 Sep 2026 03:06:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343571; x=1788948371; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=V+8E5jO2+J4F03fqoDzGPqMiN7o7fOgYBv7lxsMcpSw=; b=K6Bb+ln3tBbqGymq3fXLrZFyeZrOU1OolyvhpnkFPdOppfhdh+yttBSIxVX8H2SxiX Dg3bzM4Xt5twaygvfyxpCK+u4BmjvUTflMqF73LRSiFmxCHeVj927CYXWH3YmjCBqrmn diSZqhDPrdXC34KQYx7+EqT24ppgrnOHGaZxYxOnYBEm2aOjI+QbamzJF3Kd5wV0Pq9y Y5W7xlPrJTObIQeTKrHYzAyo9xY9VX3YA+B5wAUotkTjGLmCdgky4xyYlbjF8ERMiUQG yv0IWHMmd8rqa/L/Q+UUvKjFHGGcsv9Cw2T4jFhgnUeukn0DoJRZ7gl6XdO1ZZsvsISM FRVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343571; x=1788948371; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=V+8E5jO2+J4F03fqoDzGPqMiN7o7fOgYBv7lxsMcpSw=; b=WQyQeMP0f4dtFdOICsJgDUrFQFcPaHFl/NY6xXD7JHHvSFBP4xYuS2wDCIPqOAMSZ6 HCiD9bQuxJt9/BzxZnNssHz2W0XMTOdwJOaOfUl2JXirJ+1Snf69Jcw2OxUbiLDcc7kJ pIMOzV36al/o0LYjfmdtY23/1+NxtBqymqHQTqcg7TDf34hNWgeITgVmKmJytJmi/gLs BmOT5sBoSXU2Dn4f1SXL56K9eJnRHccITP9vWcuHC7XJHUNJLqdlcl78GMblp14IJIEN hjABjiRMC1hABVpIjFwq7RAMzUn1V5dp2QJawTXEiUC7+KXMoL1iRE4Cnp13n1V3sfHf uR6g== X-Gm-Message-State: AFuF++k56X0GiDWHghOreQROzUV9fb5pokQT5N9MMd4Nb5YH8M23lYAq Wk2ja7hEi0/Cn43Tkz0nJ8bvKiT79VpWUA2CGd5Qj6YCQ+oDf2E+ji60oVGOSw== X-Gm-Gg: AYBFou174bm6XJvBo7APCfopEfvw5G13j6PRJYNHHolA8lohjENBaZ0HrrSkYSE/CSN 0FEqP7EZHpYSfYjbFgux6Yo595jzU2u70gbXbuz9154SI3doGNcgfR1NlMONgQ+0+SmXw0h0ImY upVkNKV0tXBEVURzJQRRg7rNokSOFB+rhDs3OMwIMvJLB+KCE85y1pbtrwJoPLUZM55MR2xOc2q xF9T30jX9y/8PSHyMO5Jfqkd7HoHrWCZTjJPV7D34biB7VNRMzibQ4A4lj92irTjStfVXX/nPAF wgW6VVRqGnST0APNvGGgLfsrvjtffF5sZy3XnkT+3wKc6bFXPEpbkSTWFqYQ4wwGqxPhHnIyI4w h4JbHIyqXKZz8RlRCnNi8HIOWBrudaiFP9bywc/Whw+IwlwFTwy4rA/n92kSGSdBjoH5cS/1czn lk7H7r7LQflKKETezdylYu+QUTTTm+79ByTo8lQM87GakG9h0SryYn/dHbnBwgWbIScSlbsJAj X-Received: by 2002:a17:90b:2649:b0:398:d6e6:4671 with SMTP id 98e67ed59e1d1-39aee249be6mr5294559a91.25.1788343570726; Wed, 02 Sep 2026 03:06:10 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.06.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:10 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-multimedia][wrynose][PATCH 21/28] gerbera: ignore CVE-2025-23386 Date: Wed, 2 Sep 2026 22:05:03 +1200 Message-ID: <20260902100511.2105916-21-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129652 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2025-23386 This vulnerability is due to openSUSE specific packaging issue. Signed-off-by: Ankur Tyagi --- meta-multimedia/recipes-multimedia/gerbera/gerbera_3.0.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.0.0.bb b/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.0.0.bb index fdbd91f9b0..403565b7fb 100644 --- a/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.0.0.bb +++ b/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.0.0.bb @@ -27,3 +27,5 @@ PACKAGECONFIG[magic] = "-DWITH_MAGIC=TRUE,-DWITH_MAGIC=FALSE,file" PACKAGECONFIG[js] = "-DWITH_JS=TRUE,-DWITH_JS=FALSE,duktape" SECURITY_CFLAGS:riscv64 = "${SECURITY_NOPIE_CFLAGS}" + +CVE_STATUS[CVE-2025-23386] = "not-applicable-platform: The vulnerability is openSUSE specific" From patchwork Wed Sep 2 10:05:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97078 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 565F3C61DD6 for ; Wed, 2 Sep 2026 10:06:17 +0000 (UTC) Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9065.1788343574049599293 for ; Wed, 02 Sep 2026 03:06:14 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=JW+FR1Tk; spf=pass (domain: gmail.com, ip: 209.85.214.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2d6e954afbdso5171635ad.2 for ; Wed, 02 Sep 2026 03:06:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343573; x=1788948373; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fowu6XI+DUSRHXo45Qm1TWU8fLj7OAHlch8GTHzWiz0=; b=JW+FR1Tk4mmPQTJ2EdDW/8d/rU964O+Zmu+hCAEtURECWcvmddc5Fp5QAQFX9CiMyP 1iWX7z5NUroYhyBokFwO9PTUhEkVg1AmJxgOaNy7T3YMYWBCRF3r0ehYeUW1tNxv0lMC QLLyk/b+UEeqxqOSrufE4hpjqJcowXbB6yTw6kWiHJ/+J1PGzIdHR64mgg0y4ZWiVO4/ 5oz9cez3LZTyboD0jmX3CYdiAXq55RBFojVhSgjqIf0ySsbeVrtyM2BfiIxRJuEfeQWv flKIHrnpaCLQ7yOKWf6UQWphHBX2vTuIrEPSbFuEG2GlAxQmq8kiOFxgwo0VfwjZO5o3 i54w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343573; x=1788948373; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=fowu6XI+DUSRHXo45Qm1TWU8fLj7OAHlch8GTHzWiz0=; b=sRPwhH6vtnmdftr71q2LD9Y3Gs+0X/DQeEviaRYdfwqZllhyL0op1A0TCVMrLO387m EvU52Hng+Lr2etYcEJ0E4vmPM8Es9102NvGGUS3LyEeqO7gBTgNW0iP7YfLipl/izmnN 13Ndxod+An/YgRVFx6PdOEPU5QbRIoX2J/KjBAIQ7Q8wCoFLEZjbUrcV0+BSPQdvl3VG EVq2JIx2mz8NHIV+I0BDIbXt4oGJ6yT4UuueeO86Bno2cAS9KXxzUXXEnX71ITgIezPj 7wb8gIZcQZkM0IkfRKepxYVTswvo6J6QJcvk/g/JXalRyy7OkaUQPiPg+i0FwlP1MGia +aQQ== X-Gm-Message-State: AFuF++leFeXP8FEw9MHkWLKTMLeyPeEfmI3SloqaFbBmkDe5r5CdYgmk KJM0dEOmzZyA6JKA3dbBRrm1CeqYfioso3pvvOBKIdvW7jhFVM7vz7FB+1qDkw== X-Gm-Gg: AYBFou3cHxEubDAwQJw49QLr9TsaekgkWUAbkHkTsprOLCcimo+VAgMHeaDvUtC3d8u unxqbjFtFUNqh5y7+NxP7NnGzDWmb+1Onux5/H1lX1G17zM7wldGU3VUIaksppSMvZWFBM/sOio Aa0dTJVqxyb+tCiX1boAYakVl73rbT9uWIFOxzFk9WZmRczXck7HRBI2UEzCX/aiskK8g6XbTEJ rmBQ14KKsBNwYFz2hM79wwT2tePNct+iApIrH2XmaKEfv6xV9T4P4/jNCMIDmjIiXrKlKVJKRdq zcPAfq7QtBPyjkJQFvG+lTpNQF7mHdR/ZKTkVfi8qu5kY2YOL61VtK3ElJNU04KNEBfhiLLc3mq 0suRViICoPnglL2e6mTJDBz1kR1SBhjOSWguK9iG4FJwza2qz5H193n0QtDAaM9m0/obCRDIIp4 sceTpwxVpDEzs2ZPZQyyXzhyRp0tqP+lAP9Avojj52xL5yAz6GKGZhQWpLDkCNILNW86s4v7mE X-Received: by 2002:a17:90b:4d06:b0:398:bf7e:b267 with SMTP id 98e67ed59e1d1-39aedec7bd8mr4901111a91.2.1788343573232; Wed, 02 Sep 2026 03:06:13 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.06.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:12 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 22/28] hostapd: patch CVE-2026-58374 Date: Wed, 2 Sep 2026 22:05:04 +1200 Message-ID: <20260902100511.2105916-22-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129653 From: Ankur Tyagi Apply hostapd patches recommended by upstream[1] as mentioned in the NVD[2] [1] https://w1.fi/security/2026-1/ [2] https://nvd.nist.gov/vuln/detail/cve-2026-58374 Signed-off-by: Ankur Tyagi --- .../hostapd/hostapd/CVE-2026-58374-1.patch | 49 +++++++++++++++++++ .../hostapd/hostapd/CVE-2026-58374-2.patch | 43 ++++++++++++++++ .../hostapd/hostapd_2.11.bb | 2 + 3 files changed, 94 insertions(+) create mode 100644 meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2026-58374-1.patch create mode 100644 meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2026-58374-2.patch diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2026-58374-1.patch b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2026-58374-1.patch new file mode 100644 index 0000000000..9bb8974c50 --- /dev/null +++ b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2026-58374-1.patch @@ -0,0 +1,49 @@ +From 7ab2de9eecf5409f6af1461cf89dbf217930bd45 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Tue, 31 Mar 2026 23:24:04 +0300 +Subject: [PATCH] AP MLD: Fix link ID validation in Basic MLE parsing + +Link ID 15 can be indicated in the field, but that is not a valid value +and must be rejected to avoid issues pointing beyond the array of links +for a non-AP MLD. Without this, an invalid MLE could result in writing +beyond the end of the buffer and causing process termination or +unexpected behavior. + +Fixes: 5f5db9366cde ("AP: MLO: Process Multi-Link element from (Re)Association Request frame") +Signed-off-by: Jouni Malinen + +CVE: CVE-2026-58374 +Upstream-Status: Backport [https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187] +Signed-off-by: Ankur Tyagi +--- + src/ap/ieee802_11_eht.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/src/ap/ieee802_11_eht.c b/src/ap/ieee802_11_eht.c +index b935ee8..804808c 100644 +--- a/src/ap/ieee802_11_eht.c ++++ b/src/ap/ieee802_11_eht.c +@@ -1262,6 +1262,7 @@ u16 hostapd_process_ml_assoc_req(struct hostapd_data *hapd, + size_t sub_elem_len = *(pos + 1); + size_t sta_info_len; + u16 control; ++ u8 link_id; + + wpa_printf(MSG_DEBUG, "MLD: sub element len=%zu", + sub_elem_len); +@@ -1302,8 +1303,13 @@ u16 hostapd_process_ml_assoc_req(struct hostapd_data *hapd, + goto out; + } + control = WPA_GET_LE16(pos); +- link_info = &info->links[control & +- EHT_PER_STA_CTRL_LINK_ID_MSK]; ++ link_id = control & BASIC_MLE_STA_CTRL_LINK_ID_MASK; ++ if (link_id >= MAX_NUM_MLD_LINKS) { ++ wpa_printf(MSG_DEBUG, ++ "MLD: Invalid Link ID in Per-STA Profile subelement"); ++ goto out; ++ } ++ link_info = &info->links[link_id]; + pos += 2; + ml_len -= 2; + sub_elem_len -= 2; diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2026-58374-2.patch b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2026-58374-2.patch new file mode 100644 index 0000000000..7881e687ff --- /dev/null +++ b/meta-oe/recipes-connectivity/hostapd/hostapd/CVE-2026-58374-2.patch @@ -0,0 +1,43 @@ +From 86cefb9f27e0e2d31d857bea483b0735e6441801 Mon Sep 17 00:00:00 2001 +From: Jouni Malinen +Date: Mon, 18 May 2026 15:45:15 +0300 +Subject: [PATCH] AP MLD: Verify AP MLD link ID validity before updating bitmap + of links + +Link ID is 0..14, so ignore value 15 if an invalid frame is processed. +It does not look like the invalid value was actually used to reference +any local array, but in any case, it is better to not mark an invalid +link as being specified. + +Signed-off-by: Jouni Malinen + +CVE: CVE-2026-58374 +Upstream-Status: Backport [https://git.w1.fi/cgit/hostap/commit/?id=ce1a8612e309fe86133ecf05ffb452b0bdf3b035] +Signed-off-by: Ankur Tyagi +--- + src/ap/beacon.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/ap/beacon.c b/src/ap/beacon.c +index cec0c98..cc295c1 100644 +--- a/src/ap/beacon.c ++++ b/src/ap/beacon.c +@@ -1305,6 +1305,7 @@ static bool parse_ml_probe_req(const struct ieee80211_eht_ml *ml, size_t ml_len, + for_each_element_id(sub, 0, pos, len) { + const struct ieee80211_eht_per_sta_profile *sta; + u16 sta_control; ++ u8 link_id; + + if (*links == 0xffff) + *links = 0; +@@ -1324,7 +1325,9 @@ static bool parse_ml_probe_req(const struct ieee80211_eht_ml *ml, size_t ml_len, + * partial profile was requested. + */ + sta_control = le_to_host16(sta->sta_control); +- *links |= BIT(sta_control & EHT_PER_STA_CTRL_LINK_ID_MSK); ++ link_id = sta_control & BASIC_MLE_STA_CTRL_LINK_ID_MASK; ++ if (link_id < MAX_NUM_MLD_LINKS) ++ *links |= BIT(link_id); + } + + if (!for_each_element_completed(sub, pos, len)) { diff --git a/meta-oe/recipes-connectivity/hostapd/hostapd_2.11.bb b/meta-oe/recipes-connectivity/hostapd/hostapd_2.11.bb index ce1c145fd7..f98bad9ef6 100644 --- a/meta-oe/recipes-connectivity/hostapd/hostapd_2.11.bb +++ b/meta-oe/recipes-connectivity/hostapd/hostapd_2.11.bb @@ -15,6 +15,8 @@ SRC_URI = " \ file://hostapd.service \ file://CVE-2025-24912-01.patch \ file://CVE-2025-24912-02.patch \ + file://CVE-2026-58374-1.patch \ + file://CVE-2026-58374-2.patch \ " From patchwork Wed Sep 2 10:05:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97079 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70885C624D0 for ; Wed, 2 Sep 2026 10:06:17 +0000 (UTC) Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9366.1788343576709349968 for ; Wed, 02 Sep 2026 03:06:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=kiWBZeHi; spf=pass (domain: gmail.com, ip: 209.85.216.54, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-398d2b28acfso681915a91.1 for ; Wed, 02 Sep 2026 03:06:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343576; x=1788948376; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=BKzn0n2pLlKo179kVdmLYmDuB95iwSvtweMvRUWXOYk=; b=kiWBZeHiSPqr2RFx403nH7lElQ4RIhb3DKW31LKUOy6hO/tFrHXQ1qiLp5ILWD4jRR PEdUJPTd679GZglCQFXdLPdw+4a/QTX6clYbMpVos/zmfhH1sLeLxi5L/IrjoZ3+84Ac Y5UM3fcHhAqXScxyBGMcURgHeCwy+EfiR05VsixUSx7kRF6N98MWJi5KGDIncw3ddTWG ls2my/bafonobqsA7pbC8PhorlRlbq10Z7VMsvKb3qi0caKY0gkMOMcxjnFxYhbjHn1U oDEe+UOj6JuyLuduSkvuAoux6ZHalRUUw/lhtcWJvs1b1CTQGBZLctauk5mbXDeFB2Y1 wBOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343576; x=1788948376; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=BKzn0n2pLlKo179kVdmLYmDuB95iwSvtweMvRUWXOYk=; b=GYi/xQt2LQxpuTpkT/VlJuDBuUGTPglkQPRpcg09tED+4EXZ3riOOxgcPqcH1X2kun wz7kpwlJvdNxzmAZyLgUkQW8Qf6b604IdyWTpQzPF2E6NvsPO/M0J7HEDH70FFj0xALJ DrcojK2sG+HEv+6nOqqLPMeC12gNvS9vQXN6vpDeBS7fk/dsYdZNGtrT2AAhawzHG7zF yzJIS0gN4QoV7/bSVsen5jK1aWB2uCXJqL8jI6Wwmofe8WoMoMzCltc4uN9oG3h8az1x wC1I7bgwm5snEeMa6H7F81p9ASWPtiEQ0dXy7uMVAvh/Jy61TvRI1FGskUSZH3XERUev QyGg== X-Gm-Message-State: AFuF++lU2abH3huuQvl2vDtM5Yxscyn4nEPOtsYCZOQvSHazqzth8hIO Zrx6U84FEDqm9faAo3Yq5okkr8rjealtmhTMj1oXGuQWvQy8xD81GgrAoWDDHRVo X-Gm-Gg: AYBFou11nhe648H1cvZbOx3dlaR2RJ0jbZ+mPZKcvd7+MFMMDey9rYEHpl1K7AXtndE +HKAmqUdsAhXpKXQ2l4Ej59nxwf93FC03+obd1+ARDzVfkvzXou4pncerNAoLjRFhhqNV2s13dE ROjBcGwFGPPuzkP3qCuGXyAhpPERpbhHw3yVuZX4F0c5sonByOmhhou4ElqFdRmAPwG6ran8eCQ RwuAoi6KMZPtDRXII4bH6Sshj6No+xKbFy+qaB8GsUtW7q2XkCF1/pXBXTpvSTlmR8sID+wciwn ohMCoHb/OMI8Gb66giC7CA8mpahF2NagGpCDqZRnHpR2cHT5S/lANm2vDwei6notZdIayc5udJ7 4cX/+0PixTXhP2Qyn7viH9o1d/vPR5oYkS3q1jLRu2/Mintfwj+xqEKIiEnKnk2LAf+gJenwfmF oataHLFwWuJ5eJVijCSExU3H8KKcdNUj2IrWJO+IMBOLmP0jmOyRnPMHeHVPtCbcx0pGPphnzu X-Received: by 2002:a17:90b:3907:b0:381:11eb:d78e with SMTP id 98e67ed59e1d1-39aee066e04mr4451133a91.14.1788343575884; Wed, 02 Sep 2026 03:06:15 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.06.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:15 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 23/28] hdf5: patch CVE-2026-17572 Date: Wed, 2 Sep 2026 22:05:05 +1200 Message-ID: <20260902100511.2105916-23-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129654 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. Debian[4] has also identified the commit. [1] https://github.com/HDFGroup/hdf5/pull/6499 [2] https://github.com/HDFGroup/hdf5/issues/6501 [3] https://nvd.nist.gov/vuln/detail/cve-2026-17572 [4] https://security-tracker.debian.org/tracker/CVE-2026-17572 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17572.patch | 253 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 254 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch new file mode 100644 index 0000000000..373a6c374e --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch @@ -0,0 +1,253 @@ +From 606bb0a0282d0b056a3bdda1d489a608deee78d2 Mon Sep 17 00:00:00 2001 +From: Nayyar +Date: Tue, 14 Jul 2026 23:39:56 +0530 +Subject: [PATCH] reject SOHM list message count exceeding list_max (#6499) + +* bound SOHM list decode to list_max messages + +* Add tsohm test for out-of-range SOHM list message count + +Create a file with a shared-message list index, corrupt the on-disk +message count so it exceeds list_max (repairing the table checksum), +and confirm reopening rejects the file instead of overrunning the +list image buffer and message array. + +--------- + +Co-authored-by: H. Joe Lee +Co-authored-by: Larry Knox + +CVE: CVE-2026-17572 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/20f0b9564bc46154e60f8d35578720a599d41552] + +Dropped changes to the CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5SMcache.c | 14 ++++ + test/tsohm.c | 173 ++++++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 187 insertions(+) + +diff --git a/src/H5SMcache.c b/src/H5SMcache.c +index eb6d612a78..96687ffed9 100644 +--- a/src/H5SMcache.c ++++ b/src/H5SMcache.c +@@ -489,6 +489,12 @@ H5SM__cache_list_verify_chksum(const void *_image, size_t H5_ATTR_UNUSED len, vo + assert(image); + assert(udata); + ++ /* The buffer only holds list_max messages; a corrupted header whose message ++ * count exceeds that would size the checksum region past the end of it. ++ */ ++ if (udata->header->num_messages > udata->header->list_max) ++ HGOTO_ERROR(H5E_SOHM, H5E_BADVALUE, FAIL, "number of SOHM messages exceeds list size"); ++ + /* Exact size with checksum at the end */ + chk_size = H5SM_LIST_SIZE(udata->f, udata->header->num_messages); + +@@ -552,6 +558,14 @@ H5SM__cache_list_deserialize(const void *_image, size_t H5_ATTR_NDEBUG_UNUSED le + HGOTO_ERROR(H5E_SOHM, H5E_CANTLOAD, NULL, "bad SOHM list signature"); + image += H5_SIZEOF_MAGIC; + ++ /* The message array is sized for list_max entries; a list index always ++ * holds at most that many before it is promoted to a B-tree. Reject a ++ * corrupted header whose message count would drive the decode loop past ++ * the allocation and the input buffer. ++ */ ++ if (udata->header->num_messages > udata->header->list_max) ++ HGOTO_ERROR(H5E_SOHM, H5E_CANTLOAD, NULL, "number of SOHM messages exceeds list size"); ++ + /* Read messages into the list array */ + ctx.sizeof_addr = H5F_SIZEOF_ADDR(udata->f); + for (u = 0; u < udata->header->num_messages; u++) { +diff --git a/test/tsohm.c b/test/tsohm.c +index 1652c9b044..61036e7dc3 100644 +--- a/test/tsohm.c ++++ b/test/tsohm.c +@@ -3702,6 +3702,175 @@ test_sohm_external_dtype(void) + free(orig); + } /* test_sohm_external_dtype */ + ++/*------------------------------------------------------------------------- ++ * Function: test_sohm_reject_bad_count ++ * ++ * Purpose: A shared-message list index holds at most list_max messages ++ * on disk before it is promoted to a B-tree, and both the list ++ * image buffer and the in-memory message array are sized for ++ * list_max entries. Corrupt the on-disk message count so it ++ * exceeds list_max and verify the list load rejects the file ++ * instead of sizing a read or indexing the array past its end. ++ * ++ *------------------------------------------------------------------------- ++ */ ++static void ++test_sohm_reject_bad_count(void) ++{ ++ hid_t fcpl_id = H5I_INVALID_HID; ++ hid_t fid = H5I_INVALID_HID; ++ hid_t sid = H5I_INVALID_HID; ++ hid_t did = H5I_INVALID_HID; ++ hsize_t dims[1] = {4}; ++ FILE *fp = NULL; ++ uint8_t *buf = NULL; ++ long fsize = 0; ++ long table_off = -1; ++ unsigned list_max = 100; ++ uint32_t chksum; ++ size_t pos; ++ int i; ++ herr_t ret; ++ ++ /* On-disk shared-message table layout for a file with a single index and ++ * 8-byte addresses: a 4-byte "SMTB" signature, one index record, then a ++ * 4-byte checksum. Within the record the 16-bit message count follows the ++ * (version, index type, message types, minimum size) prefix and the 16-bit ++ * list and B-tree cutoffs. ++ */ ++ const size_t rec_size = 1 + 1 + 2 + 4 + 3 * 2 + 8 + 8; /* 30 */ ++ const size_t table_body = (size_t)H5_SIZEOF_MAGIC + rec_size; /* 34 */ ++ const size_t num_msgs_off = (size_t)H5_SIZEOF_MAGIC + (1 + 1 + 2 + 4 + 2 + 2); /* 16 */ ++ ++ MESSAGE(5, ("Testing rejection of an out-of-range SOHM list message count\n")); ++ ++ /* Create a file whose single shared-message index is a list that can hold ++ * up to list_max messages before converting to a B-tree. ++ */ ++ fcpl_id = H5Pcreate(H5P_FILE_CREATE); ++ CHECK_I(fcpl_id, "H5Pcreate"); ++ ret = H5Pset_shared_mesg_nindexes(fcpl_id, 1); ++ CHECK_I(ret, "H5Pset_shared_mesg_nindexes"); ++ ret = H5Pset_shared_mesg_index(fcpl_id, 0, H5O_SHMESG_SDSPACE_FLAG | H5O_SHMESG_DTYPE_FLAG, 1); ++ CHECK_I(ret, "H5Pset_shared_mesg_index"); ++ ret = H5Pset_shared_mesg_phase_change(fcpl_id, list_max, 0); ++ CHECK_I(ret, "H5Pset_shared_mesg_phase_change"); ++ ++ fid = H5Fcreate(FILENAME, H5F_ACC_TRUNC, fcpl_id, H5P_DEFAULT); ++ CHECK_I(fid, "H5Fcreate"); ++ ++ /* Several datasets sharing one dataspace and datatype leave the index a ++ * list holding a couple of messages, well under list_max. ++ */ ++ sid = H5Screate_simple(1, dims, NULL); ++ CHECK_I(sid, "H5Screate_simple"); ++ for (i = 0; i < 5; i++) { ++ char name[16]; ++ ++ snprintf(name, sizeof(name), "dset%d", i); ++ did = H5Dcreate2(fid, name, H5T_NATIVE_INT, sid, H5P_DEFAULT, H5P_DEFAULT, H5P_DEFAULT); ++ CHECK_I(did, "H5Dcreate2"); ++ ret = H5Dclose(did); ++ CHECK_I(ret, "H5Dclose"); ++ } ++ ret = H5Sclose(sid); ++ CHECK_I(ret, "H5Sclose"); ++ ret = H5Fclose(fid); ++ CHECK_I(ret, "H5Fclose"); ++ ++ /* Read the whole file so the shared-message table can be located and edited. */ ++ fp = fopen(FILENAME, "rb"); ++ CHECK_PTR(fp, "fopen"); ++ if (fp) { ++ if (fseek(fp, 0, SEEK_END) != 0) ++ TestErrPrintf("fseek failed at line %d\n", __LINE__); ++ fsize = ftell(fp); ++ if (fsize <= (long)(table_body + 4)) ++ TestErrPrintf("unexpected file size %ld at line %d\n", fsize, __LINE__); ++ rewind(fp); ++ ++ buf = (uint8_t *)malloc((size_t)fsize); ++ CHECK_PTR(buf, "malloc"); ++ if (buf && fread(buf, 1, (size_t)fsize, fp) != (size_t)fsize) ++ TestErrPrintf("fread failed at line %d\n", __LINE__); ++ if (fclose(fp) != 0) ++ TestErrPrintf("fclose failed at line %d\n", __LINE__); ++ fp = NULL; ++ } ++ ++ /* Find the shared-message table by signature, confirming the match with the ++ * stored checksum so the correct bytes are edited. ++ */ ++ for (pos = 0; buf && (pos + table_body + 4) <= (size_t)fsize; pos++) { ++ if (memcmp(buf + pos, H5SM_TABLE_MAGIC, (size_t)H5_SIZEOF_MAGIC) != 0) ++ continue; ++ ++ chksum = (uint32_t)buf[pos + table_body] | ((uint32_t)buf[pos + table_body + 1] << 8) | ++ ((uint32_t)buf[pos + table_body + 2] << 16) | ((uint32_t)buf[pos + table_body + 3] << 24); ++ if (chksum == H5_checksum_metadata(buf + pos, table_body, 0)) { ++ table_off = (long)pos; ++ break; ++ } ++ } ++ if (table_off < 0) ++ TestErrPrintf("could not locate the shared-message table in %s\n", FILENAME); ++ ++ if (buf && table_off >= 0) { ++ unsigned bad_count = list_max + 200; /* well past the list_max cutoff */ ++ size_t base = (size_t)table_off; ++ ++ /* Overwrite the 16-bit message count and repair the table checksum so ++ * the table loads and the corruption is only caught at the list. ++ */ ++ buf[base + num_msgs_off] = (uint8_t)(bad_count & 0xff); ++ buf[base + num_msgs_off + 1] = (uint8_t)((bad_count >> 8) & 0xff); ++ ++ chksum = H5_checksum_metadata(buf + base, table_body, 0); ++ buf[base + table_body] = (uint8_t)(chksum & 0xff); ++ buf[base + table_body + 1] = (uint8_t)((chksum >> 8) & 0xff); ++ buf[base + table_body + 2] = (uint8_t)((chksum >> 16) & 0xff); ++ buf[base + table_body + 3] = (uint8_t)((chksum >> 24) & 0xff); ++ ++ fp = fopen(FILENAME, "r+b"); ++ CHECK_PTR(fp, "fopen"); ++ if (fp) { ++ if (fwrite(buf, 1, (size_t)fsize, fp) != (size_t)fsize) ++ TestErrPrintf("fwrite failed at line %d\n", __LINE__); ++ if (fclose(fp) != 0) ++ TestErrPrintf("fclose failed at line %d\n", __LINE__); ++ fp = NULL; ++ } ++ ++ /* Reopen and share a new message, which protects the list and drives ++ * the vulnerable decode. The load should reject the file cleanly. ++ */ ++ fid = H5Fopen(FILENAME, H5F_ACC_RDWR, H5P_DEFAULT); ++ CHECK_I(fid, "H5Fopen"); ++ sid = H5Screate_simple(1, dims, NULL); ++ CHECK_I(sid, "H5Screate_simple"); ++ ++ H5E_BEGIN_TRY ++ { ++ did = H5Dcreate2(fid, "trigger", H5T_NATIVE_INT, sid, H5P_DEFAULT, H5P_DEFAULT, H5P_DEFAULT); ++ } ++ H5E_END_TRY ++ ++ if (did >= 0) { ++ TestErrPrintf("dataset creation succeeded on a corrupted SOHM list at line %d\n", __LINE__); ++ H5Dclose(did); ++ } ++ ++ ret = H5Sclose(sid); ++ CHECK_I(ret, "H5Sclose"); ++ ret = H5Fclose(fid); ++ CHECK_I(ret, "H5Fclose"); ++ } ++ ++ free(buf); ++ ret = H5Pclose(fcpl_id); ++ CHECK_I(ret, "H5Pclose"); ++} /* test_sohm_reject_bad_count */ ++ + /**************************************************************** + ** + ** test_sohm(): Main Shared Object Header Message testing routine. +@@ -3755,6 +3924,10 @@ test_sohm(void H5_ATTR_UNUSED *params) + + test_sohm_extend_dset(); /* Test extending shared datasets */ + test_sohm_external_dtype(); /* Test using datatype in another file */ ++ ++ /* Editing the on-disk table in place needs the single-file sec2 layout */ ++ if (default_driver) ++ test_sohm_reject_bad_count(); /* Test rejecting a bad SOHM list message count */ + } /* test_sohm */ + + /*------------------------------------------------------------------------- diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 20b2f1100e..cd489bdc3f 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -18,6 +18,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://0001-cmake-remove-build-flags.patch \ file://CVE-2026-26199.patch \ file://CVE-2026-26197.patch \ + file://CVE-2026-17572.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Wed Sep 2 10:05:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97084 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C51EDC624D5 for ; Wed, 2 Sep 2026 10:06:27 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9066.1788343578924091569 for ; Wed, 02 Sep 2026 03:06:18 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=FBAg4p2y; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-38e041ea211so832318a91.0 for ; Wed, 02 Sep 2026 03:06:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343578; x=1788948378; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=gLNtS3QUULSN8Mf/xS5mQn5wKXCNoS6An8pR02NkZZE=; b=FBAg4p2yB/nlaEsazmwaALfvkmOxoKWaodr/XJwG2TUrPpobeMh63h8gWjwlNAR+f+ fSJI6+ddYrUg24PHVjHtnb/I9jnjaI/AVfVwp90XoJ71d0LhuR5CafLaOM4vEFdEAxFI yCc3387GsFe5m3seI9M1q2TBZO/b8Mz2eNRMyNh3cUpNYWEcZUW/hNyKeGqZrf4F1k/L 1prRj4PLZRlRyEf6gyyfrE+2hUuMOeVx8yJ09COJU7Rcnlny1yQs6SDcD+eeHyWkViuP Nv/TeqOV7nBx05yvASLMFgL+jMrkQ+eyLbGXJaPLv7cBcZGzphuAHKTUb2HnG85Ahibu HF7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343578; x=1788948378; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=gLNtS3QUULSN8Mf/xS5mQn5wKXCNoS6An8pR02NkZZE=; b=oGUW6riNtPMXOhwzMUyq1I6mBpKjBDsSBBxIf5NctX8IFzP8kCTSpH9xEixNbnoFQa oh93KIz7H9aRnyH6NMD1gpnhjHNtsJPa5AbCKkRAIdzytuZFdx6+AE2KCrhllqnhrFG+ MfHNKUFA5rKfqKgKyNY9DCALQdjYXHIHXmsphoUDlSFovImMkFeZ2KRApW5kFpjbCuwD wXBQI9IFQPoE54d7scrD0bOlOIextZ1aL8PJKuFUt3gJxnIkLqb9467XV2CaElb5JpGT l7c7w50ra5vCdYvr2jlDOiLXlNlhsXAxr34qF1Em6UmQLkXe9pLfrqWYXKcFvhitcmNV sY7Q== X-Gm-Message-State: AFuF++nCm54Szbm/xC7AXaijn67/SfL9BDoYJyC4lXiWQ4MsW44KPigJ IoYK/IHtvoJYzlsz03N4hKBbVxX26l65Wgs9Cv9qkaMNvJMte59ocG32OmXJwAG+ X-Gm-Gg: AYBFou0LkU7u8hNF38qp3+lRavCdPaqYX4FWcBauGGG8j1sPRYJWLuiXS1Qx40DKFnG d65HbJD3AJ8bf4Pxdal1g78vdLU51K5V2gkuiUhSMjX+3Z/1nU2XXVuGNAUWgklH5UwgMa/2lC7 qCFD7mp+VF+HHxV2/46yO0isd+36zLr6r5P+ksvwqLMZsbaJlQ2SZnS8IVWpx51GTACOe9Oxrmo FwHWjKm7Qt4zWWpLzGmDq6HH959i83DSZ0w6FRWW/IpGHqh5zU9Bv5eGJKhROBWXd4FcyMQzyy5 xJAVbE5iKSMKHNJD0gTjGUehfUQZERM5zts8Rov/7gMXjZxkbDbMuKu39R0LakzvwP5ctVw1xaY /18bRfVl8BwlRsV15uzlzFEVZSgQ7NnLIhzQuU35DHRa4g6XJCXgzvPa7g6rueq7l27ZlWtiTj9 LJKRUBbQ9iKo4ASLcHwODoo8+YGb2/yF3pPmncMD2yUNVKhdta6QiA4c0fHh+22dpg8ivVA2l6 X-Received: by 2002:a17:90b:164d:b0:398:c16e:69d3 with SMTP id 98e67ed59e1d1-39aedeb9aecmr5533553a91.1.1788343578203; Wed, 02 Sep 2026 03:06:18 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.06.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:17 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 24/28] hdf5: patch CVE-2026-17573 Date: Wed, 2 Sep 2026 22:05:06 +1200 Message-ID: <20260902100511.2105916-24-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129655 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. Debian[4] has also identified the commit. [1] https://github.com/HDFGroup/hdf5/pull/6160 [2] https://github.com/HDFGroup/hdf5/issues/6124 [3] https://nvd.nist.gov/vuln/detail/cve-2026-17573 [4] https://security-tracker.debian.org/tracker/CVE-2026-17573 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17573.patch | 53 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch new file mode 100644 index 0000000000..3cfb52de42 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch @@ -0,0 +1,53 @@ +From 856e7f1dd23e466ebeab5e454a5891b12e188f6a Mon Sep 17 00:00:00 2001 +From: jhendersonHDF +Date: Tue, 27 Jan 2026 05:55:38 -0600 +Subject: [PATCH] Fix double-free issue in H5D__chunk_copy (#6160) + +Fix double-free caused by loss of buffer pointer after re-allocation + +Co-authored-by: Larry Knox + +CVE: CVE-2026-17573 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/dd3080a58cc6bb86f3b34284399915da9e513262] + +Dropped changes to the CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Dchunk.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/src/H5Dchunk.c b/src/H5Dchunk.c +index f2a0e85c03..5ff537ebde 100644 +--- a/src/H5Dchunk.c ++++ b/src/H5Dchunk.c +@@ -7034,7 +7034,7 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + const H5S_extent_t *ds_extent_src, H5T_t *dt_src, const H5O_pline_t *pline_src, + H5O_copy_t *cpy_info) + { +- H5D_chunk_it_ud3_t udata; /* User data for iteration callback */ ++ H5D_chunk_it_ud3_t udata = {0}; /* User data for iteration callback */ + H5D_chk_idx_info_t idx_info_dst; /* Dest. chunked index info */ + H5D_chk_idx_info_t idx_info_src; /* Source chunked index info */ + int sndims; /* Rank of dataspace */ +@@ -7202,7 +7202,6 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "memory allocation failed for raw data chunk"); + + /* Initialize the callback structure for the source */ +- memset(&udata, 0, sizeof udata); + udata.common.layout = &layout_src->u.chunk; + udata.common.storage = &layout_src->storage.u.chunk; + udata.file_src = f_src; +@@ -7253,11 +7252,11 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + } /* end for */ + } + ++done: + /* I/O buffers may have been re-allocated */ + buf = udata.buf; + bkg = udata.bkg; + +-done: + if (dt_dst && (H5T_close(dt_dst) < 0)) + HDONE_ERROR(H5E_DATASET, H5E_CANTCLOSEOBJ, FAIL, "can't close temporary datatype"); + if (dt_mem && (H5T_close(dt_mem) < 0)) diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index cd489bdc3f..c49d5819be 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -19,6 +19,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-26199.patch \ file://CVE-2026-26197.patch \ file://CVE-2026-17572.patch \ + file://CVE-2026-17573.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Wed Sep 2 10:05:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97085 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9BEAC624D6 for ; Wed, 2 Sep 2026 10:06:27 +0000 (UTC) Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.9371.1788343581524036043 for ; Wed, 02 Sep 2026 03:06:21 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=StOEr/iR; spf=pass (domain: gmail.com, ip: 209.85.216.42, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-398e9698a70so833760a91.0 for ; Wed, 02 Sep 2026 03:06:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343581; x=1788948381; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vBOq2A9SdyvOtz0tMobbgUjhrli/Ut35z6szyUGUDVM=; b=StOEr/iRReRzSL81jYvq1LOkKcr3TgrAbM9qFNlPv7dx6/6WWjjFR2EGcxLLtNjtnZ V1QepttYHoWkzXgO14gkoAQgGqKPJBoG3J7zx0x30YVM+ErZqz+iAGfUZqMeghhCQAvP G/IZz2Uv82T4KUpRyh71LVXvOWUQPvzxqYJ85hhiwoPbqRF7S9az3Tv9avP/KrF8m07e LubAzSrppS9oaLxAnvXlhuNPAgVObDKooWmTRCxuNX65dUT1Vi4jZE60hSnN5wVq3Rcq nbw/29CYlEaj1tkTNGs8t6AKFvpaiv2+VN7IjzivResqZ5lAWgIyf8i0ndO21I+KsOJi rKsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343581; x=1788948381; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=vBOq2A9SdyvOtz0tMobbgUjhrli/Ut35z6szyUGUDVM=; b=UtUqzNhv86aA16m22A5QO2GK8t4f+QS+7EjTBL266SFic6P8XX1j4+VT+itnKQ4qvM kqVEhorrtg/r8kVKPEk9KzI5y7C/09/n0cQ8jUtTM9awNPp+5fQ9kKp67vObDfaepzwZ cQOy+x5y0gs39SK2sa4nE5wKd//zu38usV9yqoKwtoFUVJspH/hddcX7T1omRgkOif/+ c7Qe71NzQQ8GRPSnwrPzOi5jAQeS0lECoLNGEAAMhs9N+zIkiEAYuAcRTb9YWE/M2DN1 1YSI+VwoZ7nrDvnbHzzb3BIaNCs7nBMXspX/jJbIDw3OahjbftBryQ1qjPAEs3W65w9T vPxg== X-Gm-Message-State: AFuF++n9UewSmlgJVLCO+L6H+LLO+0ymdccoGlG73heVb5IR3Y8cMv/k yw+IhLTG7CxxLDR4TqA2lgWjuAzpdr5eUfgU1bSn92zNAz1/tTmzCvhx084LPYIe X-Gm-Gg: AYBFou28sraEV3v/u9MqGc623XvcGURx529psvYJRfmn1eU/y511ttCaCWLDQcKNA6V pe7dFdnvFhI57QxvTbRQ4Npd8TQcsyXZdJrP1DEhdhWbPxMjmPjxiOxFtg38qe6MAswJw3EJGiZ xZE8fL8zyGJlYIrX5j68dFSiabWCii+GwdiHROveQO3/MZyFpItlHaDhPX4aGVtP1RZHaAxhR6p OHhaLtNvSzr8zsSPp/V9LkyAd6rFWPhDLnPq1ozVWaJxw++tMJL8lEsqPhEqMp0cboGjkhjVdn2 3RHcp+pCv5eWfOaHoQTpTBceERk4kHhmBAp1LC+z8USaX/KHgV7AZiBWBHbBkzjoX6mCIQl4S85 6fBhu0qlXOAOluaHnBrsH5mOpf/YoeaVzhsnisxhE9SZKLFAH2IQ1cXkxkx6hDD7CJJ/oiOeW+6 dwiPU0Hf/iPKH/Bx7SyqVLc2OJx+2zexkzk8C99rh2CeHkB/tfhIbyyr74UeoIFvxJ2Z+B2ji8 X-Received: by 2002:a17:90b:3e8d:b0:38e:7168:281 with SMTP id 98e67ed59e1d1-39aedf4c655mr4355493a91.10.1788343580507; Wed, 02 Sep 2026 03:06:20 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.06.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:20 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 25/28] hdf5: patch CVE-2026-17574 Date: Wed, 2 Sep 2026 22:05:07 +1200 Message-ID: <20260902100511.2105916-25-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129656 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-17574 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17574.patch | 65 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 66 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch new file mode 100644 index 0000000000..0ae79a2811 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch @@ -0,0 +1,65 @@ +From e374b227c277e100d9bfa3b1fe5c0b60cdff6c43 Mon Sep 17 00:00:00 2001 +From: tbeu +Date: Thu, 28 May 2026 17:26:57 +0200 +Subject: [PATCH] Validate VL datatype type during decode and check file + pointer in H5T_set_loc (#6395) + +H5O__dtype_decode_helper() reads vlen.type from the file without +validation. With corrupted HDF5 files (e.g. from fuzzing), this field +can have an invalid value that is neither H5T_VLEN_SEQUENCE nor +H5T_VLEN_STRING, which later triggers assert(0) in H5T__vlen_set_loc() +(debug builds) or a NULL pointer dereference / SEGV in release builds. + +Fix by: +1. Adding a validation check in H5O__dtype_decode_helper() immediately + after reading the vlen.type field, returning an error if the value + is invalid. +2. Adding a NULL file pointer check in H5T_set_loc() before calling + H5T__vlen_set_loc() when loc == H5T_LOC_DISK, so the low-level + assert(file) invariant is never violated. + +This fixes the root cause at the decode level where the bad value +enters the system, as requested in review of #6378 and #6385. + +Found by OSS-Fuzz via the matio fuzzer (ClusterFuzz testcase +5366895365914624). + +(cherry picked from commit 3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc) + +CVE: CVE-2026-17574 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc] +Signed-off-by: Ankur Tyagi +--- + src/H5Odtype.c | 2 ++ + src/H5T.c | 5 +++++ + 2 files changed, 7 insertions(+) + +diff --git a/src/H5Odtype.c b/src/H5Odtype.c +index d6405cdb86..6e622f3ebc 100644 +--- a/src/H5Odtype.c ++++ b/src/H5Odtype.c +@@ -751,6 +751,8 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t + */ + /* Set the type of VL information, either sequence or string */ + dt->shared->u.vlen.type = (H5T_vlen_type_t)(flags & 0x0f); ++ if (dt->shared->u.vlen.type != H5T_VLEN_SEQUENCE && dt->shared->u.vlen.type != H5T_VLEN_STRING) ++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, "invalid VL datatype type"); + if (dt->shared->u.vlen.type == H5T_VLEN_STRING) { + dt->shared->u.vlen.pad = (H5T_str_t)((flags >> 4) & 0x0f); + dt->shared->u.vlen.cset = (H5T_cset_t)((flags >> 8) & 0x0f); +diff --git a/src/H5T.c b/src/H5T.c +index 3b2e391a53..e2c9ba9791 100644 +--- a/src/H5T.c ++++ b/src/H5T.c +@@ -6953,6 +6953,11 @@ H5T_set_loc(H5T_t *dt, H5VL_object_t *file, H5T_loc_t loc) + ret_value = changed; + } /* end if */ + ++ /* Validate file pointer for disk-based VL types */ ++ if (loc == H5T_LOC_DISK && NULL == file) ++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, ++ "NULL file pointer for disk-based VL datatype"); ++ + /* Mark this VL sequence */ + if ((changed = H5T__vlen_set_loc(dt, file, loc)) < 0) + HGOTO_ERROR(H5E_DATATYPE, H5E_CANTINIT, FAIL, "Unable to set VL location"); diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index c49d5819be..8b5b842fa0 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -20,6 +20,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-26197.patch \ file://CVE-2026-17572.patch \ file://CVE-2026-17573.patch \ + file://CVE-2026-17574.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Wed Sep 2 10:05:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97083 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 916C3C624D0 for ; Wed, 2 Sep 2026 10:06:27 +0000 (UTC) Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9068.1788343583863305830 for ; Wed, 02 Sep 2026 03:06:23 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=SmtTUy/7; spf=pass (domain: gmail.com, ip: 209.85.214.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2d01663d816so7079595ad.1 for ; Wed, 02 Sep 2026 03:06:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343583; x=1788948383; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9mbe9gI0jjJFZ0xr7RJVarvn2Sz5mNUnrQ8diwcqbv8=; b=SmtTUy/7D6/egEHyf9oKNGZTqeImjcR7vGONC76zJjYQ1GR9nJfNMTMz/EH7bgff9u viXcoNjr2PVwfezmytrA9KcHm9HsfEIoCEwBUXEcFEMS4Zu4vRSk7ehvzTbwBZWqkUOZ VkcylsXyZBJmL9Vx7mXy8tde3FPAwY+CXhRf1BJJrN9kamBfApdU/9eifqpAv9zrVvci C17qgepj7XU9+lD5jznd8InYgnPE1OZ/xUU6THnDE4/dvuauMc/myJLMCjL863aUg4Nk UmLVotTbyW8HjxUkeMA+rbZIdnSAZcFGODlNabX6Z4ZZ4QW65Frt8t1Eed9hy3D4RdeP fYJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343583; x=1788948383; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=9mbe9gI0jjJFZ0xr7RJVarvn2Sz5mNUnrQ8diwcqbv8=; b=mQnML22qkuwyvricY8zaaNOgP1GAtWE2D4qQ1atiQtpXFFZr/s7JYDHYaUwJhxtVdU XVCQLpQ1F2/PuJK3aHLuz08tdORY2SbpoXpYMFi5eunUlaY13k+WQJ/x8/bjwlhS4hYQ k0J0xUkQNKOGQrMYJkBYwWk9QHsu5DqgnCaLEGzLa1hMhUEa5I7cJmm6nPfCIXEAcp51 HPd/b2AXMwSByTetpKj0zXA88nIxfw1u262GVTfTofqUSmckZyNM3/1hexB2KXLinklk o6hLAUmnV0qR6BSjmH6V48hqyASsiaqGyGHdTIRZY0ADZShPG3HK+UZCTcAkpLU+SLgT 1gLg== X-Gm-Message-State: AFuF++kNqatqFRfcbHy12uXaldguzeBRMMn48czBUZaWZcXwElvBu9tG ms394HWtpCtE2JHeoJd+BVnK36OJJpd5481/GkwgFuqmTt4jXedgsFsOZc1hMykC X-Gm-Gg: AYBFou2r+wu6jgFtxweoP0RZQjK92Mh6pP4vo54osPiAb0grZ6uy3jrIEPcKvfi3vPy ZscPKEyjgIEkZIBKjR2aF2iUPLmpUkGUs5kye/M9BTFqVXArVGHhGa/opCjLDwO12MhS1u/43nR M0/zCjT3H444i09rAvG1tRsL4tT9goXnU/FYAxInj2U6ebQ73LrWwdyp2A+8cAFRDx4J8x8LG0T UbVpP87xYtK+Y5q9Yi9CnitNDBlrXEukIsrZh7C3vcD+4uTr9Wq1dwNZl4qJvjZHXMNU2aMlM8s pmCTglEDFLGVepKUwRjrHB1Lfi19EMWGn6KqgWLVnIiOmocUpVDLfDUDgun40WI+XWvv1jityjW H82wGoTekGCiS1Hxwzs4X0P0WlIkm7XB6kYhMdVwklcuTY60ChqzdMG4dgxLm9ihevtZVBesAuR 7VtAqBIA+gBDfa6LawnERum9K6e2YWjwZ12X6Ucw0S9u09BNYrVPMzSknsuoPN4tFnCA4ZIJz4O l/AjwUZJVQ= X-Received: by 2002:a17:90b:3c04:b0:398:d6e8:f84e with SMTP id 98e67ed59e1d1-39aedf5571fmr6134212a91.9.1788343583119; Wed, 02 Sep 2026 03:06:23 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.06.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:22 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 26/28] hdf5: patch CVE-2026-19025 Date: Wed, 2 Sep 2026 22:05:08 +1200 Message-ID: <20260902100511.2105916-26-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129657 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. [1] https://github.com/HDFGroup/hdf5/pull/6508 [2] https://github.com/HDFGroup/hdf5/issues/6491 [3] https://nvd.nist.gov/vuln/detail/cve-2026-19025 Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-19025.patch | 112 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 113 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch new file mode 100644 index 0000000000..075bcf7653 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch @@ -0,0 +1,112 @@ +From 0cb26cd769d1da3f2ad2c3836dc1732309f935a7 Mon Sep 17 00:00:00 2001 +From: Matt L <124107509+mattjala@users.noreply.github.com> +Date: Fri, 28 Aug 2026 13:49:02 -0500 +Subject: [PATCH] Fix CVE-2026-19025 (Reject chunked datasets with mismatched + chunk/dspace rank at open time) (#6508) + +* Reject chunked datasets with mismatched chunk/dspace rank + +H5D__chunk_construct() validates that the chunk layout dimensionality +matches the dataspace rank, but that runs only at dataset creation time. +When an existing dataset is opened, H5D__chunk_init() didn't repeat the +check, so a file whose stored chunk rank disagreed with its dataspace rank +was accepted. During chunk I/O the memory-selection rank (from the +dataspace) and the file-selection rank (chunk ndims - 1) then differ, which +produces a zero stride that causes a divide-by-zero in +H5S__hyper_iter_get_seq_list(). + +H5D__chunk_init() now performs the same dimensionality check on open (the +stored chunk rank includes the extra element-size dimension, so it must be +exactly one greater than the dataspace rank) and rejects a mismatch with an +error. + +Added test_chunk_dims_mismatch() as a regression test in test/dsets.c + +Fixes #6491 + +* Fix typo + +Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> + +* Clarify element-vs-byte wording + +* Validate chunk/dataspace rank at layout decode time + +Move the stored-chunk-rank vs dataspace-rank consistency check out of +H5D__chunk_init() and into H5O__layout_decode(), so a malformed chunked +layout is rejected as the message is decoded (mirroring the fill/datatype +size check in the fill message decode). + +* Update release_docs/CHANGELOG.md + +Co-authored-by: Larry Knox + +* Update CHANGELOG + +* Pin format version bounds in bad chunk layout generator + +--------- + +Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> +Co-authored-by: Larry Knox + +CVE: CVE-2026-19025 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/b7b85e7abf9aa9b1dd9693523defa35217684eb2] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Olayout.c | 32 ++++++ + 1 file changed, 32 insertions(+) + +diff --git a/src/H5Olayout.c b/src/H5Olayout.c +index d230feb992..5dce35e916 100644 +--- a/src/H5Olayout.c ++++ b/src/H5Olayout.c +@@ -23,6 +23,7 @@ + #include "H5FLprivate.h" /* Free Lists */ + #include "H5MMprivate.h" /* Memory management */ + #include "H5Opkg.h" /* Object headers */ ++#include "H5Sprivate.h" /* Dataspaces */ + + /* Local macros */ + +@@ -561,6 +562,37 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU + } + } + ++ /* For a chunked layout, the stored dimensionality includes an extra ++ * element-size dimension, so it must be exactly one greater than the ++ * dataspace rank. Validate that here ++ * to reject malformed files before the inconsistent ++ * ranks can cause problems during chunk I/O. ++ */ ++ if (mesg->type == H5D_CHUNKED && open_oh != NULL) { ++ htri_t space_exists; /* Whether the dataspace message exists */ ++ ++ if ((space_exists = H5O_msg_exists_oh(open_oh, H5O_SDSPACE_ID)) < 0) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't check for dataspace message"); ++ if (space_exists) { ++ H5S_extent_t *extent; /* Dataspace extent from the sibling message */ ++ int rank; /* Dataspace rank */ ++ ++ if (NULL == (extent = (H5S_extent_t *)H5O_msg_read_oh(f, open_oh, H5O_SDSPACE_ID, NULL))) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't read dataspace message"); ++ ++ rank = H5S_extent_get_dims(extent, NULL, NULL); ++ ++ /* Done with the sibling dataspace message */ ++ H5O_msg_free(H5O_SDSPACE_ID, extent); ++ ++ if (rank < 0) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't get dataspace rank"); ++ if (mesg->u.chunk.ndims != (unsigned)rank + 1) ++ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, ++ "dimensionality of chunks doesn't match the dataspace"); ++ } ++ } ++ + /* Set return value */ + ret_value = mesg; + \ No newline at end of file diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 8b5b842fa0..cf199375d3 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -21,6 +21,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-17572.patch \ file://CVE-2026-17573.patch \ file://CVE-2026-17574.patch \ + file://CVE-2026-19025.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Wed Sep 2 10:05:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97082 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD36DC61DD6 for ; Wed, 2 Sep 2026 10:06:27 +0000 (UTC) Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9069.1788343586200755004 for ; Wed, 02 Sep 2026 03:06:26 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=ZrzIrf6m; spf=pass (domain: gmail.com, ip: 209.85.215.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-cc1a4c62804so916513a12.3 for ; Wed, 02 Sep 2026 03:06:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343585; x=1788948385; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ogbGGh9jtlIZq/Ale7HOJ+sENbia9HNrq2dTUIgrP2Y=; b=ZrzIrf6mTXubBYzIN37szaOTYVwvabd9M6UyofCcWTjBg+uJzR9wEeRwxlCdOeuZuk 0yTRqb0WlHsSJGzrI4RmQkOP5htCAkAaw00akDNrgP5LUwysF1xfrZz2evA7CiexnBz+ XmWStAV3xAdwWR5pAM2hRh2UR9OoxdBX06oyV3Whlzi2bVdJf5x27Fnolh/LnbltHJCg 9qYj0j/UKLcVw7FwnR6Bf+B+NpffuYXUGoRTwwGpKpc8seVfp18zXMxOCzDuPzBrROOU LXMOfXVEvkO0lGIR0TfWVTaHI14/jIr6Ix+2NA83IAih4STVdAdPq85mFVocfqZhVqCg zWBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343585; x=1788948385; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ogbGGh9jtlIZq/Ale7HOJ+sENbia9HNrq2dTUIgrP2Y=; b=dz91l3+mgWhtsjPm3odTThwNwtQQZC+AV0w9ME0agE7KjBvcMnY7KiIJUy24+Vv1aR RW/JPvCGQ/puYs379nl9p3XccXhlHgxSkOPG2LFwOtzasqudXTN03BfmTbx9BdSMNmMU Zs8q70YvR2LN8I+k+9RKvAaK+7ZjjyZUV4RXzIx+VqnkzaFt/Bex2/tpan4qBeID700P c0V5s1UnGmtXkni97pszeTMYHFbISlV7uHxvR68GP0BGKPENsCudrBJRcEOc4HVjwiTp 8Q123SXckfcsRcxUmSUMghJcTU4SAxZzwpsctbhRsG7Bsm4SzJJ9l5A3hckAZwVuYbm8 3oYQ== X-Gm-Message-State: AFuF++nueHWSzSAcnXiDaSAg0gSxO02GXXI57xhX1aqHAwqqbWIEr0w+ kQqV5v8N/58bMvQhVFud/dvPszEkiO2rg95q5f+D7Cj0h1SM0plcWofFZcofwA== X-Gm-Gg: AYBFou1gMox5g0mJ+ee4jUv2kyOyVcTTCPNYDT/pj066aEneU2NUjpJD+eo85RZIjGt 9K8ditBBm0W48zAuYLrsbyzsO6yYf4tGHjenzk7OrcsZYXhIfVwStxkUKm8yvD3zA6PpsSrmqGT PLdgqHsLdksqG4IkwEwfz0v2rSyndDb/QlbMo+bcuR6xZToyt9k6mtqtrUacx/tsYfy/xx4+inu yk289DWBf7jfjHTjTzgFwI32bsEgjYNnL2afj5UCTOSvXKZUHtdU1HkCk+/dDz+mmZudmIgr77C IKvm0djueF+F+pa40DXolhSjkC45hLl9lM1geM7ydvdRzVLULuY++T9DrKRz5K8KXNJTcJFuokm OQfg1hB1ZbcsrzN+buNZe0GmYWepH4Kbab69cBTdIuxD3qDi2+PA792V1l9goADKdzk0Ju9zilJ 6CnkrrkysnqnfmbAcUsrhaRGzaYXTmhijSJkvx5n4a6tYmSon2+sAxpCnhTH00q3XR5j+g+ACO X-Received: by 2002:a17:90b:28cd:b0:398:e96a:8999 with SMTP id 98e67ed59e1d1-39aee0e6633mr5467600a91.16.1788343585569; Wed, 02 Sep 2026 03:06:25 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.06.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:25 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][wrynose][PATCH 27/28] iftop: ignore CVE-2026-3824, CVE-2026-3825 and CVE-2026-3826 Date: Wed, 2 Sep 2026 22:05:09 +1200 Message-ID: <20260902100511.2105916-27-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129658 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-3824 https://nvd.nist.gov/vuln/detail/cve-2026-3825 https://nvd.nist.gov/vuln/detail/cve-2026-3826 Signed-off-by: Ankur Tyagi --- meta-networking/recipes-support/iftop/iftop_1.0pre4.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta-networking/recipes-support/iftop/iftop_1.0pre4.bb b/meta-networking/recipes-support/iftop/iftop_1.0pre4.bb index 4d9fea58e0..5971af2b3c 100644 --- a/meta-networking/recipes-support/iftop/iftop_1.0pre4.bb +++ b/meta-networking/recipes-support/iftop/iftop_1.0pre4.bb @@ -15,3 +15,6 @@ SRC_URI[sha256sum] = "f733eeea371a7577f8fe353d86dd88d16f5b2a2e702bd96f5ffb2c197d inherit autotools-brokensep +CVE_STATUS[CVE-2026-3824] = "cpe-incorrect: this CVE is for WellChoose" +CVE_STATUS[CVE-2026-3825] = "cpe-incorrect: this CVE is for WellChoose" +CVE_STATUS[CVE-2026-3826] = "cpe-incorrect: this CVE is for WellChoose" From patchwork Wed Sep 2 10:05:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97086 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CC0DAC624D0 for ; Wed, 2 Sep 2026 10:06:37 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.9070.1788343588516547894 for ; Wed, 02 Sep 2026 03:06:28 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=MMJXVfzt; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-3964dfb5b9aso1074937a91.1 for ; Wed, 02 Sep 2026 03:06:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788343588; x=1788948388; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=jtt+uzyesIPhXyMXbLlASGAvehecRRtc9upUfnBK3E8=; b=MMJXVfzt0hieZvVKi9Ija2NV0VoXMvY3WqC5CfmKQjQ7M6kARzG25tru75E/4n7G/S HNktBrE7AJWP8U+BylpiM3+RWM3meELbrM8ggwLRLwXgA7mDxt2YAvbz4ojS7rrsidmu eoPxldZ+qwP62p0MEavXypP46YqtteUDbfw1/Umu5VCh+ayDCBsydbhPZGsHf7Ohp0aX Ou4+oHUIp72BTA2NZ0d8XzThk9wwZUPjJq3pduEfrj2QqVOk0ZFxYowqWquxGP7l9hNx STC3OJ93JtOWmIJVrCLC2fLzN4tYfQzETJehol1lP6ceaIzzlYQazgXZkG5+/67OgSL8 U7Fg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788343588; x=1788948388; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=jtt+uzyesIPhXyMXbLlASGAvehecRRtc9upUfnBK3E8=; b=W+4uVdSIIgOiQ7vw7yJyovxUcds99QVPSPI2v45jiNRCsrNMDHhVv1CBggYAEjbzR3 ggwPfbkIJVKpG5kkLVgqRNXYZ+nOfYd+N3kU1Hnu6b57DUlIBzDodIoIe+z5IHonqP07 2B3hXAIRgZ/817QtWv5RsiyLr3ENrpNW34sX2ZTBF629E25ihs0lM/cFoQKumQd/Wbao /d5HcmmWpM413Bjdm3zNRYerGSsVzTjewyTGZ1UmWNU+NQgznDAledp7KnRMT3ZS/flo 9R6HkSRh9p4sxF3bIpv1pF5pEQGm8a8uwnqkJbgM5Yiw9PyNiKw9C4/gzOFgMvJZR2TZ EE0w== X-Gm-Message-State: AFuF++nds5zoBdgheetTkKBrCJLHpaz+F1YPq7hO7sEqVnJzQx+G06HY 4J5dF0Jfee+N2t2XSUN7DegD16AMgz82YUYyrVlIinm+6Zc8sr2aYbc7gYwpiw== X-Gm-Gg: AYBFou3DEGtMErIXzh81vY7P3nKohEQaX3xpJmiTpSmKjGozlqHUFpicnUd6aIVFJbm QYHxc1bgUFWBgwwvuQ3KN+NLFRvhSbzl0MZKw9B8Tfx0O0+s1L7Mfp6FR4Vl0GTb474UEaBegUq CDZWR/jHJDuq8h5bSIU5nHloWXadJREtzLnOJbDVBF4ZtJnwBlpK+YaeP6rLzrL1tk37fBIwTdw 0ahyNRu3gpGiigFkFgaezgfJBSBpshv8qu0jU8d3MIIfEH1o7Sim9ljt1hwM4scI/zCsaHLX5jn yvSriqdaruNAyrGocQ9ISbtIm+0X5W9W0K5xsMcbH2n0xlVp7IOhU7MhfGTX4JPxBDKSYG43y6w YHRyRjPm1JZSSRiJwxq1gAh/9TBWbAYVQJrsBv7PL7mG8j5MBM0oLa8rK5sAPixjenRodldcPVq tOGpMeucvqLpah1tdBgCai/ufXMX7XuFQqGDPwieWQk0i7DMWBaNWt+4Y55zlvG0yqcd25EW9dY g== X-Received: by 2002:a17:90b:2644:b0:38e:9045:babe with SMTP id 98e67ed59e1d1-39aedfbd99amr5492316a91.7.1788343587775; Wed, 02 Sep 2026 03:06:27 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3990bd1dcfbsm10766784a91.2.2026.09.02.03.06.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 02 Sep 2026 03:06:27 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 28/28] iniparser: mark CVE-2025-0633 pached Date: Wed, 2 Sep 2026 22:05:10 +1200 Message-ID: <20260902100511.2105916-28-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> References: <20260902100511.2105916-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 02 Sep 2026 10:06:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129659 From: Ankur Tyagi Also mentioned in the release notes[1] Detais: https://nvd.nist.gov/vuln/detail/cve-2025-0633 [1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb b/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb index 9ab713ee92..5958ecb9c6 100644 --- a/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb +++ b/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb @@ -15,3 +15,5 @@ EXTRA_OECMAKE = " \ " FILES_${PN}-staticdev += "${libdir}/cmake/iniparser/iniparser-staticTargets*.cmake" + +CVE_STATUS[CVE-2025-0633] = "fixed-version: fixed in v4.2.6"