From patchwork Sun Sep 27 00:39:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 99264 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86705C9833E for ; Sun, 27 Sep 2026 00:39:40 +0000 (UTC) Received: from mail-pj2-f43.google.com (mail-pj2-f43.google.com [74.125.227.171]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.29994.1790469569801429810 for ; Sat, 26 Sep 2026 17:39:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=GPlYnsxh; spf=pass (domain: gmail.com, ip: 74.125.227.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj2-f43.google.com with SMTP id 98e67ed59e1d1-396ccafb752so1018791a91.0 for ; Sat, 26 Sep 2026 17:39:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790469569; x=1791074369; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=N8zhEvPPU1tlcLI5eM+mzVbfuOveqqujSkFW4Xtd3Qk=; b=GPlYnsxh/vbTJmBGR/BV43s6XTPuxuY7jVHnJPZJbrS3JrVxVV5wmPtSRVT3b505cY NL9tQ7V3zx567hdYYkLOYALWFnCTEmgKKhBwjLVIWmgZxfkYj4HxcZUwzVg1dmKMFvQk lD5QhkmNnvwxZQmv6C6EfAW0SSn9ymY0I+3ZtDho1wF5+8waFKZ+Lg1SKYbU5hhmiUrC xc7xuv7p48YDoY93qZSaz9mvbSDLN6PhMqyozlo03r/rYLf5CbxPXqzYvny+xUBSMyhs pWicXlwYm5AtjWgDy+ltZv3G6VzcHpNSAW/i+S5Szdl1SM+5OuYu51MC8iWYCvN+Dn3s cVaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790469569; x=1791074369; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=N8zhEvPPU1tlcLI5eM+mzVbfuOveqqujSkFW4Xtd3Qk=; b=2dOXoFpDYGL5oWILAcB4azcEr/OXnNlmmfI6Yfw4hCCU4GvUqIrOR9mC7fhoUlXxD5 o4tUINbPFIwvhGDxiM+UrfKFKuAvkvrvblTOhc3mD0JPj8C09RlTbqmDXGVUBfISkDx9 xrLnrUcjF1V+QWrC5D3jrioKNAKCHGOuu7MmHhdULZ3bcoVZO5CFaDoHQbmMpWgSfjuk emctzLCEqJU0uYML8YvndxmDXP9GtHk1TWt0NyxndrZ5TKXwyaM7iRYtcL3Z9UOCTG08 unb1QIiTPYar6RMnQLD7ThfLtr9BaOyS93qY9Ev8hjGs5QSCnER/xgzh0ugQo/trmN/T EXCQ== X-Gm-Message-State: AFq9FYIdZFmiIY+oRSL2XpgIv1V9V3wsPF4AQy0AoK7fO7hh8WfmkPic L1RXs+zmsLdebZq8UBK99ybXYED6lXa2J6K/actsszXEhzcQxx56dIuXg9a6Bw== X-Gm-Gg: AYBFou1ms1GFbRyvLPcL2abSX5Bmx/JQ16E8Sy4/AVsiksGhkUkP1Ns0/aKK4CNiFBO 7TZGLHcA+JhHs2cT4O48hoY7vpojOk8N921wywJLszPcsvEv+5N4sgY+EHTdKjW9z58OErU4NRE 54tX/zPSsBbxPwpq82j82vsn8rw0DtqwVAT/MVqCBBEDMq5QrGA1gGVGTPqWrt0HuVW6M4BX7uX ayQ6juWl3q7twUQbIqtysiphai1a3RMu/3D5VXSi4CJLbuw0PoUn7nwpq80JWHRw8O9s7AzO8nV K8WBI9XgmD1YjVVa343cgrqOwxDPg43rdGjgHKye9htC6jC5+PbBeoeJ47Rv1qylAkKXk3/fFVT eO9D5nqE0OU/FsOxcchbrB0PXg9NxSNGeRti6IfJGghtuyTOlywtcuVg2TGPDbmmduWojQQct/u Ewl0mASs9LArNVEYqZUAHR+iYusjcePWU6gxdEcDypsO4iTVH1bEANoozwiSWGLfzUyV3jt0RL2 ESwX22yiGeoY1jQnzFRsiY= X-Received: by 2002:a17:90b:44:b0:3a0:cc33:2285 with SMTP id 98e67ed59e1d1-3a0cc3324bcmr3598687a91.22.1790469568957; Sat, 26 Sep 2026 17:39:28 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a0d22281f0sm2876420a91.1.2026.09.26.17.39.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 17:39:28 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][wrynose][PATCH 1/11] unbound: patch CVE-2026-80225 Date: Sun, 27 Sep 2026 13:39:11 +1300 Message-ID: <20260927003921.746786-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 00:39:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130320 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-80225 Signed-off-by: Ankur Tyagi --- .../unbound/unbound/CVE-2026-80225.patch | 286 ++++++++++++++++++ .../recipes-support/unbound/unbound_1.24.2.bb | 1 + 2 files changed, 287 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-80225.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-80225.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-80225.patch new file mode 100644 index 0000000000..fb7dda7a15 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-80225.patch @@ -0,0 +1,286 @@ +From 5d92dbc699c7a347be74b3752b1c3ee690e4dec1 Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 16 Sep 2026 09:16:29 +0200 +Subject: [PATCH] - Fix CVE-2026-80225, Possible degradation of service from + continuous queries on the same TCP/DoT connection. Thanks to Qifan Zhang + from Palo Alto Networks for the report. + +(cherry picked from commit e619ead2dbcde8fc47f03b2ac68987b3377da4c7) + +CVE: CVE-2026-80225 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/e619ead2dbcde8fc47f03b2ac68987b3377da4c7] + +Signed-off-by: Ankur Tyagi +--- + services/listen_dnsport.c | 12 ++++++- + services/listen_dnsport.h | 8 ++++- + testcode/testbound.c | 10 ++++++ + util/fptr_wlist.c | 2 ++ + util/netevent.c | 66 ++++++++++++++++++++++++++++++++++++++- + util/netevent.h | 9 ++++++ + 6 files changed, 104 insertions(+), 3 deletions(-) + +diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c +index d49d4ad4c..9b6fb557c 100644 +--- a/services/listen_dnsport.c ++++ b/services/listen_dnsport.c +@@ -2134,7 +2134,7 @@ void listen_start_accept(struct listen_dnsport* listen) + } + + struct tcp_req_info* +-tcp_req_info_create(struct sldns_buffer* spoolbuf) ++tcp_req_info_create(struct comm_base* base, struct sldns_buffer* spoolbuf) + { + struct tcp_req_info* req = (struct tcp_req_info*)malloc(sizeof(*req)); + if(!req) { +@@ -2142,6 +2142,12 @@ tcp_req_info_create(struct sldns_buffer* spoolbuf) + return NULL; + } + memset(req, 0, sizeof(*req)); ++ req->read_again_timer = comm_timer_create(base, tcp_read_again_cb, req); ++ if(!req->read_again_timer) { ++ log_err("malloc failure"); ++ free(req); ++ return NULL; ++ } + req->spool_buffer = spoolbuf; + return req; + } +@@ -2151,6 +2157,7 @@ tcp_req_info_delete(struct tcp_req_info* req) + { + if(!req) return; + tcp_req_info_clear(req); ++ comm_timer_delete(req->read_again_timer); + /* cp is pointer back to commpoint that owns this struct and + * called delete on us */ + /* spool_buffer is shared udp buffer, not deleted here */ +@@ -2189,6 +2196,9 @@ void tcp_req_info_clear(struct tcp_req_info* req) + req->done_req_list = NULL; + req->num_done_req = 0; + req->read_is_closed = 0; ++ ++ if(comm_timer_is_set(req->read_again_timer)) ++ comm_timer_disable(req->read_again_timer); + } + + void +diff --git a/services/listen_dnsport.h b/services/listen_dnsport.h +index 963595a1c..79f46705f 100644 +--- a/services/listen_dnsport.h ++++ b/services/listen_dnsport.h +@@ -345,6 +345,10 @@ struct tcp_req_info { + int num_done_req; + /** list of pending writable result packets, malloced one at a time */ + struct tcp_req_done_item* done_req_list; ++ /** the read again timer, when the number of pipelined TCP queries ++ * is large, it waits, zero time, for a new event loop to service ++ * the remainder of the TCP traffic on the fd. */ ++ struct comm_timer* read_again_timer; + }; + + /** +@@ -375,10 +379,12 @@ struct tcp_req_done_item { + * Create tcp request info structure that keeps track of open + * requests on the TCP channel that are resolved at the same time, + * and the pending results that have to get written back to that client. ++ * @param base: comm base for read again timer. + * @param spoolbuf: shared buffer + * @return new structure or NULL on alloc failure. + */ +-struct tcp_req_info* tcp_req_info_create(struct sldns_buffer* spoolbuf); ++struct tcp_req_info* tcp_req_info_create(struct comm_base* base, ++ struct sldns_buffer* spoolbuf); + + /** + * Delete tcp request structure. Called by owning commpoint. +diff --git a/testcode/testbound.c b/testcode/testbound.c +index 063037df4..3a3bcaef6 100644 +--- a/testcode/testbound.c ++++ b/testcode/testbound.c +@@ -786,3 +786,13 @@ size_t doq_table_quic_size_get(struct doq_table* ATTR_UNUSED(table)) + return 0; + } + #endif ++ ++void tcp_read_again_cb(void* ATTR_UNUSED(arg)) ++{ ++ /* nothing */ ++} ++ ++void tcp_more_read_again_cb(void* ATTR_UNUSED(arg)) ++{ ++ /* nothing */ ++} +diff --git a/util/fptr_wlist.c b/util/fptr_wlist.c +index 3c863d5e1..2cf3d320e 100644 +--- a/util/fptr_wlist.c ++++ b/util/fptr_wlist.c +@@ -141,6 +141,8 @@ fptr_whitelist_comm_timer(void (*fptr)(void*)) + #ifdef UB_ON_WINDOWS + else if(fptr == &wsvc_cron_cb) return 1; + #endif ++ else if(fptr == &tcp_read_again_cb) return 1; ++ else if(fptr == &tcp_more_read_again_cb) return 1; + else if(fptr == &auth_xfer_timer) return 1; + else if(fptr == &auth_xfer_probe_timer_callback) return 1; + else if(fptr == &auth_xfer_transfer_timer_callback) return 1; +diff --git a/util/netevent.c b/util/netevent.c +index aedcb5e07..0dde9059c 100644 +--- a/util/netevent.c ++++ b/util/netevent.c +@@ -122,6 +122,10 @@ + #define NUM_UDP_PER_SELECT 1 + #endif + ++/** The number of TCP queries over a TCP connection, per read indication ++ * from select. */ ++#define NUM_TCP_PER_SELECT 100 ++ + /** timeout in millisec to wait for write to unblock, packets dropped after.*/ + #define SEND_BLOCKED_WAIT_TIMEOUT 200 + /** max number of times to wait for write to unblock, packets dropped after.*/ +@@ -4546,6 +4550,10 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c) + static int + tcp_req_info_read_again(int fd, struct comm_point* c) + { ++ /* One event-loop visit drains at most this many pipelined queries; ++ * the rest is re-queued, so that other file descriptors get ++ * serviced in between. */ ++ int budget = NUM_TCP_PER_SELECT; + while(c->tcp_req_info->read_again) { + int r; + c->tcp_req_info->read_again = 0; +@@ -4562,6 +4570,16 @@ tcp_req_info_read_again(int fd, struct comm_point* c) + } + return 0; + } ++ if(--budget <= 0 && c->tcp_req_info->read_again) { ++ /* Defer the rest of the drain to the next loop turn. ++ * This uses a zero delay timer. For TLS the undrained ++ * remainder sits in OpenSSL's user-space buffer. */ ++ struct timeval tv; ++ memset(&tv, 0, sizeof(tv)); ++ verbose(VERB_ALGO, "Defer tcp_req_info read again"); ++ comm_timer_set(c->tcp_req_info->read_again_timer, &tv); ++ return 1; ++ } + } + return 1; + } +@@ -4575,6 +4593,7 @@ tcp_more_read_again(int fd, struct comm_point* c) + /* this continues until the read routines get EAGAIN or so, + * and thus does not call the callback, and the bool is 0 */ + int* moreread = c->tcp_more_read_again; ++ int budget = NUM_TCP_PER_SELECT; + while(moreread && *moreread) { + *moreread = 0; + if(!comm_point_tcp_handle_read(fd, c, 0)) { +@@ -4587,6 +4606,30 @@ tcp_more_read_again(int fd, struct comm_point* c) + } + return; + } ++ if(--budget <= 0 && *moreread) { ++ /* Defer the rest of the drain to the next loop turn. ++ * This uses a zero delay timer. For TLS the undrained ++ * remainder sits in OpenSSL's user-space buffer. */ ++ struct timeval tv; ++ memset(&tv, 0, sizeof(tv)); ++ if(!c->tcp_more_read_again_timer) { ++ c->tcp_more_read_again_timer = comm_timer_create(c->ev->base, tcp_more_read_again_cb, c); ++ if(!c->tcp_more_read_again_timer) { ++ log_err("out of memory for tcp more read again timer"); ++ reclaim_tcp_handler(c); ++ if(!c->tcp_do_close) { ++ fptr_ok(fptr_whitelist_comm_point( ++ c->callback)); ++ (void)(*c->callback)(c, c->cb_arg, ++ NETEVENT_CLOSED, NULL); ++ } ++ return; ++ } ++ } ++ verbose(VERB_ALGO, "Defer more read again"); ++ comm_timer_set(c->tcp_more_read_again_timer, &tv); ++ return; ++ } + } + } + +@@ -4614,6 +4657,23 @@ tcp_more_write_again(int fd, struct comm_point* c) + } + } + ++void ++tcp_read_again_cb(void* arg) ++{ ++ struct tcp_req_info* req = (struct tcp_req_info*)arg; ++ verbose(VERB_ALGO, "tcp_read_again_cb"); ++ if(!tcp_req_info_read_again(req->cp->fd, req->cp)) ++ return; ++} ++ ++void ++tcp_more_read_again_cb(void* arg) ++{ ++ struct comm_point* c = (struct comm_point*)arg; ++ verbose(VERB_ALGO, "tcp_more_read_again_cb"); ++ tcp_more_read_again(c->fd, c); ++} ++ + void + comm_point_tcp_handle_callback(int fd, short event, void* arg) + { +@@ -6025,7 +6085,7 @@ comm_point_create_tcp_handler(struct comm_base *base, + c->pp2_enabled = parent->pp2_enabled; + c->pp2_header_state = pp2_header_none; + if(spoolbuf) { +- c->tcp_req_info = tcp_req_info_create(spoolbuf); ++ c->tcp_req_info = tcp_req_info_create(base, spoolbuf); + if(!c->tcp_req_info) { + log_err("could not create tcp commpoint"); + sldns_buffer_free(c->buffer); +@@ -6584,6 +6644,9 @@ comm_point_close(struct comm_point* c) + *c->tcp_more_read_again = 0; + if(c->tcp_more_write_again && *c->tcp_more_write_again) + *c->tcp_more_write_again = 0; ++ if(c->tcp_more_read_again_timer && ++ comm_timer_is_set(c->tcp_more_read_again_timer)) ++ comm_timer_disable(c->tcp_more_read_again_timer); + + /* close fd after removing from event lists, or epoll.. is messed up */ + if(c->fd != -1 && !c->do_not_close) { +@@ -6623,6 +6686,7 @@ comm_point_delete(struct comm_point* c) + free(c->tcp_handlers); + } + free(c->timeout); ++ comm_timer_delete(c->tcp_more_read_again_timer); + if(c->type == comm_tcp || c->type == comm_local || c->type == comm_http) { + sldns_buffer_free(c->buffer); + #ifdef USE_DNSCRYPT +diff --git a/util/netevent.h b/util/netevent.h +index c5114bbbe..dae2c375a 100644 +--- a/util/netevent.h ++++ b/util/netevent.h +@@ -380,6 +380,9 @@ struct comm_point { + * Or leave NULL if it is not used at all. */ + int* tcp_more_write_again; + ++ /** resume timer for tcp_more_read_again */ ++ struct comm_timer* tcp_more_read_again_timer; ++ + /** if set, read/write completes: + read/write state of tcp is toggled. + buffer reset/bytecount reset. +@@ -1127,6 +1130,12 @@ void doq_send_pkt(struct comm_point* c, struct doq_pkt_addr* paddr, + /** doq timer callback function. */ + void doq_timer_cb(void* arg); + ++/** tcp read again callback function. For tcp req info listen. */ ++void tcp_read_again_cb(void* arg); ++ ++/** tcp more read again callback function. For outside network. */ ++void tcp_more_read_again_cb(void* arg); ++ + /** + * This routine is published for checks and tests, and is only used internally. + * handle libevent callback for timer comm. diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index faf315876c..0b59d7c9f9 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -43,6 +43,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t file://CVE-2026-55991.patch \ file://CVE-2026-56416.patch \ file://CVE-2026-56444.patch \ + file://CVE-2026-80225.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c" From patchwork Sun Sep 27 00:39:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 99260 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01369C98328 for ; Sun, 27 Sep 2026 00:39:38 +0000 (UTC) Received: from mail-pj2-f40.google.com (mail-pj2-f40.google.com [74.125.227.168]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.29995.1790469572198626512 for ; Sat, 26 Sep 2026 17:39:32 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=lGHB8Qtc; spf=pass (domain: gmail.com, ip: 74.125.227.168, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj2-f40.google.com with SMTP id 98e67ed59e1d1-3a0eeda3e03so223025a91.1 for ; Sat, 26 Sep 2026 17:39:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790469571; x=1791074371; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=37aJK3mxQLizslUDs+/kI8C2CLgfArSBL1h1FJGJ4Og=; b=lGHB8Qtcx5nOzPz7KkNnRc1ImKaudmYT/reYxLRfLiGtd+vEi6MQqcxaFOJlsh1IWK +G/+rAWWLMVRMJxPileyxClJgHHB1KvvSkhfFdhm4TaZ2qwC6MwJIObt4iN/IHUUE78M hhglDazaPlgo9UID8mfCe5zTsUPNWITiG5m28Hvg5h10endZQ55UXjVwic1dPFYcfy3y 1+HEDrLHWTZ55eXu+0Vyq5ELBLNqQbOPAxj5XBvFXaGUVtNi2szBuEQAUq5E2wNdV6ok GqRABUeIUNJ9QmwZV7Rw8LLTNO8RJay24aO0xJy5RMq1klkNGlmhNX0V/YJGe1lKT1A6 B46g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790469571; x=1791074371; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=37aJK3mxQLizslUDs+/kI8C2CLgfArSBL1h1FJGJ4Og=; b=KRZDgs82dE+EtB9U+WH+C0UVO8Ewqui3znWC3//NZfhGO2CJ2ze+NQbhlQGs1YUGmR Q6iiyaRhKPeKRejEBGbTZ3pUKSH8sIaKkW6+bD42qfytwuWW2z2wOV/4aiL8wp9dQg2h BhW86SG3zCuukgaAXTpPIsLIEd1tlNNRj3bya/svItpPlThHCrsv9NKmMNZ49DvWniKI 505ZQ1S2thQg0vBxACOR8fLaugFYyLtiSemay0FOlpwWQ4fEX/uJbsGxtG5NHSAudOm+ timXiEb2qtNcMgl+TVgtWTbtXabV0CeeKmHU1apA9uWX2IU/bV4dAaPK224Q79m93/Hs MgFQ== X-Gm-Message-State: AFq9FYI8NgV5P9aY3L2hQZATh5by+QZKjLQW/nu3cz6T102IoGPtTtZb y4eFsLqPZeVZPlhs8udFz7P/Kmc3cz4+91drDD3iCMVc5hTsUKmwxh+X7IOeCg== X-Gm-Gg: AYBFou0eLXk6UWWkofddaR4vh2ymHFUrs7U4LsemMBDx06wNoC8oFTr4PpUidiTyVqp adKHipf0z/It3vEiEFLx+lXjAE0BIKZUjhkkkvdYe4YCgkg+Wu/HIfAPsRnaSpuiYlN1hWOziTZ cQN5nh158/WT9JbWWrdwBXFnNODdJb1t00PzoWkeVlHEA95NTU39glcyPzJbyaOOroE2utCDQKI 8zSxKiw8zOVPu10VN2X+SG5Ob6YJlX60RF2uDpLGPvbUr7BwogDn8QhNov2lyXATtZyQNegsRpb oKtohF45e3GHqxKh1/jFi6565TgIYKRLhsaDwrgdWXbaAnmgoojEY55X1eLlA9IIn12zeE6eCE5 d7RLx4mG66jCbPjSpnAAZeXMlbGpHrAlsaNEDh9/Gni9YC7RUNAGjyY8Kz9UhYmJgHNEHFauevA CWHJ5SIjP/0IKeC2wbviqMHOgVIoOmvpY63lgpNNKuftKdQZilqWx86EK0ztXJRtrd7vR5gFG59 pM01JwV4iokbt3yQfpWz94= X-Received: by 2002:a17:90b:1c83:b0:3a0:cde8:1dd6 with SMTP id 98e67ed59e1d1-3a0cde82a7amr2569539a91.6.1790469571471; Sat, 26 Sep 2026 17:39:31 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a0d22281f0sm2876420a91.1.2026.09.26.17.39.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 17:39:31 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][wrynose][PATCH 2/11] unbound: patch CVE-2026-81642 Date: Sun, 27 Sep 2026 13:39:12 +1300 Message-ID: <20260927003921.746786-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260927003921.746786-1-ankur.tyagi85@gmail.com> References: <20260927003921.746786-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 00:39:38 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130321 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-81642 Signed-off-by: Ankur Tyagi --- .../unbound/unbound/CVE-2026-81642.patch | 30 +++++++++++++++++++ .../recipes-support/unbound/unbound_1.24.2.bb | 1 + 2 files changed, 31 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch new file mode 100644 index 0000000000..9f77424a95 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch @@ -0,0 +1,30 @@ +From a774b2050a1543e87def9cba0e25dcdabffde526 Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 16 Sep 2026 09:18:49 +0200 +Subject: [PATCH] - Fix CVE-2026-81642, Heap buffer overflow and possible + Remote Code Execution when digesting DNSKEY. Thanks to Yuqi Qiu and Xiang + Li from Nankai University, AOSP Lab for the report. + +(cherry picked from commit 8c2e0fd6cc5b6eaa618ac72227808824b4edee7c) + +CVE: CVE-2026-81642 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/8c2e0fd6cc5b6eaa618ac72227808824b4edee7c] + +Signed-off-by: Ankur Tyagi +--- + validator/val_sigcrypt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c +index cde281870..b9bfe685c 100644 +--- a/validator/val_sigcrypt.c ++++ b/validator/val_sigcrypt.c +@@ -305,6 +305,8 @@ ds_create_dnskey_digest(struct module_env* env, + * digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA); + * DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key. */ + sldns_buffer_clear(b); ++ if(!sldns_buffer_available(b, dnskey_rrset->rk.dname_len + dnskey_len-2)) ++ return 0; /* buffer too small */ + sldns_buffer_write(b, dnskey_rrset->rk.dname, + dnskey_rrset->rk.dname_len); + query_dname_tolower(sldns_buffer_begin(b)); diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index 0b59d7c9f9..c8d7c6cdab 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -44,6 +44,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t file://CVE-2026-56416.patch \ file://CVE-2026-56444.patch \ file://CVE-2026-80225.patch \ + file://CVE-2026-81642.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c" From patchwork Sun Sep 27 00:39:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 99261 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27188C9832A for ; Sun, 27 Sep 2026 00:39:39 +0000 (UTC) Received: from mail-pz2-f38.google.com (mail-pz2-f38.google.com [74.125.228.38]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.29996.1790469574501491280 for ; Sat, 26 Sep 2026 17:39:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=H1Z9d0zz; spf=pass (domain: gmail.com, ip: 74.125.228.38, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pz2-f38.google.com with SMTP id d2e1a72fcca58-88286981a36so58417b3a.2 for ; Sat, 26 Sep 2026 17:39:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790469574; x=1791074374; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=iRSYQxx4zNrOx7h41BDfUcuhevWI7gAJRuA+HTuoMus=; b=H1Z9d0zzCjCbhmgFxl0nnBETgf6u2/EgTSsnVTDQzw6rM4/A1a+Ndqem/otTpasRpU E1SMJTojZ4eH0d3dT5IMxxqinyAzcKPZKJUEyx+xBF3/5YMZvkjaiY70wZuzC+8nS7hP urwxAbiZDFlsGqhJgzpH5rPNja9FklyAqAfo1dhJOvx7DuttNKMkIFk9xW8jVDqw4ojy kPDVdhDDhC3kJvfXv7bq2i+vWJUDEdG1883/+2oOAG1G/XGBkXme67uJ6V0hPC7Igaqk 4co0dwIh1Ffgm9RsQPGyEv30s6mQdta2TBikIEhadQ06xjBtiGVRBRDAvI6Cwkd9RR8V 7iFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790469574; x=1791074374; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=iRSYQxx4zNrOx7h41BDfUcuhevWI7gAJRuA+HTuoMus=; b=ww4j78Kf5PkWO/FYBh0OE7q3nP/S3/vuJhINmQJljV/9MdeWxwMYystpg8GDmh1DZo WOI5YR9F6C21VEtHXncpbOYb+DDhQrRCL+yx0lqj0zeoej9KU0UqOnUU6+Rfup34zkHH EYivKaWQCymyX9FosarOAPqSqy8CXpGSchzPl5ilDhIN3ha4eMWsyCboFJfT57v8c9sb UlS3Yohis7uj+1iXDC8pLVSR6Vw0HoJrF/jkskNZ3TeIMxeNQXQkfdLguOTZpwRl6siM ajQAgRrdsXeQYgjZX5uBSqWgPtTw3yRfVLkNXAIZrFOa/w7Xt9giXDaS6K5dKfOXbKa4 zEiw== X-Gm-Message-State: AFq9FYK8xcA9B6ZSCugowHxV5xmbA7fMRFhcvikB0GR5UY4rryozAPFd hnXcgplrmC2Q5ozEi1tK0458EwTy6H10nSAxpiQOoadFJn3WUcPc8QuurHamdg== X-Gm-Gg: AYBFou3BMhphHgyFYR/uHClhuzStz28rWfgl4dp6L4lCe+MSzs/Sb/FrVvvK/6/Lnug byy9Jr/z9sTLOpHdbDYKQnZZ5X9LIhsOpDzSN7T903CQgagXTcCu8CnHIgHhGkbqlPZdG1wJuMD m7vyWEmzb2e6mIfpJqQwCKzPWb+RfiQ14+8h1emK1mf2o0qu2idDumDV8+8rBTlpZAL+mea1/nI Mwv6/dTabR9wpci3OlUMpsQbXpQ+03sDTu9vx1J19djdpfbm/NW+ygyDloohGS91gecPXtEoBZz QDfo0y1WZPaHfPRSC9ahMliunOy62sDIwU3QLNtzIq7hoSMSH9uWMgEy3Cmo4bUBa12xR3+ncn7 v6SjQNgHDk8pmolCKbCeNrd9S7+xiY4eAsV/WZp8xE1US/yNWlbIaaxw3DktdIsyo42tFIFqhkF 1m8RGmWDpWSsh2+gYOTVyolXX2rbR70oaqTvoWKcCyu6h5EMB46aTfRCD+Yub+cmTwFi66r87ms J5gk/bbDv6nme87Gnp6DQndvLRfSQarNw== X-Received: by 2002:a17:90a:4ca7:b0:3a0:b809:b9f3 with SMTP id 98e67ed59e1d1-3a0b809bb4dmr3418968a91.8.1790469573750; Sat, 26 Sep 2026 17:39:33 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a0d22281f0sm2876420a91.1.2026.09.26.17.39.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 17:39:33 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][wrynose][PATCH 3/11] unbound: patch CVE-2026-78227 Date: Sun, 27 Sep 2026 13:39:13 +1300 Message-ID: <20260927003921.746786-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260927003921.746786-1-ankur.tyagi85@gmail.com> References: <20260927003921.746786-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 00:39:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130322 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-78227 Signed-off-by: Ankur Tyagi --- .../unbound/unbound/CVE-2026-78227.patch | 30 +++++++++++++++++++ .../recipes-support/unbound/unbound_1.24.2.bb | 1 + 2 files changed, 31 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-78227.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-78227.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-78227.patch new file mode 100644 index 0000000000..b434885a1a --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-78227.patch @@ -0,0 +1,30 @@ +From 1bec118f61aaf13cc5d1dfbaf1d45e0af8986901 Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 16 Sep 2026 09:25:05 +0200 +Subject: [PATCH] - Fix CVE-2026-78227, Use-after-free in DoQ stream output + buffer on reset re-transmission. Thanks to Yuqi Qiu and Xiang Li from + Nankai University, AOSP Lab for the report. + +(cherry picked from commit 7914901915dd46817e7ae9877776d6fb6fc2060e) + +CVE: CVE-2026-78227 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/7914901915dd46817e7ae9877776d6fb6fc2060e] + +Signed-off-by: Ankur Tyagi +--- + services/listen_dnsport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/services/listen_dnsport.c b/services/listen_dnsport.c +index 9b6fb557c..f748070f8 100644 +--- a/services/listen_dnsport.c ++++ b/services/listen_dnsport.c +@@ -4477,7 +4477,7 @@ doq_stream_reset_cb(ngtcp2_conn* ATTR_UNUSED(conn), int64_t stream_id, + "unknown stream %d", (int)stream_id); + return 0; + } +- if(!doq_stream_close(doq_conn, stream, 0)) ++ if(!doq_stream_close(doq_conn, stream, 1)) + return NGTCP2_ERR_CALLBACK_FAILURE; + return 0; + } diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index c8d7c6cdab..1ab81879f2 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -45,6 +45,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t file://CVE-2026-56444.patch \ file://CVE-2026-80225.patch \ file://CVE-2026-81642.patch \ + file://CVE-2026-78227.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c" From patchwork Sun Sep 27 00:39:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 99262 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44A7BC9833F for ; Sun, 27 Sep 2026 00:39:40 +0000 (UTC) Received: from mail-pz2-f39.google.com (mail-pz2-f39.google.com [74.125.228.39]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.29997.1790469576725016878 for ; Sat, 26 Sep 2026 17:39:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=sGBmBX67; spf=pass (domain: gmail.com, ip: 74.125.228.39, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pz2-f39.google.com with SMTP id 41be03b00d2f7-cc79223bcfbso946273a12.1 for ; Sat, 26 Sep 2026 17:39:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790469576; x=1791074376; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=hSC/Wm3Ceg6evakLXubYrF/0CywcR5tMVkfoR9KKG0Q=; b=sGBmBX67Bdtm4NSulSAXMcUED+8pi/ySV91wMlqvC1iZuFgTATgdBIPiSth1QiLX0L bm0Kn9DpLFd3N5vYYb9rAMlLq+lIPpd5r+fy4SjEYiWzeI4qNckqovTdS4o0ahc/FCdf X0AOEXJy9PVTxw6hmUTICKZk+mop+InFoiJ16PH+lHGPcWfKFNq2YkdjVgDj6DQnIZbq M/8buNF7hD8j+HEFSG02qTbFQYP/h/aoz5xcKRr6mRKdn73R6cb1PgYiYYFpS8RiLqEr JfcrwcN5ROG4PisM/h1J/cWGPyO5aXriqC+EIcJMa2lw1VHVbKTUY9iNkNBONJewadMR A8hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790469576; x=1791074376; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=hSC/Wm3Ceg6evakLXubYrF/0CywcR5tMVkfoR9KKG0Q=; b=Gk7Gl+GEBgAVPyzEUV/UApjhsgr+RfDHG8CAZXr+GoauPaDTL8Gf1JdmKdIzxp4mGB 2H1ZjfvLbF3e/UIs8Le3b7FAv1UB4gw/CQsz95F9lagjhqEudD9DNqaaG4fNlpw7UlL8 j9YUWXebXfILnd/os4RMXsNBwb6UHVwWZS1plK7bTFeGWAXwq/g1bZRtolbawgpJnd03 zGdmVAhI9Ak3HKC70N+6oPOn8iINTa6+ReeEKCg9luFODpubX/eGd3MxVOzVFOaIF3sz MpgGW6/2306fbAyuSyA+6R/P2TpQ6rdk/y/higE5TFJqS/qn5jSEOr8nkKG9WQ6S4ZOv S1Eg== X-Gm-Message-State: AFq9FYINqxW8+phWRYRViWfbfX7hboNEmjlV6d6MqWSZ/+/nBnS2S5P2 bMJ944HamnWOdLxm0KH4dhAkIo9A3A7kh0++HNDxVrQLgT9JKIpxGHDTurUdKg== X-Gm-Gg: AYBFou29xvSiuL2F1tt7+uXRUlmtlLK4DDJyqFs/ST126LVscmI20hanl8+zjnIJyWH 7xHvKB/Euz4LpOcbMjpuM/acxybre0fZQiu3ZOl9+hGoK+xu1QSXq7k6VZJtt4BymiBSzkemevp iCrTUQIAYghwSPd1bEP+NQnwRHjyr1Tiv4cVo2K7eU22DAnDoP0DJdetgNx3sGNF+A+JLwEfgxS NSodm58SxfORF8oElx3jrXGqtp223Xxfx/ykXBSOw6K8sE1GFJVHWZCxt6J2Gddilw+spf1f87t fW5lbhmcvyhrmgb0rl2+Fpas5N0yWc02zjDJksrx8BgP67CZR/plR4NNLL8qdA9JIul5CiU6wpG +bbk0HK2LG5OAstx1+Pm7MLmULhCPNQKeuDiES2Paoe4jj1olMfsWLp8eDthV4NM4WBNmp2LU67 QPSgy+ztJLTmb11r5sAZvAO3XTO9BWrsHR8K/eIj0JgWNV+MohBDmFwm2h2UO0oT62rZnzU8fmM m2GGW9iyARHQdl1c88cjFE= X-Received: by 2002:a17:90b:5292:b0:39e:6c68:c784 with SMTP id 98e67ed59e1d1-3a098e56107mr7932137a91.58.1790469576030; Sat, 26 Sep 2026 17:39:36 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a0d22281f0sm2876420a91.1.2026.09.26.17.39.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 17:39:35 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][wrynose][PATCH 4/11] unbound: patch CVE-2026-77860 Date: Sun, 27 Sep 2026 13:39:14 +1300 Message-ID: <20260927003921.746786-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260927003921.746786-1-ankur.tyagi85@gmail.com> References: <20260927003921.746786-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 00:39:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130323 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-77860 Signed-off-by: Ankur Tyagi --- .../unbound/unbound/CVE-2026-77860.patch | 31 +++++++++++++++++++ .../recipes-support/unbound/unbound_1.24.2.bb | 1 + 2 files changed, 32 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-77860.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-77860.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-77860.patch new file mode 100644 index 0000000000..266166b729 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-77860.patch @@ -0,0 +1,31 @@ +From 46671c9294ef76e2056a447eca8a561f3f48719e Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 16 Sep 2026 09:29:04 +0200 +Subject: [PATCH] - Fix CVE-2026-77860, 'serve-expired' can bypass Unbound + 'wait-limit'. Thanks to Xuanchao Xie, Lutong Chen, and Kaiping Xue from the + University of Science and Technology of China (USTC) for the report. + +(cherry picked from commit bd71e3b8a6dd87682bf454dc3687fc9e70b1bb78) + +CVE: CVE-2026-77860 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/bd71e3b8a6dd87682bf454dc3687fc9e70b1bb78] + +Signed-off-by: Ankur Tyagi +--- + services/mesh.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/services/mesh.c b/services/mesh.c +index a6798953e..20e4f1a26 100644 +--- a/services/mesh.c ++++ b/services/mesh.c +@@ -2563,8 +2563,7 @@ mesh_serve_expired_callback(void* arg) + if(r->query_reply.c->tcp_req_info) + tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate); + /* mesh_send_reply removed mesh state from http2_stream. */ +- infra_wait_limit_dec(mstate->s.env->infra_cache, +- &r->query_reply, mstate->s.env->cfg); ++ /* mesh_send_reply decremented wait_limit. */ + prev = r; + prev_buffer = r_buffer; + } diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index 1ab81879f2..1d810fba6c 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -46,6 +46,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t file://CVE-2026-80225.patch \ file://CVE-2026-81642.patch \ file://CVE-2026-78227.patch \ + file://CVE-2026-77860.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c" From patchwork Sun Sep 27 00:39:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 99263 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6ABBCA5FA0 for ; Sun, 27 Sep 2026 00:39:40 +0000 (UTC) Received: from mail-pj2-f12.google.com (mail-pj2-f12.google.com [74.125.227.140]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.29998.1790469579006989356 for ; Sat, 26 Sep 2026 17:39:39 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=KQas8klN; spf=pass (domain: gmail.com, ip: 74.125.227.140, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj2-f12.google.com with SMTP id 98e67ed59e1d1-39dacf053eeso1001974a91.2 for ; Sat, 26 Sep 2026 17:39:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790469578; x=1791074378; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Ihasz/e0/UPt69klKpRFfp+vEJglF5cPqjGpbJngi9U=; b=KQas8klN1px2MH6B1BnClmlrAoFeYvSlvEb8a01nwpALlUntVGvIQCwxEEu7B2eEtC pSJG4MoCmwrhc6zaeBa1rI0F/oyQqqHVzFPB3txWCGjhaboyhChf5xGKbd4zdxvhLsMe QDj+QutKV+osr6skR+0fgKgjmqbI5I9aNeCBaN8AL5uP5pzq6GgPaPmWJBybdrVmq7oI l7VX8YAfsolRP5I8sPckQLEC32XryRoV6DeryBIMr0yTa/uDjxNm1TxB5S+IdY2ZLPDU 9IL5U0d2hzxFQi0wqic78x4OBMQmWUCOh4zPFh80re4sefLNOucY0VYgMLlCQqqQI109 BjsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790469578; x=1791074378; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Ihasz/e0/UPt69klKpRFfp+vEJglF5cPqjGpbJngi9U=; b=wa4vDp7DPxdtG9Vp4gkr1VOMco/1igIKXvbBvXxflwgVIkJaK9TfNKIuE4iiQED4Hb tinD9MjKfJL3TvVJcRm5lFySFoqN6MuqymhLuQlZy2NS0anxNPnFIMA+U4UkdwZRu0Cf YntNyzj7JDTs+1YT1+7dhSe12blHkmKWw6nOV6SW0yYCY5bVoYPROmm12R2YEDY3MPVk 6UTbkiaxvvpjJNmrh+wyMbXN6OAdO+gUEWxyPS9nc5EEVAL2W4sovrXnhurUaPWrTE+j oTJK4KTUpkIpBZBfIYGxI9k2UrS3MDSkzK6DTdN/DZBKB7jr/GT0ngiWkDLg3BLi9OSh 4Ntw== X-Gm-Message-State: AFq9FYJOGQCeRJU7TtMtrqUqsgAPRl+84TbVWJ3Esmjbt7+ehCqQaRQm /DeVrjKe8GffonLsxi91NW51CSaXgYU9pxP6s6rwWpf2R/YSHmjhE2kRLQnSxA== X-Gm-Gg: AYBFou3oE9oY+/lPNARu1OuOtg0teTJ6gGI2vgKkv+awDH98zB/R8V+jZT+B5ePFAxq Acnp4trm18xDuu12HBL/ubijoLgu+oTX4CfGGTOyBTuEmDCyhAbs8lj21BTa0r+Bk4rSWwS2wZ1 1Tl24L39g4A8OmCnLc5n8dJZGBhmn4nZ/HJKG1OyCJzp3pakIOwgx7Pme30rdQjA7iPLOmrSDTx szJXyvk3E7cbzECnh8tSGThzOv/zRlPsb9TZhiMxruxKbNpAeYpFWKfj73q1L75r2/bySsHufAN neQD5uBXbuLmJH3PGQOrsQlnOGwbCLtSbv1Z/BhBy9azvlcj9WxBMSFChusKcjE1CwWzNKE/C7R v1Me9q1ci6oQVVLDYr8DQP3I0UICrkWbJhZT9X5l1ZX/B8CguI1HWMWaBa37sFmpUOiupdOIE4Z gFnNmvjhEHh44gpNhY05HJciz7loyxg8YADOWBDopGiq6vX3prpnm7p5B7PhvO3mrqJAMHVgYSL ajYyju12/a8CnrsRvPxYvg= X-Received: by 2002:a17:90b:48d0:b0:3a0:e22b:1b16 with SMTP id 98e67ed59e1d1-3a0e22b1df8mr2380950a91.25.1790469578256; Sat, 26 Sep 2026 17:39:38 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a0d22281f0sm2876420a91.1.2026.09.26.17.39.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 17:39:37 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][wrynose][PATCH 5/11] python3-tornado: patch CVE-2026-91990 Date: Sun, 27 Sep 2026 13:39:15 +1300 Message-ID: <20260927003921.746786-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260927003921.746786-1-ankur.tyagi85@gmail.com> References: <20260927003921.746786-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 00:39:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130324 From: Ankur Tyagi Backport patch from v6.5.8 matching CVE description. Details: https://nvd.nist.gov/vuln/detail/cve-2026-91990 Signed-off-by: Ankur Tyagi --- .../python3-tornado/CVE-2026-91990.patch | 40 +++++++++++++++++++ .../python/python3-tornado_6.5.7.bb | 3 ++ 2 files changed, 43 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91990.patch diff --git a/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91990.patch b/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91990.patch new file mode 100644 index 0000000000..65b43b61a1 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91990.patch @@ -0,0 +1,40 @@ +From 151ba03ad569ec1c13593899550f4ab7d1fa03c8 Mon Sep 17 00:00:00 2001 +From: Ben Darnell +Date: Wed, 5 Aug 2026 14:13:32 -0400 +Subject: [PATCH] httputil: Apply multipart max_parts limit earlier + +This prevents some CPU and memory amplification attacks. + +(cherry picked from commit de85b3f87446e323e881bbaa3d5a74f4b76e5f05) + +CVE: CVE-2026-91990 +Upstream-Status: Backport [https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05] + +Signed-off-by: Ankur Tyagi +--- + tornado/httputil.py | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/tornado/httputil.py b/tornado/httputil.py +index 0c9ad832..f698db21 100644 +--- a/tornado/httputil.py ++++ b/tornado/httputil.py +@@ -37,7 +37,6 @@ from urllib.parse import urlencode, urlparse, urlunparse, parse_qsl + from tornado.escape import native_str, parse_qs_bytes, utf8, to_unicode + from tornado.util import ObjectDict, unicode_type + +- + # responses is unused in this file, but we re-export it to other files. + # Reference it so pyflakes doesn't complain. + responses +@@ -1078,7 +1077,9 @@ def parse_multipart_form_data( + final_boundary_index = data.rfind(b"--" + boundary + b"--") + if final_boundary_index == -1: + raise HTTPInputError("Invalid multipart/form-data: no final boundary found") +- parts = data[:final_boundary_index].split(b"--" + boundary + b"\r\n") ++ parts = data[:final_boundary_index].split( ++ b"--" + boundary + b"\r\n", config.max_parts + 1 ++ ) + if len(parts) > config.max_parts: + raise HTTPInputError("multipart/form-data has too many parts") + for part in parts: diff --git a/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb b/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb index 4dda1541b8..5d3db11b6b 100644 --- a/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb +++ b/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb @@ -8,6 +8,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" SRC_URI[sha256sum] = "66c513a76cda70d53907bc27cf1447557699c2e95aa48ba27a442ff61c3ddfc2" +SRC_URI += "file://CVE-2026-91990.patch \ +" + inherit pypi python_setuptools_build_meta # Requires _compression which is currently located in misc From patchwork Sun Sep 27 00:39:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 99268 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CFD44C9833E for ; Sun, 27 Sep 2026 00:39:50 +0000 (UTC) Received: from mail-pj2-f42.google.com (mail-pj2-f42.google.com [74.125.227.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.29269.1790469581569545464 for ; Sat, 26 Sep 2026 17:39:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=AY1LYR3l; spf=pass (domain: gmail.com, ip: 74.125.227.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj2-f42.google.com with SMTP id 98e67ed59e1d1-39d654f02baso831145a91.3 for ; Sat, 26 Sep 2026 17:39:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790469581; x=1791074381; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=OhjvG7RBmMLMxl1tw4VJYcsXX77DE5uwytv6s3oyt7Y=; b=AY1LYR3l5pyAubis0CeDtFUUmp4G0iVE4bEsq9TpFvoloWWmMG4LfoxJggFhuaEWXf xCcWOzHz6qBbOihYW2yMh2rPA/Sf9byYVbcbEYx5VqOfBThAUm1H8IACpXTSR02OT78z iC+3sntqBlsgKLoqpmUJ3VncOAenGEeEIT7GZstpQq9iEB8apCZOA3Er8mht29ZxGUmd pSJH+vYVvky6eKhB46scP5NDngnfmsWz0xRsxezQML7xxAgLifGcVF5G2Ha0KvFKAtMv ErrfAkYgrleJeYbNG5olDpzAhL+FRbCnItBorJNOGy378c7hKyn9L0HnpLCNC2dWY9uc fnXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790469581; x=1791074381; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=OhjvG7RBmMLMxl1tw4VJYcsXX77DE5uwytv6s3oyt7Y=; b=cydNg9kUgp/9mA3KrYaAXTujQxgaKs4pWVBPf/oufGPHdzrvi+k3NsefyFciGDL5bO /yp8X1bj34xqE0+hi+KZzzrl//GFbS4HGr/KWP7AI6ly7RbiLj2wMC7tAXb7lHY07pVo VSoSv/drajB4QozNeYuNGAtl3C9XEYHPeVb/i1ic660d3xoNXtY0YX3pJb3CY+XA7j+G yuIkZXqxSoWejBXFVh6AZ7/MMbMmNXYRT6EgVlaoP5uTTRMHRvhg/lyjQoe9X6aF+bzC 1hj7BKpY14ygeVu3vGGkXmvDEYM1l+n0e7uqZdq1x/GwGPxHN3gi3CxNxQzq7EPKChYI tziA== X-Gm-Message-State: AFq9FYJq+BRSk0V/Of0TjJUkhP1vrve2/yHmKKNiDicIsjSe8iS+LKum AJTzFTnrI/riXDLBb9InCOZyIaGQnZfelM3s9FfMtzqkbkrYnxCUxjRFk94dWg== X-Gm-Gg: AYBFou2qfQ2MJ80o0HjLDbww/5j24MRm7e3Fw7AN3aBxhiiihhaB/zcmWHbiYjQ7VHG VGdUHNYmHmkL4wC97J3OrldM+QbPSsY7kaIOWaovwz3Z4uVsqZEJHliHLSjDt2uQhuuV92QtTBg 8fUR7O/YuiMOBl3WoTE53/MMsO5cKFWLlF+U6UgAyGKbeO1k8UNhEavWhR0/1ppVcWPoqFHFjK1 KPygfUpzSCNqoZMp4aVCy5Xm4lvTf2JZrYejsWIngKNZfOKhKqRFLg56BN6DuJTwQtdfSN5y7vM d049KLH1rsgBLbk87KyfUtTQNzPtuK+7mwCsnTF5tznabmXlmO/JEn/iL+E2iWhR8MNcGNKYlL5 DiyzAAKYzaRxP33bjnwyGu42O1q0Vpq0iaGI5+hm0jPZ0z1Rp8gy+EC9m4MnmG88cYthe4+5tsy MeFUXTgBTemO5p6kGAAA01kfceYMBj4Od4ULtHgu/4T6Ra4wY3BFXXXvwMj0hjFknRo76Pq00di Sl9c5qodFwG9h7ih+WDDBQ= X-Received: by 2002:a17:90b:2683:b0:3a0:dbe7:971b with SMTP id 98e67ed59e1d1-3a0dbe79bc2mr2460769a91.67.1790469580827; Sat, 26 Sep 2026 17:39:40 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a0d22281f0sm2876420a91.1.2026.09.26.17.39.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 17:39:40 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][wrynose][PATCH 6/11] python3-tornado: patch CVE-2026-82397 Date: Sun, 27 Sep 2026 13:39:16 +1300 Message-ID: <20260927003921.746786-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260927003921.746786-1-ankur.tyagi85@gmail.com> References: <20260927003921.746786-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 00:39:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130325 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-82397 Signed-off-by: Ankur Tyagi --- .../python3-tornado/CVE-2026-82397.patch | 149 ++++++++++++++++++ .../python/python3-tornado_6.5.7.bb | 1 + 2 files changed, 150 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-tornado/CVE-2026-82397.patch diff --git a/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-82397.patch b/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-82397.patch new file mode 100644 index 0000000000..71278d5d23 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-82397.patch @@ -0,0 +1,149 @@ +From eba9e5652af3edbf9d8f2375194b5c63362d0c91 Mon Sep 17 00:00:00 2001 +From: Ben Darnell +Date: Wed, 5 Aug 2026 21:20:58 -0400 +Subject: [PATCH] httputil: Enforce a new limit on the number of arguments in a + request + +Large POST bodies can be very expensive to parse in the worst case, +so use the (new in Python 3.8) max_num_fields argument to limit the +cost. A new field in ParseBodyConfig allows users to configure this +limit. The default is 1000, which is the same as that used in php and +node.js. + +(cherry picked from commit 8d6363ed7b69d5f0da806efe34d256627a2191de) + +CVE: CVE-2026-82397 +Upstream-Status: Backport [https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de] + +Signed-off-by: Ankur Tyagi +--- + tornado/escape.py | 16 ++++++++++++++-- + tornado/httputil.py | 26 +++++++++++++++++++++++++- + tornado/test/httputil_test.py | 18 ++++++++++++++++++ + 3 files changed, 57 insertions(+), 3 deletions(-) + +diff --git a/tornado/escape.py b/tornado/escape.py +index 8515bf58..a1c16b36 100644 +--- a/tornado/escape.py ++++ b/tornado/escape.py +@@ -171,7 +171,11 @@ def url_unescape( + + + def parse_qs_bytes( +- qs: Union[str, bytes], keep_blank_values: bool = False, strict_parsing: bool = False ++ qs: Union[str, bytes], ++ keep_blank_values: bool = False, ++ strict_parsing: bool = False, ++ *, ++ max_num_fields: Optional[int] = None, + ) -> Dict[str, List[bytes]]: + """Parses a query string like urlparse.parse_qs, + but takes bytes and returns the values as byte strings. +@@ -179,13 +183,21 @@ def parse_qs_bytes( + Keys still become type str (interpreted as latin1 in python3!) + because it's too painful to keep them as byte strings in + python3 and in practice they're nearly always ascii anyway. ++ ++ .. versionadded:: 6.5.8 ++ The ``max_num_fields`` argument. ValueError is raised if this limit is exceeded. + """ + # This is gross, but python3 doesn't give us another way. + # Latin1 is the universal donor of character encodings. + if isinstance(qs, bytes): + qs = qs.decode("latin1") + result = urllib.parse.parse_qs( +- qs, keep_blank_values, strict_parsing, encoding="latin1", errors="strict" ++ qs, ++ keep_blank_values, ++ strict_parsing, ++ encoding="latin1", ++ errors="strict", ++ max_num_fields=max_num_fields, + ) + encoded = {} + for k, v in result.items(): +diff --git a/tornado/httputil.py b/tornado/httputil.py +index f698db21..b80c796c 100644 +--- a/tornado/httputil.py ++++ b/tornado/httputil.py +@@ -947,6 +947,23 @@ class ParseMultipartConfig: + """ + + ++@dataclasses.dataclass ++class ParseUrlEncodedConfig: ++ """This class configures the parsing of ``application/x-www-form-urlencoded`` request bodies. ++ ++ Its primary purpose is to place limits on the size and complexity of request messages ++ to avoid potential denial-of-service attacks. ++ ++ .. versionadded:: 6.5.8 ++ """ ++ ++ max_arguments: int = 1000 ++ """The maximum number of arguments accepted in a urlencoded request. ++ ++ Each ```` element in an HTML form corresponds to at least one argument. ++ """ ++ ++ + @dataclasses.dataclass + class ParseBodyConfig: + """This class configures the parsing of request bodies. +@@ -957,6 +974,9 @@ class ParseBodyConfig: + multipart: ParseMultipartConfig = dataclasses.field( + default_factory=ParseMultipartConfig + ) ++ urlencoded: ParseUrlEncodedConfig = dataclasses.field( ++ default_factory=ParseUrlEncodedConfig ++ ) + """Configuration for ``multipart/form-data`` request bodies.""" + + +@@ -1015,7 +1035,11 @@ def parse_body_arguments( + ) + try: + # real charset decoding will happen in RequestHandler.decode_argument() +- uri_arguments = parse_qs_bytes(body, keep_blank_values=True) ++ uri_arguments = parse_qs_bytes( ++ body, ++ keep_blank_values=True, ++ max_num_fields=config.urlencoded.max_arguments, ++ ) + except Exception as e: + raise HTTPInputError("Invalid x-www-form-urlencoded body: %s" % e) from e + for name, values in uri_arguments.items(): +diff --git a/tornado/test/httputil_test.py b/tornado/test/httputil_test.py +index 92683ae9..afb15879 100644 +--- a/tornado/test/httputil_test.py ++++ b/tornado/test/httputil_test.py +@@ -1,4 +1,5 @@ + from tornado.httputil import ( ++ parse_body_arguments, + url_concat, + parse_multipart_form_data, + HTTPHeaders, +@@ -95,6 +96,23 @@ class QsParseTest(unittest.TestCase): + self.assertIn(("b", "2"), qsl) + + ++class UrlEncodedDataTest(unittest.TestCase): ++ def test_urlencoded_data(self): ++ data = b"a=1&b=2&a=3" ++ args, files = form_data_args() ++ parse_body_arguments("application/x-www-form-urlencoded", data, args, files) ++ self.assertEqual(args["a"], [b"1", b"3"]) ++ self.assertEqual(args["b"], [b"2"]) ++ self.assertEqual(files, {}) ++ ++ def test_max_arguments(self): ++ data = b"".join(b"a=1&" for _ in range(1001)) ++ args, files = form_data_args() ++ with self.assertRaises(HTTPInputError) as cm: ++ parse_body_arguments("application/x-www-form-urlencoded", data, args, files) ++ self.assertIn("Max number of fields exceeded", str(cm.exception)) ++ ++ + class MultipartFormDataTest(unittest.TestCase): + def test_file_upload(self): + data = b"""\ diff --git a/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb b/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb index 5d3db11b6b..ce7b903ef7 100644 --- a/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb +++ b/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb @@ -9,6 +9,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" SRC_URI[sha256sum] = "66c513a76cda70d53907bc27cf1447557699c2e95aa48ba27a442ff61c3ddfc2" SRC_URI += "file://CVE-2026-91990.patch \ + file://CVE-2026-82397.patch \ " inherit pypi python_setuptools_build_meta From patchwork Sun Sep 27 00:39:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 99266 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A247C98328 for ; Sun, 27 Sep 2026 00:39:50 +0000 (UTC) Received: from mail-pj2-f43.google.com (mail-pj2-f43.google.com [74.125.227.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.29271.1790469583794201019 for ; Sat, 26 Sep 2026 17:39:43 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=rhKpK8zf; spf=pass (domain: gmail.com, ip: 74.125.227.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj2-f43.google.com with SMTP id 98e67ed59e1d1-3a0b0fa2055so1147780a91.0 for ; Sat, 26 Sep 2026 17:39:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790469583; x=1791074383; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KItwui4v3L6Mik1fdMuLAfKsq6yVBG4V7BCkPKoB/Eo=; b=rhKpK8zfqCNyagAkDWg5/Pc61WEbgAeU/E0My9MnfBFgz12SPAkdV1yWKwdf506mHu D7rrPgAP4H5G0BJLS0+vyOWa2DWgjr6vQ2Z0SGcVNNIkz2SoBQANbL5mO072G6GcksmY 618CI3HAXLkp6thJQ2WqhG4olKC4ZHsdQ5JRgYCR1tcAphMuXyePoOzWNjVziaYLe6vT 94py2U8EAN0UsQyM9mrUrX3I6KhlpjM+L19egHrjyLJrWURCyCyqUPU2aqdbpNy1m77V 4b/7zttc/ZW++R1Fu9OzwX4ClFvNylUMkGVJyv1uQN7Vm9ljVdN+8AswvAvb7XyVijS9 nEUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790469583; x=1791074383; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=KItwui4v3L6Mik1fdMuLAfKsq6yVBG4V7BCkPKoB/Eo=; b=f8I1UAFCza05G/bVHFlsYUBGD5N2NJaFoA3ujM5Msi72tzdSmDf/dfohSpKdYBiyqO aBvjeU3sYk+U/Ofv/chU7CnXGKhRvT5E5cmmjwh8e7TdPRcGK1wkgu7wLeawDEiBjVRm BKjPH6uYo9k/U6ZvQXarxDS/fRcWaQHiBa9+BoCnyWY/bAEcMP2LZ4qSIM//HZjSsySr KVBjdUoIBpaXCPCAadH6pe4Nm4QzawbSurAk4LixAL2rW22iMypxM1SZvrNuRSeJ2pMd WzHkMHWUhdHemOpD+rYQlkvYwnqfwkSux4Kk+HgX3Z6RaiTwByodscTXgcMwqrRQBpgu EnTQ== X-Gm-Message-State: AFq9FYJtlhp7TapC5ek+9DWhVAcEpi8wR0wR4usDPcxYH9Zpj/CIjS+7 /6fP+dg5twsJDnAQsgk6wgu43vJjGIWhcluJeSDGQRYJQHlzH4FMSd858af9xA== X-Gm-Gg: AYBFou1yTVGEzY1My7HlWbWa0IdfjPYv1JeJO1kYI5NMwxrusO+LkU3aoRGBRcUoz0J zO96hGnSXq7pU5YAXNBbzT1jdGBux1G2Mf3u6Ko1UOhx0UFSVd0+Y7HjEqOQNnRI75yBB47pyZn vJpVwLI5DdOV4Q9zwfqggE0IVSWh7b+mfzaEekBAMvCUfb7GPKLXTNFyWgbigRU5Cz0antYGMHo zRa+Aii9sZ/M1EiG3sm6bGdytaNWZMTsfYQo8PltmItnAjox59VCZXGscWiGhW4ci1iK/s5IX8p R3x8ddGlEtMQDs4FFzdtcbbh2iAJ6q2wNfyBMJFawzyTE5G6cO1HZ/3zR2UQ2Z6LhfPibL+FT+e FCDH9d88ZirzHYGDqdSA2ERFBBs76sOtK0AXZJaBbNkfG7tFZ3CcWRezbfqCiiZs3sRIRqC3kno EuxzlB+wciWmseZBA06kQ4aIjNaLwikrQckZon5W3D4kS6mdcMmoPorIqV6pzT5oJKDtgQT/N8G zL7GYV5mY9jhveOsAmvYsA= X-Received: by 2002:a17:90a:d2cb:b0:3a0:dfb6:aec7 with SMTP id 98e67ed59e1d1-3a0dfb6d466mr2689565a91.67.1790469583048; Sat, 26 Sep 2026 17:39:43 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a0d22281f0sm2876420a91.1.2026.09.26.17.39.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 17:39:42 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][wrynose][PATCH 7/11] python3-tornado: patch CVE-2026-91991 Date: Sun, 27 Sep 2026 13:39:17 +1300 Message-ID: <20260927003921.746786-7-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260927003921.746786-1-ankur.tyagi85@gmail.com> References: <20260927003921.746786-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 00:39:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130326 From: Ankur Tyagi Backport patch from v6.5.8 matching CVE description. Details: https://nvd.nist.gov/vuln/detail/cve-2026-91991 Signed-off-by: Ankur Tyagi --- .../python3-tornado/CVE-2026-91991.patch | 57 +++++++++++++++++++ .../python/python3-tornado_6.5.7.bb | 1 + 2 files changed, 58 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91991.patch diff --git a/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91991.patch b/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91991.patch new file mode 100644 index 0000000000..6bd755af57 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-tornado/CVE-2026-91991.patch @@ -0,0 +1,57 @@ +From 566a5ff64a530dfbc6bb6afbb1615c3e7addfd8d Mon Sep 17 00:00:00 2001 +From: Ben Darnell +Date: Wed, 5 Aug 2026 21:33:26 -0400 +Subject: [PATCH] web: Also check for semicolons in deprecated mixed-case + cookie args + +(cherry picked from commit da284767eae8e1f0484f123b8c3225f6465b09c7) + +CVE: CVE-2026-91991 +Upstream-Status: Backport [https://github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7] + +Signed-off-by: Ankur Tyagi +--- + tornado/test/web_test.py | 12 ++++++++++++ + tornado/web.py | 6 ++++++ + 2 files changed, 18 insertions(+) + +diff --git a/tornado/test/web_test.py b/tornado/test/web_test.py +index 9bd1d49c..27e7fcfe 100644 +--- a/tornado/test/web_test.py ++++ b/tornado/test/web_test.py +@@ -329,6 +329,18 @@ class CookieTest(WebTestCase): + "unexpected exception for char %r in domain: %s\n" + % (char, e) + ) ++ try: ++ self.set_cookie("foo", "bar", DoMaIn="example" + char + ".com") ++ self.write( ++ "Didn't get expected exception for char %r in DoMaIn\n" ++ % char ++ ) ++ except http.cookies.CookieError as e: ++ if "Invalid cookie attribute DoMaIn" not in str(e): ++ self.write( ++ "unexpected exception for char %r in DoMaIn: %s\n" ++ % (char, e) ++ ) + + try: + self.set_cookie("foo", "bar", path="/" + char) +diff --git a/tornado/web.py b/tornado/web.py +index ec7ec3f5..6f1ae304 100644 +--- a/tornado/web.py ++++ b/tornado/web.py +@@ -717,6 +717,12 @@ class RequestHandler: + raise http.cookies.CookieError( + f"Invalid cookie attribute {attr_name}={attr_value!r} for cookie {name!r}" + ) ++ for k, v in kwargs.items(): ++ # Also check for disallowed characters in deprecated kwargs. ++ if re.search(r"[\x00-\x20\x3b\x7f]", str(v)): ++ raise http.cookies.CookieError( ++ f"Invalid cookie attribute {k}={v!r} for cookie {name!r}" ++ ) + if not hasattr(self, "_new_cookie"): + self._new_cookie = ( + http.cookies.SimpleCookie() diff --git a/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb b/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb index ce7b903ef7..ca5b0a0470 100644 --- a/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb +++ b/meta-python/recipes-devtools/python/python3-tornado_6.5.7.bb @@ -10,6 +10,7 @@ SRC_URI[sha256sum] = "66c513a76cda70d53907bc27cf1447557699c2e95aa48ba27a442ff61c SRC_URI += "file://CVE-2026-91990.patch \ file://CVE-2026-82397.patch \ + file://CVE-2026-91991.patch \ " inherit pypi python_setuptools_build_meta From patchwork Sun Sep 27 00:39:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 99265 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A9F44C9833F for ; Sun, 27 Sep 2026 00:39:50 +0000 (UTC) Received: from mail-pj2-f41.google.com (mail-pj2-f41.google.com [74.125.227.169]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.29274.1790469586244353262 for ; Sat, 26 Sep 2026 17:39:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=X4h2H3np; spf=pass (domain: gmail.com, ip: 74.125.227.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj2-f41.google.com with SMTP id 98e67ed59e1d1-3a0bcdf41a3so922870a91.2 for ; Sat, 26 Sep 2026 17:39:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790469586; x=1791074386; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=D+RNC3o09m2sHgU5jd32fJsbyWzu+VeOOAHJVhuHz+E=; b=X4h2H3npVvgg6DSUfO93hnTm1K1lLT8SuDSFLSXrxf3BkyD0ZOLByw1k6SEys/CNEx KZiXNtsguL+p2wyOozufm3LMeGzSRC2P7wtsrCIqEnivVQ7LE5utd0rTtec07BVuPkUU 2gz6ZzveZrkFCWAhi2AkJyT83UeW1NOMq4DhCIPiolgVmHm8iDE3uxICHtsZFRjFFg6u TUjlrFyL22GF9DsrK4K+HDfoE4rAyrDAKxd3cBqXfNAHICPwkn2kV/WIboaquorv9Bk5 1c/3kIQD69UXg9+Cqd4cpUuaIgdwNW3E2YseYdwEWAtLdYJhN40UusgwdMu8ILpzz25U FFHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790469586; x=1791074386; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=D+RNC3o09m2sHgU5jd32fJsbyWzu+VeOOAHJVhuHz+E=; b=0RoZnk7l4mB2rzAVbJoNSvmBUrOARWuudCOcFfz38DPuCTHy5TxcRs9PD8ixux25ZZ YdC8Iq2+7F5pUg9uZ/AOSPZDtJIyTakBu0NyG42dI3P8mlzuzsCfkK15g2h3Nv+xYqpQ UH4HPUztHa9KbzaL+cd+oGZ0dlxc/YkJsRoRtboFYvxCuODzD9N7vhnl8vP6DXFJyRat T94t7O2lz8ZXLcs9tzZ7oJ1BBPFM9N6V5+1I5WZDBMHJyy5H0P2/gGfpWhhmxqBJEhXK Pe5SvasW1+4/MoNXOQmkf0kESJjz28gEUBpGeM+8/RC0NLildm3nwSFo4lCKjrVW9Nfc kDXA== X-Gm-Message-State: AFq9FYKeJOk4i8sLRwJUTlEnv5Y0W09mfxktPoYbO8eBPgAyPElrCA0R E+TMKcB6mcqhF76i4BYiHbsfm0TOEpTX9r+zgZ7rmUWBW+riehn/1QGTj5VDCQ== X-Gm-Gg: AYBFou3nxxtSX7hugWj62i/BKc9+hP6QPmMTMQLiS7g8qfMZateS/SLAQ5FxPnw3QvS mI76IIsOeX4LgLj/lUfELwmkbc3oyMbGkNtlp+dERQdx1VFibHK85he+LvjPqp2v6FsJLhVusIh 55NKi75qCL/zbP58G5Q2YPFi/fbf7J3cnB8fgaCjIDSryZA2sT1Hgq0YdQ8/KZfs8vKktI3fi3e /gLORzlEEU0igCfD+U4eIM/WkT1vOGyqGPyCrOR8HbF7dFJorWyoRGUsriUu+vbkzedu5D0HvQE 0RRtXFq1ruOvx1jByfSbbY/Yf/MNrTWodZ2afxDpjELQ5W2ND+zJWN20s+jCOENiCW1aHbkpvOw We0zrznYsRaZyfDq6ocsoRjJngYFLQvuJjE9Gc0DfylJIexR9nklebZyJGQ0ggutBLdV0o+bKTY zK2LZU0z0HP3BaYB7H4fUGfM40igvWvTVnRPTDpjTOnhJ8f3bK7eleaSGPhwKaJduoPNV2EuC3n X80n7ryd1z+Ntu3LGXSHEU= X-Received: by 2002:a17:90b:4b0a:b0:3a0:7cbf:b8d2 with SMTP id 98e67ed59e1d1-3a0986ed05amr8490582a91.10.1790469585489; Sat, 26 Sep 2026 17:39:45 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a0d22281f0sm2876420a91.1.2026.09.26.17.39.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 17:39:45 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 8/11] freerdp3: patch CVE-2026-85089 Date: Sun, 27 Sep 2026 13:39:18 +1300 Message-ID: <20260927003921.746786-8-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260927003921.746786-1-ankur.tyagi85@gmail.com> References: <20260927003921.746786-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 00:39:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130327 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-85089 Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-85089-1.patch | 28 +++++++++++++++++++ .../freerdp/freerdp3/CVE-2026-85089-2.patch | 28 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 2 ++ 3 files changed, 58 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85089-1.patch create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85089-2.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85089-1.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85089-1.patch new file mode 100644 index 0000000000..78a985642d --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85089-1.patch @@ -0,0 +1,28 @@ +From 2ccd047f64930ae10518ea14f476b2f311218814 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 13 Aug 2026 11:23:46 +0200 +Subject: [PATCH] [core,info] write zero to info data padding + +(cherry picked from commit 056cede398d71c1f2540baebc26ec3327a249301) + +CVE: CVE-2026-85089 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/056cede398d71c1f2540baebc26ec3327a249301] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/core/info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libfreerdp/core/info.c b/libfreerdp/core/info.c +index a11cc12ff..003bec52a 100644 +--- a/libfreerdp/core/info.c ++++ b/libfreerdp/core/info.c +@@ -1495,7 +1495,7 @@ static BOOL rdp_write_logon_info_plain(wStream* s) + if (!Stream_EnsureRemainingCapacity(s, 576)) + return FALSE; + +- Stream_Seek(s, 576); ++ Stream_Zero(s, 576); + return TRUE; + } + diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85089-2.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85089-2.patch new file mode 100644 index 0000000000..90e921dc39 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85089-2.patch @@ -0,0 +1,28 @@ +From 1228a148cb3754a78b8c40737e14d0be5030a382 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 13 Aug 2026 11:24:02 +0200 +Subject: [PATCH] [winpr,utils] initialize wStream buffer with zero + +(cherry picked from commit 483c9388119f06bac420d92053cff9ef94e83bea) + +CVE: CVE-2026-85089 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea] + +Signed-off-by: Ankur Tyagi +--- + winpr/libwinpr/utils/stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/winpr/libwinpr/utils/stream.c b/winpr/libwinpr/utils/stream.c +index c0beba7fc..224459584 100644 +--- a/winpr/libwinpr/utils/stream.c ++++ b/winpr/libwinpr/utils/stream.c +@@ -98,7 +98,7 @@ wStream* Stream_New(BYTE* buffer, size_t size) + if (buffer) + s->buffer = buffer; + else +- s->buffer = (BYTE*)malloc(size); ++ s->buffer = (BYTE*)calloc(size, sizeof(BYTE)); + + if (!s->buffer) + { diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index edd2fddf94..1c46a8b9ca 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -25,6 +25,8 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-64621.patch \ file://CVE-2026-66401.patch \ file://CVE-2026-67288.patch \ + file://CVE-2026-85089-1.patch \ + file://CVE-2026-85089-2.patch \ " From patchwork Sun Sep 27 00:39:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 99267 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3E32C9832A for ; Sun, 27 Sep 2026 00:39:50 +0000 (UTC) Received: from mail-pj2-f12.google.com (mail-pj2-f12.google.com [74.125.227.140]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30000.1790469588423674248 for ; Sat, 26 Sep 2026 17:39:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=I4fOJQHk; spf=pass (domain: gmail.com, ip: 74.125.227.140, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj2-f12.google.com with SMTP id 98e67ed59e1d1-398beb616f5so1027671a91.1 for ; Sat, 26 Sep 2026 17:39:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790469588; x=1791074388; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=/vRhbPfu/diBys2eiwnkaQPpGzgrjxQ7ZK+5VlNahfw=; b=I4fOJQHkdz8fNvxPdVFXKUDxb64AhWLAuIBf4ti03qOe82cRnHCct48+2+poZs5O6O kRafeywC+iJSkuILkOgeb6mrkaXx624MGrK+uMxXrJLhV/L+SPeG8PpxDul1bZAnYBvQ uyEefjjcsLeb+KVoRu7z7MnSpUqnBu85oVBC9RQIVYlpmkMXXHk+jp/4ZCIB7cGQccgA QBEARYJ5N9t7gfgQ0KmDGB/MgviNRUQY79Y4e0kGjuJQYb+EK7RmaoISCKQPShyDMfpO dSNceKbK8+KwuKYkOPbHywZ8+S22Hji4qstVsMT2TzmlE82dJYIwDo7KQeGSJ0gNKtZr 3ZQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790469588; x=1791074388; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=/vRhbPfu/diBys2eiwnkaQPpGzgrjxQ7ZK+5VlNahfw=; b=PAwHP1VP1qlvAKG2lMuOYBEtmcm1uIJC19PJ8pwEB7JCvbGBjPCQnNnG503FI4/Rua 62vx+mpNWVKGw+m9lHeLbF5pkJTMLl/3EwZrni4EcPzs5N/crZ9YEwanDZSUx0i03vE6 zPT6eLmn4JpZxx2E6vq2p9lecfTxBPUGl9YpqyEi8XaZlUdiutW3NWx6Vkj1PMIZXd0O S4t5nmRuaP7DOhwB3cmH7rUb2eYVZTxlELj8rRtlihMBAq1nW8w2txMvmkhHL+5yDanl gO8a+KvTyLXgsFZFKczCzIvxvK6Npwi1I+9TMt6TGf+aYKSU46j1GvplPwMzOZOp+UrV 7U7Q== X-Gm-Message-State: AFq9FYIBzs9ur7qCYnwB4aGl8fox54YjuWpe6ixOBFqRmsYkaMZWv1b/ L2TGMLjs9JiQAErdosS4WYMsqVG1seTggP5vT76ejgbGLqKxj2hKtTa1fB9oiw== X-Gm-Gg: AYBFou28obF1lT5QL4aGcOe52yf6J1JbbIIK1bm//uU4cKiyFjUVo/1ob44tbB9KA6M x/Q+gNKJKZuTTbNLTSQQFppHS+mG0cS5E4hE8SexyrWN2IHpA+DN04ry638kUiopR4Ri1vYR183 t8vzdEqK98+y71tawMvy1Vluc4ywPsXCuWAExzgW7fEJ1qUTC6u3NuwPwjCm/jQ2syY4x381rtQ LbPvHyfMKCSZDIZHMqO7hJyB9tG1Rm7LhFNEm50re+78LegeNkTQDqNuLt/fo7ZXwysJLyhAI00 ur5/iFAIgmXvU+hm91cRJgU6Wz1dCeO+AEM09Nv7fA+r8C7/8ZeQrA/HkT+6A1CK2FzlESGR1S5 FTID8zLxsTCqjsKMJ+Bln9GXm/HqX0TcBHCQPxaDO69/Aql+xqdAz9e27jRfV7Nga7PaKlyQ/XA e5idE2080ArJt9cTUvRML1x18/7Py7JoRu1YUhgHRNPUhv/OQtVtu0WQ2bn8Bxoct090b0OWII1 triknVgP2SX6yLmRDsRoLOtPaf1hytNzw== X-Received: by 2002:a17:90b:2704:b0:3a0:ce02:6dda with SMTP id 98e67ed59e1d1-3a0ce026f76mr2179744a91.19.1790469587761; Sat, 26 Sep 2026 17:39:47 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a0d22281f0sm2876420a91.1.2026.09.26.17.39.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 17:39:47 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 9/11] freerdp3: patch CVE-2026-85090 Date: Sun, 27 Sep 2026 13:39:19 +1300 Message-ID: <20260927003921.746786-9-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260927003921.746786-1-ankur.tyagi85@gmail.com> References: <20260927003921.746786-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 00:39:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130328 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-85090 Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-85090.patch | 59 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 60 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85090.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85090.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85090.patch new file mode 100644 index 0000000000..ee3077c1c0 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-85090.patch @@ -0,0 +1,59 @@ +From 22476c6898945934fb86b1672a372894fb68a111 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 13 Aug 2026 16:09:28 +0200 +Subject: [PATCH] [primitives,yuv444] limit data read to actual height + +(cherry picked from commit d0a481cb74ab57bca24791fe11b89464a332d3f1) + +CVE: CVE-2026-85090 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/d0a481cb74ab57bca24791fe11b89464a332d3f1] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/primitives/neon/prim_YUV_neon.c | 3 ++- + libfreerdp/primitives/prim_YUV.c | 3 ++- + libfreerdp/primitives/sse/prim_YUV_sse4.1.c | 3 ++- + 3 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/libfreerdp/primitives/neon/prim_YUV_neon.c b/libfreerdp/primitives/neon/prim_YUV_neon.c +index f44016cda..3e74c7ea1 100644 +--- a/libfreerdp/primitives/neon/prim_YUV_neon.c ++++ b/libfreerdp/primitives/neon/prim_YUV_neon.c +@@ -668,7 +668,8 @@ static pstatus_t neon_ChromaV1ToYUV444(const BYTE* WINPR_RESTRICT pSrcRaw[3], + pX = pDst[2] + dstStep[2] * pos; + } + +- memcpy(pX, Ya, nWidth); ++ if (y < nHeight) ++ memcpy(pX, Ya, nWidth); + } + + /* B6 and B7 */ +diff --git a/libfreerdp/primitives/prim_YUV.c b/libfreerdp/primitives/prim_YUV.c +index 65a5a8dd6..0db8c0e68 100644 +--- a/libfreerdp/primitives/prim_YUV.c ++++ b/libfreerdp/primitives/prim_YUV.c +@@ -146,7 +146,8 @@ static inline pstatus_t general_ChromaV1ToYUV444(const BYTE* WINPR_RESTRICT pSrc + pX = pDst[2] + dstStep[2] * pos; + } + +- memcpy(pX, Ya, nWidth); ++ if (y < nHeight) ++ memcpy(pX, Ya, nWidth); + } + + /* B6 and B7 */ +diff --git a/libfreerdp/primitives/sse/prim_YUV_sse4.1.c b/libfreerdp/primitives/sse/prim_YUV_sse4.1.c +index 6fed9945c..9ab1762a8 100644 +--- a/libfreerdp/primitives/sse/prim_YUV_sse4.1.c ++++ b/libfreerdp/primitives/sse/prim_YUV_sse4.1.c +@@ -1534,7 +1534,8 @@ static pstatus_t sse41_ChromaV1ToYUV444(const BYTE* WINPR_RESTRICT pSrcRaw[3], + pX = pDst[2] + 1ULL * dstStep[2] * pos; + } + +- memcpy(pX, Ya, nWidth); ++ if (y < nHeight) ++ memcpy(pX, Ya, nWidth); + } + + /* B6 and B7 */ diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 1c46a8b9ca..6270ea6a2d 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -27,6 +27,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-67288.patch \ file://CVE-2026-85089-1.patch \ file://CVE-2026-85089-2.patch \ + file://CVE-2026-85090.patch \ " From patchwork Sun Sep 27 00:39:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 99269 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8766C9832A for ; Sun, 27 Sep 2026 00:40:00 +0000 (UTC) Received: from mail-pj2-f41.google.com (mail-pj2-f41.google.com [74.125.227.169]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30002.1790469591409812162 for ; Sat, 26 Sep 2026 17:39:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Vw/2Slh3; spf=pass (domain: gmail.com, ip: 74.125.227.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj2-f41.google.com with SMTP id 98e67ed59e1d1-3a0bec20a6fso722182a91.0 for ; Sat, 26 Sep 2026 17:39:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790469591; x=1791074391; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=APpbIUbTG6Kivn786WnVrQv1gJd2BRDc5H0ZoqK49iE=; b=Vw/2Slh3z0hInXQsGNon003aByGUGBlf8hvLjggxkuD+JaQhP8l2T+m7wjmXXZKdGQ 3RY6EKckEus/WgnRUSG/aJGkimck/WJHa2OmiZdIsNsQD+9h1g86jkiYDAXLU2Hknjrc NuvTWsht4hYK122LU1HDWLhSH6ToxRTFeinOu+bJhUXn4oZjK4a52kgKT5UWrrY3W1wo ynGWfVRppOBDxyvBMz9FsqaNGFhmuYv1OF9Ll3K4193b09N3+e1BYISSD5DLMLLI01zL nnkIZhxUi9ili/CxNTfjpwaThbqqTest6CV+8ksCYp6djhP6RJWiKtoJ2kSdnKPhMdsg GBqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790469591; x=1791074391; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=APpbIUbTG6Kivn786WnVrQv1gJd2BRDc5H0ZoqK49iE=; b=O8R2GCggxziwsuZ9uJO4xGLDQV+O1tmRJ8f0tBHm+DpnG1Qkor/VGalPO/xQKJBp+W a1jjSGjNai0Iye3IzONj8GkeH381PCeQkMJ6PVUVHhkrimDvcwsn6V9XtAhNISrgwn7w W9vnNw0OS5xMUts7aQfUXMkciaFYKjiuqH0pVyjriSI+l+Ufn32LyiC0AtVPoT6OaESO DdlIyzszwxU+1i81Es+XFgVVxmWHk1Hny57+nJCOXl8D0ricX51+hnIW6ZtmHhq5vPRI TYr+jAAz9Xd9WlkiGrl/lymP6jHLBjVb7eJ60iI3au8oqQzSxhDQQlM+mPcefXpecPc/ eL1g== X-Gm-Message-State: AFq9FYLjvwnXG/LC/eySwKCjZGnhyx8RI2wUPndhyQqS++AiKQNyfikn Ypj62Q8/Jl/enSCPvmyAsHDE4mjFhwXDeeCcrG90f8LHHdpsoP3zL4vmthtehQ== X-Gm-Gg: AYBFou3xXHOGdBgRhx8IkkPQ9mbNEfhJQuyRGjFDVSuTSG5JI3k3aWnuH0Adv0+0Cqe gg/aF9VeTnTikohThRSLio9dra7ypim9z3Mm2kuT6nwqsRkS0KRBbSkng+VgpDlaKX7rwzv9WBj jWIjuSQidri7pNFlP54Q0lsM3XuQOTxanq3/PTG8WM8d5MtJyfskW+hBywMf6WnOhZdlq0X6YoZ BCf48JHqI2Sv9UJ9q42tJ9vJzy1K90wBXG5fRNopn3hgFI3KsIKG5c61lhcoxRMkH5a9HMv+j5s 2ZwPqXRp5o2ES6SR9MRrFV8irv9E4/L/PVhgur1rNOjGaXo8eCtFfi0f1vI9ZH3VMGd1FIRo3tz BpKaKnKN9TByBxfUQc51QcahBp66v75ARNR1QAngUGvjV61YIVjzPG6D0W3MZGGxSV7BYZi/x0p bRbcfDjODXtX3HFjfRAe4q2pXlt8ILoxjTqrbu+tbP0/bUTFd20TDXrcY/TGDDrE7KpV5xVkfYp KWXSKfvrhJ3D61jQeX8g7k= X-Received: by 2002:a17:90b:33cb:b0:3a0:f4ee:d2b2 with SMTP id 98e67ed59e1d1-3a0f4eee4aemr979705a91.32.1790469590686; Sat, 26 Sep 2026 17:39:50 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a0d22281f0sm2876420a91.1.2026.09.26.17.39.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 17:39:50 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Jason Schonberg , Khem Raj , Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 10/11] php: upgrade 8.5.10 -> 8.5.11 Date: Sun, 27 Sep 2026 13:39:20 +1300 Message-ID: <20260927003921.746786-10-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260927003921.746786-1-ankur.tyagi85@gmail.com> References: <20260927003921.746786-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 00:40:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130329 From: Jason Schonberg This is a security release. CVE-2025-1218 CVE-2025-14181 CVE-2026-91765 CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769 CVE-2026-6103 CVE-2026-93682 CVE-2026-92842 CVE-2026-17545 Changelog: https://www.php.net/ChangeLog-8.php#8.5.11 Signed-off-by: Khem Raj (cherry picked from commit 38accdd03182817dd97a7689f8a50568410b3ac5) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-devtools/php/{php_8.5.10.bb => php_8.5.11.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-devtools/php/{php_8.5.10.bb => php_8.5.11.bb} (99%) diff --git a/meta-oe/recipes-devtools/php/php_8.5.10.bb b/meta-oe/recipes-devtools/php/php_8.5.11.bb similarity index 99% rename from meta-oe/recipes-devtools/php/php_8.5.10.bb rename to meta-oe/recipes-devtools/php/php_8.5.11.bb index aab18777c7..c9f8f478f8 100644 --- a/meta-oe/recipes-devtools/php/php_8.5.10.bb +++ b/meta-oe/recipes-devtools/php/php_8.5.11.bb @@ -32,7 +32,7 @@ UPSTREAM_CHECK_REGEX = "releases/tag/php-(?P\d+(\.\d+)+)" S = "${UNPACKDIR}/php-${PV}" -SRC_URI[sha256sum] = "d79bd4f3a9248e5cb5833766ba0d51cd35dd01b8727f23f30bcdba6fabc51d3e" +SRC_URI[sha256sum] = "dc940716a8c73e531c0078eecb955d595d321ec2cc9d47149cf0089ea6e18f64" CVE_STATUS_GROUPS += "CVE_STATUS_PHP" CVE_STATUS_PHP[status] = "fixed-version: The name of this product is exactly the same as github.com/emlog/emlog. CVE can be safely ignored." From patchwork Sun Sep 27 00:39:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 99270 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CB9D6C98328 for ; Sun, 27 Sep 2026 00:40:00 +0000 (UTC) Received: from mail-pj2-f12.google.com (mail-pj2-f12.google.com [74.125.227.140]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.30003.1790469593852813950 for ; Sat, 26 Sep 2026 17:39:53 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=MI/rbBCn; spf=pass (domain: gmail.com, ip: 74.125.227.140, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj2-f12.google.com with SMTP id 98e67ed59e1d1-398a147688bso1437422a91.1 for ; Sat, 26 Sep 2026 17:39:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790469593; x=1791074393; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=u5KTHW9KWjVoScyLNmtZfx6K+1gWWzp678SI7V9AU+I=; b=MI/rbBCnDo1NNeWF2HuT5g2i2vUf+nSww5yRPLFvzdBglGn10NBo6uFslIUo0opxFG BDq4msDaGH6qakbdzYsZ1Kq30TohqWL1s/gYbySeKCnNedAo6cBBWbMeDzo1v7YeAwJs pH6peRTDpy9kjDPVeeP7BnNnuiuyhMQ844TzsytdYPcuXWQSTyanUWEcHbPVoY2Cq1Nl OJFc1T7apG/mZFuGbyTLwuLuRo5obmrIwnLSUF5149qmCNMyvB8SD2C80nDTkANlUQJO auw02CwKyQIEPJxw2G0MF9h5khhedhw2WEQQluIr9WOCfW78fj1WvJjBeb7eIZ4Ul/dg hMFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790469593; x=1791074393; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=u5KTHW9KWjVoScyLNmtZfx6K+1gWWzp678SI7V9AU+I=; b=zBRJ0NwHBYWFurU66ovk1YGC3gmZ7i2rzGHMj5BsJulyaBqP2OIHrxbdWmZpOkbcf2 NR0MzBxIOK57GylsimBR0sLNqq9KgBTMB0vqK2gJAcLb++lPSrjDuIzG/eHu+nnmh8sR 4HCnlEJnDi/XVaGE78Y8RlD/ezAuZQ7JLAZ/DSaxltGmeR6xUUHH8qhczcV8861kgEWr jTGshJ5xP4GaGKGJDpgXqqrsix2ovoMqh+qjXOKAS6sRDflNUbdwv3qHBq4ejI0CQrCu QU0auO7Ef+wJOUdmLv+hOtxXZcYhh4SA5pwsdwbSIo7wy/K7P2bgMPy5g6UI94blttB+ 3psg== X-Gm-Message-State: AFq9FYITX+MIYfNPQb/b5RAirmbY15wMBVi23LTXOavWulkBIeF1UuCM AozkY/1gOXeO9vTSmLz3MMNaoykN7XqsagaGHt4qwAzUZ082z0FPgSjA0cJYkg== X-Gm-Gg: AYBFou3x3wU5lSJwGAeC8ndipEjY+IsWqJSxCEItMuYEiH0vPuxSS7LCiUsE4ZAUgNk 1aN6T63xxGnWB0SFQq3HrWHPx1hpV49Fqxp+XeJ+fpF44bGIKihJp4j8cqazXMGAbBvD/h0Vfk/ XsCICfZY5yGJmsGRbPOx7FghvGe5pct6api8Vv/6NFLOn+TpE1AE8mweaD1miN+Txtjug2qnrzD ZMlQR+j2DxZcdt+MLah1tEiRF7SUdnG78xAVyADUIWgxKW348pH9yzqBK0K26C6ajPS908bqIkz dNFDPFWfgdm6xKvmixHUV/YtvuBuLPsuqxnDdNBGrl5Qrszdu1kV95k5K3RL7H4TCfaP8hkOi/i quavmUuvjZE2/0UP4CzSAla9VWYuf/ERpivlZLQ+TXf6qDhNTMOAaxwM38duyFmnu5B7gfpZIl2 LTwAaVBa0/JJYtQJ3rJqCXEDtJpN6k2KmcNA2w+33gUnoh93wi8ai2saYx8cJpZi176smUL1nqn 0cbnEJDnEcLnV9jB7EiQW0= X-Received: by 2002:a17:90b:52cd:b0:39e:6c69:9b8b with SMTP id 98e67ed59e1d1-3a099231f90mr7452845a91.48.1790469593137; Sat, 26 Sep 2026 17:39:53 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a0d22281f0sm2876420a91.1.2026.09.26.17.39.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 26 Sep 2026 17:39:52 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 11/11] gpsd: patch CVE-2026-60122 Date: Sun, 27 Sep 2026 13:39:21 +1300 Message-ID: <20260927003921.746786-11-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260927003921.746786-1-ankur.tyagi85@gmail.com> References: <20260927003921.746786-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 00:40:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130330 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-60122 Signed-off-by: Ankur Tyagi --- .../gpsd/gpsd/CVE-2026-60122.patch | 45 +++++++++++++++++++ .../recipes-navigation/gpsd/gpsd_3.27.5.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch new file mode 100644 index 0000000000..da8fa5f4d2 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch @@ -0,0 +1,45 @@ +From 50bf98d0240b94bbec6ce06be33cdaf99e2f6214 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Mon, 20 Jul 2026 20:12:16 -0700 +Subject: [PATCH] clients/gpsprof.py.in: ensure sats.used is boolean. Issue + 406 + +Prevfent command injection by sates.used. Force to boolean. + +(cherry picked from commit 5a9c44a42136b9bb98d460a8a716e9fd344a8d93) + +CVE: CVE-2026-60122 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index e91367ee3..07123d417 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -334,8 +334,11 @@ class spaceplot(plotter): + # get sat used count + sats_used = 0 + for sat in self.session.satellites: +- if sat.used: ++ if sat.used is True: + sats_used += 1 ++ else: ++ # ensure it is boolean. ++ sat.used = False + + if 'altHAE' not in self.session.data: + self.session.data['altHAE'] = gps.NaN +@@ -783,6 +786,10 @@ class polarplot(plotter): + used += 1 + if 'polarunused' == self.name: + continue ++ else: ++ # ensure it is boolean. ++ sat['used'] = False; ++ + if (('polarused' == self.name and + sat['used'] is False)): + continue diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb index 7819dc532d..ed16ee4fc1 100644 --- a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb +++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb @@ -11,6 +11,7 @@ SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \ file://CVE-2026-58459-1.patch \ file://CVE-2026-58459-2.patch \ file://CVE-2026-58459-3.patch \ + file://CVE-2026-60122.patch \ file://gpsd.init \ " SRC_URI[sha256sum] = "409873f5048462ef1ac413a51ab35caa8b50b31be62b3347bee1cc2994e7c649"