From patchwork Sun Sep 27 08:59:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99317 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57C75C98324 for ; Sun, 27 Sep 2026 08:59:59 +0000 (UTC) Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.34123.1790499593780954019 for ; Sun, 27 Sep 2026 01:59:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=S+StSfVZ; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-256628-20260927085950b027403f7a00020721-qjkcsi@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 20260927085950b027403f7a00020721 for ; Sun, 27 Sep 2026 10:59:50 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc; bh=td0wZLays808QaIPu/laWBSJcM7q6kgNJyy+NhPUEmQ=; b=S+StSfVZ/7rhts2/m8JuINsidBhaVzH8Z2VYkaMsqs+QnC0yGE1lW/Vit+akpncJWkD4RF Q+d68N8wExr/ywcWNsTe6ZXiU9iCT7nc6zLez6Ew3Ip2rez63c9OSLpiDmLKnbf6nfYcNKbc HeEqwHIJEpPapWSAJyit5adTLeF3AAXriUIgkT6ncxfZEO/zMoOMZ633Rw9vT9uXytxtBu93 UlvpnpWnRl5KKM1Xjsl5ULnDSbY2ouWcUswiOUZ0RvhgZCnjIc0hT1Ycnw+dxBt0bVQ3qcQG TC4inBoblrMZVe4qLdOdYVIwp15L/jTrdbMM9y2kVpqQ3usKdhkT+CnQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH 1/8] glibc: set status for CVE-2011-0536 and CVE-2025-0577 Date: Sun, 27 Sep 2026 10:59:29 +0200 Message-ID: <20260927085936.114900-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 08:59:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246679 From: Peter Marko New version of sbom-cve-check makes more torough version validation and version strings with distro specific suffix is no longer accepted, thus leaving some CVEs without version to compare (no-version-ranges). * CVE-2011-0536: CVE desciption says it's related to RedHat patches * CVE-2025-0577: [1] linked CVE report says it's related to RedHat patches and no upstream release is impacted [1] https://bugzilla.redhat.com/show_bug.cgi?id=2338871 Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (From OE-Core rev: 85babe3703588b00a03f7087c54440243a993ee5) Signed-off-by: Peter Marko --- meta/recipes-core/glibc/glibc_2.43.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-core/glibc/glibc_2.43.bb b/meta/recipes-core/glibc/glibc_2.43.bb index 9f3a3814d0..5c21223b55 100644 --- a/meta/recipes-core/glibc/glibc_2.43.bb +++ b/meta/recipes-core/glibc/glibc_2.43.bb @@ -16,6 +16,9 @@ CVE_STATUS[CVE-2019-1010025] = "disputed: \ Allows for ASLR bypass so can bypass some hardening, not an exploit in itself, may allow \ easier access for another. 'ASLR bypass itself is not a vulnerability.'" +CVE_STATUS[CVE-2011-0536] = "not-applicable-platform: specific to RHEL patches" +CVE_STATUS[CVE-2025-0577] = "not-applicable-platform: specific to RHEL patches" + CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS" CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 CVE-2026-4437 CVE-2026-4438 \ CVE-2026-4046 \ From patchwork Sun Sep 27 08:59:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99318 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2FB88C9830E for ; Sun, 27 Sep 2026 09:00:09 +0000 (UTC) Received: from mta-64-228.siemens.flowmailer.net (mta-64-228.siemens.flowmailer.net [185.136.64.228]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.34124.1790499599790435357 for ; Sun, 27 Sep 2026 02:00:00 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=uAF3wZOG; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.228, mailfrom: fm-256628-202609270859581e41e72c7d00020754-f5faui@rts-flowmailer.siemens.com) Received: by mta-64-228.siemens.flowmailer.net with ESMTPSA id 202609270859581e41e72c7d00020754 for ; Sun, 27 Sep 2026 10:59:58 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=i0l0m/PnEooPZEZm/l+C/bprhl6Hyl0sFH8Bp7j2m/4=; b=uAF3wZOGLGpQlvjsR3nI3s4Z2rtaZvDSUv/miYDKufUHBlz9qtDjrZoK1HHH8wgezTUz5B 3FqpuYfv96Lua9RnC4ee+asSDCUqYsPrto4/qjsry3/CU8zCe7WxcygtnmtkNwZfx2OHb1Fz UyuR88XyHjthRUIgclc/x/vXDeC6Qc6pWMzL6cyxel4BL6G6TwzFvXaoWzznldAnfVZAPDpO IpRQgrGX8iaDHtDAMOqKxoqHXrUIBuDRDPpTkTu338ikd+YpdUwts3eODoyEj947tZffye2T zjrDVTrR6zo8zrhQVwqSdtcUXohHC1nt/pORDtFJZTv8EZ/QSJfKFcvQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH 2/8] gnutls: set status for CVE-2023-0361 Date: Sun, 27 Sep 2026 10:59:30 +0200 Message-ID: <20260927085936.114900-2-peter.marko@siemens.com> In-Reply-To: <20260927085936.114900-1-peter.marko@siemens.com> References: <20260927085936.114900-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 09:00:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246680 From: Peter Marko New version of sbom-cve-check makes more torough version validation and version strings with distro specific suffix is no longer accepted, thus leaving some CVEs without version to compare (no-version-ranges). Per [1] this CVE was fixed in v3.8.0. [1] https://security-tracker.debian.org/tracker/CVE-2023-0361 Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (From OE-Core rev: 9d9b944d390efdf45196e53e4283e3ec2acfd0fd) Signed-off-by: Peter Marko --- meta/recipes-support/gnutls/gnutls_3.8.12.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb index 538fd9c9e0..92854eeaf9 100644 --- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb +++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb @@ -123,6 +123,7 @@ pkg_postinst_ontarget:${PN}-fips () { fi } +CVE_STATUS[CVE-2023-0361] = "fixed-version: fixed in version 3.8.0" CVE_STATUS[CVE-2025-32989] = "fixed-version: fixed in version 3.8.10" CVE_STATUS[CVE-2025-32990] = "fixed-version: fixed in version 3.8.10" CVE_STATUS[CVE-2026-1584] = "fixed-version: fixed in version 3.8.12" From patchwork Sun Sep 27 08:59:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99319 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42D52C98338 for ; Sun, 27 Sep 2026 09:00:09 +0000 (UTC) Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.33376.1790499605733257858 for ; Sun, 27 Sep 2026 02:00:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=qUOZaDUB; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.225, mailfrom: fm-256628-202609270900034cc9cec8b100020709-k4ndla@rts-flowmailer.siemens.com) Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 202609270900034cc9cec8b100020709 for ; Sun, 27 Sep 2026 11:00:03 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=stOcbp2JH2ZcgWFn2leDmu58t97ZiZvJ/Gk0DuxWy1U=; b=qUOZaDUBSLFOXtWBgxNbNpYTPVzTlswPpvo0nKMJ91Ts04R0AVsktE/fI2rkMSHdRVdIqQ D7Ve9Az+K7zwOsXoNGRzrk6aeLcWrfUk6avftS/njAkHdU2TgdX2DlsViq8Ed6CElWaW0yKO 3nnxx0rRZ2vPMXowwYp9ZLjgKFilFCMQ9SArwqbgYL2J8p++iZiqsD3Eu8bJzcJ6UoudK+mV EQwjAKLVYdvhe4gqtOWpYxyOdwH4SW+pKcgDB5B5TS8HmZsrXLCj70dRsneiQw5yxMQTLXYL tEA8fOXr+tsGNmTvOAjZafdqK7pFyd7qGJZTs/toBkzh48UiSN5vul1g==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH 3/8] libarchive: set status for CVE-2026-4424 Date: Sun, 27 Sep 2026 10:59:31 +0200 Message-ID: <20260927085936.114900-3-peter.marko@siemens.com> In-Reply-To: <20260927085936.114900-1-peter.marko@siemens.com> References: <20260927085936.114900-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 09:00:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246681 From: Peter Marko New version of sbom-cve-check makes more torough version validation and version strings with distro specific suffix is no longer accepted, thus leaving some CVEs without version to compare (no-version-ranges). These are RedHat CVEs listing version-less or distro versions. Release 3.8.7 notes [1] contain reference to pull [2] from NVD report. [1] https://github.com/libarchive/libarchive/releases/tag/v3.8.7 [2] https://github.com/libarchive/libarchive/pull/2898 Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (From OE-Core rev: 4359d85f9dcb0a6d188859f1ae0200352668b9cc) Signed-off-by: Peter Marko --- meta/recipes-extended/libarchive/libarchive_3.8.7.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb index afc06f85d4..c0a2921143 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.8.7.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.8.7.bb @@ -89,6 +89,7 @@ do_install_ptest() { RDEPENDS:${PN}-ptest += "bsdtar bsdcpio" +CVE_STATUS[CVE-2026-4424] = "fixed-version: fixed since 3.8.7" CVE_STATUS[CVE-2026-4426] = "fixed-version: fixed since 3.8.7" CVE_STATUS[CVE-2026-5121] = "fixed-version: fixed since 3.8.7" CVE_STATUS[CVE-2026-5745] = "fixed-version: fixed since 3.8.6" From patchwork Sun Sep 27 08:59:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99320 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 301DCC9830E for ; Sun, 27 Sep 2026 09:00:19 +0000 (UTC) Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.33376.1790499605733257858 for ; Sun, 27 Sep 2026 02:00:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=hbZ7T3hq; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.225, mailfrom: fm-256628-2026092709000866ff6163f600020775-3dk3gb@rts-flowmailer.siemens.com) Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 2026092709000866ff6163f600020775 for ; Sun, 27 Sep 2026 11:00:09 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=wexw94u8Zk5YtdWzeqKPPFTr0Gr5lbdjj0wfzl5mmkI=; b=hbZ7T3hqvXr08w/GPou2vBwpQfXhWtTVZSNgJwjBKAmGwd0AwFYDq+MljSXvDzXwFYag66 /uVh8nIyTTBx+EIP5M1ReKVGILAJHxcyfSI5IgFzWpE2kpDP1Z0QB9FAoPARMi0c7aG+dSXp zqgKtOvRGNrx5csQHsNs2KxwZr9vyVFKdYG89IdoX5hUMeJjQEkADs5iU619DSlAinfVWZ33 1KLHqsKzcBltWNBehR2/+/jue5AdHdQorGMYkygy/Bybw0OTn+YmBYOg+edOTeoYz/jAeIZ+ +xnnZgiwv9rquleuLC7Orode7lTHGkdeRgmcCBsf2dD+cleGWudv4qOg==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH 4/8] nfs-utils: set status for CVE-2025-12801 Date: Sun, 27 Sep 2026 10:59:32 +0200 Message-ID: <20260927085936.114900-4-peter.marko@siemens.com> In-Reply-To: <20260927085936.114900-1-peter.marko@siemens.com> References: <20260927085936.114900-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 09:00:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246682 From: Peter Marko New version of sbom-cve-check makes more torough version validation and version strings with distro specific suffix is no longer accepted, thus leaving some CVEs without version to compare (no-version-ranges). This is RedHat version-less CVE. Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (From OE-Core rev: 2bb062e403c7093734de6467c49503a7d8970d9e) Signed-off-by: Peter Marko --- meta/recipes-connectivity/nfs-utils/nfs-utils_2.8.7.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-connectivity/nfs-utils/nfs-utils_2.8.7.bb b/meta/recipes-connectivity/nfs-utils/nfs-utils_2.8.7.bb index 7693a88682..a5ebf7043e 100644 --- a/meta/recipes-connectivity/nfs-utils/nfs-utils_2.8.7.bb +++ b/meta/recipes-connectivity/nfs-utils/nfs-utils_2.8.7.bb @@ -147,3 +147,5 @@ do_install:append () { chown -R rpcuser:rpcuser ${D}${localstatedir}/lib/nfs/statd chmod 0644 ${D}${localstatedir}/lib/nfs/statd/state } + +CVE_STATUS[CVE-2025-12801] = "fixed-version: Fixed since v2.8.6" From patchwork Sun Sep 27 08:59:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99321 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40A3AC98324 for ; Sun, 27 Sep 2026 09:00:19 +0000 (UTC) Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.34131.1790499617059631814 for ; Sun, 27 Sep 2026 02:00:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=KU39fdEt; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-20260927090015339155fcff0002077d-22at8y@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 20260927090015339155fcff0002077d for ; Sun, 27 Sep 2026 11:00:15 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=7wPgnp8FK98eSr9A2/sGnI0vtW0vgfM/5GrSRC6dg7Y=; b=KU39fdEt9X6TSTlHsam7SzFuiYRyqVN8ngzqZoPj1mOcae04ITC9kyaoQdSgFCg3Cj694M 3qixNhsBxXPFLas9ykIWIb8jxlp8y/L9LmIRJsbcP2t3UHb064Bc7yhhLmsRRRx9dNgUdebg pWGHbVCmY4r6DQbBYNLEgC9W8Pqi9qpZvDkCZoHlBha57ts/AemUl1vQ8Vml1uQ310DYTqGu cFosdr2hr5c3510xddhTbYNLS17AFQI/hsiDswFQ4nB7Aotd2+pR4DUwYpgViyGEg/fS4AIu XiXDLg5Jnjbin/SAqbuPggwm44ZXtRLHkXnzkh/blTxVCgou5q+2/ctQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH 5/8] openssl: set status for CVE-2015-3216 Date: Sun, 27 Sep 2026 10:59:33 +0200 Message-ID: <20260927085936.114900-5-peter.marko@siemens.com> In-Reply-To: <20260927085936.114900-1-peter.marko@siemens.com> References: <20260927085936.114900-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 09:00:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246683 From: Peter Marko New version of sbom-cve-check makes more torough version validation and version strings with distro specific suffix is no longer accepted, thus leaving some CVEs without version to compare (no-version-ranges). Per [1] this fffects Red Hat specific patch. [1] https://security-tracker.debian.org/tracker/CVE-2015-3216 Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (From OE-Core rev: 0353d7f67e6fedfc10e9ca56a6bf5f3ca9e215e8) Signed-off-by: Peter Marko --- meta/recipes-connectivity/openssl/openssl_3.5.8.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-connectivity/openssl/openssl_3.5.8.bb b/meta/recipes-connectivity/openssl/openssl_3.5.8.bb index d8cae41291..71446e62e3 100644 --- a/meta/recipes-connectivity/openssl/openssl_3.5.8.bb +++ b/meta/recipes-connectivity/openssl/openssl_3.5.8.bb @@ -301,3 +301,5 @@ INSANE_SKIP:${PN} = "already-stripped" BBCLASSEXTEND = "native nativesdk" CVE_PRODUCT = "openssl:openssl" + +CVE_STATUS[CVE-2015-3216] = "not-applicable-platform: specific to RHEL patches" From patchwork Sun Sep 27 08:59:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99322 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CA33C98324 for ; Sun, 27 Sep 2026 09:00:29 +0000 (UTC) Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.34132.1790499622975369038 for ; Sun, 27 Sep 2026 02:00:23 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=HTb1Fkho; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.225, mailfrom: fm-256628-2026092709002115499bf8eb0002079e-zjqxsh@rts-flowmailer.siemens.com) Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 2026092709002115499bf8eb0002079e for ; Sun, 27 Sep 2026 11:00:21 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=qEL585+6bgfGnA1HTorSivaDx4doFHVKeGmmkstAEIo=; b=HTb1FkhocozJbe1krS9qJgG0h7mzV1DeoYh6j43va+fJ/heOr9hzOSwIZwsdYNbzYXjxCV F+c+RKAAxXX/ZLi3fNyulAVB+SDhr12tc9uwS5znodElKFpryp8+q6mFuCVVfj72tlqiDZab mPUage7EfjOYJiiScrGLF5kXvP0xi9+RmthzMQXBAZpYJKwdxy9rPvg6TyrUfzKooNL7SSVP GPjloNswF1FYsg08OSMgX4f1tpay1aFRnc0VLNpfz44D3svQ2WR/bsFV7SolbKREv/kNw/5O aRoimcfQmYrJ5ReeJRY2gs/TgvQcKgcpr2J0Prfbjyk+ghAewfqJ+k6A==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH 6/8] ovmf: set status of CVE-2017-5731 and CVE-2019-14584 Date: Sun, 27 Sep 2026 10:59:34 +0200 Message-ID: <20260927085936.114900-6-peter.marko@siemens.com> In-Reply-To: <20260927085936.114900-1-peter.marko@siemens.com> References: <20260927085936.114900-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 09:00:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246684 From: Peter Marko New version of sbom-cve-check makes more torough version validation and version strings with distro specific suffix is no longer accepted, thus leaving some CVEs without version to compare (no-version-ranges). OVMF has a generic problem that version is encoded in different ways. Both CVE have their fixed version in NVD CVE reports encoded as YYYY-MM-DD... CVE-2017-5731 additionally predates tags in vurrent git repository. Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (From OE-Core rev: 1ac5e07968d2dc23343ca3a7c1eab7c3788fff41) Signed-off-by: Peter Marko --- meta/recipes-core/ovmf/ovmf_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb index 01f840c215..cd6a40a9d0 100644 --- a/meta/recipes-core/ovmf/ovmf_git.bb +++ b/meta/recipes-core/ovmf/ovmf_git.bb @@ -40,11 +40,13 @@ CVE_VERSION = "${@d.getVar('PV').split('stable')[1]}" CVE_STATUS[CVE-2014-8271] = "fixed-version: Fixed in svn_16280, which is an unusual versioning breaking version comparison." CVE_STATUS[CVE-2014-4859] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." CVE_STATUS[CVE-2014-4860] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." +CVE_STATUS[CVE-2017-5731] = "fixed-version: fixed since 2017-11-07" CVE_STATUS[CVE-2019-14553] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." CVE_STATUS[CVE-2019-14559] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." CVE_STATUS[CVE-2019-14562] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." CVE_STATUS[CVE-2019-14563] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." CVE_STATUS[CVE-2019-14575] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." +CVE_STATUS[CVE-2019-14584] = "fixed-version: fixed since edk2-stables202011" CVE_STATUS[CVE-2019-14586] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." CVE_STATUS[CVE-2019-14587] = "fixed-version: The CPE in the NVD database doesn't reflect correctly the vulnerable versions." CVE_STATUS[CVE-2024-1298] = "fixed-version: fixed since edk2-stable202405" From patchwork Sun Sep 27 08:59:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99324 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C1FAC98324 for ; Sun, 27 Sep 2026 09:00:39 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.33382.1790499629470991091 for ; Sun, 27 Sep 2026 02:00:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=YrOyo1+m; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-20260927090027316c7c8faa0002076b-7omezj@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 20260927090027316c7c8faa0002076b for ; Sun, 27 Sep 2026 11:00:27 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=RJK46qcr08BARfhbw57JcE4qNNQmMS1sP3WLFgYqCW8=; b=YrOyo1+mWClcLiSooqyZQjv188dFXsKWgAk4xkhBLm3Y2bSQquxVPjZ/Bidi6gsFvALU8A 8G+vd4SraxbJA60mRk+yLn8ylW7zFE4jL3AJSqbo7xuPaVRVGdmBy0Lx/utBRsO2b9iSFuKF sDzZ8t4aRVGqV/lIMWofht8gHbOpWeHLF67PoafagcJCKQDQE/wF9wRwaeQm+h5az0cxhBQ4 YBIwJ8JhM1DwU+u/Qk81Vuk2c1OyBXlIJVZfjKB+mhlbWhZ1uEviRM8sZ7WBAMRb0/X/58s5 BAA08gha0EEXKzlh64JYcbLnJVUTVb6FRa25ExukmP2VAlgcUf8S2owA==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH 7/8] ppp: set status for CVE-2020-15704 Date: Sun, 27 Sep 2026 10:59:35 +0200 Message-ID: <20260927085936.114900-7-peter.marko@siemens.com> In-Reply-To: <20260927085936.114900-1-peter.marko@siemens.com> References: <20260927085936.114900-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 09:00:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246685 From: Peter Marko New version of sbom-cve-check makes more torough version validation and version strings with distro specific suffix is no longer accepted, thus leaving some CVEs without version to compare (no-version-ranges). Per [1] this is Ubuntu-specific issue. [1] https://security-tracker.debian.org/tracker/CVE-2020-15704 Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (From OE-Core rev: 1f875a76c3b5aca955f705163b07dd1fe20373be) Signed-off-by: Peter Marko --- meta/recipes-connectivity/ppp/ppp_2.5.2.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-connectivity/ppp/ppp_2.5.2.bb b/meta/recipes-connectivity/ppp/ppp_2.5.2.bb index 37e223b4ab..698d6930eb 100644 --- a/meta/recipes-connectivity/ppp/ppp_2.5.2.bb +++ b/meta/recipes-connectivity/ppp/ppp_2.5.2.bb @@ -79,3 +79,4 @@ SUMMARY:${PN}-password = "Plugin for PPP to get passwords via a pipe" SUMMARY:${PN}-l2tp = "Plugin for PPP for l2tp support" SUMMARY:${PN}-tools = "Additional tools for the PPP package" +CVE_STATUS[CVE-2020-15704] = "not-applicable-platform: specific to Ubuntu" From patchwork Sun Sep 27 08:59:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Marko X-Patchwork-Id: 99323 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BBA1C9830E for ; Sun, 27 Sep 2026 09:00:39 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.34133.1790499633807670266 for ; Sun, 27 Sep 2026 02:00:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=Ix+QNShI; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-2026092709003296b00528af00020755-uyvrj7@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 2026092709003296b00528af00020755 for ; Sun, 27 Sep 2026 11:00:32 +0200 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=9AH/2YtKUOiJskvvgkyKpSJdf6urinxpj4Dud++dYTs=; b=Ix+QNShIfKM+LWO51Bg6bkIb0FGCpQ5jMBoKGibRnD7/VE3wtUNbn0cVl3TNcsTkFruJOX 0o4RS21c/vGFQkXcl66dEJL0S1jOZdXYbOuHFvy4iPgnyUdzewjdHT7xCIxzEGJt+B6y7vsn 5uD9elcfQiZGXtogSLOvDstc6De/w6cQ2Lu8eRSuXYJStyf8X0Hz2FIQnxtvBX7yOpwfa9eN aAyDGykOBPLtIPFNxxFaw/VIUeOgjiZgjMEWBWiPDWusXGJJWP6wFVZstvKEV+2GiIr61zrt 16lIQuZYwCt8TRivR8l8If49f+RiqSKsiRx9zSZHK1DDz+T59JQ2WsPg==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [wrynose][PATCH 8/8] pulseaudio: set status for CVE-2020-15710 and CVE-2020-16123 Date: Sun, 27 Sep 2026 10:59:36 +0200 Message-ID: <20260927085936.114900-8-peter.marko@siemens.com> In-Reply-To: <20260927085936.114900-1-peter.marko@siemens.com> References: <20260927085936.114900-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Sun, 27 Sep 2026 09:00:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246686 From: Peter Marko New version of sbom-cve-check makes more torough version validation and version strings with distro specific suffix is no longer accepted, thus leaving some CVEs without version to compare (no-version-ranges). Per [1] and [2] these are Ubuntu specific CVEs. [1] https://security-tracker.debian.org/tracker/CVE-2020-15710 [2] https://security-tracker.debian.org/tracker/CVE-2020-16123 Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (From OE-Core rev: d202f8cb555f04eda34eb2793c5802aac43f58cc) Signed-off-by: Peter Marko --- meta/recipes-multimedia/pulseaudio/pulseaudio.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-multimedia/pulseaudio/pulseaudio.inc b/meta/recipes-multimedia/pulseaudio/pulseaudio.inc index a8a5a1e074..1df24bf04b 100644 --- a/meta/recipes-multimedia/pulseaudio/pulseaudio.inc +++ b/meta/recipes-multimedia/pulseaudio/pulseaudio.inc @@ -297,4 +297,6 @@ RDEPENDS:pulseaudio-server += "${@bb.utils.contains('DISTRO_FEATURES', 'x11', \ bb.utils.contains('DISTRO_FEATURES', 'systemd', 'pulseaudio-module-systemd-login', 'pulseaudio-module-console-kit', d), \ '', d)}" +CVE_STATUS[CVE-2020-15710] = "not-applicable-platform: specific to Ubuntu" +CVE_STATUS[CVE-2020-16123] = "not-applicable-platform: specific to Ubuntu" CVE_STATUS[CVE-2024-11586] = "not-applicable-platform: specific to Ubuntu 16.04"