From patchwork Mon Oct 12 21:09:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100491 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 802EECA9EDC for ; Mon, 12 Oct 2026 21:10:23 +0000 (UTC) Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5053.1791839417169378333 for ; Mon, 12 Oct 2026 14:10:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=FIQJ/cjs; spf=pass (domain: gmail.com, ip: 209.85.216.45, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-383b4a3755fso1461180a91.3 for ; Mon, 12 Oct 2026 14:10:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839416; x=1792444216; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=JXETLo7OCgtEZvnkhNWh1tg9VjrtfeNUp4d38wajRg4=; b=FIQJ/cjsSKl3bPKHwza7aj790giF46OhYZ3EI3FbetvNojjlj1gCRfV1XxJJfcfJXE v58Nr9Z10KPLLQzS0WEhqMtcQShMIXlTsSCv3RpevLsXt8MRrfnDyXLdP5n4tGyJDt8I tV0K9DUk52PDNq+0R6AgGM95GVpxYvUt9fU7SogHCyBX1s031iU8O3MsJsrVOT3a3Sgt +A7kWxBixbjAMihl8M79MVEVo8aVHEdRdy5MLKyVXkYiiWaMcvuexqza+xzdXBMjXsyD enHrMbEEgA4lR38HIsWk2euhJ4kwwcyeONC+I5QM1jWi43oUi4itVSuajrhvAae+Y7vq Gi2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839416; x=1792444216; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JXETLo7OCgtEZvnkhNWh1tg9VjrtfeNUp4d38wajRg4=; b=QeMOQkYy28Y1zoNH3mzHRAuLsYSrUnHh+dxBWZVp1MLInCpPLJJyRGYe9XXXDgA09C aGwii17S1sZ6BogbW+7MPYQxwzlGTlnr4vme/2kUvVa9N544XQQ0GCz8ihXVyRCQ06lw TXBt02gW3dJQLT1r/QSOLCI35mC1HXy6EOjBDxRvm5J8VxDgTtYB2XplEFOYVYMKXwNM hZ/TjnVoCBcRzhpNiVJprczFCocCNSrIygqVB5LQCl66leYcC3DLTrkIacKT1d9pemfm XOIM1//yo/3c5mq9KSWqRRbrJlprQE6SRG68TrM4bEV7qaiWOkT/jooSEfkxo66V/fR6 uvFQ== X-Gm-Message-State: AFq9FYIXRCkVGbglE/mStgrGdznuQp4ej30m1JWQ6O0rEEXZsFBC3wZo bvYv/unVZSzPXnT+MbwJc5s7oh0S2u/DgOPcptB0DwD73PgOMQEl8s4/3mFFCHuc X-Gm-Gg: AYBFou0zmU19gg6K+bdZZBhWxk+52xZC7PpUpF+nVG4ZmG5VRAj7OQnnAvDJ0kiayEA a8QYA3rEcUJSHXx+I/XBn4+U3CFEV65BuAbIfXvPB9ZBFBJUnIM5BMa38GASMdwXpWM2aZzddnA n8W38YjrrseFPCIts2e5EyMhhd50CGaXn0oM3ot0f94vnJMjGWAdJUP5fm/C2Fc9sAPh3E5hZDv 0wYre2UqUZNapE5lOprzcnMUHRAT1Y/b4zTlhgw29cjDc8AgSZQbyO6ZBH/bvdNYTRKrI6t43dC OJxi32JgbIaeIW0D3Rli5THwEQrYGvSZKHe4MkVDHqcr8L/Ks0q0gsBNOsjwysT2EkfBHoWV3BN 9UWbqqJLLByzKIBZMeQITlFklZuup+q99NBsewsp9p/wBoZQh9Qw0WwnWhEI1Tcc0KKeAFJNa6B PXcx0n/LnpvehEd8z9O/J5CUSADLQwMkKeYE/3EH5IAnJX0cgBoTT6x0x+hhZFuHyWi6000JM5T H8Z9Iip+iSonnNUAC6ZVmBAJh1z9Ig2Oh4V9JI= X-Received: by 2002:a17:90a:617:b0:3ab:be66:ddd4 with SMTP id 98e67ed59e1d1-3abbe66df49mr3042819a91.19.1791839416500; Mon, 12 Oct 2026 14:10:16 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:15 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 1/43] capnproto: ignore CVE-2026-59704 Date: Tue, 13 Oct 2026 10:09:25 +1300 Message-ID: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:23 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130771 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-59704 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb b/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb index 9909afb0e90..1149913c2b7 100644 --- a/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb +++ b/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb @@ -41,3 +41,4 @@ BBCLASSEXTEND = "native nativesdk" CVE_STATUS[CVE-2026-32239] = "fixed-version: fixed in 1.4.0" CVE_STATUS[CVE-2026-32240] = "fixed-version: fixed in 1.4.0" +CVE_STATUS[CVE-2026-59704] = "cpe-incorrect: this vulnerability is for CapSoftware Cap" From patchwork Mon Oct 12 21:09:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100490 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97F6BCA9ED0 for ; Mon, 12 Oct 2026 21:10:23 +0000 (UTC) Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5084.1791839422582132017 for ; Mon, 12 Oct 2026 14:10:22 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=R5vJkUFo; spf=pass (domain: gmail.com, ip: 209.85.215.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-cc4e9e56e9aso669569a12.2 for ; Mon, 12 Oct 2026 14:10:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839422; x=1792444222; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=t3d43JjfWEUFleFcwwuibvfJUhSWCwglxb4hHqHvJmc=; b=R5vJkUFoKUw85zVyJlbofmPYDO0L+ZOsoF57JDhctoUCoP6PkdpSju5iELB4w/wvkf xaiyJoJ+dvkbiTcCkp6HphgBARFbpbDc0/0nmUEr169V0B2WYDWgXT1rl5bKyK7XGZV6 YefjVDdzleM49u7pDsaXekpKHjRPWXPuj9zMbBkeRaQIFV3yoFXTWk4UHVXMJ1ivJEsO D7AHVH+yjaC8o62OzVC9dIKPBUb16naMwTF/dhcDzsWE8P31BJL2Pleg04sLuaH3tjB9 uqCmHn+qdUK/T7VhjwMbz58SCXRv0Z8xWQfyPEGwnejare2exDIvw/V6LS6xq7Nmsfvb IurQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839422; x=1792444222; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=t3d43JjfWEUFleFcwwuibvfJUhSWCwglxb4hHqHvJmc=; b=kvgxAlMXe25XOIAYwDai+9zCQqYbx8d5VClxTDMrge+QSO2HBrR/LYtYx9d6yeorD0 Ozoc6TWgHoWcRWvzbD2NmE2bPcPM8GBBI8L+A4snJyWRyX7IMJow3Uiv7rQ7FlSw0qLj Wav1Uya4PiPjm7uL49URfzjjNyuojbtq1yOZYYn56D1NBX8tIG2dKtYjc5iOm36ohi/0 JBSzyYOeVv+UVjMBb0HUrCaBb+6NLWHbpxPfImjYIawqxp603bOuD9jtpRqyR6s8hCB8 mlPTsM//3ZWSqppRLNRRSybfZ7j8LyK4FvLCtvn1ObD3YcJffUa5XBhoRvEIWy3FrBjH lRRA== X-Gm-Message-State: AFq9FYKEeDTrkezbKejqEJdzlW00gXlLvDOTjWXNwkTp7hUEzyE0pze/ NpuSQvLLaqcOMY8omHe+Ai59mJPHRGRiGlCtQk8NV2AJPpbI31mIQTnLruj7lQ== X-Gm-Gg: AYBFou3/UMzVkJm24FPTs7hJhIAMzF2FKXVJOjOYOkMsygCGoGDrHy+6a1C9Mz2QxvS dx/KiryMPGAJS6MMe4oWvHYDiaJhqqJGkBDKeb8ZpIlYeNJiXs1zndVMhqOuj13hdbit3yh5J8J o86WtJ/RuoUHvI5XZWhkB6u5QiOHQWYkgJaS90296LZ4oW6h+5nZkI3Kw+W5DqV+BPfV6BP5UKf hfODvJxiXNihiD6dkpcv90xDDYLGcQcEeZkU8bPE9mwJfq1tYiZzS5tWto9ZGtv2UW0yXmXl5gf ac4cohK299OugRCFVNi/lcZMNGEZz6Jdc8SXYfQRKJfboHeQ1MVHVHKzcwjN1FBNCyVGepYuC5u oDKjQSbX1cAGZDhRiQI0/2VH2ufcRpa+nFEcVHWFLhZZlivnjIOLQlq5YFrKX1q5Tb50nqLvnp8 BeUX5Il6hUD0NPgEIvBlFd9m/m6KiJ5qsIh4TpAN6pR3TrX2Ro1QFbkWVQwnIazcsp3vgj6moG0 o2VBzG23KGgJPT/mXo/66txZrIM9ddnAtzUQp2QdQdpLwJ+bQ== X-Received: by 2002:a17:90b:258f:b0:3a6:f1d2:57f3 with SMTP id 98e67ed59e1d1-3ab3a8d974emr8604029a91.58.1791839421859; Mon, 12 Oct 2026 14:10:21 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:18 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 2/43] civetweb: ignore CVE-2026-5789 Date: Tue, 13 Oct 2026 10:09:26 +1300 Message-ID: <20261012211009.3352822-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:23 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130772 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-5789 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit db080436aa68c50b0500aadd33a366916b12c782) Signed-off-by: Ankur Tyagi --- meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb b/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb index d9ca7ccd53b..df64d4cd355 100644 --- a/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb +++ b/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb @@ -13,6 +13,7 @@ SRC_URI = "git://github.com/civetweb/civetweb.git;branch=master;protocol=https \ CVE_STATUS[CVE-2025-55763] = "fixed-version: The vulnerability is fixed in the used revision" CVE_STATUS[CVE-2025-9648] = "fixed-version: The vulnerability is fixed in the used revision" +CVE_STATUS[CVE-2026-5789] = "not-applicable-platform: Issue only applies on Windows" # civetweb supports building with make or cmake (although cmake lacks few features) inherit cmake From patchwork Mon Oct 12 21:09:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100493 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5BF8FCA9ED0 for ; Mon, 12 Oct 2026 21:10:33 +0000 (UTC) Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5086.1791839425131495876 for ; Mon, 12 Oct 2026 14:10:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=dpvVDShA; spf=pass (domain: gmail.com, ip: 209.85.216.50, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-39647aa9d52so1332573a91.0 for ; Mon, 12 Oct 2026 14:10:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839424; x=1792444224; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=g4h5NSqmncAof+0pUgPXZEK5PPc25rRE+KsDPDf+OJ4=; b=dpvVDShAaUKS3G/OOoREDqWeVr1neLuUz2SNGGegkXASQupj1R3xFNwhjmiMksuyAQ 2IyOEaSIq+V7RjPpU12pnr4QJqOeLVDBeS2anlKh+PmKz4jt1Ke2xBH6lEOnB0kxWK0P lDnfhe92omKY1v10HCg/ZlLdau6rSkOVllNIiPb59V40wrqFiyEarURLRNh9r1rICLOM ZrFmJDpB6Hd0KETEmXT0jSzlSDCtaIrfSlxJn0Pw39Tldt65iOf6iqYLb9/liaKVFXlf FyiqKtbP4CWAfHaSzZhYfn2XHNtvpMrm/2iFKEmIXdnk0zQWXd65TuQpZ0z8+hJDpIog 9rsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839424; x=1792444224; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=g4h5NSqmncAof+0pUgPXZEK5PPc25rRE+KsDPDf+OJ4=; b=E28JtBtM0tW2vLpgc59be+hKdzczWg5hPiBErC7SB0f496738MiwzFp8r6nOLNR+Hm nkog73/JlXZtOQT+JurfLqgO94aucy++KjGfNotu2xLiZyoa+Bq5L+2i5Jf12GtoD8Q2 R3THJXqWwtD7YDkBkm6nSeUAgbm04AVIXB8OuTYD1/3CwK4GL/2Z4BxmEy3O6LPJbxu9 zjKPNLVAmWyjRjCwdWtQUlePCeEOo8IcnTEaAJI/YIRlt6Bq0iY+5oO7dLD1AvRWTLmU INPHIXO7Te2HccmF65Zon0x918amrF3ky2q0i+5Qch1NaqXj2EtVXYZ1jSw2Gciy2JhK 3p4g== X-Gm-Message-State: AFq9FYK06IQzBpCuDWgNsYqSES/N+IpSutjoO1f9O3zBxpsXfZRhuofx 0rycttPPsySXwhukMSiQ/hlnCiLFQV8mVggqkmdG+xhWMHy2wvQeVX16JZp8eyx8 X-Gm-Gg: AYBFou3UlzeCQWgNaalyowth1r+pkCHuH2yOFKN0WmI0slDcAg3aUnBV7HBA3IM04mT XHtjrutIz8ahiUT+mEwFzgsl2JkLHADWqNYkp77+4gv9yMObZGv1nXCuatOHBQ1bWuaAWK8NRSR eAqjsqj87c5mhi2HNiRHqanOvFVPzZumb4F9aodUXIWa8ypFHRQ81gtCudhd8EiZ+CP7/Md3y6t SOJi28yDdGO/8G9e2mzAYwYfWfJ4WD//1jYppt+igGBY6yRQm+pIh/lmvaeKAQoE8tE/DCpCpMU sbU5JMQdj7wFfJMErs1jO0R6VsGII40Svgl9Rcqglp32zHHMoHp6puK+rb5zOxsypEhpEemMrc2 7TO5z7hu9trLliGBO4qp7PQW2dmw47uPyQnxBpcX3Hy2Jr74nWUSSr/+P+vofZRZ1cBu2r0Kq+Y ngjzVRZfv+xFUS8rA214sydnT3ktTVE49iYMp0t6qnz5jWxg8SjC+MvI+QCkUZI/E3krveyvTG4 dQNHYL0jepkn7DTREt8zUnhVzncFk+7RhmMrzQ= X-Received: by 2002:a17:90b:4e8b:b0:3ab:be66:ddd3 with SMTP id 98e67ed59e1d1-3abbe66dfa9mr3302641a91.32.1791839424476; Mon, 12 Oct 2026 14:10:24 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:24 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 3/43] dovecot: ignore already fixed CVEs Date: Tue, 13 Oct 2026 10:09:27 +1300 Message-ID: <20261012211009.3352822-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130773 From: Ankur Tyagi Upstream has confirmed that these vulnerabilities are fixed, and Debian has also identified the relevant commits: CVE-2025-59028: https://security-tracker.debian.org/tracker/CVE-2025-59028 CVE-2025-59032: https://security-tracker.debian.org/tracker/CVE-2025-59032 CVE-2026-27859: https://security-tracker.debian.org/tracker/CVE-2026-27859 CVE-2026-27851: https://security-tracker.debian.org/tracker/CVE-2026-27851 CVE-2026-33603: https://security-tracker.debian.org/tracker/CVE-2026-33603 CVE-2026-40016: https://security-tracker.debian.org/tracker/CVE-2026-40016 CVE-2026-40020: https://security-tracker.debian.org/tracker/CVE-2026-40020 CVE-2026-42006: https://security-tracker.debian.org/tracker/CVE-2026-42006 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 86a9ad852a7180edf8b03fca7d0a69e9f1d9e550) Signed-off-by: Ankur Tyagi --- meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb b/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb index 993453eaa30..06e6ee39fa3 100644 --- a/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb +++ b/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb @@ -89,3 +89,11 @@ CVE_STATUS[CVE-2026-0394] = "fixed-version: fixed since v2.4.1" CVE_STATUS[CVE-2026-24031] = "fixed-version: fixed since v2.4.3" CVE_STATUS[CVE-2026-27855] = "fixed-version: fixed since v2.4.3" CVE_STATUS[CVE-2026-27860] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2025-59028] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2025-59032] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2026-27859] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2026-27851] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-33603] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-40016] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-40020] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-42006] = "fixed-version: fixed in v2.4.4" From patchwork Mon Oct 12 21:09:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100494 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A735CC6B03 for ; Mon, 12 Oct 2026 21:10:34 +0000 (UTC) Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5055.1791839427621668878 for ; Mon, 12 Oct 2026 14:10:27 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Xw9UnaaN; spf=pass (domain: gmail.com, ip: 209.85.216.49, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-398a4dcf289so1072138a91.2 for ; Mon, 12 Oct 2026 14:10:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839427; x=1792444227; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=oB7tE+PbDjYkzFxeiwzFxCxaGcxBXKY4yXEBtK1GdQM=; b=Xw9UnaaN6MP1hGwF1RuITUhPWiW7m/h+Sa17ulwqaMJqPh/dQNpgcdO6vn27R/XEzT GXch4cwvEd5+mRK8MbKrVuHSJZBv+Nk1D1weigYa3/5V4ZRrLBRusyPpCydlakfsnPR2 FF+mLCDrCV/S7DxiuwHfTRufFCamSh6VvGn0rNBGYRDnLNQgP64ke2vG8ItuLrxurQ/5 r99sUnCNTpf/RIpEkGYKmhKE8vfD40x2XO11krrmzN5ZZ5zh1enHQTTJQfk84dgVrXrn 3U6qfp6t/42kKqvTNPbKfPF6/LNl8gztesdGY9MmfA4oAH3x0ZoQV7Rz4EI1/MvD1F47 CovQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839427; x=1792444227; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=oB7tE+PbDjYkzFxeiwzFxCxaGcxBXKY4yXEBtK1GdQM=; b=MvXFiEsIPgW+RDx8jRky0e6vjIkNBrSvQBC3XbDV6ZSOXBZ4+3IrWjTr9fF6zPphwI OQohsbvEWKB6d4Rn34nGIUecIJF56AiT0i/DeR/AM9zmGjZxAyqf07r1qa4CTAcjZjQT KlYy7hi39crerjzahMOLefsyMmxuKiX+vYTZqYm7mY+s6TMnIXFHx0MnJWYqUUXoG8KB BRx3FO28dpw6rdZ4DTFnfjShVvg0outc3k/bjCaTU9frnrPhphmU+wgig5baApLKZR1y X7ItmR2rUlhLCoVni1DAag9KL8sKO1dZaLsZLZPxl8wzx0iDXp6KIbkmgtu5x9/K6T75 4e2w== X-Gm-Message-State: AFq9FYK8JDFUODR3VyOsLUS4+UpuECnXveR1x9T3pQ3vThXaBZZ8G+su mzUkVZH5tOTXSZIhqbvnym0TAbCsmqoixqaP7xwbCjeG4TS4URmb/2Hbrqnld6xP X-Gm-Gg: AYBFou2REzwMRhAv8WlI7izSHiIpJGdAlO8GtagNZBrJFmkuL60EWkaw++z2v+oFIQH CyFSYVeX22EBHr5mEOkvoWNDRa3Z5WI/d2PpKKeWCMqa3nf0TvqOktdqbrYB1rV5bng2ujLC3Sa y7m4vgif20jIPrm/nG5qzQ12rR3XJEP5U7VQ8yN/+eDF6asW2I0ESYGhfuOmXLjifDdKq3/r0IJ 7HahyBRkiBltsoGunj5lPV4ACtL1iU+7IqsgUUhmKdwZoFpWiILMoO0KE2ZPDLrEdy3Jeg3LvRS fEjjGVvLarIJY+n18OVpCWrtvIOUqxo9NWH7ImSXCaaUxRbZeneb6//iv/8YJgVw6bmFDHfrQGm nCO2PV2eOtUWs6ngKshBEfr6C0hckX5IFkzUXWUNlRK/kBAZth+mlQEYzBwqxtCbDfZcwNnSngg LQC2CM8dZQy7JtTDhimeHP7RLPk/bcFruedWrXRJY3y3Nor8D6hKdfYHelStIw0GoEa/u/1BEtk Vbq72Zs1vTNg3MJHskq340GM/O5IU9vd7L1c/Y= X-Received: by 2002:a17:90a:d44d:b0:3a2:bb45:d37b with SMTP id 98e67ed59e1d1-3ab3aafb452mr8678178a91.25.1791839426994; Mon, 12 Oct 2026 14:10:26 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:26 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 4/43] eject: ignore CVE-2026-28065 Date: Tue, 13 Oct 2026 10:09:28 +1300 Message-ID: <20261012211009.3352822-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130774 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-28065 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit e6d111c16938dab4a377826147bfc86b72bca8a1) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/eject/eject_2.1.5.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/eject/eject_2.1.5.bb b/meta-oe/recipes-support/eject/eject_2.1.5.bb index aa0e86db12d..90630ff791b 100644 --- a/meta-oe/recipes-support/eject/eject_2.1.5.bb +++ b/meta-oe/recipes-support/eject/eject_2.1.5.bb @@ -34,3 +34,5 @@ ALTERNATIVE_PRIORITY[eject] = "100" ALTERNATIVE:${PN}-doc = "eject.1" ALTERNATIVE_LINK_NAME[eject.1] = "${mandir}/man1/eject.1" + +CVE_STATUS[CVE-2026-28065] = "cpe-incorrect: this CVE is for WordPress plugin or theme" From patchwork Mon Oct 12 21:09:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100495 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C205CA9ED2 for ; Mon, 12 Oct 2026 21:10:33 +0000 (UTC) Received: from mail-pg1-f182.google.com (mail-pg1-f182.google.com [209.85.215.182]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5057.1791839430254657966 for ; Mon, 12 Oct 2026 14:10:30 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=EsHvD7JU; spf=pass (domain: gmail.com, ip: 209.85.215.182, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f182.google.com with SMTP id 41be03b00d2f7-cd60c5da24cso553344a12.0 for ; Mon, 12 Oct 2026 14:10:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839430; x=1792444230; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=t4H22qeiDu7Wi0/N+SsuWRdiTVMK30xTEL53fVAubwM=; b=EsHvD7JU+Xdp7/lt9W1ySK9ufSCpXEhe8TEtGoCppiD2MWY0CgM3OI8KnlXeoMi4w7 S4kvmKg1kHJb6PVEcOALRQdil2lh4MnOHMuuQ4xEUoBGyAFtTwD2dnpigf5jcY3f5JOr NmMF4NeV+/YH80P39cQIgdzYZ2uwZaI146iYadMv3Ol0GHzcs1tMFXlFxTrQGAGUA/cs rjNwWBXFyeUHJKI6LF354GYYK52Vq2qGsrpMc8P2RcR7OABe5fLgfmxT1K3VPOrvslNx yNsd+LwDUnXqcNzSJasgt0K6kQ9zxoWEoxbe6YEkW2EiKnFiZ/0ofrfsReY2wJ4v8Ucw BvMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839430; x=1792444230; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=t4H22qeiDu7Wi0/N+SsuWRdiTVMK30xTEL53fVAubwM=; b=tE6u13nRi8Bm3RVXwjJhtDg6YrphWzNfCCvNYxOpIRt+pKQG4Sl87GMb5IX042Wb+o ZJ+NPMJ6KxsLL+f3f5hByamSwlon8D3yhnTIwB+bQ2MWpwoNaS/uTvR/inVd7T4QbLWB OF+mZmGjfpIDu9vsQwlYoZ+Y2sY0ImFfzSnFtau/oFITrEa1AvyMcGc19NPFjX7co6p6 AGUCvuOBUhJ4k3cPt8pKEqKaoN0oAQo/Q/L5VsKfX0wuJlO9epWo4rDLH/8/L0vGXS+b Czs/rgzj+yDFuBvFBsWdior2sd0rneI/HAFE0G3SaJLjPSFnIG/WN/Rvu5DFyW3XDS46 mI3Q== X-Gm-Message-State: AFq9FYLS4tOuyfpciMVukYPcCgozmcVsGgPRRa3jLn7hzANNWIFQKR5O L2wEppYCWtlY7NrqlAA9UKXdes8DQOOJaoui7yW3IV29VlByx6kfpTwcZlQ67v62 X-Gm-Gg: AYBFou1n0pGiPQjl5sF1F3F5jRKyCTPWAb/96AwGc5w7+5Pw6MgZraxUQyRA2dwylGr XHBxfYKKbFExIkNqGBwT9QgOBPp5KDlzZgMz7XZWdavycjFf/NSZGUBGm+MzcM3y/a29BBb4v6s PupQ+ggdOaLQDIqwMZjHoWjRP6T5UohFuAw6lilYfgeewfq6ioeP3rC7wT/xV1Zi49gnD3JTM3U 4ojbyEQDdMeGykANn8Jg4FmbFNFHVgtCWtDFPS5l1QQf2jZVGE8uFDDyEGGl/x/0yFa5Hsbjfjb oGE4A82ySQRrXyOmRzyY4p2+I9pRJp6zDSzxdvhlcpgyTxZvVxOAsG6BGOi7r1oUlMwX8ktVdLb memEzbu+o6oCyz/FF4jlPKkmVwl+wwqD4KZ1KIbm5waGzoswSjJKFPuTik4WkxTDwGfiTt5rQak xKMnvDqVS1NaaRROYpymABmF6LtFgBYeCkOR44c+kF6PAZczkUDW6p591gJhHrnL1keoFfHGRar joIW7CkOzlFjv8hPKmU/eNrulUBoKv4OIhjxBU= X-Received: by 2002:a17:90b:4a45:b0:3a0:50bf:d497 with SMTP id 98e67ed59e1d1-3ab3a2ffb61mr8703423a91.3.1791839429512; Mon, 12 Oct 2026 14:10:29 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:29 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 5/43] gpsd: patch CVE-2026-58459 Date: Tue, 13 Oct 2026 10:09:29 +1300 Message-ID: <20261012211009.3352822-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130775 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-58459 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 57e1f7d3d255e7b2eb55e9bca152f189ad8cdd09) Signed-off-by: Ankur Tyagi --- .../gpsd/gpsd/CVE-2026-58459-1.patch | 48 +++++++++++++++ .../gpsd/gpsd/CVE-2026-58459-2.patch | 46 +++++++++++++++ .../gpsd/gpsd/CVE-2026-58459-3.patch | 58 +++++++++++++++++++ .../recipes-navigation/gpsd/gpsd_3.27.5.bb | 3 + 4 files changed, 155 insertions(+) create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch new file mode 100644 index 00000000000..aec3acdeb26 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch @@ -0,0 +1,48 @@ +From 485b793ee3a54865ff9d8efffd2fe9a309666be0 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Wed, 1 Jul 2026 17:55:57 -0700 +Subject: [PATCH 1/1] clients/gpsprof.py.in: Quote double quotes in title. + +Someone could use the double quote to break out of the +string and add gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 5581ba196d826a984fbfaf792b7d58535f9911ce) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/5581ba196d826a984fbfaf792b7d58535f9911ce] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 5c18f50ff..261e72665 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,6 +198,10 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + ++ # escape ", and \n, for gnuplot, to not break strings ++ desc = desc.replace('"', '\\042') ++ desc = desc.replace('\n', '') ++ + return desc + + def collect(self, verb, log_fp=None): +@@ -1262,10 +1266,10 @@ if __name__ == '__main__': + # Ship the plot to standard output + if not options.title: + options.title = plot.whatami() +- # escape " for gnuplot +- options.title = options.title.replace('"', '\\"') + if options.subtitle: + options.title += '\\n' + options.subtitle ++ # escape " for gnuplot, to not break strings ++ options.title = options.title.replace('"', '\\042') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch new file mode 100644 index 00000000000..dd50d276950 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch @@ -0,0 +1,46 @@ +From 6031dc96603d5537a650068a2f8d42ef90d9d32d Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Tue, 7 Jul 2026 13:41:54 -0700 +Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title. + +Someone could use the back tick to break out of the string and add +gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 1a6bb7bcbdf58aa940132e630870af061dc88537) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/1a6bb7bcbdf58aa940132e630870af061dc88537] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 261e72665..202214769 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,8 +198,9 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + +- # escape ", and \n, for gnuplot, to not break strings ++ # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') ++ desc = desc.replace('`', '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1268,8 +1269,9 @@ if __name__ == '__main__': + options.title = plot.whatami() + if options.subtitle: + options.title += '\\n' + options.subtitle +- # escape " for gnuplot, to not break strings ++ # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') ++ options.title = options.title.replace('"', '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch new file mode 100644 index 00000000000..a40edfe6d13 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch @@ -0,0 +1,58 @@ +From 54484dccf7265e51368eef03d99ea7a370c15e06 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Tue, 7 Jul 2026 14:23:56 -0700 +Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title. + +Second try. Also quote "terminal". + +Someone could use the back tick to break out of the string and add +gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 4c06658e988f4ced1a7a574ce082a22ef625df56) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/4c06658e988f4ced1a7a574ce082a22ef625df56] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 202214769..e91367ee3 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -200,7 +200,7 @@ class plotter(object): + + # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') +- desc = desc.replace('`', '\\140') ++ desc = desc.replace("\x60", '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1271,13 +1271,19 @@ if __name__ == '__main__': + options.title += '\\n' + options.subtitle + # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') +- options.title = options.title.replace('"', '\\140') ++ options.title = options.title.replace("\x60", '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: + term_opts = 'truecolor' +- sys.stdout.write("set terminal %s size 800,950 %s\n" +- "set termoption enhanced\n" ++ ++ # escape ", `, and \n, for gnuplot, to not break strings ++ options.terminal = options.terminal.replace('"', '\\042') ++ options.terminal = options.terminal.replace("\x60", '\\140') ++ options.terminal = options.terminal.replace('\n', '') ++ ++ sys.stdout.write('set terminal "%s" size 800,950 %s\n' ++ 'set termoption enhanced\n' + % (options.terminal, term_opts)) + # double quotes on title so \n is parsed by gnuplot + sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title) diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb index fa3df89b272..52d86503a18 100644 --- a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb +++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb @@ -8,6 +8,9 @@ BUGTRACKER = "https://gitlab.com/gpsd/gpsd/-/issues" HOMEPAGE = "https://gpsd.io/" SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \ + file://CVE-2026-58459-1.patch \ + file://CVE-2026-58459-2.patch \ + file://CVE-2026-58459-3.patch \ file://gpsd.init \ " SRC_URI[sha256sum] = "409873f5048462ef1ac413a51ab35caa8b50b31be62b3347bee1cc2994e7c649" From patchwork Mon Oct 12 21:09:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100492 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D48ECA9EDC for ; Mon, 12 Oct 2026 21:10:33 +0000 (UTC) Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5058.1791839432390328036 for ; Mon, 12 Oct 2026 14:10:32 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=n2uijwG9; spf=pass (domain: gmail.com, ip: 209.85.215.181, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f181.google.com with SMTP id 41be03b00d2f7-cd3310348d2so1880480a12.1 for ; Mon, 12 Oct 2026 14:10:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839432; x=1792444232; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=CQ/To9wsn2t3Pxs/kp8y7LosA82+dyROBT2jtGHTIO8=; b=n2uijwG92YfeooQ85HrW51NA0nUK4PK7KWWu07trL3Y+AfCdmn0SQ62BxNAK/F8i5t tUkSxK8D7m97/HwaqPPDOimrzfyCwWoS+eJQbIQBjCaY4LzXw5aCJk8d+t1wz5/9r3RX bPJY9WRVA24jJsgn5zrv0HdK/HEUQrf0Jo5GmuHO4CmqRZNx+2dUytrLyyehUlzO9eza pTfQT3O5aaBZRVhWEFa58I1axNLtI8atOaf36kG7n22hakYEFjoJfnSlIzKjhZzFxZzM VM8flog1hVu6n5hcBnIOl1HuN98l4bIHK8mlzH5Ji+9CJZPyXVs2sWGsXD8uKwm/wDA2 8O2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839432; x=1792444232; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=CQ/To9wsn2t3Pxs/kp8y7LosA82+dyROBT2jtGHTIO8=; b=yqOJVMCJGtbfopKnUKuyNLcWFfsxFF313bJsztBBaOSOdEz9PTcAg6VdkHxnWjPJlu aMRzSP9FVDmZnuj9y74rDS5M03kAchAj5ss2FI/ETFG4NzTx29fWZ1r6H4F5GBdgiE3d H4u4OMJR2DlHA7I0F56gXrx93lBlsZD6UyWcV32JLcdOprZjGJd1O7HnMWlGwze3KlHZ ir5Yjz/cbv476UGUkLvdFHWfwvLXbDpGtv03wPbVbEQHrbt2/DP35q4/qfdxF2uZbwbS wKlDapL4vOclCHmQx1AvoN3gShvcvnbEuRjmpwsg8WMUqpmMvXc2zMMJfCO5OJFZPUTK Q6Lw== X-Gm-Message-State: AFq9FYJ567c15qfvUAORmlCMMR/C3UJK7ap7d6kZfBDXlwAd5tExn0r9 fs1bMJ3rxDM5g3yRbr5vi00UYBcxnCASF2eRopuvXNODe0/lGvbkH0EsXArJBiFs X-Gm-Gg: AYBFou1CaPufL3y/xQR2h7rY19L214wub2qI7vxV9SWR+lHcEgalHB2/7O/2f5zcuc5 6nijmsaw8IO0I9C9StPp7w19F5KAk4XeHbDPRnwN4Vpxft/IzWBI1QUkHWRKrRYIL/uoduS0HEM g+tiL25DkVFmB6D1k2QZ0fIM0/NqzcLg5FJ1bXSxEKdRXDmIANIpF1ecElQsVJcy78cw6nfGWF5 aZfdj7dHvfrAIj7YyK7KT/fOJxncoi1BwnUiyG0DXnle75u7DXnY6d6/JKWCgVp37wLhkjjHA2o Enked6QupSQczPgjMNaumBqX/dZ5asZdwdsrXxUOwxFZvCfabWn7cNzl5H1s+5y4jKNjJbOVaF8 bjoP/X/Ou7CE+Tuo33jpjPoZTQYYi8EJQFwOmGqTmzKc6CjLTYXuTD3/WcNoGlMjeu132GgTY/G 9jmvkcpfRPl9+ibRJPiM69YpNGIckpzzdkkzN+IHsqTSwaeDnxmz0PRch6eYdwlMljgP2zos8RT WUlAwYRnS4g+1GtUaK+n4lDnIumEimz6yCltQI= X-Received: by 2002:a17:90b:43:b0:3ab:330d:6e47 with SMTP id 98e67ed59e1d1-3ab3a9528fbmr6123317a91.10.1791839431729; Mon, 12 Oct 2026 14:10:31 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:31 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 6/43] bcc: correct CVE_PRODUCT mapping Date: Tue, 13 Oct 2026 10:09:30 +1300 Message-ID: <20261012211009.3352822-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130776 From: Ankur Tyagi Use "iovisor:bpf_compiler_collection", the exact NVD identity for the https://github.com/iovisor/bcc source. Signed-off-by: Ankur Tyagi --- .../meta-python/recipes-devtools/bcc/bcc_0.37.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb index 8caeef90bfb..eec8ef4a32d 100644 --- a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb +++ b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb @@ -91,3 +91,5 @@ FILES:${PN}-doc += "${datadir}/${PN}/man" OEQA_BUILDPATHS_SKIP = "/home/ubuntu" COMPATIBLE_HOST = "(x86_64.*|aarch64.*|powerpc64.*|riscv64.*)-linux" + +CVE_PRODUCT = "iovisor:bpf_compiler_collection" From patchwork Mon Oct 12 21:09:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100496 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 356D5CA9EDC for ; Mon, 12 Oct 2026 21:10:44 +0000 (UTC) Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5088.1791839435232568215 for ; Mon, 12 Oct 2026 14:10:35 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=rCVxGkN/; spf=pass (domain: gmail.com, ip: 209.85.216.42, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-3ab9268d90eso943124a91.3 for ; Mon, 12 Oct 2026 14:10:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839434; x=1792444234; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=KhP7I524Ik2T7MERZuAYHCRsypN597paxCkLUXVEfc8=; b=rCVxGkN/3kGPHUW3fpYsGJUzl4UM1nsp/cEt8zApmqqCJJ1nZkXvOL44PApdiG986R Yv4aQR2o3FQGxtXlAmpKAXvzK2jcI3OIUQ0Mt+G7c9KGQK+RAGT/hbIIwsrl6cZB4VN0 3BgV5xQdHvRpoN/IXShXJz88tLtaOyL7mR3oZ4xmF6ndNtz4tP9uRxrhG3me32RGgxEO 57rrcVYR11gI5YjpOqXZ7mL/v+hpOKOozem0LpJhhy44+5Cd5r5Gixm76YaeuljNeifM JO2QdkBET/tWrCJX/lnReY3IO8ZRqM6dxw1jc/I3g79G1yXCY5mfoln6aHfNNTiFU/8U NSgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839434; x=1792444234; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KhP7I524Ik2T7MERZuAYHCRsypN597paxCkLUXVEfc8=; b=GhhiCIdNhWz6PxsQ6dvx+Ym/ok9891tx1MtAtYdcMSb5P95KhduYikqQp7qmBf9R8y Otnxzr+YxsW9ds35DmaqCPDmZ8h+Mi5hvwjkcXiv6fgG/KltW5FLXhjXJQWPyG85nnVp PcnoBca7BAJ0T4Y7pYdYzzIOs66F60k2sCXQ+Ajd6GTiUQlZngfaODJTlnqiQQNrEODT +MrajZoA1tkQsgcz23/12WJxFcaqGFW/3GC6J8Xwa2J89gRuUqctDTQqsUzV/3Cyt79z MI1m0DfUkb6Pve6Zk0tqlqmg3JyhxiGzifDZUfG5zGOCaD20FMOgEQia/CzLdPOV87G1 idPA== X-Gm-Message-State: AFq9FYJ3EmBJwU3vKBny32zfev47pw1rtaMZUwbrYoWg2yziubTyxLt/ ruZlQybtg0+dyoCxIT8UtShZw2pLwOg+e1byn0xfUeukhZn7Z1HkLjZA8UpeUPrJ X-Gm-Gg: AYBFou0GBh/pkWeoEqdiGZJ5WRLOkrkAJlYDmWUIhBZWjKyhQCFPBtaeLlW6bZnGjSi 0Tc+mEEug8qVgyL7lxYLZ8jYPbyWOVi1EkXoJ5QLqYOy1bo0bdZO2PKRu7FIuOfBWKWRCdlyMgu kQHIWtvYkS4X0RqrLzlTHZysIZUk5acUlGXpZiHplduevcN1h8Jf3d0gz+OSa88qENi38L+s2Jt HiEyInTTNcH7vG7vDUhBq5HZLT6pdk1XzYR9v6Tjr/gN2kkD+Vdz7fO2DFEkuRTKpWF8ChbF/vG juLWUgcqOkHjYoRU/8gb6bODkNzwMmifkeDPcLvH9weFwapYS8KP9mKEcKNlUclnl+UxKlAJajw /bk/lwoVoLRT0UoTds5SJ00IzDWwlFs6KnbIlWbDQF+ANALYp5Apt2WMS2EAplm0bflvaV8IBG/ R+ol2uy5Y+m4WguXUmnbJY2FPJBKVzEAyVK6+C8XoJOjMLbo+CoXl4t9SPTvzTowsKPmfJTLwUu q0Eh2HDQbA8xOe0hkUDNmbmXmlbym/H7S5Hmz0= X-Received: by 2002:a17:90b:2ccb:b0:3ab:1af3:a0d with SMTP id 98e67ed59e1d1-3ab3ac63ba3mr7956095a91.33.1791839434446; Mon, 12 Oct 2026 14:10:34 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:33 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 7/43] dool: patch CVE-2026-56651 Date: Tue, 13 Oct 2026 10:09:31 +1300 Message-ID: <20261012211009.3352822-7-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130777 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-56651 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 2e1445decda0c68cc6889777c6f648cdaaef082c) Signed-off-by: Ankur Tyagi --- .../dool/dool/CVE-2026-56651.patch | 47 +++++++++++++++++++ meta-oe/recipes-support/dool/dool_1.3.8.bb | 4 +- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch diff --git a/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch b/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch new file mode 100644 index 00000000000..e367884ca90 --- /dev/null +++ b/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch @@ -0,0 +1,47 @@ +From f5eb4fbf3977d919a2e9da8b73985a29d2878e56 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Majchrowicz?= +Date: Thu, 18 Jun 2026 10:52:27 +0200 +Subject: [PATCH] Neutralize formula-prefixed CSV output +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Michał Majchrowicz +(cherry picked from commit d5aa93b3d1939a83b2b10a7cd8af3c819930aea1) + +CVE: CVE-2026-56651 +Upstream-Status: Backport [https://github.com/scottchiefbaker/dool/commit/d5aa93b3d1939a83b2b10a7cd8af3c819930aea1] +Signed-off-by: Ankur Tyagi +--- + dool | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/dool b/dool +index 634ed9d..fc1015d 100755 +--- a/dool ++++ b/dool +@@ -3030,7 +3030,10 @@ def perform(update): + + # Prep the line for the CSV file + if op.output and step == op.delay: +- oline = oline + o.showcsv() + o.showcsvend(totlist, vislist) ++ csv_cell = o.showcsv() ++ if o.type == 's' and len(o.vars) == 1: ++ csv_cell = csv_quote_string_cell(csv_cell) ++ oline = oline + csv_cell + o.showcsvend(totlist, vislist) + + ### Put the output in the csv file + if op.output and step == op.delay: +@@ -3170,6 +3173,12 @@ def file_slurp(filename, size = -1): + + return ret + ++def csv_quote_string_cell(text): ++ "Quote free-form CSV string cells and neutralize spreadsheet formulas" ++ if text and text[0] in ('=', '+', '-', '@'): ++ text = "'" + text ++ return '"' + text.replace('"', '""') + '"' ++ + # Make human readable device names that are shorter + # + # Example mappings: diff --git a/meta-oe/recipes-support/dool/dool_1.3.8.bb b/meta-oe/recipes-support/dool/dool_1.3.8.bb index 8a057effdf3..5118eadad69 100644 --- a/meta-oe/recipes-support/dool/dool_1.3.8.bb +++ b/meta-oe/recipes-support/dool/dool_1.3.8.bb @@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=1ebbd3e34237af26da5dc08a4e440464" DEPENDS += "asciidoc-native xmlto-native" RDEPENDS:${PN} += "python3-core python3-misc python3-resource python3-shell python3-unixadmin" -SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV}" +SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV} \ + file://CVE-2026-56651.patch \ +" SRCREV = "b74503e2dfbca8ef01c284d40aa77dc82be308b9" From patchwork Mon Oct 12 21:09:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100499 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25699CA9ED0 for ; Mon, 12 Oct 2026 21:10:45 +0000 (UTC) Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5090.1791839437730951090 for ; Mon, 12 Oct 2026 14:10:37 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=GRLop0kF; spf=pass (domain: gmail.com, ip: 209.85.216.42, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-3ac397836fbso162319a91.1 for ; Mon, 12 Oct 2026 14:10:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839437; x=1792444237; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=IHZMYifF5YIf54LpMRTrtfIxEQZb5vTJwqmhYAklHYo=; b=GRLop0kFLMGBfSsf/Co9kAZk5koShJL+niw1ytyZ5sseopn5hSnIug0w0TiWJBQcVH TTVLSMt/LMz/HK/mMBGkdUQ+UlEbUvxacDu1mNJmF6fvK0MV2s7aAdMkOHke0LaXvshs FuH15QNz3kwdunVVa0dtNtX3EY0tcORAzzUAqGKxfuMp3BfmJUYjwdQ0mKOe9MmZhkOj aS3EUgcrZo9XwoimxObekrWonEyPd3kHtaQVo5K5xnlddvGY4RMdkmjR9UiaW9VNs7Iv Zcam6twAEdVntRroP3crnNIWefj5Vx2i6CQF5fWS9NS1r2sOHGnvhYeCX8YTpX3mm61h Q7AA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839437; x=1792444237; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=IHZMYifF5YIf54LpMRTrtfIxEQZb5vTJwqmhYAklHYo=; b=JjUbhxbbtvMZHtlCWlQ4jYSdsz78TkILLWKzymjgaTltS/3BqsRt9/3YYOY/88JHQ7 v7sdvUlKXrjjVWpsEnJUp3xjLbKHAEa0Ilfsv3tC8xau6wL2k8GfBcLX+r6CflpvJtsX uZjkNt93x9ng28os4w8Qrbgin/J3Z3Bavj4Y/5Fz2P8+YqpKNd2LSh2udDGEyJsil7AV sjhK5jy4yiAchScP4DB5VFN0IVnP0xsxIu+XRUhNZ0ZgjQy9lUMbTURMr9ov/KI8fgU0 Vdz2gmk7TzOakeH+F3dd1Oxsmip3308p+ndMxMtFe01BmI5oKJeXLi+XLPga6tbSITHC XiGg== X-Gm-Message-State: AFq9FYKkb7YRHkEcUAv6deX0CnJyQW3nQq4FfwEwgU3HieV2k4TcogRN nf5JTCYssKjghNTQScuXWwwVeAiAC1gBqazZmdej2ELZs+OWcOWekRXfQS9EQ79p X-Gm-Gg: AYBFou1n890Zv67yO2C7BaTIE6nvuDNEcviawMb24sfV5uwJBKLvfFHbQ2vm8Jpc3AO Q1mbWt6IFAkjWUVySIyhzT9RhKJiWa27LtrmZmhnYADWzSpksTcInOe8nWHRxgyeztpK19MaMhI /hOx5nGuCEznYu0VeL7sH8JLyAm08JcNCoRmHsLXjAyBZvqfCznRJA1ktZchumgMHLiWNv5gV5t xx0SF+bBwwmvsEmtDyF84tK/QAOWr1PtT3RQmTIJQTQdGldZDDJANxKOIxGHD0jJ647lR4mrG4j ACJaNzZorjwomNLfgtpIiP4rbAdup3pnuG2Y6+UuGStT54dyORCN3xuy50W0egFfvZrYJaBIiEx +vipHZE3wUNOcF+l9vBruL7hUd8OUYlKbCvQZIGmqUB0oE2sIG7OV8+1lTM5QhNxo4Um9NRO1qw ptobxRk3PUMmKR/KBceZ023EZQBqf4MQAIb8HQNPYqGmkVa4YRruQ5srP7nnSrV0AddOYYUmt/x iFU7oJidnVVLOS2jJnXbIbRRmseaalFPEIDf04= X-Received: by 2002:a17:90b:5346:b0:3ab:17b6:9a91 with SMTP id 98e67ed59e1d1-3ab3a747313mr8642095a91.32.1791839437089; Mon, 12 Oct 2026 14:10:37 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:36 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 8/43] dool: patch CVE-2026-56652 Date: Tue, 13 Oct 2026 10:09:32 +1300 Message-ID: <20261012211009.3352822-8-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130778 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-56652 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 53bbf2771b13ae1d2c856975ea8f8712b329cb30) Signed-off-by: Ankur Tyagi --- .../dool/dool/CVE-2026-56652.patch | 35 +++++++++++++++++++ meta-oe/recipes-support/dool/dool_1.3.8.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch diff --git a/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch b/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch new file mode 100644 index 00000000000..c6806ae0c56 --- /dev/null +++ b/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch @@ -0,0 +1,35 @@ +From d20ba041a0f4968fdbc2745827f9af676339924f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Majchrowicz?= +Date: Thu, 18 Jun 2026 19:20:30 +0200 +Subject: [PATCH] Refuse symlinked devel log files +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Michał Majchrowicz +(cherry picked from commit 259fe40c7fa519020ef7a3f8ef8d61586b72ecc3) + +CVE: CVE-2026-56652 +Upstream-Status: Backport [https://github.com/scottchiefbaker/dool/commit/259fe40c7fa519020ef7a3f8ef8d61586b72ecc3] +Signed-off-by: Ankur Tyagi +--- + dool | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/dool b/dool +index fc1015d..2df407d 100755 +--- a/dool ++++ b/dool +@@ -2132,7 +2132,11 @@ def devel_log(msg): + if not DEBUG_FH: + log_file = "/tmp/dool-devel.log" + print("Writing devel log: '%s'" % log_file) +- DEBUG_FH = open(log_file, "w", 1) ++ flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC ++ if hasattr(os, 'O_NOFOLLOW'): ++ flags |= os.O_NOFOLLOW ++ fd = os.open(log_file, flags, 0o600) ++ DEBUG_FH = os.fdopen(fd, "w", 1) + + # Print out the header line for the devel log + DEBUG_FH.write("|Time |Since Prev |Description|\n"); diff --git a/meta-oe/recipes-support/dool/dool_1.3.8.bb b/meta-oe/recipes-support/dool/dool_1.3.8.bb index 5118eadad69..06484c54752 100644 --- a/meta-oe/recipes-support/dool/dool_1.3.8.bb +++ b/meta-oe/recipes-support/dool/dool_1.3.8.bb @@ -11,6 +11,7 @@ RDEPENDS:${PN} += "python3-core python3-misc python3-resource python3-shell pyth SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV} \ file://CVE-2026-56651.patch \ + file://CVE-2026-56652.patch \ " SRCREV = "b74503e2dfbca8ef01c284d40aa77dc82be308b9" From patchwork Mon Oct 12 21:09:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100498 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43333CC6B03 for ; Mon, 12 Oct 2026 21:10:44 +0000 (UTC) Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5060.1791839440112578495 for ; Mon, 12 Oct 2026 14:10:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Q4r0jEww; spf=pass (domain: gmail.com, ip: 209.85.216.53, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-38ec1402b05so942016a91.2 for ; Mon, 12 Oct 2026 14:10:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839439; x=1792444239; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8+1OKLLfY0HM+hYdXDzeeA60NjAWoNrRG1H/m8ZLgSM=; b=Q4r0jEwwOBKO5+lc9JiedGidGSu+AeZlCdp+oncFBEkHbBvkrgtot9ldH5IxPJ7vQi HileGERI5fVBqFr71DJ/zGBk1hXOC+Q4NV/sic9h5Ovdz56rVHmimttyGWetOcO0+/Wv ObBPRepCEszbso9guTTgPSFk0r5jLkm4p5MEvA/O/Zhkf1DuXz+DMnSbscItAeUL3W+Y RLVu+tQaoV9eTdet8uQvuNizCo/WfZcETp/LWMsaYqYmr7H2I/AXVzxHf6TMG26PRatU /dH1HyFletQGiro2bbyGMnr9wDfvCVJyd+SrBP4lhT5Wn0bQZ7NYXgYdqNLH9JxybI4Q g6hQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839439; x=1792444239; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=8+1OKLLfY0HM+hYdXDzeeA60NjAWoNrRG1H/m8ZLgSM=; b=W3CHynLGUIqXWJEqBIKdDGtpyx0Ry/qxurvPsrfVCNukJJCN9iHrzV2XyUvLPvR0EH iVMq2qchGlbQn9grlyU+swhVp+JImZjWxj23sHVWZdMJQ0xT4EQh/0hiG7oH4XRqMYWq Kndji04pZ6psO3pxtkwXxe0sDZfOK85W3fr5If0dL3roqm8rdguvFydlEu0+4quZOU72 RdanykyjxMT1bu2qvxAA/dnfOgofdgJ36UqOfswDC0kPm4hqxpRsbuP0cnCvAE1C1Gyz eB0h9nCwDFbLz/sOmrrfejpSNP+Y68l3PUJ4MxETM9j6vQ2N6d5OZ8qw1VlJtFCwdkec KuGg== X-Gm-Message-State: AFq9FYL3MgfXqphoxBO7DQbW257hujkjdPQ+LZHlUkKiRQOXF5ssMh8f CHwEqL7n+8CIap4QuaB+1cevp+8cCHVZlPw2Kd2hfZV0AfLiCPQlij9E8BD2YsTm X-Gm-Gg: AYBFou2N8xxLcSqnWCZU7oxRntnW/2axsQIFPantKVUTJFTQ5ZTETg5bcaoDXwzpgDQ TPPqBBokX1u5swhAK/3N2Zgz+OYSgjJbgyY3QAy0H99HZCCXVtGIt8MWyjc9rFHObSGVtgRAEyd Hb3bpCwCQgHrxdV2zfMaWKoTd3Asd8Q+gkZCWB4tViAoBI4tXK8YPHJ85cFxAKmIckI2xnahgso d4to29HMP2nMxfsB5if0ROOHuNd3bttw/UUv6SiQnmJV9v+4w3HryV5CIeNZjPVxW8F9MyRvVE3 t+OJGtAiYnGUeOxMm5C1ulW1e3aweirc5i3CmiVAVqPinJKe2wJ+w2AuyD34dtM1S9R5Tyvg1Pq ZbHozTMMJUvP1lqkc4XTVP2ePDVUBvbUarxarQJrn2w4H1oM/Jmyb8FtL8KJUy1BsSxP36rYcp/ z5L7mrZb5psBkw6FDAlX6EMxaJUhGRTmcVlL4Rj4rjHXsvxdt5PdERFA47KK39bDvDxlIGmdSkE t0ZycGBThRVXSF3QtyJz4vFj1huRL6guUlcZkBcJg== X-Received: by 2002:a17:90b:5343:b0:39e:4c81:6c5f with SMTP id 98e67ed59e1d1-3ab3a953758mr7956500a91.26.1791839439497; Mon, 12 Oct 2026 14:10:39 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:39 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 9/43] haveged: ignore CVE-2026-41054 Date: Tue, 13 Oct 2026 10:09:33 +1300 Message-ID: <20261012211009.3352822-9-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130779 From: Ankur Tyagi Debian[1] also confirms the fixed version. Details: https://nvd.nist.gov/vuln/detail/cve-2026-41054 [1] https://security-tracker.debian.org/tracker/CVE-2026-41054 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 086a780db02e001946bba0ecd337ee7834da1823) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-extended/haveged/haveged_1.9.26.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb b/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb index fbebb158eee..727f8563799 100644 --- a/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb +++ b/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb @@ -21,3 +21,5 @@ EXTRA_OECONF = "\ " MIPS_INSTRUCTION_SET = "mips" + +CVE_STATUS[CVE-2026-41054] = "fixed-version: fixed since v1.9.21" From patchwork Mon Oct 12 21:09:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100497 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3548ACA9ED2 for ; Mon, 12 Oct 2026 21:10:44 +0000 (UTC) Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5062.1791839442586023428 for ; Mon, 12 Oct 2026 14:10:42 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Gfp4zA4C; spf=pass (domain: gmail.com, ip: 209.85.216.45, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-3a7cfe8f761so2581564a91.1 for ; Mon, 12 Oct 2026 14:10:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839442; x=1792444242; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MR39kHT8Rwj5ttSiVFLB95sc/8LyJ4pAhvdYOC3+C/U=; b=Gfp4zA4C66j1piakr1i5XZd2xIOm81mUZcuzrt7zouugIlMfGrZHgkeW8vnRrSQ4gx 9nIn1ll+mC4oJa6/rw6XjmUYk3Pr4QzOMVPvM5DYcbTAV3m46VumEKtauYflEPqynQrK p2N1/T6o85L2pwiJ/Bp3g5aDGYu7aWnOmg+pIkShiI9AUAlslQZEsC5iE91iz13M5OnS U2HxcbMXpSf/VXJp0pyFu3tzVKWtuWluqLS8pqCEFfywQ17qRRLpwRTXbs3u/gs7C3tS V1Y00swJv6REi7V9o4lFbZFEMo7xzTWisyCfCln3AC75MlBmJudutxUtS2Kkak7VNei1 Oy8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839442; x=1792444242; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=MR39kHT8Rwj5ttSiVFLB95sc/8LyJ4pAhvdYOC3+C/U=; b=iMvcQ9QYFtutM1A03kz8xiY3W7W9LCXQSbwfXIJs1Qh8EjSmvncdRpu7m3qZjtdiPK 5ThIwQT3PkCuxytFvsgJTdeY9D4vm/ym0JyNKqFQtaXz0m0m1sSSagZOfD0ff7nlLcTQ qBeUQspUJxpAehE++gzbQuiEeZIIf3y7gJBZ12PYkQ5yxkpH1llcsetPZsdrZ8VljKmN L5WD90DFjn9en/8fagYrjV7GaVhJDEnaPb73BN1J+P7YDLTBJQTd5FIZeydRclO4CJOi aNZ9jjQhuVSHty+92yqTB6/XQ9KDmeY64uHCpEN5wCGqVYg/gUcQQH/YVBZN5D5uaEEO clvQ== X-Gm-Message-State: AFq9FYKupQh8jb9upB1AJ+I/67p/2S+SNTxLhnBpYL46oFg5HvK+nF7j qy1Q/mJRqrGLGX0WKn4VpJyavp/UYWQQTHGTzKevYnkiMzwMZn32AJ8IJ48Asw== X-Gm-Gg: AYBFou0gO6La1/M9EwhviM7X38nVmEwxgz6dkS6E2IpcXgXIPU85hhdsTAisxJ1cm+o I2030BWl0JDoe2b0N8NIGV+ghHv1LfZuZbRPa3KG3o3bb/Q5ktvpjHj1GP69R0HMUzCC53/Z1tq T7yXY6EXyOs60vvqMb5M1UkhPTUozCw6S1A0i481m0/7YQy+rPB/ibPIMdeT+7NQMWMmf35f9MP byiYg5IZE9onGF29Bh4KvvxIGysjq2K8jcXcGuZ43q3i4IavNxl7NIYDetMy4H4GYf7gEnvmpLX k6Oqf92mzKfrxwhTNkEkqOCJ4JtMiBASm1UbhyKiwiunYMV/elq1yGlIDy7XPTIwLy/ERgzkS6n GqIl5AzyEz0H5/s1E8jxyDyFubzhAqKz6QPH9A6v6jZvZnlToT6r0llKyM7rINqsfdcS4HPWSjh /MRQfJ3nvEbHdL6POqHNoUjqyTjE9UoftlIHZZF6KZXW2tDiB9T1CHrZN3Nq/kVIOrVHK7vSwQu bv0QqsdrM+6xmMPC2rfy5C7/XqeGYRtIe43uJw= X-Received: by 2002:a17:90b:4b82:b0:3ab:a09c:f858 with SMTP id 98e67ed59e1d1-3aba09d4a0cmr3514498a91.33.1791839441976; Mon, 12 Oct 2026 14:10:41 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:41 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 10/43] gpm: ignore CVE-2025-4558 Date: Tue, 13 Oct 2026 10:09:34 +1300 Message-ID: <20261012211009.3352822-10-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130780 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2025-4558 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit e134adc8f3e5ff7359d7df04c4a841e4d5eeff15) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/gpm/gpm_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/gpm/gpm_git.bb b/meta-oe/recipes-support/gpm/gpm_git.bb index 155e56bdefe..9c07f334b0e 100644 --- a/meta-oe/recipes-support/gpm/gpm_git.bb +++ b/meta-oe/recipes-support/gpm/gpm_git.bb @@ -42,3 +42,5 @@ do_install:append () { } SYSTEMD_SERVICE:${PN} = "gpm.service" + +CVE_STATUS[CVE-2025-4558] = "cpe-incorrect: this CVE is for GPM from WormHole Tech" From patchwork Mon Oct 12 21:09:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100502 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 033C7CA9EDC for ; Mon, 12 Oct 2026 21:10:56 +0000 (UTC) Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5093.1791839445641262879 for ; Mon, 12 Oct 2026 14:10:45 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=K2qjtCIF; spf=pass (domain: gmail.com, ip: 209.85.215.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-cc1c9879395so671370a12.1 for ; Mon, 12 Oct 2026 14:10:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839445; x=1792444245; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ZjhCXHBxUjyK6lESQo2PAi2aWndh8PCz+Tl0U6po3z4=; b=K2qjtCIFxsO1xaPcb8nCdRWyc4Xh3bnNgELV4hGLgcGTtWUTFZozfflemgDMWXBUvo Uj9BQkX9iD1o8PJ7BmOV/q3J0cab4THcGysLNqVVJGupDTB5xE4fcbma0h7oz5bdWKlW EHQglnlQc1naXh9FeCSU6h5CQMgBK0spDyXvzKWBCm76Sw0paS9tVSuU3bLQUJHEZECD 5AUs6qgIjqR44uDHzy7o9T2xJYyH/IJr6kJa/ZF0fOCmcyGHGHQ3pooj3cDAR44WwPz4 kH7Ut+Jxika3B1VNKwrRj0AYKWfVQxjStNexMwFeotGMEJthSDpMLucNvf7YxpRclirp x0Fw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839445; x=1792444245; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ZjhCXHBxUjyK6lESQo2PAi2aWndh8PCz+Tl0U6po3z4=; b=CFMZynQdQ4jPmVri6ymzbd6O4RgEgoz/QutXHrxKUjaP5yU6SHYuMjMRxkLBYOnj2K YKgMdCuqWPo5+8Kf+I24+Wha6ep3Q1oM3fXXHQI0vk/1OCBzd+DtE6DWStFwjWfe8coG xGfWt5UhjFpTF08XaX8l2x7ljwvRRAVAwJvvPPE5xJdsnsdh6GZlQABexZJSSRtstnCJ kB1A05Ef7gxIPNjuJbhmJwgZu0rMuAROg2mFqRF9I/0AFJRduy/eIzaBQi0HKagm9NNQ EgMoW3M53guX07MHo0nFNRrRvxN3M5jhh+1nuLqhR2Mxn/XRTRz6zvLC0rEBKZSrdjJA Zelw== X-Gm-Message-State: AFq9FYJ7XjBer3x5UPukJYueBLyi2D3B+JcOJ2oz6iulHTCuoX1ypomD sQwtN5JLtwcZg/A9iQQLcdtLZy2En0bivxg1s+wTtAwVOzSxeKXDFr8mdMxYc0cw X-Gm-Gg: AYBFou3ZXbHDI2+QaxsLTEjztB/sAf9gCPo3rTcn6I342ETUvTlS0n94AkE4szb1ihz c66lezoddjthTHqLcGDe8TQ0eedmHSug1Kg5Qd48jXfNjdrGDcL8f01xBjZuMemGX4MXSKVm7I0 Hzfn4VFCpWN1Kvzy8PbDYvPVb0cK6hGkouz1c6cU/AVkzcy4Syx5aWIIpxVdi010dVnOISXK78K 9VGcxWpCPOlpy0lY6Z4NVo4Xp50czPzW+6yHoWoaFvUrKUFYXqplaLPnO5swW3GRHIMdh2Sl6xp T/51qK/Xrjlbg/1gV+9SkfC7hifLlX6CyZD9lfZrwI86NDh96zWqfJhLWylnWJe0/rpfHxlbm/3 DLZmZfnosdFX5RdCrt6fchDZVfzjJ8zTBo5l+SCcjaHe1dLvfGwr5Em5UgE0VJfePnTwoh/YHzt UhVuNfF67A2hxtb/YkShQeOo8EMtGHrNmsLedIrYQD0xWHor7HRb7odhAX+HEaISq/JVf2tZAkp hQAxQ1pASZvZsLShBdKdJkfNr2zTJkkExPHQvo= X-Received: by 2002:a17:90b:3c07:b0:3ab:1a24:56e4 with SMTP id 98e67ed59e1d1-3ab3aca1257mr7721742a91.30.1791839444962; Mon, 12 Oct 2026 14:10:44 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:43 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-multimedia][blacksail][PATCH 11/43] gerbera: ignore CVE-2025-23386 Date: Tue, 13 Oct 2026 10:09:35 +1300 Message-ID: <20261012211009.3352822-11-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130781 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2025-23386 This vulnerability is due to openSUSE specific packaging issue. Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 369d9629673fd4282cc88fc9b7435de5d1a0ceeb) Signed-off-by: Ankur Tyagi --- meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb b/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb index 3d28273f30a..ca54cf2315e 100644 --- a/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb +++ b/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb @@ -29,3 +29,5 @@ PACKAGECONFIG[js] = "-DWITH_JS=TRUE,-DWITH_JS=FALSE,duktape" PACKAGECONFIG[zip] = "-DWITH_ZIP=TRUE,-DWITH_ZIP=FALSE,libzippp libzip" SECURITY_CFLAGS:riscv64 = "${SECURITY_NOPIE_CFLAGS}" + +CVE_STATUS[CVE-2025-23386] = "not-applicable-platform: The vulnerability is openSUSE specific" From patchwork Mon Oct 12 21:09:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100500 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2664BCA9ED2 for ; Mon, 12 Oct 2026 21:10:55 +0000 (UTC) Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5096.1791839448577285622 for ; Mon, 12 Oct 2026 14:10:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=ZXcrG5pW; spf=pass (domain: gmail.com, ip: 209.85.215.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-cd5cd8d89a7so710992a12.1 for ; Mon, 12 Oct 2026 14:10:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839448; x=1792444248; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4x/C/dWGcatHe42E5jutBB/abcUKIjeNHiMFKqhs2V8=; b=ZXcrG5pW6R3/4nUXTM7wCuEoAmm8OTyJB1bVCAjsXjfbxF1h9/n3Ja7/eOwTGfvwpd gcH0/l1WbzYL4l4SD0dkJ+/YweEwbu7qxrx6Dqiig/ISEEFjAXBbyMISLg7xPPAHwIf3 C5SzBS3gGPzTmHPQNt2DQp8rilNm98ZIya/4N0dCWIq5g5LnV2r4Yz/41gwB7sgN446D hPm64ZzO0ujQzrc9zHf2ECCo/CBfUxLhnUf7amhxPzuEzhZ61cQc63KK5SqYJ/DVv7Sq WjO22V+OqeSxK4MAvv4i6kLM+xbbb/zV4LTBh58W8hYVzfVVLOKiBDrt5DUs7eJHAKxA lI4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839448; x=1792444248; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=4x/C/dWGcatHe42E5jutBB/abcUKIjeNHiMFKqhs2V8=; b=oajiFITqkHChN37VOBUO4IcyElofG93uXyGhDHSmfISnZeDFvFi5H8DkDSQPdFFiqQ LXl+uHPHDFBjxLAH5evQiwg5pCqyBqJXC1bnR24OKzQt92yNVUb/Ea6gL9npsD8Iw0vr 8VVIloylFaRag0vWWuH5oCpuUDb/TqaricjpDu9OJaNL+vBlcKFxBok8TyETahV5yibv 2bgSte+3xC/3tL50pTLHgTuGDlTmmFvrk/YNAJxcLS78VZ8j080KxxKQLpFy6V5lLeVA 3NNw7IL6f+SO0LMiJWNvux5xJk75nwMzwYrjA09NLxTAIRbHcCfNZrSNZWKcaQKGizg+ zV2w== X-Gm-Message-State: AFq9FYJx4Lhm87gz2GHPLcsRXTCUHALmIJK4uCpTAGRg+muA7MlyZa96 XyR4myU5/M2h+d/Hn6kbPbPevJLREk9OIOxEN2vIDdK5520PpUAji3oriwu2igMY X-Gm-Gg: AYBFou3tGlXx0vmp2eGL9SIsTEMZKRATTU9038nJ8SLLZTu2RrsKUrd6uXwnuDQ7seH MQ3ejb5+DdAKLz3/7d9w3RTfLsU/+00StKZxF91u6CeMSe8HmjxtB40Brn4XAmYf9NRqXJzwR9q B2m023mLCqYQcm3G7J/uJitwazW4IxH/hi82R0JvWTWfDdopYBb+UxtRdWL3SfpLio90Uklw39O oHKtigatSN2LuZ6zb1iJ6S5zAJ+jsfPYCyc8pGZVPdIvzpZnP7K7hCu7HtuLp92YqOROZMNWs8h 1Sb0ig92JMi4+RLHL88+sWi6/93j8Nfy7517prcqvyjFCdCPYm0ejEnu2Aiq/WLdwIzZ+BZyqTM Qm7HUzbSqiJFLMvJtOSOUVOrH703Px9YdS1ucJIl6MHTb2RU2oFZKRjcxcZ8zmdUC+3i0VyqOxG d1fQgATCHYNT+9RiaBfbLk8/L+OAChB7B+WjW1n2RcYQh1Mi3Fv1KXUo0tX8/EkVWWxTPFks4Zv 4Rm515sHY0AKfACy++TBcTyKPwzgukXyAQTe+w= X-Received: by 2002:a17:90a:d2c7:b0:3a8:13d6:f740 with SMTP id 98e67ed59e1d1-3ab3a99aa95mr8700970a91.22.1791839447863; Mon, 12 Oct 2026 14:10:47 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:47 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-multimedia][blacksail][PATCH 12/43] libde265: patch CVE-2026-49295 Date: Tue, 13 Oct 2026 10:09:36 +1300 Message-ID: <20261012211009.3352822-12-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130782 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49295 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit bd09bb41b41ee12aeb181bf04e5f5961b00123ef) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49295.patch | 41 +++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 4 +- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch new file mode 100644 index 00000000000..189d330b9a5 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch @@ -0,0 +1,41 @@ +From 7d5e48dbf9324691ba3ce4cd8ffa089d735b0b70 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Mon, 25 May 2026 20:14:07 +0200 +Subject: [PATCH] bound aggregate short-term RPS size (GHSA-g2rg-wj66-w594) + +(cherry picked from commit 691f3a3c55b3d32478c4a49895dee061a282652b) + +CVE: CVE-2026-49295 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652] +Signed-off-by: Ankur Tyagi +--- + libde265/refpic.cc | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/libde265/refpic.cc b/libde265/refpic.cc +index ea4db4b0..dcd2b214 100644 +--- a/libde265/refpic.cc ++++ b/libde265/refpic.cc +@@ -322,6 +322,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue, + + out_set->compute_derived_values(); + ++ // The unused short-term references are all collected into a single PocStFoll array ++ // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set). ++ // While each individual list is bounded above, the predicted-RPS construction can ++ // append the current-picture delta to an already-full source set, pushing the ++ // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds ++ // write when filling PocStFoll. ++ if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) { ++ out_set->NumNegativePics = 0; ++ out_set->NumPositivePics = 0; ++ out_set->NumDeltaPocs = 0; ++ out_set->NumPocTotalCurr_shortterm_only = 0; ++ ++ errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false); ++ return false; ++ } ++ + return true; + } + diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index ca05e9099e5..6bed3250fa5 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -8,7 +8,9 @@ LICENSE = "LGPL-3.0-only AND MIT" LICENSE_FLAGS = "commercial" LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" -SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV}" +SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ + file://CVE-2026-49295.patch \ +" SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Mon Oct 12 21:09:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100501 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33CD5CA9ED0 for ; Mon, 12 Oct 2026 21:10:55 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5067.1791839451597302868 for ; Mon, 12 Oct 2026 14:10:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=adVFFL72; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3a4b3ac8fb7so896470a91.0 for ; Mon, 12 Oct 2026 14:10:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839451; x=1792444251; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=CPtpAxsWgHCGclwUU4Kex2f7e/VVpeiiVhkw7dMAbMg=; b=adVFFL72XAE4barrEjR6NZiGjGUYF9R0eeCvtNAxZZLN24NFIXZiylaaHx/xNVPZ4O zWwJRdv2I5Nw810g9p2wK6ytFijpheWdq7BKTja4YuSjWgZrZtPeqLOOhyUq9P8UDj+f iXRXtVJ+E9Z7s8E5FHdZPxdzXgMh4gDltPO9Z1lWdtCyu5SzBxclLvV3KJxCln9+QKW3 8mLb7xIYXGK7wiiVMR2qnzNY4TeNcupiFm0GsEnGm4pklKSt9WZ6wJsa6NINQRmVQGll m5VuYjxq+CLr8QCIfLvWtvXPx+5GupzIMVWUpTFjnOHKscPFufKu/7fuZuRFMJ4gRwJD dS2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839451; x=1792444251; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=CPtpAxsWgHCGclwUU4Kex2f7e/VVpeiiVhkw7dMAbMg=; b=KnMF0ovp1sDK2OrMam13ypB/2XQodyLiHbWVg5xgf5f/NtVIkj6hVPxoI/SCHYih5S KZe3FoSnev5BjngWXkjHtRFRPmcFYHRFviYC875qW9m7WdCyaTeaaB0LgOKRh9TB1WkF Y83uf/1O+3e2G2UgsanEiBieQ8MtIs2h/7x4i9edUf/eTsR0vvA1KV2sliurHhUR3ZgG 0+ipYM0rTud2vFYd7Za4Zo/JxRyuwOv+FG1koZAz+64BArKHGQK5gM+5JBy42GNi7NYN G3VK5NhEO5Y/X3Ze3gE7wJKnVr5am6HJJTbdDFbUEhOeh2NY4I24vUvQCS282AnBYsjh oZmw== X-Gm-Message-State: AFq9FYLLFYy1OI7O27mKVnMZV2l6A1OlBabpbeQM6ZHh/+0ORdAAKksf TotHfbRilLtEWFwN0tcQi4zISchqkI6+ZdyahE5aLoGoo6AFW6Q0XhFTatoQ0KeI X-Gm-Gg: AYBFou29/hzHX4bd7S1bQ2qHnXWVudF+e691uJkIfSWFmrxCZyqkvOYxu1BbM9g+T/g ki+5+RfKu6Fu3eHs+OeRWoBIR56NX5gg7FCl+IXP1L14OoKw5ga9GI5FAcOViIQfyqJYkNfxEU4 nPDDtqDg0yz3N+pT18Dxl/CfMUUXPp0sZBBlSrt48knrUjd6kVNjGlceuuPCgjl6RBNxNLC6Ttz Qv5PeS5LtqW5t7f9GPKtCX3DwR0oQ1ZJp9SJPaTK/lsRixFDr04w805lyYsf4m9fNXx2ihIJI9+ rdXzG2Y5Lb+400wefnmISF4ACig1zyvyMSpSY16K8C4Q7nDBrTupbQY1AMl6PebTBsTuffx97US qU15crJE789EYRrG3TCuKOSz+2LAjeYcYA0A8AdFbtSdqASgpbWlcNtiTc6+TEwAA8cpyO2G8J0 /Q3YHDYy1Egmw9jyF6uzpqHdbEw/+0lmjj7zvrs8qsrNAU0neRd9vrlN+g16Z7tnQeo2q5DftDo rXutRsPh8g17ECTOEEKsiKeRb+YYm3raHrqWAU= X-Received: by 2002:a17:90b:498f:b0:3ab:d26b:c2e9 with SMTP id 98e67ed59e1d1-3abd26bc503mr3529234a91.33.1791839450968; Mon, 12 Oct 2026 14:10:50 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:50 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-multimedia][blacksail][PATCH 13/43] libde265: patch CVE-2026-49337 Date: Tue, 13 Oct 2026 10:09:37 +1300 Message-ID: <20261012211009.3352822-13-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:10:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130783 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49337 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit c83399f83fbbbb855c5a272c9702e8aff4328ce4) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49337.patch | 53 +++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch new file mode 100644 index 00000000000..88e0e329491 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch @@ -0,0 +1,53 @@ +From 2f0c53241cb9bf2f5acded53c25f1b74db536de7 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Mon, 25 May 2026 20:29:40 +0200 +Subject: [PATCH] free orphaned slice header when no active image unit + (GHSA-g5hj-rf9f-7vxm) + +(cherry picked from commit 683cb9fa603e35840642f98765ab95cdb71cadf9) + +CVE: CVE-2026-49337 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9] + +Signed-off-by: Ankur Tyagi +--- + libde265/decctx.cc | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/libde265/decctx.cc b/libde265/decctx.cc +index fbb3baa1..5deddc37 100644 +--- a/libde265/decctx.cc ++++ b/libde265/decctx.cc +@@ -478,10 +478,6 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + shdr->entry_point_offset[i] -= skipped; + } + +- this->img->add_slice_segment_header(shdr); +- +- +- + // --- start a new image if this is the first slice --- + + if (shdr->first_slice_segment_in_pic_flag) { +@@ -495,6 +491,13 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + + if ( ! image_units.empty() ) { + ++ // Hand the slice header to the picture (which takes ownership and frees it ++ // on release). Only do this when there is an active image unit to decode ++ // the slice; otherwise the header would be retained on img->slices forever, ++ // which a crafted stream of non-first slice NALs can exploit to grow memory ++ // without bound. ++ this->img->add_slice_segment_header(shdr); ++ + slice_unit* sliceunit = new slice_unit(this); + sliceunit->nal = nal; + sliceunit->shdr = shdr; +@@ -507,6 +510,7 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + } + else { + nal_parser.free_NAL_unit(nal); ++ delete shdr; + } + + bool did_work; diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index 6bed3250fa5..5fcf6411131 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ file://CVE-2026-49295.patch \ + file://CVE-2026-49337.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Mon Oct 12 21:09:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100506 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18952CA9EDC for ; Mon, 12 Oct 2026 21:11:06 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5097.1791839455314876059 for ; Mon, 12 Oct 2026 14:10:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=MkNPqUV2; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-3ab2bf5e75bso1142935a91.3 for ; Mon, 12 Oct 2026 14:10:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839455; x=1792444255; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=6QiV0nfZtc98gxzDTeDh7ZHrHNNpjxQXVoYPbjSwhmo=; b=MkNPqUV2BojOBfDGoskLDKDi54gVgLJZhi3bbqG86QulJHEZ0eX6wnwOwwKVQE4fw7 DVCFLOr8fISfr/AeAZRXrNc7OTd+w3SgNoL1BvHpNw/npr6FFmbb9GHmvtUgXHJKe71M Zx7ZLVIqEysRqP2AjF63BuHLuhKNgIHmITBWovIrQ/2yDf8gBi8fqKEHB7h7lSqcdxAH tiixXWVaZKOBHogZOmjXJosJSoi+tTHetkk3IoXlIFFRp/R3jrS3BjF8hc8f6IYbfYP8 nOXceP8uNDN940e5z1S+HKTJAaILMCIKh4QaykPkOiWNtAbXB+Dc1DrkI056EAaB2x3U AtWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839455; x=1792444255; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=6QiV0nfZtc98gxzDTeDh7ZHrHNNpjxQXVoYPbjSwhmo=; b=dkTLaVf2JXdCjOVEgebcUjmSNFBLduAO1sBN7FsLzPzgnTA4szxlXd9lddrNljXZTK TYJWUbO30lllh6n761xoe9N9hAy+kv7Bgoo9bGbBNFEeiLml1Q+iPe6uMkqACtRutU62 DKbwWNUEr8MoCYtCcWA9Eqjv5IxsdzHfSs01T9a3Yw9t+L3pvYBaQidVp5Uhk1IxFwju cjSZoNi0KxvUOLSxwswNk5OUky6zOxEzzI8cvYpOF1cEjjPqfjJXjad8K8cF0WtQQomz RjT0QUaVZD57s1ERa+KbrVoVNZ7ibEqVRXA9QqvVdHvkLj1jGDpGEPuSKEEKVVHTsbT8 QeAw== X-Gm-Message-State: AFq9FYJfKW8A5YgUP9mKNYqhMUzj59o3gLQz/PZcnAyMWlr24M4f3rb+ bWXuDKzGOBh65KcHZir01q1u3bn1AKsUCMF3FMMOXb8/oBugEe0NEaley8+2OJTI X-Gm-Gg: AYBFou35t4qb6Eqf4OXpo0A2EqQi/1L2TGB6rAMUohdIzskxvS7eH2mMsThDLZja+Xm jMxM8MtKSbcEZDEp/6EQar/d2B+rSkMXrqhitfrnJkbw8i/bknhui9WY4JPIX3ovuov3/L9RWJr ySzBhm1CGfxNcSbfcj9FIH0nO6yOJTn2uu48aK4SVY1GIYlEBJC+NnyWErKSX1X6aWW85Tfv3iK EZ3mTpF9l7Ih1N60j2vRTVCtPQmRZK4R0qZWBOLB7AFIk6rD2pIq2YvvgOr7rPQ/G7QmNUmElfM 23aJY/avGbjEDqs/Ft4FILY1ZZyv43JO/n3QX9KFNDZIM76AkOErXXMrPR42/vINJCmRnNO7i4U 5uA1/oDBffceBDEsarydcjzfasQywYADZ9gPbNdvedN8Qj54F9ko588/+oy9CoUmdWoINcfzZYn arXNIk1xkfvitUkm/nFve1JUh6aVlzx9axTCSosQS9nF/CI720bpdXz6f7S726a3LJ4zDFEbD0o d3vbKU9Jaitbne0INVLxXfzCEABz51zS800rZdCcw== X-Received: by 2002:a17:90b:4fcb:b0:3ab:31b9:fe51 with SMTP id 98e67ed59e1d1-3ab3acf311bmr8986882a91.67.1791839454570; Mon, 12 Oct 2026 14:10:54 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:54 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-multimedia][blacksail][PATCH 14/43] libde265: patch CVE-2026-49346 Date: Tue, 13 Oct 2026 10:09:38 +1300 Message-ID: <20261012211009.3352822-14-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130784 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49346 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 4a63a2afa1c984b82a663ed8951b62f0ae5da093) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49346.patch | 102 ++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 1 + 2 files changed, 103 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch new file mode 100644 index 00000000000..288295b08a8 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch @@ -0,0 +1,102 @@ +From 1667c33f2778a04f08ba4f7d6c1c16508350a779 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Tue, 26 May 2026 00:59:08 +0200 +Subject: [PATCH] fix integer overflow in image plane allocation size + (GHSA-vv8h-932h-7r86) + +(cherry picked from commit 8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8) + +CVE: CVE-2026-49346 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8] + +Signed-off-by: Ankur Tyagi +--- + libde265/image.cc | 46 +++++++++++++++++++++++++++------------------- + 1 file changed, 27 insertions(+), 19 deletions(-) + +diff --git a/libde265/image.cc b/libde265/image.cc +index 0b6071ba..94f3c974 100644 +--- a/libde265/image.cc ++++ b/libde265/image.cc +@@ -70,10 +70,11 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, + void* inputdata, int inputstride, void *userdata) + { + int alignment = STANDARD_ALIGNMENT; +- int stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; +- int height = img->get_height(cIdx); ++ uint32_t stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; ++ uint32_t height = img->get_height(cIdx); + +- uint8_t* p = static_cast(ALLOC_ALIGNED_16(stride * height + MEMORY_PADDING)); ++ // size computed in size_t: stride*height can exceed UINT32_MAX for large planes ++ uint8_t* p = static_cast(ALLOC_ALIGNED_16(static_cast(stride) * height + MEMORY_PADDING)); + + if (p==nullptr) { return nullptr; } + +@@ -82,12 +83,14 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, + // copy input data if provided + + if (inputdata != nullptr) { +- if (inputstride == stride) { +- memcpy(p, inputdata, stride*height); ++ if (inputstride == static_cast(stride)) { ++ memcpy(p, inputdata, static_cast(stride) * height); + } + else { +- for (int y=0;y(inputdata) + inputstride*y, inputstride); ++ for (uint32_t y=0;y(y) * stride, ++ static_cast(inputdata) + static_cast(inputstride) * y, ++ inputstride); + } + } + } +@@ -107,30 +110,35 @@ LIBDE265_API void de265_free_image_plane(struct de265_image* img, int cIdx) + static int de265_image_get_buffer(de265_decoder_context* ctx, + de265_image_spec* spec, de265_image* img, void* userdata) + { +- const int rawChromaWidth = spec->width / img->SubWidthC; +- const int rawChromaHeight = spec->height / img->SubHeightC; ++ const uint32_t rawChromaWidth = spec->width / img->SubWidthC; ++ const uint32_t rawChromaHeight = spec->height / img->SubHeightC; + +- int luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; +- int chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; ++ uint32_t luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; ++ uint32_t chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; + + assert(img->BitDepth_Y >= 8 && img->BitDepth_Y <= 16); + assert(img->BitDepth_C >= 8 && img->BitDepth_C <= 16); + +- int luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); +- int chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); ++ uint32_t luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); ++ uint32_t chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); + +- int luma_height = spec->height; +- int chroma_height = rawChromaHeight; ++ uint32_t luma_height = spec->height; ++ uint32_t chroma_height = rawChromaHeight; + + bool alloc_failed = false; + +- uint8_t* p[3] = { 0,0,0 }; +- p[0] = static_cast(ALLOC_ALIGNED_16(luma_height * luma_bpl + MEMORY_PADDING)); ++ // Compute the plane sizes in size_t. Each operand fits in uint32_t, but the ++ // height * bytes-per-line product can exceed UINT32_MAX for large frames, so ++ // the multiplication must be done in 64 bits. Computing it in 32 bits wraps ++ // the allocation size to a small value while fill_image() later writes the ++ // real (size_t) size -> heap buffer overflow (GHSA-vv8h-932h-7r86). ++ uint8_t* p[3] = { nullptr,nullptr,nullptr }; ++ p[0] = static_cast(ALLOC_ALIGNED_16(static_cast(luma_height) * luma_bpl + MEMORY_PADDING)); + if (p[0]==nullptr) { alloc_failed=true; } + + if (img->get_chroma_format() != de265_chroma_mono) { +- p[1] = static_cast(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING)); +- p[2] = static_cast(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING)); ++ p[1] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); ++ p[2] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); + + if (p[1]==nullptr || p[2]==nullptr) { alloc_failed=true; } + } diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index 5fcf6411131..a02d6dd5d8c 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ file://CVE-2026-49295.patch \ file://CVE-2026-49337.patch \ + file://CVE-2026-49346.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Mon Oct 12 21:09:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100507 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2144CC6B04 for ; Mon, 12 Oct 2026 21:11:06 +0000 (UTC) Received: from mail-pg1-f182.google.com (mail-pg1-f182.google.com [209.85.215.182]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5069.1791839457816189146 for ; Mon, 12 Oct 2026 14:10:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=XYC/2bPB; spf=pass (domain: gmail.com, ip: 209.85.215.182, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f182.google.com with SMTP id 41be03b00d2f7-ca766c1c9ccso682582a12.0 for ; Mon, 12 Oct 2026 14:10:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839457; x=1792444257; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nrbgLpbwEEBb0tsaMG+LmqQUyf+iPCi2n7OE3hcRmLo=; b=XYC/2bPBySb8hvDKNZvMyPgcICJtu1K82zgIwCHADJekhUih9xyrTMsEaFLA2GM/Hi mauNdYfcnVtiu2EEUAJJsfr8WEx64QqxRyVlTbqRGLFtJ8ivJggSMYLwSLoiTXxEudd7 FY1A4Ae9f5kwzXMoyTA/dzrR7qtprj4q9HCQE3ntNdx5nuoeY2jX62LCrNE8EgalgCQa 1TBUOyzddUD01NHdbKipB5erOy0QppisuzDakQoy+WXJJ+57UkjApwtXxBnUp6dtycQI bQXKyQuwhUmTrJwDTF/PiwXYsDJW2a4Sxd+Qcm13sP+TgAZRwAqqZWgj/fFCJaLWdAzB VzGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839457; x=1792444257; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=nrbgLpbwEEBb0tsaMG+LmqQUyf+iPCi2n7OE3hcRmLo=; b=VTlVx7ZTYPrwk06bgPwV6ym06nLHx7ke7XbHOUCyhEgbmWm3cO6ur/RMBDHU2tw5gS jc5qvkamdY/FueMT6k1jl0deZG5cq1wGQ7yEjY9YxCCr3awhHCPD3wdZPf6R7yPtiN3n b8KhNkaQ86mOeY9AxrRs2CjkqYwwouCMSMc2VCLqq/PBZDFNFJD+3YscTK1kQ6ShzBmI LZ4ydp2A1GVXpaTzeA5dH51hBrhfXNvQshzVH1n0YP1lEJsrE3Ykpmh2bRgUtfClz4G8 lPn6brvAwyLSeFgfqORMzb8sw2gZtI/ltCWmhg9OPJDvfFqQYrZhqAqKUtWDX2BtN3AO sw9g== X-Gm-Message-State: AFq9FYIgUjmyBLZJbM59lljV/L0+a8Ld/Go/m8D9KB40qBVoXEdX6PZq lvtWcd+Z0aAbqvLZ/tXaoAyho3WLyiC/AzdeyGJdzGAzYPQrVbi7xNCLM/njYA== X-Gm-Gg: AYBFou3DLhs1/AAzDZ+Dhhpuhq3B+qNTLu52jMzLCDXxsn0q9/MFqiZITqbgaQ7V9Zn mQuATkJNDWCotAa+Tk6OEIAUy2OZYHfBTSHCVzZrt/6XPCFKV1JSGtQmKU/R6SqgvXZa1MyMBVr mJwXWsFBFWP6aq0Z9qbwKWakvBxP4DAjhU27Q0nRSYclCtuLKwTDrU/u/UJB9ayaWn5KKd68UX9 ZmL1PRfxpOqay/NBXcCwB4tq0plI/Vx0d07fAaLfm7Y0D4bd4OnZyJ5/v+UKkLio2iwZesinKW9 VA3GMoh7TCfMeU4Uf8k1QG24Y9ZwJHn0UiEkRWOfziqa46+rULdD6LTx9RkhK8RWSL+WxIotHqm 3CYHL4S424hsEpxxHAEyLFbpm6d7n48UcZGTxUR9hubAS14wni9oysp35OX/R2d1GUtlxKU/MK0 OYv7f8Ok+wbXazuq1gsOwT+U6LkAMlFEP4b7hRtrvnuUQvirySJ508k6MfERyiRIcRSpOGp2BQY hAwQXi00m8ne8rLvftjuMvPDAWoOvP0XEH0vZ0= X-Received: by 2002:a17:90b:1dd1:b0:3a6:fec5:c179 with SMTP id 98e67ed59e1d1-3ab3ad2b1b8mr9097138a91.41.1791839456943; Mon, 12 Oct 2026 14:10:56 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:56 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-multimedia][blacksail][PATCH 15/43] libde265: patch CVE-2026-54240 and CVE-2026-54241 Date: Tue, 13 Oct 2026 10:09:39 +1300 Message-ID: <20261012211009.3352822-15-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130785 From: Ankur Tyagi Debian identified same commit as fix for both CVEs[1][2]. Details: https://nvd.nist.gov/vuln/detail/cve-2026-54240 https://nvd.nist.gov/vuln/detail/cve-2026-54241 [1]https://security-tracker.debian.org/tracker/CVE-2026-54240 [2]https://security-tracker.debian.org/tracker/CVE-2026-54241 Signed-off-by: Ankur Tyagi --- .../CVE-2026-54240-CVE-2026-54241.patch | 426 ++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 1 + 2 files changed, 427 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch new file mode 100644 index 00000000000..6f5c526f17f --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch @@ -0,0 +1,426 @@ +From 3986aba8dec43bc539e5f7c349826cea902f9ee3 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Wed, 3 Jun 2026 16:44:32 +0200 +Subject: [PATCH] fix pixel-accessor integer overflow on large frames + (GHSA-ccfw-29x7-rrx3) + +The de265_image::get_image_plane_at_pos*() accessors computed the pixel +offset `xpos + ypos*stride` in signed 32-bit int. For frames where +width*height exceeds INT32_MAX (e.g. 46344x46344, both within the existing +<=65535 limit), ypos*stride wraps negative and the returned pointer lands +~2 GB before the buffer -> heap out-of-bounds read/write. This is independent +of the earlier allocation fix (GHSA-vv8h-932h-7r86), which only widened the +buffer size, not the offset arithmetic. + +Widen the image stride to ptrdiff_t (members, get_image_stride/get_luma_stride/ +get_chroma_stride, set_image_plane) so all pixel-offset math is evaluated in +64 bits. The public C API (de265_get/set_image_plane) keeps int for ABI; the +narrowing at that boundary is safe (stride <= ~65552). + +The same 32-bit-stride / absolute-coordinate pattern existed in several scalar +paths that the accessors don't cover; widen those too: + - sao.cc: SAO offset indexing, and the inputCopy allocation+memcpy size + (an int size_t under-allocation -> heap write) + - motion.cc: mc_luma/mc_chroma reference-plane access (ref_stride, src_stride) + - intrapred.h: intra reference-border fill + - sei.cc: decoded-picture-hash MD5/CRC/checksum + - image-io.cc: YUV plane read and write +The deblock kernels, SIMD layer (acceleration.h) and per-block code already +use ptrdiff_t or only small block-local offsets and need no change. + +Also store pic_width/height_in_luma_samples as uint16_t (the value is +provably <= MAX_PICTURE_WIDTH = 65535 after validation) so PicSizeInSamplesY +needs only a single uint32_t cast instead of int*int (which was signed-overflow +UB on the same trigger); add static_asserts tying the limits to the storage. + +Verified: girlshy bit-exact single- and multi-threaded; ASan+UBSan PoC against +the get_image_plane_at_pos sink crashes pre-fix (UBSan signed-overflow at the +accessor + ASan wild write) and is clean post-fix. + +(cherry picked from commit bdca87569b9c63c2a7054d90ae4462dbb78d159a) + +CVE: CVE-2026-54240 CVE-2026-54241 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/bdca87569b9c63c2a7054d90ae4462dbb78d159a] + +Signed-off-by: Ankur Tyagi +--- + libde265/de265.cc | 2 +- + libde265/image-io.cc | 4 ++-- + libde265/image.cc | 2 +- + libde265/image.h | 21 +++++++++++---------- + libde265/intrapred.h | 2 +- + libde265/motion.cc | 8 ++++---- + libde265/sao.cc | 18 +++++++++--------- + libde265/sei.cc | 18 ++++++++++-------- + libde265/sps.cc | 4 ++-- + libde265/sps.h | 11 +++++++++-- + 10 files changed, 50 insertions(+), 40 deletions(-) + +diff --git a/libde265/de265.cc b/libde265/de265.cc +index 48e38a01..02b2d5fd 100644 +--- a/libde265/de265.cc ++++ b/libde265/de265.cc +@@ -678,7 +678,7 @@ LIBDE265_API const uint8_t* de265_get_image_plane(const de265_image* img, int ch + + uint8_t* data = img->pixels_confwin[channel]; + +- if (stride) *stride = img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8); ++ if (stride) *stride = static_cast(img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8)); + + return data; + } +diff --git a/libde265/image-io.cc b/libde265/image-io.cc +index f15234b6..14ca95f0 100644 +--- a/libde265/image-io.cc ++++ b/libde265/image-io.cc +@@ -76,7 +76,7 @@ de265_image* ImageSource_YUV::read_next_image() + // --- load image --- + + uint8_t* p; +- int stride; ++ ptrdiff_t stride; + + p = img->get_image_plane(0); stride = img->get_image_stride(0); + for (uint32_t y=0;yget_width(); + int height= img->get_height(); +diff --git a/libde265/image.cc b/libde265/image.cc +index 94f3c974..59a19184 100644 +--- a/libde265/image.cc ++++ b/libde265/image.cc +@@ -184,7 +184,7 @@ de265_image_allocation de265_image::default_image_allocation = { + }; + + +-void de265_image::set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata) ++void de265_image::set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata) + { + pixels[cIdx] = mem; + plane_user_data[cIdx] = userdata; +diff --git a/libde265/image.h b/libde265/image.h +index e0f1db24..114f41e4 100644 +--- a/libde265/image.h ++++ b/libde265/image.h +@@ -26,6 +26,7 @@ + #endif + + #include ++#include + #include + #include + #include +@@ -235,11 +236,11 @@ struct de265_image { + /* */ uint8_t* get_image_plane(int cIdx) { return pixels[cIdx]; } + const uint8_t* get_image_plane(int cIdx) const { return pixels[cIdx]; } + +- void set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata); ++ void set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata); + + uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + xpos + ypos*stride; + } + +@@ -248,38 +249,38 @@ struct de265_image { + template + pixel_t* get_image_plane_at_pos_NEW(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return (pixel_t*)(pixels[cIdx] + (xpos + ypos*stride)*sizeof(pixel_t)); + } + + const uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) const + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + xpos + ypos*stride; + } + + void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]); + } + + const void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) const + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]); + } + + /* Number of pixels in one row (not number of bytes). + */ +- int get_image_stride(int cIdx) const ++ ptrdiff_t get_image_stride(int cIdx) const + { + if (cIdx==0) return stride; + else return chroma_stride; + } + +- int get_luma_stride() const { return stride; } +- int get_chroma_stride() const { return chroma_stride; } ++ ptrdiff_t get_luma_stride() const { return stride; } ++ ptrdiff_t get_chroma_stride() const { return chroma_stride; } + + int get_width (int cIdx=0) const { return cIdx==0 ? width : chroma_width; } + int get_height(int cIdx=0) const { return cIdx==0 ? height : chroma_height; } +@@ -333,7 +334,7 @@ private: + int width = 0, height = 0; // size in luma pixels + + int chroma_width = 0, chroma_height = 0; +- int stride = 0, chroma_stride = 0; ++ ptrdiff_t stride = 0, chroma_stride = 0; + + public: + uint8_t BitDepth_Y = 0, BitDepth_C = 0; +diff --git a/libde265/intrapred.h b/libde265/intrapred.h +index 9b17f75b..a256cb3a 100644 +--- a/libde265/intrapred.h ++++ b/libde265/intrapred.h +@@ -533,7 +533,7 @@ void intra_border_computer::fill_from_image() + assert(nT<=32); + + pixel_t* image; +- int stride; ++ ptrdiff_t stride; + image = (pixel_t*)img->get_image_plane(cIdx); + stride = img->get_image_stride(cIdx); + +diff --git a/libde265/motion.cc b/libde265/motion.cc +index c62c24c3..14e920e1 100644 +--- a/libde265/motion.cc ++++ b/libde265/motion.cc +@@ -50,7 +50,7 @@ void mc_luma(const base_context* ctx, + const seq_parameter_set* sps, int mv_x, int mv_y, + int xP,int yP, + int16_t* out, int out_stride, +- const pixel_t* ref, int ref_stride, ++ const pixel_t* ref, ptrdiff_t ref_stride, + int nPbW, int nPbH, int bitDepth_L) + { + int xFracL = mv_x & 3; +@@ -129,7 +129,7 @@ void mc_luma(const base_context* ctx, + pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+7)]; + + const pixel_t* src_ptr; +- int src_stride; ++ ptrdiff_t src_stride; + + if (-extra_left + xIntOffsL >= 0 && + -extra_top + yIntOffsL >= 0 && +@@ -181,7 +181,7 @@ void mc_chroma(const base_context* ctx, + int mv_x, int mv_y, + int xP,int yP, + int16_t* out, int out_stride, +- const pixel_t* ref, int ref_stride, ++ const pixel_t* ref, ptrdiff_t ref_stride, + int nPbWC, int nPbHC, int bit_depth_C) + { + // chroma sample interpolation process (8.5.3.2.2.2) +@@ -227,7 +227,7 @@ void mc_chroma(const base_context* ctx, + pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+3)]; + + const pixel_t* src_ptr; +- int src_stride; ++ ptrdiff_t src_stride; + + int extra_top = 1; + int extra_left = 1; +diff --git a/libde265/sao.cc b/libde265/sao.cc +index a0db84b2..579dcef2 100644 +--- a/libde265/sao.cc ++++ b/libde265/sao.cc +@@ -28,8 +28,8 @@ + template + void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + const slice_segment_header* shdr, int cIdx, int nSW,int nSH, +- const pixel_t* in_img, int in_stride, +- /* */ pixel_t* out_img, int out_stride) ++ const pixel_t* in_img, ptrdiff_t in_stride, ++ /* */ pixel_t* out_img, ptrdiff_t out_stride) + { + const sao_info* saoinfo = img->get_sao_info(xCtb,yCtb); + +@@ -77,7 +77,7 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + + if (SaoTypeIdx==2) { + int hPos[2], vPos[2]; +- int vPosStride[2]; // vPos[] multiplied by image stride ++ ptrdiff_t vPosStride[2]; // vPos[] multiplied by image stride + int SaoEoClass = (saoinfo->SaoEoClass >> (2*cIdx)) & 0x3; + + switch (SaoEoClass) { +@@ -266,8 +266,8 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + template + void apply_sao(de265_image* img, int xCtb,int yCtb, + const slice_segment_header* shdr, int cIdx, int nSW,int nSH, +- const pixel_t* in_img, int in_stride, +- /* */ pixel_t* out_img, int out_stride) ++ const pixel_t* in_img, ptrdiff_t in_stride, ++ /* */ pixel_t* out_img, ptrdiff_t out_stride) + { + if (img->high_bit_depth(cIdx)) { + apply_sao_internal(img,xCtb,yCtb, shdr,cIdx,nSW,nSH, +@@ -332,8 +332,8 @@ void apply_sample_adaptive_offset_sequential(de265_image* img) + return; + } + +- int lumaImageSize = img->get_image_stride(0) * img->get_height(0) * img->get_bytes_per_pixel(0); +- int chromaImageSize = img->get_image_stride(1) * img->get_height(1) * img->get_bytes_per_pixel(1); ++ size_t lumaImageSize = static_cast(img->get_image_stride(0)) * img->get_height(0) * img->get_bytes_per_pixel(0); ++ size_t chromaImageSize = static_cast(img->get_image_stride(1)) * img->get_height(1) * img->get_bytes_per_pixel(1); + + uint8_t* inputCopy = new uint8_t[ libde265_max(lumaImageSize, chromaImageSize) ]; + if (inputCopy == nullptr) { +@@ -347,10 +347,10 @@ void apply_sample_adaptive_offset_sequential(de265_image* img) + + for (int cIdx=0;cIdxget_image_stride(cIdx); ++ ptrdiff_t stride = img->get_image_stride(cIdx); + int height = img->get_height(cIdx); + +- memcpy(inputCopy, img->get_image_plane(cIdx), stride * height * img->get_bytes_per_pixel(cIdx)); ++ memcpy(inputCopy, img->get_image_plane(cIdx), static_cast(stride) * height * img->get_bytes_per_pixel(cIdx)); + + for (int yCtb=0; yCtb(data); +- int stride16 = stride / 2; ++ ptrdiff_t stride16 = stride / 2; + for (int y=0; y> 8 ) ^ ( y >> 8 ); +@@ -224,7 +225,7 @@ static inline uint16_t crc_process_byte_parallel(uint16_t crc, uint8_t byte) + (t << 12)) & 0xFFFF; + } + +-static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride, int bit_depth) ++static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,ptrdiff_t stride, int bit_depth) + { + raw_hash_data raw_data(w,stride); + +@@ -250,7 +251,7 @@ static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride + } + + +-static void compute_MD5(uint8_t* data,int w,int h,int stride, uint8_t* result, int bit_depth) ++static void compute_MD5(uint8_t* data,int w,int h,ptrdiff_t stride, uint8_t* result, int bit_depth) + { + MD5_CTX md5; + MD5_Init(&md5); +@@ -289,7 +290,8 @@ static de265_error process_sei_decoded_picture_hash(const sei_message* sei, de26 + int nHashes = img->get_sps().chroma_format_idc==0 ? 1 : 3; + for (int i=0;iget_width(i); + h = img->get_height(i); +diff --git a/libde265/sps.cc b/libde265/sps.cc +index aa871a09..a29a3c0a 100644 +--- a/libde265/sps.cc ++++ b/libde265/sps.cc +@@ -570,7 +570,7 @@ de265_error seq_parameter_set::compute_derived_values(bool sanitize_values) + PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY); + PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY; + PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY; +- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples; ++ PicSizeInSamplesY = static_cast(pic_width_in_luma_samples) * pic_height_in_luma_samples; + + if (chroma_format_idc==0 || separate_colour_plane_flag) { + CtbWidthC = 0; +@@ -1325,7 +1325,7 @@ de265_error seq_parameter_set::write(error_queue* errqueue, CABAC_encoder& out) + PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY); + PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY; + PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY; +- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples; ++ PicSizeInSamplesY = static_cast(pic_width_in_luma_samples) * pic_height_in_luma_samples; + if (chroma_format_idc==0 || separate_colour_plane_flag) { + CtbWidthC = 0; + CtbHeightC = 0; +diff --git a/libde265/sps.h b/libde265/sps.h +index c8be9788..5cb0b46c 100644 +--- a/libde265/sps.h ++++ b/libde265/sps.h +@@ -39,6 +39,13 @@ constexpr int MAX_NUM_LT_REF_PICS_SPS = 32; + constexpr int MAX_PICTURE_WIDTH = 65535; + constexpr int MAX_PICTURE_HEIGHT = 65535; + ++// pic_width/height_in_luma_samples are stored as uint16_t and PicSizeInSamplesY as uint32_t, ++// so these limits must keep width/height in 16 bits and their product in 32 bits. ++static_assert(MAX_PICTURE_WIDTH <= 0xFFFF, "picture width must fit in uint16_t"); ++static_assert(MAX_PICTURE_HEIGHT <= 0xFFFF, "picture height must fit in uint16_t"); ++static_assert((uint64_t)MAX_PICTURE_WIDTH * MAX_PICTURE_HEIGHT <= 0xFFFFFFFFu, ++ "total luma sample count must fit in uint32_t"); ++ + enum { + CHROMA_MONO = 0, + CHROMA_420 = 1, +@@ -111,8 +118,8 @@ public: + uint8_t chroma_format_idc; // [0;3] + + bool separate_colour_plane_flag; +- int pic_width_in_luma_samples; +- int pic_height_in_luma_samples; ++ uint16_t pic_width_in_luma_samples; // <= MAX_PICTURE_WIDTH (validated on parse) ++ uint16_t pic_height_in_luma_samples; // <= MAX_PICTURE_HEIGHT (validated on parse) + bool conformance_window_flag; + + int conf_win_left_offset; diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index a02d6dd5d8c..8e145cf8dde 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https file://CVE-2026-49295.patch \ file://CVE-2026-49337.patch \ file://CVE-2026-49346.patch \ + file://CVE-2026-54240-CVE-2026-54241.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Mon Oct 12 21:09:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100504 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C23CCA9ED2 for ; Mon, 12 Oct 2026 21:11:06 +0000 (UTC) Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5100.1791839460266803876 for ; Mon, 12 Oct 2026 14:11:00 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=o4/5GjAY; spf=pass (domain: gmail.com, ip: 209.85.215.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-cc4be0e5351so584949a12.0 for ; Mon, 12 Oct 2026 14:11:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839460; x=1792444260; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=UQGQuHIaxDSL9TFDWXqM5bu3wBbrle3z2o81dZ1QKb4=; b=o4/5GjAYWiuCbfYO+6km90rjKzF83z6jOOh6Nl1GviXsYzfAysuxjEfD5uQ5USCywu YRu0yFPb4Mu4FDjLSiMEhoCU3blWcbkCAu2p9jrJ227b+fdvyqekfJnfnYxFCwTxAQgD np5iss2mjJG3HVqeJbx2NfQFANWhzMjPcwbvsl86NHk9BLs/p+027+/WuAd2ymQAjBVm D3FqJThUhzXREAajJ6m05sQ1Ldq4XhFAFKqNP62oKtT80ELPBLmviFECrKKv4ioaZbtJ Y6I+BTSReQehDXXDMQkE+6Bnu5h0HUAJi4SPDLOSNEVmerXoLg3OqlYIWR3Y7Libj54+ yTZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839460; x=1792444260; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=UQGQuHIaxDSL9TFDWXqM5bu3wBbrle3z2o81dZ1QKb4=; b=v7nKUAYKn8FOySjtg45Vj0KUHX2JWkKYX8GBYaj7tyVj2b1cDZs+JdVeVz4MVztMbk xLEclXrl6rgt59+ZhL/In8dmIs8K16M6THkHNWTlLLXGRfoCeYJx2+kBpplcfynXp+Vf E+M5Lm32SDOMc9HKzFVprmyf8Rsii7x4WdWUqubBP1qybWJvYPqnubVnkER8tMPdOp/S dG5CDu0HjkOkS9JNp3HHnS+9mdZ3098S5GnyHNJelNsneKSgrg0xudee92VBHp9VxS9r s0P0KZwoBlks2X4JOwyAMqRw+SSY1NlC4ruqUWarWqqwSgmw+oj4DxSU82KqK2DxPAGB 0Zrg== X-Gm-Message-State: AFq9FYJ2z6nMcjnZrCcddl28IPxrfZ9ap/bKhlQTbFAgr8SytqN1XTJo rQ3/xHTz3AC8sBw+utQhxzrFGM83CXswG15G4vymaMB19mO+FONH7CdM9txZAKIh X-Gm-Gg: AYBFou0e0j96MJQyawoCBdkE17l70wbWi34Phf/f4HdaUTDnfnyos3Qtoxb+eq/x1fG W0bdCsngE1QdmHMhpw/yICpW0tbuEgL4T+T8DIXCsWsvLhXjUtNNbpQBZwhQM2BVDPuJeZEoe+I o1QJoITrFOOKvA2YdrbnKcQA6+cUATICOypRAEnS1n/JeGTvp1D1QAktlWE8Z5tt6m5ys8orxHH obpmjBnDlyuHZEHh9DcU1C/mBwrQPkfQeBD9AHAape/SzOSh8De+kFegeYZL1a3dwueRlueAUyI Lz4UBxDSI7i4+mPNos84WdirU70/YWCv0nM0ugotvJCa7rGoMMFOBYePhrjeXV6KMwQzebZuOr8 kaySC2085SbabGxeAFfaDueqO+LChYmw6ZJ9w3YJlcfRzxZhMj0JeZbmiF81Yk8Q2cOY6IIJ+/z S32/MG5HtC5bsw+EWiKuo8uMe4oGdyDju+qtJRW/rExf8oprP9kiRXG70uPWhlvwijwHleyzpVh h4FndAWru+cxc9gwSqN8OA7zcOfT2AG/5fgSCY= X-Received: by 2002:a17:90b:384a:b0:3a8:1320:38ae with SMTP id 98e67ed59e1d1-3ab3a291871mr8545053a91.9.1791839459402; Mon, 12 Oct 2026 14:10:59 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:10:59 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 16/43] hdf5: patch CVE-2026-17572 Date: Tue, 13 Oct 2026 10:09:40 +1300 Message-ID: <20261012211009.3352822-16-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130786 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. Debian[4] has also identified the commit. [1] https://github.com/HDFGroup/hdf5/pull/6499 [2] https://github.com/HDFGroup/hdf5/issues/6501 [3] https://nvd.nist.gov/vuln/detail/cve-2026-17572 [4] https://security-tracker.debian.org/tracker/CVE-2026-17572 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit c279e9e68822db77648667093bcbf3013269c791) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17572.patch | 253 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 254 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch new file mode 100644 index 00000000000..373a6c374ef --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch @@ -0,0 +1,253 @@ +From 606bb0a0282d0b056a3bdda1d489a608deee78d2 Mon Sep 17 00:00:00 2001 +From: Nayyar +Date: Tue, 14 Jul 2026 23:39:56 +0530 +Subject: [PATCH] reject SOHM list message count exceeding list_max (#6499) + +* bound SOHM list decode to list_max messages + +* Add tsohm test for out-of-range SOHM list message count + +Create a file with a shared-message list index, corrupt the on-disk +message count so it exceeds list_max (repairing the table checksum), +and confirm reopening rejects the file instead of overrunning the +list image buffer and message array. + +--------- + +Co-authored-by: H. Joe Lee +Co-authored-by: Larry Knox + +CVE: CVE-2026-17572 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/20f0b9564bc46154e60f8d35578720a599d41552] + +Dropped changes to the CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5SMcache.c | 14 ++++ + test/tsohm.c | 173 ++++++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 187 insertions(+) + +diff --git a/src/H5SMcache.c b/src/H5SMcache.c +index eb6d612a78..96687ffed9 100644 +--- a/src/H5SMcache.c ++++ b/src/H5SMcache.c +@@ -489,6 +489,12 @@ H5SM__cache_list_verify_chksum(const void *_image, size_t H5_ATTR_UNUSED len, vo + assert(image); + assert(udata); + ++ /* The buffer only holds list_max messages; a corrupted header whose message ++ * count exceeds that would size the checksum region past the end of it. ++ */ ++ if (udata->header->num_messages > udata->header->list_max) ++ HGOTO_ERROR(H5E_SOHM, H5E_BADVALUE, FAIL, "number of SOHM messages exceeds list size"); ++ + /* Exact size with checksum at the end */ + chk_size = H5SM_LIST_SIZE(udata->f, udata->header->num_messages); + +@@ -552,6 +558,14 @@ H5SM__cache_list_deserialize(const void *_image, size_t H5_ATTR_NDEBUG_UNUSED le + HGOTO_ERROR(H5E_SOHM, H5E_CANTLOAD, NULL, "bad SOHM list signature"); + image += H5_SIZEOF_MAGIC; + ++ /* The message array is sized for list_max entries; a list index always ++ * holds at most that many before it is promoted to a B-tree. Reject a ++ * corrupted header whose message count would drive the decode loop past ++ * the allocation and the input buffer. ++ */ ++ if (udata->header->num_messages > udata->header->list_max) ++ HGOTO_ERROR(H5E_SOHM, H5E_CANTLOAD, NULL, "number of SOHM messages exceeds list size"); ++ + /* Read messages into the list array */ + ctx.sizeof_addr = H5F_SIZEOF_ADDR(udata->f); + for (u = 0; u < udata->header->num_messages; u++) { +diff --git a/test/tsohm.c b/test/tsohm.c +index 1652c9b044..61036e7dc3 100644 +--- a/test/tsohm.c ++++ b/test/tsohm.c +@@ -3702,6 +3702,175 @@ test_sohm_external_dtype(void) + free(orig); + } /* test_sohm_external_dtype */ + ++/*------------------------------------------------------------------------- ++ * Function: test_sohm_reject_bad_count ++ * ++ * Purpose: A shared-message list index holds at most list_max messages ++ * on disk before it is promoted to a B-tree, and both the list ++ * image buffer and the in-memory message array are sized for ++ * list_max entries. Corrupt the on-disk message count so it ++ * exceeds list_max and verify the list load rejects the file ++ * instead of sizing a read or indexing the array past its end. ++ * ++ *------------------------------------------------------------------------- ++ */ ++static void ++test_sohm_reject_bad_count(void) ++{ ++ hid_t fcpl_id = H5I_INVALID_HID; ++ hid_t fid = H5I_INVALID_HID; ++ hid_t sid = H5I_INVALID_HID; ++ hid_t did = H5I_INVALID_HID; ++ hsize_t dims[1] = {4}; ++ FILE *fp = NULL; ++ uint8_t *buf = NULL; ++ long fsize = 0; ++ long table_off = -1; ++ unsigned list_max = 100; ++ uint32_t chksum; ++ size_t pos; ++ int i; ++ herr_t ret; ++ ++ /* On-disk shared-message table layout for a file with a single index and ++ * 8-byte addresses: a 4-byte "SMTB" signature, one index record, then a ++ * 4-byte checksum. Within the record the 16-bit message count follows the ++ * (version, index type, message types, minimum size) prefix and the 16-bit ++ * list and B-tree cutoffs. ++ */ ++ const size_t rec_size = 1 + 1 + 2 + 4 + 3 * 2 + 8 + 8; /* 30 */ ++ const size_t table_body = (size_t)H5_SIZEOF_MAGIC + rec_size; /* 34 */ ++ const size_t num_msgs_off = (size_t)H5_SIZEOF_MAGIC + (1 + 1 + 2 + 4 + 2 + 2); /* 16 */ ++ ++ MESSAGE(5, ("Testing rejection of an out-of-range SOHM list message count\n")); ++ ++ /* Create a file whose single shared-message index is a list that can hold ++ * up to list_max messages before converting to a B-tree. ++ */ ++ fcpl_id = H5Pcreate(H5P_FILE_CREATE); ++ CHECK_I(fcpl_id, "H5Pcreate"); ++ ret = H5Pset_shared_mesg_nindexes(fcpl_id, 1); ++ CHECK_I(ret, "H5Pset_shared_mesg_nindexes"); ++ ret = H5Pset_shared_mesg_index(fcpl_id, 0, H5O_SHMESG_SDSPACE_FLAG | H5O_SHMESG_DTYPE_FLAG, 1); ++ CHECK_I(ret, "H5Pset_shared_mesg_index"); ++ ret = H5Pset_shared_mesg_phase_change(fcpl_id, list_max, 0); ++ CHECK_I(ret, "H5Pset_shared_mesg_phase_change"); ++ ++ fid = H5Fcreate(FILENAME, H5F_ACC_TRUNC, fcpl_id, H5P_DEFAULT); ++ CHECK_I(fid, "H5Fcreate"); ++ ++ /* Several datasets sharing one dataspace and datatype leave the index a ++ * list holding a couple of messages, well under list_max. ++ */ ++ sid = H5Screate_simple(1, dims, NULL); ++ CHECK_I(sid, "H5Screate_simple"); ++ for (i = 0; i < 5; i++) { ++ char name[16]; ++ ++ snprintf(name, sizeof(name), "dset%d", i); ++ did = H5Dcreate2(fid, name, H5T_NATIVE_INT, sid, H5P_DEFAULT, H5P_DEFAULT, H5P_DEFAULT); ++ CHECK_I(did, "H5Dcreate2"); ++ ret = H5Dclose(did); ++ CHECK_I(ret, "H5Dclose"); ++ } ++ ret = H5Sclose(sid); ++ CHECK_I(ret, "H5Sclose"); ++ ret = H5Fclose(fid); ++ CHECK_I(ret, "H5Fclose"); ++ ++ /* Read the whole file so the shared-message table can be located and edited. */ ++ fp = fopen(FILENAME, "rb"); ++ CHECK_PTR(fp, "fopen"); ++ if (fp) { ++ if (fseek(fp, 0, SEEK_END) != 0) ++ TestErrPrintf("fseek failed at line %d\n", __LINE__); ++ fsize = ftell(fp); ++ if (fsize <= (long)(table_body + 4)) ++ TestErrPrintf("unexpected file size %ld at line %d\n", fsize, __LINE__); ++ rewind(fp); ++ ++ buf = (uint8_t *)malloc((size_t)fsize); ++ CHECK_PTR(buf, "malloc"); ++ if (buf && fread(buf, 1, (size_t)fsize, fp) != (size_t)fsize) ++ TestErrPrintf("fread failed at line %d\n", __LINE__); ++ if (fclose(fp) != 0) ++ TestErrPrintf("fclose failed at line %d\n", __LINE__); ++ fp = NULL; ++ } ++ ++ /* Find the shared-message table by signature, confirming the match with the ++ * stored checksum so the correct bytes are edited. ++ */ ++ for (pos = 0; buf && (pos + table_body + 4) <= (size_t)fsize; pos++) { ++ if (memcmp(buf + pos, H5SM_TABLE_MAGIC, (size_t)H5_SIZEOF_MAGIC) != 0) ++ continue; ++ ++ chksum = (uint32_t)buf[pos + table_body] | ((uint32_t)buf[pos + table_body + 1] << 8) | ++ ((uint32_t)buf[pos + table_body + 2] << 16) | ((uint32_t)buf[pos + table_body + 3] << 24); ++ if (chksum == H5_checksum_metadata(buf + pos, table_body, 0)) { ++ table_off = (long)pos; ++ break; ++ } ++ } ++ if (table_off < 0) ++ TestErrPrintf("could not locate the shared-message table in %s\n", FILENAME); ++ ++ if (buf && table_off >= 0) { ++ unsigned bad_count = list_max + 200; /* well past the list_max cutoff */ ++ size_t base = (size_t)table_off; ++ ++ /* Overwrite the 16-bit message count and repair the table checksum so ++ * the table loads and the corruption is only caught at the list. ++ */ ++ buf[base + num_msgs_off] = (uint8_t)(bad_count & 0xff); ++ buf[base + num_msgs_off + 1] = (uint8_t)((bad_count >> 8) & 0xff); ++ ++ chksum = H5_checksum_metadata(buf + base, table_body, 0); ++ buf[base + table_body] = (uint8_t)(chksum & 0xff); ++ buf[base + table_body + 1] = (uint8_t)((chksum >> 8) & 0xff); ++ buf[base + table_body + 2] = (uint8_t)((chksum >> 16) & 0xff); ++ buf[base + table_body + 3] = (uint8_t)((chksum >> 24) & 0xff); ++ ++ fp = fopen(FILENAME, "r+b"); ++ CHECK_PTR(fp, "fopen"); ++ if (fp) { ++ if (fwrite(buf, 1, (size_t)fsize, fp) != (size_t)fsize) ++ TestErrPrintf("fwrite failed at line %d\n", __LINE__); ++ if (fclose(fp) != 0) ++ TestErrPrintf("fclose failed at line %d\n", __LINE__); ++ fp = NULL; ++ } ++ ++ /* Reopen and share a new message, which protects the list and drives ++ * the vulnerable decode. The load should reject the file cleanly. ++ */ ++ fid = H5Fopen(FILENAME, H5F_ACC_RDWR, H5P_DEFAULT); ++ CHECK_I(fid, "H5Fopen"); ++ sid = H5Screate_simple(1, dims, NULL); ++ CHECK_I(sid, "H5Screate_simple"); ++ ++ H5E_BEGIN_TRY ++ { ++ did = H5Dcreate2(fid, "trigger", H5T_NATIVE_INT, sid, H5P_DEFAULT, H5P_DEFAULT, H5P_DEFAULT); ++ } ++ H5E_END_TRY ++ ++ if (did >= 0) { ++ TestErrPrintf("dataset creation succeeded on a corrupted SOHM list at line %d\n", __LINE__); ++ H5Dclose(did); ++ } ++ ++ ret = H5Sclose(sid); ++ CHECK_I(ret, "H5Sclose"); ++ ret = H5Fclose(fid); ++ CHECK_I(ret, "H5Fclose"); ++ } ++ ++ free(buf); ++ ret = H5Pclose(fcpl_id); ++ CHECK_I(ret, "H5Pclose"); ++} /* test_sohm_reject_bad_count */ ++ + /**************************************************************** + ** + ** test_sohm(): Main Shared Object Header Message testing routine. +@@ -3755,6 +3924,10 @@ test_sohm(void H5_ATTR_UNUSED *params) + + test_sohm_extend_dset(); /* Test extending shared datasets */ + test_sohm_external_dtype(); /* Test using datatype in another file */ ++ ++ /* Editing the on-disk table in place needs the single-file sec2 layout */ ++ if (default_driver) ++ test_sohm_reject_bad_count(); /* Test rejecting a bad SOHM list message count */ + } /* test_sohm */ + + /*------------------------------------------------------------------------- diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 7860931e7e1..c83bb832deb 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -18,6 +18,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://0001-cmake-remove-build-flags.patch \ file://CVE-2026-26199.patch \ file://CVE-2026-26197.patch \ + file://CVE-2026-17572.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Mon Oct 12 21:09:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100505 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26ACECC6B03 for ; Mon, 12 Oct 2026 21:11:06 +0000 (UTC) Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5101.1791839462623585780 for ; Mon, 12 Oct 2026 14:11:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=UYYV8RX7; spf=pass (domain: gmail.com, ip: 209.85.215.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-ccc6b11a19aso751168a12.0 for ; Mon, 12 Oct 2026 14:11:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839462; x=1792444262; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DdiunAitm9p3IpUO3AfUpuarKIA8DrhqU3e+HYdK9bg=; b=UYYV8RX7a3dGjPET883evFFlJ+wpZBU7hqw2ww4dL8NouRLkUOXwWl2LOIK+qWKpVf 6o/lTSi/4R92NDdUMBjwufEMUPvZchNc78tDOUk92ZuuqX5fdgIwGQZNEhxzorgiHgcZ T5SQnw87WlqIB0oUPxUvhGOg12uLRGaEZj143PZjV1RSMIeQUc+XBGlZQH9vS3VRFGuA mkpFo9ygjwwDKOV0OfkTO+8V0qTzBFzysoJBTFlZBnn/NDRPUf6foBxoesGIH4+cAtuk b54R/mRw3ZgTJ4biYSvmJ1P0h3Ho1105yDZfegu8NrEFOZZB/mKS1WXI2fEcRobymyEp 2DHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839462; x=1792444262; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DdiunAitm9p3IpUO3AfUpuarKIA8DrhqU3e+HYdK9bg=; b=S7k3UyrqFI/JbVll4NtQQM1OXfDJrvxJytp58w5TLblbPyBazLyUE8oYwziVK7qjt1 nXtLOHBR2mcGF651RxisIrtJRmJDXOasVh+cxLFUN1pftZuZdYg9iQ7YZn5GYK2tX8Na Ig5eiWqzgbUhFvwczYC9Yb1eCHlsc7JZfFvS3lOw6LfXrCf1ktYDR7L0hnnaE3XvZ34w Exi6wfyYxKFQZXEw0AVPLB5ULDA27gm/m6pxcQ81NeLkbUaWXZoXSXSy2sapiqUiysDz awPfwuidcLMiuBIvTeUDk32Yezg38tCepTIDlc1Nw2FnAS0hpj7G9yVIWZn/AA697R1F uLEQ== X-Gm-Message-State: AFq9FYJcKk7ti02C3cuxbCdMqr6DzAPrXOi3r7Q07q5ZTq5uqY+BJT2T GaNWIe/c6y6ofhWBEEe3+fR/HH9oUk8+6zTTzii2NZ84nfSf/dxC3ZWZXOmvhw== X-Gm-Gg: AYBFou1LXzibpArTLJq1gBoJBek9VPxn5sEWZ1b8e+kyYLMJ0ZrFJ3bLmJqyncRTHjL scCRKAmlwjiARoNE1Z8fn47PgmBtP8sQ0o1PxrVLHF/AQnCSDNLJjKGE2S08eVKoM6bThQ4LVT/ WDd1G85sxUONpIGUZ4LAmpo4ACs1qe698ab6cxHE+IfruNc5yoFZIkb23D8RePR3mpbZMtAMvUe ehj7jjoA/qfkSYSXkhmFT0uNCus5g7C+ivU8R/HQRrIsQgyobSuaJvUZ3j3kKSx8ih7C30IEXXv ue5E5oSVUL8/O7xy16Guit+qGIlmi1gXIDtzfk2nLfNer8ciT8U9ioVz3w4khQFMC5FN6xxsY4r cquamQPymmwXQTIktF3a6wOkIpZN0r8jgWlLg7p1Rj0HMFPacIdEckeAybEjfOmsVygJ+NV+Hxj asWMd36uOUfqRsLaCNMLvwJG8gOA5SKJUpuCYjtrx3mdREOaTwQ8/jzFtYJA7tWpbHfMsWerEgB Dm0sFW9Ko2iuO02ngWaFrm6ID8EKTkkdrUpH9VFfA== X-Received: by 2002:a17:90b:51cf:b0:3ab:c370:3684 with SMTP id 98e67ed59e1d1-3abc370392emr3985577a91.30.1791839461874; Mon, 12 Oct 2026 14:11:01 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.10.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:01 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 17/43] hdf5: patch CVE-2026-17573 Date: Tue, 13 Oct 2026 10:09:41 +1300 Message-ID: <20261012211009.3352822-17-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130787 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. Debian[4] has also identified the commit. [1] https://github.com/HDFGroup/hdf5/pull/6160 [2] https://github.com/HDFGroup/hdf5/issues/6124 [3] https://nvd.nist.gov/vuln/detail/cve-2026-17573 [4] https://security-tracker.debian.org/tracker/CVE-2026-17573 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit f46990293cf684add8cc2ee7e71738e97889bcc3) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17573.patch | 53 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch new file mode 100644 index 00000000000..3cfb52de42d --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch @@ -0,0 +1,53 @@ +From 856e7f1dd23e466ebeab5e454a5891b12e188f6a Mon Sep 17 00:00:00 2001 +From: jhendersonHDF +Date: Tue, 27 Jan 2026 05:55:38 -0600 +Subject: [PATCH] Fix double-free issue in H5D__chunk_copy (#6160) + +Fix double-free caused by loss of buffer pointer after re-allocation + +Co-authored-by: Larry Knox + +CVE: CVE-2026-17573 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/dd3080a58cc6bb86f3b34284399915da9e513262] + +Dropped changes to the CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Dchunk.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/src/H5Dchunk.c b/src/H5Dchunk.c +index f2a0e85c03..5ff537ebde 100644 +--- a/src/H5Dchunk.c ++++ b/src/H5Dchunk.c +@@ -7034,7 +7034,7 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + const H5S_extent_t *ds_extent_src, H5T_t *dt_src, const H5O_pline_t *pline_src, + H5O_copy_t *cpy_info) + { +- H5D_chunk_it_ud3_t udata; /* User data for iteration callback */ ++ H5D_chunk_it_ud3_t udata = {0}; /* User data for iteration callback */ + H5D_chk_idx_info_t idx_info_dst; /* Dest. chunked index info */ + H5D_chk_idx_info_t idx_info_src; /* Source chunked index info */ + int sndims; /* Rank of dataspace */ +@@ -7202,7 +7202,6 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "memory allocation failed for raw data chunk"); + + /* Initialize the callback structure for the source */ +- memset(&udata, 0, sizeof udata); + udata.common.layout = &layout_src->u.chunk; + udata.common.storage = &layout_src->storage.u.chunk; + udata.file_src = f_src; +@@ -7253,11 +7252,11 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + } /* end for */ + } + ++done: + /* I/O buffers may have been re-allocated */ + buf = udata.buf; + bkg = udata.bkg; + +-done: + if (dt_dst && (H5T_close(dt_dst) < 0)) + HDONE_ERROR(H5E_DATASET, H5E_CANTCLOSEOBJ, FAIL, "can't close temporary datatype"); + if (dt_mem && (H5T_close(dt_mem) < 0)) diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index c83bb832deb..df0192a0911 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -19,6 +19,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-26199.patch \ file://CVE-2026-26197.patch \ file://CVE-2026-17572.patch \ + file://CVE-2026-17573.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Mon Oct 12 21:09:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100503 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 481C4CA9ED0 for ; Mon, 12 Oct 2026 21:11:05 +0000 (UTC) Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5104.1791839464976541718 for ; Mon, 12 Oct 2026 14:11:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=UuUbJNgQ; spf=pass (domain: gmail.com, ip: 209.85.216.53, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-38759bcd877so1300634a91.2 for ; Mon, 12 Oct 2026 14:11:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839464; x=1792444264; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=hcA8hh3M98vJCTJzI9euS/gus0y3Gzf5/hG2K1IrN2g=; b=UuUbJNgQTQ0p6noJJjZ9YYRWNYcdqExtEHG1c/ab+Z8AUh1OTjuo5HGil1kErapSQr CC9gvELasg3E27GwqCLwxdbncXf5Y5/sCPey59qcupBMD63OLBG3TXCZWxoDfb8AECZs nRAsMffNqmtEVv3W+w6f/NcA/t1lOJu6mRtcvFpq+bRmN0MxNso9f/RW6Erw3T0g5x2j WiSPrV5dvUAGfPQyw+Q6B8Kd+iyyktMbCx9EumEHF3m9I3FHK/VOAUSBCDKanQeLNbdD qUk9GyOX4C1q2s9dxSxRvDNK+L59EY0sedjoOpEy8KHvRDmcVkzg2B9yQeW91LgdTw1R fNPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839464; x=1792444264; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=hcA8hh3M98vJCTJzI9euS/gus0y3Gzf5/hG2K1IrN2g=; b=b1GrWOHvc5gEfFlCbd2ZpjC7ZWvTVi0KBKZRmmaAIwZrBK90UCZje3NA8QJxDsURO7 JP+CxycHiomoW612phQrxPLYbW80sL4Dj41fm71kIHbD+PRd1I3wqFXpaYFzgEZxHZWD HP1ElsYdQkD/LD7OqJ1fXX70I3X9pyc4D5roIbLNK/p6IHSLGxFDWizQEywF1Mb3ziye kwaopmi06g0nX81h8EF7gw38i8I1h7OU9hwsqVFHk/shCSztQZz3Ew3g5g0EvfFu41D7 /SiqIp8nZSTQqiZOGcUQq49o2fWp0rH17VMTFRJBC3MaYr9FBhBmYHNwMwecu/5BwK73 +ajw== X-Gm-Message-State: AFq9FYIPe2KG21a+aHFEy7u1yZdUNHNSvhteQvhH7cSQArHAv/HtNYmW Nv1Ka/JIJLhHScD0/LZo9flNXVlVDENMnIxRJdZJlJZgkzuXhIk0v2+MEXFDmAKX X-Gm-Gg: AYBFou3QAgrnTJMi6p3YN/SFMj8v55O4KnT5GLpiXyiwt2XSu4uDmcC/VvxhCA3He4e LhRMUBLG95L0P34V6ASM291u8qQxGBA2BIRafqtUxgPpU4KwX/IjD66pWkNP1kBMNpZEHcqAQYm erFOfKFykgpRK+f4cHaRoBfC0wnu2Q/qEWoOJD1VfwVbStUSKqC3NW25FVbFNSHO3uM5LQu78cI mo7EnH0+nmIyuhtL0Sc554Y/jJKTqjHCvzpjQg/8vovP4wHjzk+c/A8zYkdiNSVrfQ0l72EZ+dW GzCNoLKQUp0OwYY97SDustwuu/9DEP1+JC3W1d31bVyk1b6qmQRJVDSx3yQeDF8YtYv5rLpVIso mMeKLq/3ghGNLQMcIwrGcj3M27foRpxjl/iAu+MtFmVP6LbZfnhOD2JD03fYd9RRraugC/Huc3J uNkwwuy1F1ARgdnXvXMqWDiiNfKAh7/km83PS3tJMMT/oZjfnFl+LR27EwJL3BcNj9O55f+TxlG F7lQZbtzREnLRCUGf5/MlocE0jNsMk9OhY88iY= X-Received: by 2002:a17:90b:224e:b0:3a8:9db2:a4f with SMTP id 98e67ed59e1d1-3ab3af75ac1mr7814998a91.51.1791839464279; Mon, 12 Oct 2026 14:11:04 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:03 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 18/43] hdf5: patch CVE-2026-17574 Date: Tue, 13 Oct 2026 10:09:42 +1300 Message-ID: <20261012211009.3352822-18-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130788 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-17574 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 637f437de908d10e8a3118888740a286c2cd1f06) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17574.patch | 65 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 66 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch new file mode 100644 index 00000000000..0ae79a2811a --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch @@ -0,0 +1,65 @@ +From e374b227c277e100d9bfa3b1fe5c0b60cdff6c43 Mon Sep 17 00:00:00 2001 +From: tbeu +Date: Thu, 28 May 2026 17:26:57 +0200 +Subject: [PATCH] Validate VL datatype type during decode and check file + pointer in H5T_set_loc (#6395) + +H5O__dtype_decode_helper() reads vlen.type from the file without +validation. With corrupted HDF5 files (e.g. from fuzzing), this field +can have an invalid value that is neither H5T_VLEN_SEQUENCE nor +H5T_VLEN_STRING, which later triggers assert(0) in H5T__vlen_set_loc() +(debug builds) or a NULL pointer dereference / SEGV in release builds. + +Fix by: +1. Adding a validation check in H5O__dtype_decode_helper() immediately + after reading the vlen.type field, returning an error if the value + is invalid. +2. Adding a NULL file pointer check in H5T_set_loc() before calling + H5T__vlen_set_loc() when loc == H5T_LOC_DISK, so the low-level + assert(file) invariant is never violated. + +This fixes the root cause at the decode level where the bad value +enters the system, as requested in review of #6378 and #6385. + +Found by OSS-Fuzz via the matio fuzzer (ClusterFuzz testcase +5366895365914624). + +(cherry picked from commit 3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc) + +CVE: CVE-2026-17574 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc] +Signed-off-by: Ankur Tyagi +--- + src/H5Odtype.c | 2 ++ + src/H5T.c | 5 +++++ + 2 files changed, 7 insertions(+) + +diff --git a/src/H5Odtype.c b/src/H5Odtype.c +index d6405cdb86..6e622f3ebc 100644 +--- a/src/H5Odtype.c ++++ b/src/H5Odtype.c +@@ -751,6 +751,8 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t + */ + /* Set the type of VL information, either sequence or string */ + dt->shared->u.vlen.type = (H5T_vlen_type_t)(flags & 0x0f); ++ if (dt->shared->u.vlen.type != H5T_VLEN_SEQUENCE && dt->shared->u.vlen.type != H5T_VLEN_STRING) ++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, "invalid VL datatype type"); + if (dt->shared->u.vlen.type == H5T_VLEN_STRING) { + dt->shared->u.vlen.pad = (H5T_str_t)((flags >> 4) & 0x0f); + dt->shared->u.vlen.cset = (H5T_cset_t)((flags >> 8) & 0x0f); +diff --git a/src/H5T.c b/src/H5T.c +index 3b2e391a53..e2c9ba9791 100644 +--- a/src/H5T.c ++++ b/src/H5T.c +@@ -6953,6 +6953,11 @@ H5T_set_loc(H5T_t *dt, H5VL_object_t *file, H5T_loc_t loc) + ret_value = changed; + } /* end if */ + ++ /* Validate file pointer for disk-based VL types */ ++ if (loc == H5T_LOC_DISK && NULL == file) ++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, ++ "NULL file pointer for disk-based VL datatype"); ++ + /* Mark this VL sequence */ + if ((changed = H5T__vlen_set_loc(dt, file, loc)) < 0) + HGOTO_ERROR(H5E_DATATYPE, H5E_CANTINIT, FAIL, "Unable to set VL location"); diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index df0192a0911..12c9852fd02 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -20,6 +20,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-26197.patch \ file://CVE-2026-17572.patch \ file://CVE-2026-17573.patch \ + file://CVE-2026-17574.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Mon Oct 12 21:09:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100509 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47EC5CA9ED2 for ; Mon, 12 Oct 2026 21:11:16 +0000 (UTC) Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5106.1791839467317967395 for ; Mon, 12 Oct 2026 14:11:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=JPEdxpfL; spf=pass (domain: gmail.com, ip: 209.85.216.53, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-3ab450c0873so1835099a91.3 for ; Mon, 12 Oct 2026 14:11:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839467; x=1792444267; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=R6rtrxU2F0igLKmi1YwTtTAtE+8sinCmQ20pGSFM21o=; b=JPEdxpfLj28GTv1QkPQiUMyrebHMNbte7a7ChPj/19a6BEMcM0pYyhdAADlWqv8woI 7bxnV8uwuyrCb1BDAXnMOBDcS8JZbAdH8K+LGZliUWLkoCHtDvO9TgX8gK6QDcJB0m1F Kf39ofvmcfh76aHEou+ZxmtJafoscudcaM2y6/+pzuNlBcLvTGN8reRTBCeRIoOBSROU ZYtEVG+AdEKk4VoJyjPKgg6Yh91TBTgF1BzSBKqs6F/GhM5cIDf1QrYuoDq9GF++Tvps m2RBgXQGGszStsj3jcwaAnSxZHUXFZ1kV4oO9kOihxsHlQRzUPEu2dXN8Jjzk7gpaG43 p3LQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839467; x=1792444267; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=R6rtrxU2F0igLKmi1YwTtTAtE+8sinCmQ20pGSFM21o=; b=1mxIbItpulbnT3sRxBn18M3/n2huFIDhC7XB0AaIge/NncriuqysHk59o5L9Bmyc7m w7Ktnf8JqbVi84+2i/Op8fmelXVM1FE3b8bT6GnZgZDKUb2LwHtjs5pB+lSmni9EJpME uuVvbEL8C0OrDEBt2ha1JC9jr2CVpzIB63Tg7V0EA63kgwf6UCRSOJ9nVwtvgZPKPkA6 bRxu54cY9wuEBpwqfPveZJqvi6KiQpXIPKDSGvR3GZ5gZP1hroEwLztLqUIasvS6p3pu u5yJyIGuGxAXZGIJckKCsAud1Rjs+ozGjT9/ZY8rb/MRqzOuUoIJei9LBKrHbdKOGlmh xxJw== X-Gm-Message-State: AFq9FYLG45uE//eCEzjWcsGTl9iN93iPFMbP9xpE/NGHCwZs5IA4BiH8 YSzqc0jgCVcer36YKHmYVSsGOr+iMmcSIFFykiz7zTcxmKZ8oYkhkinbk9s+bEA1 X-Gm-Gg: AYBFou3R95YqH4I/ih707CbhxzrXa6UXQ3/t/noupJk+q+YBkbs1RrW6Uhyb+bJk3Gg H5NBXjdKcHhxPO6wLjCGWmGVp+bjAFoSbBG8+j0AV5QQTWZeCvBvrOQAMjQEQri8Ffqffq/PslE jlksRjyf/LOEB5geiweCqG1JpyKU8mVLPrQVgdITQvGWZTrswc4p+9qyVKYR3Fpgj8aVNYOaHn4 fhfNl1uqBknltWWaGujLUFEszo0JADCrN3HsmYUbOz9gasxxZRF8GLUCNz0ljez3ylwoNRixfVY LQP0mPlqDAChEXjFoL5sfsR7reHUBcSWcbn36EMrjNRUXhNN79ASTdH0IcQPkbY/zvFy+5QWFhV 5opk6NNtPuPMUZh9bTlkiTQtsuxWlgCD5FkU1Zeccszq0DrTi7LEgM88xWa+7HpuHZ3sC+P9BzV z34kaNDHpPB1OfHyETJyE4DYd3GnTqJbrTYIF7v3SmNqVSNatE1qeiR+ktEsCl4j+0cU71qBXY0 1eVFI3zpWteRqE93CmCskZcezjpUEBCT+/IZkG5moKTwmxdUg== X-Received: by 2002:a17:90b:1dc1:b0:3a8:96cb:fe8 with SMTP id 98e67ed59e1d1-3ab3a2fe583mr8867767a91.9.1791839466628; Mon, 12 Oct 2026 14:11:06 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:06 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 19/43] hdf5: patch CVE-2026-19025 Date: Tue, 13 Oct 2026 10:09:43 +1300 Message-ID: <20261012211009.3352822-19-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130789 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. [1] https://github.com/HDFGroup/hdf5/pull/6508 [2] https://github.com/HDFGroup/hdf5/issues/6491 [3] https://nvd.nist.gov/vuln/detail/cve-2026-19025 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit df3f814ab84f9cbdcdaeb7cc745e0c61c90c55e8) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-19025.patch | 112 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 113 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch new file mode 100644 index 00000000000..075bcf7653e --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch @@ -0,0 +1,112 @@ +From 0cb26cd769d1da3f2ad2c3836dc1732309f935a7 Mon Sep 17 00:00:00 2001 +From: Matt L <124107509+mattjala@users.noreply.github.com> +Date: Fri, 28 Aug 2026 13:49:02 -0500 +Subject: [PATCH] Fix CVE-2026-19025 (Reject chunked datasets with mismatched + chunk/dspace rank at open time) (#6508) + +* Reject chunked datasets with mismatched chunk/dspace rank + +H5D__chunk_construct() validates that the chunk layout dimensionality +matches the dataspace rank, but that runs only at dataset creation time. +When an existing dataset is opened, H5D__chunk_init() didn't repeat the +check, so a file whose stored chunk rank disagreed with its dataspace rank +was accepted. During chunk I/O the memory-selection rank (from the +dataspace) and the file-selection rank (chunk ndims - 1) then differ, which +produces a zero stride that causes a divide-by-zero in +H5S__hyper_iter_get_seq_list(). + +H5D__chunk_init() now performs the same dimensionality check on open (the +stored chunk rank includes the extra element-size dimension, so it must be +exactly one greater than the dataspace rank) and rejects a mismatch with an +error. + +Added test_chunk_dims_mismatch() as a regression test in test/dsets.c + +Fixes #6491 + +* Fix typo + +Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> + +* Clarify element-vs-byte wording + +* Validate chunk/dataspace rank at layout decode time + +Move the stored-chunk-rank vs dataspace-rank consistency check out of +H5D__chunk_init() and into H5O__layout_decode(), so a malformed chunked +layout is rejected as the message is decoded (mirroring the fill/datatype +size check in the fill message decode). + +* Update release_docs/CHANGELOG.md + +Co-authored-by: Larry Knox + +* Update CHANGELOG + +* Pin format version bounds in bad chunk layout generator + +--------- + +Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> +Co-authored-by: Larry Knox + +CVE: CVE-2026-19025 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/b7b85e7abf9aa9b1dd9693523defa35217684eb2] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Olayout.c | 32 ++++++ + 1 file changed, 32 insertions(+) + +diff --git a/src/H5Olayout.c b/src/H5Olayout.c +index d230feb992..5dce35e916 100644 +--- a/src/H5Olayout.c ++++ b/src/H5Olayout.c +@@ -23,6 +23,7 @@ + #include "H5FLprivate.h" /* Free Lists */ + #include "H5MMprivate.h" /* Memory management */ + #include "H5Opkg.h" /* Object headers */ ++#include "H5Sprivate.h" /* Dataspaces */ + + /* Local macros */ + +@@ -561,6 +562,37 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU + } + } + ++ /* For a chunked layout, the stored dimensionality includes an extra ++ * element-size dimension, so it must be exactly one greater than the ++ * dataspace rank. Validate that here ++ * to reject malformed files before the inconsistent ++ * ranks can cause problems during chunk I/O. ++ */ ++ if (mesg->type == H5D_CHUNKED && open_oh != NULL) { ++ htri_t space_exists; /* Whether the dataspace message exists */ ++ ++ if ((space_exists = H5O_msg_exists_oh(open_oh, H5O_SDSPACE_ID)) < 0) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't check for dataspace message"); ++ if (space_exists) { ++ H5S_extent_t *extent; /* Dataspace extent from the sibling message */ ++ int rank; /* Dataspace rank */ ++ ++ if (NULL == (extent = (H5S_extent_t *)H5O_msg_read_oh(f, open_oh, H5O_SDSPACE_ID, NULL))) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't read dataspace message"); ++ ++ rank = H5S_extent_get_dims(extent, NULL, NULL); ++ ++ /* Done with the sibling dataspace message */ ++ H5O_msg_free(H5O_SDSPACE_ID, extent); ++ ++ if (rank < 0) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't get dataspace rank"); ++ if (mesg->u.chunk.ndims != (unsigned)rank + 1) ++ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, ++ "dimensionality of chunks doesn't match the dataspace"); ++ } ++ } ++ + /* Set return value */ + ret_value = mesg; + \ No newline at end of file diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 12c9852fd02..a0eb5eb155e 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -21,6 +21,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-17572.patch \ file://CVE-2026-17573.patch \ file://CVE-2026-17574.patch \ + file://CVE-2026-19025.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Mon Oct 12 21:09:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100512 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 37E0ACC6B04 for ; Mon, 12 Oct 2026 21:11:17 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5108.1791839469704187255 for ; Mon, 12 Oct 2026 14:11:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=fhgPrnMx; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-381b831d535so2639421a91.0 for ; Mon, 12 Oct 2026 14:11:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839469; x=1792444269; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=dvesF0Vep8chKF3Hj+95VrPPTpeej9DI7y0P/dY8fYQ=; b=fhgPrnMxBsat/LW0jUSIszYq3xJUAUdTu0aJmGpuoTRXqLWndddwaORDB19daL7ECn hFNxnWJxgr5ORf40Gj4tEmC0d2S0YJOqDFK/yT+8oKnVV55g60/B7b1IVrOFBckOMfgC GTb5GB1//V2N1OTShv60pAEp1Yci56PJhWviIH7x95U8LA8HuLfCIpX1Mir3Gd06Xq/f V+QoZRzTexw12ZYoIb6AJGcjsF05zkf9iNtgekhZzlHvfPny74CydTJYSzOiaE4lz/Oc 5ZIw5TvM/A4IwpcKVrquBQl7Iyxp/AXhcuPYMYeHDkkjAYzHB4MZ9yL8zYoN9ifGtbei 7Wwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839469; x=1792444269; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=dvesF0Vep8chKF3Hj+95VrPPTpeej9DI7y0P/dY8fYQ=; b=04LsM13u/jVn0jbqp0M3vVYf65kz5ACk6pRCoEG18nNBCch8WBgzB65sFU8L0ukci7 4atQBPmotdqttG8GEp/3mJ5IIonkBe/60pNPK23GxlpPJohTfOPC2fQEKxQ1e3mf7Bxo IsMgFV61R/9iWRtoQfJJb+KpwbykEXw+9Qek6icmv0JmOic+CLsbgku/FJOJ7d77cdep LZWTgHteD+Mdzu/k12YYXrf1n1i0hleT7ukSGr6Hn1iKe7d/GwhjpGrxytVDP9RBu2JE ibyepnVhtzyD7fff/iiQEtQ/AsIFruc66/atNQUn020U2e99YenI47N7v5UEgapfQzKo vE2A== X-Gm-Message-State: AFq9FYKJS50kDBqERTq0V8CKinIUAEt6kybfBaY3ZlcfRtGVWLuiCv73 B7XEG0eoMAsZ9tz72VlKjxWFYc6qsIu/Kv6FyonSQH42CUxMjcA2SxH/Vu/N1Q== X-Gm-Gg: AYBFou1AHGf7ckX4E9B8VScXxbM8ZmQhPHr9PpdJYwtYHW3AFFsDzpFGricR/rBM1/V Oto8IqZrebMeapgVYPsHw/6Tk8ThOu2o9Pj/3XwKhkM9w9lDCNH2fCPXiTVP3wZ4dFgodm3Ah8U 87J/e1dS7MwJKcILdCpbZ3Ub6ZNxh8OxCMbJEf0D42Mgc9bTmvzZ/xy0x5yhWrls71MUmPp4G+7 LG5EFkoUuLDNUOjGDcPSET8xIldoFVMWBdWo0XQZzgCJd6Q8SfL78umtgUTqYYkMtQVYMVYj99u tmc2NgeahdcA+MnJbweCKVc+Sgqnl55eZlsUnQu20ipuOllxHg3abbENG6md+3lYdjZdxEdxjAi nMkwSVcilAycd6pGFXFXexV/ibuDEjDZ/Sz1G1LrocHk9UdFHUGWP0st2dzY9KG+4A5i5Ls+kgH 8oX0k2e8oSIAZcwzgBVr1b6/VqOgEmGXjP6I+lAIR/6ujmXmw3a5yAiRvvtaL2v0g2cndRT5oOX pT1jKJ+WJCGp9MvA0gIhMlKDFrE3JT59zPeL+8= X-Received: by 2002:a17:90a:617:b0:3ab:be66:ddd4 with SMTP id 98e67ed59e1d1-3abbe66df49mr3044030a91.19.1791839469156; Mon, 12 Oct 2026 14:11:09 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:08 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 20/43] iniparser: mark CVE-2025-0633 pached Date: Tue, 13 Oct 2026 10:09:44 +1300 Message-ID: <20261012211009.3352822-20-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130790 From: Ankur Tyagi Also mentioned in the release notes[1] Details: https://nvd.nist.gov/vuln/detail/cve-2025-0633 [1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 86fba2b5805f6c8ff0a5f936106a9be630bc54d9) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb b/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb index 9ab713ee92e..5958ecb9c6c 100644 --- a/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb +++ b/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb @@ -15,3 +15,5 @@ EXTRA_OECMAKE = " \ " FILES_${PN}-staticdev += "${libdir}/cmake/iniparser/iniparser-staticTargets*.cmake" + +CVE_STATUS[CVE-2025-0633] = "fixed-version: fixed in v4.2.6" From patchwork Mon Oct 12 21:09:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100511 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59D53CA9ED0 for ; Mon, 12 Oct 2026 21:11:16 +0000 (UTC) Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5109.1791839471951151256 for ; Mon, 12 Oct 2026 14:11:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=cv93X+5r; spf=pass (domain: gmail.com, ip: 209.85.216.53, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-3a8af3a704fso1050977a91.2 for ; Mon, 12 Oct 2026 14:11:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839471; x=1792444271; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xV4YHzzW3lTKxDoYgiY6VmQkddjLDpwlCyUrR1waM5w=; b=cv93X+5reWoUonmc3MJdE0XlQkCWYBHrHWRNnDCcZunMLCpvWVsZTJ3eVXIE0bW3G/ iBLsKJkM6yWeX+H/AJI6N5avYhSUiIsxNNiKRUcPKImS6UeuDiI/tunRgp8F5vrEXgfg jMYZmOUjmAh0xegKI2oraEfw493GzMn+R+y6pm9EMWM14kwkgLE8mQTQbwgQMSfGaZ6k pZbm0eBUtZ3XwA9/hO7ldEDnDGvlmGuO5oL3QY7aKQNrK6Q1qVRYz9pyi+Q+TJgmKSla pyTin5WyIqSOOq49fdigm1sRZgCSYBzCMmRa6oBUVNC17mk51yoOGpAkCTMM9FxZsTQy rh2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839471; x=1792444271; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=xV4YHzzW3lTKxDoYgiY6VmQkddjLDpwlCyUrR1waM5w=; b=Kxj74jH8ceLZ4aeneQux5VgVFUAsO91xgRoUobPIbd6CXoI+5skN6qE/hlvpz42Usy JTv98L0hEUStUglKxKJZnxA+A9G39YyKvpWiqa6KmHra/Hoc+/BAPgTB1FbVTXN6QCrI zAsOBZubW20fgGPvDu+BdN0P7JGGuX5vp7dGx8PfzsJJFTthI2S6r3b94lEoGQ5jb3qn CUC8Ok6AI8xqsXfs7hAqFyNPlocMixFzz8OO0m/Rq0qee7gbxe09wROxYRELpxrGgTfa O6dJ0ERiZ/OcesINJQL7fscDbnm7H/WeTfSFRUYB6JyYInpqah6TLZbLpgHZySIyfWr6 v8cQ== X-Gm-Message-State: AFq9FYIR1EsO3gbG23YtO0ub90+tQpWy/ChYh6mYukfUBzT1048FVSSU CbJPUnHzmrqXWvsi7lb4ToEIs6Lk97racVVTt5GrDI5yiHafIMCVWxxsEAolGg== X-Gm-Gg: AYBFou35nuTrp7hnXCjflPmMHMOrVn39HaCqGT1hZhyHaM1wKFEVsnPgffds3OOfyQ0 Xe92UH+v1MWmwotylYZ+dfwsW8rzDtz16tqCD52x/HFFFgDpGaK0DfQ/moFa+uolQigWfmTIaDa HaCXA+EcIF0pT1pRyWc4J/zve6c+qE9BShXLaYa9otcN5xjK5dGMBQErvg599lAMp8nKLg8ipwF jMg9FYXBnw/sf5UN25AjX0epfSIxpIWvJjsZ1rMZtH5Bge1p1V8MuchGRvvNI0ivdSlsVbqNYPN g6epW4V8NBsE/W3GLRxNN1OHe7ifg13oPs1izTiJUkhhi1rNn8Xr3TmkvqsfBU3haRlKfMiAj98 kpLpzXN9lAN15UBohyrC19owGMc5xHO3rTDhdIZiyFYiHHQa5XmpKNrUp2WBm7YXtGbggJjRRli ueb69f2uw9I7VW+Ci1rehnqe4FvnBuvM9ZB5ZVpykdSp+N/2Fgh9DLbXJmly/sAeiMWcUNfyvMY fWaiYxPgHymsxXdmjHxs7pbmGILaIt0Drh7FoI= X-Received: by 2002:a17:90b:5444:b0:3aa:f2c4:12df with SMTP id 98e67ed59e1d1-3ab3a236ca5mr8447933a91.9.1791839471320; Mon, 12 Oct 2026 14:11:11 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:10 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 21/43] jq: ignore already fixed CVEs Date: Tue, 13 Oct 2026 10:09:45 +1300 Message-ID: <20261012211009.3352822-21-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130791 From: Ankur Tyagi All these CVEs are already fixed in the recipe version[1]. Details: https://nvd.nist.gov/vuln/detail/cve-2026-33948 https://nvd.nist.gov/vuln/detail/cve-2026-39979 https://nvd.nist.gov/vuln/detail/cve-2026-40164 https://nvd.nist.gov/vuln/detail/cve-2026-44777 [1]https://github.com/jqlang/jq/releases/tag/jq-1.8.2 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-devtools/jq/jq_1.8.2.bb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/meta-oe/recipes-devtools/jq/jq_1.8.2.bb b/meta-oe/recipes-devtools/jq/jq_1.8.2.bb index 0bbe6e009fe..9f586eb18d3 100644 --- a/meta-oe/recipes-devtools/jq/jq_1.8.2.bb +++ b/meta-oe/recipes-devtools/jq/jq_1.8.2.bb @@ -48,3 +48,7 @@ do_install_ptest() { RDEPENDS:${PN}-ptest += "tzdata" BBCLASSEXTEND = "native" + +CVE_STATUS_GROUPS += "CVE_STATUS_FIXED_ALREADY" +CVE_STATUS_FIXED_ALREADY[status] = "fixed-version: The issue is fixed in v1.8.2" +CVE_STATUS_FIXED_ALREADY = "CVE-2026-33948 CVE-2026-39979 CVE-2026-40164 CVE-2026-44777" From patchwork Mon Oct 12 21:09:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100508 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48A62CC6B03 for ; Mon, 12 Oct 2026 21:11:16 +0000 (UTC) Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5075.1791839474460962629 for ; Mon, 12 Oct 2026 14:11:14 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=ID+3JF7g; spf=pass (domain: gmail.com, ip: 209.85.215.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-cc4aa0246b7so950570a12.3 for ; Mon, 12 Oct 2026 14:11:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839474; x=1792444274; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=aX58d3wxyfWAj/pKjRcwECLPPmGI4L6iIb86qlI2+8o=; b=ID+3JF7g5tIBol7vhRSiTGqxXbQcp2MaesL3JsF0tpqwcLmM5wq+FOLTEHBh8v1z9F KI9dTEZhxgmVjMkQA3nwid96VI9K/0AOgFCTkYGK35MIuUdyeqJD97xUpr4n69n9CHcr ykyI3tHbGG3dVI9A+9HxObvpUx8OiOUuMEBULrKhqTAeI7I5bUeHErjOeXfJv1guTN57 Qy817+87Xm24UsQu1WuPr23Sf+SBp03OShvMuKSL48WZ1X3M2/IlQnec/JX5pVY7Nmb+ HDJRPcKF6Z5fIhJESWLImseS8BSlnuMPcBuI6UJWFDe/hc6TrlcgPtQbyvglPLz1/eu4 jzkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839474; x=1792444274; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=aX58d3wxyfWAj/pKjRcwECLPPmGI4L6iIb86qlI2+8o=; b=pdlTgHKzgpPN19UOzJbxT8WOsdbcFPi1tbR2p9ygFVcnB7x2pwHr5yp9ZtVuheR7kZ xflVKfewmGGX9EZI9ETSlES77vGU4ONYeZUnv6xbrQAvEmS+xUX1g4NHJHXU4u/NWpCF gi2tA8pOsGimV39WwruiLwBCVidd+rsbh2v++92hxz1hlRyiCXayTVlyuLWm144wTN6i WgzhZPjKhsvUZ920caUHv2WoHhAiiWglO+37jF4iPqN/sb9CvR044wNNgZ2r8A58H1Ze DgTStnbxhfR5DseJ420m3qF8KvAW5WqyYs5eIEE5xXAfY4sZ7e+pa5lRVqrSEsa87gfG jyNA== X-Gm-Message-State: AFq9FYLGjFaU1x/M30wcOabajq+7e9Qs1jgLDASVc8hPHTIInf7rekid B5xLBQoq8aQ+omLFH3Ryucl5gnPnoKH2H3GnPHS3law7m7sKW8SWmDaxwaOahKay X-Gm-Gg: AYBFou0i2rJ9kwK4kZWbGl3OYIYw0eonPpEkPjQWpkf5ztteSc/0h2Z6FuGzv+Mp0/C g4SsqsVNU8NoMsYljbEjIMutIs2602VdLpu+5MMm7zhKgcyQPChUJ8koZ6JIo97T45MUfEPHDdY yPy95kIhrD8uRXE95AhzzJQKDh5EI/7uQm6qnT1m9Ar/bGSQ89+808fzcHXlIyP45pJ4YJhzbBH usBcZHXiDDQpjY8CHWzxfumqUv5BPdp7yV0Q+XbKEwAJpK5jdf0a2g0cV8hvnzUDYyz/fimfLlF bZ90OaB9EjGpmWMNBXGuzJyGxGZNWdEnYWciRmWJvliOD9qe5ra7hCLlKUKXdBOvg2ZKkkirSQZ ++xmY0NRYT8/PNc1EfsyK8FnuRR/LoeGjCo9O1WeiOQ+l0vUXJA2o0DWxY3dcpVUecgGydLrAIC 7b8acpQ50xk2bTzuC3tBMpNNNYgRuWcbq6jllbXpkbW3FgHNYBhLyjJ5/hkkgu906juBftj0wKb ebxLfiBNciZ6/4Gb95qkWoapCttfXWTfNkeAVjRBDkeAijKzw== X-Received: by 2002:a17:90b:568b:b0:3ac:17c:6e89 with SMTP id 98e67ed59e1d1-3ac017c701bmr2389849a91.19.1791839473795; Mon, 12 Oct 2026 14:11:13 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:13 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 22/43] libiec61850: mark CVE-2024-45969 patched Date: Tue, 13 Oct 2026 10:09:46 +1300 Message-ID: <20261012211009.3352822-22-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130792 From: Ankur Tyagi NVD[1] mentions commit[2] for v1.5 but is also present in v1.6[3] [1] https://nvd.nist.gov/vuln/detail/cve-2024-45969 [2] https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33 [3] https://github.com/mz-automation/libiec61850/commit/d1ab50298fcba3f87b1e58dabff92f8615b14ee7 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit a7088b0fda5d269721e5d3f16ae410062b9b2c8e) Signed-off-by: Ankur Tyagi --- .../recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb b/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb index d2fbbc53fb6..51ceb5cf02f 100644 --- a/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb +++ b/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb @@ -35,3 +35,5 @@ FILES:${PN} += " \ ${PYTHON_SITEPACKAGES_DIR}/pyiec61850.py \ ${PYTHON_SITEPACKAGES_DIR}/_pyiec61850.so \ " + +CVE_STATUS[CVE-2024-45969] = "fixed-version: fixed since v1.6.0" From patchwork Mon Oct 12 21:09:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100510 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A2A1CA9EDC for ; Mon, 12 Oct 2026 21:11:17 +0000 (UTC) Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5111.1791839476777346842 for ; Mon, 12 Oct 2026 14:11:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=cF7pQpe+; spf=pass (domain: gmail.com, ip: 209.85.216.45, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-3ab450c0873so1835202a91.3 for ; Mon, 12 Oct 2026 14:11:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839476; x=1792444276; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Qm9oNQgB0SDyAkc7HUVwto23Q5hQajfQWVxN5SEl6r8=; b=cF7pQpe+LFEUawfTqIkUvKIwXIXpjg7faU6TidJ+8aIyDcJO3E8JLNaL1Z1cp3BFed JdsEUGL5I/cJC2Np2KZVVfKkBMZKSkF7Rd8uuFdkXmu5t2tkRAd6/ipuyuQJ4mO2BLAe HCeqt8eNtbByAuRa7lupO57v140NNRcFOjSQAMWHqc/Tf3I+gIkIqiPC9Gq11RRwpzgV uRhdtDLGcyz9PwIIh81Ck4cTIeIovektD5Fe1Ye4NyFjDxuyJBNFap3gC2SVTR+RJDJD Zql+Xq4azjdl8EnrPdX2QVAFQZAxPf6QLRbtKtZLv0z6vWBKNsHs2D7PVqXuj7oyGgNX 9xjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839476; x=1792444276; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Qm9oNQgB0SDyAkc7HUVwto23Q5hQajfQWVxN5SEl6r8=; b=wTNp1sJh/MTOqTUGA25Uk3VY7HfF1ad8Nesnwzx79fqTAwNYIRVjhQrucXjOturT2D MxZE14cy8Fzj+J7Ln+Nzd5FjN6JjmI7z3rT+URHkauiZUjIuNjfEFFPUPi1U/z2ybZD/ oQV0SgKkk/sQwUoTVRZULliJ4iKoDIFYQJlwqFeq9DbcPVL3qmEkfPhKnnO4MilhFqp7 WwDZ6QkWlkRUX9Io5Rg4/4ns6P0m5pHza8Av04eBjO2l3PZC+oP2YohmlCTNDQM1phRw vYEsP8la4qhSFBH/agkkS4t3VdAf4lh8SLHmD7QE2Hd+8n7yXXPjgkQEHajFe6fj52Ue +6iQ== X-Gm-Message-State: AFq9FYIkTUpJlR/Y+u3oGcY03mkPInCMWOemuyX67F3cqmHte9Jshy0a 26F1eYFz6IixH9aa0Y1yEalmffkOv1YY0/HoG+aJ4Vt7d9rjbnba/yTSAIr1DWj+ X-Gm-Gg: AYBFou3P4CI3bHLsSV9s9V69ImRwte4zJuT2Gq40AF3OWbMfdrIQ3RZtwvqZr5y4Lqg mrwIeHS/vcNIUUF7CqH0Cp+SI96qBAsa1ZENTStMLUF3JbG0KHlye87HHdnNDA62WP25zQMejEC kIEOcBaeHoC64VRGls7gnWK1ENxr0y37hY03/5uhcWAs9WUWt/9DMrObCPUjbOGACXSZ5kUyig7 7ioD/UFN0IbOo5cZHVhjvhTQXjEhq7KyoQi/bXLNdwUTgTT6Ix2hRvdNvNDDjzOV8rmP92Z+/6v qH7gKmcTC1Qs+ImT4rVPm0cyJKZA9e/UxCH8vzfFZ9W9DqqcmnuPvCWfa/mjFVxQ61yjLdsgEly wsRBrckpWtPUtN1ldN3Hfu3czV8GD66avvak1wUZyZ/zVC04qiLBa2Q6FGIXqsVaS1x4mQWo4QR 9knIR0BbBkM/6lqvTOvEICGDOix2BexH1Yg9+vb2q9rVXptwjLKXHrZ/YDi4qJDjrVbTdE8/85H FXSFcF0G/lSGUwGvcIBWLm7YutmwYsI3aNne+k= X-Received: by 2002:a17:90b:4d88:b0:3a4:a850:6982 with SMTP id 98e67ed59e1d1-3ab3a7786e4mr9277852a91.26.1791839476133; Mon, 12 Oct 2026 14:11:16 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:15 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 23/43] libnfs: patch CVE-2026-53689 Date: Tue, 13 Oct 2026 10:09:47 +1300 Message-ID: <20261012211009.3352822-23-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130793 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-53689 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 6ace2f0b5e54469c5e9fd8b99412e8f412128458) Signed-off-by: Ankur Tyagi --- .../libnfs/libnfs/CVE-2026-53689.patch | 34 +++++++++++++++++++ .../libnfs/libnfs_6.0.2.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch new file mode 100644 index 00000000000..0c624c72199 --- /dev/null +++ b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch @@ -0,0 +1,34 @@ +From d45a7d6cdc899ac2a62abc21280d674ae91ae0ae Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Wed, 10 Jun 2026 11:43:28 +1000 +Subject: [PATCH] ZDR: check the string size for sanity + +It could otherwise cause an overflow in the bounds check later. + +Reported-by: Nick Hummel +Signed-off-by: Ronnie Sahlberg +(cherry picked from commit 55c18ea33a83d667f79f0ef209c96895795c729f) + +CVE: CVE-2026-53689 +Upstream-Status: Backport [https://github.com/sahlberg/libnfs/commit/55c18ea33a83d667f79f0ef209c96895795c729f] + +Signed-off-by: Ankur Tyagi +--- + lib/libnfs-zdr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/lib/libnfs-zdr.c b/lib/libnfs-zdr.c +index bc507eb..cbdb650 100644 +--- a/lib/libnfs-zdr.c ++++ b/lib/libnfs-zdr.c +@@ -305,7 +305,9 @@ bool_t libnfs_zdr_string(ZDR *zdrs, char **strp, uint32_t maxsize) + if (!libnfs_zdr_u_int(zdrs, &size)) { + return FALSE; + } +- ++ if (size > zdrs->size) { ++ return FALSE; ++ } + if (zdrs->pos + (int)size > zdrs->size) { + return FALSE; + } diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb index 49617eaa294..8068d35e1ca 100644 --- a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb +++ b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb @@ -5,6 +5,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=825301ba17efc9d188ee0abd4b924ada" SRC_URI = "git://github.com/sahlberg/libnfs.git;protocol=https;branch=master \ file://0001-CMakeLists.txt-respect-CMAKE_INSTALL_LIBDIR-for-mult.patch \ + file://CVE-2026-53689.patch \ " SRCREV = "18c5c73ee88bb7dc8da0d55dc95164bb77e49dc6" From patchwork Mon Oct 12 21:09:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100516 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9CC6CC6B03 for ; Mon, 12 Oct 2026 21:11:28 +0000 (UTC) Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5077.1791839479545545545 for ; Mon, 12 Oct 2026 14:11:19 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=B/muw4aX; spf=pass (domain: gmail.com, ip: 209.85.216.48, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-3856d6fbcb3so1195602a91.2 for ; Mon, 12 Oct 2026 14:11:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839479; x=1792444279; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=IFyHMMfDcpk0PFp6O8K7ZmTSmldNP8zLDG3pTHQX+ag=; b=B/muw4aXUJR+Eh7pRixSezQ0Fea8RYdkxCEJwjxC0WSJF7EhSCtitAbwgPFiH6lbCX 6VYYnWJwIzQb8nvdlMPRcoaPnVFB78RyjN+fWf0aSh0Pdj7IqFgdojQjqBV7axjLY5t1 SASZ9ibcFB+D5hAp8MmP7qzlk79EYeRp9OvoF6rTpTWHJDckjmgQ4AN2UZlNiiAMn6sT ac3uKLzvnRswl44P+RHe8uzZDvHE0utCCjdHBjU+XIlZXl3R55xgImIbmQEtsrbDbV9B cfWSXgLVajU0mEQ7sBAC8PmBMDRlk45m+PUG1HXvIRrCusxgOwPWwWfS1acWO0cqxUcS YFNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839479; x=1792444279; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=IFyHMMfDcpk0PFp6O8K7ZmTSmldNP8zLDG3pTHQX+ag=; b=iDx+bjNjhJ8vQ+ZTkoYgFuVq4KYRVp8gM59Zq8+RU1nsZFRk0GXuGwBRhC5l70uADc /rTg+HcCM009mfj/m0jKBVQ0a46EqNk61pbum0lhbPIodXZ7wLRTwnfR20/tCBfiAaE9 RAzVVRdw4c24YrfXkFqlYUvMdc7icFoW2ixPtaxSXvuyeAL4JgfHZalZITxd078b2Ac0 WVhAzFGNhLnLUEp0cKk0eUibiYyqfiI9J1UHFE6WAQnfV5ldRq9/EdBUqUpxTxN+WFSe emN8YHWCTin7W3BfluD3h8+lzCkX9VAqgewer73oB+n+3Vgkt6EHhFCx++/jtS5iOSSL qF9A== X-Gm-Message-State: AFq9FYINWDz8hp6anFf6lmOfXWJtZunyiLCQSNTc4V9IoLvMtONWv083 YT8mPCI/O0a8Wn1mBN8GmpnCXHhzjB7LDim4OrjPWLZQ+pvNNbtVHyIBgrCQtytG X-Gm-Gg: AYBFou0TM9GU6bFojxWEX1hEE/vE0ZmdPe2wcz9HFnwWgKdFUwvOB3fKxKmJfpIVxDp 0ZIrJqBpgoxhJQRLgddTiHk1pPtNyQjv3qLObp4ky9Germ9SswOFwcvv9/fqmnuNIKs9Q+jZKu2 +jQsdJva/XMGvlg44ux34rytyjRYT7NRZ2Y5MaUuY5sbxVLLgGiQTprsooncpqNZnPoWJK5LIXh lg+AyIZxYVxJps0yhA5Aux3yS1gU9LJg0xLQB+pf1hi2AKnYCn+bMqw7c5+bAsgmJxW2ifZJz0G tdzaBslcKK0qDkAX/RX4s0S0YSJOxKIGDRblOdc8/EKrJvZP9R7HYrnoRVjucbtlHrIMrIu/4ya 0it/J/BzTDNdOWPLJxc4+YxlZcfBgYDueLqwcAZEwdbWFQXJGOd6DJBa1A1KuD4hrVV84MSus3X qlK9z/+zLN2wxASGItNnGbJPDPeQWCB+RY8IMp72frTRgHmVK9qokf/1qWSM/JDn3UCR9XjeV7I c0MCi8saxgRWFZntb3wTl8etzIQnBmLtQw3p5Lyitqe9JQ8Ow== X-Received: by 2002:a17:90b:3a48:b0:3a8:7096:9b48 with SMTP id 98e67ed59e1d1-3ab3a29185amr8986031a91.1.1791839478882; Mon, 12 Oct 2026 14:11:18 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:18 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 24/43] libnfs: patch CVE-2026-57918 Date: Tue, 13 Oct 2026 10:09:48 +1300 Message-ID: <20261012211009.3352822-24-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130794 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-57918 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit bb3f5628f16b0ccac36287f6355c95000233c57b) Signed-off-by: Ankur Tyagi --- .../libnfs/libnfs/CVE-2026-57918.patch | 34 +++++++++++++++++++ .../libnfs/libnfs_6.0.2.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch new file mode 100644 index 00000000000..27c99b5704f --- /dev/null +++ b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch @@ -0,0 +1,34 @@ +From 589568b88a06d92b298ecce563ae57b5fad91238 Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Wed, 10 Jun 2026 12:21:58 +1000 +Subject: [PATCH] socket: prevent an underflow in xid + +if the expected pdu-size is larger than the absolute pdu size +from the xid/record-marker. + +Reported-by: Nick Hummel +Signed-off-by: Ronnie Sahlberg +(cherry picked from commit 935b8db712b3c6649bc57ddc276526c4a31680de) + +CVE: CVE-2026-57918 +Upstream-Status: Backport [https://github.com/sahlberg/libnfs/commit/935b8db712b3c6649bc57ddc276526c4a31680de] + +Signed-off-by: Ankur Tyagi +--- + lib/socket.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/lib/socket.c b/lib/socket.c +index f51ca4d..8e38eb8 100644 +--- a/lib/socket.c ++++ b/lib/socket.c +@@ -929,6 +929,9 @@ rpc_read_from_socket(struct rpc_context *rpc) + break; + case READ_IOVEC: + rpc->pdu->read_count -= rpc->pdu_size; ++ if (rpc->rm_xid[0] < rpc->pdu_size) { ++ return -1; ++ } + rpc->rm_xid[0] -= rpc->pdu_size; + if (!rpc->rm_xid[0]) { + rpc_finished_pdu(rpc); diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb index 8068d35e1ca..ef99118230a 100644 --- a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb +++ b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb @@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=825301ba17efc9d188ee0abd4b924ada" SRC_URI = "git://github.com/sahlberg/libnfs.git;protocol=https;branch=master \ file://0001-CMakeLists.txt-respect-CMAKE_INSTALL_LIBDIR-for-mult.patch \ file://CVE-2026-53689.patch \ + file://CVE-2026-57918.patch \ " SRCREV = "18c5c73ee88bb7dc8da0d55dc95164bb77e49dc6" From patchwork Mon Oct 12 21:09:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100514 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC89CCA9ED0 for ; Mon, 12 Oct 2026 21:11:28 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5079.1791839481998679206 for ; Mon, 12 Oct 2026 14:11:22 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=HJKRsTVx; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3ab9268d90eso943392a91.3 for ; Mon, 12 Oct 2026 14:11:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839481; x=1792444281; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=E5JilhUTxMtWz8C+tADtofg5K8PQsEMD8sLFp2LpaKc=; b=HJKRsTVx4VihyfqK72EMAW3mlyiGap8gPQuEZ2DAubcb25tA5p/e3GLJjr2jSDAHhf tSlqf9Vt3X5Js/Tgz0rr2c2JVuwKbiLgxe/1wNB74+MZ7iCIMYF8hN7gXvEM1/HYSbcp 4yHgeuoG4Uq/iI0fYliPfvT+BtpiVrla5gKeQeUp5yw9vK9wSBf2Foep7M1XRZ9O3aVJ xz7T+w4wzGRWewiIqjJeRaJK1MNYIx/zQnC2WrNGpwFpkFFxeGrEI+kNmH/42IVq6Oz7 6qB4OsEhpap1uHqVbPzkdEXKEzQv6RTidn4Sbn0wuk+hfpMN6jqPj+wBe6mBdPoqteNN bZQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839481; x=1792444281; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=E5JilhUTxMtWz8C+tADtofg5K8PQsEMD8sLFp2LpaKc=; b=SDUACDP1VnZk0wonCIceLEjK1PQuAe6UViwZLCAkMc3B2wAsX5eaPPMokGkBOiWLUN 45We88Td6P6p5FilrpHnXwSfpgZfziBEo2HtU0vkb+GL3Ezr1N20ubNqOfs2Dc/jVYg7 KdAkYaggV0rOtwb/TRs1XdaDsTEcW+vF/2HeDDn6deRNIWXIylfl3HL+ykFeF1LvJGR8 XMa6920+JlJdDLRHmH/Wp+ado1ekP35GABU1Fj3W34dzyJ0u6xFBIuQ0+bSc/Z/aGw5P gjg9wOpsPkFJYcWJvY7PmgD3+R+29GG6BjRF7OezIPgL5vmUu0gfM5iVEmZXkMKON17Y zksQ== X-Gm-Message-State: AFq9FYKK6HuoxRpNj/OEprdCRxUjDs3umweeMIPbSImNdNb7ln6fJQ1T 9/ueNhJB20H/DoYk160EEkUg/qjT4UNhKT/ThXWksWHpbpaGKTl3vAsieexmdDP2 X-Gm-Gg: AYBFou16qTXCcj4rWLzlTnNqwb0BtnUqOq0+QaLpwUjZpcEp8u4KLfsttFJ2zl8tSGF SDh0qG/JsqCWpe4trYZmEcojVqxsVJdxaPcAvuGffDpMaErqbiFnT87EvTxxDCnC7r2GxCsorWe TZdbC/sKX9EhpsPhXFe9UCq2cG+H3gjfA0LC6bUGDxAZfcNeJf5pc+5p33nPtwgGSgtINS5cW9E MZHxCm9z3dzevE8y81/H2AjnE7FG4iTSCvRCaWySvVSf2cXfX/c9moJczcUdn/ItM5qEOfZPf3n hOEodH0v+5PVr43bnCHupEWApny51VITP69wwnYTzyMBlI1U7tow/Bujo0wdEZ4K032H58fEP94 QcR2ZOhz21ZG3kLQpIr5j/NhqHcmD6EbWzJh0O3Rub532Xm5fAEY6xjIkGseNn9d8yRCo9ASuJE ALkVxszDOXX7TZtgYfaKeK1KpvTcDivQqNDvB4H9jbb/mZHUTSroEAYEL/C1mIDiCEHsmQMWK4h 5pcSt66UrHYjfz3HiVEz6e5U1QB3gfKtsqT1MAFqNGj7EdWGQ== X-Received: by 2002:a17:90b:258f:b0:3a5:c08:4c41 with SMTP id 98e67ed59e1d1-3ab3ae368c6mr7775049a91.50.1791839481370; Mon, 12 Oct 2026 14:11:21 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:20 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 25/43] libssh: ignore CVE-2025-14821 Date: Tue, 13 Oct 2026 10:09:49 +1300 Message-ID: <20261012211009.3352822-25-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130795 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2025-14821 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 6541aefe606686445b5f7c7feb7eb4dd78ce5543) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/libssh/libssh_0.11.5.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb index d2f5072d1e1..738f8b17311 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb @@ -48,3 +48,5 @@ do_install_ptest () { } BBCLASSEXTEND = "native nativesdk" + +CVE_STATUS[CVE-2025-14821] = "not-applicable-platform: issue only applies on Windows" From patchwork Mon Oct 12 21:09:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100515 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9D9ECA9EDC for ; Mon, 12 Oct 2026 21:11:29 +0000 (UTC) Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5081.1791839484304334728 for ; Mon, 12 Oct 2026 14:11:24 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=rd345ITk; spf=pass (domain: gmail.com, ip: 209.85.216.46, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-3ac397836fbso162715a91.1 for ; Mon, 12 Oct 2026 14:11:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839483; x=1792444283; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=qVITSVbl7xeJXRH7g7Re5urKiKlSHDaSKBKFmBAleaM=; b=rd345ITk9QP2t52drO5koV/p6/3KMr/bMGH3LRe7HwjySki/DgqntnIs57CiU/pwvb e69polfG0nkDruXdOi4GS+jAEHP1x6emQxd93n2b9Xw4OUA865MSMsAaynSAP3BNH1jS /3xcvAP4xJgoGmPXL0IcZ+HXfUGorMN1im06BnonGYuNyOxlf+waMlRa94Ag3QeZMt95 Y1yBshBENMWNFl9bI2zTnLkLrUdmluekszjtOxiPEeASCf8P9A0ykKtGWVH2LHQU00i/ EEFLHm9mhEPfiNVliV7ICwv08cZVRuZv9Gn5yqhlEwLzbd2WzZSTtdrf7ePRrXh3eVww cmfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839483; x=1792444283; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=qVITSVbl7xeJXRH7g7Re5urKiKlSHDaSKBKFmBAleaM=; b=Rxa3wo06Bj9ADQz+JNoUl5NQ5aTe7krVsNf/9KwPz9wORA+LMeyrfLjRcXTC6E2QOd UR39GPsTKlbNOkc8vVo9A33rE/9PVbaG+e9kl3PJdnzknhVk7HtKpWfDqBWfmz5DScLz e4aEpGMDfyBzoFo3k5c1mTi5E5rAm4tQuF2sWccAmHr/nyJxN5SFMN8RAa49aLJiQ5wU O6nY12SKyYXOvinxRWXkFkUTsVOdg010HHsToGoPKAF84l4M/dvyGJY4EGxQNXxeuXu9 Ku6OUjsDgG/gAaPrXIuIuoCbza5ABFByMqA0RPJDLHkYmuHuj5YDKtxtWkeRDb8LuAqm KcsA== X-Gm-Message-State: AFq9FYIKZeRlKUZxmqacCeECU0XQwgd3p0//2Sb9eq5oBEvygF4xZ9d7 cxnKt3QRNHwz6M1Jh8M2/teaFCraPJ+4XJj3hsYJQwxZ/ozTEMb+kl12XfFZeMLg X-Gm-Gg: AYBFou3MJ2U59sfi2cGBiyGc/cZW9M9JJ3xjP8bb/4OMD2jDoO5rJ9X026OKMRX2rH3 e+C49rIE8Dh52HK/UNMm1gQQhCFu9ChEg9HKYMDI1VapLAHToau/eWL98l6DVoOY9cYM1OIpLSC bSB4h9ecEgi9aRzCbb9/wIeoXSeTfKRjLuiARchT60hUN46gEfOLq857ADiGNAKqitnFTb9G4Vs ADvUT+sTRKw8uSMIotR0liLP50FZ9YCsB/drcHI02/5fiM5vgXxfzp6KL5+f7eC/wfabcSZZOYc 2fcn1EifVWcKIVay/GNUER+w/9zRm7p/850IAbedFAeJsW3UdLb7OunNUf/5qpuhQ5NENpf7NIE uVLthu5RjQGZkBC5oRfNzDFNUswEbwwSSV/aMIJepCXoKSqpT39bt8mt4XF9wIubeWp7nXiyN5c naFt+bIst//oCMiX+Kuqjqrvw8/w1DXLDjQRPa4JuT8tfDc+ucFIvDDdxTCFL6WAyIbR22rN0LU 2kIsawOSV59MuGAxFaj6DmxNF1/Bs8BOqqwEoo= X-Received: by 2002:a17:90b:58ec:b0:3ac:17c:6e8a with SMTP id 98e67ed59e1d1-3ac017c707cmr2868044a91.51.1791839483556; Mon, 12 Oct 2026 14:11:23 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:23 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 26/43] libssh: mark CVEs patched Date: Tue, 13 Oct 2026 10:09:50 +1300 Message-ID: <20261012211009.3352822-26-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130796 From: Ankur Tyagi Changelog[1] also confirms the fix. Details: https://nvd.nist.gov/vuln/detail/cve-2026-59843 https://nvd.nist.gov/vuln/detail/cve-2026-59844 https://nvd.nist.gov/vuln/detail/cve-2026-59845 https://nvd.nist.gov/vuln/detail/cve-2026-59846 https://nvd.nist.gov/vuln/detail/cve-2026-59848 https://nvd.nist.gov/vuln/detail/cve-2026-59850 [1]https://gitlab.com/libssh/libssh-mirror/-/blob/libssh-0.11.5/CHANGELOG?ref_type=tags Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/libssh/libssh_0.11.5.bb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb index 738f8b1731..a99c4ee788 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb @@ -50,3 +50,9 @@ do_install_ptest () { BBCLASSEXTEND = "native nativesdk" CVE_STATUS[CVE-2025-14821] = "not-applicable-platform: issue only applies on Windows" +CVE_STATUS[CVE-2026-59843] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59844] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59845] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59846] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59848] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59850] = "fixed-version: fixed in v0.11.5" From patchwork Mon Oct 12 21:09:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100513 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 377CBCA9ED2 for ; Mon, 12 Oct 2026 21:11:27 +0000 (UTC) Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5083.1791839486346820519 for ; Mon, 12 Oct 2026 14:11:26 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=YqDSc0pC; spf=pass (domain: gmail.com, ip: 209.85.215.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-ccc7a6070b4so1009218a12.0 for ; Mon, 12 Oct 2026 14:11:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839486; x=1792444286; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=mJjzH92AJS/YH2ce8fGIUYLPv66ZYgIjH7lmFkApzEQ=; b=YqDSc0pCZla6NZSSYuHQgtLoIrnl2wgl3ILv9915lzTsKNRo+8b+A8is07UfzTNR4v IozMCzD7rr+wl3VrVfexe/Zv3Fg7LBK/OkMjNtcVQQQLy11fTK7onfozCrlKfJE0fHy7 8uGKL3D0LMrtnqLined0xtryJW5hqQwsYJtEdELb9NfC7Atnmd5c5Vh57J4v9a58B8qA 7kqYJRk9alL7Dn+IsQREbe0VdTs9ed6KHeUls8TIQ4d64eWw1Ndt9RpjFVsj0JydcVZu DI/PxM4fv86o28jLPo+ER15NbjhjT5uiVyVjWytcmI/zq/dWtmFhRdVwKcGER2dMnNMQ qecQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839486; x=1792444286; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=mJjzH92AJS/YH2ce8fGIUYLPv66ZYgIjH7lmFkApzEQ=; b=tV4JsWo/DpaviqaVgaZ81bzjJO0Y/znPMX6OUmGgztA6WdnVDS1L7gvD3ebxfJyKJE zBsOwNXzLBRwIqr5+YSCYbDvoq9VN/t+IVpA60Mi/oGLnMZYtruyMAXJYxw15F1omNIT MY9IMFY/1cDGd25pNEAeRi7yYGMudl5ea/fY7CU8u3rVEprtanYUcjHMyJrAkwbkfhCy js5uKB/XaxZ9bz3KrbTW0KV+HHuacudJ1IV4mxgQyvbuh+jo1eiVG4tM2p+DOjsB8d6+ 9tjQn75oFVdNWrr8l/ryLwBFNGusJEoqHZeIxA0i1Abs0zrStaOl089JSdGFE0/xJDaf jwaw== X-Gm-Message-State: AFq9FYLTpcA66jvWNtZecpUTnbQ2W8h4vmlQEBO9jJPxIFiNxlwZS8uA 7BJqj0wFJCsdQzBOAcQq6sGeqbcxkH52EYmFbsMh3dnuCEUvyISB+wCxPRX8gUTP X-Gm-Gg: AYBFou2h6qYk1SSZF6GMqRqRnfAmnnYCTPa2kVGLHebOqe8E5GNFvX00oFgqaZQOSwd C3PlkOPbmOzD8cJJyDC8HxpPx7BJnEkbZSTF283iDagZxHkkvgSYrxzTwYJlDO0tT4j+0RMsx+E 88+5HhPhkhkDiFfLGeYIKHIRGLLEEoxyGJsr/Jzb5E9n/czFUsFELSZNm0DnT3moz8fBuaI79BJ hEwqNa4Ltk/Obpnmo/fbVlgAGNxSw2BGgtDxRYApqI7AyrnZ9vKkTIk2ehd+7JbEYqSI4JHLpVm 9cOxCzgN3dXP8OtNcc/Z9xDsic/GJ1n1xwc0e+K2yIxjSfZ9Bc0TX6ObFFjh3qmT3fOEYzTDL4I EV2CKCgp1H/5JK8jriEaYdpS/vVFhzDrGyyTkVrug88Fy8Qq2mFfbGDcepsQpAVDUosRqRORAxY vc2961jiBgaJsJXHKJGTQQ15N3lFMpZQq4xILCoBWCKVwBaDTJ6i89m61FAuxtNhgukjgMmhlzh 9YM/n29VX5xs6OduK6TT9s1W9AB/Qhw3X9LUnw= X-Received: by 2002:a17:90a:51a7:b0:3ab:5832:72af with SMTP id 98e67ed59e1d1-3ab58327370mr5612857a91.32.1791839485708; Mon, 12 Oct 2026 14:11:25 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:25 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 27/43] libssh: ignore CVE-2026-59851 Date: Tue, 13 Oct 2026 10:09:51 +1300 Message-ID: <20261012211009.3352822-27-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130797 From: Ankur Tyagi GSSAPI Key Exchange was introduced in v0.12.0[1]. Debian also confirmed the same[2]. Details: https://nvd.nist.gov/vuln/detail/cve-2026-59851 [1]https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.12.0 [2]https://security-tracker.debian.org/tracker/CVE-2026-59851 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/libssh/libssh_0.11.5.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb index a99c4ee788..a67956df88 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb @@ -56,3 +56,4 @@ CVE_STATUS[CVE-2026-59845] = "fixed-version: fixed in v0.11.5" CVE_STATUS[CVE-2026-59846] = "fixed-version: fixed in v0.11.5" CVE_STATUS[CVE-2026-59848] = "fixed-version: fixed in v0.11.5" CVE_STATUS[CVE-2026-59850] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59851] = "cpe-incorrect: vulnerability doesn't exist in v0.11.5" From patchwork Mon Oct 12 21:09:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100518 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C763ACA9ED2 for ; Mon, 12 Oct 2026 21:11:32 +0000 (UTC) Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5084.1791839489180968032 for ; Mon, 12 Oct 2026 14:11:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=byju2a1e; spf=pass (domain: gmail.com, ip: 209.85.216.47, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-38759bcd877so1300898a91.2 for ; Mon, 12 Oct 2026 14:11:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839488; x=1792444288; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KXbyCa13wnvjKK6vtk0O76lvNis4Bh3iBUF4NLnhi2Q=; b=byju2a1esIgZgctmcKVQ9r2SwgM4fsRUYbFjAab28o9TMwJV1WGBFYyEcWlu4b5wXp Z4nOXvYfj1gs8qZo7u1wIR0wrx/CDsP4cRczOLu0qOBEaW4aBIs1o/hVKamKU0QcIKxn XMg4yCYk6nHjUUowpygLKEOXF0h9VntRnxJLkj7sT7O1Z48G9pWjQgrnvnOzObo3eyyb AeShrBshtbaaQrFW4Pv7roGMUH4yNQY/NAcijAfykhWd+BufWKLKiMLsYDjDNxMzMMcp xhx6XoBuQ5QJnsP6ySGXCwzyh+JG8WHAvGaU8fi5Ejug/mpqkaj6PMSyNQsTrr/woE3Y OO7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839488; x=1792444288; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=KXbyCa13wnvjKK6vtk0O76lvNis4Bh3iBUF4NLnhi2Q=; b=yLeyEPPDnqsavUXGkQ4CTE0q3BxIdDacB9SlLnRU9lOl0f638dAEItub5rtYXor1Hm WU87z3vGVFBC7aILtLVb0kuySHQDJbM7o8jCN5tB/a9hOKGP6ctzkvy1bR2Lecs3ccB/ m2N5IgDDMI29rs3gHRMxc5csHpBkPMMEJgYlHEEhA3ORpgsVf4Ju1Nc3U8U+1ktDxf5M 3j2t4aJD21qfknhZdSmSf0aV2lN9eunSDpJleBYgTI8qYIpmrx/tvD0Wg9RT6DJw1DxQ k4b1UGIWaIwOeqoIg3mGnjpb1MHDAsrOqZ5qKGYDRZC6Elx4YIS1FiTq8jhTwp1rFXU4 wkGg== X-Gm-Message-State: AFq9FYKYtwejRnMSgD2OAdKwM2tcWo+nVVRzXP8JgiW4hKmOgJ02gzp0 B3Bi76zX67Mc1xOwCjlz4ec7adPr2Nh4AuTW4gJeQ0rqqSx12e6a7uBp2aii+sA3 X-Gm-Gg: AYBFou1NsO2XTJzwFWfnUsekjW77AMxUiVSt6g/6X8M+eduTZVyG0BWxmSwW1TzROKo Ch9wnfXrnG3FJaPZvAykNCJCLFWNhBXrhetft0KOakkaymKe0+mxynH5pEFA020a7gbtsJVDpd2 gDDp7NUDVljJXLTYoG/h8e3RqBBePBgO9SgZmBtdd3YpebN0SEyVZxUN985VCMPEZ+yWmtHfv/s qXpB4AQzxNmwbPcrSe1GE15geFkuqppruJPlpgooPUP3U22/of5ut23cWk6sWEaapx4zbOw1VPH 7ClwQqu6Udt5xJRQuQVPXlDzV2x/7Ok+TGn7Hh352zuig7s5EbbOnx0B2So+DADh+ASUgAIr+83 +u65vhl8j6EppH2UTBXJnsAo6O6lzjhwTikADja2P7y+unnVkY/6vTJTnWeHIcExUjuFWln+CbL mPXmkLAqmVZLFfCCwhyBwvGdJwyI5tmbX78GocBqF/NyXA5nGwiD7o6b09DUBrjdfTeadBXbwqI Z/EAMjwAnHNYZetLHcOBe2gxbaS6Gr1Q4M5eqU= X-Received: by 2002:a17:90a:d48:b0:3ab:c674:cad1 with SMTP id 98e67ed59e1d1-3abc674ea8dmr2570244a91.50.1791839488445; Mon, 12 Oct 2026 14:11:28 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:28 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][blacksail][PATCH 28/43] miniupnpd: patch CVE-2026-107159 Date: Tue, 13 Oct 2026 10:09:52 +1300 Message-ID: <20261012211009.3352822-28-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130798 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-107159 Signed-off-by: Ankur Tyagi --- .../miniupnpd/files/CVE-2026-107159.patch | 78 +++++++++++++++++++ .../miniupnpd/miniupnpd_2.3.11.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch diff --git a/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch new file mode 100644 index 00000000000..fa2401e0391 --- /dev/null +++ b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch @@ -0,0 +1,78 @@ +From 8a3e282b22b16fc90740d62fe213c51696e8dc01 Mon Sep 17 00:00:00 2001 +From: Thomas Bernard +Date: Sat, 3 Oct 2026 23:42:55 +0200 +Subject: [PATCH] minissdp.c: MX: 0 is invalid as well. 1 is the minimum + accepted + +(cherry picked from commit 8f13b7a5843f5270db684099c0a083f98869636a) + +CVE: CVE-2026-107159 +Upstream-Status: Backport [https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a] +Signed-off-by: Ankur Tyagi +--- + minissdp.c | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +diff --git a/minissdp.c b/minissdp.c +index afb11ec..d825bf6 100644 +--- a/minissdp.c ++++ b/minissdp.c +@@ -2,7 +2,7 @@ + /* vim: tabstop=4 shiftwidth=4 noexpandtab + * MiniUPnP project + * http://miniupnp.free.fr/ or https://miniupnp.tuxfamily.org/ +- * (c) 2006-2025 Thomas Bernard ++ * (c) 2006-2026 Thomas Bernard + * This software is subject to the conditions detailed + * in the LICENCE file provided within the distribution */ + +@@ -1015,7 +1015,7 @@ ProcessSSDPData(int s, const char *bufr, int n, + #endif + #endif + #if defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE) +- int mx_value = -1; ++ int mx_value = -1; /* -1 => not set, -2 => invalid value (0 or negative) */ + #endif + unsigned int delay = 50; /* Non-zero default delay to prevent flooding */ + /* UPnP Device Architecture v1.1. 1.3.3 Search response : +@@ -1113,7 +1113,16 @@ ProcessSSDPData(int s, const char *bufr, int n, + memset(atoi_buffer, 0, sizeof(atoi_buffer)); + memcpy(atoi_buffer, mx, MIN((int)(sizeof(atoi_buffer) - 1), mx_len)); + mx_value = atoi(atoi_buffer); +- syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value); ++ /* UPnP Device Architechture v2.0 : ++ * MX ++ * Required. Field value contains maximum wait time in seconds. ++ * shall be greater than or equal to 1 and should be less than ++ * 5 inclusive. */ ++ if (mx_value <= 0) { ++ syslog(LOG_WARNING, "MX: %.*s (value=%d) INVALID (must be between 1 and 5 incl.)", mx_len, mx, mx_value); ++ } else { ++ syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value); ++ } + } + #endif /* defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE) */ + #if defined(UPNP_STRICT) +@@ -1140,9 +1149,12 @@ ProcessSSDPData(int s, const char *bufr, int n, + /* For multicast M-SEARCH requests, if the search request does + * not contain an MX header field, the device MUST silently + * discard and ignore the search request. */ +- if(mx_value < 0) { ++ if(mx_value == -1) { + syslog(LOG_INFO, "ignoring SSDP packet missing MX: header"); + return; ++ } else if(mx_value <= 0) { ++ syslog(LOG_WARNING, "ignoring SSDP packet with invalid value for MX: header"); ++ return; + } else if(mx_value > 5) { + /* If the MX header field specifies a field value greater + * than 5, the device SHOULD assume that it contained the +@@ -1150,7 +1162,7 @@ ProcessSSDPData(int s, const char *bufr, int n, + mx_value = 5; + } + #elif defined(DELAY_MSEARCH_RESPONSE) +- if(mx_value < 0) { ++ if(mx_value <= 0) { + mx_value = 1; + } else if(mx_value > 5) { + /* If the MX header field specifies a field value greater diff --git a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb index 42a654e3278..920d33da94c 100644 --- a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb +++ b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb @@ -13,6 +13,7 @@ DEPENDS += "iptables net-tools util-linux libmnl libnetfilter-conntrack openssl" SRC_URI = "http://miniupnp.tuxfamily.org/files/download.php?file=${BP}.tar.gz;downloadfilename=${BP}.tar.gz \ file://miniupnpd.service \ + file://CVE-2026-107159.patch \ " SRC_URI[sha256sum] = "91994b127da735b2c97f19992e34420648c0e8c4ace8a4bcb0596e7685c48678" From patchwork Mon Oct 12 21:09:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100517 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4853CA9EDC for ; Mon, 12 Oct 2026 21:11:32 +0000 (UTC) Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5086.1791839491580876719 for ; Mon, 12 Oct 2026 14:11:31 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=NDn91dPj; spf=pass (domain: gmail.com, ip: 209.85.216.48, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-3a4b9732d5aso1657874a91.3 for ; Mon, 12 Oct 2026 14:11:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839491; x=1792444291; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Nd5iME4DHBJ20zDw+3DocSsaOXDxJpLV+Hucf4RLi2o=; b=NDn91dPjXvZJOgG9opoGiQQnnhJPR7UYDAMPwmuZsF84z56jikPfvu6Hl77D6BN0Fu ag4h7A7w0gBwiTzBzXvyi6vOoDicdEums7g8uDylVay0jjwVOVS06oVgL6ReyYSR5cFu 5C5wk/le7ez8Gc4MHZ3AbtIgSNwmszLcLZ3uPHKGHZHxPG9iBKZBHk2mFk2DaF1U4zX2 Tja/z/2uVOmpBdFVAzZi61oqA0qEwuHNQD7fUGAgzXdpfoAxz//ySIxI8lfjHYyfO2KG s3+e56RAA2PJJNONToAyeLV6TsEy4Ux/a8XVUFPNMZKt8+0UepuU+5E5HUAnjImkkLtP 7whw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839491; x=1792444291; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Nd5iME4DHBJ20zDw+3DocSsaOXDxJpLV+Hucf4RLi2o=; b=ol+jnrV9RchBcuanoGqGBPRI48m+ZDVi6tbMgMxau/3v7GdemFtuSKwX1UUPHqXPKH l0gWctc1jmtHv+gD8yG+aihb/8vojENFMXLglL3IUPXLSTDOFeLNKNWZPa2NpbHgEoe1 8pukkW7Ev/avHzhXW2ElEt9Cs0PWykFjHDdvdHTtvW0Yi58EP4syGDTVLL8RJ/w8dfLi FQ+yM9FUjaJnP2fj4Xv5sIhR7IncW6ShzHduraMxUQsguSz7hT1P4ImwdrWgo6NT80y8 99RXkPchWvzkNAr7zBA/Gxb8xxW4C/fRXp/7EzSCqN0VasmAZcJF6fHBtFl3MFa0qHyu t3qQ== X-Gm-Message-State: AFq9FYJG2kR5bQJTT8eEk64HVuRQkq9vic0tIifJzXfu3tT+fKwpbLp1 vYNseYdV9C0oeqxnAVHLZd+DJWSwPP6fhLJe0TEBkWxCblEr0dL3qw89jYXPSw+X X-Gm-Gg: AYBFou2sFWVqvFKWTi6+XYWlYQxQudjaEvgG7CHIxDuYN0/PiGmWRY3++zCGbvv3aWi AXg2csSz5hw5vSsNQPcNd1behMuPQfjVOvkAP10hi4x0I84yPNuZww322cBC21GKGhp0wMEGYt/ fyMYnCqct6D4+f+4z0XsWFfZGGW4BCulFXtTtAwaIR2ngydJFyGOccBtuNEJYVJCB90wv7jfOCS 6YC5pg8v7wKPSyjo3vkzDnRdeiuilz8z1QoPGpBeRyZU60QBMJ/3eUD12Lcw3foW9YyEP/P0ETj yzmfXTsjq7GnO5/ftzBIT05Fr3Jyht0U77VHXw8RpWfne6f+yRmV7UBu41DrF7JBewONGJQ/fnZ BsKg1ufySvTchyqcbP5lhQE07i2pi4netDNtOEeDzzv1oBGdMVD0Ati1hdRhCdOBCH3ViZqQGmo 4yy5NWohwvAj58Y8Tll3AlSujmbGDUXWDSC1WD/Ps25FCRgVVxjGAyM7qFc3vRp3bggP7BuLljU MeNiDqy6w0ffMCZb+L/mbdfyNCBrZjco4fkXdE= X-Received: by 2002:a17:90b:5486:b0:39e:6a7f:1dcd with SMTP id 98e67ed59e1d1-3ab3ab1d56cmr9498419a91.41.1791839490911; Mon, 12 Oct 2026 14:11:30 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:30 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][blacksail][PATCH 29/43] libyang: patch CVE-2026-41401 Date: Tue, 13 Oct 2026 10:09:53 +1300 Message-ID: <20261012211009.3352822-29-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:32 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130799 From: Ankur Tyagi Backport patch identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-41401 [1]https://security-tracker.debian.org/tracker/CVE-2026-41401 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 6b06704ac1bae4ef4831384f0c28d14e98c804b8) Signed-off-by: Ankur Tyagi --- .../libyang/libyang/CVE-2026-41401.patch | 43 +++++++++++++++++++ .../libyang/libyang_3.13.6.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch diff --git a/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch b/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch new file mode 100644 index 00000000000..06537acbb82 --- /dev/null +++ b/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch @@ -0,0 +1,43 @@ +From 34b2a26ee86716e2b593c44e51e38ee15d4e8434 Mon Sep 17 00:00:00 2001 +From: Michal Vasko +Date: Thu, 26 Mar 2026 08:33:44 +0100 +Subject: [PATCH] parser common BUGFIX invalid metadata removal + +(cherry picked from commit 54c3276d871023da266d4ed3ceaee7e8d71d0b04) + +CVE: CVE-2026-41401 +Upstream-Status: Backport [https://github.com/CESNET/libyang/commit/54c3276d871023da266d4ed3ceaee7e8d71d0b04] + +Signed-off-by: Ankur Tyagi +--- + src/parser_common.c | 4 ++-- + tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + create mode 100644 tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 + +diff --git a/src/parser_common.c b/src/parser_common.c +index 0b221af72..fefe723eb 100644 +--- a/src/parser_common.c ++++ b/src/parser_common.c +@@ -413,8 +413,8 @@ lyd_parser_set_data_flags(struct lyd_node *node, struct lyd_meta **meta, struct + next_meta = meta2->next; + + /* delete the metadata */ +- if (meta != &node->meta) { +- *meta = (*meta)->next; ++ if ((meta != &node->meta) && (meta2 == *meta)) { ++ *meta = next_meta; + } + lyd_free_meta_single(meta2); + if (prev_meta) { +diff --git a/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 b/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 +new file mode 100644 +index 000000000..7e3b6c39e +--- /dev/null ++++ b/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 +@@ -0,0 +1,5 @@ ++5 diff --git a/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb b/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb index 822c30ba24b..7724b4c2189 100644 --- a/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb +++ b/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb @@ -11,6 +11,7 @@ SRCREV = "c2ddd01b9b810a30d6a7d6749a3bc9adeb7b01fb" SRC_URI = "git://github.com/CESNET/libyang.git;branch=master;protocol=https;tag=v${PV} \ file://0001-test_context-skip-test-case-test_searchdirs.patch \ file://run-ptest \ + file://CVE-2026-41401.patch \ " From patchwork Mon Oct 12 21:09:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100520 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA8E2CA9ED2 for ; Mon, 12 Oct 2026 21:11:42 +0000 (UTC) Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5087.1791839493959330856 for ; Mon, 12 Oct 2026 14:11:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=skclEBEy; spf=pass (domain: gmail.com, ip: 209.85.216.42, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-3ac397836fbso162787a91.1 for ; Mon, 12 Oct 2026 14:11:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839493; x=1792444293; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DIyg5qq8b+2UqKvFnrtqZGTXonYDjkNyPtCICmTLpUI=; b=skclEBEyWmyajqx06CO0tXBhMqvHF/O0udyd5j/piXHGf15QV3JzOIFfHh3pQ8xan2 ip/sFE7ZmNrM5VPNPdJsIGigSF0XNBbJqFkxfb6U4UsoPVoZtvdK4qexOpLGtNZsPs9C 0z95Q2DRbe1YLLlnJvErtyhYYcTHvIIzOEmtDegE0Nb1wMZPgwIEzvK2GG7LlGnTv6LQ YezmNaee8acwy/0Kjd+UHKkiHvbt9FUs0l3oYWUEkT5ChBUE29sdV2m/f7kLOLHwWlJ6 +T/J6FlH0HaRWgrYT+EbVEiTx5zQ1PnG/dey+jBSkGOFWgtoMaXOzVkRcIcMMqHIxTKR 0BTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839493; x=1792444293; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DIyg5qq8b+2UqKvFnrtqZGTXonYDjkNyPtCICmTLpUI=; b=MPYfFDEDKHcZHnDQqhslcPWL6T2etCfxrPo3y9sjDpJHAB8qvOcYxetdYVGm5S3Det Ke6CZwdnWxdP4P/WLe5qS6nVhcZoKDvgwsf/NNSRLqLMjAyTIt7W44OlYFoUabtj4IMW RuZBCUFN7kqZKMmsuqWlLfBfIqBsu5hI6TXn4Q9WJGpz0+umTsX/bPgMcl71Ut1tkxZN VuUsPJt+Q9T9BtVkchGg4CRdnwLEY5YXVAoKAoPSlGkilGumQqPU2infAz0SQ09SvH+e 0ZBXZuz8T4U2P3acu5ldtvlnHApAekEVC0Pnzg+C+eeHLMs7/MfrdfzCbtnKH96xzzz/ Tf6w== X-Gm-Message-State: AFq9FYLwhbsbiQQmWSToQLWDWYWHP72KaSAbyOO8mipvwQfNlxcCOikE G+jqbfjUVQmsHI3//3APJil5LbZqKd/ZzT+RsF6YS4RjCOjoVVdnomyTkN0qx62u X-Gm-Gg: AYBFou1DN6NBLXjB00tE7+RtwBirOsXKiAjhQxWlWuvDDPlrnLVbV6sx8zE7QlBKTvb GrWu8U02yNVFz8JWmJEW+jCKQUgGY2ZxcJnijEbW4s2Dtbxos4FfmTQUadAxPOb5Oy/ocA7oxlN 4F83U8h4xC7toqnb9mTKfQZUrHIuQrxB3qBxvEgl4THSNSelSn3Pcc85lIF+niY4wihWCJuidEe BNYIeGZewk4CCdikgzuqAICARYO8RxmH49aLYKjHNA0XgFCMeUoiBJeR4XNFXb/rnVppsNHTrt2 UUn1EFiX5BMtYQD0rI/zIB6S1CuEljYoBrReu5wRk24VW0i1OwI9LTANAxbquze0vwwmzwC5ig8 9hl6EELrjNXPgcd/IjQ+toKOTJCTKh7xngLOd2X8uNQE5Ox1Cv1egfbaxYXrEWWiZGWYIDTgpcE rypd1rzNNpE2ag/tF84Oz+2GSq7IUq3gZjmiAjPFEGNXcBaeeyFUrg3oR4PznAu0wkCAvGVXd67 SM3VZV2wKx2j57uVpaJPGnfb7dwxwVSlPwsGIg= X-Received: by 2002:a17:90b:48c1:b0:3a7:e126:4980 with SMTP id 98e67ed59e1d1-3ab3a79c42amr8140756a91.43.1791839493341; Mon, 12 Oct 2026 14:11:33 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:33 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 30/43] tinyproxy: patch CVE-2026-31842 Date: Tue, 13 Oct 2026 10:09:54 +1300 Message-ID: <20261012211009.3352822-30-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130800 From: Ankur Tyagi Backport commit identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-31842 [1]https://security-tracker.debian.org/tracker/CVE-2026-31842 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 985acd9e7c375e17a674be4c21e9e80d0259eb38) Signed-off-by: Ankur Tyagi --- .../tinyproxy/tinyproxy/CVE-2026-31842.patch | 33 +++++++++++++++++++ .../tinyproxy/tinyproxy_1.11.3.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch new file mode 100644 index 00000000000..6b8c02d6292 --- /dev/null +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch @@ -0,0 +1,33 @@ +From ed5252d213a68546feaff68e2b40e401d2c2afd4 Mon Sep 17 00:00:00 2001 +From: rofl0r +Date: Fri, 3 Apr 2026 11:21:23 +0200 +Subject: [PATCH] reqs: fix case-sensitive matching of "chunked" (#605) + +the chunked transfer encoding needs to be matched in a case- +insensitive manner. + +closes #604 + +(cherry picked from commit 879bf844abffa0bf5fae6aff0c73179024dd9f98) + +CVE: CVE-2026-31842 +Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/879bf844abffa0bf5fae6aff0c73179024dd9f98] + +Signed-off-by: Ankur Tyagi +--- + src/reqs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/reqs.c b/src/reqs.c +index 7aacfd3..8b68538 100644 +--- a/src/reqs.c ++++ b/src/reqs.c +@@ -850,7 +850,7 @@ static int is_chunked_transfer (pseudomap *hashofheaders) + { + char *data; + data = pseudomap_find (hashofheaders, "transfer-encoding"); +- return data ? !strcmp (data, "chunked") : 0; ++ return data ? !strcasecmp (data, "chunked") : 0; + } + + /* diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb index 2555d2132d9..a0ef5fd62f9 100644 --- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb @@ -9,6 +9,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz file://run-ptest \ file://CVE-2026-3945-1.patch \ file://CVE-2026-3945-2.patch \ + file://CVE-2026-31842.patch \ " SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592" From patchwork Mon Oct 12 21:09:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100521 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBA66CA9EDC for ; Mon, 12 Oct 2026 21:11:43 +0000 (UTC) Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5118.1791839496437333340 for ; Mon, 12 Oct 2026 14:11:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=npN9/5y6; spf=pass (domain: gmail.com, ip: 209.85.215.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-cc4c02ddd62so992208a12.0 for ; Mon, 12 Oct 2026 14:11:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839496; x=1792444296; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=NXyyvuUcu5QLDCsKxmVu1m7pp0gj/ECe/+J84LPSuKM=; b=npN9/5y6gFuF3dQSvd6Fiqws7bPThbGtqIIIKRDwnjrOQul9fwayhpiK6h9JoIVfyC 5EF0Pw9vH3PVuup3KUnZ3hsRWjhcStSOzuw8+jmD745W6rB3wzLWiiM5T0dpb8SneUpI bs56R3kEkoFmcHYQ5ToCHwwO7engUAxPCqeo4eoINxzC5y6M6EXrXdtUMh/f/0ngIeDB uGA+VQhcQcmM34Ep0jXjx5hWDZtWPGzNa37hfE/5tELk9vRJ/hzTLCiJMagB1R8xR8cS XLyKBkmHxw+RLoqRmQPqhvedW44mLnq4FZJ3c+FQEsBwNa2Zv60WN+FK9MYBBM3SWm9p xpCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839496; x=1792444296; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=NXyyvuUcu5QLDCsKxmVu1m7pp0gj/ECe/+J84LPSuKM=; b=x4s392j0344ovVOFApRPT8wMGtYimAs6rgu0pJzNgMWz+Ww6zSQnoEorCfaxSIGxHY Kyt1n0dnUWRAEx1BY3daCIi/4cIE2F1itb6VXAoWStChRrd9FzgXeDS7sDHEEBOp40qR iKifKkb+ePSPUGdLX04TBMEGKBeIqnkGR0U3iTvM5cidNZJr2PMSUD3RKfLgX4W9RMKN ox/RApuNtr1eiSh6T7nK3538MLgIyRCfKtEyK8R8HiCbKYuIv8c9yb+DpDvSk1g8la99 HgmuM4Y8OhOcWm/bW3TyvWCjGu4lKrVrY/kt2eqYyBhptIq1DAWupLdesGJwTYw8nKxO HuLg== X-Gm-Message-State: AFq9FYJQ6hubQxfDQ1F5fheaF1/0Iv2nQWSQlyBSzIphyvmjTiXoFqc0 pOG/b76SrhMKsbWfGOLpRFA6I5Y6MhI/TXKeGvLtAicwMxHPP9B8Wy7pRU+YBW8o X-Gm-Gg: AYBFou14217OQQ9vZXOv+xCGuM/Bs9O0IJw+PfBcKzxqxFwbtYVF/WhNWE70iduQ3sL 8henWMWigbe/3evnJ++P9E6rx/nW4FuPY9QQLuR1+9MFJn8GQoKtxbQhcSyoshH7Y8z4U2Apy/e /ICAk2TiDJ+FaSiwQ4CLe6cZHnlodw2y6E+fyVjYVo8GE0TdWkW0wARWKpoptMTL5Y9aF7+HaMX KAXGZTRUeIJnIQir7RqhaNSGRGQTPrnSE+n4LEJvlEiOukgo2guJWJKLEEAfn7Av5nytIq242y2 1FdR33u38pyd94W3Xh54R976kIwDc1UfMMXvrZECoFtBPFzHSRQ+wVjQIsRCAvo/XJTNalPN/XJ CD4zupexX4Nj7JDALWyShoGNdKYpPW/h4O3Wziq6FBYJbUmU283wmvz8ca7fgSvHnsp8j6KTPcr ApLinNE4kfiRtTOpWbBybniVbO1u4eYEYq2APyMg96Ty+j8W6p63AZFno3GoMPbZgu0FqzJVCZu PIZ/ZuYwYfzw9vf+0dSrcZiCYjgtG++9sNn2DGEoq4+GAwJWg== X-Received: by 2002:a17:90b:3851:b0:3ac:17c:6e88 with SMTP id 98e67ed59e1d1-3ac017c7026mr2593436a91.43.1791839495722; Mon, 12 Oct 2026 14:11:35 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:35 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 31/43] tinyproxy: patch CVE-2026-54387 Date: Tue, 13 Oct 2026 10:09:55 +1300 Message-ID: <20261012211009.3352822-31-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130801 From: Ankur Tyagi Backport commit identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-54387 [1]https://security-tracker.debian.org/tracker/CVE-2026-54387 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 33649b065762429d18d1d9e9ec94deedb6edb63a) Signed-off-by: Ankur Tyagi --- .../tinyproxy/tinyproxy/CVE-2026-54387.patch | 37 +++++++++++++++++++ .../tinyproxy/tinyproxy_1.11.3.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch new file mode 100644 index 00000000000..c0199c1713c --- /dev/null +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch @@ -0,0 +1,37 @@ +From a9602e492cedd5d5d18dd3675d9be90e9b0d9e66 Mon Sep 17 00:00:00 2001 +From: rofl0r +Date: Thu, 7 May 2026 16:33:11 +0000 +Subject: [PATCH] reqs: prevent request smuggling via both content-length and + chunked + +addressing point 1 of #609 + +(cherry picked from commit 623bfc093df009296f0b85d40bc677ef9d5c09bb) + +CVE: CVE-2026-54387 +Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/623bfc093df009296f0b85d40bc677ef9d5c09bb] + +Signed-off-by: Ankur Tyagi +--- + src/reqs.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/src/reqs.c b/src/reqs.c +index 8b68538..e3cfe76 100644 +--- a/src/reqs.c ++++ b/src/reqs.c +@@ -942,8 +942,13 @@ process_client_headers (struct conn_s *connptr, pseudomap *hashofheaders) + connptr->content_length.client = get_content_length (hashofheaders); + + /* Check whether client sends chunked data. */ +- if (connptr->content_length.client == -1 && is_chunked_transfer (hashofheaders)) ++ if (is_chunked_transfer (hashofheaders)) { ++ if (connptr->content_length.client != -1) ++ /* request smuggling, see GH issue #609 */ ++ pseudomap_remove (hashofheaders, "content-length"); ++ + connptr->content_length.client = -2; ++ } + + /* + * See if there is a "Connection" header. If so, we need to do a bit diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb index a0ef5fd62f9..e84aeae53cc 100644 --- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb @@ -10,6 +10,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz file://CVE-2026-3945-1.patch \ file://CVE-2026-3945-2.patch \ file://CVE-2026-31842.patch \ + file://CVE-2026-54387.patch \ " SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592" From patchwork Mon Oct 12 21:09:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100523 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA0ADCA9EDC for ; Mon, 12 Oct 2026 21:11:53 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5119.1791839498873227921 for ; Mon, 12 Oct 2026 14:11:38 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=GkufgNaF; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-3ab3260b2cdso933461a91.1 for ; Mon, 12 Oct 2026 14:11:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839498; x=1792444298; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=z8GN4om8v5rdFSVZdGpD+ZsZwPq5HhaGQ2mhYesOgWg=; b=GkufgNaFobHjaOXYFWWwDChDh+E0FsBfthuIQuSAX/tnRakICzMPGdpUSNFz7KkMgc r8/Dpwy5ljkUMIOKT5nYv8ReceOyJ0JMN7/2c7caOy+vkV+Qyz3vZVUO5D7wYxm+lSzR 0kd2SODSpoSYOTrrklyJnF/gqoe7IQdchGMnVMbWSwbZElDOxXSw20RwO+gAeEGYmh7p Yd3a5iCl26HgEYEfwyL3a2bIMUCdBiwvLGz4i0Hs0y7Qhk1Dk+2N4JY/VMYJSPI49gMu VQbI7sf/zOuX9pMswWUrwp7n48x4xQ9G0CG6Vj3czQX/o3GaL9xV0ee+v+RSWi9FD8nC x+gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839498; x=1792444298; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=z8GN4om8v5rdFSVZdGpD+ZsZwPq5HhaGQ2mhYesOgWg=; b=Rmc2+rMLri54SrxP3ikqtpyb7J58UbOBWr0dpdzFIiEKU/Vf+jPgUIG1ioLGvO9NKH JOQ/pLl4qkzeYlAORLebJjRPcEI+75tP6pNAEU8seydADND1bfQ70HFpY+9T49/X0nOH 6QtilEbJkoWYJrPJkjF0UYG3IhgP7H4tDCvtq/sy5ne9hgTh6RlmU/lkWdU2fuWhS32c LKwTcQ79L44F99z7AJgrG8kGpHjlMbxswfJR0p9ZAZ3f3zvLea8+uXncvWLFPQhO1Y2+ gap5YtzDWJ2aDoXHtEYu/Cg4D42rWVm5wDyg7tQCWsYuyiI1eZaT652f5xeqI3xVV8zu Iy6A== X-Gm-Message-State: AFq9FYIvlnUN3yZ4KgPO6dbfkJve0P12vcAnI0O4J0rXzRX8LaxTRy2O SY6sYXTMDqRwUqWh9ZcefAvPgbt+XgxCr1sJ5bA/La4iIQLG7ZHM/N7Essn1x85q X-Gm-Gg: AYBFou01xpQmsCXVAGNPuUmjDyL+9ZELUrq8YTvDDJaMPT8rr2oZ9BS0YnrPFz89peE K22DVX1zmuZZneg1sw078rONeJCkIZzUVpkLTvTnmR4ZzADKlq4v+XPru4+v/OefmaHrcj0ctqq 0EcIsS8ssDHn3rVvVKOfyw9hCK4DeAviEMC4eaom12MpdRxS6P9HxVXAdEI0CV0xa6kabySJzER GtVIB6sjDdpAw+qNuEQaOu2Tdf4HBL6jFgL/YcSUJaeKIAHPB+aRRemoAK3KpLWOwjxPdkjuA6+ 30NiVt8mFkV5YWKEJQjDcPbkQvXkwxJYdqiMwnvlTZxx6zqQ+C+kFhcyTzB/Ghr5IXWUzQq7ute aCcHFeqpTUhTDT+P7A/sewWKz1GCms9hjjYuUO8JAfce17ewUdwebK2hnfshfXuKtZ+w/9Vg8bN yfSFJLRIl9Ik9taOZTpYCGkc8xFv4o4fxZ9nUp8/XKmKwO/ixrtzgqicIg5J7OjBAbD3+OhUghL wljPAzVKd6nNLG1FKISxcD/EK5qyqZytfFqpRQ= X-Received: by 2002:a17:90b:380a:b0:3a8:cb54:e132 with SMTP id 98e67ed59e1d1-3ab3ae2c453mr9520106a91.49.1791839498174; Mon, 12 Oct 2026 14:11:38 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:37 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 32/43] tinyproxy: patch CVE-2026-55202 Date: Tue, 13 Oct 2026 10:09:56 +1300 Message-ID: <20261012211009.3352822-32-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130802 From: Ankur Tyagi Backport commit identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-55202 [1]https://security-tracker.debian.org/tracker/CVE-2026-55202 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 233e6a56e5311eff91c8a46c36a790db1fb38933) Signed-off-by: Ankur Tyagi --- .../tinyproxy/tinyproxy/CVE-2026-55202.patch | 107 ++++++++++++++++++ .../tinyproxy/tinyproxy_1.11.3.bb | 1 + 2 files changed, 108 insertions(+) create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch new file mode 100644 index 00000000000..4e446542e27 --- /dev/null +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch @@ -0,0 +1,107 @@ +From 04b34f814076d790db26925d7df7c30798910c99 Mon Sep 17 00:00:00 2001 +From: rofl0r +Date: Sat, 18 Apr 2026 00:03:15 +0200 +Subject: [PATCH] reqs: improve stathost detection (#606) + +until now, only the basicauth code checked the host header, regular connections didn't. + +- add a new helper function to compare a hostname with optional + trailingcolon/port against the stathost. +- add stathost check via host header before transparent proxy check, + else stathost might be misdetected as a trans host request. +- refactor existing stathost checks to use the new helper + +this should make it easier to access the stathost, for example by +injecting a host header into a curl command line with -H: + + $ curl -H "Host: tinyproxy.stats" 127.0.0.1:8080 + +the stathost can also be specified as an ip address, e.g. +Stathost "127.0.0.10" + a separate Listen statement for that ip. +in such a case e.g. + + $ curl http://127.0.0.10:8080 + +would work too, even if curl didn't add a Host header (but it does anyway). + +(cherry picked from commit 09312a185ae25cc486b4ff5987638a7917a48bce) + +CVE: CVE-2026-55202 +Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce] + +Signed-off-by: Ankur Tyagi +--- + src/reqs.c | 37 +++++++++++++++++++++++++------------ + 1 file changed, 25 insertions(+), 12 deletions(-) + +diff --git a/src/reqs.c b/src/reqs.c +index e3cfe76..d5037cf 100644 +--- a/src/reqs.c ++++ b/src/reqs.c +@@ -316,6 +316,17 @@ static int send_connect_method_response (struct conn_s *connptr) + connptr->protocol.minor); + } + ++/* determine whether a hostname with optional trailing colon/port is the ++ stathost */ ++static int is_stathost (const char* host) ++{ ++ const char *p = config->stathost; ++ const char *q = host; ++ if (!p || !q) return 0; ++ while (*p && *(p++) == *(q++)); ++ return *p == 0 && (*q == 0 || *q == ':'); ++} ++ + /* + * Break the request line apart and figure out where to connect and + * build a new request line. Finally connect to the remote server. +@@ -384,6 +395,16 @@ BAD_REQUEST_ERROR: + goto fail; + } + ++ /* ++ * Check to see if they're requesting the stat host ++ */ ++ if (is_stathost (pseudomap_find (hashofheaders, "host"))) { ++got_stathost: ++ log_message (LOG_NOTICE, "Request for the stathost."); ++ connptr->show_stats = TRUE; ++ goto fail; ++ } ++ + #ifdef REVERSE_SUPPORT + if (config->reversepath_list != NULL) { + /* +@@ -497,19 +518,11 @@ BAD_REQUEST_ERROR: + } + } + #endif +- +- +- /* +- * Check to see if they're requesting the stat host +- */ +- if (config->stathost && strcmp (config->stathost, request->host) == 0) { +- log_message (LOG_NOTICE, "Request for the stathost."); +- connptr->show_stats = TRUE; +- goto fail; +- } ++ /* check whether hostname from url is the stathost */ ++ if (is_stathost (request->host)) ++ goto got_stathost; + + safefree (url); +- + return request; + + fail: +@@ -1688,7 +1701,7 @@ void handle_connection (struct conn_s *connptr, union sockaddr_union* addr) + + if (!authstring && config->stathost) { + authstring = pseudomap_find (hashofheaders, "host"); +- if (authstring && !strncmp(authstring, config->stathost, strlen(config->stathost))) { ++ if (authstring && is_stathost(authstring)) { + authstring = pseudomap_find (hashofheaders, "authorization"); + stathost_connect = 1; + } else authstring = 0; diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb index e84aeae53cc..25df44301b6 100644 --- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb @@ -11,6 +11,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz file://CVE-2026-3945-2.patch \ file://CVE-2026-31842.patch \ file://CVE-2026-54387.patch \ + file://CVE-2026-55202.patch \ " SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592" From patchwork Mon Oct 12 21:09:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100519 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E67B4CA9ED0 for ; Mon, 12 Oct 2026 21:11:42 +0000 (UTC) Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5091.1791839501370223830 for ; Mon, 12 Oct 2026 14:11:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=JhKhE9Lt; spf=pass (domain: gmail.com, ip: 209.85.216.49, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-3a8adb68d8bso1491901a91.1 for ; Mon, 12 Oct 2026 14:11:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839501; x=1792444301; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=AZOpdh2ofxltEUluA4G5vv652iJgziEy/5DNpaJ57go=; b=JhKhE9LtU9Rd44p0fLoBPEYx5I0JAmqdm6NAtCZwto+CJ77h/ZJ+lOXicl74i+gSHQ XPxzwAbbYnEEbyZo9BK2A5dTtIVpt+ntC9mCBX6Nr6rrImxHL24C2JvIEiXQsKahuEkt /n9tTURZcmQAEaJx6LOD7aaaPOLkv1TESQQUMV0zhW6yNf4bEmiLZECZYYU1ZwAxnE0U VPzKsafGEHGO+4ATalCS4xhpnKjlqDv4p4u4E2w525POn2oLWY0L6NnZg9ey6yetSj8v JcyBlHab0vUv/FZVpoSP1m+wjLqHAghtOVgv+HYHD/yG6rTiBzSWgPaLSznAjffk2Pp5 /L2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839501; x=1792444301; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=AZOpdh2ofxltEUluA4G5vv652iJgziEy/5DNpaJ57go=; b=Tasp1sfquQ+EsI9oNKW6cRIQ4XL+NarGaQ64Scy74DsyRWYobqhK4sdoB0NHOlzeyX gkYzWaHx8a/4++TEUqBd+w6EH15E9ZNJDkQbjj9mN3KWuRxxolvQNIehPoWz2vvCYIhU rGqb905f2Hw8k9bp38aKn1yFD5KPCnwuZeOu1NyYeVvrBrqbhKdHeNt5i10aHVnDxDbm NFoYq18/Lx3pW8zZP+15nXKQfC4Gt6y3CKrWRrWCxtAGAKhD7cLnQifcgMdgv4VKj0Vm BPnCgRzpthQJTJ/qYXfLT5hqDBpuiO+UV1/F8ttntpIUy6Qo5VYuCrknLWZ5DVM2a6qe qooA== X-Gm-Message-State: AFq9FYKCfQSJFm5kS78hLKNht5Z95ne0KxOtvJeSLEaeXU2LAYvBhsll by9KUkvE9BUTbcdI8o1CIe9sOBb6gFgaYc/E3uS9CFXn3J2+jDYXe9dnbAwbkKXy X-Gm-Gg: AYBFou1Bq8eQK262uXOskxqVZQE9qNhrbWYFGo7FGE+N+aNpycz8Z35TiuKUyaeMsFB ROY0T9PjiMoG4y/lQ59kloMw5XOEfKpQWJaTjCn7VWrKf8rlRYphaFw1h3cqyX5p1eVdExLHLk4 khTRTsR6l3mEXnarNUEGBZxF8XAwjTlTKgEzQGb3xRjY9g4oHXr4FDXpqhsVuRorMVaYWQaCcPk yTVLbFU3pjNNTTgYXKrXO269ZV9ugxG83jMqjtQMDs9gxH3J4RmuMo2eK35oBTxzXqDPFhK7dqj z4NCPCy1hfHS3oqVKF+8b8ieQFKNbjWABVxS48kdZRMmpwmRrTmgIkktmHyHmxYPf599XqE6aBO dUgbLkF3BOVrsAnY1YtXlbCjqtoCnx6aJSNO1hMnsY2yyMRjbm3QuC/nM8FLWnlYesGWtCfu3y2 eguY4wxJqlMWA43uD5O1sp8mbyAykqdZpqO7v5PK8SuBrVaWZTjYYDhbgTeEGQIDLEslKo2At6W BPTNKuqiT3dW9jq0xvKsKib0nVTUMmMdgRmzaat3tHF9UnlGg== X-Received: by 2002:a17:90b:1dc1:b0:3aa:f4af:1e14 with SMTP id 98e67ed59e1d1-3ab3ac7eeb8mr9403911a91.51.1791839500758; Mon, 12 Oct 2026 14:11:40 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:40 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][blacksail][PATCH 33/43] wolfssl: mark CVEs patched Date: Tue, 13 Oct 2026 10:09:57 +1300 Message-ID: <20261012211009.3352822-33-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:42 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130803 From: Ankur Tyagi CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version. Details: https://nvd.nist.gov/vuln/detail/cve-2023-6937 https://nvd.nist.gov/vuln/detail/cve-2024-5814 [1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities [2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit c12fcc9b481d5fcd94db96cd062042301a4f24b1) Signed-off-by: Ankur Tyagi --- meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb index 8fc6068560b..a2b41b2d3c7 100644 --- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb +++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb @@ -72,3 +72,5 @@ CVE_STATUS[CVE-2026-5504] = "fixed-version: fixed in 5.9.1" CVE_STATUS[CVE-2026-5507] = "fixed-version: fixed in 5.9.1" CVE_STATUS[CVE-2026-5772] = "fixed-version: fixed in 5.9.1" CVE_STATUS[CVE-2026-5778] = "fixed-version: fixed in 5.9.1" +CVE_STATUS[CVE-2023-6937] = "fixed-version: fixed since v5.6.6" +CVE_STATUS[CVE-2024-5814] = "fixed-version: fixed since v5.7.2" From patchwork Mon Oct 12 21:09:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100522 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AA621CA9ED2 for ; Mon, 12 Oct 2026 21:11:53 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5092.1791839503788184266 for ; Mon, 12 Oct 2026 14:11:43 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Kk6YG4W/; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-3ab62a8250aso1197883a91.1 for ; Mon, 12 Oct 2026 14:11:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839503; x=1792444303; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Tq4Jyy0Md+hDU71NW0upmsmT1bjck2A5lshkdE8RtuQ=; b=Kk6YG4W/xTjqHn9EHSLJl7HBwj+N/XsabLbXnq1b1oR6K5uTVp+HC33chKCknNwbY2 BRJAjKthXNULCUMJabHC+vyG5GnpJ9bapXPwl0YecS97CurOt1UoylPesTjywlq1N5P/ XSgLrq54WVBvWEL9702yGtFVS5sAXw4PMknngz6xPleSV6/6Az+ZjjM41uHu18r6jgWz BWmUG3u1hWDNO5DdlogGszQwCbNXp3sTldMBgxH00a+pZHsfurj5QNhL2s7wKuqUps33 VTStc0EIt6gRSesUKe/t1QsngUwACNZgfW3vcyraDLoN3KvHoO4uGQy4dP2tb2ZB1eg6 fTqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839503; x=1792444303; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Tq4Jyy0Md+hDU71NW0upmsmT1bjck2A5lshkdE8RtuQ=; b=G1tmtcurmokh1zcgceJcvrBcxxwYFS9NHJSxDFut8LFE9dCy+eOl+7ZVwYwaQulp7T QGmzKoGH7AQqxi9fpbCj1JW4IGKTgAlOLV4vkRhX+R2ce8pgWkrvgkoAXrkxuV7GZ0sM XbfBky6kZDfLJI81+C3+5UKwAbTP5X+/l1MH7EXZU49uB/y1NwoaQgG9ySCSgp48lKdI Ax6C8ABVxTbmHMmKzJMHkIo5ggbHq1qJ24HpaXoWQVc5N1lmntZaZAOSaeJ5VpziI1YZ n19EpCivLEIpXYRDVjTn/XrNO8x6Mto+58bwB3+uBoK4WUH9tWXU7/0tTXBUHbX+uKkK 1OdA== X-Gm-Message-State: AFq9FYJ1q8deH5NLpVi3dH3+BJvt71oarcLhyWTxMBfSt5TnhD+lN0pW 6qQdJs9qnY5gMjpF2QdvF8iFXfCgx3WaU0VJgVBYM1omoFDxshwRT1XNpERn2w== X-Gm-Gg: AYBFou1OX949ajliGQBhWlOH8VFDrgLIidHgCJ8XXUV/Oa/dU8whKG5lm0DIHrvqPD1 Zgvqtk295OIoGe4Lo+0zvrNqE3wi+2VdA7BYGw5LMNjwn6Maxn01O0T9nGopbxnisjC3BYRCDZb 3Ll7tDx9nKFOdxbeKwBiVtuhKVNk40b9Qcpg0pV76Gt8NWyg2CJQUqcKHmN0yMIB5SFt1Gd7KOi MM1+1ZEubbjIUHVT0cV3xINjQn3Wk+/+G5Agfke4cfr+TW26WWR4CITvwN1KdvRGew2cHfA2wpD IX14F/w63oVXckONB8ZgfA0+meFe8rwzGm5/lrYbn6TE61So8XwVzYUfZMPEKnTRsAnf0qULcn5 NgTXY5FssBSF0KTjJ+zxr8qFyywpW3uVT8VxK6QP/s71eCFp/Zi9IE5wy43CA/i3V0tl/gzEd5/ Cpg4+ZZnuv7LNZaTLuovD9d1vclNzRqcdfNUbndOnwuyuM5EDm3RoK5xME2S8o+NevcjqvNVyW/ aot0g2+IcFvt8AY4ngqtzEVbhtzyByT9ZI7uQU= X-Received: by 2002:a17:90b:3c85:b0:3a7:8ef9:3bb5 with SMTP id 98e67ed59e1d1-3ab3a90b5e6mr8441621a91.10.1791839502978; Mon, 12 Oct 2026 14:11:42 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:42 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][blacksail][PATCH 34/43] python3-gunicorn: mark CVE-2024-1135 patched Date: Tue, 13 Oct 2026 10:09:58 +1300 Message-ID: <20261012211009.3352822-34-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130804 From: Ankur Tyagi Debian[1] also identified the commit. Details: https://nvd.nist.gov/vuln/detail/cve-2024-1135 [1]https://security-tracker.debian.org/tracker/CVE-2024-1135 Signed-off-by: Ankur Tyagi --- meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb b/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb index 545947446cf..e19be893602 100644 --- a/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb @@ -41,3 +41,5 @@ EOF } RDEPENDS:${PN} += "python3-setuptools python3-fcntl" + +CVE_STATUS[CVE-2024-1135] = "fixed-version: fixed since v22.0.0" From patchwork Mon Oct 12 21:09:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100525 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2E1DCA9ED0 for ; Mon, 12 Oct 2026 21:11:54 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5093.1791839507052031355 for ; Mon, 12 Oct 2026 14:11:47 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=lfIffWs/; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-381b831d535so2640049a91.0 for ; Mon, 12 Oct 2026 14:11:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839506; x=1792444306; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=F/cfPalfImY/FRNSoYtj5GA3iNFtN5UZ6V6zpCr3S8Y=; b=lfIffWs/+VqYzjyxjib5N7i7B/KyF+BchKFRao2jDhVZi954P3T/zVuF5YimksSuRs M67/7/3Z24mN3yNA8DS+QQLAFum3GnEuH2X6Y4BmK4782bz6HSnMLuK09Jb4nnqBfpyU WSDoz8z2nfppYFAUa1goJZ6pfVyIzsZ+W9FKZ95DvSYcwNJMF191hNj9cQ2tqTara0NP XwIknf/Be+Ux3RzjaHEHqOwktEApwnEAwP5qiaFGgp9otStQFT/6ebUfTYZ4y7l0UYDH pzEzGb09TZMlan4OGDlqg13Ua/GRHmn13HjOlqVxnaAZfkBJzUNVdzSppMhvZu8ap1yf 7gJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839506; x=1792444306; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=F/cfPalfImY/FRNSoYtj5GA3iNFtN5UZ6V6zpCr3S8Y=; b=uL3qxoohodb/FDertMzCIPV1FDessqeeiqsJLa5A2f7WzlpsvAe24xV7VTafr6b8Tc iRl1TQZK/iTI30v3gILBT4zl+lxtcoeCpjM7Ge+sAWVmwxfyd4N5DZtRXQxGrCDkZeTT n3+6vIrjIjOPwSJCTNYhTtRKtLcA2rZUe1q+D1Wzvndul8rsJ6jb+LAYxV6TrMMOFiWB jvdVls73/s/Qo429PvLvMgsdVatdLP9tvl0/Ju1CDdtOcKUZMtPQS08BIgDfzJq9nDTz OgKMl8qH1Zs0dpoh9oTanwU7RBsMZDq5tHQ/1x7x9kwRewioK0o/VEg3uq85vYiwsdZL Kcug== X-Gm-Message-State: AFq9FYKNbtanE33DILWZWFPSm7pO1zqIgbZbSY7VLKdDqoExE+LNm8b3 eUz357Wdpv0Tfm1MffENUM/CEz9Q0MKBartgEoLMgWuVgrpZXU8AeIk/PMAPKD1w X-Gm-Gg: AYBFou3FJPci1kg8YraAxTGhVL6W7oOxQFcpx+O72oTXLzo3qBDjIItLqlBjL2/EPzD 2reC+fVcFO3db8TJ8wSrYh1AuPc5N3t9ARetUZBJVT6jkvfh+oGbLuHQQDq7D6N8JfAUI7UAmbF rF3d7iqGUuvBRqljlqNBMIXX3522eLJ7EmviMN3jv6TzjgKRHvcvDfVJYC+leS2DWyyS0WXvJTX omm1dYvbQR1/wMVIqrhXv4Ghf+KFRlr+14O0eUxR2T/p1nTd/MBiOwxsvc5UDR0JCWF5lYdKRZJ YaG7f+iXKOgyuN9pB3xgPZ5e6UZTcPz6LLmtKX4P63ARnVt+UB1wdWaoL4MwrkXF9szc2leMB9s iZgPls2mMHVtvRcVhJ6TyY8OCO/CPTDWr3WApjaBGuRJR+gI9ZN94PHwcf6KspP9S3+Z4E1OTm9 rJ17TFXZB5TI7O3gzXY5e7sJbpUKcksLOuWTmKDu2QKkaIUPE7Ogtv2ty3OF4kL6qxPYZEaT8st BOw71TFeFdwviIHEEgeH+EmwAuJM5k1wyJCWdg= X-Received: by 2002:a17:90b:5343:b0:3a8:c0cd:57fa with SMTP id 98e67ed59e1d1-3ab3a956d33mr9275993a91.11.1791839506312; Mon, 12 Oct 2026 14:11:46 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:45 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-networking][blacksail][PATCH 35/43] pgpool2: upgrade 4.7.2 -> 4.7.3 Date: Tue, 13 Oct 2026 10:09:59 +1300 Message-ID: <20261012211009.3352822-35-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130805 From: Ankur Tyagi Changelog: https://www.pgpool.net/docs/latest/en/html/release-4-7-3.html Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 192d012d9a1f40061901ad4302a4d90fc08769aa) Signed-off-by: Ankur Tyagi --- .../pgpool2/{pgpool2_4.7.2.bb => pgpool2_4.7.3.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-networking/recipes-support/pgpool2/{pgpool2_4.7.2.bb => pgpool2_4.7.3.bb} (95%) diff --git a/meta-networking/recipes-support/pgpool2/pgpool2_4.7.2.bb b/meta-networking/recipes-support/pgpool2/pgpool2_4.7.3.bb similarity index 95% rename from meta-networking/recipes-support/pgpool2/pgpool2_4.7.2.bb rename to meta-networking/recipes-support/pgpool2/pgpool2_4.7.3.bb index c6b6a22c64a..2648cc1f9f3 100644 --- a/meta-networking/recipes-support/pgpool2/pgpool2_4.7.2.bb +++ b/meta-networking/recipes-support/pgpool2/pgpool2_4.7.3.bb @@ -16,7 +16,7 @@ SRC_URI = "https://www.pgpool.net/source/pgpool-II-${PV}.tar.gz \ file://pgpool.sysconfig \ file://pgpool.service \ " -SRC_URI[sha256sum] = "e72b9d0ff3620f7da7e33a58dda44b77919d056752dc9bd86b2985c4988d1938" +SRC_URI[sha256sum] = "4bf9df3e13feb8e64bee486b4ea54c9076296c2d9406165b0b68d32086fce250" S = "${UNPACKDIR}/pgpool-II-${PV}" From patchwork Mon Oct 12 21:10:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100526 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67746CC6B03 for ; Mon, 12 Oct 2026 21:11:54 +0000 (UTC) Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5095.1791839509791227207 for ; Mon, 12 Oct 2026 14:11:49 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=C2yAqqwp; spf=pass (domain: gmail.com, ip: 209.85.216.49, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-3a4b9732d5aso1658000a91.3 for ; Mon, 12 Oct 2026 14:11:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839509; x=1792444309; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=b29O3v2MCwPX7xDUGtfueqBR7XokGZnunF/3xTBS0js=; b=C2yAqqwpwBx4JG4VmrFA8//HCyHyap3UQIZETqUp0GBK/69HgBSmBXbI6WP0FCEsqn cLSaFCIsBjwnmSqCL//Nq8A/85bbSIEmb8frs4PAUrLI7RC+5xxKqQLmhmZFykyYWI1t 2jWr/gbJKdZ4fhBEdvHM2/zpcxpsPXkjnAZ2QlwOrEBmiY1/ChNnAuji32+URYYdYuff B0DP0FdkKEjbm+vVlATk2gPolqS0q4xdBUIBIgO+vfaLExkMgr7PvzNQczCw9hSx8/z8 bVnvQSL/pJ/5Pn2YC1VQwZg0Ic6o5MazBR6j4nuc1oonvT7F72F/rIC40wddito4x6mN qXHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839509; x=1792444309; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=b29O3v2MCwPX7xDUGtfueqBR7XokGZnunF/3xTBS0js=; b=XXarP+QfUCFFX73S8HIA4e+wxAf8f9POx2u2v2CpOgpbKjVImsUROolajs5n6q620X CFtJ5aMihR4nd6IW3imUajknSZC+FNDijVjyzEUCGu06ZYUJrUbuJjYLBxDaxFSX6MjW 1ZlwfSMdaiDVg0l0XdNCRctVv3qbDuzH3j1ePniiQVrTd9GF7YqEBpsGQV79/cEHn925 9vpqBYkktfW94KD7OAngc9RcR+vjYDB14XUzjtk2yr53hAPCal0RKSOmM4mDJz05MPFc d5sfE7jWRHEJDQ/nyKI/aN5FcZghMMiPShhcmsaz6E/90TzhZigmFVe1I0D3LWoE4KA/ eqLg== X-Gm-Message-State: AFq9FYKzFj02g3dE4Xh4MEMZsTNvP8JTFjc/aeisgtiVkGdcTjxVVWD3 p2KchJLVS61eREbB9olofmqCchKFO8Fc19ubW6btS7Vyr6STsxFsui0jXk/2fOgT X-Gm-Gg: AYBFou3+wvkJjBQjPUJTwdy2nEHKtGlGj+3IUdP3ztrww11tDsd7bsJXhZjUD8Gfeil JX1SUPFSp9xHy0rrU7loy1hRmN1wZP1GOFenF3nJugctsunYnJN0Ku0pp9i0WK5joBRoty8wztQ 5X3ovbiH4f0dr4HARJ2kJJ98pWp+N87TXH58Rr51sk20/lOo/1sQYeCHwv4SVpxx5ivDhmNRde5 e0ZWR+WOlgsqSQxhf7k7urJrPOns3aI50lLmTX5AasNYx3uyHm/ZBUye9EKxoQWvb9OTeb+adLR GSrRYFkXmtl/NHSdPcZV/OYHqLElMm904JQVoNwsnd0XwEkZn0BNwTZCfZ+76kt+937zdIHHCkU JUy/dw7jE2ZHLCPUeZUg5i4mumi9tXJpINJIBWs1EKVA6FC1GvuHnV60Cb33rh2YrLo1AMa7AFu 3XkVT1WRK43eLvyQSOTxi6s5xBd8sBmYFtq0HKC3GU7hOEBiJZh5e4i4Fq9J9NKwPmmsmDRe/Mq sB972KrvNYjp8Qsd30KYIVQlLxJT47pDr03nZNUSgxA+klmNPz0 X-Received: by 2002:a17:90a:d2c7:b0:39d:f4a8:75ef with SMTP id 98e67ed59e1d1-3ab3a33da74mr9059235a91.1.1791839509150; Mon, 12 Oct 2026 14:11:49 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:48 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-oe][blacksail][PATCH 36/43] smarty: upgrade 5.8.4 -> 5.8.5 Date: Tue, 13 Oct 2026 10:10:00 +1300 Message-ID: <20261012211009.3352822-36-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130806 From: Ankur Tyagi Changelog: https://github.com/smarty-php/smarty/releases/tag/v5.8.5 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 3fe4c2247419cbe376ad010e2e56536bec3faab0) Signed-off-by: Ankur Tyagi --- .../recipes-support/smarty/{smarty_5.8.4.bb => smarty_5.8.5.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-support/smarty/{smarty_5.8.4.bb => smarty_5.8.5.bb} (95%) diff --git a/meta-oe/recipes-support/smarty/smarty_5.8.4.bb b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb similarity index 95% rename from meta-oe/recipes-support/smarty/smarty_5.8.4.bb rename to meta-oe/recipes-support/smarty/smarty_5.8.5.bb index dcb7c85a807..83f428d388d 100644 --- a/meta-oe/recipes-support/smarty/smarty_5.8.4.bb +++ b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb @@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=2c0f216b2120ffc367e20f2b56df51b3" SRC_URI = "git://github.com/smarty-php/smarty.git;protocol=https;branch=master;tag=v${PV}" -SRCREV = "94a27cbbc7820198d7adc17a2be8d457fb267753" +SRCREV = "0ae663525dcbc9e996feb2a867e43bc85f960938" INHIBIT_DEFAULT_DEPS = "1" From patchwork Mon Oct 12 21:10:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100524 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9D1C4CC6B04 for ; Mon, 12 Oct 2026 21:11:54 +0000 (UTC) Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5098.1791839512264141219 for ; Mon, 12 Oct 2026 14:11:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=aUGzQYsx; spf=pass (domain: gmail.com, ip: 209.85.215.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-cc4c02ddd62so992300a12.0 for ; Mon, 12 Oct 2026 14:11:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839512; x=1792444312; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Xqt7+WrPGlXlXY/CP0KQGUH1Hkhbk2WHpDFTYBLBvAE=; b=aUGzQYsxrTzZ/ZXoLAAmOiNumQcLjmOofA2g/9rlUyvgOlTJV8U/2ddpkaUa/3A7E7 h3F4hiDVnKkmyTVceJWZs/RilGk6BzyktmTr/5lvfwbRtWP/qTZVwSJLPgeuyEPXC2+u Uzg1ck7FDmYFYV9eZI8RLzZftkXJvCQW3T00Y3uU4rvXkdQn3gY+j3fQZfOQuXc4Pzei 2Vkatz9HLSnw59pKilo4zwWCXED1kTZ7qcPvPGb8vkYotXqTjtORKghUYTadm2ctsFBb INMUKSroGhGBb4ydzNhNg9qyDm6y+Sss+nEJIy+fwiJTNg2Yt2IqMnOvmQbY7TCAOWFU NobA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839512; x=1792444312; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Xqt7+WrPGlXlXY/CP0KQGUH1Hkhbk2WHpDFTYBLBvAE=; b=W1DhxE2pvOUzBO7YNze1B+z7mfa/62lflvdIxv7GAPGLpSu/eV8q2tA6A4OLJ99SOH /vJToen14sSs4A4Iym/7GoGW4RIfoKO7/Tp4f9wnzbbqxGG9Cdx+yVT2J6qo7boRk+CG UAiumthcTdOlJAzOdLEy4yUP8lYRPeBXBq+BgxkqREokZzPqkTVIYH1av2RjQ8TKfNzd lNw5YPrKZmXn+5p+540Rm4GrTSsXXaZdyyqfUalzXDS1Jjdgy6AbEEAvNBp5EdAg97MH Y0tSAkZR3LTrone4MZZCUXo85PYXzEcThpmfykPRsju5F89uIxBJ5W+3cUm6ydy/si6r 4g/g== X-Gm-Message-State: AFq9FYI/3v0jg5DtSxSUj+JHFVmT9SofJ8fogqW20oeEwexKIL3Oiwpr xe2OwpaWamdOnUmFR2+kva4LAlNPYwEB0jPh0kMsJjd6Zazb3/ITLX3+kEuLY+e7 X-Gm-Gg: AYBFou3tJvMzdZw/gcyRlelgneC/dZ60cipvj/Htt8auTM9b0Ty3EUMNtCDr53mi50u 8ER+Ou0s3Xy880UvYKI4IqeR35PoqElcLvFJ+NJwY0PA1Deism1BDiNX00YcVJJOBBQmCl0XQxK Me3QR0s1/auPFhvX/TRyfiIrJquKTT6Mte/BYKV/c6nLDiCvQfbnwXdvXW5j7yP7grd9QUNr4q0 4+SeV0D0/iBo+2PortNiQjDULW5qRg8DNZJT0BrlBNPnkRdqVnFs3ahXq70UWPbE3IK9jpHhe2y w5hCNY9R5pkY532j+4AVqG6+RLUcWGFhdCYL+yb7ssO8/aGLr0bv70A8j7+nYF0xAFIesuPlKqY PzAK09CPzMf0iCTR1yChZh++IcIt8cUmWRSaCLA5tlbxoyjeokp5sbySkKrdCBBNNrx6rA/z4At BrqhrhhMC5tFp2SeaaXKsdPJlg+4ASXVpRoNzVX0563X1Ov+XHjpDMNhK0Y8PGwXcoTOJNtQPmT c7kdAiBZNKWSxkI+t8zDtkFAVWs+VRCpSDiKncmx1lzLbgtGA== X-Received: by 2002:a17:90b:1d4f:b0:3a4:fe48:d410 with SMTP id 98e67ed59e1d1-3ab3a954001mr8637663a91.30.1791839511578; Mon, 12 Oct 2026 14:11:51 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:51 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-python][blacksail][PATCH 37/43] python3-astroid: upgrade 4.3.2 -> 4.3.3 Date: Tue, 13 Oct 2026 10:10:01 +1300 Message-ID: <20261012211009.3352822-37-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:11:54 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130807 From: Ankur Tyagi Changelog: https://github.com/pylint-dev/astroid/releases/tag/v4.3.3 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 486ef820db2ec71ff8da90f4c9634a200d6a15bf) Signed-off-by: Ankur Tyagi --- .../{python3-astroid_4.3.2.bb => python3-astroid_4.3.3.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-astroid_4.3.2.bb => python3-astroid_4.3.3.bb} (89%) diff --git a/meta-python/recipes-devtools/python/python3-astroid_4.3.2.bb b/meta-python/recipes-devtools/python/python3-astroid_4.3.3.bb similarity index 89% rename from meta-python/recipes-devtools/python/python3-astroid_4.3.2.bb rename to meta-python/recipes-devtools/python/python3-astroid_4.3.3.bb index 55f4d011946..c9a209aba0e 100644 --- a/meta-python/recipes-devtools/python/python3-astroid_4.3.2.bb +++ b/meta-python/recipes-devtools/python/python3-astroid_4.3.3.bb @@ -4,7 +4,7 @@ SECTION = "devel/python" LICENSE = "LGPL-2.1-only" LIC_FILES_CHKSUM = "file://LICENSE;md5=a70cf540abf41acb644ac3b621b2fad1" -SRC_URI[sha256sum] = "8cdaf5b7f3f4f39557ae05ed8b0852136b43a04ab686db7d39255b206233677a" +SRC_URI[sha256sum] = "d03854b09d92c08e18d8e7d9185d393961186ed0747136d8fcb2d1c008a504ec" inherit pypi python_setuptools_build_meta From patchwork Mon Oct 12 21:10:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100527 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5F6DCA9ED0 for ; Mon, 12 Oct 2026 21:12:04 +0000 (UTC) Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5100.1791839514720072754 for ; Mon, 12 Oct 2026 14:11:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=USRyQiRE; spf=pass (domain: gmail.com, ip: 209.85.215.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-cc4c02ddd62so992321a12.0 for ; Mon, 12 Oct 2026 14:11:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839514; x=1792444314; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8BnSSjKFO0PMtJD0fnqhAXCYbYW7l7yAaTyeqqUClDc=; b=USRyQiREYWtqU53WjACMAGdIkI/sSI+lf24Jc5Ja68bf/fAE/BCdHUXALA/Z6sR3zj 72BbDsMsokLWpNNibHYb1Y/SwX6RArzukOSNGOifIjdpK9AiPGu+c8+/De/ukBDcbwHB OEQfSwfXVhPiVc3KFAGu9PFNuSU21+i96q1xEV2wPHkITi9MK/Rxsk6yxXxsXIGq/R0F iY29oZVaaKfiFeYk9ZPLuhpamoZtlWoBHUX5CQw2pO4EWWEBbgX0DZWh7nLz2/QiUF1c cLlBJtZNzhz2Fb2wROj69vAt7P+x0vB1D5MM0zOyVO2jpnzxIO7YNyOPg9rZZVekuRI6 GWEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839514; x=1792444314; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=8BnSSjKFO0PMtJD0fnqhAXCYbYW7l7yAaTyeqqUClDc=; b=RDGUxgR7MP0WjkevCPZnwawylHW3+4EfMSyNMshkfsCccRI/K/hn/2yGB0CeYxmBIk JB1ZeXmqwWy93+p6xV5xwGOEaK2RgA4AhsJHk8mLcdSiWvcYzpjO8QtnFmYNzKtmxnmL YdWPUfkaB1mQoVYY9cPHoQ9DRQ1OxjEzmM2EX5pt5n00rOZ/5JXdfPp4QHdctwBrWX9K 5lQmqT3GSjQ0+kFOljf1QbEXHLuWT64dtVUPA2MJVDDejUbDzZjJp7bG376irjSKrOzM 4XeFRnjUGeB8r/BdmZzq6KqmaGZUijM+yAjYwmtB/5EahYVMQLhw90U5HPydywvMgP8G xfBg== X-Gm-Message-State: AFq9FYKtBt8reMRpUbgtFxlftb4E+FosevQA66JHBdKH3pqEgS39H366 LVRQW0eRYEZifYxAho3H1XtdKfWJkCMA0UPYf6ZfEL107PnbMhyvmVEJ2ZAF0OIb X-Gm-Gg: AYBFou2cIDSrymCv1Y5QNZtz7RYOl2teCew0Lpr8rUJtevNlESULVLaATUO+/bscBgF GTJIe5yJlhSgGTZ8OnKL5Z3BeulpLMovn1wAxARZo4WChKKSskmlxhR1AcEsR19wukUVtw2r2G2 DcEj2EGiA2PyukpKU1lIupp/sM6wV5zvjG8a7mwQrhbzNHm/cvMJgge4efeSG8URjKg4WKM2P51 leNV3V3mDhDd5tPxzuvVDcterF13YVBoxljpZBSPjog2rhpETcmoUg2WIOCC6cWzwRYdJFc1mxI 0S78RFa+hc3ha5ssKRFinUTT361FFYKARTNEor0fVinmyGu3izHyk67EfSnnZOKAu/ZG5rAUFR4 KXnyNv31/2bsoPFLppyRHY0JQf+OfJTMxs8LqOZok8hL5OQDHj833J2NAhCoNwM9N87AQoH75jT 8VsF7DREPKJ3HyRxl+ft6qRrTWE8RjRGGuQgigoG8HjJuLKA+4vShuzQ2bUboRTaMnFOEU9j2qg 92vFYV5mbOdDwBeAEj8H7LfT3OiNIkHxDrz420= X-Received: by 2002:a17:90b:2d06:b0:3a4:b30b:b501 with SMTP id 98e67ed59e1d1-3ab3a32d491mr8092885a91.9.1791839514093; Mon, 12 Oct 2026 14:11:54 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:53 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-python][blacksail][PATCH 38/43] python3-django: upgrade 6.0.8 -> 6.0.9 Date: Tue, 13 Oct 2026 10:10:02 +1300 Message-ID: <20261012211009.3352822-38-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:12:04 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130808 From: Ankur Tyagi Changelog: https://docs.djangoproject.com/en/dev/releases/6.0.9/ Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit c39562d398bdde11ba32c9144a8189f87ef922d7) Signed-off-by: Ankur Tyagi --- .../python/{python3-django_6.0.8.bb => python3-django_6.0.9.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-django_6.0.8.bb => python3-django_6.0.9.bb} (75%) diff --git a/meta-python/recipes-devtools/python/python3-django_6.0.8.bb b/meta-python/recipes-devtools/python/python3-django_6.0.9.bb similarity index 75% rename from meta-python/recipes-devtools/python/python3-django_6.0.8.bb rename to meta-python/recipes-devtools/python/python3-django_6.0.9.bb index 0c7fb2197d5..acdd2c21d06 100644 --- a/meta-python/recipes-devtools/python/python3-django_6.0.8.bb +++ b/meta-python/recipes-devtools/python/python3-django_6.0.9.bb @@ -1,7 +1,7 @@ require python3-django.inc inherit python_setuptools_build_meta -SRC_URI[sha256sum] = "cb0bd962d27fc866f3c514b20aae6a7df56ec80b488f9899da46d675cd051526" +SRC_URI[sha256sum] = "8ce037c971f421cfb47d38c097ca233a8f6dd42d9e9501a37e02dd7d08c5cb3f" # Set DEFAULT_PREFERENCE so that the LTS version of django is built by # default. To build the 6.x branch, From patchwork Mon Oct 12 21:10:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100529 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 91B63CC6B04 for ; Mon, 12 Oct 2026 21:12:05 +0000 (UTC) Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5102.1791839517318557808 for ; Mon, 12 Oct 2026 14:11:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=rhbk2wgx; spf=pass (domain: gmail.com, ip: 209.85.216.46, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-3ab98332238so1068841a91.3 for ; Mon, 12 Oct 2026 14:11:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839517; x=1792444317; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=BFdLD08Zonuc1MwlLqwImzL9VYb6JVQWrc6o++fcaLQ=; b=rhbk2wgxd+pnuyIZvSEp9q/8AZr6dCaMhIuOvnqY3Dn7IulSBe2ZiVKzxXTvk3wncF JZXi0V2TS0jjKQVbydNFdOhczdFBjhz21+39HKbUfSxwr5GF3KegWcvSA1OstRW4zsO6 ydqDctZxO1UiKzditaJn+XstPQo+XiCdn2LmTQr5xTm8PHQg8GxIs2JrLSMFDUU8dMCn 2BIFfY6b7TphVL6HOLeWg81dmAoELcvCIzMGy8xxAspb9+AfRXcdu0xAIGO+arypQFr1 JHPdJeYIg4wJj+37krPOiay7Ra3mswJ7GVr5Aw/OP1Pjy5y+5jVM5Rl3cAFs1IGNIoDo WIgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839517; x=1792444317; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=BFdLD08Zonuc1MwlLqwImzL9VYb6JVQWrc6o++fcaLQ=; b=xl7mJdU8ztwBft6YWDyi+UBuW90kvsORKo6bCZPfSEfrH7VMoNZAXVnoU8pV/08Dnc Pggm7jKaJq9/GIX1J4KrkhUJ5fv6mINtGbqABlkzShKKWyUS0G1Tam7lZB7/KeRvpt63 n0GLqTmOTVT7DqcV/wgSB8a9rmeEi3Y5DOhWo0xJBlpq72V8Y/YaxLpCWMO9FxKFkylD kKtX1TKSV2Kig/RQ+RaPlhxM70Kf6WOm5P2tqOsxm6AhJ02VtyWqM6vPjKQTtftL57fW KxNWgmCOjE1SDEi4zBaDC1G1lNgHO8lQiBeZxTLx4bm/SZYkvF08G4RdG0C7bJSkcaXT jv/w== X-Gm-Message-State: AFq9FYJ97yc9y84B1np1ie+Zm86m/0qQfosSTCqBwntdHnYtdT4obTmC 8NbTntc42zRsakvc+/43P+0xSwOjPFssFHEJ+4UCq8yKLKI8w5j3/Ipd8klFWA== X-Gm-Gg: AYBFou0fDQdGIqVd0TcZ1oKGI/aqUBfdU09AgU0stnTMIzH1nrqgmHNDddaE2FFXr1B mh/MgL1Z/MqB2mMGO/gpohUO733mIX9GUUbSBT+F4hmHXvnH4LVwkzCzKkBNGE99YNJeylMJ4sc cV5XSEsTqfxC5LSBVBASOfH35FpHhJNTTw9QoC9RzVI6t1kFRmJh0o/TAOYdqL5Vr2iPdu9KY+I 4jrvtmka/QSm8AeDrScPQU7Hhp8v6BF5ckE24eBsNNkEMDVdo+/ugy0mTO/F4+IxHkNJ6U6tg70 bscz8O6Oi+zTgH+0EGRt/D5rj6E8H0b8ya/xJQXOeT2hdGix/CzbeGTNFBCFXKyc1rLaJC4o84r pEI28Ecg/gV56+/GosPrWIHOFiOeHyhY/PpJwCQaZwetmxq+R0daq2RSuGTdpZ0oRaHwvHLl5Rn ri0iXwlKXbSxeo9xKHyxMEuSY72msLUEoNRBxGiGL/Y5Fp92X7cBjrYy4EHX2UbM2Hjr84MM1jI moYEkzLDzzLykyfkZnzZYm/8534hsqPU++F4XE= X-Received: by 2002:a17:90b:4b85:b0:3a0:f4ee:d2a6 with SMTP id 98e67ed59e1d1-3ab3ac54b32mr8577579a91.19.1791839516654; Mon, 12 Oct 2026 14:11:56 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:56 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-python][blacksail][PATCH 39/43] python3-django: upgrade 5.2.17 -> 5.2.18 Date: Tue, 13 Oct 2026 10:10:03 +1300 Message-ID: <20261012211009.3352822-39-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:12:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130809 From: Ankur Tyagi Changelog: https://docs.djangoproject.com/en/dev/releases/5.2.18/ Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 0640fa901df7783fc9f544a6bbfde5b771e22b96) Signed-off-by: Ankur Tyagi --- .../{python3-django_5.2.17.bb => python3-django_5.2.18.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-django_5.2.17.bb => python3-django_5.2.18.bb} (61%) diff --git a/meta-python/recipes-devtools/python/python3-django_5.2.17.bb b/meta-python/recipes-devtools/python/python3-django_5.2.18.bb similarity index 61% rename from meta-python/recipes-devtools/python/python3-django_5.2.17.bb rename to meta-python/recipes-devtools/python/python3-django_5.2.18.bb index a9009adaf90..eb84122116d 100644 --- a/meta-python/recipes-devtools/python/python3-django_5.2.17.bb +++ b/meta-python/recipes-devtools/python/python3-django_5.2.18.bb @@ -2,4 +2,4 @@ require python3-django.inc inherit python_setuptools_build_meta SRC_URI += "file://0001-fix-test_msgfmt_error_including_non_ascii-test.patch" -SRC_URI[sha256sum] = "9d4d93be539a18ab80d058eb515900e10951e04c537c5a6b394fc49528d3251f" +SRC_URI[sha256sum] = "461c5dd06d2ea16bd5ca37d3f46e4def1d6b0fe7588c6f4e2119517bb0af8b2d" From patchwork Mon Oct 12 21:10:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100531 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3A90CA9ED2 for ; Mon, 12 Oct 2026 21:12:04 +0000 (UTC) Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5123.1791839519717725171 for ; Mon, 12 Oct 2026 14:11:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=UroTXqX4; spf=pass (domain: gmail.com, ip: 209.85.216.53, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-3ab752f6244so1815952a91.2 for ; Mon, 12 Oct 2026 14:11:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839519; x=1792444319; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xiGx4zfZNuwp8tv4MzK5ca16ry5+iO4X1zhBEE7mtRY=; b=UroTXqX4JwKgRx2gCQ0j5En5L6VlJk3Pq44Ae+vT2dDGNc62bPeki0HZjPtu8n/URu M4saynToJAEcMmkvQ9MbarXpINKpptFBiqIho9vExTSLPGcMv5gA8ZoF6HRt5cLAjtec TXIycZGT2K4aFIsdyFHZKGIUr/a52YGhH4Yu3X0ifsho/U2JePCR8n+GmOqwcYYx1AWF ohceO8YSOWLr6jk9g7hC/XIbtMC2GFviIwqptKfSlKlcWnxf7wv8DYkELIaf5CpALfon CW/4Pt2iBTFmoio2tn6l+gbHhEaOh6WdrnJjZ3TlP1xIbaBetEJdVOum0C+npbO0M0Yn 5pqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839519; x=1792444319; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=xiGx4zfZNuwp8tv4MzK5ca16ry5+iO4X1zhBEE7mtRY=; b=paFd3eUG4Ven+6flLBWmNRrpYWEIgJYDYng3Mr635vCWi/JHK5EbMiAyfaMSQG6BLu +M9CBO1LmUzl+01o293u/VEkUs607aCf+6sMxGeuyNISA/kLh36bA01VnnehRBCjmExd WkSCnt0uz1u81RRZJKx5E/kz80DiJTF+krDkkRMpbWm3c8Jo+1+y7thBJzT1zd/yUrjK vdI9CbsS96gMdD83ohIzhDd1wXLWXAwgk89qXDxiRNifgYm3XpItefHx4SEfdOE+/aaF MLNA6qtuQKC3G7XheKEmJ9aN/SVydquYZDKWGJlzbSVtKSxgk7uaQVRop2EnM5BJYxr0 E5Eg== X-Gm-Message-State: AFq9FYLqLugteQGlHtqQHDhzyK9HJYXFu4PEY+XmUf4ZeO1c6ZeDif6A e6gdwXp420yxdb1pxmfuqLIqM6yFQzILnbrLljYpZu6ACJImPBm+Y9j71r3+57f7 X-Gm-Gg: AYBFou3h7dnJV2NhfPa6SxoUcu+LhVirxj7UzD44ufva3IcGOtYTbFhMbU6sLXXLR5r SMZqGyOtrSo+TdpZ06h9IZ3JBL4RukI8eETGRDqhvyjy06SKr3TgyLbxxUiXllmb0V04K3D8Ia/ K+J+gYcLgqBxwqkz3WhMukkcqM56T5vFs7dEVrTjdvNzGu05V241eDnlFgdGeM733JlwTf9vN3M PiD4H9946fDDm55plUOK9eiMqNG2ohbMzU7vQreIvnzCSv/7pSN+TXlskAexkK8lRotLxANLEvl Mhyxo7pMdEawlH3kxN3xVFXARu+DmsHhbsGaPmMACdUwLJl+MDr7qRKcyQs2V45N8QxZiI5yrLB A+yvLHcqJVnBWGLMgoK3MqDQBu9YzRHssTxycEx88kPC3RDdeBwuTXcb4KaPGeuhCl/bjv5f4C0 tLLmRNkeptzhrYO3xqCekcCDOgUXfCeLYAlRV8js2VYqgHXPnO44h71xQ2jSzYdWcWzGRZteZ6O EwrqnvEzTgYeHGvT0qsHXOj0NubZpoVeNxfR1U= X-Received: by 2002:a17:90a:e01:b0:3ab:e588:c2a8 with SMTP id 98e67ed59e1d1-3abe588f9a0mr2241965a91.64.1791839519102; Mon, 12 Oct 2026 14:11:59 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:11:58 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-python][blacksail][PATCH 40/43] python3-tzdata: upgrade 2026.4 -> 2026.5 Date: Tue, 13 Oct 2026 10:10:04 +1300 Message-ID: <20261012211009.3352822-40-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:12:04 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130810 From: Ankur Tyagi Changelog: https://github.com/python/tzdata/releases/tag/2026.5 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 01bd918ea8c7a391e977b9ab409605fa7fc5d953) Signed-off-by: Ankur Tyagi --- .../{python3-tzdata_2026.4.bb => python3-tzdata_2026.5.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-tzdata_2026.4.bb => python3-tzdata_2026.5.bb} (86%) diff --git a/meta-python/recipes-devtools/python/python3-tzdata_2026.4.bb b/meta-python/recipes-devtools/python/python3-tzdata_2026.5.bb similarity index 86% rename from meta-python/recipes-devtools/python/python3-tzdata_2026.4.bb rename to meta-python/recipes-devtools/python/python3-tzdata_2026.5.bb index 9bd29afa61a..4590cec28de 100644 --- a/meta-python/recipes-devtools/python/python3-tzdata_2026.4.bb +++ b/meta-python/recipes-devtools/python/python3-tzdata_2026.5.bb @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=804220b73c90950be376e7ff7b2066bb \ file://licenses/LICENSE_APACHE;md5=86d3f3a95c324c9479bd8986968f4327 \ " -SRC_URI[sha256sum] = "f1b8bd365d8d210c55353f4d7f8d6d8561c0ba50d704b700d195a9424bba0d79" +SRC_URI[sha256sum] = "8cc73c0a0bfca7dbfa59235d60b2eff82231dee33f53d206db1acd9173cfc0a7" inherit pypi python_setuptools_build_meta ptest-python-pytest From patchwork Mon Oct 12 21:10:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100528 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6022CA9EDC for ; Mon, 12 Oct 2026 21:12:04 +0000 (UTC) Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5125.1791839522285464295 for ; Mon, 12 Oct 2026 14:12:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=aTrFZWsu; spf=pass (domain: gmail.com, ip: 209.85.216.47, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-3ab8309dcbaso1534857a91.1 for ; Mon, 12 Oct 2026 14:12:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839522; x=1792444322; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=FiPHs+ZgER4/6fC2+egNayEVI4YVUuf/Nr8sa3Fl1O4=; b=aTrFZWsuEK2qhiM1HBuIS3X/QbsIm1LuCkbB1GRN0UcDQI+UFOFyOZU36YY1fV7F06 NzrsrptWkCFJ5Qn5ZAJNNOyLjTtaD3jg7+tHez8GxXBVMmK+iR4jleYgiJq1/EDp0Q1z 2LHabfN4MDuF5rrFwv7VbYPuZaCzRsRmmIm+9Lkzs+c3QKH8ottn5ifS9WJNPCGWPZcw S3dyskQksfuNalcBIpBetzwUq0yYXZgXecQIIpdClJX4kxWT9Qm4T/eM0gGgTFylKTRJ O4dmOOuEYnit/KQ9pG/V9an5tQnF0RWziPWmLPiqcOinMDszF9hR0gfnENa0CBKGzCi6 yYFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839522; x=1792444322; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=FiPHs+ZgER4/6fC2+egNayEVI4YVUuf/Nr8sa3Fl1O4=; b=2JU/emnls9KwUEeOc4rkZItuGR1wImAHFb1ZhtGW9Bc//UAS9ULGo0/X88fVctpBW7 Ccju3o9pxV4bl/TJFmIxrNX+GVTUFCxfiddx+P3/Rtl4XOjnUwzTHrmywQp3x+fgZ7iw 4RQhltyA75NSa7pK+XUEUtLe5arAiGAfI4TbPKMmMjCJtH9/Gfx4FxcsUq32JQKElk2L 7fxbpncgdbigdmvPIYeIPT2fFoo782GPdm41+njk+vg8bEjXWlcO3g1CMsF5M/H9SvTi +n2GcwCKtoHWsTp6AFmjaW5PcD1znGMFcc+iZQdwFU2dJR0nM76zMwrFQeXP/I5JVNSh Jc/A== X-Gm-Message-State: AFq9FYI/cYjld3x/293kpc7s3IINpdMXPYMUb7dzmOyzIcbBaIV1uFtY hUcSDpGC4MKlHf7GLZxIyBAf1LQEv0TEeg4oruwpHnxdvTOw4TQlLjfhtOOeAA== X-Gm-Gg: AYBFou2RMOIJH3j72AX012DPdJG2F8odmiOMTzoDl8m6I7fKF9SOndqcOVAyrE4SPyF Pfen3tZUkg9DMt1EilYI8njh4X2RjuNnLHWSfAvmRlxhY2eJc1cRUQq1XWJs5MMKntKa7ehpQTZ 9pmymKFPif9V0CBp7zaKBIYRNIO0ymApNJo+XGwW6pEvdMX/Rk5w8lReKakYsPo2A0OvB1CstYV Hbv7aGB/OD68ziHMXiLhJbDxatYfdxNcZedfp6k5gopNXKz+dnB7utA1b2kzk+dcGuc7kc+IcIp 8TwMSTIpynKmjF/c1dAyDg7M0TpZw8KiA07mnsSDxQ+456aF2fM/CmRX31VkpFUH8svA1OcjD9m oqMW2wIZD8HAzTL/YkkSdVzQBouoydG/kbe4k3ZelQzZ/RkHHbf78CFrFJd8dqVJ4XV30w+mO5J TJWR7/k4BGLc2WTBfPW02MvSIpMVFhAioSkcs/XaXMSNcy1abjNW7o82srLxiurK4BQRK+l7HOK lJ363p14yA3n5bvqmRPsRQey4KYVQBslWMbiW8RTbg/JJkqRQ== X-Received: by 2002:a17:90b:1dd1:b0:3a0:c85a:ee12 with SMTP id 98e67ed59e1d1-3ab3aceba09mr6098775a91.41.1791839521640; Mon, 12 Oct 2026 14:12:01 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.11.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:12:01 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-python][blacksail][PATCH 41/43] python3-werkzeug: upgrade 3.1.8 -> 3.1.9 Date: Tue, 13 Oct 2026 10:10:05 +1300 Message-ID: <20261012211009.3352822-41-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:12:04 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130811 From: Ankur Tyagi Changelog: https://github.com/pallets/werkzeug/releases/tag/3.1.9 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 0d101e1633262c35907fde6fd2708c0317eedbb5) Signed-off-by: Ankur Tyagi --- .../{python3-werkzeug_3.1.8.bb => python3-werkzeug_3.1.9.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-werkzeug_3.1.8.bb => python3-werkzeug_3.1.9.bb} (91%) diff --git a/meta-python/recipes-devtools/python/python3-werkzeug_3.1.8.bb b/meta-python/recipes-devtools/python/python3-werkzeug_3.1.9.bb similarity index 91% rename from meta-python/recipes-devtools/python/python3-werkzeug_3.1.8.bb rename to meta-python/recipes-devtools/python/python3-werkzeug_3.1.9.bb index fae4de2a3f3..d3b1598f782 100644 --- a/meta-python/recipes-devtools/python/python3-werkzeug_3.1.8.bb +++ b/meta-python/recipes-devtools/python/python3-werkzeug_3.1.9.bb @@ -10,7 +10,7 @@ HOMEPAGE = "https://werkzeug.palletsprojects.com" LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=5dc88300786f1c214c1e9827a5229462" -SRC_URI[sha256sum] = "9bad61a4268dac112f1c5cd4630a56ede601b6ed420300677a869083d70a4c44" +SRC_URI[sha256sum] = "55ca7c70a75689be937aa27f8ff4b018f06ff4838fc73045560bf0f5a1291060" CVE_PRODUCT = "pallets:werkzeug palletsprojects:werkzeug" From patchwork Mon Oct 12 21:10:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100530 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A0460CC6B06 for ; Mon, 12 Oct 2026 21:12:05 +0000 (UTC) Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5127.1791839524841476854 for ; Mon, 12 Oct 2026 14:12:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=eKNCURpJ; spf=pass (domain: gmail.com, ip: 209.85.215.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-ccc6b11a19aso751433a12.0 for ; Mon, 12 Oct 2026 14:12:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839524; x=1792444324; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=UWYLf86a3oJDTvpkrE8P6QLke3XWX9pfxC+R93QCLPY=; b=eKNCURpJBOchuvVzjAE8gWyn2KYFDyKZ6uEbeDOF5TEbadZI2qcwxtanV6V5MAzw5+ yWj0vFDbvZemCWMaJ7A2al3QcnhL2EddxoYPe7kxblb4l/jFXz7/YrS4JafXxeewLylm CAIkS0mBiVOa51ERlLwPtwguLhkcaS8cf9kVsGxnPu5b2MVFzEeK03FOdmvHp+8hyFwe DWqmhGKfuddus1NxzPmOSeczV/orlylPnvTg3AiF3CD0jucdbRicHu9obe7OW8OWbdEW rjyewGPVMXRwgmRggXwHLwI2eqwKnHY6kBZke0oEmkdB/+0zFt1SWE1TOXPe9FwVlMH1 SYSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839524; x=1792444324; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=UWYLf86a3oJDTvpkrE8P6QLke3XWX9pfxC+R93QCLPY=; b=k+IIvjT8tXXGA5VcRaXvlgDP66GFWt7hSEIXZ89sNMgvgFVcXf8xuxroxA+vcIEWGI gSOrJEr6jHvCri7w4KU0nWbhqDaYyX2iBVJXmQZWIGDXmd6B1oxAZoTft1MdClPUjoRW FmRcgWpY1o2xWtLEI1wpL5rSxZmljdaa2orttJ212iIVC9mfi8LImU+d1uYevVGtcjNo MgWOg11GGWiCncWWNWHnh8jLfrE81lMahGfd8Ulzo6vtdUebV7b18rGkwCTJcL91ouxa xRJ4N6n7wmw2UJBRTNp3aLni5ok/uH8b9pSXbHDcSUV9jJeAqzkOdTyiqZCqt0cVyswJ Yh7w== X-Gm-Message-State: AFq9FYIGH4Zm021D9JECrmZ8SBpCP3Z7ksI9ONuR6OrVroH7pAiV/5vI nUVZx4XUs4390/rMili5seEOWYsIrzA5hMC48rySQ5IJLCYh5RyVFNwygDqFTA== X-Gm-Gg: AYBFou3jZpBdoF5KQP6d7fouWqCL0SHGEDaCKTpWmpzbKxxg1ikkIaUxCezbggYZb3R nSJSrE/3Gd2DW7ekzM5VP3gf1609UM4Q6ZmDcSLwTN6nQp3qfNU5sO1ov+EUyYQaUifZ8WOT92X 611sLRvugrC1lyGvLLUcMK6SruHnXcs1y1B/8Dl+AoI+BjzqhWLVvJ3xHHDxXiOm+440tZF2/Pu Pilxq3SotYCM0H3EImhpx3kezQOF5yLjq0WSaU1kgTSNfNxq+oXTk7uLamyCKatR2lthfrq+s4R XtgvqOPC050MxqDzW5s9ylP7pHTD34kwEjd8Hup9IsfRBoyf0prQuxY5g1EVgLuHkHX0F8MJ+vH GpwoI36wR7Mts68CdOb6ylrRvxl8L5riYdKQZrD1YBFKUyJ1w5L+tRIyQ+Krx8tXx2wgqk5zWF3 VLkNxUzRoFufoZpDGONFzQYMicsxJIDVOkEyX8jQHsFOVkLA3ixXRXwFwURd04YP9e7QYTuo0nv kJVmH43HMWIGBbzSxD7tr/pHb2FAK2j8Krdgx0= X-Received: by 2002:a17:90b:3c04:b0:3ab:2d17:51e0 with SMTP id 98e67ed59e1d1-3ab3a99b412mr8530957a91.19.1791839524181; Mon, 12 Oct 2026 14:12:04 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.12.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:12:03 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-python][blacksail][PATCH 42/43] python3-zeroconf: upgrade 0.151.3 -> 0.151.5 Date: Tue, 13 Oct 2026 10:10:06 +1300 Message-ID: <20261012211009.3352822-42-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:12:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130812 From: Ankur Tyagi Changelog: https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.4 https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.5 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 92fff734092811bbca94ddfa3847a49ef5bea427) Signed-off-by: Ankur Tyagi --- ...{python3-zeroconf_0.151.3.bb => python3-zeroconf_0.151.5.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-zeroconf_0.151.3.bb => python3-zeroconf_0.151.5.bb} (88%) diff --git a/meta-python/recipes-devtools/python/python3-zeroconf_0.151.3.bb b/meta-python/recipes-devtools/python/python3-zeroconf_0.151.5.bb similarity index 88% rename from meta-python/recipes-devtools/python/python3-zeroconf_0.151.3.bb rename to meta-python/recipes-devtools/python/python3-zeroconf_0.151.5.bb index beadc0b3edb..4111f49a11d 100644 --- a/meta-python/recipes-devtools/python/python3-zeroconf_0.151.3.bb +++ b/meta-python/recipes-devtools/python/python3-zeroconf_0.151.5.bb @@ -3,7 +3,7 @@ HOMEPAGE = "https://github.com/jstasiak/python-zeroconf" LICENSE = "LGPL-2.1-or-later" LIC_FILES_CHKSUM = "file://COPYING;md5=6ede793c8b5508eab1acfad7c0c4e335" -SRC_URI[sha256sum] = "ce6c548e665759b6150cef4db9ab9d7bdd89857e90c513abd6b7340bdd7dbd6a" +SRC_URI[sha256sum] = "28c2ec9d772007eedf11b41a9c9fd3d5c684c17b00721ff8f1ee31b20ad286a1" SRC_URI += "file://run-ptest" From patchwork Mon Oct 12 21:10:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100532 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97C40CA9ED2 for ; Mon, 12 Oct 2026 21:12:15 +0000 (UTC) Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5129.1791839527461021730 for ; Mon, 12 Oct 2026 14:12:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=kF4b7Ye4; spf=pass (domain: gmail.com, ip: 209.85.215.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-cd5e6f0a22bso634519a12.1 for ; Mon, 12 Oct 2026 14:12:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791839527; x=1792444327; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=n5YXX8VcQjTiFYyiuHEhZ1QY7AT7nv4TSI6DgXgeaSc=; b=kF4b7Ye4eO0VMb2xtIGER5q87ukfgsvvYZ6yzb71WwIfEjBeQc5h+H4VeBWMhYArvV 7lfJI5Vx4KWbIrxhQ07Av1nGJojMaChb6cTrcLXiavNPkBISxT0rQN0vHV5Wpbmr/bLh /vTTDLfAv0Pxrz+0svc4gwrAK8F8WqHBTAvCOsJh//fcbv/LZX21Q6b6aIszID4Y6CqD oUHj5UvL/FkBrU2HftZxCbM/J1+EnwNb6mYBVvgL4x4tddR7MRmBqRHCu9RD6UTH+fAF IXcempEDRcrXd2TObB6px+QywR3jQITVwu8cQqDEQWlvZkAz6ibUqmkbC5bhJfDNk9L/ Ks7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791839527; x=1792444327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=n5YXX8VcQjTiFYyiuHEhZ1QY7AT7nv4TSI6DgXgeaSc=; b=kGZbzTWg1fNgjFUXbjgyeWomDUFU8iYLzmcMisJtQmjX00S8cQrBoFnuEaByaYXICv mxm+4JKU022Sms/Uwv6Zs9T6ByaJNVSUxIgGxINkPMX1S7el8TIAuxyBvnVlGnTduRZR mbDO62gHl91R/2+CCBhRQbWy7/AwiV1aAZv+DveFMY0JY2SPwpX5RzGGbXaMg1xge63e 9Q3SysnELLtixCWmMyPyyq76tyCvsTa2orn3vV/g50PO8LYJI/LAMZWj1VqJrTVJvPBN V6KkCds0RjCPi7TTGR7cfsE1crybJaraaNPGFzI52ACED4NkwWyTWtATH/7ULUWDoWFQ QsVg== X-Gm-Message-State: AFq9FYK3tcetYsVHc1uom+Xs6pP1Snr6yJF4msZdQyJ75volVJV2ydSu TPUGcWIci+erQNeuTTWlxz+A36XBiDnAwIFXh9S1tXeNH+neAlRTBhmQsuhuUgpB X-Gm-Gg: AYBFou3OpEvRfVbrxF1xxqolPObjRXSvjswbzpn/LN9Jhaf7ajNFUqf1CpWn80GQT/S naY+6/07GNhoIwnG1Sb07Z8CrkK5fkoCFZZwHPgL7X9PX0yhIR92opcWN8BetzIoxdntbxhHGuS j+78vV5RMrYPXz/lEuoN7DRb6RuAqiVjGtiKiE7OoRb2x53k8YiQ7XNzzLtwmnFvianM0EHdkzJ tOlTisbye9mHSvnhqbJxwK3aF4r8sAFZXShYRmh1jWC+f1I33Hv5Re222dQJv30uJSJXD+s+YwI RD+T8JNfZifnGKYJOT7clU+IKi3Eq2gqV5mzGdBxxBOziZ6Cs/Hn/294OQHUu7g0zH5vigXrOyt nswpAPbQ4Wgw2bI+ciOwWHMbvfHKERRBJGoZJ1eo/aCKIxpp2WZHUtzULVW9X2C7RS1lDCyPuTw ew2KBJRTdq9x5l/9FKk+5ZpUEQHlz/602v4uz4L3qwfuXS58QtV9iFDaDDiSLKxm5wNGWtJjB7M Ep8KC0IrdMFvumEq8yU89KF1y8JlLjK2VdsEwk= X-Received: by 2002:a17:90a:d2c7:b0:3a8:211b:6c6f with SMTP id 98e67ed59e1d1-3ab3a9f0cc3mr8665274a91.67.1791839526828; Mon, 12 Oct 2026 14:12:06 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab32c0f59bsm10962728a91.0.2026.10.12.14.12.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 14:12:06 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Khem Raj Subject: [oe][meta-webserver][blacksail][PATCH 43/43] swagger-ui: upgrade 5.33.0 -> 5.33.1 Date: Tue, 13 Oct 2026 10:10:07 +1300 Message-ID: <20261012211009.3352822-43-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> References: <20261012211009.3352822-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 21:12:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130813 From: Ankur Tyagi Changelog: https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.1 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 50c590bebc5269b1aadce1d907466c0fee131619) Signed-off-by: Ankur Tyagi --- .../swagger-ui/{swagger-ui_5.33.0.bb => swagger-ui_5.33.1.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-webserver/recipes-devtools/swagger-ui/{swagger-ui_5.33.0.bb => swagger-ui_5.33.1.bb} (94%) diff --git a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.0.bb b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb similarity index 94% rename from meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.0.bb rename to meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb index 45a3bb6d17c..db2bb498a81 100644 --- a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.0.bb +++ b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb @@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" SRC_URI = "git://github.com/swagger-api/swagger-ui;branch=main;protocol=https;tag=v${PV}" -SRCREV = "cfd4a6c3cbaeeb7c13a8bada7c754de42d78cd5b" +SRCREV = "cac3d136b5e37bfbe3288c8591f6f4fcf9870599" CVE_STATUS[CVE-2016-1000229] = "fixed-version: fixed since 2.2.1"