From patchwork Thu Oct 15 05:40:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100797 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 295FCCC6B2F for ; Thu, 15 Oct 2026 05:42:56 +0000 (UTC) Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32789.1792042971651557341 for ; Wed, 14 Oct 2026 22:42:51 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=X5tmFoUa; spf=pass (domain: gmail.com, ip: 209.85.214.175, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2e5d0ee1951so30918445ad.0 for ; Wed, 14 Oct 2026 22:42:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042971; x=1792647771; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=B2mroNgXCjWb0DUGga54BzEbdtygFiP3E6llww/7/18=; b=X5tmFoUaTvUPdu0HcVwgIE63wF9wpYb+QHw2cM8U34RWRS/SE9F2rFCsnknRQSCXTi AeIqBnDqduzoaueoQsAVZW7Ih/TYJ5n3sUjnPnXRV+qOFhTz+5UTbzC4+wXQHrompHnA vu7c4V+/wshaQZ/lwz7LpT6JJ4+B0YUd2e+fXrz+zbKNe27P4qEQBIae/MmlyGFsQZwc t/rjLPD52YRxZN61IN3cfrMt/LtffLSIbdApuNauY3R3eEENXhTuttYi5g5ys+JScch0 nj9KcU1zlZGTQhnymgyxnKGbnXxrKt3oQzF6ccx8AJIyD95DJXRXz/dp9saPxjiRMOHe 1zgg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042971; x=1792647771; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=B2mroNgXCjWb0DUGga54BzEbdtygFiP3E6llww/7/18=; b=qKX5HYKc0y5UHLENEKAslfRMi6YIt+y1KUgoUdgVUenSv0aRVOn/Hr4pnCyvQwMtto +hRUoAOtWKLhWxEQ+S7G8Jh4nf6EW4sGqAwXEnk+3211Cpk3WLVlqwCImLcr6tQEQ+1y Opj0k7jEqAfw5eprxPtRqJ9U5xkdOslBIHR8A2tk6GFIQVcqTcj1G23bH3yfWlJF+lc1 NstvTfkdq3gLmWdVWfnG9UniyUzQ0QXknAFKAkqkeQ+I8pdCews/BZmLQvY0naHI/xCi vsO+ZC2yKZJ+lDNZ6g4SBPxHgy/tLwpmuEeMTbD005aA5PyuZhHegBIdFza5m5yRXyOq WmmQ== X-Gm-Message-State: AFq9FYKZ/q7Qsy45zOPJRsVLrW1TBVs707PO1tYm6H+59urT/3LP20Zr 9P5ebj/FoxFjry31S9aX/+/OnDx+uDHPL5LgbHbIpoRN9jD2aKRTJDUuCgwoMg== X-Gm-Gg: AYBFou0AHtrsZFh1/Yk8F5ny3uAb0MwftxEq9cTzxRPsWRyZfvq1cOgHNeLFHgk/1q6 r/xKubHrle+F4F4wrrFySYUKjkWn2rFpvJaRxO2c7GGf6/4rU1WMSeeETa2SRQitZrtCNNMJKEe GwyMXHhaZt3NYW+4KtvZjngK6nn8dKWw9xeGkZzS88UQCg2lFtgyCH8hgHjy7LAV13yFYxgAleK MMtod3obdwHn6QMNL6DZ/lnn8OCfhsbBcJzNquNmRHam1wKMU3TzVP+YM5hOMN7iZhOMLYl1y3i oYZs1ucDi+EvftwS1RtpdK4eKepFfQkq1b61xQnpV4y+CzkHPXuiZF08DoxSNWXQ9mEZfd34kqp PA1/uOaTZS6tDHvqu+zp2C6Ltt1oIZr0KgYNQueI+E7zOwh3xNepu3vgqLwiHrfS+7HlwO6J/oj ucPvCJJ2MvdYINnCf9EbHr/MHC3qHHMeqEuZeWhEbXhkMiFuqfRVbQ1NQUNoMZ/UE4Asd4R0g8H OQoZnC2cG2niQ7C7GIRoUg= X-Received: by 2002:a17:903:1ac7:b0:2e9:60fb:5e41 with SMTP id d9443c01a7336-2e960fb6555mr7594415ad.50.1792042970797; Wed, 14 Oct 2026 22:42:50 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.42.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:42:50 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 01/82] readme: update maintainer Date: Thu, 15 Oct 2026 18:40:49 +1300 Message-ID: <9dd6d4a720db5a84f08c956c5ff6de0a51ec709e.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:42:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130921 From: Ankur Tyagi Signed-off-by: Ankur Tyagi --- README.md | 2 +- meta-filesystems/README.md | 10 +++++----- meta-gnome/README.md | 10 +++++----- meta-initramfs/README.md | 8 ++++---- meta-multimedia/README.md | 10 +++++----- meta-networking/README.md | 8 ++++---- meta-oe/README.md | 8 ++++---- meta-perl/README.md | 10 ++++------ meta-python/README.md | 12 +++++------- meta-webserver/README.md | 10 +++++----- meta-xfce/README.md | 11 +++++------ 11 files changed, 47 insertions(+), 52 deletions(-) diff --git a/README.md b/README.md index 9fc30bda95..f445aed152 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ Collection of layers for the OE-core universe -Main layer maintainer: Khem Raj +Main layer maintainer: Ankur Tyagi This repository is a collection of layers to supplement OE-Core with additional packages, Each layer have designated maintainer diff --git a/meta-filesystems/README.md b/meta-filesystems/README.md index 78a4429ce2..28c2f14733 100644 --- a/meta-filesystems/README.md +++ b/meta-filesystems/README.md @@ -11,26 +11,26 @@ URI: git://git.openembedded.org/openembedded-core layers: meta - branch: master + branch: blacksail URI: git://git.openembedded.org/meta-openembedded layers: meta-oe - branch: master + branch: blacksail Patches ======= Please submit any patches against the filesystems layer to the OpenEmbedded development mailing list (openembedded-devel@lists.openembedded.org) -with '[meta-filesystems]' in the subject. +with '[meta-filesystems][blacksail]' in the subject. -Layer maintainer: Khem Raj +Layer maintainer: Ankur Tyagi When sending single patches, please use something like: git send-email -1 -M \ --to openembedded-devel@lists.openembedded.org \ - --subject-prefix='meta-filesystems][PATCH' + --subject-prefix='meta-filesystems][blacksail][PATCH' Table of Contents diff --git a/meta-gnome/README.md b/meta-gnome/README.md index 6c23b4e671..7d66dfce27 100644 --- a/meta-gnome/README.md +++ b/meta-gnome/README.md @@ -3,14 +3,14 @@ This layer depends on: URI: git://git.openembedded.org/openembedded-core -branch: master +branch: blacksail URI: git://git.openembedded.org/meta-openembedded -branch: master +branch: blacksail -Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-gnome]' in the subject' +Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-gnome][blacksail]' in the subject' When sending single patches, please use something like: -git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-gnome][PATCH' +git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-gnome][blacksail][PATCH' -Layer maintainer: Khem Raj +Layer maintainer: Ankur Tyagi diff --git a/meta-initramfs/README.md b/meta-initramfs/README.md index e074142be7..cca1b5f174 100644 --- a/meta-initramfs/README.md +++ b/meta-initramfs/README.md @@ -12,19 +12,19 @@ This layer depends on: URI: git://git.openembedded.org/meta-openembedded -branch: master +branch: blacksail Maintenance ----------- Send patches / pull requests to openembedded-devel@lists.openembedded.org -with '[meta-initramfs]' in the subject. +with '[meta-initramfs][blacksail]' in the subject. When sending single patches, please use something like: -git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-initramfs][PATCH' +git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-initramfs][blacksail][PATCH' -Interim layer maintainer: Khem Raj +Interim layer maintainer: Ankur Tyagi License diff --git a/meta-multimedia/README.md b/meta-multimedia/README.md index bda470a6f6..5f847c259c 100644 --- a/meta-multimedia/README.md +++ b/meta-multimedia/README.md @@ -1,17 +1,17 @@ This layer depends on: URI: git://git.openembedded.org/openembedded-core -branch: master +branch: blacksail URI: git://git.openembedded.org/meta-openembedded layers: meta-oe -branch: master +branch: blacksail -Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-multimedia]' in the subject +Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-multimedia][blacksail]' in the subject When sending single patches, please use something like: -git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-multimedia][PATCH' +git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-multimedia][blacksail][PATCH' You are encouraged to fork the mirror on github https://github.com/openembedded/meta-openembedded to share your patches, this is preferred for patch sets consisting of more than one patch. Other services like GitLab, repo.or.cz or self hosted setups are of course accepted as well, 'git fetch ' works the same on all of them. We recommend github because it is free, easy to use, has been proven to be reliable and has a really good web GUI. -Layer maintainer: Khem Raj +Layer maintainer: Ankur Tyagi diff --git a/meta-networking/README.md b/meta-networking/README.md index f8337b0c5b..094a85b9d9 100644 --- a/meta-networking/README.md +++ b/meta-networking/README.md @@ -18,21 +18,21 @@ This layer depends on: URI: git://git.openembedded.org/openembedded-core -branch: master +branch: blacksail For some recipes, the meta-oe layer is required: URI: git://git.openembedded.org/meta-openembedded subdirectory: meta-oe -branch: master +branch: blacksail URI: git://git.openembedded.org/meta-openembedded subdirectory: meta-python -branch: master +branch: blacksail Maintenance ----------- -Layer maintainers: Khem Raj +Layer maintainers: Ankur Tyagi Please see the MAINTAINERS file for information on contacting the diff --git a/meta-oe/README.md b/meta-oe/README.md index da6c4cbe79..345b3ca903 100644 --- a/meta-oe/README.md +++ b/meta-oe/README.md @@ -4,7 +4,7 @@ This layer depends on: URI: git://github.com/openembedded/openembedded-core.git -branch: master +branch: blacksail luajit recipe requires host compiler to be able to generate 32bit code when target is 32bit e.g. arm, so ensure that $CC -m32 is functional on build host, if building this recipe, needed @@ -16,10 +16,10 @@ Ubuntu sudo apt-get install gcc-multilib linux-libc-dev:i386 -Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-oe]' in the subject' +Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-oe][blacksail]' in the subject' When sending single patches, please use something like: -'git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix="meta-oe][PATCH"' +'git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix="meta-oe][blacksail][PATCH"' You are encouraged to fork the mirror on GitHub https://github.com/openembedded/meta-openembedded to share your patches, this is preferred for patch sets consisting of more than one patch. @@ -33,4 +33,4 @@ 'git fetch ' works the same on all of them. We recommend GitHub because it is free, easy to use, has been proven to be reliable and has a really good web GUI. -Layer maintainer: Khem Raj +Layer maintainer: Ankur Tyagi diff --git a/meta-perl/README.md b/meta-perl/README.md index 9d56dbe8c6..9fb1d7d864 100644 --- a/meta-perl/README.md +++ b/meta-perl/README.md @@ -52,7 +52,7 @@ This layer depends on: URI: git://git.openembedded.org/openembedded-core - branch: master + branch: blacksail Adding the meta-perl layer to your build --------------------------------------- @@ -73,14 +73,12 @@ ----------- Send patches / pull requests to openembedded-devel@lists.openembedded.org with -'[meta-perl]' in the subject. +'[meta-perl][blacksail]' in the subject. When sending single patches, please use something like: -git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-perl][PATCH' +git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-perl][blacksail][PATCH' -Layer maintainers: - Hongxu Jia - Tim "moto-timo" Orling +Layer maintainers: Ankur Tyagi License ------- diff --git a/meta-python/README.md b/meta-python/README.md index 36c193957c..36255167b6 100644 --- a/meta-python/README.md +++ b/meta-python/README.md @@ -13,11 +13,11 @@ URI: git://git.openembedded.org/openembedded-core layers: meta - branch: master + branch: blacksail URI: git://git.openembedded.org/meta-openembedded layers: meta-oe - branch: master + branch: blacksail Contributing ------------------------- @@ -28,14 +28,12 @@ before posting. Send pull requests to openembedded-devel@lists.openembedded.org with -'[meta-python]' in the subject. +'[meta-python][blacksail]' in the subject. When sending single patches, please use something like: -git send-email -M -1 --to=openembedded-devel@lists.openembedded.org --subject-prefix='meta-python][PATCH' +git send-email -M -1 --to=openembedded-devel@lists.openembedded.org --subject-prefix='meta-python][blacksail][PATCH' Maintenance ------------------------- -Layer maintainers: - Tim "moto-timo" Orling - Derek Straka +Layer maintainers: Ankur Tyagi diff --git a/meta-webserver/README.md b/meta-webserver/README.md index 565269648d..1562365e47 100644 --- a/meta-webserver/README.md +++ b/meta-webserver/README.md @@ -13,13 +13,13 @@ URI: git://git.openembedded.org/openembedded-core subdirectory: meta -branch: master +branch: blacksail For some recipes, the meta-oe layer is required: URI: git://git.openembedded.org/meta-openembedded subdirectory: meta-oe -branch: master +branch: blacksail @@ -50,14 +50,14 @@ ----------- Send patches / pull requests to openembedded-devel@lists.openembedded.org -with '[meta-webserver]' in the subject. +with '[meta-webserver][blacksail]' in the subject. When sending single patches, please use something like: ``` -git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix="meta-webserver][PATCH" +git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix="meta-webserver][blacksail][PATCH" ``` -Layer maintainer: Derek Straka +Layer maintainer: Ankur Tyagi License diff --git a/meta-xfce/README.md b/meta-xfce/README.md index 564590ff39..d032d1b076 100644 --- a/meta-xfce/README.md +++ b/meta-xfce/README.md @@ -1,10 +1,10 @@ This layer depends on: URI: git://git.openembedded.org/openembedded-core -branch: master +branch: blacksail URI: git://git.openembedded.org/meta-openembedded -branch: master +branch: blacksail meta-xfce depends on meta-oe, meta-gnome and meta-multimedia in this repository. @@ -13,10 +13,9 @@ BBMASK = "meta-xfce/recipes-multimedia" -Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-xfce]' in the subject' +Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-xfce][blacksail]' in the subject' When sending single patches, please use something like: -git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-xfce][PATCH' +git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-xfce][blacksail][PATCH' -Layer maintainer: Kai Kang -Layer maintainer: Khem Raj +Layer maintainer: Ankur Tyagi From patchwork Thu Oct 15 05:40:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100796 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44A6ECC6B3A for ; Thu, 15 Oct 2026 05:42:56 +0000 (UTC) Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32790.1792042973579838092 for ; Wed, 14 Oct 2026 22:42:53 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=XxptVoL1; spf=pass (domain: gmail.com, ip: 209.85.214.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2e812e2b31bso27727015ad.3 for ; Wed, 14 Oct 2026 22:42:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042973; x=1792647773; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=6XFErGIZX9Fhi/AwL31IjD2jBf3aVWUSf4PZDRq5+Aw=; b=XxptVoL1DGRzn0jO1IYjea4e9pO4q3VcHuQO7P0RVdrMvQvQ2UBo0oQW+Xzy8j+lXW 0QZBemYEalfbMeEcSePEPIIADLh15id4PyoejMKe6p/aY8rrsU+MKP69HcPlB/vtIAT5 yiaaIODTlOAZA61Thz3ZZudu3qsP9Pb1lquVyR8CuSpjXX/6xjp91k8+IBxNrz4KQAFo yhTbBI+1bSuTST5wsuv9JTIH1sEl3Fbe/Y5kIR0Dp7zPGn8DKDJoSneB3KC397tokm1W xZXhpKK1dtO6orABHSPFSjmpG+iMWLxm24qLYEmmWzJrnMsYbdU2W9cYVGy1Qjt7RE/m xYjw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042973; x=1792647773; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=6XFErGIZX9Fhi/AwL31IjD2jBf3aVWUSf4PZDRq5+Aw=; b=sDjs5dM/BXJU5lRmxwA26QrMtfI4L4e3wiBvk17OJTje6eGYS6nWqx4W78GIZ449uZ qD3iYXf36dLGFrBRd2Ob6J0pUns8CG5qOqlri5DnxI3VkXincjFzdJ95deBV/vbtrGCF UK+/4gmRpt3UA2URF2/CqwlCgBh2upGI7kxg3diGXYZ+tG7T0khS+ZVBivkEEn2KQb2b mVSse3oH13/Ui8Ty/ub/91Hj2N9aPm0ohi+mUFeF2ZqHTrZV7cPJoV24Bes+82KB93sz u5OJT5wLj3xlGlfmqc6oiV0cY1OMohDrqDWiFg19uELZ+JURn8kFF1WHDKwCIuuKIHtM M97Q== X-Gm-Message-State: AFq9FYJrQ0AYqy3n608GlAShCCMBK9UTZfeXghx621CXJPsZuBwVV3De +zIUQouSDd9GLa6kwhtUxzA4loJ6SpdL0dW2ScVCA0ZSEgv1LJIma+x/rV0jQA== X-Gm-Gg: AYBFou0asZwGRLU5HT+P82Vpo/R97wvEZsDefTXqU+0Ls7bOJQ0qCxPDxDKZkK0X8Ko s62BvxkNs7jt+QiCmORTWAdDf3Tip6VOCAwd60Td6wdYh+0EKZUnn8yJyJ5vgwf9dZDe8H1LFmx QyFsovjpwDgsDUI/AbuekXL7PfXftjN9GocAiT5EFQGqFy4BuPpp2WLcBc/pgWjHj7+AOTfhYd3 k/TgggXY+5j3k4hN23N4NVg3mJPt44nYvN2XLc+ZmnHVIoui7VkzLFx+UL3KgfTyuHx7zTOoHyF cwJ7VSleb5fDS9R+DmptsR2ASFJ4CZb/z48Dwp9QMBB3BffglKKfgwPG6D12JFEJXG7GGj54XV3 Lhym8SUnMgt8b1sqex9oHjea0/E+Z8yDgqcolva0R+5zXWm244Z7GILnPB3+Q+p+f2XYCft03g3 BdS5AM7X3jPfx7twStD6pRZyTAsE9ffKKHGzX97TE+R3oliAJObpIJQ6/RxV/UyWJzoLPkxz5YP pyBu4xq6AyLmzZoH7Ss5LQ= X-Received: by 2002:a17:902:ef4f:b0:2e5:c563:c0dc with SMTP id d9443c01a7336-2e842cdb0f8mr162708665ad.42.1792042972792; Wed, 14 Oct 2026 22:42:52 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.42.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:42:52 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 02/82] Revert "libpwquality: remove recipe (moved to oe-core)" Date: Thu, 15 Oct 2026 18:40:50 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:42:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130922 From: Markus Volk This reverts commit 50d5f23e07431865470d16aeaeb8e442f690186b. The import into oe-core (3d295bef38 "libpwquality: import recipe from meta-oe") is only in oe-core master, not in blacksail, so on blacksail the recipe is missing and gnome-disk-utility, gnome-control-center, cryptsetup and others fail with "Nothing PROVIDES 'libpwquality'". AI-Generated: Uses Claude Code (Claude Opus 4.5) Signed-off-by: Markus Volk Signed-off-by: Ankur Tyagi --- .../packagegroups/packagegroup-meta-oe.bb | 1 + ...-Use-setuptools-instead-of-distutils.patch | 78 +++++++++++++++++++ ...02-Makefile.am-respect-PYTHONSITEDIR.patch | 26 +++++++ .../libpwquality/libpwquality_1.4.5.bb | 39 ++++++++++ 4 files changed, 144 insertions(+) create mode 100644 meta-oe/recipes-extended/libpwquality/files/0001-Use-setuptools-instead-of-distutils.patch create mode 100644 meta-oe/recipes-extended/libpwquality/files/0002-Makefile.am-respect-PYTHONSITEDIR.patch create mode 100644 meta-oe/recipes-extended/libpwquality/libpwquality_1.4.5.bb diff --git a/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb b/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb index cc3f7cf064..225cd95604 100644 --- a/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb +++ b/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb @@ -368,6 +368,7 @@ RDEPENDS:packagegroup-meta-oe-extended = "\ liblognorm \ libmodbus \ libplist \ + libpwquality \ libqb \ librelp \ ${@bb.utils.contains("DISTRO_FEATURES", "systemd", "libreport", "", d)} \ diff --git a/meta-oe/recipes-extended/libpwquality/files/0001-Use-setuptools-instead-of-distutils.patch b/meta-oe/recipes-extended/libpwquality/files/0001-Use-setuptools-instead-of-distutils.patch new file mode 100644 index 0000000000..7eaca66b5c --- /dev/null +++ b/meta-oe/recipes-extended/libpwquality/files/0001-Use-setuptools-instead-of-distutils.patch @@ -0,0 +1,78 @@ +From ad95b7684365dea8335c34527d4c1463c1668af0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= +Date: Fri, 31 Mar 2023 14:52:19 +0200 +Subject: [PATCH] Use setuptools instead of distutils + +distutils is removed from Python 3.12+: +https://peps.python.org/pep-0632/ + +Upstream-Status: Backport [https://github.com/libpwquality/libpwquality/commit/7b5e0f0097faebdcc6a8b783237bbba7a983147a] +Signed-off-by: Alexander Kanavin +--- + libpwquality.spec.in | 11 ++--------- + python/Makefile.am | 2 +- + python/setup.py.in | 6 +++--- + 3 files changed, 6 insertions(+), 13 deletions(-) + +diff --git a/libpwquality.spec.in b/libpwquality.spec.in +index 70a6f53..0809126 100644 +--- a/libpwquality.spec.in ++++ b/libpwquality.spec.in +@@ -33,9 +33,11 @@ BuildRequires: gettext + BuildRequires: pam-devel + %if %{with python2} + BuildRequires: python2-devel ++BuildRequires: python2-setuptools + %endif + %if %{with python3} + BuildRequires: python3-devel ++BuildRequires: python3-setuptools + %endif + + URL: https://github.com/libpwquality/libpwquality/ +@@ -103,15 +105,6 @@ cp -a . %{py3dir} + pushd %{py3dir} + %endif + %if %{with python3} +-# setuptools >= 60 changes the environment to use its bundled copy of distutils +-# by default, not the Python-bundled one. To run the Python's standard library +-# distutils, the environment variable must be set. +-# Although technically setuptools is not needed for this package, if it's +-# pulled by another package, it changes the environment and consequently, +-# the build fails. This was reported in: +-# https://github.com/pypa/setuptools/issues/3143 +-export SETUPTOOLS_USE_DISTUTILS=stdlib +- + %configure \ + --with-securedir=%{_moduledir} \ + --with-pythonsitedir=%{python3_sitearch} \ +diff --git a/python/Makefile.am b/python/Makefile.am +index 1d00c0c..6e51744 100644 +--- a/python/Makefile.am ++++ b/python/Makefile.am +@@ -14,7 +14,7 @@ all-local: + CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) + + install-exec-local: +- CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) install --prefix=${DESTDIR}${prefix} ++ CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) install --root ${DESTDIR} --prefix=${prefix} + + clean-local: + rm -rf py$(PYTHONREV) +diff --git a/python/setup.py.in b/python/setup.py.in +index a741b91..f934c50 100755 +--- a/python/setup.py.in ++++ b/python/setup.py.in +@@ -6,9 +6,9 @@ + + import os + +-from distutils.core import setup, Extension +-from distutils.command.build_ext import build_ext as _build_ext +-from distutils.command.sdist import sdist as _sdist ++from setuptools import setup, Extension ++from setuptools.command.build_ext import build_ext as _build_ext ++from setuptools.command.sdist import sdist as _sdist + + def genconstants(headerfile, outputfile): + hf = open(headerfile, 'r') diff --git a/meta-oe/recipes-extended/libpwquality/files/0002-Makefile.am-respect-PYTHONSITEDIR.patch b/meta-oe/recipes-extended/libpwquality/files/0002-Makefile.am-respect-PYTHONSITEDIR.patch new file mode 100644 index 0000000000..cd59a6d887 --- /dev/null +++ b/meta-oe/recipes-extended/libpwquality/files/0002-Makefile.am-respect-PYTHONSITEDIR.patch @@ -0,0 +1,26 @@ +From edc51ba1b446913232cdf2945f485392bca72dc7 Mon Sep 17 00:00:00 2001 +From: Hongxu Jia +Date: Mon, 3 Aug 2015 13:43:14 +0800 +Subject: [PATCH] Makefile.am: respect ${PYTHONSITEDIR} + +Signed-off-by: Hongxu Jia +Signed-off-by: Martin Jansa +--- +Upstream-Status: Backport [https://github.com/libpwquality/libpwquality/commit/5192eab011ada47b0157f8d0524bf5b18bba3bd0] + + python/Makefile.am | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/python/Makefile.am b/python/Makefile.am +index 6e51744..0a3bad5 100644 +--- a/python/Makefile.am ++++ b/python/Makefile.am +@@ -14,7 +14,7 @@ all-local: + CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) + + install-exec-local: +- CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) install --root ${DESTDIR} --prefix=${prefix} ++ CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) install --root ${DESTDIR} --prefix=${prefix} --install-lib=$(pythonsitedir) + + clean-local: + rm -rf py$(PYTHONREV) diff --git a/meta-oe/recipes-extended/libpwquality/libpwquality_1.4.5.bb b/meta-oe/recipes-extended/libpwquality/libpwquality_1.4.5.bb new file mode 100644 index 0000000000..b7c673be52 --- /dev/null +++ b/meta-oe/recipes-extended/libpwquality/libpwquality_1.4.5.bb @@ -0,0 +1,39 @@ +DESCRIPTION = "Library for password quality checking and generating random passwords" +HOMEPAGE = "https://github.com/libpwquality/libpwquality" +SECTION = "devel/lib" + +LICENSE = "GPL-2.0-or-later" +LIC_FILES_CHKSUM = "file://COPYING;md5=6bd2f1386df813a459a0c34fde676fc2" + +DEPENDS = "cracklib" + +SRC_URI = "git://github.com/libpwquality/libpwquality;branch=master;protocol=https \ + file://0001-Use-setuptools-instead-of-distutils.patch \ + file://0002-Makefile.am-respect-PYTHONSITEDIR.patch \ +" +SRCREV = "5490e96a3dd6ed7371435ca5b3ccef98bdb48b5a" + + +inherit autotools-brokensep gettext +inherit_defer ${@bb.utils.contains('PACKAGECONFIG', 'python3', 'setuptools3-base', '', d)} + +do_configure:prepend() { + cp ${STAGING_DATADIR_NATIVE}/gettext/ABOUT-NLS ${AUTOTOOLS_AUXDIR}/ +} + +export PYTHON_DIR +export BUILD_SYS +export HOST_SYS + +EXTRA_OECONF += "--libdir=${libdir} \ + --with-securedir=${base_libdir}/security \ +" + +PACKAGECONFIG ??= "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam', '', d)} python3" +PACKAGECONFIG[pam] = "--enable-pam,--disable-pam,libpam" +PACKAGECONFIG[python3] = "--enable-python-bindings --with-python-rev=${PYTHON_BASEVERSION} --with-python-binary=${STAGING_BINDIR_NATIVE}/python3-native/python3 --with-pythonsitedir=${PYTHON_SITEPACKAGES_DIR},--disable-python-bindings,python3-setuptools-native" + +FILES:${PN} += "${base_libdir}/security/pam_pwquality.so" +FILES:${PN}-dbg += "${base_libdir}/security/.debug" +FILES:${PN}-staticdev += "${base_libdir}/security/pam_pwquality.a" +FILES:${PN}-dev += "${base_libdir}/security/pam_pwquality.la" From patchwork Thu Oct 15 05:40:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100794 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1BAC8CC6B39 for ; Thu, 15 Oct 2026 05:42:56 +0000 (UTC) Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32791.1792042975481727279 for ; Wed, 14 Oct 2026 22:42:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=E6Eyk5uf; spf=pass (domain: gmail.com, ip: 209.85.214.181, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2e8455755f3so25496125ad.0 for ; Wed, 14 Oct 2026 22:42:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042975; x=1792647775; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=WdpT7UjNmsfxPYoCphuPVuL7XK/Fr3qj/oS92gc0yt0=; b=E6Eyk5ufGpNp/k+eMB3hsaFPtQeTWPKYvNVNVab0seshpw0voDjdiPxUydgVxwKBjs IxMWxRQBOM1Umqmi7OB4ZZGYcjpaBBfmxOqon27IlsDj0r7jraYeZzQ+dIrIMYrQvuXx XV0LL9ZYzGzhZ2ktlLMLwDvA+2yoaXb7F7tv3NFA/RE2wVD1mGBibNF00Y/KetaHT+mI jsrNH6rYM3mshJNWAb/pMljJXyuQd2KoSUQ8+djRfDB3ibxQlp2sa1vah5q67BfBXlKN x4XPxJnRuY5QfBiNMfk/wiz8vFDPMd3tLPiOa3qFpY4ArtqIRbpbOa4atSVPHcKiz2R3 WIYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042975; x=1792647775; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=WdpT7UjNmsfxPYoCphuPVuL7XK/Fr3qj/oS92gc0yt0=; b=u2wP3JPQwLr/ja9MVxQ4kFUZ+DwYc2Z0qiiTwaNuz0npSOs7Ic0sQl0V1AtrJt1izv 3+CRkA+Vdc//GOeYtQUIdadZd2HOeHcctGlqxkqgtSXtoG/U7mW+bN0ef1exEOHg1THW 7fhtI/YIwpDavE2U+D3nQAY3Cd4t5TWTsZ610MpyoX+jRjVzakuzsKScS0XiUuslL7Jc diYw39eFCOvwlaMk5m23pInosr3T1/ftw6mHsfdGX5ChmjYnjZk35BNWHMGKPQDRG8xI BOF0BALZiPeN1MP8UoGYBdLvGoSSXqvLjn3I4LH/btdCdyS5HmCt2guOwW1kytShThnY COUQ== X-Gm-Message-State: AFq9FYK1XPti3jsCogyYPZ38vsocFpiTaZJYB5I6hlFeQCYGPyGLlR7/ m15DHat1/sCGd4C4/d3Ix0intvH57GyEnRFu38YZXvve6N/G0xj6he2x8JjE6Q== X-Gm-Gg: AYBFou37Wzi7/I62OxDxSurDr0otblFBLnSxg8JGGbCK3MwyJVOsNIcWK7gjeVgFpQ2 49bu5jceWqFBywhubJ1eRBLZR2OJP9hWtS+5AU/vdp1EHBuWYT0RvKmGTCCIc/4lWYPpHjzM9zh e9DiBqCnlpAVhSPm5g+0vYCLDnzqNAvWYUn/SSl6kpH6N/tCuCbNYvohi3IzxMG4E9KNF4ieEHW DLwZ4iOHug9PX04LxCQpV5wdLqlm2iND+8HvxTtiqJ/rNfkHRYUSZQmt2eL40goVR68fAkELIzd BYnm5GK6BRgf7hlEBLfSvIGv7R65BXckYl60jlLSOMK3NYsrC7W9LwWvV+mvlLJdD+8sqVGf6kw SW8PLBLW14IW6Lnd2K2YisB+ILVVpgIJcK8sU1Ym/ZNbnEe4fmVk9/PbqEiQyGi+crGmM9Emfqv FSEJRjsTWZYn0op6im4YTylEw+nQJO/zgLLcG1YmC6+eJYzl0nkK54M8s8yhzlAlmKENEBWGK02 wj61l75iPLUnDcP3SS3HIs= X-Received: by 2002:a17:903:41d0:b0:2e5:467a:7a6b with SMTP id d9443c01a7336-2e8429a9fb0mr162022125ad.10.1792042974774; Wed, 14 Oct 2026 22:42:54 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.42.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:42:54 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 03/82] pcsc-lite: create pcscd user and group also via useradd Date: Thu, 15 Oct 2026 18:40:51 +1300 Message-ID: <82effe671227815a2c64aa2a7431e074961d20d7.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:42:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130923 From: Bastian Krause The recipe currently only does this via systemd-sysusers. This does not work for read-only root filesystems, though. So use useradd to create the pcscd user and group. Signed-off-by: Bastian Krause Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.5.1.bb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.5.1.bb b/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.5.1.bb index a8735a449f..daa1b78304 100644 --- a/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.5.1.bb +++ b/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.5.1.bb @@ -14,7 +14,7 @@ DEPENDS = "autoconf-archive-native flex-native" SRC_URI = "https://pcsclite.apdu.fr/files/${BP}.tar.xz" SRC_URI[sha256sum] = "bfcfe38a20afc49849c6bf55325e38f449fc4b26d3923fdc32b969ae41a8741b" -inherit meson systemd pkgconfig perlnative +inherit meson systemd pkgconfig perlnative useradd EXTRA_OEMESON = " \ -Dlibusb=false \ @@ -37,6 +37,9 @@ RRECOMMENDS:${PN} = "ccid" RRECOMMENDS:${PN}:class-native = "" RPROVIDES:${PN}:append:class-native = " pcsc-lite-lib-native" +USERADD_PACKAGES = "${PN}" +USERADD_PARAM:${PN} = "--system --no-create-home --shell /sbin/nologin --user-group pcscd" + FILES:${PN} = "${sbindir}/pcscd \ ${datadir}/polkit-1 \ ${systemd_system_unitdir}/pcscd.service \ From patchwork Thu Oct 15 05:40:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100799 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70195CC6B39 for ; Thu, 15 Oct 2026 05:43:06 +0000 (UTC) Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32792.1792042977166396527 for ; Wed, 14 Oct 2026 22:42:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=JdZS3Ff7; spf=pass (domain: gmail.com, ip: 209.85.214.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2e5fb79ce82so27170745ad.0 for ; Wed, 14 Oct 2026 22:42:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042976; x=1792647776; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=TAfdUnIwmvrzKpbSCQYVK04czpkDUk+G/wFJ7mMs20U=; b=JdZS3Ff7MOG9gOsGOOZ++i58IZCcgMFDLDpnPpeJvlmW3itGF6/+pQuRZx274ZUgAM 4tBc9pCPe+Kcmvkh3F4hbbcd/lqMfQ9t132iff/6k469q82Lv4jTR+mI1XDueAKw14rq xrZWx3TWUx4K5Tq5cXLtH6pHwP8RKm/1r9bioOMROVlqGLy3J8sCUaaR2/cu66D2TgA5 36pUoLd+dV46p84ZOzTaDPkONbyOhmT+T363q4WSg1swxGCLIrB737vc24Tw3prPJLnV 5WZK585Np4KOnxG7Tm0+zLsV2+ZiTFcEn9fHTgwnPgQ15blfRC4h3Vg4equziJWSJ6f+ 79xA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042976; x=1792647776; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=TAfdUnIwmvrzKpbSCQYVK04czpkDUk+G/wFJ7mMs20U=; b=Jhklo6RlXXaPU7aZtgkCFR6ZMDj2nkwfB2kb+9DBicC5tqS0Tzs9lj5+e9KdboXuMi 8tPDn4BiZjUSaNkJS/B1K6/RKjLZgN5/a/Rix0lh76+8FfxunQFuRu8moGTySbbOiygE +mfgRl1FLSU4xQ7GS+wIly6XyhGYBv/s259qq/DFTPs/ggmfTPI0msjSIHXhCo5in4vR j2WadyjmUvNQjxgrdYh440mPoIjJWXY/aC15Ill66gai7QB0lbCPZV+hGRRuVBcSHY0x mIETMVON+F2CKuHKVmWMkcu+Hu2t8nplAxxQ9hbdb6FYsAJ3JDuteZT9q5qULAWgtYja 59MQ== X-Gm-Message-State: AFq9FYJvq8Ib/xslLGfaOc5duFunF+Ej2+j3ppvd85hQH+rj1lT4jO8A bNhNe9QNvYW3vL/mXgpiCWRtQk4HNgJ8byCBDgzaqrF8Tf2njhUhwB2Y6/sAJw== X-Gm-Gg: AYBFou1JyUTCWIPlszVJNn79biHOtP2rt9eQ7nj/JnmRG1pR6p/r31r/cDOf+eGrDod G23NnaWp233gAVBglhTMQg86+ELuIhgasfBrO8zMan9RpVdVcJDmWuXh2S79PggxyHo79CpGIzC kqqhzBTYqqgx8f1Ge/x0aXGsAKX70idKujwz2jYWxh9+rGA3Doa/5kgRsZ5hu9V5PPIg4VOZjzy gWNhKN6mUZ4kKVpXis69HEwIWWhosPGYW+MVQLf7LEMQUYgpfJkigHfzCCtxk1UfhMkbVcfKua9 pbdx0zngGXYBlN8acH7xFjj2mHlVaCv+Z++j3JX1fcXnLCdXA22CnRZ5db/ZanOCPimkjHi0YcZ ByrLm6fshj68fSltTcVuWQjvFDxgbT2S6M1xZ0bWkkwdWyJhtK1cO2mEoovCzP8+nRUuDx+wuc8 vj+9Tx0E93edPjsXREC5JzRNxKpkPyId0BQUQfk+HR7kxh8zlAl1CUVtkgjZtcz2/Yz6CF5Ozy/ wabBzVp2QdYxFt90L9vCsA= X-Received: by 2002:a17:902:ce12:b0:2e2:aa17:477f with SMTP id d9443c01a7336-2e842f11b4bmr161356685ad.58.1792042976483; Wed, 14 Oct 2026 22:42:56 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.42.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:42:56 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 04/82] Revert "gnome-shell-extensions: upgrade 50.3 -> 51.0" Date: Thu, 15 Oct 2026 18:40:52 +1300 Message-ID: <8c6b70d35aed8157362126052116c68b97576193.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130924 From: Markus Volk This reverts commit 89448d167e9e672609801802286c432ad0b88218. The extensions follow gnome-shell, which goes back to 50.4 on blacksail. AI-Generated: Uses Claude Code (Claude Opus 5.5) Signed-off-by: Markus Volk Signed-off-by: Ankur Tyagi --- ...-shell-extensions_51.0.bb => gnome-shell-extensions_50.3.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-gnome/recipes-gnome/gnome-shell/{gnome-shell-extensions_51.0.bb => gnome-shell-extensions_50.3.bb} (85%) diff --git a/meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_51.0.bb b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_50.3.bb similarity index 85% rename from meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_51.0.bb rename to meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_50.3.bb index 9b58d976ef..a7a5b06fb9 100644 --- a/meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_51.0.bb +++ b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_50.3.bb @@ -6,7 +6,7 @@ inherit gnomebase gettext gsettings features_check REQUIRED_DISTRO_FEATURES = "x11 polkit systemd pam gobject-introspection-data" -SRC_URI[archive.sha256sum] = "3c078d7b88faee3d0f68adcee1392b1bed84731b91a337ec894cc88aa8a8b813" +SRC_URI[archive.sha256sum] = "68fc74306f88f697a6bcdb8243cb32a9ec0cd3f6e2bb92249b24b60fc57450b6" EXTRA_OEMESON += " \ -Dextension_set=all \ From patchwork Thu Oct 15 05:40:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100801 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84EA1CC6B2F for ; Thu, 15 Oct 2026 05:43:06 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33227.1792042979098052013 for ; Wed, 14 Oct 2026 22:42:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=MQ2Cwcze; spf=pass (domain: gmail.com, ip: 209.85.214.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2e8246b13cbso36311265ad.2 for ; Wed, 14 Oct 2026 22:42:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042978; x=1792647778; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=kakb93U1OD84xHRnqJXsVmDbCF8ULncwq52EJhNmAWo=; b=MQ2Cwcze0nw2nUIKFdvrXQsl4Z82GsiQQ+vEOlYvl09enyzdJyQl6sHicg9jhuuiVC uzxsxm34PaCPFEMk2oUQ85Q/wwhsXDEALJMo7gvYlrEWzkisfb7hXmgdoxACKBko0Xn9 m1tHdToC1L9dTntq8qjoeJzox84GgdRFqoSVNEPDlgN9RedY+Li1eNzjOhXqyNsMbYfc WE1La5fZuEp/r+i/heSTsNgfRnxC2Bn++VPBjlVr4ehaxzA8IWDZbRDpkLmTvd40tddG QaWA8BuDFay1AZWwTlk/3tsYQj7Ou6qm0DP7v0a8SRx0VxbvR7UtlSPVqU2RrZwtkTn3 30kg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042978; x=1792647778; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=kakb93U1OD84xHRnqJXsVmDbCF8ULncwq52EJhNmAWo=; b=HDzB0tAUyJeT+CLntasMiXBH+H5k2QAKLPZe+FNM2EgV3P+vCrodSVkURsZ7F9plQA 4JXHtc03IipDW5qbDZQZAWSXmdE0VQiS0CJ/bFd6O+dKNzd/Rznrz0DaGOoKj1pi+72H Z2sYgmjLuujheKlrcJqnUop7skn5d/QKzbH9pShJqPTe3EPpdnnU6qgoe2sH0DAakTKz jdpLSPJddfhaI5/jgjQBBoKnQPsT0g4gkmVbi1w78XausJbjWNdY732/9LPEFPZ0lSex yYPj3WTxr2+UWDNWO1gJfdh4Toh0txIR2EGIkyA6YK/jzALnnS0Z5tIlzWjc4/RKDT6R Zw5Q== X-Gm-Message-State: AFq9FYJpdkDZfOauDhWBDQffpyaSIkbtMpp7So6AexW3mATT7PtXWRfj qKbQbULMAWRE68R8QZd26r2Y1pzPHSW8uUDsbqCvZL1bvzcX5k+Klr8eIHdgGA== X-Gm-Gg: AYBFou2o900UlW/IarHSnV3eLxasJ+nFhZ/Tk2zj3SYTsc+A89kuXCkoS28yUaSDtgk AIaTUDZvJe+0wzGXY/Vi8oI/ZSAldItMr98K3NJwxcATVYlkLAKUDEJGYiSMAzydVGu8v8kM3hy FrO64bxMLRyI9qg4Q4XUF2yohCyfniXLy4lfzbgut4/FddkBeHLR5D3RkZilhaJy8MtFS1DKY3q LmAd5DBMfNslm+gxPZ+LHqGAYx9GksN4rfdNCYGY02I6hYbd5oG1qYrIjdAXYm/xvKYS+99bbZV U0HkFzBI/fwBs4zAsiRfJldwtS8wm6UGZHsJ/NPs93CuDCsCrA+Yj40Ot4ohBBxklR0hItedBTC Lace6WrZaLSqHdGf1jbrFlGr5BiMUUGgrDpr8tFizXplOAKP4C2lx4cfWLaiDLnnlWB7Pm37kKz bVcgDXXmHi2dOthDh9VqlMjA1v81mXcI6OYYAq6bbymfIx1vbi2ARMF74dFXh+hLdJRk/00CWnd 6QK0u7+AV9UPV+6zu/S6Z8= X-Received: by 2002:a17:902:f609:b0:2e9:5b4e:b8a1 with SMTP id d9443c01a7336-2e95b4f1282mr11278645ad.55.1792042978332; Wed, 14 Oct 2026 22:42:58 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.42.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:42:57 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 05/82] Revert "gnome-shell: upgrade 50.4 -> 51.0" Date: Thu, 15 Oct 2026 18:40:53 +1300 Message-ID: <1e695e01446fec3ab11fe6d9b685078a4198ae2f.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130925 From: Markus Volk This reverts commit d22efe5c4c2252226b8644ee805863d3c3b5e446. gnome-shell 51.0 needs mutter >= 51.0, which goes back to 50.4 on blacksail. AI-Generated: Uses Claude Code (Claude Opus 5.5) Signed-off-by: Markus Volk Signed-off-by: Ankur Tyagi --- ...ver-Fix-build-failure-with-libical-4.patch | 44 +++++++++++++++++++ ...nome-shell_51.0.bb => gnome-shell_50.4.bb} | 7 ++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 meta-gnome/recipes-gnome/gnome-shell/gnome-shell/0002-calendar-server-Fix-build-failure-with-libical-4.patch rename meta-gnome/recipes-gnome/gnome-shell/{gnome-shell_51.0.bb => gnome-shell_50.4.bb} (86%) diff --git a/meta-gnome/recipes-gnome/gnome-shell/gnome-shell/0002-calendar-server-Fix-build-failure-with-libical-4.patch b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell/0002-calendar-server-Fix-build-failure-with-libical-4.patch new file mode 100644 index 0000000000..d64cf38ccc --- /dev/null +++ b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell/0002-calendar-server-Fix-build-failure-with-libical-4.patch @@ -0,0 +1,44 @@ +From 91eaa9221b45b506d7a5d84a9ec8c204b5c8c34f Mon Sep 17 00:00:00 2001 +From: Xi Ruoyao +Date: Fri, 8 May 2026 13:13:37 +0800 +Subject: [PATCH] calendar-server: Fix build failure with libical 4 + +Fix the following build error with libical 4 due to function signature changes: + + error: passing argument 4 of 'get_time_from_property' from incompatible pointer type [-Wincompatible-pointer-types] + note: expected 'ICalTime * (*)(ICalProperty *)' but argument is of type 'ICalTime * (*)(const ICalProperty *)' + +Link: https://github.com/libical/libical/blob/4.0/docs/MigrationGuide_to_4.md +Part-of: + +Only the gnome-shell-calendar-server.c hunk of the upstream commit is taken; +src/calendar-server/reminder-watcher.c does not exist in the 50.x series. + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/b34766f3992c7616b7816a47249fb463c053e5fa] +--- + src/calendar-server/gnome-shell-calendar-server.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/src/calendar-server/gnome-shell-calendar-server.c b/src/calendar-server/gnome-shell-calendar-server.c +index 0b2f88eb7..622c16181 100644 +--- a/src/calendar-server/gnome-shell-calendar-server.c ++++ b/src/calendar-server/gnome-shell-calendar-server.c +@@ -112,11 +112,17 @@ typedef struct + time_t end_time; + } CalendarAppointment; + ++#if ICAL_CHECK_VERSION(4, 0, 0) ++typedef ICalTime * (* GetICalPropFunc) (const ICalProperty *prop); ++#else ++typedef ICalTime * (* GetICalPropFunc) (ICalProperty *prop); ++#endif ++ + static gboolean + get_time_from_property (ECalClient *cal, + ICalComponent *icomp, + ICalPropertyKind prop_kind, +- ICalTime * (* get_prop_func) (ICalProperty *prop), ++ GetICalPropFunc get_prop_func, + ICalTimezone *default_zone, + ICalTime **out_itt, + ICalTimezone **out_timezone) diff --git a/meta-gnome/recipes-gnome/gnome-shell/gnome-shell_51.0.bb b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell_50.4.bb similarity index 86% rename from meta-gnome/recipes-gnome/gnome-shell/gnome-shell_51.0.bb rename to meta-gnome/recipes-gnome/gnome-shell/gnome-shell_50.4.bb index 549a3d5971..f39d72532e 100644 --- a/meta-gnome/recipes-gnome/gnome-shell/gnome-shell_51.0.bb +++ b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell_50.4.bb @@ -31,7 +31,8 @@ GIR_MESON_OPTION = "" REQUIRED_DISTRO_FEATURES += "gobject-introspection-data" SRC_URI += "file://0001-shell-app-usage.c-only-include-x11-headers-if-HAVE_X.patch" -SRC_URI[archive.sha256sum] = "2179bab13af353427065096af8bf3d30da7b86e0c516e5ba86a14998af9575f6" +SRC_URI += "file://0002-calendar-server-Fix-build-failure-with-libical-4.patch" +SRC_URI[archive.sha256sum] = "c531939539db316a41aef23670370abd1330d3254f84bcb0f9f4dae5d6e362cf" PACKAGECONFIG ??= " \ camera-monitor \ @@ -43,6 +44,7 @@ PACKAGECONFIG ??= " \ " PACKAGECONFIG[bluetooth] = ",,gnome-bluetooth" PACKAGECONFIG[camera-monitor] = "-Dcamera_monitor=true, -Dcamera_monitor=false, pipewire" +PACKAGECONFIG[extensions-app] = "-Dextensions_app=true, -Dextensions_app=false" PACKAGECONFIG[extensions-tool] = "-Dextensions_tool=true, -Dextensions_tool=false, gnome-autoar json-glib libsoup-3.0" PACKAGECONFIG[nm] = "-Dnetworkmanager=true, -Dnetworkmanager=false, networkmanager libsecret, networkmanager" PACKAGECONFIG[portal-helper] = "-Dportal_helper=true, -Dportal_helper=false" @@ -96,6 +98,9 @@ RDEPENDS:${PN} += " \ librsvg-gtk \ " +# The extensions app is a GJS application and pulls libadwaita at runtime only. +RDEPENDS:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'extensions-app', 'libadwaita', '', d)}" + PACKAGES =+ "${PN}-tools ${PN}-gsettings" FILES:${PN}-tools = "${bindir}/*-tool" RDEPENDS:${PN}-tools = "python3-core" From patchwork Thu Oct 15 05:40:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100800 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 944F1CC6B3A for ; Thu, 15 Oct 2026 05:43:06 +0000 (UTC) Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33229.1792042980868994266 for ; Wed, 14 Oct 2026 22:43:00 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=E00zyFzr; spf=pass (domain: gmail.com, ip: 209.85.214.181, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2e87c66e556so20919935ad.0 for ; Wed, 14 Oct 2026 22:43:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042980; x=1792647780; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=7p0v19ZNzkYNszoWvr2ZPVZE3rwVn7I3lRuUx7y4eeE=; b=E00zyFzriZl1BUP7NglQYXOfov0O3d8FuI3uneq0sNKFCK6C5hVjYcpLfA6H1FFilB iE/ECaFaHeCZCvdaliqzKgHygQgtfxTrns00bENDec3K7VLFqG+39j51xQKsJE87gjmE nCF4SxHELE5cETAt5qBQ4e5w18XrxxU6YWL2geSX29ZsHFzS79ZQ2uZgFFhr4YejXUvv zsqPYIrcyGjEhxLJk6HuCbsY28ykFKoyZsHdgMFPZDoD7NqfcGCtd8jEg1xsaOjr2Vos 6aSe38jVEwDARn178rT5MC3/8P+UDW4XAej5Uf06QDqt7TWHzTP+8DEQTdo32Iu7eDf7 bKbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042980; x=1792647780; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=7p0v19ZNzkYNszoWvr2ZPVZE3rwVn7I3lRuUx7y4eeE=; b=BVRFduIGupZygN9HfaH1igLZwsuLaXSA/20BM00aJYKe8Q3psrpee/spCWazKrsILo V8bwIXyHZQkQZ0N2MaIsYUOjkSVOrR774zt4qDkKk+z+/mL/PwtjJNjsbTfjTEZyci0E aivZfUfKZ6ZmE4bhdCGqRUgR0AM6dPbekC3Ux2/E06mSfDoAAm1/zQJJKPg7LEl0Db5y PNDNHWOfPQjCU+KL3Ha5uTvoIvH/4QVBIbOcWcNdf/bQPMnjmLCGnZXhPQnufUWi/hmV Qebbl6m/ywf8MmLPOmgbLs6ETPaO4nqpZJ34BSZ/DUPbV3F1u5TOKyvQUZJ9Y+DPyvCA sDEw== X-Gm-Message-State: AFq9FYKJuoyAJxBNNe9oajIYDjtqnSvDBrFqPdTh6x2cYx2MuABlbhSw nITHxpiE1NTxqZDcxToGUzU2ujJ7ujm7/arFku+Q6DF5FRdlpOsbMQ7wwKjKVg== X-Gm-Gg: AYBFou3lKfqh089L9qTt/d5svw81w67yLizJ/LqDr6LKs7zCEcLTrW5NpN8ldyVexpb 8JvCYy6rrS3Iv/wBVsrnmqDmZBGZDDQTUEe8cAo50SNe/T0s5ofcBrWhys66UMfMUU45JIP9lN+ ELwpCYrHWdKGQZlgNGalufyoMWtk8KsQZSzWWzJ33WU+QdyZVBkA0uJgy/rXEubyZflVyChvSKq W2jIm4RzIkfMQFqmlBnWpJziqR50zKuWEWPCWZISw8ifiaLIen+cdcJJIEvRBioG1PwBOJ4Uscy vHjMuDogLlCjNGSffsKTeiIJxD0QhJ2eHR6X14PQ79QiYBtNj/iJkVs0l4VtEsrJSndKEujVsFp nGmsnBFG6tQDQb/J2cSX4QcsqNeqhSm5E1EXjUzG3ttrCBjqUoOFguMpJ0BcIUpUHUaLjsqyZvR PXvxjAUJXX6KKuDl81UMiueeCH7j9drcMPB0s1KnyyUeezIXHYf8FQPFrlWGGf6BwK8vkuA8G++ qlWipyNoyJrbJfoie2dqBp5tw== X-Received: by 2002:a17:903:2446:b0:2d8:d4d2:d136 with SMTP id d9443c01a7336-2e8404d753amr121277435ad.18.1792042980221; Wed, 14 Oct 2026 22:43:00 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.42.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:42:59 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 06/82] Revert "mutter: upgrade 50.4 -> 51.0" Date: Thu, 15 Oct 2026 18:40:54 +1300 Message-ID: <8199790102b29eb409a98d5d036bae39dea5d131.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130926 From: Markus Volk This reverts commit 6f735ce8ac29f1e57dc463bac8c34f3c439a7fb7. mutter 51.0 needs gsettings-desktop-schemas >= 51.rc, but oe-core blacksail has 50.1. Tested by building gnome-image against oe-core blacksail. AI-Generated: Uses Claude Code (Claude Opus 5.5) Signed-off-by: Markus Volk Signed-off-by: Ankur Tyagi --- .../mutter/{mutter_51.0.bb => mutter_50.4.bb} | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) rename meta-gnome/recipes-gnome/mutter/{mutter_51.0.bb => mutter_50.4.bb} (85%) diff --git a/meta-gnome/recipes-gnome/mutter/mutter_51.0.bb b/meta-gnome/recipes-gnome/mutter/mutter_50.4.bb similarity index 85% rename from meta-gnome/recipes-gnome/mutter/mutter_51.0.bb rename to meta-gnome/recipes-gnome/mutter/mutter_50.4.bb index 6604865f67..f9b3e9d5e5 100644 --- a/meta-gnome/recipes-gnome/mutter/mutter_51.0.bb +++ b/meta-gnome/recipes-gnome/mutter/mutter_50.4.bb @@ -17,17 +17,12 @@ DEPENDS = " \ libdisplay-info \ libdrm \ libei \ - libgudev \ - libinput \ - libxcvt-native \ libxkbcommon \ pango \ pixman \ python3-argcomplete-native \ python3-docutils-native \ - udev \ virtual/egl \ - virtual/libgbm \ virtual/libgles2 \ wayland \ wayland-native \ @@ -37,7 +32,7 @@ DEPENDS = " \ inherit gnomebase gsettings gobject-introspection gettext features_check SRC_URI += "file://0001-Dont-use-system-sysprof-dbus-folder.patch" -SRC_URI[archive.sha256sum] = "5d28f3ae225692428fcafb96500d673f34328b698b86960c9c1460d0b1d983b3" +SRC_URI[archive.sha256sum] = "273d33c875abcb4b6cbea3f4ec045d18155fbc510c3521fc7e47926371310988" REQUIRED_DISTRO_FEATURES = "wayland polkit" ANY_OF_DISTRO_FEATURES = "opengl vulkan" @@ -45,10 +40,10 @@ ANY_OF_DISTRO_FEATURES = "opengl vulkan" # systemd can be replaced by libelogind (not available atow - make systemd # mandatory distro feature) LOGIND ?= "systemd" -DEPENDS += "${LOGIND}" REQUIRED_DISTRO_FEATURES += "systemd" PACKAGECONFIG ??= " \ + native-backend \ egl \ gles2 \ ${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'opengl', '', d)} \ @@ -56,11 +51,17 @@ PACKAGECONFIG ??= " \ bash-completion \ gnome-desktop \ ${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'xwayland', '', d)} \ + ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'logind udev', '', d)} \ " +PACKAGECONFIG[native-backend] = "-Dnative_backend=true -Dudev=true, -Dnative_backend=false -Dudev=false, libdrm virtual/libgbm libinput ${LOGIND} virtual/egl virtual/libgles2 udev libxcvt-native" PACKAGECONFIG[opengl] = "-Dopengl=true, -Dopengl=false, virtual/libgl" PACKAGECONFIG[gles2] = "-Dgles2=true, -Dgles2=false, virtual/libgles2" PACKAGECONFIG[egl] = "-Degl=true, -Degl=false, virtual/egl" +PACKAGECONFIG[egl-device] = "-Degl_device=true, -Degl_device=false" +PACKAGECONFIG[wayland-eglstream] = "-Dwayland_eglstream=true, -Dwayland_eglstream=false, wayland-eglstream-protocols" +PACKAGECONFIG[udev] = "-Dudev=true, -Dudev=false, udev" +PACKAGECONFIG[logind] = "-Dlogind=true, -Dlogind=false, systemd" PACKAGECONFIG[libwacom] = "-Dlibwacom=true, -Dlibwacom=false, libwacom" PACKAGECONFIG[remote-desktop] = "-Dremote_desktop=true, -Dremote_desktop=false, pipewire" PACKAGECONFIG[gnome-desktop] = "-Dlibgnome_desktop=true, -Dlibgnome_desktop=false, gnome-desktop gnome-settings-daemon" @@ -87,7 +88,7 @@ EXTRA_OEMESON += " \ -Dverbose=true \ " -MUTTER_API_NAME = "mutter-${@oe.utils.trim_version('${PV}', 1)}" +MUTTER_API_NAME = "mutter-18" do_install:prepend() { sed -i -e 's|${B}/||g' ${B}/cogl/cogl/cogl-enum-types.c From patchwork Thu Oct 15 05:40:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100802 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AAA83CC6B3C for ; Thu, 15 Oct 2026 05:43:06 +0000 (UTC) Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32796.1792042982834124860 for ; Wed, 14 Oct 2026 22:43:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=m/RxswDj; spf=pass (domain: gmail.com, ip: 209.85.215.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-cc1bc88a20eso1173871a12.3 for ; Wed, 14 Oct 2026 22:43:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042982; x=1792647782; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=JUoHHEwW3LEC1cG6FFgwzC48aplBg0BACbNR1nAq74c=; b=m/RxswDj30HIgZeK2h8LfzXADQs4WX8B18TbAzvbhTVXXo5TULggGqB7x09rDf3ITp OHizLNl/9he5sEmdNIHSnBEkUUn9XoOXFpU5gotqVtRlKVTvRF0kDlHgxRY3pMN/zElw sYuhGnHpezyHcFY1dyaDVyD34XsmjbaiHe/UwM1IStz0cMLIJvu/Ak8gxN4fsBaYMvNv IW90Lox/pprAvM5b4REjDUicaBayek9/IYwHxqV8WnVebeTUNgvEAwm6j69/L9CGUHK3 TFLR/vOUJ97u8ByO/HsQE4j91azHu64KdeA1Y5G9KR3oAru6h7djpkqUKh6dCwItQn0e SCEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042982; x=1792647782; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=JUoHHEwW3LEC1cG6FFgwzC48aplBg0BACbNR1nAq74c=; b=PPcWLjHg0IBwjWk8jSO16DKoXEZt9a76KayG53oKgg6zKziz5f3W2m88JjqCskL+Ob 7tz/zsb1eGyqo6eNS+hM+CW4gEIsNkXkG5GWBkjVyPSdQx2Xbk32oQuPJn05IVTNWAnC 2YtOzY0Jl4ieIWCHlhPOvaJ/ARWnn6DiDOHRbqZOoqx/OrxcP5hwYi8vlKdAluNdryX4 VTRE7OksTn7wjCjG+fJv3D1sluAA2dkHhX8xdMosmHdIYcKpq7fFIyujxilDosyCEnb0 De9HyHMZO0OABMRVJqThtS/TSs7BOCkYzIB9A3QxtC1zTpVT7B2Z1iv6y2O+Pjt72bdW qSjw== X-Gm-Message-State: AFq9FYJ+bwLhWt0mjH32E/QJS0WmpUWoCTw3q8J4WXM3N6onJjo+UgI5 0gj/oMr0FuiVkBDUoMDeMP7lErfgnVdT7kVn5ZhjChwlJDxp42nhc4zHvtKUqg== X-Gm-Gg: AYBFou1F3aGHbaWw/4s1lesnEvgEPWRsitJb8FXA2rHL04sMHk8OzOvH3nSmWaIYTY+ RGKpVNi8OM/LA1D506XW7EHzLOwxRG4yRkddzQDd6epsfxJ/Izq8owwM1kYGM95i9Kao8OGBQJu VQcDmulau5B1j7+h6miQQNbuHbLLzAIZwZftiAOCcsIWbBov28SdogdhxiCXjNL8S/axidZU5yS 4rdcdVN8NlI/Ps0ekFU2rnHgGAn0jUKeXfVdeJdzSEq47WD1FX4WeFB+w2MgRiuiVdo1pQ3rrya M6NvjY0iEuETerZvhm+jsw5VIZHm6dc3GE/2dKxtLRfaxYEEsJqOaYfMj1sHX60NNWvlR5WaYZZ uT5lkJVLJ5frOCR2xF4iMyp6cBbI7n82I7zBu18IUpjbv8luoSI4kGEYVhtz0D/7fFFh+erS4RF h6fNwu7ioLZpVc91kODlBRKa5xh/sHB9MCYRD3Q6iYIe0BM5Vv6JLM9KrB+04LXN9e29RyGWZcX h+qFXdGL1Aq59lpGaXJ7V2i77x3/i4X5Q== X-Received: by 2002:a17:90a:e7d2:b0:3ac:a6a5:5748 with SMTP id 98e67ed59e1d1-3aca6a55a28mr140043a91.13.1792042982101; Wed, 14 Oct 2026 22:43:02 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:01 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 07/82] libwebsockets: patch CVE-2026-19773 Date: Thu, 15 Oct 2026 18:40:55 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130927 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-19773 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (From meta-oe rev: b8399ae07ae1958eced847a3d5e8a4227c2e3aa2) Signed-off-by: Peter Marko Signed-off-by: Ankur Tyagi --- .../libwebsockets/CVE-2026-19773.patch | 31 +++++++++++++++++++ .../libwebsockets/libwebsockets_4.5.8.bb | 1 + 2 files changed, 32 insertions(+) create mode 100644 meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch new file mode 100644 index 0000000000..74908c5437 --- /dev/null +++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch @@ -0,0 +1,31 @@ +From 998a9af40aa6c2ddcb91c662d6585ea80ab52f85 Mon Sep 17 00:00:00 2001 +From: Andy Green +Date: Fri, 3 Jul 2026 18:43:25 +0100 +Subject: [PATCH] zdi-can-31036: h2 bounds check on server + +This vulnerability was discovered by: +Maher Azzouzi working with TrendAI Zero Day Initiative + +(cherry picked from commit 824151862f37bc72f46d9a3e01d5b9408d313a0b) + +CVE: CVE-2026-19773 +Upstream-Status: Backport [https://github.com/warmcat/libwebsockets/commit/824151862f37bc72f46d9a3e01d5b9408d313a0b] +Signed-off-by: Ankur Tyagi +--- + lib/roles/h2/hpack.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/lib/roles/h2/hpack.c b/lib/roles/h2/hpack.c +index 1025faa6f..863eb88c9 100644 +--- a/lib/roles/h2/hpack.c ++++ b/lib/roles/h2/hpack.c +@@ -274,6 +274,9 @@ static int lws_frag_append(struct lws *wsi, unsigned char c) + { + struct allocated_headers *ah = wsi->http.ah; + ++ if ((unsigned int)ah->pos >= wsi->a.context->max_http_header_data) ++ return 1; ++ + ah->data[ah->pos++] = (char)c; + ah->frags[ah->nfrag].len++; + diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb index 005729dcac..11da4b299c 100644 --- a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb +++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb @@ -10,6 +10,7 @@ SRCREV = "fbb0baf6af9c4324f0f1591734c78b0089b599d4" SRC_URI = " \ git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.5-stable;tag=v${PV} \ file://CVE-2026-10650.patch \ + file://CVE-2026-19773.patch \ " UPSTREAM_CHECK_URI = "https://github.com/warmcat/${BPN}/releases" From patchwork Thu Oct 15 05:40:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100798 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65573CC6B38 for ; Thu, 15 Oct 2026 05:43:06 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32797.1792042984978670830 for ; Wed, 14 Oct 2026 22:43:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=bclW0Rdp; spf=pass (domain: gmail.com, ip: 209.85.214.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2e8da6ef7ddso11430645ad.3 for ; Wed, 14 Oct 2026 22:43:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042984; x=1792647784; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=SypwQzOkwr9JGVLj6x2qF+QnK525gJNk2oB+kfnhCWQ=; b=bclW0RdpFKjwGjAj7iN7X15cKooM8mzXiVXBN3yMSP1JpYpGR+8JBPpOUINE2oqlYR LewTKpo4/OVkt+kj75f9YdGVJcFMllMzzlSN/b0jS5sLMs0OX/sc1h76zTekluHNGlEH HQCpuF/69b1TeEetU1GpvSW2lWadOd0pkJpSf49ikuOgIMdrbluDDtFWZ+25kiZraSMw tpJReCHwb+txiCe1wjI2dUfsghUuvA9i010ljbQQ4fCLji79x8t46PG3l0Fcgtg2JWgT MmJckqltgfkdIOFO+JiNGfbSdmCOdjaAnKgcfPXRRwH5j8LhvkWH40QUfh8w0bhF4BIP RL2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042984; x=1792647784; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=SypwQzOkwr9JGVLj6x2qF+QnK525gJNk2oB+kfnhCWQ=; b=DMXQSTWYmOTfTsFGZwk7D0h1xl9axLZK9G4jt3K1gWdGuRNtSOuUlVncoNVha+ymHP r+Fzym1rQvaGJuWWWUm+mRAlHGz40DYV7BV0ukoQEH7iEQBbjCy+RzLN47AF2Kcdxkom 4QwEee4tvw8G1nHKypafwciGeDz7eRQdXtKhs7XqQbI/lrxkrhTQxGORr2TKgEYgTQ71 sQ89mV5Ch12VWvf6Yh+DzdxRmFzV+ldu08khbD3fe06nu1JFEMHYL9P6tCApVtG2CLhk 5je+SRfwfZ1uOHBeV58H/A7PwwXLqfULSyhsqqKro7OnZ3rx1VcVWebsIByVCCbdb5cq tmfg== X-Gm-Message-State: AFq9FYLESsq1a22tejAveEZCivElxkIen9u8oRF8r0A9uuLgIq0MGNzA YoPo5F4CqV+8FilErI5o99osz39ZDi5BSDzZoj9fkwBXRLgmKC8Xe156+xTkGQ== X-Gm-Gg: AYBFou0JvvrS2kQH8dwRdJ+P8CSEkJ/CT0Sg55lNh4RLm++xntHLnirbBu7I9Jo5PXW DOL87obwv2/lAYCUcy/NbZ4NlBWxCVfl9debhnMp1I+TjWUZeG/H5K21Ufwq3rbAvdwNR/BZHwH DQY/X6o0RZQFCeSXRkMTXbiO39RytIphCRIHv8tEmXmzo/Sag5KzYTVwlsnnVolFcbHVpf/uMBY 533xTNaoACYvq+YpOC2s0wMgFExiSIT+fd9/uHBiUL1UMcDD9UsK+ZPE1WVGqBqVj34rAXT4mR2 DRAKDRm8krP/6oMiVITZ2NhDYlRLg9m6MDN2H6MLuPKtFFtnc3szxzKKVZ9QZ57Ou7nXDndxV7Q USEr7UrS+S559mg50QQN/26GXDShlHKOrZoaTSmnPLeA8g2a/KXZAp/ML2lzRtZu9b4R9APITj/ wVmYIUVhhDFl8Zqh+SOq858cYkw5odZ8uzBlujOGh/U3pC0meMMyzKkz8Hj0/mVe0gbVSxrHfwT YqI4DOZoQ/A+1c5JBLJ6FE= X-Received: by 2002:a17:903:298d:b0:2e9:670f:d080 with SMTP id d9443c01a7336-2e9670fd389mr2048995ad.32.1792042984236; Wed, 14 Oct 2026 22:43:04 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:03 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 08/82] libwebsockets: patch CVE-2026-78161 Date: Thu, 15 Oct 2026 18:40:56 +1300 Message-ID: <9aeb9f56897ae3f18415491524e51511a1bec1d3.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130928 From: Peter Marko Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-78161 Signed-off-by: Peter Marko Signed-off-by: Ankur Tyagi --- .../libwebsockets/CVE-2026-78161.patch | 45 +++++++++++++++++++ .../libwebsockets/libwebsockets_4.5.8.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-78161.patch diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-78161.patch b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-78161.patch new file mode 100644 index 0000000000..ab978811d8 --- /dev/null +++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-78161.patch @@ -0,0 +1,45 @@ +From 1d44554a1bb262db63ff4e240152a9deecd99054 Mon Sep 17 00:00:00 2001 +From: Biniam F Demissie +Date: Mon, 6 Jul 2026 04:33:45 +0100 +Subject: [PATCH] cbor: overflow + +CVE: CVE-2026-78161 +Upstream-Status: Backport [https://github.com/warmcat/libwebsockets/commit/1d44554a1bb262db63ff4e240152a9deecd99054] +Signed-off-by: Peter Marko +--- + lib/misc/lecp.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/lib/misc/lecp.c b/lib/misc/lecp.c +index 44a7ac667..13e6ba476 100644 +--- a/lib/misc/lecp.c ++++ b/lib/misc/lecp.c +@@ -325,11 +325,11 @@ report_raw_cbor(struct lecp_ctx *ctx) + if (!ctx->cbor_pos) + return 0; + ++ ctx->cbor_pos = 0; /* reset BEFORE callback */ ++ + if (pst->cb(ctx, LECPCB_LITERAL_CBOR)) + return 1; + +- ctx->cbor_pos = 0; +- + return 0; + } + +@@ -388,10 +388,11 @@ lecp_parse(struct lecp_ctx *ctx, const uint8_t *cbor, size_t len) + */ + + if (ctx->literal_cbor_report) { ++ if (ctx->cbor_pos >= sizeof(ctx->cbor)) { ++ if (report_raw_cbor(ctx)) ++ goto reject_callback; ++ } + ctx->cbor[ctx->cbor_pos++] = c; +- if (ctx->cbor_pos == sizeof(ctx->cbor) && +- report_raw_cbor(ctx)) +- goto reject_callback; + } + + switch (st->s) { diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb index 11da4b299c..0b612c6f4f 100644 --- a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb +++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb @@ -11,6 +11,7 @@ SRC_URI = " \ git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.5-stable;tag=v${PV} \ file://CVE-2026-10650.patch \ file://CVE-2026-19773.patch \ + file://CVE-2026-78161.patch \ " UPSTREAM_CHECK_URI = "https://github.com/warmcat/${BPN}/releases" From patchwork Thu Oct 15 05:40:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100803 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C727CC6B38 for ; Thu, 15 Oct 2026 05:43:16 +0000 (UTC) Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32799.1792042986795004234 for ; Wed, 14 Oct 2026 22:43:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=rO1LYg7V; spf=pass (domain: gmail.com, ip: 209.85.214.181, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2e608cd460eso26538495ad.3 for ; Wed, 14 Oct 2026 22:43:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042986; x=1792647786; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=FYEcqKBAui+ZdiiC94+izk6BVFVe2zb2+NEhJLVKqms=; b=rO1LYg7V8W7iJm2oxYKp5w9p8tehfALiQbP/Pms2+fKyMjiZDetmQJx+nupdHHmhz8 tAECZ43TN9WFkuwS9AH4/iUReVQloD68BIajfmMGAoMNT+6yHFdI4jhFrW9IrSrJxQ7D AfpdiIrZD1uTStGfJBhFpwvexGhWNZZyQzHq0abizzz7Ne88+cO8KefYrkDg8GG4CEJp Ikj/DNxsXgTjuXJH4fB+UDm08Ywmz4f8IzJ+bs6lhrAvudmWBdevqCbHLwBQa52+7hzM 8E+0mG6qVK0aAEVEF6b9pdmCI5L16swjFWM19yjL/Sa8r+jzCpM/gShTIO9K0c5HpzGm MqmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042986; x=1792647786; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=FYEcqKBAui+ZdiiC94+izk6BVFVe2zb2+NEhJLVKqms=; b=xgDy8i7HD5j80vsGL+wO+r8aUpFf05vxm7dAAjlKZXtETYnK8eXF2MdqXuQq9MgcU9 RLTlKZkpYifhcJWYtQ57y3EnojxY0Hq0uHG36mNw8Ks3Gf0bG5UzesnVcQ6uvFGLdHkX Ynqbfu5yCQJN8PqQuVfs9ef10yUF+PMW9QyNmbkya1XqgS4Sk+28TVB1zof54Xv2ZWwI +k6+NBOrp+NoTRQwwixL1kCKDtGPBHdSCVXI8nCkGw9H0bRL4tQYoYY+SE1taSCaTzj7 +QObzemggFllf0h4yQG8QPXSaCWjdX4sEVefP2HKOQf7/cpinWGCw7oTqBclripssqGl 98Cw== X-Gm-Message-State: AFq9FYI8LIeTuj4WK+tP5m5klfgLR9nAOMj1aY+pcfDKQ68A0+oejoVG xV92u6Wv7fx2be+vY1onsl5qZLwn5Dvp0LCbvw2Q9CE8uK2OSq48y3IR5TCAyA== X-Gm-Gg: AYBFou3eQxuWT2XG6knGondV/X6kPaBsb3UAgO/89yv9DVpR19UqPqqtCTSweB72/oF ynJMlQ7vLx7oadJgGWNjGpWBQYaeQ3l4LfrRRT1ABDNoe1GFwu9O+Ynv8RyaxV807m1+xhKlIPZ 7ynmDyCRIslB+C8dWp84Zo591wStg2Dr4N6KTfhi6jfcQ/sbStXgzpkDoXHqKPoCpbhOQB6kWBr 3Cr4/xLKg6U5YunArXUboWpxPRQYpGxsn2R9PRsuIbaKAapD/sYTPwbTB9EwR384+7ewfz9ZowX VsLgQHTJO/FRN6D1l9WOKbya7qEUxQhrkYI/6MXIxb1sLEkb8ytfwIC764xs96NzZV+CkBcBj4I uB87qQak4lFT00V/Mmnx+zL1Nc0qhmh44BNmGaJOqKZf69PabBxxFDeoZ101BA4GL0cR91V0yfE V+PBxPmldzVkX66slrxYgrP99UOU92ZZOAN5nYcxhp8BRPPAuYtzr78ow0PD5jDqz8QdIkdcPWx vFYRwO5TgJbyYHyNI2gb5s311vBDmtT1g== X-Received: by 2002:a17:903:40d1:b0:2e2:d77b:e584 with SMTP id d9443c01a7336-2e8428a24b7mr159067765ad.13.1792042986132; Wed, 14 Oct 2026 22:43:06 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:05 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 09/82] nginx: set status for CVE-2026-90439 Date: Thu, 15 Oct 2026 18:40:57 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130929 From: Peter Marko CVE information now contains separate version range for mainline and stable nginx version. Problem is that mainline version range includes stable verion fix and since cve-check marks CVE as applicable if one of ranges contains current recipe version, it's reported as vulnerable. * Affected 1.29.2 < 1.31.6 (semver) < matches 1.30.5, so false positive * Affected 1.30.4 < 1.30.5 (semver) < correct fix version, but overridden Add also a note to remove these explicit entries when new minor stable version is available which does not fall into the mainline version range (for all 3 currently explicitly handled CVEs). Signed-off-by: Peter Marko Signed-off-by: Khem Raj (From meta-oe rev: 13915b76c5411a7f3992ecfa7001bf9b9d32e5a6) Signed-off-by: Peter Marko Signed-off-by: Ankur Tyagi --- meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb index 4dda52c62d..6b638cdd96 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb @@ -6,5 +6,7 @@ SRC_URI[sha256sum] = "6c20565aa2325cb82216ae804f4a4ff1875179014759a381c42ddc8e11 inherit upstream-version-is-even +# Remove following entries when upgrading recipe to 1.32 CVE_STATUS[CVE-2026-42055] = "fixed-version: Fixed since 1.30.3" CVE_STATUS[CVE-2026-48142] = "fixed-version: Fixed since 1.30.3" +CVE_STATUS[CVE-2026-90439] = "fixed-version: Fixed since 1.30.5" From patchwork Thu Oct 15 05:40:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100804 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B0030CC6B39 for ; Thu, 15 Oct 2026 05:43:16 +0000 (UTC) Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33231.1792042988964075605 for ; Wed, 14 Oct 2026 22:43:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=YCPc5XNx; spf=pass (domain: gmail.com, ip: 209.85.214.175, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2e8ad5b31c7so28512105ad.3 for ; Wed, 14 Oct 2026 22:43:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042988; x=1792647788; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=NjzE/v3jxnPok3/kOyd0v7jWN1eTGZHUVo7vK+faoa0=; b=YCPc5XNxQSSZlW7HTjAl2RjQ6FPYuxjNJ5p/vVuJwKs7EbeQl7jcFZekXKTcfkD0pO aN7SwYJsqH5SPWecwRZG2ZVr6U1ooS68gqMD0ncgktKjPwxjZwPnehDoYN3gFP1SPmFn HVro8Ivny7C5N/v/VD9xc2CD73U1fp8Y1K6OBdJvCdmMrkq8hMVBWsqj/c1l95Lyu2UZ NXmLrI69M1W0h1XWSzKG+dGZs9NqDLwcSwQDHNn4VyjI/HVX7+qSitgKMRdmSCg3ku9m 6PgGOtlYyQNp41VirsladmQS/ceBsyu4sx7ZW8OsMDMnmy/OWzU+47mvOda7sGdoRMFx aArw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042988; x=1792647788; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=NjzE/v3jxnPok3/kOyd0v7jWN1eTGZHUVo7vK+faoa0=; b=PH4XrIOp64FwVolbda2lGaWTx1qolJpSPi4oT9Mq6UmZotuWCke/ONhYnAQ7wjzwMC 7SRht2lV3sSUUS/e1zdK8faiXkk3yIaaMdDfDwmf6FDDQn21WUH8enC5517Xkr0xw80W KrsAnlTaEaq+d3sPjKlGQbVCEg4q2DiYWZCYnUBArrz/9iBgF3HItUv3XWP83o4Ao+5k JysVkBh6DBc+giYbhFC7J9w1E1X7/M0oYWTz/phEVXyqWSQZNzzb/e9b4R4y0t/B0X+n 6U4Vf9QsZWj9n7uY9y5HT8s5BhwmXUOZ0o/kvzQiDOIJrvVTe1VxIdjfnv0pw4k47uS2 2TYw== X-Gm-Message-State: AFq9FYJYeJ1MSDDJkFAqA0ze0xbCkPaUrXaRDXF2ovgEtyIkimNNKkUs tEZ1wnloxYrbWmRQTYVpMZLvjb0V9SbBTXvKXN/9m1K10T3LL/81bTw5JWQk6w== X-Gm-Gg: AYBFou2GrbNrCjK8lOo0YBEC9JijKKYrnDPZkALTGJPE5EBAy5iyE+0ZHEyRCsagQOU GjkXp1tVm7xJwqlnm5UDJjfemUfUrmvrBSMX8LVLTE7LqhSJBjtNtU/jtrnFI+CyOJH1mTYqtv/ Z967utL9t4r02TKDbz98LZEpLzbxy6eGrvaBuSidpI/K6ppUqWYN3Ro3Jw8L4rcEzAY9eBT195g MwJ/LXi50zoB8qFwJpZ82kzOS3w4xhw83ospzMsuZI5HKYqJ6Ia8d4J4wDhJBR7ZAfzMS80bshy jTiaih1hlTyI3oULWJ8sFa+P26fajHfChWyjv6KVONJ3Gnz7tZppzbVrpFlULVX4zrN6r1qZGI3 tNB1Q2pQV/hvGPPGRMdv4m0M63OrT/RaquC3NS0rJmE4hare8r9ZzI9I/QOrAS7pef2RgG7ponB KwMChO7mUwd6YASh5JA5ODSrylApdB27RKBpZQfU15MXr4Ii7HC5b4CE+oHZ79eUtkls5uVBw+Q T+LVpzf7CXgfgkBXiuwWyE= X-Received: by 2002:a17:903:f86:b0:2e9:5175:2eb with SMTP id d9443c01a7336-2e951750309mr22820545ad.1.1792042988283; Wed, 14 Oct 2026 22:43:08 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:07 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 10/82] capnproto: ignore CVE-2026-59704 Date: Thu, 15 Oct 2026 18:40:58 +1300 Message-ID: <110844e1f06cd8651ead1cd43ab193300e03e518.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130930 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-59704 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb b/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb index 9909afb0e9..1149913c2b 100644 --- a/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb +++ b/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb @@ -41,3 +41,4 @@ BBCLASSEXTEND = "native nativesdk" CVE_STATUS[CVE-2026-32239] = "fixed-version: fixed in 1.4.0" CVE_STATUS[CVE-2026-32240] = "fixed-version: fixed in 1.4.0" +CVE_STATUS[CVE-2026-59704] = "cpe-incorrect: this vulnerability is for CapSoftware Cap" From patchwork Thu Oct 15 05:40:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100806 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C50ABCC6B3A for ; Thu, 15 Oct 2026 05:43:16 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33232.1792042990974683323 for ; Wed, 14 Oct 2026 22:43:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=MM0DEOCV; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2e5fb79ce82so27171605ad.0 for ; Wed, 14 Oct 2026 22:43:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042990; x=1792647790; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=6lwJNj3bBLCP99d622u60HYHiBJYer0AB7ZaE+Q0pUs=; b=MM0DEOCVMWNl1OpaGYsKkJcoU5BwrwGSkoXicX7tpyL/y4m4FfotHRIj6r8VEcgh2e EIKFjl76IsxrfptAAcIwg8IKNHBhkIbogguIMOhxEkUhpOPOYj/3sSPloprt3pV1wOdr WAo+dYOcx8G7JyrdQiR9HRpykokmo14Ttomdn+MJDDeLid+tmbjkaMZTDGZpllr9xbTJ iEHICRJ4xQCWv6iI154YHiEqIFj29PCBaPDTB2yrLqh+2duTrK0pKWeyfoY/hL/n9v8b 7P59MAdL2877qYK5M75AIvNXKf7qA8myKRFLpGsuT1HFifB6gx4GwhKefDDwE76IosD/ aREA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042990; x=1792647790; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=6lwJNj3bBLCP99d622u60HYHiBJYer0AB7ZaE+Q0pUs=; b=HeXPUDc0bSyRpuIz0D+NHXWD07cUXo33N/HgVbra++L9PdUMurPNy/Al0eICqHj7+D sqsqi81uINJSpr33Gi6u2NdUYPWGfWciTVjjADv24OVqW2/gsxVCU4jZRNb4CpePq0sP LVVDxs8PXmq50VtCLkWNu6o2Q11zeP984sFuB/abvAzXhY1MVKv/g1hJwY3avX2O+ZR2 uN7kVomnoPxzerIx8tsOP6DitkLUwJhsotdslZzWV1XqZzTidFbrEIcZ7SgXWJg2Vglh 5WHeH5QGsJBEGy42Iz2707Cad8wtMiAxDh1H3tlTH8L3vlbOBxSwpDFs2zzlWUaUWNXI IasQ== X-Gm-Message-State: AFq9FYJxWfhT3nVNtQleE+23Cs/hfZMV45gC/W3UQ6SdGK+oBfdAEyjG BLics0tK1mDQUitQxcrOOMkua+FXXjljTeKC45L1isTwbelKsZW4Tq3VMz5MkQ== X-Gm-Gg: AYBFou0CURbzBdZYKB9J+VgfwsJThC76yPbS2pWF7IVxu0fAQqcQs83qUi07m+QrLP+ 1nPzK48tW6FWXbZ7RZ3ogYZo1BSefSr40k/le7c+27n9tO/Svh9FDiTgM7g9AwtUfVaiONU4eUY prWCMBGtcFrYp5dZ3FoaYA8bUPpFzpWzHZrG9/vW4PnrHquY7qVr9YRlriK1lMAo++e/HwTUCvE WOlsTeoFHzmy/M0ffFa0l1PxyT7VYhMAH8kUF4qki9o6l/dLZjU+YGdcJvonbhhNc6/MppR7wae XWMVR4FsYZbHCplyaggrLTRcSmVfL56pzrTxlAWMU1zdLDY2drHXT3NfusulrIhXeMZFIrOobpb 9mkXnwnDW/mirfnsDp1HE+TZsVGTZhhnsG4bDIHfmV2+E/jM8rqczPKkCkYOgmApajqUO0CyHYk YoNJQHfbZkdzcDJZLadytZnlvR6AWsnkSU/dPhkwDMDptMhq1db1N8U7tY0vX/9cgnfLFPw9OR1 8PdwE1hOCi2mHMxtdy+9lY= X-Received: by 2002:a17:902:c946:b0:2e7:e73e:7091 with SMTP id d9443c01a7336-2e842bc6d99mr170698245ad.31.1792042990287; Wed, 14 Oct 2026 22:43:10 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.08 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:09 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 11/82] civetweb: ignore CVE-2026-5789 Date: Thu, 15 Oct 2026 18:40:59 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130931 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-5789 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit db080436aa68c50b0500aadd33a366916b12c782) Signed-off-by: Ankur Tyagi --- meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb b/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb index d9ca7ccd53..df64d4cd35 100644 --- a/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb +++ b/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb @@ -13,6 +13,7 @@ SRC_URI = "git://github.com/civetweb/civetweb.git;branch=master;protocol=https \ CVE_STATUS[CVE-2025-55763] = "fixed-version: The vulnerability is fixed in the used revision" CVE_STATUS[CVE-2025-9648] = "fixed-version: The vulnerability is fixed in the used revision" +CVE_STATUS[CVE-2026-5789] = "not-applicable-platform: Issue only applies on Windows" # civetweb supports building with make or cmake (although cmake lacks few features) inherit cmake From patchwork Thu Oct 15 05:41:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100807 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AAFAACC6B2F for ; Thu, 15 Oct 2026 05:43:16 +0000 (UTC) Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33233.1792042993608444934 for ; Wed, 14 Oct 2026 22:43:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=iHzNOFdc; spf=pass (domain: gmail.com, ip: 209.85.214.180, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2dd1dcdcf95so25865485ad.1 for ; Wed, 14 Oct 2026 22:43:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042993; x=1792647793; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=taTZGrFwvq5HJphryyhNZeQXRyrBC3nrK3AzNOp8ZFk=; b=iHzNOFdcE+vyNmTukCm1nLFdTNgsHvpJl7rgYHHrB7f1ZSiHl19komAU/mDz3ZLOTU QluzOCUlEfdo2k7Cet/TN9ucxUUwNqSJb8yVesyIqIrxJraDw0+SElPnOanhcW/RlIBH 1jLkJJNtD8azv6CZhIAyhqhn8L68iw5QAwp77YbkZKcxDobUUe9QgmuRd1hFBdHvGQyU oDApu14J25w5hjI5iXV0eGButk7PXaXbO+1O0PAYwYktSRcrY9VFKQ57hIwfQUgRKuM5 9Swq06xF3JlW1QXpfrzoXdXoxfDoFJ6rqoFDu89lFi1PkoiGMU9ltM7pDy3y2sEXv66h tNUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042993; x=1792647793; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=taTZGrFwvq5HJphryyhNZeQXRyrBC3nrK3AzNOp8ZFk=; b=Aq8cLYnqmQpHoMMyHfh93B7VdN18/hIjaLzk1FQLMye7OdoORtISlKMPeHNN/hWTZ8 0piu5qeoos5lMr96ILv4vv5aDP8j7t9BBvjJMMERXUxGVMtghgpO8cDRBsBzYrJyWQIQ Gd+/zyefVQLzm0wPWRdUFq80VeBs37kAI01ryZpIQrjQULfQuEfkpjWKZ2hYhiVOQ5Zh p0/reAcWVHBcthP9WFmWQiRPazHnTRQQ3oeXxVamPCoZ9ZcGhFOr/53F4LPyurqRCFjk pdp1GKSLSNF3TqsxwwSv7ST4cUswnXQlxqnK8Ca7voyKYwx6WE1gkGv2AoTdxlVUtIAQ SaHw== X-Gm-Message-State: AFq9FYLHnhzQciVs+8Z7byKOt/3QbYHOCZuM4z8bCQCn/ospm5r7SsTI am2jd8RTEc2Q6iLXylaZM4rodmgvMN1wwWX7lV7OJI4lcdLkSBMMtFJzMEgNrw== X-Gm-Gg: AYBFou2SbJElSRnzhQ9bBUPhFgn6GaDgkupuKX0cap0NlgapiIbQjENrmPTpYXCQRna Fv1YRClIDujx+pce9HbovReLpQSakADstTcMaZbzkRRz1/RPPiPuJmTrglXLaULM0wyJEgGI70T B4/nTj00D9cDDCs8XerfpzXVgMas16Z7I00YwiuWpHzDitDicuZxvUOgubgqT4smjwyoPsIZhet f0cwxuQCV5PRL5SJtuNXbABG83gGfohlirc8tAdxv7ofv4lxKmn0T3fjqDb4IjqmywhzcMCNtT0 qoR1GZFKbGc0id8TNM9W90j8iArb4pDUiyPiUAvvCAflmEoqmgBFDXvClGLcECOBa4qZ9NNjMcM N0fRE9Vbv8RQ15sVAjemAeUWILUdZ2qv9NGUsQJvJ1K8Pzn1DGa8YaMCFtNqXZdVpqncvhhRSr/ gXSesDLGXBIFQwWeNkO3E0DhNma9xc9kqMDMFxYjMSch6KEpJbuaby7cJVH9QjbBZYzqDT/8kGp j+074w5nntsLQ4Dc/KWDo4= X-Received: by 2002:a17:902:f60b:b0:2e9:5313:8f7a with SMTP id d9443c01a7336-2e953139665mr15933655ad.6.1792042992896; Wed, 14 Oct 2026 22:43:12 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:12 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 12/82] dovecot: ignore already fixed CVEs Date: Thu, 15 Oct 2026 18:41:00 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130932 From: Ankur Tyagi Upstream has confirmed that these vulnerabilities are fixed, and Debian has also identified the relevant commits: CVE-2025-59028: https://security-tracker.debian.org/tracker/CVE-2025-59028 CVE-2025-59032: https://security-tracker.debian.org/tracker/CVE-2025-59032 CVE-2026-27859: https://security-tracker.debian.org/tracker/CVE-2026-27859 CVE-2026-27851: https://security-tracker.debian.org/tracker/CVE-2026-27851 CVE-2026-33603: https://security-tracker.debian.org/tracker/CVE-2026-33603 CVE-2026-40016: https://security-tracker.debian.org/tracker/CVE-2026-40016 CVE-2026-40020: https://security-tracker.debian.org/tracker/CVE-2026-40020 CVE-2026-42006: https://security-tracker.debian.org/tracker/CVE-2026-42006 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 86a9ad852a7180edf8b03fca7d0a69e9f1d9e550) Signed-off-by: Ankur Tyagi --- meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb b/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb index 993453eaa3..06e6ee39fa 100644 --- a/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb +++ b/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb @@ -89,3 +89,11 @@ CVE_STATUS[CVE-2026-0394] = "fixed-version: fixed since v2.4.1" CVE_STATUS[CVE-2026-24031] = "fixed-version: fixed since v2.4.3" CVE_STATUS[CVE-2026-27855] = "fixed-version: fixed since v2.4.3" CVE_STATUS[CVE-2026-27860] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2025-59028] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2025-59032] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2026-27859] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2026-27851] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-33603] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-40016] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-40020] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-42006] = "fixed-version: fixed in v2.4.4" From patchwork Thu Oct 15 05:41:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100805 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DE9F1CC6B3B for ; Thu, 15 Oct 2026 05:43:16 +0000 (UTC) Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33234.1792042996030510887 for ; Wed, 14 Oct 2026 22:43:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Hf76oorp; spf=pass (domain: gmail.com, ip: 209.85.214.180, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2e8f2c3ad6bso20398935ad.1 for ; Wed, 14 Oct 2026 22:43:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042995; x=1792647795; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=gUy+ok7KmUVPajobsErk65d1AHsPoAPoiGYJeLt3G7E=; b=Hf76oorpzp/Elz2zpm16W7hfaupJ8+ynDy+h9Hyedm5p2j3Faae+tcRlFrxP9cO4e8 1UirICOocEqcKJLSF+adXjQ9Qe/MFePtJf8ULyA+h2sUS/N44KHhbmg233q4U8fc0mmt Pi+kphWBulao8YHNlpAs5p7HZj4NoMNWjb3Dw6GbzqEZCDdkSuy/e5AkyDIQpfwg/9mV sytdk5XiB7wGz8NuEFXtWD6PfWHJAlMQzyJTTGo64d6yx3koDxWWv/1UTToHhX4Pcnv0 weefbtCkMt8fnZ29Mb/41SwAN6GeTznD4gGOICC/KPWleD+7gLFVVv025sovBniFkYc1 7jOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042995; x=1792647795; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=gUy+ok7KmUVPajobsErk65d1AHsPoAPoiGYJeLt3G7E=; b=jfYvpRiTiH3SyR3N2EqUlicaH1G9G/+H8dbiSWzM0zhuXyy3FXrtWJCcLIX9wZf9Ei ClEVQQ7DlCkfRrn+hUhEsy+UHb7OwFsdeqXzRqJleuEGDBzeXDvtfTSMG/Y1/UZeERiw UgYIaCu9Yx3ZTuM6ffBQgScCQ0eqwI3AK/zEpZkdR3SwvzdCTZyPYY/WJEeF/ykbuFEk jroeKp+ksmX5NCVw6AfnOeqkpmUBRaxUj9troZcWg31SNvWDEPc+q3sIvOBdi0jD1HDX XraZhWPLZa7BhTbJHMRdnwACRNMx5MNgT5fEl1Bqjg8bCg5kEYd4VdV0kIUk63fWYGbZ qzkQ== X-Gm-Message-State: AFq9FYLPb/KDRcqJCzreLCZ8y7oXkjgeJ4fWUYFTSomSJOYlf6r59/Xt UYqPC7H9J5lvno/uIWKPdvAVtl/pIv/7tfrnqBWsYhwpWOw6FyFLHxu1H1D1kg== X-Gm-Gg: AYBFou0nVb9OnToET1xGPyQZu9357cJQpnQalufxTBii8Sz94CicUfp0h4rSUnP7QiV 0gnhVvIlaLclPpt/f/+tNMfOdBOS89b5NjrzQ2VW9dr+UOKyz1xAwk9rBIypV8opKW0q26ZY+MW AKMKXrXgoU6F46VyTQ48lJzDp/YhgrE3+xXWbQu0Uilp5cbRIsQuIQHPsic2xSJ9WV4QBq6f2bK TFEMDWTKFfveqFOEu8260fyV5cHJgkzO9REwE8ZwpC8R74TcsKqE4az5NfOdENHWZubrHRiIqSD sqeeM7G5ecmd+D3LkkRvFu7vNZYBujsizF6Fn7vY6klz+TeLbnxqHncPFkmE6oOSAqh5mzq3hpz tPOr3/8schIizEQ9lnEH7DOwLZaNaoLIu3TQegyUsijj9b+jJXLr7+YbAtXArtMPxdFjWqeHB6a A4w5k00KoVJfWVhCgyPhfyvVDFtoESU1ftL6oxMRpkMaRLcyg++SOoy+cFEOn6wdpbX1j1z9ebx RhB0S7BJVgLWV/Dsf6VYExXZ7tqHOAR+w== X-Received: by 2002:a17:903:19cf:b0:2dd:c100:4b76 with SMTP id d9443c01a7336-2e842ce7c78mr177066875ad.45.1792042995362; Wed, 14 Oct 2026 22:43:15 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:14 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 13/82] eject: ignore CVE-2026-28065 Date: Thu, 15 Oct 2026 18:41:01 +1300 Message-ID: <4581170802a4bf0a009ae21ef4b6b561632d7806.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130933 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-28065 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit e6d111c16938dab4a377826147bfc86b72bca8a1) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/eject/eject_2.1.5.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/eject/eject_2.1.5.bb b/meta-oe/recipes-support/eject/eject_2.1.5.bb index aa0e86db12..90630ff791 100644 --- a/meta-oe/recipes-support/eject/eject_2.1.5.bb +++ b/meta-oe/recipes-support/eject/eject_2.1.5.bb @@ -34,3 +34,5 @@ ALTERNATIVE_PRIORITY[eject] = "100" ALTERNATIVE:${PN}-doc = "eject.1" ALTERNATIVE_LINK_NAME[eject.1] = "${mandir}/man1/eject.1" + +CVE_STATUS[CVE-2026-28065] = "cpe-incorrect: this CVE is for WordPress plugin or theme" From patchwork Thu Oct 15 05:41:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100809 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6C22CC6B38 for ; Thu, 15 Oct 2026 05:43:26 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33235.1792042998478813156 for ; Wed, 14 Oct 2026 22:43:18 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=HYw5D900; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2db710396ffso37499405ad.1 for ; Wed, 14 Oct 2026 22:43:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792042998; x=1792647798; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=JnAkwpC7n4kx2MhHw7h7cwwn3nedx3CkYkjxjX88DzY=; b=HYw5D9004D6sGB80XL2ASlPvoRS4K4Azo5oxkhLHDhiIs6tlTW0KAgn3XMdKY9uzjh ePFU92V16RPWTLvwjj4tw/73fFn9wy51Kld5N4mhTDjLK8FfRz3N1kEIk2/PbMS8qJPn 7gVDU+Cy1QohXg/GqrBY45xzE7NOgiQOwVbWWndB+qoTheXsBA90j1f7v5rN5NAC43ml SjZLErs+Xf9kTe7/7o1FpsbUMJcJuM64/WIvPz2XqXJdp5vKJJCnadUlUutg8p5bOygJ 0rnisSeX19Lgd0enwUvPIoBHMqLneOzGZ7Eweo6Po3SL1L/+bDvDwii4aOdzTZgHlJWP UVEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792042998; x=1792647798; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=JnAkwpC7n4kx2MhHw7h7cwwn3nedx3CkYkjxjX88DzY=; b=CzD9SvbTV3S7YsUYJT4dhnTz/fj8JuHslOfxGh7MhmR/qpHYwhczx4JElTsWru9hhe r/0Uli4Jw9kebrhNvIHNS3p8zo89xAhXD0kk2E/1T17v/NbNsgyX8Ab7kwDm1XeR/KoH f6c+B40ZyClP+lO2pR+ZgQ3x3vzDr82EzIEMCZrLypAjFLU7lsNBXNITaYnG1+nHYB+e +GTSIsB2jNvisI0ysRx6JR5miHHvuvXZbEczBue9eyFPXh3qKzYEJ4Jd6PT8aoLw1t78 axsY9umwr21ldtL6pVXohMVbbMGmfbeIeKsBCswq1LClOllZLza7niY4slEzw2gR6rfU 7jCA== X-Gm-Message-State: AFq9FYJfEiruS7mN2Q00thOfa2EUPGzAv4YYaRO//sP7LUUqyGz+S+uk +JDe/oMJjszYq0KJmmTobwtUBq3e0TWCtFy5Inaz0R3XrMU1dCfBuYJncWYXMg== X-Gm-Gg: AYBFou1xILvJK+L1HP8RAw5sUWY1GFmYAGUjlCcM0ty71qbj1VxVUi0NLrdgsX9Esn2 4t5CvfbxC77zNDaY+pCrU1fGSiMRWQ8/qFl2cvaXTM7eOsM+xwl3VREPvy5xsqNkaZwOay/ww1J SqN+R3RYxUGundNaLHgsMgoXQnB0HyxpplXC2j++kCBqMQ/SwBhO8sMQi0IiRh1US1C1kzJ7Zan yRfqcshZ5vVMdHifyG5xp1WXAJa/711wOi/ILTmDVLqPKRVMAeUwxWSppDWNX8NMweJFIU6rBAd +mXhidMYG146aX3SMlOmvQLRzvBWbLJ17B26zGLuT6lCZqsguhmfnVr0N4gQHKvu/2ImcpNva9e tZWH6x0c/Zd//Nv8CVN7vTVSb7CgQ1yS3naWgW7NQtw4/+tim/NPkk2POLKe2EuQHz2nILP3zkm BUEsBfXK1s/f+dS1t2E3brUEiPKwlqs79zhJyE7oJVLzSgyKmDqLirfUbxwhjRb2+O+n+6tmwMZ xB/+hGBL7ncYUaoQQmXCPfkrw== X-Received: by 2002:a17:902:c40f:b0:2e8:6540:11b6 with SMTP id d9443c01a7336-2e86540122fmr100751035ad.37.1792042997718; Wed, 14 Oct 2026 22:43:17 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:17 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 14/82] gpsd: patch CVE-2026-58459 Date: Thu, 15 Oct 2026 18:41:02 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130934 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-58459 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 57e1f7d3d255e7b2eb55e9bca152f189ad8cdd09) Signed-off-by: Ankur Tyagi --- .../gpsd/gpsd/CVE-2026-58459-1.patch | 48 +++++++++++++++ .../gpsd/gpsd/CVE-2026-58459-2.patch | 46 +++++++++++++++ .../gpsd/gpsd/CVE-2026-58459-3.patch | 58 +++++++++++++++++++ .../recipes-navigation/gpsd/gpsd_3.27.5.bb | 3 + 4 files changed, 155 insertions(+) create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch new file mode 100644 index 0000000000..aec3acdeb2 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch @@ -0,0 +1,48 @@ +From 485b793ee3a54865ff9d8efffd2fe9a309666be0 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Wed, 1 Jul 2026 17:55:57 -0700 +Subject: [PATCH 1/1] clients/gpsprof.py.in: Quote double quotes in title. + +Someone could use the double quote to break out of the +string and add gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 5581ba196d826a984fbfaf792b7d58535f9911ce) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/5581ba196d826a984fbfaf792b7d58535f9911ce] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 5c18f50ff..261e72665 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,6 +198,10 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + ++ # escape ", and \n, for gnuplot, to not break strings ++ desc = desc.replace('"', '\\042') ++ desc = desc.replace('\n', '') ++ + return desc + + def collect(self, verb, log_fp=None): +@@ -1262,10 +1266,10 @@ if __name__ == '__main__': + # Ship the plot to standard output + if not options.title: + options.title = plot.whatami() +- # escape " for gnuplot +- options.title = options.title.replace('"', '\\"') + if options.subtitle: + options.title += '\\n' + options.subtitle ++ # escape " for gnuplot, to not break strings ++ options.title = options.title.replace('"', '\\042') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch new file mode 100644 index 0000000000..dd50d27695 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch @@ -0,0 +1,46 @@ +From 6031dc96603d5537a650068a2f8d42ef90d9d32d Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Tue, 7 Jul 2026 13:41:54 -0700 +Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title. + +Someone could use the back tick to break out of the string and add +gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 1a6bb7bcbdf58aa940132e630870af061dc88537) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/1a6bb7bcbdf58aa940132e630870af061dc88537] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 261e72665..202214769 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,8 +198,9 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + +- # escape ", and \n, for gnuplot, to not break strings ++ # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') ++ desc = desc.replace('`', '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1268,8 +1269,9 @@ if __name__ == '__main__': + options.title = plot.whatami() + if options.subtitle: + options.title += '\\n' + options.subtitle +- # escape " for gnuplot, to not break strings ++ # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') ++ options.title = options.title.replace('"', '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch new file mode 100644 index 0000000000..a40edfe6d1 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch @@ -0,0 +1,58 @@ +From 54484dccf7265e51368eef03d99ea7a370c15e06 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Tue, 7 Jul 2026 14:23:56 -0700 +Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title. + +Second try. Also quote "terminal". + +Someone could use the back tick to break out of the string and add +gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 4c06658e988f4ced1a7a574ce082a22ef625df56) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/4c06658e988f4ced1a7a574ce082a22ef625df56] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 202214769..e91367ee3 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -200,7 +200,7 @@ class plotter(object): + + # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') +- desc = desc.replace('`', '\\140') ++ desc = desc.replace("\x60", '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1271,13 +1271,19 @@ if __name__ == '__main__': + options.title += '\\n' + options.subtitle + # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') +- options.title = options.title.replace('"', '\\140') ++ options.title = options.title.replace("\x60", '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: + term_opts = 'truecolor' +- sys.stdout.write("set terminal %s size 800,950 %s\n" +- "set termoption enhanced\n" ++ ++ # escape ", `, and \n, for gnuplot, to not break strings ++ options.terminal = options.terminal.replace('"', '\\042') ++ options.terminal = options.terminal.replace("\x60", '\\140') ++ options.terminal = options.terminal.replace('\n', '') ++ ++ sys.stdout.write('set terminal "%s" size 800,950 %s\n' ++ 'set termoption enhanced\n' + % (options.terminal, term_opts)) + # double quotes on title so \n is parsed by gnuplot + sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title) diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb index fa3df89b27..52d86503a1 100644 --- a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb +++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb @@ -8,6 +8,9 @@ BUGTRACKER = "https://gitlab.com/gpsd/gpsd/-/issues" HOMEPAGE = "https://gpsd.io/" SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \ + file://CVE-2026-58459-1.patch \ + file://CVE-2026-58459-2.patch \ + file://CVE-2026-58459-3.patch \ file://gpsd.init \ " SRC_URI[sha256sum] = "409873f5048462ef1ac413a51ab35caa8b50b31be62b3347bee1cc2994e7c649" From patchwork Thu Oct 15 05:41:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100811 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4B34CC6B39 for ; Thu, 15 Oct 2026 05:43:26 +0000 (UTC) Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32800.1792043000753852380 for ; Wed, 14 Oct 2026 22:43:20 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=ltNqtOsS; spf=pass (domain: gmail.com, ip: 209.85.214.181, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2e8da6ef7ddso11431575ad.3 for ; Wed, 14 Oct 2026 22:43:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043000; x=1792647800; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=FoArhE49vCg0g/mnOsPCMqt0Cv43GTb/2k96P0GEjQ0=; b=ltNqtOsSEb4uNLkh+lxA1XFafTQHO1ZlczR+Fw0UfG2EAU8X+91C+UrSQCU6vbB10q h4jW1wUclM+JBf6rowam/P/dze1vKVmPOMoeG8SBYLQXY1dSo1xWwTV/IXAPDoAsrx+U qrYXofkX39+Bs118WNoghnvk++2JvuXMO7MPV27IYUPMyVta3l+VOqytwBs9hZSepqOn MKNoyGMTpmZf4U/yoeZIz8EZHsTGqJOx8A4ltQMH9hMse9wpt5q0A/MhYVG6KTcgo/W2 Ksmc+L3gCtUJl/AlhBzl6c8L7EJINayqMQiVQ5AaS4SujDvP4K4UR9QqRVmFx4ftRUlY 78Ww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043000; x=1792647800; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=FoArhE49vCg0g/mnOsPCMqt0Cv43GTb/2k96P0GEjQ0=; b=kby7aw3u1M8C+f2L1My5ev3o3C54M0tabuBjt3tVvSZc26UiifjczeGBVsHhpnBkco XWCde8ByS/cf+tUPP3vSsjwFgZsD5so7SqK6s9K5wcRGAlD2iXBRyBWEouHgsB3tRmPn 2PB9hurOiuo/UsOdNyL1AGJ//nacJx8DgqMN1K3/j5HVl5E1jqScwp89QFxwbGVwyHet oFpoROEmQ9SakVDa+Z2w4Xvn52PmudiTmsCfyEV3GiZANfrOgUi7UWYHsh/cuWXLiBMx l9IF6b54nNZ+av0vxEFCjoI/XCxjxXpxutyAIKdVgYAv1rTGHn8B8bTz8GKaSZCVQ+bK iT9w== X-Gm-Message-State: AFq9FYK58EtKY6J692dWrHmliokYSo08lmUmvXYy37R0H1WpHM64JHAN n3S99equ/8gvGBmnSEcnbntmu6fj4OA+agoJtqzh/tz4Pqc/Ue6iZRIgilj4SA== X-Gm-Gg: AYBFou2L8ypzr7Kl1R0S1UJ4d6430l9SrczYSxJPNkK7nv4LfIDgiX2avbs2/NqR7yO rn9xcu2N4q3lk+ZXKjWEWEDTjb+uQJIr0IventwVy2zJVXaZpj3DvXq0OPDU+1gFsYVnH5FR5Aa l0Lz1UCHw0iYkInrKr5gsVDHTpebDP4ZImylGAQCtvxINsU/C0TfnnWlnc08cB2D/7PGiAk5Jqc NjKN21lbZ0rsFTK8Ht9yD/GD1VPoRdawAVDupp3onj4sUqcctZLQJUSaJ+EuqfI1J6jimwk7qc0 8wJKPM129BO3uviEWK5vs7x5YaA/lLgGvKl1sxEZX6jTJhW4ZfQhQ6iiumHt3XxOORlXstVb99e kVRpmKzRcwi3HRK25r9t6VpRYGIBMfD99T4HNSowoWCVXgAa9nDiAiHG0dmb9c0TDTi+SGJ8wZq D9/Sbr1CoNTCgYSotxVq1BbfC0U57pyShoMAQl6xpQeNypSpSxKUibxxGEwiWLkXh81MtaLWebq 6Gm81kDJAu3YpH93Yqw3vg= X-Received: by 2002:a17:902:dac6:b0:2dd:c100:4253 with SMTP id d9443c01a7336-2e842e061d7mr157375375ad.55.1792043000098; Wed, 14 Oct 2026 22:43:20 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.18 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:19 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 15/82] bcc: correct CVE_PRODUCT mapping Date: Thu, 15 Oct 2026 18:41:03 +1300 Message-ID: <2883998669b316a1a51de5a3278e4cb568fbfe7e.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130935 From: Ankur Tyagi Use "iovisor:bpf_compiler_collection", the exact NVD identity for the https://github.com/iovisor/bcc source. Signed-off-by: Ankur Tyagi --- .../meta-python/recipes-devtools/bcc/bcc_0.37.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb index 8caeef90bf..eec8ef4a32 100644 --- a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb +++ b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb @@ -91,3 +91,5 @@ FILES:${PN}-doc += "${datadir}/${PN}/man" OEQA_BUILDPATHS_SKIP = "/home/ubuntu" COMPATIBLE_HOST = "(x86_64.*|aarch64.*|powerpc64.*|riscv64.*)-linux" + +CVE_PRODUCT = "iovisor:bpf_compiler_collection" From patchwork Thu Oct 15 05:41:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100810 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D62CCC6B3A for ; Thu, 15 Oct 2026 05:43:27 +0000 (UTC) Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32801.1792043003359187641 for ; Wed, 14 Oct 2026 22:43:23 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=fTVncurs; spf=pass (domain: gmail.com, ip: 209.85.214.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2e95b3b52f2so2109295ad.0 for ; Wed, 14 Oct 2026 22:43:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043003; x=1792647803; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4Z6G3hWoaPVvm3Lrf1oJtBmflGYOH700fa9YsIuo/mA=; b=fTVncursXqfaBnOACjyJK8qm/DUjX/a1J40AZ4d9EpgL8Qaj5eBZAQ9ZsyR15eUL37 A1ljePo3TS8p8U2Eq80T3/aBLxUpg6nIzc8lrPGeuTm/uLZBw6hfjNkzhn60r9j+JULL 0ZKkOl0GzzO21CJPjFDwjQdP7qfz6SCQE32fPp890PjB7qWAzEsxHWG5i9NH3ZW1e3uy 3GMJoH4egeEcicoKf8XVo+QYztoG+IMoNbtH4UBNKq6uH3m3QGZwH51INFSUda+GQTDg rlpPPqoEXhadU2BZZUywqZk4t9u3g/OkEMZEkV5aNGCBeF5bmxfMDG6wJ02clct5ZzUC ATFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043003; x=1792647803; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=4Z6G3hWoaPVvm3Lrf1oJtBmflGYOH700fa9YsIuo/mA=; b=PbIlD7uT+liQ/7Np2BQDgn38clybSoujVLNDJkX9dGV/FT+UOcBah9sQYkeAHRtj0P 5XVJ6tmL2AUO7c99rELUNb/LWAL3hdY34wfcLlhbHlkYdKK2lVuw+pPWiFi/b5TCRWtm CNwZKHTARC9KqCPBgJqU4hfMJHwM5WwDnJLoIu76sSbG55U6ikVNuhDiZwTgNuMDBl+o AQnoxgZ+8OTb0f05q0ehqffaPUKMVycq5t7SrFvlph/rjyFLIR9J2Vrl43C6+IrjGuyY 7G9U82EG1n4PFRkH8XcV7TyWZnOmBg5Ypf8l72pzQqkeyL52JfycPpEuiUZ949NB+iHX eN+Q== X-Gm-Message-State: AFq9FYKDNEEimAr2on1Bvh9jekFz65+0RLEosW+6NvbFEcjNqrsFBQlS wg3d6nh6VDUm5y9IfoSfKtClazUtpmvFF8aULRlWySJNkSeaFdeRiCn29P5zbg== X-Gm-Gg: AYBFou20gL6vEZU53F3TIrs+rVkewKwr85NuC4itAAYR6SekE+z+LzwEviQw8bEk1X/ DBkb84vFOJ3uXvTUxxipNXUqtndf8tVdwoOc2eWqSBeIqFi2a+7i/74cDqcqd8sxWWcDIn2Cnwd fSu/tpRQ1RiWeE5K0qSmpOgFWIpbkxiark74QYUW2iQCAix2dh1bOv1CmFHjD4PFvVNyu94HZyF DC+2JaZi9TkpviV1BWPEzcA0mWz56hGJ/R+fFlL05uyymRXjgisN6oH7lOXNi2+9PIW+QA70LYo v9eK/0JhK8P0mgrSn0rFpV4OQly3ReHXUuMrWkOqFw1cPKwflWrRx5BOKpQeeGa7v8NADe/YyfG PZ1IPjw/Gl1Ux+Xk5Ytt2o/rHsZ61TUCe/I1M0T02YqZOcfOe7ogf/pAYDj47MpPdYc/9VlYfWd N1sUUpDX54NP3p1jOn0FYhKARKD8pcct6wui9KHEJJ+/gfU5zRC4t0k7BQAqMsmu7mtz5oWSCLV tu70bUS6eQOa1UqBYvcFak= X-Received: by 2002:a17:903:26cb:b0:2e9:3f41:4212 with SMTP id d9443c01a7336-2e93f414356mr35565745ad.13.1792043002656; Wed, 14 Oct 2026 22:43:22 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:21 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 16/82] dool: patch CVE-2026-56651 Date: Thu, 15 Oct 2026 18:41:04 +1300 Message-ID: <6dc6984b6cae7f2c469886c6b8c67ff9cd09252c.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130936 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-56651 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 2e1445decda0c68cc6889777c6f648cdaaef082c) Signed-off-by: Ankur Tyagi --- .../dool/dool/CVE-2026-56651.patch | 47 +++++++++++++++++++ meta-oe/recipes-support/dool/dool_1.3.8.bb | 4 +- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch diff --git a/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch b/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch new file mode 100644 index 0000000000..e367884ca9 --- /dev/null +++ b/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch @@ -0,0 +1,47 @@ +From f5eb4fbf3977d919a2e9da8b73985a29d2878e56 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Majchrowicz?= +Date: Thu, 18 Jun 2026 10:52:27 +0200 +Subject: [PATCH] Neutralize formula-prefixed CSV output +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Michał Majchrowicz +(cherry picked from commit d5aa93b3d1939a83b2b10a7cd8af3c819930aea1) + +CVE: CVE-2026-56651 +Upstream-Status: Backport [https://github.com/scottchiefbaker/dool/commit/d5aa93b3d1939a83b2b10a7cd8af3c819930aea1] +Signed-off-by: Ankur Tyagi +--- + dool | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/dool b/dool +index 634ed9d..fc1015d 100755 +--- a/dool ++++ b/dool +@@ -3030,7 +3030,10 @@ def perform(update): + + # Prep the line for the CSV file + if op.output and step == op.delay: +- oline = oline + o.showcsv() + o.showcsvend(totlist, vislist) ++ csv_cell = o.showcsv() ++ if o.type == 's' and len(o.vars) == 1: ++ csv_cell = csv_quote_string_cell(csv_cell) ++ oline = oline + csv_cell + o.showcsvend(totlist, vislist) + + ### Put the output in the csv file + if op.output and step == op.delay: +@@ -3170,6 +3173,12 @@ def file_slurp(filename, size = -1): + + return ret + ++def csv_quote_string_cell(text): ++ "Quote free-form CSV string cells and neutralize spreadsheet formulas" ++ if text and text[0] in ('=', '+', '-', '@'): ++ text = "'" + text ++ return '"' + text.replace('"', '""') + '"' ++ + # Make human readable device names that are shorter + # + # Example mappings: diff --git a/meta-oe/recipes-support/dool/dool_1.3.8.bb b/meta-oe/recipes-support/dool/dool_1.3.8.bb index 8a057effdf..5118eadad6 100644 --- a/meta-oe/recipes-support/dool/dool_1.3.8.bb +++ b/meta-oe/recipes-support/dool/dool_1.3.8.bb @@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=1ebbd3e34237af26da5dc08a4e440464" DEPENDS += "asciidoc-native xmlto-native" RDEPENDS:${PN} += "python3-core python3-misc python3-resource python3-shell python3-unixadmin" -SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV}" +SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV} \ + file://CVE-2026-56651.patch \ +" SRCREV = "b74503e2dfbca8ef01c284d40aa77dc82be308b9" From patchwork Thu Oct 15 05:41:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100808 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6633CC6B2F for ; Thu, 15 Oct 2026 05:43:26 +0000 (UTC) Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32803.1792043005700355153 for ; Wed, 14 Oct 2026 22:43:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=EzdpP3FA; spf=pass (domain: gmail.com, ip: 209.85.214.181, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2e6038cebefso36454955ad.0 for ; Wed, 14 Oct 2026 22:43:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043005; x=1792647805; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=90drzaRUZo1OEMOCEJ42r70WwBOEd3go3cPz5bMURXQ=; b=EzdpP3FAdxxdXtOCTQ1QIQjDK1pan2BJJmLxVHo7G8JLdfX6IH59bYmCXpH4wa1Gvj FGlyUnq+bS1+Cokd1qgom9K9OL5HUZ4M9F5lw1Eiw75hX4+VPGYShyLr/AWvBDm94VT7 Xc7O3vJF/vDUI+R1GdeAUjEwEx1CIgl91HMeSf+REM+IAVk4we8YBiaT/OsFAR1SYnB7 4IibsAbEqwFw2RpWrueg5kJoA9RhzvAF+INc+CMrEwmJB7ejr239yxSBtoX/z0wKPKvn 8Rrbe1m4+45Zq/5uaT9TqKPQ4SVLt9Mrb2SqfaDfU1l8QDrcJ6fAlowQanIuskiNR/+x 5m4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043005; x=1792647805; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=90drzaRUZo1OEMOCEJ42r70WwBOEd3go3cPz5bMURXQ=; b=IlVSmxmmBR4oHXJ2v7Gp3CDh/f7F8/S+Vc1EcPyG0OZWEIhvljCPeD5APOsYnjXWaQ +9QnAxyJ87Rw41PnE8b81It7LIJAHOHfrOVHuHdjdiGxQ5DnHDDNHW6yEY9vZZaJ0WYm G3ua0xnBzAp2HqyhapOWsSjEjnDxHdypgZ0o7zidIB0YfCblTrCeuf0SuBFLnXKPX7zS nhBCz+5TidbwfOmXX8sltlJYXzG2z4yN8X9/JDGrqDFzMQ7a+qvoMIwOa0i/KS8zd2Zh 9Akt8BY8SrslDR6JPhpP0pnZG5VWgpFsIILjuayDmYJYTxkea1veXNvRh7kwl2g2XJnm 4FtQ== X-Gm-Message-State: AFq9FYLpCy8JExkA275L1MsBnnoyKOBGEx6E226cbjQvpUWxyCIBc4Y9 P35m7u8e5E1zOjQojf23xbuXFNhJw8sLRPMz9y4x/Q+qewJ2iG3aDQ50LrlCfQ== X-Gm-Gg: AYBFou0d3m1xgtA0692XoL9RqUdML6DfR7sfKNB8tk0/wZemLiqeoVjvujwqSKw3JwS S9RcLpdotQAfhhtnd01iwKq5cB4kNPxnY8ghYfrciYzqE9MerlTlOdykTeTBg376u1pDvpD6q8Z B5n3OQn9RPj6NBDqCXZRJwxGNH1jU9wmihVftjIdu8RneO/brg3TqGCKzCycGGYdF9I8Wt9vb1E hqhiQnvxlfK1oSkN8LOcYLf0Va/TKLrWe38tEoEVILnjwq8AE97yzz7m/JA2pm0hek/oXfdIjUx flImd4qS84vk2TH/gxfPzY7yeaM5kL0BbZ41/9X1YmTq8Pg6t/+JUwisfIYMFNETiIDy+rtn37a 7AUK2HqEYkn/TQx5wfzJ+o00lEW3o6PbtQge0IdsMNFQL1WvS+lAOMWyFALR2k32RF1Jg9kyutz YHP6RCQGbsZ9ztq0LXTvGv0wzy3kdq2XQjdiKR8xq0AxOW5iiosR6ki/PeQGfe2ViKNmnvFrct3 oORm68uZ3gIIU2hTywt2t76wA== X-Received: by 2002:a17:902:e744:b0:2dd:c100:943e with SMTP id d9443c01a7336-2e842cef77amr167027055ad.60.1792043004927; Wed, 14 Oct 2026 22:43:24 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.23 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:24 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 17/82] dool: patch CVE-2026-56652 Date: Thu, 15 Oct 2026 18:41:05 +1300 Message-ID: <63363b3ec9c5e6ceaad1a0669d9a2af73c917146.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130937 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-56652 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 53bbf2771b13ae1d2c856975ea8f8712b329cb30) Signed-off-by: Ankur Tyagi --- .../dool/dool/CVE-2026-56652.patch | 35 +++++++++++++++++++ meta-oe/recipes-support/dool/dool_1.3.8.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch diff --git a/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch b/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch new file mode 100644 index 0000000000..c6806ae0c5 --- /dev/null +++ b/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch @@ -0,0 +1,35 @@ +From d20ba041a0f4968fdbc2745827f9af676339924f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Majchrowicz?= +Date: Thu, 18 Jun 2026 19:20:30 +0200 +Subject: [PATCH] Refuse symlinked devel log files +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Michał Majchrowicz +(cherry picked from commit 259fe40c7fa519020ef7a3f8ef8d61586b72ecc3) + +CVE: CVE-2026-56652 +Upstream-Status: Backport [https://github.com/scottchiefbaker/dool/commit/259fe40c7fa519020ef7a3f8ef8d61586b72ecc3] +Signed-off-by: Ankur Tyagi +--- + dool | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/dool b/dool +index fc1015d..2df407d 100755 +--- a/dool ++++ b/dool +@@ -2132,7 +2132,11 @@ def devel_log(msg): + if not DEBUG_FH: + log_file = "/tmp/dool-devel.log" + print("Writing devel log: '%s'" % log_file) +- DEBUG_FH = open(log_file, "w", 1) ++ flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC ++ if hasattr(os, 'O_NOFOLLOW'): ++ flags |= os.O_NOFOLLOW ++ fd = os.open(log_file, flags, 0o600) ++ DEBUG_FH = os.fdopen(fd, "w", 1) + + # Print out the header line for the devel log + DEBUG_FH.write("|Time |Since Prev |Description|\n"); diff --git a/meta-oe/recipes-support/dool/dool_1.3.8.bb b/meta-oe/recipes-support/dool/dool_1.3.8.bb index 5118eadad6..06484c5475 100644 --- a/meta-oe/recipes-support/dool/dool_1.3.8.bb +++ b/meta-oe/recipes-support/dool/dool_1.3.8.bb @@ -11,6 +11,7 @@ RDEPENDS:${PN} += "python3-core python3-misc python3-resource python3-shell pyth SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV} \ file://CVE-2026-56651.patch \ + file://CVE-2026-56652.patch \ " SRCREV = "b74503e2dfbca8ef01c284d40aa77dc82be308b9" From patchwork Thu Oct 15 05:41:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100812 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13FCBCC6B2F for ; Thu, 15 Oct 2026 05:43:37 +0000 (UTC) Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33237.1792043007481652523 for ; Wed, 14 Oct 2026 22:43:27 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=pGt1mVcO; spf=pass (domain: gmail.com, ip: 209.85.214.173, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2e5d0ee1951so30922195ad.0 for ; Wed, 14 Oct 2026 22:43:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043007; x=1792647807; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=qDt2FLp+TMVuVM/EB32L1w8SQfeIqCLI/G+Yf3nPJ0A=; b=pGt1mVcOkOq+Tb5xCUvFpxGUYNJNoklsfvfUboCLNdoPpBeMEsdDpRvKGpzONzbDG1 /GI1+pQj8mQxT9ZdA6aGw4kQzgIfLC7+5bpVTEfjy6Ks0oBetc9Q2z0ZeSsyxyv0thGc Nmhn7agroOI7rOIvibFdEADLEeaBOocq+gzWY+Yxhe4s0ZliPTIdB2twNHxB3pbbItcw 3SwJTcrTByzodHALNoMvbxW6F9a05tfFMLdEeVDecPzbCX3rTJNelvSVBboLUcJmPYn+ MWR0AJi+kiux993P6ljdznlUcJoTJGJtu8dAquTVFbX0LsbKKYm8LnPpQ53dLXMAl0Ul ewtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043007; x=1792647807; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=qDt2FLp+TMVuVM/EB32L1w8SQfeIqCLI/G+Yf3nPJ0A=; b=2CtMP3yPz8gJh0KwEXrf0S0YVn8Y8ZV6jI0LCnCzMaGW1QZiAlARG3u7xxWlnvzaaE gSbRqNO0emwtw2Ze8Dv9HjHloMPZMX2R8o8Yk7Pj5HDBIJSM7D91aChBdP+j7ROmnzb2 iOtw9L9Mcm4cARvwlrkMzfznyX6Hu1pwjQ9/WSYfBtI+39aYJ6Je2XiaaXVZyHuQvtV2 83hoZiQ8vOWV8/FCYaiG7VAhte/Yq+iIE7AN7njcXQbpz1yvzF8I2VMrNpfjU5ftjRpH vZrvbUsJtx4YBJi2YDJydodQV4oLTdmIYeYzYS4NuBTO8pnM595+Z04mjdBUnm9RxQge KMCA== X-Gm-Message-State: AFq9FYJTsK7jiDCm5x2i1pSw76Npku8oW3natFvt+36SnsorcoUWn7os uCejePDNQyjvkLS6ZbSIJxReH54enkxUlv5kOyBru/+dUmIko33kbONd/d7vuQ== X-Gm-Gg: AYBFou1nY0SfH9vxtgMuZuPW4ykgyaoaS17Ce8mpVXgHt52vdUNqLPc+yVaxp1dsjE+ KHC0Mu6FV0V+Uznk55wvCoDO4uFjBrLfKdHSX6neHATrz2xqwnPyjTojdyuJ8PPtnf/yT5vFACx KAKo+5xhUd0+i55szGz/qR9lOXHe2FyykLuW+yTGU5M26jUfPH2Q6xePtoOwYZvis71f7/UIioh nt1UzR0i2oTH/+q4m8oKCEQdIE89AMeGe4tQJRqpOyX5HH1ScWR8/crkjdwkmaIGr0GK0JDu89T 81SpnSBC5HKEm2GHBnHfe9/WDkuo5rEYyeDtoOL4QEQbMWGrZEZ4CvuBHheTPoBDDlNKRErXBEm Ms/Ei3YHksVY25l7ralJJBuzmut/lurji3YfMZAUnEjSbDWLQNrDz2NohkrXfDUUWcYntFccabB 3Yb914MzgTIIqFHxPr9STllRkbTYkqPV2UwT/ZcfGVfyf4Kztcz9Ar/0ig8IT6tjS98yfiZbFzL oFW08vbAYyE4WHgdgtnLos= X-Received: by 2002:a17:902:ce0d:b0:2e9:5714:6082 with SMTP id d9443c01a7336-2e957148c0bmr15239885ad.55.1792043006787; Wed, 14 Oct 2026 22:43:26 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.25 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:26 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 18/82] haveged: ignore CVE-2026-41054 Date: Thu, 15 Oct 2026 18:41:06 +1300 Message-ID: <1ea608311d774be4d8ff87b8ff40fd190ae85058.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130938 From: Ankur Tyagi Debian[1] also confirms the fixed version. Details: https://nvd.nist.gov/vuln/detail/cve-2026-41054 [1] https://security-tracker.debian.org/tracker/CVE-2026-41054 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 086a780db02e001946bba0ecd337ee7834da1823) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-extended/haveged/haveged_1.9.26.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb b/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb index fbebb158ee..727f856379 100644 --- a/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb +++ b/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb @@ -21,3 +21,5 @@ EXTRA_OECONF = "\ " MIPS_INSTRUCTION_SET = "mips" + +CVE_STATUS[CVE-2026-41054] = "fixed-version: fixed since v1.9.21" From patchwork Thu Oct 15 05:41:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100816 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AAF6CC6B3A for ; Thu, 15 Oct 2026 05:43:37 +0000 (UTC) Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33238.1792043009736422910 for ; Wed, 14 Oct 2026 22:43:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=smIAGP7l; spf=pass (domain: gmail.com, ip: 209.85.214.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2e8ad5b31c7so28513135ad.3 for ; Wed, 14 Oct 2026 22:43:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043009; x=1792647809; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=IbEZzYz1oFOUiKbvEoUom0ixcYkNfOQAMw3851J4cOo=; b=smIAGP7llbOkkDoCZcD4yYqXs8wh/EMsDUyw7PsHwsq0rFnjn4qjnR57nKJjax3ZRv j7tlre3Th3uZoB4Xc5vlSnlpmxknGbN52Au67XFep5zhLrBv6Q9JmlWDaQePQhYgTL+/ 98BrC6TqSjD7CHsFYiL7dqIU1z2U4Yp2S39lIcV5uFSprdCOmF9Z0/xbEUpc0NmdzHPJ AA777iOilfnaMxz4tiTHFUEQw179wryb2x+OBJvkk/LMWNtlW2wouefxYuiFzAKHz/FH db+JsfH9pVRsF3snIeEb8PtQbaYR9WTQZpmAheSf68eb1iVq6C24Yx8FjiSUSPhtnQN8 R5gw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043009; x=1792647809; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=IbEZzYz1oFOUiKbvEoUom0ixcYkNfOQAMw3851J4cOo=; b=D7cIX9WICtqFG9wlYrCXKDsIHWQWuAXfQReMu61o2jFcpj4cJXtJjSzWjorAeh7EzX Hr7sDwrEVFXKhh1S+l7ydQudx6hiAgDciFuxZK4n+hP27uGiIzIxY4Ib5eOimzlxsWlZ NsFyT9XmrKobQ6aUDjFg3QbGhZZW9x+uEGo4SNzpA0yjzXp/TDd5chbI5VH6aZKsms4Y 72zF69L/JZYeXFxPdC5w/AAIytcxp8pHqddSDl3P9vYNP++VOx33Rn7tUhfuuHrtrsbP WprwtEPfbiccbyyjAUOS3+Ug5TgUaeq3RUmT24TZnGjFCNP3oUWeHt6ZJ/PPxl5VEvsd zlog== X-Gm-Message-State: AFq9FYId9s44Kfdgx4ybExmOGnkyC+66PA5eV+cf86EIca1PdWiNnoW8 WdjGfP4pBgiEvq1Ejl38+ApT6QArMeo9BJi5SZrhfTF2W4xcONiTYeuZ0EsFFw== X-Gm-Gg: AYBFou05BM2BzdAQj1VHRE6X4mAMtklI7RLm4TMF/sPngxDkZg4a9+HWzi/Kk7EplD4 jOoXqrbq95HdrvRlqQuOxXU0QqZFTtpdiE0HcFeiHHxtmEym/yVHH2ouGBg0kirlI/KeBs77cLR cUoUbvnjPWEgWJoWdAiFfZseyCAUTxPp5PWg8lKQMX3Rvn+rbUZebDHXACsJCUDbjhaQXh+6ae7 PZur5V21EIoS0ehUgDZ0AWWQQv9AE55kuFEPAXrNn5vNXv4os93MPzp1QS+JDE/s4qsKtpGBPdt YOnUbbbFRycJvWLW2UNIvcfln1Bj0ixLW8pALgRVOSKpnUCU6raeD0WmggV06zpiU88jEBRWUSf dxyzsCkLJqkfJ8OB/y1LCu/nkZ9obONft7HjG75K4g9EEg98CL9xSzzJWI6Js3zAiOH38quz9Xr Zx1boVasbBDJwFR746a14GD0lWa7PPtGw/cxgi+SH50SRpX07f60oR7hkbUAgCuzuJaRmTpMDBD WKCOCk0qG3WbgHyjTs3Tw8= X-Received: by 2002:a17:902:e88a:b0:2e3:1776:278f with SMTP id d9443c01a7336-2e842bcd141mr172622385ad.42.1792043009064; Wed, 14 Oct 2026 22:43:29 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.27 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:28 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 19/82] gpm: ignore CVE-2025-4558 Date: Thu, 15 Oct 2026 18:41:07 +1300 Message-ID: <5a3355e3ae4520541b02607c8562d7cfd73b4beb.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130939 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2025-4558 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit e134adc8f3e5ff7359d7df04c4a841e4d5eeff15) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/gpm/gpm_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/gpm/gpm_git.bb b/meta-oe/recipes-support/gpm/gpm_git.bb index 155e56bdef..9c07f334b0 100644 --- a/meta-oe/recipes-support/gpm/gpm_git.bb +++ b/meta-oe/recipes-support/gpm/gpm_git.bb @@ -42,3 +42,5 @@ do_install:append () { } SYSTEMD_SERVICE:${PN} = "gpm.service" + +CVE_STATUS[CVE-2025-4558] = "cpe-incorrect: this CVE is for GPM from WormHole Tech" From patchwork Thu Oct 15 05:41:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100814 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 378D0CC6B39 for ; Thu, 15 Oct 2026 05:43:37 +0000 (UTC) Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32805.1792043011636701650 for ; Wed, 14 Oct 2026 22:43:31 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=bS45Km03; spf=pass (domain: gmail.com, ip: 209.85.214.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2db80fcdf8bso28336965ad.2 for ; Wed, 14 Oct 2026 22:43:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043011; x=1792647811; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=ogtaFee1Dqa18phQLnMc0mQq1Y1XRBGM0jQFbwLfFl8=; b=bS45Km03yaoweylV1nZilJ6UV2f5vVAS+ZLlSIzelHCNyClhopu2tocP+BcAZH7aSO iCwdK+3np92eIZgyDdH2aRAo1wPxK0Pvb88RbmeNXEiQ16wDO2PRSIzcu7injCHdwT+G mBIAnrXDuUBWoAqlQ/g8isR3OeuPxAre69UX4pu2a2px7TESNykVzgHQqbOm9MHI3F40 FX+LbNsQYmbL+I/zmj6+0Hv23Y0G6RsBnzZrsvV71XvJrE6YmAg+gvfiizJY+XFHLvYW IdXzzC29nOT1q20Xy0+6nNctLiEys9WnmBjsQHMsTWzB0aXAA9XiMJxVwYFvrE+dqw5H y1cw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043011; x=1792647811; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=ogtaFee1Dqa18phQLnMc0mQq1Y1XRBGM0jQFbwLfFl8=; b=hV4zgenuO7Q8xb/bjgf7WcBbCbew3hQi1bC1eT5HI9tpLBOnpgrtyzaObs8orwguOj ln37QXrAnrAulxE88Fv4NXB9Exe2PuNKAihvpNAGb3gfr+bayp+na/FJZN8JMcrz0eFh Oyuh2ECAvyhM5T9nMG0vdX+OwR58ITIXzJ8ynTdEFjL4+6jy9YCfrU46wPpjp9P22I/O YCrUHncUvh8LN4xqRZ8r/Y9PtLogmwpqdKVk9uQ1SvLwFnKxsj9lB6M3R+NPHnrJX7QH KlVDZpWHoEORt/EDH7eri9y3B9EzoPCKM9wlSU5cyP9kQi+zdUaEE99MFPCAciaW8JYv n9sg== X-Gm-Message-State: AFq9FYIkS3llsxQWYWZbuy8CMkgv+nl4DGxcWpm4iJcNV4vj/C21Skxc +6g09VHw+bN8R7gf4ADq0Y/+Uigg9wMBVTOlU1q5SrW9cHXQEt++dYfXYszEtg== X-Gm-Gg: AYBFou1MO7Qb4m3CVLAYOgAq6HocVya0yD1gTUhs1lidMK9It5f5xBgS7FgjMcZrJa4 eHbj2k+TUFU/YqRS5fnfSOLfe4/sge1Exx8nu+ngAx+v+LR7yj4Gi2YrWaFJcGoWVZ3puut+l/U W+E020hkYEpJehWTubk5W+tXZD6VVpsLAl1HF4ly7gksHrv74sthnGeZhL/+NsPMFQKOJ9l9R8A FQ/7FXMYjuhvQjzg5/GBPaEIAOqF/hPzF0rfIje2QT8sV58EGVAJrr++W4keDcxTn/Yi3X17Pp9 snDwjUk8YDHXlsjrRO/M1WIOP79kPVgKDGzHST31hal/MDE8y+V1hotkGZLUrtcaV4/AJSqFtQA 7UFgnwlQfvY3uJTpcsBECRD7ZlxN8Jd8D//jnccnEAIIMUYP3hwZY9LqvG/SJpoTUM1YZzc1MQW urSwN1K69pSjsb+AQtDQhXtb0qe2ZU6ag+1yt/qqubsgfhshIGiljd7imVVlq1wtwTReduX48SK Er+0umbk4p46yUiTq/3Hbg= X-Received: by 2002:a17:902:dac3:b0:2dd:c100:7cb6 with SMTP id d9443c01a7336-2e842abe6e9mr141974875ad.50.1792043010915; Wed, 14 Oct 2026 22:43:30 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.29 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:30 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 20/82] gerbera: ignore CVE-2025-23386 Date: Thu, 15 Oct 2026 18:41:08 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130940 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2025-23386 This vulnerability is due to openSUSE specific packaging issue. Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 369d9629673fd4282cc88fc9b7435de5d1a0ceeb) Signed-off-by: Ankur Tyagi --- meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb b/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb index 3d28273f30..ca54cf2315 100644 --- a/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb +++ b/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb @@ -29,3 +29,5 @@ PACKAGECONFIG[js] = "-DWITH_JS=TRUE,-DWITH_JS=FALSE,duktape" PACKAGECONFIG[zip] = "-DWITH_ZIP=TRUE,-DWITH_ZIP=FALSE,libzippp libzip" SECURITY_CFLAGS:riscv64 = "${SECURITY_NOPIE_CFLAGS}" + +CVE_STATUS[CVE-2025-23386] = "not-applicable-platform: The vulnerability is openSUSE specific" From patchwork Thu Oct 15 05:41:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100813 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21708CC6B38 for ; Thu, 15 Oct 2026 05:43:37 +0000 (UTC) Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33240.1792043013773646589 for ; Wed, 14 Oct 2026 22:43:33 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=H2oKytvg; spf=pass (domain: gmail.com, ip: 209.85.214.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2e7006bbf77so10873055ad.0 for ; Wed, 14 Oct 2026 22:43:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043013; x=1792647813; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=m/nydFnaJBfC4ToqKC57bH38g8KweER4BCyTyRvk3NE=; b=H2oKytvg92CYEjE5pvlTTwWMSLKnMuiVEDpZ5xNS4VG1iMs9UI0NYWZ2vjhoMba50R 7SpqfnV85ayReLUn1HHnfLWaU3dta77MFR6PWfer98f9DLfixQesB2BqHgCgs+JVjVmp il3U6XXoZJ9qB6dq95f/Mv+ei0wyEZ82vQYDzWFFu0NASjAU5COk1L+oCCPWClo7KlB3 zvSdPVqJVh7mG0qzQcENman5wQvtEZGGTiDZOfPz8ZEnM38ueKSMGCuWNaXWX5jqiC6d +wd++ktScin0kij0bbB96NV4hc9FTZY/3SxVjhnlmg9CZ+JNzqe024UMFkdsj3KOc29H W1rQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043013; x=1792647813; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=m/nydFnaJBfC4ToqKC57bH38g8KweER4BCyTyRvk3NE=; b=Gyk1Ip/eNYXA4QXRNOAxS55PEAcJm908aFJTsCJ6XRmMp6B7G4XtaXJqt5erY6RDjq Hp9PXiz8gXyXWbC4nM5idDLhh2NcKV3zlmoUhzHE3oNHgJ+dzzrs9mmOnS/IbIdwyuTp XSJBVvYrxSGfk/dqwoDfq2Galg4gG8pjuSIE+G+VUJzgLFK44izFUXCCdbEvTdyaJdzw Xo4jzUQO4lH5Gkuq2gg+3kDqFk1VFugkPxABsMpjDLNmoUj21KkAfsDcxXHS1CQ03gQq k3BpcB6kBLCStG+PReVO+jbK+9DZHY1V19cuJegbC+XWoqCSJXE6w+/LQZSw+9taQDqD aLGQ== X-Gm-Message-State: AFq9FYLDYMTscjPu9ak0SHfyCf72p8rnZRJ1ApMQqbrO/QYnfdp2T3iN sJRH1Z7woY5IWY13OwUZwYS1XGEOzTC16WW1J++Xj/qcea1LVNllRX5xZ00E1w== X-Gm-Gg: AYBFou1uc2FywTENQeJ8RcJlcE7Fci2BuqDdnuaRU06eEyqWHBei1V5OvwGVIv6097h ce6SEuoOR+R62QJu84deklroji7gu7BxF8nAp0NfGCH5rk1zrOzcEIjLOk/EhlFEiSsNt0uJP8z xhn78G9TGvtuy0YloYbQa1nFBJjj0ryvCCH2J3WGRah7LUg6b5PjotPRF5NeR/lztuga3VpgQhA 9yAZ+Ek7fQV+J0xPl0ee2WruG9ZxIM6RMknqeaOYJuIC6YqIUYktr0P6A9MA5ic604OgX1OYcMI PU7ib6Omk6fa6AM0M2DL6fZpA65rf2K5XFzB1LFFvtoQVcE09s0vjSc4OxeK6V5fjLfgltCnQQ5 RN98ibl2/4zABJLaeKI8KZvUNUfbnxiGrC1ZSt0jgP7dTmMk2RdgsFUg8BoTTrgxjelR3r5/1sM ej2c0+yWNrhcpKQ6ElGi3H3smbpIZ2/4IS3rGT7k5DE5Fukm28XAdNeryEv33qMHKqmDRgu+SFC BYQ1m+UG0fEFm5vzzwV8l0= X-Received: by 2002:a17:903:1967:b0:2e5:dbbb:6c7f with SMTP id d9443c01a7336-2e8427efabemr156351745ad.1.1792043012966; Wed, 14 Oct 2026 22:43:32 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.31 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:32 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 21/82] libde265: patch CVE-2026-49295 Date: Thu, 15 Oct 2026 18:41:09 +1300 Message-ID: <70486f9176375ea28967d4823efb19bd2ac50e0f.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130941 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49295 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit bd09bb41b41ee12aeb181bf04e5f5961b00123ef) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49295.patch | 41 +++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 4 +- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch new file mode 100644 index 0000000000..189d330b9a --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch @@ -0,0 +1,41 @@ +From 7d5e48dbf9324691ba3ce4cd8ffa089d735b0b70 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Mon, 25 May 2026 20:14:07 +0200 +Subject: [PATCH] bound aggregate short-term RPS size (GHSA-g2rg-wj66-w594) + +(cherry picked from commit 691f3a3c55b3d32478c4a49895dee061a282652b) + +CVE: CVE-2026-49295 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652] +Signed-off-by: Ankur Tyagi +--- + libde265/refpic.cc | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/libde265/refpic.cc b/libde265/refpic.cc +index ea4db4b0..dcd2b214 100644 +--- a/libde265/refpic.cc ++++ b/libde265/refpic.cc +@@ -322,6 +322,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue, + + out_set->compute_derived_values(); + ++ // The unused short-term references are all collected into a single PocStFoll array ++ // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set). ++ // While each individual list is bounded above, the predicted-RPS construction can ++ // append the current-picture delta to an already-full source set, pushing the ++ // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds ++ // write when filling PocStFoll. ++ if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) { ++ out_set->NumNegativePics = 0; ++ out_set->NumPositivePics = 0; ++ out_set->NumDeltaPocs = 0; ++ out_set->NumPocTotalCurr_shortterm_only = 0; ++ ++ errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false); ++ return false; ++ } ++ + return true; + } + diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index ca05e9099e..6bed3250fa 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -8,7 +8,9 @@ LICENSE = "LGPL-3.0-only AND MIT" LICENSE_FLAGS = "commercial" LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" -SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV}" +SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ + file://CVE-2026-49295.patch \ +" SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Thu Oct 15 05:41:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100815 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 500B7CC6B3B for ; Thu, 15 Oct 2026 05:43:37 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32807.1792043015772460704 for ; Wed, 14 Oct 2026 22:43:35 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=CnvaAz3q; spf=pass (domain: gmail.com, ip: 209.85.214.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2e60f9af6e6so13993165ad.3 for ; Wed, 14 Oct 2026 22:43:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043015; x=1792647815; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=XT00PAJLu0knCLcwz9J4YOEylZjMmPpUrDVjoU6iBkU=; b=CnvaAz3qaJ6v6ZvMa88gGN7AyvM7xDLIRckWpIO/eTVd1GYciqkPqxw7ZbhvBRdrH8 KRp1JePE03L18iDPugbRz+ezkUUmguT2A1yazk/dAgZgfb2P7PcpdPTjIDSYxnMFmX7T cXKsr9Sx7mAsjnJmARCi3SRS+NgXu0fRlMUbYQtksADIMnRbj82F6GjpcgHS0QgoFci4 B/7p5mpgdY5bNqbXqojvX4FCcm87r3/s+DyIcCxZdT0LmTrZpOIIQdBOqoY9M7uo/eWD HRdFpXPdK3Whsj7ILdcbY7GxKTNt5LVyizJAxepKSpNOBUnDhwb3YMYCwHmUS5TToi7R GLpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043015; x=1792647815; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=XT00PAJLu0knCLcwz9J4YOEylZjMmPpUrDVjoU6iBkU=; b=E97aUlOXwusDj8yx1Z9gMel7WQaTX3YsZ4CcrjKrcns6vxLzTgG88jgaYqDoxB+19T +AZgN3k9D7Jnf7gNXhJV/BNTvcmqScl3biCbh7eLtOX9LryVnHkCa/FwgFZr0Oyo+qpe N7CVS3ZHRrYD8bgqIZY2Plw+mI8oIPmFAnPKHD8Sjbj/xzaG1qYLkT1/iFasTTwcx5U1 /Hnf0s0/2F6i6JKG2wpE09FS9Q6xfSNNawH0BgjfBB9Yxles83NERYDadPAgWWcbgq3c LSfngbl77/lkZiaVYCukmxqpehy8dhlRyM5LhuVBEKLyez87iGv7lNKF6qjTWY/H+frm 0u7g== X-Gm-Message-State: AFq9FYIwfsVoBGXuhSCi9puEaF/hCEV660KYfseHu3DzOO5csC0nbxjl FHIxKffwQo4hOUllc4kFw2XkdpGIQBiSlxcaiWqrbI/AVI6CRoiIXlnDej7pPw== X-Gm-Gg: AYBFou3tuARtjk/9W0ppQRvSV8/Umer18mYngx6YQvySJt0FipxYXgt+zX258ZZSTjU nv0LTGQOlaRnlPISSIB4Ae/Z2JjkB+deXxB0478pH8ijJ3ZzGEN9RXhC1cVGOa7pg5OMsbHnjWw 8Qf3FUTOzXcxUXYdzUNSmviG6SudaLA2uQ11xi02uwNnIwaEMFdvKqgrlCFyrH4811tvt6AxtaI QSPs3IVRRi6NYMXgGdBusYTe9zLjkfkk5epvXtzwK7ABW52cgX2BxLQmQx/Ahaj3EEFyK8kEg3X dWIwieTiF6qPWog+ZOwRjal5b+eRgIGWxGeD2/1795HH8DCqYLY4uoSSWFiMDK/vedEpHzgAQQa T2VVqIchwOc4bXYBE5V4ONEYsIY0vTmgjqxyVwzhs36p1+6zR5Gr8YoudRjRTMD1FsUmirlcB4F bmCLWp0ZdGpyISDLdGOty+0+BvOEdvllXw5wF7MJETBfJXc9gxpvr+lYQb6NapmjQ2hQcy8xXnM wYXfcvhoQrD2FWyTSdQMww= X-Received: by 2002:a17:902:f70f:b0:2e9:660a:7944 with SMTP id d9443c01a7336-2e9660a7bc6mr3005205ad.58.1792043015066; Wed, 14 Oct 2026 22:43:35 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.33 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:34 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 22/82] libde265: patch CVE-2026-49337 Date: Thu, 15 Oct 2026 18:41:10 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130942 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49337 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit c83399f83fbbbb855c5a272c9702e8aff4328ce4) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49337.patch | 53 +++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch new file mode 100644 index 0000000000..88e0e32949 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch @@ -0,0 +1,53 @@ +From 2f0c53241cb9bf2f5acded53c25f1b74db536de7 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Mon, 25 May 2026 20:29:40 +0200 +Subject: [PATCH] free orphaned slice header when no active image unit + (GHSA-g5hj-rf9f-7vxm) + +(cherry picked from commit 683cb9fa603e35840642f98765ab95cdb71cadf9) + +CVE: CVE-2026-49337 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9] + +Signed-off-by: Ankur Tyagi +--- + libde265/decctx.cc | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/libde265/decctx.cc b/libde265/decctx.cc +index fbb3baa1..5deddc37 100644 +--- a/libde265/decctx.cc ++++ b/libde265/decctx.cc +@@ -478,10 +478,6 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + shdr->entry_point_offset[i] -= skipped; + } + +- this->img->add_slice_segment_header(shdr); +- +- +- + // --- start a new image if this is the first slice --- + + if (shdr->first_slice_segment_in_pic_flag) { +@@ -495,6 +491,13 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + + if ( ! image_units.empty() ) { + ++ // Hand the slice header to the picture (which takes ownership and frees it ++ // on release). Only do this when there is an active image unit to decode ++ // the slice; otherwise the header would be retained on img->slices forever, ++ // which a crafted stream of non-first slice NALs can exploit to grow memory ++ // without bound. ++ this->img->add_slice_segment_header(shdr); ++ + slice_unit* sliceunit = new slice_unit(this); + sliceunit->nal = nal; + sliceunit->shdr = shdr; +@@ -507,6 +510,7 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + } + else { + nal_parser.free_NAL_unit(nal); ++ delete shdr; + } + + bool did_work; diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index 6bed3250fa..5fcf641113 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ file://CVE-2026-49295.patch \ + file://CVE-2026-49337.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Thu Oct 15 05:41:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100818 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46602CC6B39 for ; Thu, 15 Oct 2026 05:43:47 +0000 (UTC) Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33241.1792043017893712582 for ; Wed, 14 Oct 2026 22:43:37 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=sJ9m6B+5; spf=pass (domain: gmail.com, ip: 209.85.214.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2e8da6ef7ddso11432735ad.3 for ; Wed, 14 Oct 2026 22:43:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043017; x=1792647817; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=XTpruYOA5HD02LmQuLsYexraXtzG4jhrzvWFHai0fig=; b=sJ9m6B+5rGB8bJ3umFA5rZurxRf5eCW1brwCf4XS6CxXobIK7RjabMiNEXuA3uJJl8 jOQU9Ta3z4sGXhHJ1iu9YdBUnomCRoW4W9IAu97gkDNC2Aq5UykRvoQlUH8YK3rsxVYQ LCQMlUDag061NyF+oD/Rd7rwNWIRNNqn9NPP+YuK6nA7b8G1QCj5u6gRaSHGx42exjFg D1n9qRyAJQwU4M/0qyEjVovCCRHsPyeQItarEQ6xn3aNxXME9Ymc7KNj7EfY9uKlBm7i Tt0ing4T8xmIxeFaNlPZdI1ab2RCF/QeA46rRPC5nYLzHrGlDhD2YrquqGcR/t/unK/T 1YUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043017; x=1792647817; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=XTpruYOA5HD02LmQuLsYexraXtzG4jhrzvWFHai0fig=; b=rhwM0+DOOlzB1p2LxHMiTbQNIxTlh1TnEGdr4P1JJFppKM0Npes/fgiIAbbfyR+HYl Vw20mUgFVn+rON8R/dr6zEoW+xGw0/BneIrzTUyvSAMWUeHTAeRYT76CU2tIwnZRRTv1 639XXCgkAbJ6zcLL1WqHx0ZkCa4CnlqkEXBiFaS05XeIDwPOwgxHBfPa7eLwhT9DlZ2i Pok0VzeiILofkYMirOzj9B31kv3S+kvkk0Hk6zw6ryQql6nNqiDwbD2/YrHuIc6fKDBn TRssC7p8WR5UlyecAjZ2OJQIJiRTiI8DuTmY2M553Iq2PqDUiM2rwnnDN6BSFVGkjSsU vFvQ== X-Gm-Message-State: AFq9FYJ9ENIvzN3u1bqxtb/hEkBlujI/JQxdtmsJ9nF5gj1s7uMrdUMY 84cN2Kads9e2EJFACff7coH12OHVcJNs/baJk5p3qDWdTm5XB4NLFJto062dnw== X-Gm-Gg: AYBFou02ML3jizAvsJ37qN54gWBKqtKrTgqREc9SpUy96A+b/qg9wMWWx/9EMS3lviz vgpqrMkA/JfZlRiF+Ds0d1A5T7GDoY9KjiDQ2kWeS5YLVRC430m6YzvxrYaOLSopvg5g0PKHreZ 3Khmfxo3cZ4ueXvmvsHlfES+nF+HZIQGDpyygy+LS5LC5veyod2tqy8tDSXu0X2mo/4Cr3lnaI7 ar169P56N0y1irU4on1hpuFBHKMyAkuQefIt6wpxlIGk+sdiT3MVqr9fyV4/5L/J/GDR5cXYGEW LUY5lESsXVDen2PZR0zY1cdW0aiYqvJse2CkQ2QG1AURp9K3Io4hnUlwdqfzxBFM//p7TICw6MT Hg0P7V4yE5Aa27gS/0Rr87aN8age24i150R7qeJ4KQ2a1c5MVnNOCT/8Gi/CJTZOUv1AuI5zubL G6yifRMqJ+6XiSQ5L5moWa9wMxltwvSQc6CdsPnRCVouA5s+PibSmZdGme3Dhz5LuRmBrmWhuGE Qqd6GK5CYM05xaG4clw++g= X-Received: by 2002:a17:903:19cf:b0:2e5:41dc:9ac7 with SMTP id d9443c01a7336-2e842bc7708mr167789635ad.24.1792043017066; Wed, 14 Oct 2026 22:43:37 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:36 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 23/82] libde265: patch CVE-2026-49346 Date: Thu, 15 Oct 2026 18:41:11 +1300 Message-ID: <3745d07efc93d008978220e27cfdba32a370e040.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:47 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130943 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49346 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 4a63a2afa1c984b82a663ed8951b62f0ae5da093) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49346.patch | 102 ++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 1 + 2 files changed, 103 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch new file mode 100644 index 0000000000..288295b08a --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch @@ -0,0 +1,102 @@ +From 1667c33f2778a04f08ba4f7d6c1c16508350a779 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Tue, 26 May 2026 00:59:08 +0200 +Subject: [PATCH] fix integer overflow in image plane allocation size + (GHSA-vv8h-932h-7r86) + +(cherry picked from commit 8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8) + +CVE: CVE-2026-49346 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8] + +Signed-off-by: Ankur Tyagi +--- + libde265/image.cc | 46 +++++++++++++++++++++++++++------------------- + 1 file changed, 27 insertions(+), 19 deletions(-) + +diff --git a/libde265/image.cc b/libde265/image.cc +index 0b6071ba..94f3c974 100644 +--- a/libde265/image.cc ++++ b/libde265/image.cc +@@ -70,10 +70,11 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, + void* inputdata, int inputstride, void *userdata) + { + int alignment = STANDARD_ALIGNMENT; +- int stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; +- int height = img->get_height(cIdx); ++ uint32_t stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; ++ uint32_t height = img->get_height(cIdx); + +- uint8_t* p = static_cast(ALLOC_ALIGNED_16(stride * height + MEMORY_PADDING)); ++ // size computed in size_t: stride*height can exceed UINT32_MAX for large planes ++ uint8_t* p = static_cast(ALLOC_ALIGNED_16(static_cast(stride) * height + MEMORY_PADDING)); + + if (p==nullptr) { return nullptr; } + +@@ -82,12 +83,14 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, + // copy input data if provided + + if (inputdata != nullptr) { +- if (inputstride == stride) { +- memcpy(p, inputdata, stride*height); ++ if (inputstride == static_cast(stride)) { ++ memcpy(p, inputdata, static_cast(stride) * height); + } + else { +- for (int y=0;y(inputdata) + inputstride*y, inputstride); ++ for (uint32_t y=0;y(y) * stride, ++ static_cast(inputdata) + static_cast(inputstride) * y, ++ inputstride); + } + } + } +@@ -107,30 +110,35 @@ LIBDE265_API void de265_free_image_plane(struct de265_image* img, int cIdx) + static int de265_image_get_buffer(de265_decoder_context* ctx, + de265_image_spec* spec, de265_image* img, void* userdata) + { +- const int rawChromaWidth = spec->width / img->SubWidthC; +- const int rawChromaHeight = spec->height / img->SubHeightC; ++ const uint32_t rawChromaWidth = spec->width / img->SubWidthC; ++ const uint32_t rawChromaHeight = spec->height / img->SubHeightC; + +- int luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; +- int chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; ++ uint32_t luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; ++ uint32_t chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; + + assert(img->BitDepth_Y >= 8 && img->BitDepth_Y <= 16); + assert(img->BitDepth_C >= 8 && img->BitDepth_C <= 16); + +- int luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); +- int chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); ++ uint32_t luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); ++ uint32_t chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); + +- int luma_height = spec->height; +- int chroma_height = rawChromaHeight; ++ uint32_t luma_height = spec->height; ++ uint32_t chroma_height = rawChromaHeight; + + bool alloc_failed = false; + +- uint8_t* p[3] = { 0,0,0 }; +- p[0] = static_cast(ALLOC_ALIGNED_16(luma_height * luma_bpl + MEMORY_PADDING)); ++ // Compute the plane sizes in size_t. Each operand fits in uint32_t, but the ++ // height * bytes-per-line product can exceed UINT32_MAX for large frames, so ++ // the multiplication must be done in 64 bits. Computing it in 32 bits wraps ++ // the allocation size to a small value while fill_image() later writes the ++ // real (size_t) size -> heap buffer overflow (GHSA-vv8h-932h-7r86). ++ uint8_t* p[3] = { nullptr,nullptr,nullptr }; ++ p[0] = static_cast(ALLOC_ALIGNED_16(static_cast(luma_height) * luma_bpl + MEMORY_PADDING)); + if (p[0]==nullptr) { alloc_failed=true; } + + if (img->get_chroma_format() != de265_chroma_mono) { +- p[1] = static_cast(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING)); +- p[2] = static_cast(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING)); ++ p[1] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); ++ p[2] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); + + if (p[1]==nullptr || p[2]==nullptr) { alloc_failed=true; } + } diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index 5fcf641113..a02d6dd5d8 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ file://CVE-2026-49295.patch \ file://CVE-2026-49337.patch \ + file://CVE-2026-49346.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Thu Oct 15 05:41:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100820 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5376ACC6B38 for ; Thu, 15 Oct 2026 05:43:47 +0000 (UTC) Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32808.1792043020243681626 for ; Wed, 14 Oct 2026 22:43:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=BqJ/z5Wn; spf=pass (domain: gmail.com, ip: 209.85.214.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2e901e114fdso19287125ad.2 for ; Wed, 14 Oct 2026 22:43:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043019; x=1792647819; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Z/rCmMoiVvCTpQP9wY3l7MQYYmtery4OejJMbkFOVMo=; b=BqJ/z5WncjxzifmrjnuCTdcOlKkMpkhwnGd4r4ZbEtzliPkowfMjJ/z5TkLTVhkMEw faTl7feN70qXhzbrsI3PLJaDgPGowMwUnXPkhmz9zLSz34AfXErItkG6EA4IHUwPB5Pb bhxoWYQmu/AAkn7pwTPn7LNwW5KpRPW3X1ir/3Msx7UC4po8PVwn1g+NYnYrz200qyqy RKFz7C4cXjKqmw9RwlaulMQyyM2c4ahqY9PkMDGpBq7tgi/m8lC4cRvscQaflyDVGKkx r4BR2y/bY7NJURFFAVj6XlAtsTvEkxRcep5ofVl3w+R+LKNDlBWLw9Bgb0opIOUi1x7o Ncwg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043019; x=1792647819; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Z/rCmMoiVvCTpQP9wY3l7MQYYmtery4OejJMbkFOVMo=; b=QRe+z4y9cGXCrRXwcfXWK2KVWLqlcsxeeUL39XFbN6aoF8P0gimzciBKyjfgF4SeAL ZCNRH6W9l6ap9d1OsjbAlzxB6tiM95DlFrYm0C/qyQhCHaivxX22rIg6P0biPPYmiCaA HqgNgBN+WylA+v05CZsb8whxdX4PsTaJZ8GfhDBTMJMTj9yXOIMI7B2fLLReJMP+bvrN I8diPWDhGb6FXd9my5uOajfLzggX8V4c7Qvnj9U4wP7AvnlR+6Svbopp9ivtBjQz+FYo N/QJ0S7r0jnW+bJs5pI/2sYJJk1v8guZAERk4Eah2BBHBiqlHFEt7bLTd9WVkJSJXk1d npww== X-Gm-Message-State: AFq9FYIbCayc1Rdf3g+DybDg+hukuzo/HNC7RNcPrXWyp+jB9MIie/ur e90SnEyiNrvwIkO9PtWOZBrRoPrTUtBpZ28f4cdaMBSyjv+tVnBuEslTuJsG1g== X-Gm-Gg: AYBFou1dvqz8nrIsAM+kcBQ5aQldhx+7GnNWiFVUAdUhXQFwNlzWV9DcNlqGtCjaesB f8JFQNln8BWRlLnPozTdMGvyNOXFXBN6oHrYpc5N3cCwZavGNPklcgaGD2/96D59jfBu3bXIrBT wM1MNT28AyI0HsoCnAtjf5znxCWDSI81I5NuhILr1eVPebX/UC5OZmvabgNgwZnKrpFy7WlpAB6 hVoEJmMArrn9EA7N0JGSRlhHqDK7nu8ai2bLw2YGRbp3BoSDfaie+1dlOb7MmgSbPfnKww28Uw5 CrqhcfGJNpMfoQVqGsxqD1iJEUsLeXEN2Wzq53dobq+nwMCYPGk+gYn6FzJdY4bDvaSef278xgn ZasuOKBAc2+z1BgRUy96kmcm+2JOPZ8rTsNxnutP9D/OvWx6S+QDRpCe5allde5CyT6ybMsAH+Z xphMRIJ7RBp+uxWLPnii5MHrPW4jPGOzc/qkdFbZlx3JG/6kHgj+Jj1CN9CqlhhSmSRaVZ+Gzz3 Sl0/qAU+ecnPWbrPZNv9HQ= X-Received: by 2002:a17:903:2a8b:b0:2e8:3d48:4d82 with SMTP id d9443c01a7336-2e842dfd143mr151350805ad.60.1792043019281; Wed, 14 Oct 2026 22:43:39 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:38 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 24/82] libde265: patch CVE-2026-54240 and CVE-2026-54241 Date: Thu, 15 Oct 2026 18:41:12 +1300 Message-ID: <041660ffc598e732cf766175070048fe1fef5620.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:47 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130944 From: Ankur Tyagi Debian identified same commit as fix for both CVEs[1][2]. Details: https://nvd.nist.gov/vuln/detail/cve-2026-54240 https://nvd.nist.gov/vuln/detail/cve-2026-54241 [1]https://security-tracker.debian.org/tracker/CVE-2026-54240 [2]https://security-tracker.debian.org/tracker/CVE-2026-54241 Signed-off-by: Ankur Tyagi --- .../CVE-2026-54240-CVE-2026-54241.patch | 426 ++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 1 + 2 files changed, 427 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch new file mode 100644 index 0000000000..6f5c526f17 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch @@ -0,0 +1,426 @@ +From 3986aba8dec43bc539e5f7c349826cea902f9ee3 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Wed, 3 Jun 2026 16:44:32 +0200 +Subject: [PATCH] fix pixel-accessor integer overflow on large frames + (GHSA-ccfw-29x7-rrx3) + +The de265_image::get_image_plane_at_pos*() accessors computed the pixel +offset `xpos + ypos*stride` in signed 32-bit int. For frames where +width*height exceeds INT32_MAX (e.g. 46344x46344, both within the existing +<=65535 limit), ypos*stride wraps negative and the returned pointer lands +~2 GB before the buffer -> heap out-of-bounds read/write. This is independent +of the earlier allocation fix (GHSA-vv8h-932h-7r86), which only widened the +buffer size, not the offset arithmetic. + +Widen the image stride to ptrdiff_t (members, get_image_stride/get_luma_stride/ +get_chroma_stride, set_image_plane) so all pixel-offset math is evaluated in +64 bits. The public C API (de265_get/set_image_plane) keeps int for ABI; the +narrowing at that boundary is safe (stride <= ~65552). + +The same 32-bit-stride / absolute-coordinate pattern existed in several scalar +paths that the accessors don't cover; widen those too: + - sao.cc: SAO offset indexing, and the inputCopy allocation+memcpy size + (an int size_t under-allocation -> heap write) + - motion.cc: mc_luma/mc_chroma reference-plane access (ref_stride, src_stride) + - intrapred.h: intra reference-border fill + - sei.cc: decoded-picture-hash MD5/CRC/checksum + - image-io.cc: YUV plane read and write +The deblock kernels, SIMD layer (acceleration.h) and per-block code already +use ptrdiff_t or only small block-local offsets and need no change. + +Also store pic_width/height_in_luma_samples as uint16_t (the value is +provably <= MAX_PICTURE_WIDTH = 65535 after validation) so PicSizeInSamplesY +needs only a single uint32_t cast instead of int*int (which was signed-overflow +UB on the same trigger); add static_asserts tying the limits to the storage. + +Verified: girlshy bit-exact single- and multi-threaded; ASan+UBSan PoC against +the get_image_plane_at_pos sink crashes pre-fix (UBSan signed-overflow at the +accessor + ASan wild write) and is clean post-fix. + +(cherry picked from commit bdca87569b9c63c2a7054d90ae4462dbb78d159a) + +CVE: CVE-2026-54240 CVE-2026-54241 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/bdca87569b9c63c2a7054d90ae4462dbb78d159a] + +Signed-off-by: Ankur Tyagi +--- + libde265/de265.cc | 2 +- + libde265/image-io.cc | 4 ++-- + libde265/image.cc | 2 +- + libde265/image.h | 21 +++++++++++---------- + libde265/intrapred.h | 2 +- + libde265/motion.cc | 8 ++++---- + libde265/sao.cc | 18 +++++++++--------- + libde265/sei.cc | 18 ++++++++++-------- + libde265/sps.cc | 4 ++-- + libde265/sps.h | 11 +++++++++-- + 10 files changed, 50 insertions(+), 40 deletions(-) + +diff --git a/libde265/de265.cc b/libde265/de265.cc +index 48e38a01..02b2d5fd 100644 +--- a/libde265/de265.cc ++++ b/libde265/de265.cc +@@ -678,7 +678,7 @@ LIBDE265_API const uint8_t* de265_get_image_plane(const de265_image* img, int ch + + uint8_t* data = img->pixels_confwin[channel]; + +- if (stride) *stride = img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8); ++ if (stride) *stride = static_cast(img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8)); + + return data; + } +diff --git a/libde265/image-io.cc b/libde265/image-io.cc +index f15234b6..14ca95f0 100644 +--- a/libde265/image-io.cc ++++ b/libde265/image-io.cc +@@ -76,7 +76,7 @@ de265_image* ImageSource_YUV::read_next_image() + // --- load image --- + + uint8_t* p; +- int stride; ++ ptrdiff_t stride; + + p = img->get_image_plane(0); stride = img->get_image_stride(0); + for (uint32_t y=0;yget_width(); + int height= img->get_height(); +diff --git a/libde265/image.cc b/libde265/image.cc +index 94f3c974..59a19184 100644 +--- a/libde265/image.cc ++++ b/libde265/image.cc +@@ -184,7 +184,7 @@ de265_image_allocation de265_image::default_image_allocation = { + }; + + +-void de265_image::set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata) ++void de265_image::set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata) + { + pixels[cIdx] = mem; + plane_user_data[cIdx] = userdata; +diff --git a/libde265/image.h b/libde265/image.h +index e0f1db24..114f41e4 100644 +--- a/libde265/image.h ++++ b/libde265/image.h +@@ -26,6 +26,7 @@ + #endif + + #include ++#include + #include + #include + #include +@@ -235,11 +236,11 @@ struct de265_image { + /* */ uint8_t* get_image_plane(int cIdx) { return pixels[cIdx]; } + const uint8_t* get_image_plane(int cIdx) const { return pixels[cIdx]; } + +- void set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata); ++ void set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata); + + uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + xpos + ypos*stride; + } + +@@ -248,38 +249,38 @@ struct de265_image { + template + pixel_t* get_image_plane_at_pos_NEW(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return (pixel_t*)(pixels[cIdx] + (xpos + ypos*stride)*sizeof(pixel_t)); + } + + const uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) const + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + xpos + ypos*stride; + } + + void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]); + } + + const void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) const + { +- int stride = get_image_stride(cIdx); ++ ptrdiff_t stride = get_image_stride(cIdx); + return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]); + } + + /* Number of pixels in one row (not number of bytes). + */ +- int get_image_stride(int cIdx) const ++ ptrdiff_t get_image_stride(int cIdx) const + { + if (cIdx==0) return stride; + else return chroma_stride; + } + +- int get_luma_stride() const { return stride; } +- int get_chroma_stride() const { return chroma_stride; } ++ ptrdiff_t get_luma_stride() const { return stride; } ++ ptrdiff_t get_chroma_stride() const { return chroma_stride; } + + int get_width (int cIdx=0) const { return cIdx==0 ? width : chroma_width; } + int get_height(int cIdx=0) const { return cIdx==0 ? height : chroma_height; } +@@ -333,7 +334,7 @@ private: + int width = 0, height = 0; // size in luma pixels + + int chroma_width = 0, chroma_height = 0; +- int stride = 0, chroma_stride = 0; ++ ptrdiff_t stride = 0, chroma_stride = 0; + + public: + uint8_t BitDepth_Y = 0, BitDepth_C = 0; +diff --git a/libde265/intrapred.h b/libde265/intrapred.h +index 9b17f75b..a256cb3a 100644 +--- a/libde265/intrapred.h ++++ b/libde265/intrapred.h +@@ -533,7 +533,7 @@ void intra_border_computer::fill_from_image() + assert(nT<=32); + + pixel_t* image; +- int stride; ++ ptrdiff_t stride; + image = (pixel_t*)img->get_image_plane(cIdx); + stride = img->get_image_stride(cIdx); + +diff --git a/libde265/motion.cc b/libde265/motion.cc +index c62c24c3..14e920e1 100644 +--- a/libde265/motion.cc ++++ b/libde265/motion.cc +@@ -50,7 +50,7 @@ void mc_luma(const base_context* ctx, + const seq_parameter_set* sps, int mv_x, int mv_y, + int xP,int yP, + int16_t* out, int out_stride, +- const pixel_t* ref, int ref_stride, ++ const pixel_t* ref, ptrdiff_t ref_stride, + int nPbW, int nPbH, int bitDepth_L) + { + int xFracL = mv_x & 3; +@@ -129,7 +129,7 @@ void mc_luma(const base_context* ctx, + pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+7)]; + + const pixel_t* src_ptr; +- int src_stride; ++ ptrdiff_t src_stride; + + if (-extra_left + xIntOffsL >= 0 && + -extra_top + yIntOffsL >= 0 && +@@ -181,7 +181,7 @@ void mc_chroma(const base_context* ctx, + int mv_x, int mv_y, + int xP,int yP, + int16_t* out, int out_stride, +- const pixel_t* ref, int ref_stride, ++ const pixel_t* ref, ptrdiff_t ref_stride, + int nPbWC, int nPbHC, int bit_depth_C) + { + // chroma sample interpolation process (8.5.3.2.2.2) +@@ -227,7 +227,7 @@ void mc_chroma(const base_context* ctx, + pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+3)]; + + const pixel_t* src_ptr; +- int src_stride; ++ ptrdiff_t src_stride; + + int extra_top = 1; + int extra_left = 1; +diff --git a/libde265/sao.cc b/libde265/sao.cc +index a0db84b2..579dcef2 100644 +--- a/libde265/sao.cc ++++ b/libde265/sao.cc +@@ -28,8 +28,8 @@ + template + void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + const slice_segment_header* shdr, int cIdx, int nSW,int nSH, +- const pixel_t* in_img, int in_stride, +- /* */ pixel_t* out_img, int out_stride) ++ const pixel_t* in_img, ptrdiff_t in_stride, ++ /* */ pixel_t* out_img, ptrdiff_t out_stride) + { + const sao_info* saoinfo = img->get_sao_info(xCtb,yCtb); + +@@ -77,7 +77,7 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + + if (SaoTypeIdx==2) { + int hPos[2], vPos[2]; +- int vPosStride[2]; // vPos[] multiplied by image stride ++ ptrdiff_t vPosStride[2]; // vPos[] multiplied by image stride + int SaoEoClass = (saoinfo->SaoEoClass >> (2*cIdx)) & 0x3; + + switch (SaoEoClass) { +@@ -266,8 +266,8 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb, + template + void apply_sao(de265_image* img, int xCtb,int yCtb, + const slice_segment_header* shdr, int cIdx, int nSW,int nSH, +- const pixel_t* in_img, int in_stride, +- /* */ pixel_t* out_img, int out_stride) ++ const pixel_t* in_img, ptrdiff_t in_stride, ++ /* */ pixel_t* out_img, ptrdiff_t out_stride) + { + if (img->high_bit_depth(cIdx)) { + apply_sao_internal(img,xCtb,yCtb, shdr,cIdx,nSW,nSH, +@@ -332,8 +332,8 @@ void apply_sample_adaptive_offset_sequential(de265_image* img) + return; + } + +- int lumaImageSize = img->get_image_stride(0) * img->get_height(0) * img->get_bytes_per_pixel(0); +- int chromaImageSize = img->get_image_stride(1) * img->get_height(1) * img->get_bytes_per_pixel(1); ++ size_t lumaImageSize = static_cast(img->get_image_stride(0)) * img->get_height(0) * img->get_bytes_per_pixel(0); ++ size_t chromaImageSize = static_cast(img->get_image_stride(1)) * img->get_height(1) * img->get_bytes_per_pixel(1); + + uint8_t* inputCopy = new uint8_t[ libde265_max(lumaImageSize, chromaImageSize) ]; + if (inputCopy == nullptr) { +@@ -347,10 +347,10 @@ void apply_sample_adaptive_offset_sequential(de265_image* img) + + for (int cIdx=0;cIdxget_image_stride(cIdx); ++ ptrdiff_t stride = img->get_image_stride(cIdx); + int height = img->get_height(cIdx); + +- memcpy(inputCopy, img->get_image_plane(cIdx), stride * height * img->get_bytes_per_pixel(cIdx)); ++ memcpy(inputCopy, img->get_image_plane(cIdx), static_cast(stride) * height * img->get_bytes_per_pixel(cIdx)); + + for (int yCtb=0; yCtb(data); +- int stride16 = stride / 2; ++ ptrdiff_t stride16 = stride / 2; + for (int y=0; y> 8 ) ^ ( y >> 8 ); +@@ -224,7 +225,7 @@ static inline uint16_t crc_process_byte_parallel(uint16_t crc, uint8_t byte) + (t << 12)) & 0xFFFF; + } + +-static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride, int bit_depth) ++static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,ptrdiff_t stride, int bit_depth) + { + raw_hash_data raw_data(w,stride); + +@@ -250,7 +251,7 @@ static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride + } + + +-static void compute_MD5(uint8_t* data,int w,int h,int stride, uint8_t* result, int bit_depth) ++static void compute_MD5(uint8_t* data,int w,int h,ptrdiff_t stride, uint8_t* result, int bit_depth) + { + MD5_CTX md5; + MD5_Init(&md5); +@@ -289,7 +290,8 @@ static de265_error process_sei_decoded_picture_hash(const sei_message* sei, de26 + int nHashes = img->get_sps().chroma_format_idc==0 ? 1 : 3; + for (int i=0;iget_width(i); + h = img->get_height(i); +diff --git a/libde265/sps.cc b/libde265/sps.cc +index aa871a09..a29a3c0a 100644 +--- a/libde265/sps.cc ++++ b/libde265/sps.cc +@@ -570,7 +570,7 @@ de265_error seq_parameter_set::compute_derived_values(bool sanitize_values) + PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY); + PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY; + PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY; +- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples; ++ PicSizeInSamplesY = static_cast(pic_width_in_luma_samples) * pic_height_in_luma_samples; + + if (chroma_format_idc==0 || separate_colour_plane_flag) { + CtbWidthC = 0; +@@ -1325,7 +1325,7 @@ de265_error seq_parameter_set::write(error_queue* errqueue, CABAC_encoder& out) + PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY); + PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY; + PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY; +- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples; ++ PicSizeInSamplesY = static_cast(pic_width_in_luma_samples) * pic_height_in_luma_samples; + if (chroma_format_idc==0 || separate_colour_plane_flag) { + CtbWidthC = 0; + CtbHeightC = 0; +diff --git a/libde265/sps.h b/libde265/sps.h +index c8be9788..5cb0b46c 100644 +--- a/libde265/sps.h ++++ b/libde265/sps.h +@@ -39,6 +39,13 @@ constexpr int MAX_NUM_LT_REF_PICS_SPS = 32; + constexpr int MAX_PICTURE_WIDTH = 65535; + constexpr int MAX_PICTURE_HEIGHT = 65535; + ++// pic_width/height_in_luma_samples are stored as uint16_t and PicSizeInSamplesY as uint32_t, ++// so these limits must keep width/height in 16 bits and their product in 32 bits. ++static_assert(MAX_PICTURE_WIDTH <= 0xFFFF, "picture width must fit in uint16_t"); ++static_assert(MAX_PICTURE_HEIGHT <= 0xFFFF, "picture height must fit in uint16_t"); ++static_assert((uint64_t)MAX_PICTURE_WIDTH * MAX_PICTURE_HEIGHT <= 0xFFFFFFFFu, ++ "total luma sample count must fit in uint32_t"); ++ + enum { + CHROMA_MONO = 0, + CHROMA_420 = 1, +@@ -111,8 +118,8 @@ public: + uint8_t chroma_format_idc; // [0;3] + + bool separate_colour_plane_flag; +- int pic_width_in_luma_samples; +- int pic_height_in_luma_samples; ++ uint16_t pic_width_in_luma_samples; // <= MAX_PICTURE_WIDTH (validated on parse) ++ uint16_t pic_height_in_luma_samples; // <= MAX_PICTURE_HEIGHT (validated on parse) + bool conformance_window_flag; + + int conf_win_left_offset; diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index a02d6dd5d8..8e145cf8dd 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https file://CVE-2026-49295.patch \ file://CVE-2026-49337.patch \ file://CVE-2026-49346.patch \ + file://CVE-2026-54240-CVE-2026-54241.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Thu Oct 15 05:41:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100819 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68FB7CC6B3A for ; Thu, 15 Oct 2026 05:43:47 +0000 (UTC) Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32809.1792043022291669558 for ; Wed, 14 Oct 2026 22:43:42 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Ez7agA7a; spf=pass (domain: gmail.com, ip: 209.85.214.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2e7006bbf77so10873595ad.0 for ; Wed, 14 Oct 2026 22:43:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043022; x=1792647822; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=JTXbjubNHFktRe58t76+fu7S2CjGt8orQ3meQi8dtqY=; b=Ez7agA7ag6RTRexc2mDxhW3WDFM1E5a460byc/Jus9aen9h/ZDcEtO/L8lYaZ7N+fX 38yXdtZWLJ2xHmBus3oItRnQRbohXsQ3Igm9pDVl5tgO3tLdbLqTDkA+wRvJmkGCWzqY dwqs71sn/A//lubXZwzBfxDpt8twBmrNBg19N0QV1Aq4adG463k4rSMGr+ZXE3IUIo3c 5yreN483zAhMRFUZ2dj/GEQElfzc+mJcSLwFv8vydboH1Jr1ZuSthnE3iv3+OcKHtzPl h1YelwadEXWtjHB7qp9cJbhPL/p1ZOdAyUqyu5lNuFyd0IYgJiSE4rtyaaFBtTCjbBR+ bMlg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043022; x=1792647822; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=JTXbjubNHFktRe58t76+fu7S2CjGt8orQ3meQi8dtqY=; b=s81NxAf1TUKq0NHAZ9vn8HE+7ZVIx59ZRZq2kQHWvO/LP5W0qP7x8tWvlRVH5KVK3w ik0Jv7GAhOPEvqgGqXInWtl/A3Jxr1H9tQEV7GfJ7/krhBLSXKT8yw3t7KA8dzT6anLV Sq6784IntKyZGEtXyLgjQwAwgdnTzbujXyz1v2wv6zJ9PKzbqd0JsVnTCjKzEFDgmwSt iSjX1GnaNTTkXWxEFcVt4knQThu2t7prrkeQSOL4eHtyAw2ms/0ZFtYqJTM+aKrx2wqi pG+RF93z5g5PSjRCOCr55vTWjOqVu6lv88mQnom1NmRGzBOw3EmZlLIYp+HNq5e6AbSQ N5AQ== X-Gm-Message-State: AFq9FYK5iqB6S6vVtxUSK4zzrdmjdkPUiCP+FFrCLGUWPTHpWZnVuU6E v7YMsbyCPZvufr61a1u0/jq58SRCwuep5mUS5XdNzrqtPS/rYx71JCHmTtsdLw== X-Gm-Gg: AYBFou0H+YOAe0RIjKyK1e80VJI9uZ/irjyURwdk6dlzd6/S52SnCMog8UqZMMw6b/e pHG8IGCZGjEabpp9Te7p3tORKb65/sCETMLkfrlX/yMselD0pshlVmUYHo2+uuTrqpFMeBOOf5i SNxHpYC1DxVU/sMW3cpniJ5RyGF/CG4hHxp7JMWyiHX6rOrqJ8qnonb7629xHU8WRzZKE8I4xcH zGQmivf5clC5t2YZ5naFPXwx4oCm7UTDiolyVz9cchDZ+M4CqM4eCVpfx6tKSVxOlk07R+8R0XR M1nReQH7DGgCRUgU3bRqHQksHKVBcUZYr1o/2n7OiaPaNFi3stEFAG6K9H2NKUSCTIfS7iEgxy2 nIcqU30oH8Dy4fudUEImQsejQahCB7aIEOrdK5L0tMh++dSucXum20DcCAr4y3rDJtYGQGrU2v+ 2FMpJ/btVYBq27osU7p797cPHRTxye86YvnXZgPza7sbZ4H5NTeMF5a9gTeFEmfPfbR0RaRd0x+ t8erv568O2vloJslqj5Y6I= X-Received: by 2002:a17:902:f691:b0:2e6:679:9e4 with SMTP id d9443c01a7336-2e842f119e3mr151694655ad.60.1792043021400; Wed, 14 Oct 2026 22:43:41 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:41 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 25/82] hdf5: patch CVE-2026-17572 Date: Thu, 15 Oct 2026 18:41:13 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:47 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130945 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. Debian[4] has also identified the commit. [1] https://github.com/HDFGroup/hdf5/pull/6499 [2] https://github.com/HDFGroup/hdf5/issues/6501 [3] https://nvd.nist.gov/vuln/detail/cve-2026-17572 [4] https://security-tracker.debian.org/tracker/CVE-2026-17572 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit c279e9e68822db77648667093bcbf3013269c791) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17572.patch | 253 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 254 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch new file mode 100644 index 0000000000..373a6c374e --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch @@ -0,0 +1,253 @@ +From 606bb0a0282d0b056a3bdda1d489a608deee78d2 Mon Sep 17 00:00:00 2001 +From: Nayyar +Date: Tue, 14 Jul 2026 23:39:56 +0530 +Subject: [PATCH] reject SOHM list message count exceeding list_max (#6499) + +* bound SOHM list decode to list_max messages + +* Add tsohm test for out-of-range SOHM list message count + +Create a file with a shared-message list index, corrupt the on-disk +message count so it exceeds list_max (repairing the table checksum), +and confirm reopening rejects the file instead of overrunning the +list image buffer and message array. + +--------- + +Co-authored-by: H. Joe Lee +Co-authored-by: Larry Knox + +CVE: CVE-2026-17572 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/20f0b9564bc46154e60f8d35578720a599d41552] + +Dropped changes to the CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5SMcache.c | 14 ++++ + test/tsohm.c | 173 ++++++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 187 insertions(+) + +diff --git a/src/H5SMcache.c b/src/H5SMcache.c +index eb6d612a78..96687ffed9 100644 +--- a/src/H5SMcache.c ++++ b/src/H5SMcache.c +@@ -489,6 +489,12 @@ H5SM__cache_list_verify_chksum(const void *_image, size_t H5_ATTR_UNUSED len, vo + assert(image); + assert(udata); + ++ /* The buffer only holds list_max messages; a corrupted header whose message ++ * count exceeds that would size the checksum region past the end of it. ++ */ ++ if (udata->header->num_messages > udata->header->list_max) ++ HGOTO_ERROR(H5E_SOHM, H5E_BADVALUE, FAIL, "number of SOHM messages exceeds list size"); ++ + /* Exact size with checksum at the end */ + chk_size = H5SM_LIST_SIZE(udata->f, udata->header->num_messages); + +@@ -552,6 +558,14 @@ H5SM__cache_list_deserialize(const void *_image, size_t H5_ATTR_NDEBUG_UNUSED le + HGOTO_ERROR(H5E_SOHM, H5E_CANTLOAD, NULL, "bad SOHM list signature"); + image += H5_SIZEOF_MAGIC; + ++ /* The message array is sized for list_max entries; a list index always ++ * holds at most that many before it is promoted to a B-tree. Reject a ++ * corrupted header whose message count would drive the decode loop past ++ * the allocation and the input buffer. ++ */ ++ if (udata->header->num_messages > udata->header->list_max) ++ HGOTO_ERROR(H5E_SOHM, H5E_CANTLOAD, NULL, "number of SOHM messages exceeds list size"); ++ + /* Read messages into the list array */ + ctx.sizeof_addr = H5F_SIZEOF_ADDR(udata->f); + for (u = 0; u < udata->header->num_messages; u++) { +diff --git a/test/tsohm.c b/test/tsohm.c +index 1652c9b044..61036e7dc3 100644 +--- a/test/tsohm.c ++++ b/test/tsohm.c +@@ -3702,6 +3702,175 @@ test_sohm_external_dtype(void) + free(orig); + } /* test_sohm_external_dtype */ + ++/*------------------------------------------------------------------------- ++ * Function: test_sohm_reject_bad_count ++ * ++ * Purpose: A shared-message list index holds at most list_max messages ++ * on disk before it is promoted to a B-tree, and both the list ++ * image buffer and the in-memory message array are sized for ++ * list_max entries. Corrupt the on-disk message count so it ++ * exceeds list_max and verify the list load rejects the file ++ * instead of sizing a read or indexing the array past its end. ++ * ++ *------------------------------------------------------------------------- ++ */ ++static void ++test_sohm_reject_bad_count(void) ++{ ++ hid_t fcpl_id = H5I_INVALID_HID; ++ hid_t fid = H5I_INVALID_HID; ++ hid_t sid = H5I_INVALID_HID; ++ hid_t did = H5I_INVALID_HID; ++ hsize_t dims[1] = {4}; ++ FILE *fp = NULL; ++ uint8_t *buf = NULL; ++ long fsize = 0; ++ long table_off = -1; ++ unsigned list_max = 100; ++ uint32_t chksum; ++ size_t pos; ++ int i; ++ herr_t ret; ++ ++ /* On-disk shared-message table layout for a file with a single index and ++ * 8-byte addresses: a 4-byte "SMTB" signature, one index record, then a ++ * 4-byte checksum. Within the record the 16-bit message count follows the ++ * (version, index type, message types, minimum size) prefix and the 16-bit ++ * list and B-tree cutoffs. ++ */ ++ const size_t rec_size = 1 + 1 + 2 + 4 + 3 * 2 + 8 + 8; /* 30 */ ++ const size_t table_body = (size_t)H5_SIZEOF_MAGIC + rec_size; /* 34 */ ++ const size_t num_msgs_off = (size_t)H5_SIZEOF_MAGIC + (1 + 1 + 2 + 4 + 2 + 2); /* 16 */ ++ ++ MESSAGE(5, ("Testing rejection of an out-of-range SOHM list message count\n")); ++ ++ /* Create a file whose single shared-message index is a list that can hold ++ * up to list_max messages before converting to a B-tree. ++ */ ++ fcpl_id = H5Pcreate(H5P_FILE_CREATE); ++ CHECK_I(fcpl_id, "H5Pcreate"); ++ ret = H5Pset_shared_mesg_nindexes(fcpl_id, 1); ++ CHECK_I(ret, "H5Pset_shared_mesg_nindexes"); ++ ret = H5Pset_shared_mesg_index(fcpl_id, 0, H5O_SHMESG_SDSPACE_FLAG | H5O_SHMESG_DTYPE_FLAG, 1); ++ CHECK_I(ret, "H5Pset_shared_mesg_index"); ++ ret = H5Pset_shared_mesg_phase_change(fcpl_id, list_max, 0); ++ CHECK_I(ret, "H5Pset_shared_mesg_phase_change"); ++ ++ fid = H5Fcreate(FILENAME, H5F_ACC_TRUNC, fcpl_id, H5P_DEFAULT); ++ CHECK_I(fid, "H5Fcreate"); ++ ++ /* Several datasets sharing one dataspace and datatype leave the index a ++ * list holding a couple of messages, well under list_max. ++ */ ++ sid = H5Screate_simple(1, dims, NULL); ++ CHECK_I(sid, "H5Screate_simple"); ++ for (i = 0; i < 5; i++) { ++ char name[16]; ++ ++ snprintf(name, sizeof(name), "dset%d", i); ++ did = H5Dcreate2(fid, name, H5T_NATIVE_INT, sid, H5P_DEFAULT, H5P_DEFAULT, H5P_DEFAULT); ++ CHECK_I(did, "H5Dcreate2"); ++ ret = H5Dclose(did); ++ CHECK_I(ret, "H5Dclose"); ++ } ++ ret = H5Sclose(sid); ++ CHECK_I(ret, "H5Sclose"); ++ ret = H5Fclose(fid); ++ CHECK_I(ret, "H5Fclose"); ++ ++ /* Read the whole file so the shared-message table can be located and edited. */ ++ fp = fopen(FILENAME, "rb"); ++ CHECK_PTR(fp, "fopen"); ++ if (fp) { ++ if (fseek(fp, 0, SEEK_END) != 0) ++ TestErrPrintf("fseek failed at line %d\n", __LINE__); ++ fsize = ftell(fp); ++ if (fsize <= (long)(table_body + 4)) ++ TestErrPrintf("unexpected file size %ld at line %d\n", fsize, __LINE__); ++ rewind(fp); ++ ++ buf = (uint8_t *)malloc((size_t)fsize); ++ CHECK_PTR(buf, "malloc"); ++ if (buf && fread(buf, 1, (size_t)fsize, fp) != (size_t)fsize) ++ TestErrPrintf("fread failed at line %d\n", __LINE__); ++ if (fclose(fp) != 0) ++ TestErrPrintf("fclose failed at line %d\n", __LINE__); ++ fp = NULL; ++ } ++ ++ /* Find the shared-message table by signature, confirming the match with the ++ * stored checksum so the correct bytes are edited. ++ */ ++ for (pos = 0; buf && (pos + table_body + 4) <= (size_t)fsize; pos++) { ++ if (memcmp(buf + pos, H5SM_TABLE_MAGIC, (size_t)H5_SIZEOF_MAGIC) != 0) ++ continue; ++ ++ chksum = (uint32_t)buf[pos + table_body] | ((uint32_t)buf[pos + table_body + 1] << 8) | ++ ((uint32_t)buf[pos + table_body + 2] << 16) | ((uint32_t)buf[pos + table_body + 3] << 24); ++ if (chksum == H5_checksum_metadata(buf + pos, table_body, 0)) { ++ table_off = (long)pos; ++ break; ++ } ++ } ++ if (table_off < 0) ++ TestErrPrintf("could not locate the shared-message table in %s\n", FILENAME); ++ ++ if (buf && table_off >= 0) { ++ unsigned bad_count = list_max + 200; /* well past the list_max cutoff */ ++ size_t base = (size_t)table_off; ++ ++ /* Overwrite the 16-bit message count and repair the table checksum so ++ * the table loads and the corruption is only caught at the list. ++ */ ++ buf[base + num_msgs_off] = (uint8_t)(bad_count & 0xff); ++ buf[base + num_msgs_off + 1] = (uint8_t)((bad_count >> 8) & 0xff); ++ ++ chksum = H5_checksum_metadata(buf + base, table_body, 0); ++ buf[base + table_body] = (uint8_t)(chksum & 0xff); ++ buf[base + table_body + 1] = (uint8_t)((chksum >> 8) & 0xff); ++ buf[base + table_body + 2] = (uint8_t)((chksum >> 16) & 0xff); ++ buf[base + table_body + 3] = (uint8_t)((chksum >> 24) & 0xff); ++ ++ fp = fopen(FILENAME, "r+b"); ++ CHECK_PTR(fp, "fopen"); ++ if (fp) { ++ if (fwrite(buf, 1, (size_t)fsize, fp) != (size_t)fsize) ++ TestErrPrintf("fwrite failed at line %d\n", __LINE__); ++ if (fclose(fp) != 0) ++ TestErrPrintf("fclose failed at line %d\n", __LINE__); ++ fp = NULL; ++ } ++ ++ /* Reopen and share a new message, which protects the list and drives ++ * the vulnerable decode. The load should reject the file cleanly. ++ */ ++ fid = H5Fopen(FILENAME, H5F_ACC_RDWR, H5P_DEFAULT); ++ CHECK_I(fid, "H5Fopen"); ++ sid = H5Screate_simple(1, dims, NULL); ++ CHECK_I(sid, "H5Screate_simple"); ++ ++ H5E_BEGIN_TRY ++ { ++ did = H5Dcreate2(fid, "trigger", H5T_NATIVE_INT, sid, H5P_DEFAULT, H5P_DEFAULT, H5P_DEFAULT); ++ } ++ H5E_END_TRY ++ ++ if (did >= 0) { ++ TestErrPrintf("dataset creation succeeded on a corrupted SOHM list at line %d\n", __LINE__); ++ H5Dclose(did); ++ } ++ ++ ret = H5Sclose(sid); ++ CHECK_I(ret, "H5Sclose"); ++ ret = H5Fclose(fid); ++ CHECK_I(ret, "H5Fclose"); ++ } ++ ++ free(buf); ++ ret = H5Pclose(fcpl_id); ++ CHECK_I(ret, "H5Pclose"); ++} /* test_sohm_reject_bad_count */ ++ + /**************************************************************** + ** + ** test_sohm(): Main Shared Object Header Message testing routine. +@@ -3755,6 +3924,10 @@ test_sohm(void H5_ATTR_UNUSED *params) + + test_sohm_extend_dset(); /* Test extending shared datasets */ + test_sohm_external_dtype(); /* Test using datatype in another file */ ++ ++ /* Editing the on-disk table in place needs the single-file sec2 layout */ ++ if (default_driver) ++ test_sohm_reject_bad_count(); /* Test rejecting a bad SOHM list message count */ + } /* test_sohm */ + + /*------------------------------------------------------------------------- diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 7860931e7e..c83bb832de 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -18,6 +18,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://0001-cmake-remove-build-flags.patch \ file://CVE-2026-26199.patch \ file://CVE-2026-26197.patch \ + file://CVE-2026-17572.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Oct 15 05:41:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100817 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46587CC6B2F for ; Thu, 15 Oct 2026 05:43:47 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32810.1792043025987669557 for ; Wed, 14 Oct 2026 22:43:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=TQaB199T; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2dd9cbb661bso35496385ad.3 for ; Wed, 14 Oct 2026 22:43:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043025; x=1792647825; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=uRKpzxglzqmlMUrcSvgJ1OX5CsGN9BQLYB5WyoQKvFY=; b=TQaB199TLGGFzLkOycPH87g2KwAiM6ln0myDkHUa35QHJt9G+HvrcQ+LHSWs6PNMmN 0xLsM7B10NCGoNApu6rPT8ALgA646OoIBeNHN/m2vDrtnuv60S4NXdCC77DKD1VLN8yU 6PTkXTlDiv4l1VJoYqBYA+A7KExV4kimNNvQZqOgmjG3BU9mvANKZr/grDwq087HQqd9 rIqAPffW4uq6QqLdNREYqdbAWL8zXzoYJDsQKmoqSkYMs8tXvSPSZdT3iaVRDiXTG46j aC3DZRhU4ecWAPhaJEE7viKEeWC98YYgff6YpbXEaSW9sJSYYiKA7+CnWrJTddOunacc i0Cw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043025; x=1792647825; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=uRKpzxglzqmlMUrcSvgJ1OX5CsGN9BQLYB5WyoQKvFY=; b=X2ZdBpchMSbI7HFTnkd/H5XeVtiawY1ay3DuU4RXlhjJ2VSBCbzAitrv3AmDnHVKS0 sNPmyVmCFE9nx9TpcbhlOIUTMk7eOQRWiY+yFPvdZjPjvUl5rb+cwFhZ1j3yXHDFnK/l lWnHQw35WDNpDNO7Seguz8HeZHfy2EQN6H7VlMiUaTva/mUkObI6ga3ahtFOGemf+KGr i9zsaYPfUe+fyQ/7nYIxhMUFZPCm7ZL0gjPlv2emBcFs92R7ci7tEb5ENzHyzR5BkiCk DTZloxceMOBJ5P8/hg7b3/pGlFTEcz35bJnKDlcnI3io7CwHmtIWD+/CVxWlbcEx0OQB QlAA== X-Gm-Message-State: AFq9FYJCHyjQs+OVcj6UDwEiQeTrdEJun0efdMKn7hZByO2OTZe6k1t7 4TfoDCEQNuNOKCn4OHJH4DfBBigf4OrndnEL/1p+dIhjCF4YG+ZE3N+FVpyEHg== X-Gm-Gg: AYBFou3FVY/kMFztkX7n8RepNDN5Om7IWZ0VzIWPsp8EMqF5oOY5hydx9iZMdxG/+uB mGTiS+A+AB+kJBaFJyBKfGHWfjWIPhvr0SoTZ1tzmwj8CPS4yTUmkQLGcQebxtuJy5/NmEkJaZf 5Qi1APcvCoNhyDsKSrv8gyfQP0No3VQ0DOBQlrdir9crwHRj3zhh0wb/TvQmuztTRvoDM/2sdpE +ievszc85GBErV443rQcpq4LsDCcqHnYNrNV9xMbTLHnWGgHp2tp9cuBoW2+vSdXuEPoEOPUmG1 YUX6We7DQ/cweTxVLVh6SNnwL+r+7dPvAG8mqmEY0yUkPQAmsLa/ik2+LNf97yZhwtiCTa+r3rP N1qTIa3wV0+XYxEdTc3u4Z/6ut/Ot0Eqd4bT+ALRICjX/lFUlZGK/dzh4vUYFtvFR2V7w+hdhuN AcMUWNgeQ+n3/aHU7Pf5598ioGVPlv3JFCZLMEF1wNdUaUAIDcuCzyCOJqx3/IDDG1Sdz0WD4qQ GgkPxdbNyw5AG02x+q/6d5xiSENX6C5Yg== X-Received: by 2002:a17:902:f790:b0:2e9:5507:b540 with SMTP id d9443c01a7336-2e95507b969mr19154625ad.45.1792043025256; Wed, 14 Oct 2026 22:43:45 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.42 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:44 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 26/82] hdf5: patch CVE-2026-17573 Date: Thu, 15 Oct 2026 18:41:14 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:47 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130946 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. Debian[4] has also identified the commit. [1] https://github.com/HDFGroup/hdf5/pull/6160 [2] https://github.com/HDFGroup/hdf5/issues/6124 [3] https://nvd.nist.gov/vuln/detail/cve-2026-17573 [4] https://security-tracker.debian.org/tracker/CVE-2026-17573 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit f46990293cf684add8cc2ee7e71738e97889bcc3) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17573.patch | 53 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch new file mode 100644 index 0000000000..3cfb52de42 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch @@ -0,0 +1,53 @@ +From 856e7f1dd23e466ebeab5e454a5891b12e188f6a Mon Sep 17 00:00:00 2001 +From: jhendersonHDF +Date: Tue, 27 Jan 2026 05:55:38 -0600 +Subject: [PATCH] Fix double-free issue in H5D__chunk_copy (#6160) + +Fix double-free caused by loss of buffer pointer after re-allocation + +Co-authored-by: Larry Knox + +CVE: CVE-2026-17573 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/dd3080a58cc6bb86f3b34284399915da9e513262] + +Dropped changes to the CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Dchunk.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/src/H5Dchunk.c b/src/H5Dchunk.c +index f2a0e85c03..5ff537ebde 100644 +--- a/src/H5Dchunk.c ++++ b/src/H5Dchunk.c +@@ -7034,7 +7034,7 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + const H5S_extent_t *ds_extent_src, H5T_t *dt_src, const H5O_pline_t *pline_src, + H5O_copy_t *cpy_info) + { +- H5D_chunk_it_ud3_t udata; /* User data for iteration callback */ ++ H5D_chunk_it_ud3_t udata = {0}; /* User data for iteration callback */ + H5D_chk_idx_info_t idx_info_dst; /* Dest. chunked index info */ + H5D_chk_idx_info_t idx_info_src; /* Source chunked index info */ + int sndims; /* Rank of dataspace */ +@@ -7202,7 +7202,6 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "memory allocation failed for raw data chunk"); + + /* Initialize the callback structure for the source */ +- memset(&udata, 0, sizeof udata); + udata.common.layout = &layout_src->u.chunk; + udata.common.storage = &layout_src->storage.u.chunk; + udata.file_src = f_src; +@@ -7253,11 +7252,11 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + } /* end for */ + } + ++done: + /* I/O buffers may have been re-allocated */ + buf = udata.buf; + bkg = udata.bkg; + +-done: + if (dt_dst && (H5T_close(dt_dst) < 0)) + HDONE_ERROR(H5E_DATASET, H5E_CANTCLOSEOBJ, FAIL, "can't close temporary datatype"); + if (dt_mem && (H5T_close(dt_mem) < 0)) diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index c83bb832de..df0192a091 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -19,6 +19,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-26199.patch \ file://CVE-2026-26197.patch \ file://CVE-2026-17572.patch \ + file://CVE-2026-17573.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Oct 15 05:41:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100825 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6E9C9CC6B38 for ; Thu, 15 Oct 2026 05:43:57 +0000 (UTC) Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32811.1792043028213912555 for ; Wed, 14 Oct 2026 22:43:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=ow2IjqIC; spf=pass (domain: gmail.com, ip: 209.85.214.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2db80fcdf8bso28337675ad.2 for ; Wed, 14 Oct 2026 22:43:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043027; x=1792647827; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=CMMahbzhy1XoR1ziQmNzT+BVMB04l01VmUJFI9PAABM=; b=ow2IjqICn+2cvGSADDp3ij9BEwmG93japp/+ci31jhkNXueUuMyWlxS7DTYWfhGoRz Gl0/KXYoFjzvvHjoduaU7qrhNsQAyYuCIGws/L1CfA8Jz2savGUhau1h3/GcUN399zKa AozRa1q1XI91/aZzm8ozAVnA7NtISm19XlP04qcTKOXKWtkYtzl8XHNcHXX9nX/z+uVV yvVHJ4pvyEGmVwwI3bZuHKhiAsfUlkEXLEC+pZM+GedI4XMLqcsV3QQsA0NQOahMwQXq W/74V1p6J2cNBqW1V0KtrmSsCJpmtqrkVK3ioHV3fkyusQtRQbUsps2JkLParbSXcEPv v6Pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043027; x=1792647827; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=CMMahbzhy1XoR1ziQmNzT+BVMB04l01VmUJFI9PAABM=; b=nSKQkfJEv+5uSe5C6TXEg4oUA5kZasOEGEVKJGqvho7dTtSPWbLnbOSi1XGiyTTJlI X/Op0tYryeMr9N6/tV9loDk913tG+BWXfpsk7nCq5yGpQ6KIXWn4UCdCDtSG7yeLFWQ5 hK8rryW0WN8ZRxNG5QCIs8a5MFoPbANKXsPaGkAkcTNmIUg+IVY+ZeUnVKLBEOpCKCpR S7cgyG3gWnUp6QzQdLaMjnQxMl+9Co51GaxDVbxuRlWE0xdiN61A0xWHW9BSVf9Zy/VE NEr/azvuDa/xn1qUmNCsINvz8QHo7Hf1crDVORstB4qnmI+lkYYuILQdQcBnxmve9Xfu k7Og== X-Gm-Message-State: AFq9FYL2NTv6wFEuuc1/PO6XOLdI0358qof3OnRQ96zC+wf74gtjc1I8 19jnqPdEms+N5Gi6djVoHvVWDqmavLPjrYlzbZ06n+AiC06xCd26iICGlVG5Pg== X-Gm-Gg: AYBFou14C9Quu9OJvH/HNWumLIPbQbpR61cuPGCzd2lWpWn+wP1gWKTwBdAJ+attEUn Ra6x+bb/IMKlBGU2qnVqh821VUOFE7zubtDYN5lMMNDggnW+jwvXv/67mmTlM5Uap1C5Oq23vof IoyguZA+MHQGioGQUl90ZEXaI6Fg05CQWGCdZVKerMVArrQITc5WEpOGJQRQhy41k2nAzwrteeR iouZIOzEO5RaZl6eDfKQHvAJWDrzXVXe1tQJLTXVoGAzRX4zYUVelzPKjdWFkZtBPsrujDKW4CR bOyiwW5ERec2Kr1HyBrli3EpM2bd8KDlbbnr86m6WCsNhRO3sUc9G34I+RVQJFl5HPCaBNTmQ/m va4t/jyu604TzQX+ewLix0mqF537mOfYgYLdyMflHkkpJohPkuQ3OCIIKDPoRZwLnBkw9akUwSj Ysdi2k5ZfEiqsQelNCTR+S98/BAaY97Bem0mEErc1cdKu2CXm9+2BsBvZSG1sv0WPP/jJHLcEUO IyrEZbF7eh1nmLRJBPPWcw= X-Received: by 2002:a17:903:19ee:b0:2db:539c:b7c7 with SMTP id d9443c01a7336-2e8428a1e4emr140752545ad.20.1792043027531; Wed, 14 Oct 2026 22:43:47 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:47 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 27/82] hdf5: patch CVE-2026-17574 Date: Thu, 15 Oct 2026 18:41:15 +1300 Message-ID: <20416114defddc27ae84fe2db99a77e1936b1ed2.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130947 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-17574 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 637f437de908d10e8a3118888740a286c2cd1f06) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17574.patch | 65 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 66 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch new file mode 100644 index 0000000000..0ae79a2811 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch @@ -0,0 +1,65 @@ +From e374b227c277e100d9bfa3b1fe5c0b60cdff6c43 Mon Sep 17 00:00:00 2001 +From: tbeu +Date: Thu, 28 May 2026 17:26:57 +0200 +Subject: [PATCH] Validate VL datatype type during decode and check file + pointer in H5T_set_loc (#6395) + +H5O__dtype_decode_helper() reads vlen.type from the file without +validation. With corrupted HDF5 files (e.g. from fuzzing), this field +can have an invalid value that is neither H5T_VLEN_SEQUENCE nor +H5T_VLEN_STRING, which later triggers assert(0) in H5T__vlen_set_loc() +(debug builds) or a NULL pointer dereference / SEGV in release builds. + +Fix by: +1. Adding a validation check in H5O__dtype_decode_helper() immediately + after reading the vlen.type field, returning an error if the value + is invalid. +2. Adding a NULL file pointer check in H5T_set_loc() before calling + H5T__vlen_set_loc() when loc == H5T_LOC_DISK, so the low-level + assert(file) invariant is never violated. + +This fixes the root cause at the decode level where the bad value +enters the system, as requested in review of #6378 and #6385. + +Found by OSS-Fuzz via the matio fuzzer (ClusterFuzz testcase +5366895365914624). + +(cherry picked from commit 3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc) + +CVE: CVE-2026-17574 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc] +Signed-off-by: Ankur Tyagi +--- + src/H5Odtype.c | 2 ++ + src/H5T.c | 5 +++++ + 2 files changed, 7 insertions(+) + +diff --git a/src/H5Odtype.c b/src/H5Odtype.c +index d6405cdb86..6e622f3ebc 100644 +--- a/src/H5Odtype.c ++++ b/src/H5Odtype.c +@@ -751,6 +751,8 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t + */ + /* Set the type of VL information, either sequence or string */ + dt->shared->u.vlen.type = (H5T_vlen_type_t)(flags & 0x0f); ++ if (dt->shared->u.vlen.type != H5T_VLEN_SEQUENCE && dt->shared->u.vlen.type != H5T_VLEN_STRING) ++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, "invalid VL datatype type"); + if (dt->shared->u.vlen.type == H5T_VLEN_STRING) { + dt->shared->u.vlen.pad = (H5T_str_t)((flags >> 4) & 0x0f); + dt->shared->u.vlen.cset = (H5T_cset_t)((flags >> 8) & 0x0f); +diff --git a/src/H5T.c b/src/H5T.c +index 3b2e391a53..e2c9ba9791 100644 +--- a/src/H5T.c ++++ b/src/H5T.c +@@ -6953,6 +6953,11 @@ H5T_set_loc(H5T_t *dt, H5VL_object_t *file, H5T_loc_t loc) + ret_value = changed; + } /* end if */ + ++ /* Validate file pointer for disk-based VL types */ ++ if (loc == H5T_LOC_DISK && NULL == file) ++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, ++ "NULL file pointer for disk-based VL datatype"); ++ + /* Mark this VL sequence */ + if ((changed = H5T__vlen_set_loc(dt, file, loc)) < 0) + HGOTO_ERROR(H5E_DATATYPE, H5E_CANTINIT, FAIL, "Unable to set VL location"); diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index df0192a091..12c9852fd0 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -20,6 +20,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-26197.patch \ file://CVE-2026-17572.patch \ file://CVE-2026-17573.patch \ + file://CVE-2026-17574.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Oct 15 05:41:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100829 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8324BCC6B3A for ; Thu, 15 Oct 2026 05:43:57 +0000 (UTC) Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32812.1792043030388307726 for ; Wed, 14 Oct 2026 22:43:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Sgeit8CQ; spf=pass (domain: gmail.com, ip: 209.85.214.175, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2e49fbf92aaso28796115ad.0 for ; Wed, 14 Oct 2026 22:43:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043030; x=1792647830; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=HUXOn3qsWVNCOr87aigwxMuF+HRMeyStlPLbm15s6CU=; b=Sgeit8CQ8XR6XsYm0/4gXz9Ga5leFRqjfh2wGJkTNqQWnjq8+TEaOEqYupFy+hoeSe T6f7VYnWRnYVMiYXUHvY8upr5J5eNK9g9LptmAe3YbT8M4n8MaTfYin6UHv0AszQ7WmT nY7iAqGKOiF+rlIsiV/XHDf3iV0gsfbbWbNDMfnTdn3+N3BCSApKS6gGkvOElt6dvE+I iXSE0pkozuvdKrb7Gz9PqZr/EcVFK8wJhV5w0JeKNoaYpLyaO15kA4h8y6mbhzqLSN90 FYNPPRFi8CYJyXwCocghKNX80BzAbSfre62EEOAgvA4M2PN9+sP6zpQMTxB/QxK5Mzbm N8LA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043030; x=1792647830; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=HUXOn3qsWVNCOr87aigwxMuF+HRMeyStlPLbm15s6CU=; b=plL5XV7QlLiooeYQE+NsmlUF+UBgnESMbfDM9k7dwJ9Azvop0xb8+7L0b/noFzRA05 EutrymrFLj4zgRP+gL3WgJ+z4dva1cTM6baPdatVVFMT1EOoOoG6/3gywfafjSx4xzfI jcQUoIIeOFbr3ISR44erTv1PTsC4rD0ZG1Vt+r92iJC2d0I5pN0SN2ATx1J2Hs1uEgpd lktNSEw4q7OVtsq4dqfiL/t3LR+vTzvoY9gJYVpWszgF48NxB4kCCJ6DQ9Xhfwou26Sp BaS/U2by7hTPHA6uZmoO2aj5NDVN6JzmOZkoN7pNuNWX8M6uALZmu9m8xCJgUA70jQcl YU+g== X-Gm-Message-State: AFq9FYJ6DEO0aK16Y8yaXJ4op38r6FDOQ8HVwdPONfxgDq9I5VTtnflp /7LYkkJZelip18+tJVj06oRDcr1E/yuQT4XJzGjGmL0JrrBqVfrRD25QmzDymQ== X-Gm-Gg: AYBFou0E8wbeb7Oz3ic/e8aDUhtXkQBCtj0OUeJBMKTBAWcX8t07ziTl+p0+CKnnJAD H9YPSad8JQaLFRqJQ4lv5VYx8MTzjUaMHg6vcbMR28f0vFsXbgHGeo0uwxPH1JmsE7uDtYW7cbV 2RRcJHOmDLUVrHXCO7YCaxoJf0cu87ShQ938VjRk19y2qVu0QweSAUZX1cGvapClayfdZSPBujN 91Iq1eT4sxQpwQByNpPWEAalF34bo4nqnr0DdhjAGcSbWQcOtOPiUbEBhaS2yzIi5wDpkHD0riU O6PsQWCFPALZf1C1AAaxsNJ9ShEGo3w4ZF3wJJWMycIBP93AlKR4CTYe5iHCaPLm+c/VZT8sjfC SPnatkrCIPBW5IZOtKH8rrzb+tZhRhVeux1DelSEjpQdzM8ttdV5GhLmOZu/XRLW38aRCA1uiwF 7Vi/iXedUS2qGq89/YdQ+c6Lw0YLAW2K2rcBJeqA1DqF5mOLZOUPEuKHWkt+ru3mAGkLXh6NWcm fi2L7QhEZCZ5n/TpnQWhJE= X-Received: by 2002:a17:902:f544:b0:2d9:520c:38e7 with SMTP id d9443c01a7336-2e8427f11aamr154644455ad.1.1792043029524; Wed, 14 Oct 2026 22:43:49 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:49 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 28/82] hdf5: patch CVE-2026-19025 Date: Thu, 15 Oct 2026 18:41:16 +1300 Message-ID: <38078503c1f4cdef2cebc046be751e502d915afa.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130948 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. [1] https://github.com/HDFGroup/hdf5/pull/6508 [2] https://github.com/HDFGroup/hdf5/issues/6491 [3] https://nvd.nist.gov/vuln/detail/cve-2026-19025 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit df3f814ab84f9cbdcdaeb7cc745e0c61c90c55e8) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-19025.patch | 112 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 113 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch new file mode 100644 index 0000000000..075bcf7653 --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch @@ -0,0 +1,112 @@ +From 0cb26cd769d1da3f2ad2c3836dc1732309f935a7 Mon Sep 17 00:00:00 2001 +From: Matt L <124107509+mattjala@users.noreply.github.com> +Date: Fri, 28 Aug 2026 13:49:02 -0500 +Subject: [PATCH] Fix CVE-2026-19025 (Reject chunked datasets with mismatched + chunk/dspace rank at open time) (#6508) + +* Reject chunked datasets with mismatched chunk/dspace rank + +H5D__chunk_construct() validates that the chunk layout dimensionality +matches the dataspace rank, but that runs only at dataset creation time. +When an existing dataset is opened, H5D__chunk_init() didn't repeat the +check, so a file whose stored chunk rank disagreed with its dataspace rank +was accepted. During chunk I/O the memory-selection rank (from the +dataspace) and the file-selection rank (chunk ndims - 1) then differ, which +produces a zero stride that causes a divide-by-zero in +H5S__hyper_iter_get_seq_list(). + +H5D__chunk_init() now performs the same dimensionality check on open (the +stored chunk rank includes the extra element-size dimension, so it must be +exactly one greater than the dataspace rank) and rejects a mismatch with an +error. + +Added test_chunk_dims_mismatch() as a regression test in test/dsets.c + +Fixes #6491 + +* Fix typo + +Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> + +* Clarify element-vs-byte wording + +* Validate chunk/dataspace rank at layout decode time + +Move the stored-chunk-rank vs dataspace-rank consistency check out of +H5D__chunk_init() and into H5O__layout_decode(), so a malformed chunked +layout is rejected as the message is decoded (mirroring the fill/datatype +size check in the fill message decode). + +* Update release_docs/CHANGELOG.md + +Co-authored-by: Larry Knox + +* Update CHANGELOG + +* Pin format version bounds in bad chunk layout generator + +--------- + +Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> +Co-authored-by: Larry Knox + +CVE: CVE-2026-19025 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/b7b85e7abf9aa9b1dd9693523defa35217684eb2] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Olayout.c | 32 ++++++ + 1 file changed, 32 insertions(+) + +diff --git a/src/H5Olayout.c b/src/H5Olayout.c +index d230feb992..5dce35e916 100644 +--- a/src/H5Olayout.c ++++ b/src/H5Olayout.c +@@ -23,6 +23,7 @@ + #include "H5FLprivate.h" /* Free Lists */ + #include "H5MMprivate.h" /* Memory management */ + #include "H5Opkg.h" /* Object headers */ ++#include "H5Sprivate.h" /* Dataspaces */ + + /* Local macros */ + +@@ -561,6 +562,37 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU + } + } + ++ /* For a chunked layout, the stored dimensionality includes an extra ++ * element-size dimension, so it must be exactly one greater than the ++ * dataspace rank. Validate that here ++ * to reject malformed files before the inconsistent ++ * ranks can cause problems during chunk I/O. ++ */ ++ if (mesg->type == H5D_CHUNKED && open_oh != NULL) { ++ htri_t space_exists; /* Whether the dataspace message exists */ ++ ++ if ((space_exists = H5O_msg_exists_oh(open_oh, H5O_SDSPACE_ID)) < 0) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't check for dataspace message"); ++ if (space_exists) { ++ H5S_extent_t *extent; /* Dataspace extent from the sibling message */ ++ int rank; /* Dataspace rank */ ++ ++ if (NULL == (extent = (H5S_extent_t *)H5O_msg_read_oh(f, open_oh, H5O_SDSPACE_ID, NULL))) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't read dataspace message"); ++ ++ rank = H5S_extent_get_dims(extent, NULL, NULL); ++ ++ /* Done with the sibling dataspace message */ ++ H5O_msg_free(H5O_SDSPACE_ID, extent); ++ ++ if (rank < 0) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't get dataspace rank"); ++ if (mesg->u.chunk.ndims != (unsigned)rank + 1) ++ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, ++ "dimensionality of chunks doesn't match the dataspace"); ++ } ++ } ++ + /* Set return value */ + ret_value = mesg; + \ No newline at end of file diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 12c9852fd0..a0eb5eb155 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -21,6 +21,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-17572.patch \ file://CVE-2026-17573.patch \ file://CVE-2026-17574.patch \ + file://CVE-2026-19025.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Thu Oct 15 05:41:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100827 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95690CC6B39 for ; Thu, 15 Oct 2026 05:43:57 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33244.1792043032045721288 for ; Wed, 14 Oct 2026 22:43:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=OJrJkWn4; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2e934449bb0so12226825ad.0 for ; Wed, 14 Oct 2026 22:43:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043031; x=1792647831; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=LRCOxZJ0IT9Nslc+NLfJ0EExTgblvBk4xqBz+nanNSk=; b=OJrJkWn48DDA+J85oxPOp4pwtPVtkUegRkFRCPmqR+XjR69DL2IeXgA0Efc1ujL30k +3Yepnk75tG0rwsaYLseAvuAqiiR11TeY/tgkz10nqmtsMP8zUGjsKTfuVlwn42pGgZ3 8Y8qH639ddSMhsmGz5+TLkEII7CwmAvrxtoG2D0sJgzRnrjisDRdM25o9j+3DyL8SKCl SWPqa9Qxo0klb2aTBEsK84+X3qVuJFxCL/c6/qF2aetVcLki1B4crEh4hMDp4iPL3WkA yPB0en7YHdi/f4oJtM4cKCG195PVeop9iyfjPNFhoMd3JCIbg3L1hxTJIsj9G0fNWLOV Q85A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043031; x=1792647831; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=LRCOxZJ0IT9Nslc+NLfJ0EExTgblvBk4xqBz+nanNSk=; b=d9FSX2rCa22H9yrFLeNHg/13N5AdvVqFfVUfXcOFM4qMqM0HZxEckFuc4TrgSk93jD GdCIhjoWWm5KH0kmEqzNoClp7mOtXPRAcZemUVvmkli/UX0MUVxbeVTBupC6IUZDbYya bOq4eWfaUd/HSwtRfdO2+/bOIeEHRQfucRikq1RNPc2Z9x6ljlfd6khU91jEWNmXaXyB qB95bPiAo3WYL9doXSnoun7iwJ8vNhI+mBUt9F+9Qy1XXLz7oWHSOaKE4wbYJh38PXGo WVR9C8iIfA1ntkwGPG7jZt/ZYtyaZoh0LmxsB+VBP4NtZxJSRDP+BknyA+m43DU/aWaZ SPVg== X-Gm-Message-State: AFq9FYJ0PUw7F9Be06+5HliszYP50rTdiBJIyegK2228WDBmNXbPQIcl PQtjISl0VLVE2du62KWt5EEdx+E0HjebyxYo98fsiE/19pLenzOGoCSNEa2ybQ== X-Gm-Gg: AYBFou0jnosHoIPT0tO4EWkvYzkI29MuiWKEp7hC/PFlrIPmlr13Ue4WoXq6wNSbwTk JW7RYOijBmA1pMArYD9H7rhPSQAmxXzLcbBtzed2Eo8bxDln7EbjD9jkYPC9b+5w/YppEgBlo/K tFRC6sCrRC+yLBLxgKbimQkjALja8lfNbyIUXqWkrmfEJaHMY6TugNJMx61rQF9OUMLAEC0ipiO yr10KaS30iR0Ot+O1juQrwtkqXhJxVyrcka7YAQJ05zxdwqUwURGF2KUWJOxz6MXDsGr2jC5lnz kEdIlBJRK5o5E9x5Ut95URJBEUAAYS4dhoEDDRWECHPAX3wFA883XOioJBn7LYAybp3ITmrqOjF L+YEVAoXMCFGzIcml5tCwnVUc9kApm8LQk3ji6qB4SJBydn20qOKSEjfr7hLR26eODsj3roQoY7 IkhKXBoU9GuoGIZkfXh+2fzOHjXaV6Xn6Tpvp0DEKfY3iiklTQRYwoJodHAro9/toRYrG42MIWV BpEiRW1+bI87Ifpj5Br7zE= X-Received: by 2002:a17:903:1b6b:b0:2d9:383a:30f1 with SMTP id d9443c01a7336-2e842820605mr177678225ad.4.1792043031379; Wed, 14 Oct 2026 22:43:51 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:51 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 29/82] iniparser: mark CVE-2025-0633 pached Date: Thu, 15 Oct 2026 18:41:17 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130949 From: Ankur Tyagi Also mentioned in the release notes[1] Details: https://nvd.nist.gov/vuln/detail/cve-2025-0633 [1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 86fba2b5805f6c8ff0a5f936106a9be630bc54d9) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb b/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb index 9ab713ee92..5958ecb9c6 100644 --- a/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb +++ b/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb @@ -15,3 +15,5 @@ EXTRA_OECMAKE = " \ " FILES_${PN}-staticdev += "${libdir}/cmake/iniparser/iniparser-staticTargets*.cmake" + +CVE_STATUS[CVE-2025-0633] = "fixed-version: fixed in v4.2.6" From patchwork Thu Oct 15 05:41:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100826 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C401CC6B2F for ; Thu, 15 Oct 2026 05:43:57 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33245.1792043034223334817 for ; Wed, 14 Oct 2026 22:43:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Kc+kYp9a; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2e5d0ee1951so30924215ad.0 for ; Wed, 14 Oct 2026 22:43:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043034; x=1792647834; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=7ldsrTWYH8JsDyaVrLoMeS/cvXlUmeSUdPNqx7OyA+w=; b=Kc+kYp9ar0RF04j+1cK5DQwnrtKDr2f7rvcmZtIsNpgKvneByiRvgYZxc9U0JFT7UR nGC0dZfPy9yL+DK3LPxBU/UO6agWQDdnDAa/YmKfBCfh3fne/xWiBTYypdpl7nGT5Kqr E02quHNuS0MOhIu+Lj+6zv07K9G/cTthWG7vrLsUN13jbiJNUaqXqEw4/11jhmyeDbie ecIzigFADpag/SkDHbhIxqmGgijnPBj9sib/0kSKfwYtGA6Dxb+Bp83trnGYYwJx8ygY 7FPWVxS4o7PTPlZ/y7XRvDMnIzF0QcRFVHz1wdDSwkLn70FjcTpn41fRgeptQ+rkRGnb c7fA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043034; x=1792647834; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=7ldsrTWYH8JsDyaVrLoMeS/cvXlUmeSUdPNqx7OyA+w=; b=BKDZYArVac3XJGmvotzn+g+m0XYtMr0kM/E4FvR2Kh0D72QKQl9nzzJjE4I1mhAkXN GtvhPoCE7foUt76EL6muXzIpI31qiMYqLSVhgREMkGIB+w8JHnOowqAwPc3pvZhcenW0 PIrX3PyXHTBTdZ+tSlxiDdJqtcaK+OYB5wir1K2qu0xBY0snlmr7CAKBH9Cieaw37jkL qtMdl1jE2geEkN/L8hWbnRZe7bYBUsMon7S6iAQPJY9vkQxTrnH40OmsO1kwI+/LG+dA D1NxynL4EKauG+fl619wUYGSdCjuHl0kPTcFZKcTB8PxQ6f6dcjfLYHa7OCY4UVmogvm VI8Q== X-Gm-Message-State: AFq9FYIC0QTJaxm2ctU69Nja/37ejLeSVeE8Uzq+ffh2cQfagw7bla+e 9FK1+R5OC8HYfc2AZtSDxMsZFYUsi8E+mn4mupN2A5OVFMIbVm1bhWC2zp5IuQ== X-Gm-Gg: AYBFou1D8AsmbnOv4ml7sK/WN9dr/4PXqeSUhnssr2fTylzkpiIkxAP33PNHjS34GdD ZP/ZFHPV8fyv3mANc2yirYFprbFVViWF9I3EcnYNYllGFE88s2r26efIaOGzlmiyeKBXf5hoNxx awyHgWD5mzG9SkuPzxbTk1EmytmzKynrXhykHOMwU0vpLIRXt0gfaDU5VpyIxS7m1fZ50zrFYt9 YWE5jhYgFfeyUE21esl/ORgyt4yPD1HEFL3J4OZQqPbvbhocqvj4Y0/jAhiHuOzgahdX115yvsR CA4Luvs/bi+Xvo3nCV88MZBHGHMNEWPUtzi4HHJusVtBhUcjdk1cl1ObquLpeTYkwAYhc6Pqrc9 2tzp8fALnAmWbcRcecr4aPoSDkarJhh/h8kZLVL/MWlcjI1XHrqKvUz1p2NqGT0gnSkDKmU5zSF ZCOWzA6iqp/gWarLk2o6yq+hrn3QOg0+XHh+igmy8Kx5mPPepo5qZgNLHegDNJJ+GAXdSPYsIwn DJePmZoF4yv7D/G9z/l+A4IITJr5tZ/lA== X-Received: by 2002:a17:902:d512:b0:2e2:cc25:b232 with SMTP id d9443c01a7336-2e842cdc302mr159608305ad.42.1792043033584; Wed, 14 Oct 2026 22:43:53 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:53 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 30/82] jq: ignore already fixed CVEs Date: Thu, 15 Oct 2026 18:41:18 +1300 Message-ID: <1dac3dca9d4006115ce33b0e8a3caf1cbdc3a300.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130950 From: Ankur Tyagi All these CVEs are already fixed in the recipe version[1]. Details: https://nvd.nist.gov/vuln/detail/cve-2026-33948 https://nvd.nist.gov/vuln/detail/cve-2026-39979 https://nvd.nist.gov/vuln/detail/cve-2026-40164 https://nvd.nist.gov/vuln/detail/cve-2026-44777 [1]https://github.com/jqlang/jq/releases/tag/jq-1.8.2 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-devtools/jq/jq_1.8.2.bb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/meta-oe/recipes-devtools/jq/jq_1.8.2.bb b/meta-oe/recipes-devtools/jq/jq_1.8.2.bb index 0bbe6e009f..9f586eb18d 100644 --- a/meta-oe/recipes-devtools/jq/jq_1.8.2.bb +++ b/meta-oe/recipes-devtools/jq/jq_1.8.2.bb @@ -48,3 +48,7 @@ do_install_ptest() { RDEPENDS:${PN}-ptest += "tzdata" BBCLASSEXTEND = "native" + +CVE_STATUS_GROUPS += "CVE_STATUS_FIXED_ALREADY" +CVE_STATUS_FIXED_ALREADY[status] = "fixed-version: The issue is fixed in v1.8.2" +CVE_STATUS_FIXED_ALREADY = "CVE-2026-33948 CVE-2026-39979 CVE-2026-40164 CVE-2026-44777" From patchwork Thu Oct 15 05:41:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100828 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AEF23CC6B3B for ; Thu, 15 Oct 2026 05:43:57 +0000 (UTC) Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32813.1792043036602834465 for ; Wed, 14 Oct 2026 22:43:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=RieucwrI; spf=pass (domain: gmail.com, ip: 209.85.214.182, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2e8ad5b31c7so28514765ad.3 for ; Wed, 14 Oct 2026 22:43:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043036; x=1792647836; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=yobsyBcNMHXYWF4sjLbpLEmDpMfy6IIP8ei+VHdbFOI=; b=RieucwrIOhWcj/MEHEWxfQjdDa2xY9/UauXhriNEaxNiXrwdNWl+OY5ifiRZiz1plc Yy2b4Kfy7U8RW5YvzC6KH1fAST5d/w79AoIGdasDXxBsj8GlH5LORQD0jrc1JdPa7vUV QT0fOjnq5qL5ycZ2OySv+CIkgG4PBrLj27KVZvAfzwNU/rja3M057lExescj4y8Lh675 KIC1TnFmvYd6YZyJwfK6Am/GnZIUvjAjajr8t1LsbDk1fBqv+4q19PT+mT4+J5O0G9r/ 0Rv4jkZeJVZjhNxPi7BkUq97HkVlefAXnbaM/GGTlujQdH4i+7LtWa2ruZFxeIPWAOZm zJAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043036; x=1792647836; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=yobsyBcNMHXYWF4sjLbpLEmDpMfy6IIP8ei+VHdbFOI=; b=CY42sA0RpyrsW5+edou47J8rtbKE4OixuX/ze95/089Yz/ZFjUrHgolIaR35Hb3JTJ lQYGFwEF8KYfC6/Pih6zEXsORtAIbedra3uyd7Ro/mXrM4sT7Q7D8qqSHCf2JMfcKhsl cepjbu0tJ9QYlImnVYloPjI66PHWTlBjNHvIYulaYK48igVq4HichMeICiJ8IIXQCx+c F3dkE4Doawq7YM8JOt0VXGPK4vj6y9rFUWe0uTPE2HO8zEuJsnD71B32MyAUcU6Ysqyt rT+H6Y6Gvv628QY+kp8LAIQT6nICcMPRRKkl5XxG464cZDqvfAUoYcr270uphrWCLEXg 0yGQ== X-Gm-Message-State: AFq9FYK5mZj8MXdeKvPAIFcfBphkIh3TrZNgj+G3oV6wA/I9xPVYIMGA DwNMaa1V5ZKd5ZzLZJB3eGyyKG7ZcyHcqymBqpmtE3iEMvbVRzKxUjHvlBCUpA== X-Gm-Gg: AYBFou2CTjuMxJinypDK5fY8SmM2T/0Px9+p4Cw6mC1zWRbm9j6fCdg/H/xm5bZemY+ LB7X5/0zgrx2Cd2zA0IHuKjjQvm/gOC1qKgmVfP7DQfsFE77cm2DUlBstdWPeL7XTwgelY/ETwL GZqmU5EDq39H+RnWJg39r1n9MNmacUu8E8IODH2LaYHhXGJsLmnABGtA2pRewD0Ws8AsFukWrlw dNQ7HeqVPGz2IWiRBMaLiLb/MHEQV3JIIBerxastnqP0Ksxb4uC+PMcLrf+qETrio/LO3W3kySk m9GaW7rnDtx4bnK7VTpzNsIdIGFT5UjeLrubPEobbJv7DLUcDyhTDmYpOrKfLg1r1cNMWSu+A30 bHBKBB+Mm69KODQAIzpx3Pl5a9/eEvpxlTSCoMnQuhgDCVfMFXSp0NHmJ22xu9uFYojFSY7SMaw gNWvmP3hFzjhAtlN7VnuVtBW2OCli88SXbUjRbX73XBrCLcCA2j631vw8kHwsJDjlzHBay+U4ZA 6IVwv+qDXO4UxP4g/+XsYk= X-Received: by 2002:a17:903:160c:b0:2e2:d9fe:51fb with SMTP id d9443c01a7336-2e84280aeecmr164774325ad.4.1792043035910; Wed, 14 Oct 2026 22:43:55 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:55 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 31/82] libiec61850: mark CVE-2024-45969 patched Date: Thu, 15 Oct 2026 18:41:19 +1300 Message-ID: <15d002f2668a724ae99fbe00672ad36bae8e2e3e.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:43:57 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130951 From: Ankur Tyagi NVD[1] mentions commit[2] for v1.5 but is also present in v1.6[3] [1] https://nvd.nist.gov/vuln/detail/cve-2024-45969 [2] https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33 [3] https://github.com/mz-automation/libiec61850/commit/d1ab50298fcba3f87b1e58dabff92f8615b14ee7 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit a7088b0fda5d269721e5d3f16ae410062b9b2c8e) Signed-off-by: Ankur Tyagi --- .../recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb b/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb index d2fbbc53fb..51ceb5cf02 100644 --- a/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb +++ b/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb @@ -35,3 +35,5 @@ FILES:${PN} += " \ ${PYTHON_SITEPACKAGES_DIR}/pyiec61850.py \ ${PYTHON_SITEPACKAGES_DIR}/_pyiec61850.so \ " + +CVE_STATUS[CVE-2024-45969] = "fixed-version: fixed since v1.6.0" From patchwork Thu Oct 15 05:41:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100830 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8ECCCC6B2F for ; Thu, 15 Oct 2026 05:44:07 +0000 (UTC) Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32814.1792043038768626927 for ; Wed, 14 Oct 2026 22:43:58 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=oV5912ZG; spf=pass (domain: gmail.com, ip: 209.85.214.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2e95bd1c14cso3267035ad.2 for ; Wed, 14 Oct 2026 22:43:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043038; x=1792647838; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=VhF7MzhOuo8VqGdj2+OUIQdkbeWwCa6uyZhl/+jTfks=; b=oV5912ZGy8ooEWvLTLP0pOccGkp824UCOMtB+5hsj3sc4MBPsH/OdSFDYao0uFWOOh NVdytFdja90t2ZaMpXqjqu9U5yvTqxUqHchywpe2iRF4HrbTSr2jhYRqxfLc7fQ4+7pA x8J/RsjqQpx8WZWyV7JWZjAHMiAFKfgMalNJl3oiNOWmIlTXtMClQspAmimgq83C8SjO zuOtgeoYVVdppKoIYP+bHB7kJ5AITKjrV5cQX35DeOR9Lnnz/gWdCmmgnbtMFm0Kotzn nuc76cdNrAspqMIjOEDgUJnjX9Gw6Tp49L1FRI4K9+hAPkZu70a36AU1+Y/cQAojud42 Xkqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043038; x=1792647838; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=VhF7MzhOuo8VqGdj2+OUIQdkbeWwCa6uyZhl/+jTfks=; b=XFfwtVxdLNGvibP0akSnXtx0YpJj85aTzYwQ+MijsRhirkVSYGczIZVgUNWs8iACRq 9MFmADJjkW24v4vFWE0qOJcntHWaV7ZRpf0TZiiX3D6Yu2M7PuUtyk/1wFG6tFXl9jsL 987pruhG2pNWAJ2BuTc90LfcyKVt+gMtJA6C7WD4b9Po1kyQoWg/xL8OJVbJb/mB3uL/ eE9+5EdSjQ8/c1T50pIBitr5rLy2GlsrmeskdZDr+YkpK9Y9pAyCjkExD952rfeFW+HE +ysP+L5SYB0rqW/fgqAdR5XSdtCqL2o3S2tuLCNLK32vfvGMH5V80gkPMGdorF1bdhX9 o4xQ== X-Gm-Message-State: AFq9FYJ3vQHpDEvsCCUHyeygZsouIbz6BK7UtZzjo6JbdsWvVuKLUg8Q U6FTkDh7ybArz1O6BHyMJ44AxuwXkroY4sxpcKgWM3zortbou+yj29VGBEf0pg== X-Gm-Gg: AYBFou2XfhTPmdlZTxaFvKu8WpY6x7D+M8hHqMu0t8Fj91j7zF1oBEEzylUwlXmm7bj FDbmxgNMPP3huV1usLGRfpcOSfsmW1dW0iz0QZ2OsYCo/S1y99VGSRnCBx3gUxTr6GWJG29IMW9 3yMDbjVPnjaWL0GWUocrn/qdWHEGrXASMP44C8ePmOEz5plduJXMybOQWiM9gPt4m+LAnIx4ZrT GQUTNFz7eTCegiAyoINs4tSMbi6t83T6TanNOABqgG+m8IN99l1w4JuEiAABQ9wtWcUwr3gZ3GG bcQQOYlqVzEbMvFpK4N0h03me/SgQbD8Sv796+2nrALOhlCD16rdl66YzZ7Qk7hXZ/7BTgiaio5 3Ww1M0qwW1xM/ghaVFu7qfteT13MSdug3mkVIg9xUctzG7yeRrhLFKyHBtyTGaowWT3/ob/STXG FUO/QeSUXfHYGgrCT4NZlnArFJj8LsexGk9sPWS11HbE+5P/VkzsTEUba6MU903tk/6u1JMXXc5 ogjZI1DIenOStZp8o4mjyc= X-Received: by 2002:a17:902:d50a:b0:2e3:1bb4:610d with SMTP id d9443c01a7336-2e842f31562mr157121825ad.50.1792043038066; Wed, 14 Oct 2026 22:43:58 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:57 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 32/82] libnfs: patch CVE-2026-53689 Date: Thu, 15 Oct 2026 18:41:20 +1300 Message-ID: <8abdf08b09f02003e63d33341b5f757135deb2d3.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130952 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-53689 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 6ace2f0b5e54469c5e9fd8b99412e8f412128458) Signed-off-by: Ankur Tyagi --- .../libnfs/libnfs/CVE-2026-53689.patch | 34 +++++++++++++++++++ .../libnfs/libnfs_6.0.2.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch new file mode 100644 index 0000000000..0c624c7219 --- /dev/null +++ b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch @@ -0,0 +1,34 @@ +From d45a7d6cdc899ac2a62abc21280d674ae91ae0ae Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Wed, 10 Jun 2026 11:43:28 +1000 +Subject: [PATCH] ZDR: check the string size for sanity + +It could otherwise cause an overflow in the bounds check later. + +Reported-by: Nick Hummel +Signed-off-by: Ronnie Sahlberg +(cherry picked from commit 55c18ea33a83d667f79f0ef209c96895795c729f) + +CVE: CVE-2026-53689 +Upstream-Status: Backport [https://github.com/sahlberg/libnfs/commit/55c18ea33a83d667f79f0ef209c96895795c729f] + +Signed-off-by: Ankur Tyagi +--- + lib/libnfs-zdr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/lib/libnfs-zdr.c b/lib/libnfs-zdr.c +index bc507eb..cbdb650 100644 +--- a/lib/libnfs-zdr.c ++++ b/lib/libnfs-zdr.c +@@ -305,7 +305,9 @@ bool_t libnfs_zdr_string(ZDR *zdrs, char **strp, uint32_t maxsize) + if (!libnfs_zdr_u_int(zdrs, &size)) { + return FALSE; + } +- ++ if (size > zdrs->size) { ++ return FALSE; ++ } + if (zdrs->pos + (int)size > zdrs->size) { + return FALSE; + } diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb index 49617eaa29..8068d35e1c 100644 --- a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb +++ b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb @@ -5,6 +5,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=825301ba17efc9d188ee0abd4b924ada" SRC_URI = "git://github.com/sahlberg/libnfs.git;protocol=https;branch=master \ file://0001-CMakeLists.txt-respect-CMAKE_INSTALL_LIBDIR-for-mult.patch \ + file://CVE-2026-53689.patch \ " SRCREV = "18c5c73ee88bb7dc8da0d55dc95164bb77e49dc6" From patchwork Thu Oct 15 05:41:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100832 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E40C8CC6B3A for ; Thu, 15 Oct 2026 05:44:07 +0000 (UTC) Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32815.1792043040719107468 for ; Wed, 14 Oct 2026 22:44:00 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=m24VyH93; spf=pass (domain: gmail.com, ip: 209.85.214.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2e8246b13cbso36315275ad.2 for ; Wed, 14 Oct 2026 22:44:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043040; x=1792647840; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=m+sTFThoH6Lv4ULvwMa6/fAQl2K6X60ZibvriZVvDWc=; b=m24VyH93M/OieQ8ncKnARrLV8Zn+Ma62L9+YRQV4NV/VZtVidZxfeTIv/UEfBLYpiU vH0N647XsbIM9w9OBteU9rIAnTYqn5Ay5+sFcAFxYsp3SxHUBwS+DQJQHoBwQBzd1JKI dSn7f814r9SiY8xCX0ojeXaldcGZWpQwj8UxnYkVm+dKQoxmuvzzw2Bw9ECgd2CWEO3k p9tfTW+HSo2lSqU4fkQ3e76qnWrcLMiBsknT9k2J7erFnCJ7XMAeGjSiSOQ1nBCAeuky BbjFUAoanNU3NHhWNUUZvTGDTlDFhZiOHCyyR7gE1qs5N+PwFEKs5k26fxqEzL0kb0XA PGww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043040; x=1792647840; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=m+sTFThoH6Lv4ULvwMa6/fAQl2K6X60ZibvriZVvDWc=; b=hv36xA3be6q7OiBYbB7mvGet4FNxh/h1DjLlcBI1MXc/93vCjPexUFeIJrAiAclpCp oUfvPAqikW6aVh7++qhM0ydWvlQuTE5rzU+V8fg1zerHHnrjxZmAEZ1DEB/SAohz8EJP 2uZfEv3niPaqSgKB39jgaUG1Az4i+89fjCr56DmxNu9dFX+xWLlQxnm/zxJFI9dPOo6E 7E6pnmVi5UbbkqMfCEeSGLhp5GQPUnLDrrWy6lQg5NkxXaY9T5ouqlW6s6o9m4TKefG0 o/sV6xbrgPDD+uOVDoSCkVKudaa5ZosMeX/ptS3uO1zFuzrLWlVntjgVD2zKDiH1Sxli BwdA== X-Gm-Message-State: AFq9FYL5y3DHtMknigetUZZ81uo/M6Kq/FWwkxpEiu4IGiyw68wIOxLf /ANMu0fcWyz1Djbiw4xZmFAor/h/ix/vJbkdaly9/qjK0qhMH6L2e/j+qnyerw== X-Gm-Gg: AYBFou3ZqKgNasKOMJenLLqWwBZppfa/b4lfqFGChE+50+fJKktOLl4mQ72TzxP4Ozd BU/1MCuOUft2VC35FKkmlS2rucKZ95m4GR0gMi3q9MexnA+JS2YXCT40lRs4sZXb4Elp2BcrF7m 24YdTg5scRNu+h2O2o83OEDEGeaFB3y+RU/aJNvFznvMMiWy6MY5NZrvreWThGK80Vr+1W+eTSS SpefUXKjlsoYioLdpGQkqqZfv91pkLfac8dQq1d/ejGTsWxhmLEFGpZSpKEAldyu4SJ8L7GuR8U /41KSf6h0a5SXOfMH227PUy935PzLk0fvWFcTWCfWm1MLHbPLqlmQ2mlIE7pW/Xjf8YZsmg1cCU +bTnLMvn2AzVYsi7Yhf6u1spgg9shbiWNSugfv3NSrKHkwcrQyXeucfvsqL1riIjiuzZMpUF8H1 gzaobFpIxmC+iBMPQ4wDT4rXuwCQowF0qfCniEr8PT1X4RNqHSYEF9NALX29GMnPF3qirVeomlp LdINGULwUWt/JU+lMVCuhE= X-Received: by 2002:a17:903:32c2:b0:2e8:30dd:523d with SMTP id d9443c01a7336-2e8429a739emr171880475ad.13.1792043039991; Wed, 14 Oct 2026 22:43:59 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.43.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:43:59 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 33/82] libnfs: patch CVE-2026-57918 Date: Thu, 15 Oct 2026 18:41:21 +1300 Message-ID: <5a964c11f8bf9d9897cb970ceb0f26956d5416e8.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130953 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-57918 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit bb3f5628f16b0ccac36287f6355c95000233c57b) Signed-off-by: Ankur Tyagi --- .../libnfs/libnfs/CVE-2026-57918.patch | 34 +++++++++++++++++++ .../libnfs/libnfs_6.0.2.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch new file mode 100644 index 0000000000..27c99b5704 --- /dev/null +++ b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch @@ -0,0 +1,34 @@ +From 589568b88a06d92b298ecce563ae57b5fad91238 Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Wed, 10 Jun 2026 12:21:58 +1000 +Subject: [PATCH] socket: prevent an underflow in xid + +if the expected pdu-size is larger than the absolute pdu size +from the xid/record-marker. + +Reported-by: Nick Hummel +Signed-off-by: Ronnie Sahlberg +(cherry picked from commit 935b8db712b3c6649bc57ddc276526c4a31680de) + +CVE: CVE-2026-57918 +Upstream-Status: Backport [https://github.com/sahlberg/libnfs/commit/935b8db712b3c6649bc57ddc276526c4a31680de] + +Signed-off-by: Ankur Tyagi +--- + lib/socket.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/lib/socket.c b/lib/socket.c +index f51ca4d..8e38eb8 100644 +--- a/lib/socket.c ++++ b/lib/socket.c +@@ -929,6 +929,9 @@ rpc_read_from_socket(struct rpc_context *rpc) + break; + case READ_IOVEC: + rpc->pdu->read_count -= rpc->pdu_size; ++ if (rpc->rm_xid[0] < rpc->pdu_size) { ++ return -1; ++ } + rpc->rm_xid[0] -= rpc->pdu_size; + if (!rpc->rm_xid[0]) { + rpc_finished_pdu(rpc); diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb index 8068d35e1c..ef99118230 100644 --- a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb +++ b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb @@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=825301ba17efc9d188ee0abd4b924ada" SRC_URI = "git://github.com/sahlberg/libnfs.git;protocol=https;branch=master \ file://0001-CMakeLists.txt-respect-CMAKE_INSTALL_LIBDIR-for-mult.patch \ file://CVE-2026-53689.patch \ + file://CVE-2026-57918.patch \ " SRCREV = "18c5c73ee88bb7dc8da0d55dc95164bb77e49dc6" From patchwork Thu Oct 15 05:41:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100833 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 043BBCC6B3C for ; Thu, 15 Oct 2026 05:44:08 +0000 (UTC) Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32816.1792043043152472652 for ; Wed, 14 Oct 2026 22:44:03 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=nWBgvLNL; spf=pass (domain: gmail.com, ip: 209.85.214.180, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-2d6e954afbdso8089475ad.2 for ; Wed, 14 Oct 2026 22:44:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043042; x=1792647842; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Ka0tNIP13fA6NTLmMi/qzJoPzc0yrxeGeXH++YZguGs=; b=nWBgvLNLr8Zp99mNy4q4P+ErL7u74S8ZQjHONv7hfiTgC1DMTVjX3MKzFWWNohW4VS 4Nv4AnZfstWti8CtX/lkXB5vuB6ApWqQ27hVa8SZY0WJ/VBjahoLEs+Uo5fX9hlnl5ya Qbpj4Ui9XXuVsDVZhDDunGffbwQOSsny3aElOYBrt3MRYjCju/9tFetSB6bbco/1fWi4 uDJHFTSUey/Dw+lnuT7zTvs5f9wOS0pb2I1VEsdjkfW0t8CFDJSSL8am+gWXApztpc55 I+39yyv8WYgM0nDzkeWNy4dTPnHusB/Li1RoHseFT5Y+OzcSW/89ribE/03SeGExZDQZ WUSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043042; x=1792647842; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Ka0tNIP13fA6NTLmMi/qzJoPzc0yrxeGeXH++YZguGs=; b=oGYiQE9vYtzlDyKcwRPj9IYi32yx+X3VnvtAVdZryP64Hu+lnkaJYoCRR7byfbussa 3TwZ5u1/ekkShJtlbjRlx3eIw3Pe9betGUBedzF8jcvGtGMrMHs/S9RfF1/GIkXxOvxh PjHPzQxmq4pVyE4iF4ebt7ICSsjwXIFmM86SiiNqRs1KrwL5LCpWeGawjaIjJLdabAGq /LTL3pkwCjMFop5OOTkKPSn2Qv45Tl00zsGG+qj8p3HR8b+unUSeg+Pq9QgKpi4PgoC0 AR6/rinLa6ggDx+DRV2sv4GRWHT4gfJfWDZWcamfhk4Qt68ANFQMzYyZotP6iyTC1U3q EY/Q== X-Gm-Message-State: AFq9FYKOkjxMx3XWWL+bUn8rntN4D2pnNUgCNwLHfFkE9OuFvlXYhmLt enCLlwQ35pqr8hmbmFWboJptRe7pN/ueQZsDLLHjOQ/GcQMwZWRExfD5moLqYg== X-Gm-Gg: AYBFou3wbDUwvkKGBztDktXK644H6ECdeu0LJJAY6WRrTT6pB+FFyuZ3Ijkwd6NaNhB en4KJVNXI1cpvslwQKVvbsD5zhwoYhKK3QfB2nFGcEhPzNdTYShmniB6LKKoigbRquOpEaWfcA3 EMx3dmuFdCk7CicSOBpwnm8Rm+aCzJht5mRD/vWUeSuAFcVacdPsvcQR9D6CbfCD/78RZ/HcJsB LiVmkdlHsQUKxIgV9N4g7xST6TL3Xp4BKhPfl4qzSGFpnGXnfObKJ96fAGAnwgEqgDO3TwcCmt6 PbNXQIay86z4f4riaHRtr0kohybxq3NwLFElNleXP3VtxKntbNDA98oCcDxDjXWscdGkrjcyKTD vdYqVsmVt+Eb+CQXY8Ek8VW4ZqwCPHJmaSRUYvZ+nPb75SaGUc6a8gwPpRhpsRRKbbPbrSrPtpH 3z0n4NuieTPL7wmfwn7zQVgbQtDFC5PDnv/II60kgC6GiMBRFBAZudV5YwDvCWwLB8DVuDmtin9 jdn0IOe9+odIQVFkb3359M= X-Received: by 2002:a17:903:3243:b0:2dd:ad74:ac32 with SMTP id d9443c01a7336-2e842bc61a1mr157348525ad.27.1792043042497; Wed, 14 Oct 2026 22:44:02 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:02 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 34/82] libssh: ignore CVE-2025-14821 Date: Thu, 15 Oct 2026 18:41:22 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130954 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2025-14821 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 6541aefe606686445b5f7c7feb7eb4dd78ce5543) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/libssh/libssh_0.11.5.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb index d2f5072d1e..738f8b1731 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb @@ -48,3 +48,5 @@ do_install_ptest () { } BBCLASSEXTEND = "native nativesdk" + +CVE_STATUS[CVE-2025-14821] = "not-applicable-platform: issue only applies on Windows" From patchwork Thu Oct 15 05:41:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100831 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF731CC6B3B for ; Thu, 15 Oct 2026 05:44:07 +0000 (UTC) Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32817.1792043045293638316 for ; Wed, 14 Oct 2026 22:44:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=oQu8XUqP; spf=pass (domain: gmail.com, ip: 209.85.214.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2e5d0ee1951so30925185ad.0 for ; Wed, 14 Oct 2026 22:44:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043045; x=1792647845; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=qVITSVbl7xeJXRH7g7Re5urKiKlSHDaSKBKFmBAleaM=; b=oQu8XUqPjKHS1CS4fS3I3fu0Zf6uJN0QrHaABpslpxIXdG2exJoLDX4IrTPMnbzGiM XRyYUYTR0SAGSDnUGCRxJYTI9D5X3mtI9Tet7s1veSIzutblWxN1Nqfj8WkWxADvMYf1 0V1/jD7fr3IHMK2JJ+GEukKPJFTNTHS3NzakXh3Rld+Y39AJnzbeWXLVcEHhRqdKQqKR 2IHcZa6pmTkNU5ZlTEhwvt+i65aF77h8RmY8PFADl/RrEia+wzwqz2yA9SQfri/vhk3V zAKima7MxO+HgRsaU1NxNiyoLjEgt1oK48VTbEZZ+Y9Q1tEc++it2CvY35u11mHzSkPl pwYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043045; x=1792647845; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=qVITSVbl7xeJXRH7g7Re5urKiKlSHDaSKBKFmBAleaM=; b=0vP18UmXVBZiagriIrvaJaajP+lywGrou7kKX0qLn2fIuo/OZmvsPAmuowPwaRqDWj bN5l5c16QudCqL3pkdDBSVjKUw7wq3Qya4woHWLjkNY7mEkocN+zOAwjxzYzyzF96kSI lf2N6uWV7uRuCaBcdYL0gHks33+5XNQ//QgtK9+AdG+Falgi/EWi3fRIl9HwUP+soLgL uafRER49sQETbjc3FPUtv60CTHSVHNTEz0q0kPuGZNGI9g82pyGED3LUxxngefQEJeK3 haiyGyN44SUULfmOE2a4H8pdtpyoObpCNHDUMSlCk096qRnMr5NcNjZdDDKaEuxFB/Tt J4gw== X-Gm-Message-State: AFq9FYKkYheKCChGlEsGLRi/CrE6ao7T6cp1NWYHabUKjPHP+nGM/x4Y O8RAYzpsoXXjh8fBvR4igNpR+eZM2y+ZqGVOtqdPijcPymUX3l8qQXDoSgfxNA== X-Gm-Gg: AYBFou1C9eDwAstfiy5T3RiheEx7Yc1XlD6ftsu8X3Sx4b8xhymCs8fM6npUHv8z/CZ AkL1RqVv8S3M5DaTSic529wYeq4ImYL6nw8He+WiAl9p56y2NCmDDv7yp80GDhILpaJ+XR+NcnT WcfKztDOVucSdKsNsKg/fE1KAxOjqRzW/8jht0Opvc56MrvyIzYWgKxSGBGIvOx/SIBWhhEH5MH yDwmZZ5tz1SmqCpKw0C6Bvh/lXpZek5CbyYuuDQ4RhzMxaQPa8PSHH37BSdGLlFwKUptK64PNh3 /jF34QkxVH96DmU4HcchXSQH+q9UCyyZ+EoQ0OQrN5blNkJz5xVXdMqNou7jBdWDDJMgnnIEb+t qFDRGEApNvlHPK/HEfqUqlCM0Ame/ySmqNWjIaMCoJYocYhfzlO8aI+JZHtact3EyLZwmy/KeGI Eg0lIkhUPpxyGDnjaprEb6suBvkV6a50HIpTYoR3wZrOdBf3jWvOGloOHFqHphyTUiYSlgsGFHD 6d23Oh2L8v13+YP3YbpvOM= X-Received: by 2002:a17:902:e74f:b0:2e5:d2b1:c70b with SMTP id d9443c01a7336-2e842e07b59mr156249255ad.60.1792043044615; Wed, 14 Oct 2026 22:44:04 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:04 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 35/82] libssh: mark CVEs patched Date: Thu, 15 Oct 2026 18:41:23 +1300 Message-ID: <26f04746444b29ae4678709df67ec7a71bdfc51b.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130955 From: Ankur Tyagi Changelog[1] also confirms the fix. Details: https://nvd.nist.gov/vuln/detail/cve-2026-59843 https://nvd.nist.gov/vuln/detail/cve-2026-59844 https://nvd.nist.gov/vuln/detail/cve-2026-59845 https://nvd.nist.gov/vuln/detail/cve-2026-59846 https://nvd.nist.gov/vuln/detail/cve-2026-59848 https://nvd.nist.gov/vuln/detail/cve-2026-59850 [1]https://gitlab.com/libssh/libssh-mirror/-/blob/libssh-0.11.5/CHANGELOG?ref_type=tags Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/libssh/libssh_0.11.5.bb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb index 738f8b1731..a99c4ee788 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb @@ -50,3 +50,9 @@ do_install_ptest () { BBCLASSEXTEND = "native nativesdk" CVE_STATUS[CVE-2025-14821] = "not-applicable-platform: issue only applies on Windows" +CVE_STATUS[CVE-2026-59843] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59844] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59845] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59846] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59848] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59850] = "fixed-version: fixed in v0.11.5" From patchwork Thu Oct 15 05:41:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100834 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33CCDCC6B3F for ; Thu, 15 Oct 2026 05:44:08 +0000 (UTC) Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32821.1792043047634025821 for ; Wed, 14 Oct 2026 22:44:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=SiS5T/4P; spf=pass (domain: gmail.com, ip: 209.85.214.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2e96502e447so1394305ad.1 for ; Wed, 14 Oct 2026 22:44:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043047; x=1792647847; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=mJjzH92AJS/YH2ce8fGIUYLPv66ZYgIjH7lmFkApzEQ=; b=SiS5T/4PwcLz/zHHOj9ybPT4EBxKC510YFhDu4ivXAmJxd2pJz1EKwzDgkofzGKRid fetzFms9dS4jNoQEa4TyWAeQj9eVfMQRQz8RKZs3EiuVIWbkg+vMaUEYz3OtGzFjzro5 7SaR3zGoJOLSaCAeaMQQxAZyZ/+d30r6R5/c+trsqAF/W6Mhottowkn+6dWGPxh5Z71F 9gNVDMc2Lw0wQU74JvAyatQmfAu9CNxB0rE1oVI4A3W37pXF8wc0ubzvCFOHltPCcE/0 MOvWnmZeLlCjnbhxDSsIjwVBpz8iw2+JGBfROTnKxwhXsi3tRNbY3yqoHo86aK+T4fs7 0L/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043047; x=1792647847; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=mJjzH92AJS/YH2ce8fGIUYLPv66ZYgIjH7lmFkApzEQ=; b=i5m6A9UGMGOFIAy4IRjHrmTsCWyMOXjH+swnCZfOVJsSVJiiLLxJ6UQibep23S7nIZ 5K36jJRGa9h9kwsehgjIhjJOsTfae8P9gPAHT2M4VWw7gVnqMRxvxcZW3zHbmFN+Y0Dk q5wHogi42TtRrQM7g1Lqp8D71kPaMKbz14zm+H4H2Y0mII0x+XRpYtaKwOnu/7R7OCaP OY1q85HIwWj+EGK6Ym7ZcWzqNVt8DPk+uzQy7gBN4bU20kf7JPE6jr2mBX4NXKwcp19o B8sxW1M8MrzADgnjv9S2Z6Qb+AKqTO3uVmOPKDQk1kgYbfAuXbl8be0X0Tv9hcFRDcbb X1Vw== X-Gm-Message-State: AFq9FYJ/1t9EKZJFkcUcadKNQIBp+yBrMPUk+zSo35m2F2+6giFTFNqv SwgRsQY4w3UWdwxtNCXc7q4vojP38u+heWd3Yc/OYXaiZDdtArR1KfbgwO+J9Q== X-Gm-Gg: AYBFou1S1khEKs8n3hzEhB3AptNyYNtU+27rGRMqRI1sx9wmDqOtadN95rvZ5fppu+G 1VDkwjPXjWoXusU11DiI6J88oiAqc/7Qb2VQ7C9euuUU4c8TLIPKYUFQelNxVowebscNYEKxCON SlvQdPPF4S89XpHvX+hQoJmTyCanbr2h/WX8sNCsemMYYVswfkypBamK5/r+gupXuaj5+4Wdvju LH+wph6gM3z8ZPpmpT+oPNAuJ2Q+ATk13lhMiaxuSSFd2SzswcA+iC3m4X7aMcmxX1FTPz3lgWz rBge5n9oLPRYShbI7bjD5Le5foqRmyeah4S61KTJtO0DE+1deEj5J7C3YvOowgVSdZKNs4VIcgr 93M4TXMRqzR88erSUQiFVTuYZfHTdPSgUbiwHoQMRzMMBU5TYwxwc0XeqoHMz9pQL0jIpaLlW88 yp4Ndm4jcs0ETP5zpI0XTDUg4JoxGW16TWHw2O7d0k+8DORWUY2D0hp0pLbfLWkp1tlms7TnDCN Wm25KZAFQWIIo7w0wbXe0g= X-Received: by 2002:a17:902:ea05:b0:2dd:ad73:c93e with SMTP id d9443c01a7336-2e842abf8a8mr163539315ad.31.1792043046952; Wed, 14 Oct 2026 22:44:06 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:06 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 36/82] libssh: ignore CVE-2026-59851 Date: Thu, 15 Oct 2026 18:41:24 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130956 From: Ankur Tyagi GSSAPI Key Exchange was introduced in v0.12.0[1]. Debian also confirmed the same[2]. Details: https://nvd.nist.gov/vuln/detail/cve-2026-59851 [1]https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.12.0 [2]https://security-tracker.debian.org/tracker/CVE-2026-59851 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/libssh/libssh_0.11.5.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb index a99c4ee788..a67956df88 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb @@ -56,3 +56,4 @@ CVE_STATUS[CVE-2026-59845] = "fixed-version: fixed in v0.11.5" CVE_STATUS[CVE-2026-59846] = "fixed-version: fixed in v0.11.5" CVE_STATUS[CVE-2026-59848] = "fixed-version: fixed in v0.11.5" CVE_STATUS[CVE-2026-59850] = "fixed-version: fixed in v0.11.5" +CVE_STATUS[CVE-2026-59851] = "cpe-incorrect: vulnerability doesn't exist in v0.11.5" From patchwork Thu Oct 15 05:41:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100835 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27EFACC6B3A for ; Thu, 15 Oct 2026 05:44:18 +0000 (UTC) Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33249.1792043049693237171 for ; Wed, 14 Oct 2026 22:44:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=AIhi9pBf; spf=pass (domain: gmail.com, ip: 209.85.214.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2e49fbf92aaso28796945ad.0 for ; Wed, 14 Oct 2026 22:44:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043049; x=1792647849; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=3762WRPqgngK/ANfyMw/SS794fYDwkr0TqWj8F75NyM=; b=AIhi9pBf5g1Y86AFeXotg+ItrXL+BTvdDcdAiB9nAkzIiedYka58JOWzVYxfzKZbB4 hdtqzyynB2KlFgC1fsdkcOr9DT/G45b97eeOkZ1jZF7+8+3VfXN1m08BfKmtuLDy324n GxN9n63XF+5/3oimdnZ0yz3MbnXIzHeJTzyH++3jg/QMOMfQe6mFWzDOFdSi/g1BA6FV Kiaz+N0cERNXLsQWhQYkXKsO8fNBQPk2vVRSvSf+Mt1eVhHuS91czEoOEOrGKPJv8b8d O+K8Oz613LfP+AOM+13YUQez45RYKs1lNvKKVjZf4/IiZB7yZgihqnMgPWboH0BzzOvr YEPw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043049; x=1792647849; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=3762WRPqgngK/ANfyMw/SS794fYDwkr0TqWj8F75NyM=; b=SlKi/itc5on77sg3KbQ0/G2CXBEU3Fe/c9UC+FlFbuLVOkn1TDp02vgewfCilMEDBR 5LVLxMkecAUFxJQ6fR+ugQ+4GGH/tu/rzekd3hcqIhJiCvTdAf4vsBAnYrJ9noOSbHq0 8U5e5OX20DdTBkIOMMjWblbwS/FdcgQPtwEJyXW5pwM20BKUL4WRKAzuOj/59LoahiOy xMYMzRUTR+jafkxbtKFM30oL3xi/7eem+py64XJNlww7SC73O9WXq5s3n8QLyarWCBVv yROKojLEXvUxBpl08k1gEmMIHhvxAS8Gs2sYH2LFvyF7J7hQrA4ynYB59m+oqS4cYpI5 UxqA== X-Gm-Message-State: AFq9FYI53+ZFbE6IMzckMxSBNdbt7oStA5gpT4Fzgt5W1647dNgTd7Og XHD13q7pW671oXPFGPuPrUSdJr6vtz5zlVt+ipdtU/sqdhlaX9VMzhSBFOlgdw== X-Gm-Gg: AYBFou3/9pqg7hM1PeLxeHmt7cuO9A44V2AmGkW263RAPcH86Tv0wpIoje0TGpuPB6y DaBmuWINJLDaigP+h8XjRaktuYEwTPJtHgrEc22uDZ34soz4wi31252Ic7SxwTYwWf++1QYrCLK DNvgVA97+DECJqrlM5depbUd57Q97gq3dPiOMm8vev+HkSBcUwCQTQ49yVL2r/HiRNxrKGFCO3H hgrkoADb/vjoSQhJpRYhQ92oy6yADJrkJlDzXfR8yJ0t1Pl7ms3+MMoo0T/suGLb9WwfaLwocCW 8twA1Mv/eA8va8BqZhE02VeVlRsxQRJrFIatzBPYaO+Tih+eWIpM7+qN99MXqLY0ArZdi0tLkLQ kWDyUEIABpausTRcQX9hMsSgxC6SrscwPhCUAtD3vEhXGsDXjiGKfhLCjvBQKpStUC1dPxCHm9e 5yICSqKP3CUDYLEo/DKLnf0oJkz5mbftvDYRL/M7/B2wmpKLiqozpjrOKsG5Xmnx0Qo8jAv3ymV PsnZOo9js0WWJy2kZZuEyV09QbnVFoh2A== X-Received: by 2002:a17:902:d549:b0:2e9:6788:937e with SMTP id d9443c01a7336-2e96788968cmr1081775ad.42.1792043048932; Wed, 14 Oct 2026 22:44:08 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:08 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 37/82] miniupnpd: patch CVE-2026-107159 Date: Thu, 15 Oct 2026 18:41:25 +1300 Message-ID: <25ed07136216d19d481a4555f9e2cf75d5d92f99.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130957 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-107159 Signed-off-by: Ankur Tyagi --- .../miniupnpd/files/CVE-2026-107159.patch | 78 +++++++++++++++++++ .../miniupnpd/miniupnpd_2.3.11.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch diff --git a/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch new file mode 100644 index 0000000000..fa2401e039 --- /dev/null +++ b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch @@ -0,0 +1,78 @@ +From 8a3e282b22b16fc90740d62fe213c51696e8dc01 Mon Sep 17 00:00:00 2001 +From: Thomas Bernard +Date: Sat, 3 Oct 2026 23:42:55 +0200 +Subject: [PATCH] minissdp.c: MX: 0 is invalid as well. 1 is the minimum + accepted + +(cherry picked from commit 8f13b7a5843f5270db684099c0a083f98869636a) + +CVE: CVE-2026-107159 +Upstream-Status: Backport [https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a] +Signed-off-by: Ankur Tyagi +--- + minissdp.c | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +diff --git a/minissdp.c b/minissdp.c +index afb11ec..d825bf6 100644 +--- a/minissdp.c ++++ b/minissdp.c +@@ -2,7 +2,7 @@ + /* vim: tabstop=4 shiftwidth=4 noexpandtab + * MiniUPnP project + * http://miniupnp.free.fr/ or https://miniupnp.tuxfamily.org/ +- * (c) 2006-2025 Thomas Bernard ++ * (c) 2006-2026 Thomas Bernard + * This software is subject to the conditions detailed + * in the LICENCE file provided within the distribution */ + +@@ -1015,7 +1015,7 @@ ProcessSSDPData(int s, const char *bufr, int n, + #endif + #endif + #if defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE) +- int mx_value = -1; ++ int mx_value = -1; /* -1 => not set, -2 => invalid value (0 or negative) */ + #endif + unsigned int delay = 50; /* Non-zero default delay to prevent flooding */ + /* UPnP Device Architecture v1.1. 1.3.3 Search response : +@@ -1113,7 +1113,16 @@ ProcessSSDPData(int s, const char *bufr, int n, + memset(atoi_buffer, 0, sizeof(atoi_buffer)); + memcpy(atoi_buffer, mx, MIN((int)(sizeof(atoi_buffer) - 1), mx_len)); + mx_value = atoi(atoi_buffer); +- syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value); ++ /* UPnP Device Architechture v2.0 : ++ * MX ++ * Required. Field value contains maximum wait time in seconds. ++ * shall be greater than or equal to 1 and should be less than ++ * 5 inclusive. */ ++ if (mx_value <= 0) { ++ syslog(LOG_WARNING, "MX: %.*s (value=%d) INVALID (must be between 1 and 5 incl.)", mx_len, mx, mx_value); ++ } else { ++ syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value); ++ } + } + #endif /* defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE) */ + #if defined(UPNP_STRICT) +@@ -1140,9 +1149,12 @@ ProcessSSDPData(int s, const char *bufr, int n, + /* For multicast M-SEARCH requests, if the search request does + * not contain an MX header field, the device MUST silently + * discard and ignore the search request. */ +- if(mx_value < 0) { ++ if(mx_value == -1) { + syslog(LOG_INFO, "ignoring SSDP packet missing MX: header"); + return; ++ } else if(mx_value <= 0) { ++ syslog(LOG_WARNING, "ignoring SSDP packet with invalid value for MX: header"); ++ return; + } else if(mx_value > 5) { + /* If the MX header field specifies a field value greater + * than 5, the device SHOULD assume that it contained the +@@ -1150,7 +1162,7 @@ ProcessSSDPData(int s, const char *bufr, int n, + mx_value = 5; + } + #elif defined(DELAY_MSEARCH_RESPONSE) +- if(mx_value < 0) { ++ if(mx_value <= 0) { + mx_value = 1; + } else if(mx_value > 5) { + /* If the MX header field specifies a field value greater diff --git a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb index 42a654e327..920d33da94 100644 --- a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb +++ b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb @@ -13,6 +13,7 @@ DEPENDS += "iptables net-tools util-linux libmnl libnetfilter-conntrack openssl" SRC_URI = "http://miniupnp.tuxfamily.org/files/download.php?file=${BP}.tar.gz;downloadfilename=${BP}.tar.gz \ file://miniupnpd.service \ + file://CVE-2026-107159.patch \ " SRC_URI[sha256sum] = "91994b127da735b2c97f19992e34420648c0e8c4ace8a4bcb0596e7685c48678" From patchwork Thu Oct 15 05:41:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100838 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6EBFDCC6B38 for ; Thu, 15 Oct 2026 05:44:18 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32825.1792043051725133277 for ; Wed, 14 Oct 2026 22:44:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=qLi+D3zf; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2dd9cbb661bso35498315ad.3 for ; Wed, 14 Oct 2026 22:44:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043051; x=1792647851; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=b7dha++nqx+HO/t04qUjt7QKB5xMXwWH17uwD4kyq04=; b=qLi+D3zfFV5aTeP8bbPIhCBAwCs7fIKWCDWLAWh1GWlhLugWqtyzNDOIFA3w+ENDLe NAFwGRTl/sqrcOs55i5B0nM2FteCT4X0+I+MRdtuNpTUI7838+bVS4gMyZ00vIULTcUt gEKNawxnrVUquQAfm284mK+goja49ScvMNXWRc4ykKaqXUz1IubGnmrXGOViLf20/rt3 Ljgg6IrWar4594P+cJI924hLxpCZKAEPZdH/BPo/11x09EEB5KBD7PClhxz+1R+8HIgP nVK6Tw/1KMrnOps+sC+XNu43QdOts0ittYWCbFfs6471Eo2Cfu8jzjpTbO40ZcGndbc6 EjnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043051; x=1792647851; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=b7dha++nqx+HO/t04qUjt7QKB5xMXwWH17uwD4kyq04=; b=g1C1Vv3GbLnp9SlpVmyKJrRgbTCUZP8aAukTpOPz9bfaKnzmbd3wgPdQVorIptg4PW lTFpxEDGlkI/MrzeRbI2IyhprwBAP+8YlvIOC9eMx2f5RTsPvqNqgvEbLnWPshZK+7z0 R9H0dqW43T8E37g8DMo98300m3C0MQ+1Ez0Js27Cky5DxhkD5T4zxbE3MwJwpRo1wZOq weyfXnKSOK+Tp0pCfqOxtxpRKKVZwdJmLETle3KWhfJ0WSBnWQqLX5vK5kMzNNoFgkS0 PtTwo+ub8+Pu7HL3JJwJdmxRcXxObHvTX7/JdtuAktCUqmC/ML8SqdCh2NqR1iafPGdk MP0w== X-Gm-Message-State: AFq9FYLpDusLZhSqUdmpRRMDhW/AvBmcPGsDKSUnICe/7FlwrQnSAvXj JtGluuBCFQP3UrZKqa7b2b49GsNV3j5qRE4+ee7cBeJ6KZXe872yqAzOcZi3LA== X-Gm-Gg: AYBFou3tUYV3WVmCBfnq3IpAtVXHG0R+4bMfX6a4gIWcWI7zEZxiIB4YzTqtmicvcYR zhTIZVp8E80dzvKNsJPR/qDM5l1L1JC/KKjfVDsvPOZiBZcePSFn4fwn8VFSj+eIvpWRpccUB2x oDk2uVGRK39+VpRLiv+zyDuk3kRUlvFUYjYiRY6Y6F+YsIoaf4WIfHKVTYymyJPyWiR9PifQYvb uKRFp+fUG6vlzCX1nTf4MjW2foe3UcxW0QT9I8cGPxfo7RH/ABrapSZfYR11mExiyfFCZBhJ5Y8 vcogbvIL2wKxrqRcS5XE+IU/8bCruRN8X9/RIAl9+XAMLJUeZJxJ7VT229rGdbK3VXPMcC1kj7Q pYLCNyhqUSFFL5SALzDn6Wfc0Ydhl3M8xbi2ngk4dHfREsu1OMv7mSIuhfElaiRIaBnl4x9Hbw3 BlcdbRqUBmPihe3udiY+CHJgpYzSB65zN3cWavvVViqkyrHx7Oz8F5EbZ2Xa0Saox4GyuQfob+J UhOWudxhcMvBjA9uOPfZGd/FfBRzgTjJw== X-Received: by 2002:a17:903:1c7:b0:2df:3b09:664 with SMTP id d9443c01a7336-2e842ab03f3mr154636695ad.32.1792043051013; Wed, 14 Oct 2026 22:44:11 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:10 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 38/82] libyang: patch CVE-2026-41401 Date: Thu, 15 Oct 2026 18:41:26 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130958 From: Ankur Tyagi Backport patch identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-41401 [1]https://security-tracker.debian.org/tracker/CVE-2026-41401 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 6b06704ac1bae4ef4831384f0c28d14e98c804b8) Signed-off-by: Ankur Tyagi --- .../libyang/libyang/CVE-2026-41401.patch | 43 +++++++++++++++++++ .../libyang/libyang_3.13.6.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch diff --git a/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch b/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch new file mode 100644 index 0000000000..06537acbb8 --- /dev/null +++ b/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch @@ -0,0 +1,43 @@ +From 34b2a26ee86716e2b593c44e51e38ee15d4e8434 Mon Sep 17 00:00:00 2001 +From: Michal Vasko +Date: Thu, 26 Mar 2026 08:33:44 +0100 +Subject: [PATCH] parser common BUGFIX invalid metadata removal + +(cherry picked from commit 54c3276d871023da266d4ed3ceaee7e8d71d0b04) + +CVE: CVE-2026-41401 +Upstream-Status: Backport [https://github.com/CESNET/libyang/commit/54c3276d871023da266d4ed3ceaee7e8d71d0b04] + +Signed-off-by: Ankur Tyagi +--- + src/parser_common.c | 4 ++-- + tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + create mode 100644 tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 + +diff --git a/src/parser_common.c b/src/parser_common.c +index 0b221af72..fefe723eb 100644 +--- a/src/parser_common.c ++++ b/src/parser_common.c +@@ -413,8 +413,8 @@ lyd_parser_set_data_flags(struct lyd_node *node, struct lyd_meta **meta, struct + next_meta = meta2->next; + + /* delete the metadata */ +- if (meta != &node->meta) { +- *meta = (*meta)->next; ++ if ((meta != &node->meta) && (meta2 == *meta)) { ++ *meta = next_meta; + } + lyd_free_meta_single(meta2); + if (prev_meta) { +diff --git a/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 b/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 +new file mode 100644 +index 000000000..7e3b6c39e +--- /dev/null ++++ b/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 +@@ -0,0 +1,5 @@ ++5 diff --git a/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb b/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb index 822c30ba24..7724b4c218 100644 --- a/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb +++ b/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb @@ -11,6 +11,7 @@ SRCREV = "c2ddd01b9b810a30d6a7d6749a3bc9adeb7b01fb" SRC_URI = "git://github.com/CESNET/libyang.git;branch=master;protocol=https;tag=v${PV} \ file://0001-test_context-skip-test-case-test_searchdirs.patch \ file://run-ptest \ + file://CVE-2026-41401.patch \ " From patchwork Thu Oct 15 05:41:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100837 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9CFAECCA460 for ; Thu, 15 Oct 2026 05:44:18 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32826.1792043053706728898 for ; Wed, 14 Oct 2026 22:44:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=i6sUw+61; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2e96502e447so1394625ad.1 for ; Wed, 14 Oct 2026 22:44:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043053; x=1792647853; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=KpMwLnL6wAqNevPu8zxDJVvmLS6nwimunZtoBl7R2S0=; b=i6sUw+61wIvPbARNO30hL5CcfMRL+1z4a3OBCgwHzqXRS6aJxv4vkVX0DRZBeDwGmR iBwMGBcvO7xQWsKBOV1HLRMRC2nGOjFRZDajr1Owz/Hksy0ZpG0c3uPxn3mHtCTLEJlX H8iRugI3b9RDWHmCVhXCOf8ZRzfY/BBRwazP4Nzhequ8aaaWbsm0vK9TLBLHCGMqL2r4 n+EuU0/rC8vJVUK3ORVrf8lPnjRqQmajdJw9AU6BhgsrO0tIsfipYJIKeNg9fg4lWPYL 4Mx7mslK1fQrpCEGlTFg1N6gFEKgyQ7sKwnPdK6aGK9o1ef6af8YwJDKHIC2JAg1BlmY VGPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043053; x=1792647853; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=KpMwLnL6wAqNevPu8zxDJVvmLS6nwimunZtoBl7R2S0=; b=I/HNUrI7cKkUlk2qExl1ZKH6Ykiy1GruFprawNVS0x4FfGyMKITIZZbyHFmuq9KEhe O3rMG2ZY1/UvtM30RB5gEs0nieXsIyjNwPKevdM1U8fBItS195EH9da11aElYCtZwMhw Q9EcEmucrk+hwQw19ssD7lDeMF+wCK5C+l8E5r9xHYy7RqMI8E6eSo6E2Extp0oPnUpG nm3tiugz1zWS7rGOFdkD8JO8UbleavqDbBUKS/k7OGuelRF4F+EY4+WfqA1jRIjNk9y1 Dbcb5TDYf2nwUWT3I+4tfMzv2QQOnD3gTY08WMes8G7xZm5yr4iTw5RKAsOp4QWfUQCq EvEw== X-Gm-Message-State: AFq9FYJ8lW+QIgvTxT/85F1RU2xp+hAMkj1baEN08JkAsA+YNTJTPCYY 7yT0Jhnn1iZ1mu9njLMynMFj1FDz7P9rt7mgvThQvH4SEvpzAF6TU5V4jNO8DA== X-Gm-Gg: AYBFou2j/wdiMt8WrsTN7qS72K8WFTjBygi8Ymwm59W5cqKLCtyvyLj1E9JLJSXJOaR wOJhOBeFZsy/ex2wEvSnE5dGJdrcMcXjOPzL8cCuTRY4OZLkAWqOEx7Bnbr+PrFr/g/jfbM/KCp EdYcSirdMb2snCKYgVXKnmUcO1kLOT4860WEor2CZFJ5ZFEhpZMtPEN1/bg//kAPcP0gMnUNKAr 2pYz78Xeagh2TQF/TlZKxKzhHq7fMY7zFxpasDFBiP/rlHyPGxdHG1nGnwPdtKj4Vq4qPQIwKDZ THeialum/r5IDDt/Mv8kg2Zopmr9Riryq19SmMede+EhGhR6xway3LCkRzeYbga30FUOr3ChDpX xVKW6ENxI46K21syK7azLuX0tZk7uiKBxu/NIBZJQmwVnd0+oljWDuyjxbMSdLBPQgX9uq9miwj 8FS1Y6m+DEheuMuRN20fA0xvKFHGRF9QnqN4lgCcThVca1O9cMKUwrFGREBPU/oQXSqyV7tMEVE iklY711DALiSF62oHqXpSg= X-Received: by 2002:a17:903:291:b0:2e9:5a8c:5ad5 with SMTP id d9443c01a7336-2e95a8c5ecbmr11471065ad.20.1792043053013; Wed, 14 Oct 2026 22:44:13 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:12 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 39/82] tinyproxy: patch CVE-2026-31842 Date: Thu, 15 Oct 2026 18:41:27 +1300 Message-ID: <53ec96a06c93c49014d2890fff2554e549b6503d.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130959 From: Ankur Tyagi Backport commit identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-31842 [1]https://security-tracker.debian.org/tracker/CVE-2026-31842 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 985acd9e7c375e17a674be4c21e9e80d0259eb38) Signed-off-by: Ankur Tyagi --- .../tinyproxy/tinyproxy/CVE-2026-31842.patch | 33 +++++++++++++++++++ .../tinyproxy/tinyproxy_1.11.3.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch new file mode 100644 index 0000000000..6b8c02d629 --- /dev/null +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch @@ -0,0 +1,33 @@ +From ed5252d213a68546feaff68e2b40e401d2c2afd4 Mon Sep 17 00:00:00 2001 +From: rofl0r +Date: Fri, 3 Apr 2026 11:21:23 +0200 +Subject: [PATCH] reqs: fix case-sensitive matching of "chunked" (#605) + +the chunked transfer encoding needs to be matched in a case- +insensitive manner. + +closes #604 + +(cherry picked from commit 879bf844abffa0bf5fae6aff0c73179024dd9f98) + +CVE: CVE-2026-31842 +Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/879bf844abffa0bf5fae6aff0c73179024dd9f98] + +Signed-off-by: Ankur Tyagi +--- + src/reqs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/reqs.c b/src/reqs.c +index 7aacfd3..8b68538 100644 +--- a/src/reqs.c ++++ b/src/reqs.c +@@ -850,7 +850,7 @@ static int is_chunked_transfer (pseudomap *hashofheaders) + { + char *data; + data = pseudomap_find (hashofheaders, "transfer-encoding"); +- return data ? !strcmp (data, "chunked") : 0; ++ return data ? !strcasecmp (data, "chunked") : 0; + } + + /* diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb index 2555d2132d..a0ef5fd62f 100644 --- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb @@ -9,6 +9,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz file://run-ptest \ file://CVE-2026-3945-1.patch \ file://CVE-2026-3945-2.patch \ + file://CVE-2026-31842.patch \ " SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592" From patchwork Thu Oct 15 05:41:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100836 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27E2CCC6B2F for ; Thu, 15 Oct 2026 05:44:18 +0000 (UTC) Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33256.1792043055858489663 for ; Wed, 14 Oct 2026 22:44:15 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=F3DMWlf0; spf=pass (domain: gmail.com, ip: 209.85.215.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-cc4b1f7e8f4so3105722a12.1 for ; Wed, 14 Oct 2026 22:44:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043055; x=1792647855; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=yjMuhQW7f9vMGDAtuTU7ix7lI22AZtBoFYZExtcwAyM=; b=F3DMWlf0NE4vm3XwFFBIegdQDdEbPtRuVuceKH2g9bvfGNsXUWNduYNsk7VKndD/O7 srAQe/ap1utCmmedfgXodyNWu5YEr4G0t0DxcCYJ7Fsc9Bsb9K8YCOXgk970ryLxKMzA kcx0ReozH7Zz19PBohes0Xyd50GIYshJZY5UAisTAICxcjZS/UrI0zeLuDFIsHlUle7g ar7vEDUUZKjaYrYNZ4cWhiZf8mzGDVMdY/tnAjk3pMvrF+loxJ8u4Knibg7twrE+hbz2 6SSLzpcoEcvr2BHN8vLeaTc+vHKvuXh/+RP2r51XU0QzC5r6qsmrIKxB0JPHlgKuS+UN kpRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043055; x=1792647855; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=yjMuhQW7f9vMGDAtuTU7ix7lI22AZtBoFYZExtcwAyM=; b=MIHrq6YxDcpj6Yg2HwUKSpep5/TeQE7NwusYpCTL/66R8iS3QIUsOd7vUp1oJTawmP AJU0ZjZAlN6ptg7b8D0SsumkAKAQw9a5g6tYUyQfIDCLvYkkpAMOiLfVtjUWP+T6aqhs /yMwpbHmkBT8b9j0cnNd5zBql8Pp8xVoQxZCKraLNFy3jjnXJIGgsGZm1IhRadCTPMva WATpaUGrCGLwN7lEq1UMsSifNy2Z876xEzJBTXxWX6nQtbvqUa9GWbmrYxyGmyACv/Gs de8va17Z3o6zE1z9ZGgOmYAQD7dD642cZOWmpnmZyc7zOOcWGoHwt1Z6QzXi8fYBLh3r MZIQ== X-Gm-Message-State: AFq9FYLJal0Y7lTkkxCo4BUgkds5tW37+ekFC8sqSp582u+U5Gce0owy Ng6ziN4G4VVQe3xqdKs+UQqg76Y0w+TuyOFX/87lkWSV8zUSOB4HhXs+7t1vsA== X-Gm-Gg: AYBFou1fxsJiDCyvRjsQgasf7GDLBsQXrRdF2zzHCcev3ZxMTzOaGK+Jn1Gjf50F1tS RwHDoflcF46eo44Z9HnId7QXmLbMKISzP6dJZ4u7Dt3NmedttQgGTYBvAU/tqDMwjfA7wH8knb8 5mthek6ZBJVlGYLGjcXKGb1jE1ye7mAkrKJ8G9JZWtJIk4NoDxP+CLkoP9b/5Y3cca4pwuHTGFB WuSkR1gIxlUc6oiSOeAw0itmbPwG+qxWCZj+qULMGtwzm4+eDgCIVgkKFMus3tc9n9ISkY24ii8 eA4As0PTeLYNyhCslqr/36pQf3c9rT+ntBMOSKDuSfyRHrqsviYdUHE7EiA7XhYJMUUbOfbTk7k WGRIdR64+EUtr67X0mbyDXaRL2/vUgifQRE+8EzsITY5HWSO6wUW7q5mRZEcwoh6m5ffBF54IzZ uXpT5CsH5vI+id5vZLqDDuwkKwpoRiMZ9UOvDrYITGG32fVO+Q1Ohz8VBvmmwnORfgn1tOtLrlL yk5tn9naxhZfRUWn1VzUzpXxL0CARCvDQ== X-Received: by 2002:a17:902:cf0a:b0:2e8:b5af:22e0 with SMTP id d9443c01a7336-2e8b5af2c29mr97649975ad.41.1792043055042; Wed, 14 Oct 2026 22:44:15 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:14 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 40/82] tinyproxy: patch CVE-2026-54387 Date: Thu, 15 Oct 2026 18:41:28 +1300 Message-ID: <1247ca6a89ab6acdd8ede30eb66555b3d86619d0.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:18 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130960 From: Ankur Tyagi Backport commit identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-54387 [1]https://security-tracker.debian.org/tracker/CVE-2026-54387 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 33649b065762429d18d1d9e9ec94deedb6edb63a) Signed-off-by: Ankur Tyagi --- .../tinyproxy/tinyproxy/CVE-2026-54387.patch | 37 +++++++++++++++++++ .../tinyproxy/tinyproxy_1.11.3.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch new file mode 100644 index 0000000000..c0199c1713 --- /dev/null +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch @@ -0,0 +1,37 @@ +From a9602e492cedd5d5d18dd3675d9be90e9b0d9e66 Mon Sep 17 00:00:00 2001 +From: rofl0r +Date: Thu, 7 May 2026 16:33:11 +0000 +Subject: [PATCH] reqs: prevent request smuggling via both content-length and + chunked + +addressing point 1 of #609 + +(cherry picked from commit 623bfc093df009296f0b85d40bc677ef9d5c09bb) + +CVE: CVE-2026-54387 +Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/623bfc093df009296f0b85d40bc677ef9d5c09bb] + +Signed-off-by: Ankur Tyagi +--- + src/reqs.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/src/reqs.c b/src/reqs.c +index 8b68538..e3cfe76 100644 +--- a/src/reqs.c ++++ b/src/reqs.c +@@ -942,8 +942,13 @@ process_client_headers (struct conn_s *connptr, pseudomap *hashofheaders) + connptr->content_length.client = get_content_length (hashofheaders); + + /* Check whether client sends chunked data. */ +- if (connptr->content_length.client == -1 && is_chunked_transfer (hashofheaders)) ++ if (is_chunked_transfer (hashofheaders)) { ++ if (connptr->content_length.client != -1) ++ /* request smuggling, see GH issue #609 */ ++ pseudomap_remove (hashofheaders, "content-length"); ++ + connptr->content_length.client = -2; ++ } + + /* + * See if there is a "Connection" header. If so, we need to do a bit diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb index a0ef5fd62f..e84aeae53c 100644 --- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb @@ -10,6 +10,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz file://CVE-2026-3945-1.patch \ file://CVE-2026-3945-2.patch \ file://CVE-2026-31842.patch \ + file://CVE-2026-54387.patch \ " SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592" From patchwork Thu Oct 15 05:41:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100842 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2914CC6B2F for ; Thu, 15 Oct 2026 05:44:28 +0000 (UTC) Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32828.1792043059190135930 for ; Wed, 14 Oct 2026 22:44:19 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Ps0m88oD; spf=pass (domain: gmail.com, ip: 209.85.214.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2e940d5d2beso5642075ad.0 for ; Wed, 14 Oct 2026 22:44:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043058; x=1792647858; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=XRQZMRu1IRqhE51CH+TT88hrWKuyBssDXetAC5x1E7w=; b=Ps0m88oDNyewk1bxxyyA6GG2pCsSAKfrRWSSMZDrbnum5lioTnu6p1Dm5YGDf2aqYZ hDfDATfhnVr4XgrkGNcMzq5erCh7nQnk6hszC6kU1CxWKLG7+vO3lVsv5kVLe9/HcEbL Wrr3Rs4wdKE1UlZdAadi+JL8s8ZiwS+A+E6GITlf+irS7o0QM7wFiCMApMLofIrKx09P DuI6fs6aEJ8RmE9A3xJFQ4WUBXbhu2kcUrNbt3ynzMieZofVGAtaay8X9FlPn2slME1t afGUJtyeY+Ojr1RyaWRj3ECUMoiH68Y5CykbJjQGNbIS646jGOSxc4FP8Q7ADFCUJtGp d/8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043058; x=1792647858; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=XRQZMRu1IRqhE51CH+TT88hrWKuyBssDXetAC5x1E7w=; b=lH0iejNYQh0Lx9asYReAwWnniCK3eFxslExMlvugekcsy69Sf0D2DULhhAwmN4ie8g f9ycerLvqxuz5oFk2DeIHT7XY5lM/WftiM3X74tlBNjda9jv5TysoAYWW8XjNH8It9Jy bLAqKwRT+hm/Nd4SYNbzqCOOYNs8nXygzQj+PLx89kPMDzxl7j5HKLv61B+fBeUrBMKx ocLTlIbErg53ia1Zfzi+KOLf7+atXONFtUVR8pBktp7v0ln9V/JDml41iyAb3Z0YQ9hA tjkCuWnjQmQ8hUC0i33PoHejh5csAFFitxVzAhmT1mZVLqH4dtsBHan8xX/pwEqiZ9KD Q7qQ== X-Gm-Message-State: AFq9FYIF9G1ZPJZ+wIQy/9ssRDZh06nw51GC4ko5fC/0e+Nn/lc5YqzR EHfAmPQSn8j3hiJRmx/voDmgi2DdXdws6epFHJ68Lh2pdTCHkJZ4eKKPfzN6MA== X-Gm-Gg: AYBFou2Bnw4YH1LGAwQyOjESnbAkp81sMttYeTzzahtFoC8Np6V7AHWjCyTRwfseSW1 Gjn2jsdfHhEJ3cpQXdbavzzP3mEUqB8WSDavnIlujcpDevL4WEqs09vCga/+9zs0BLEKSY+49i/ ZYVG/Ohw/rSXKvP+T8l1CcouoXFTQyRg8wbYUdYNT+Aa7qJYx2l26N5TbvGe32uw52pBtoetwtz fGfojb1FG6E9V2aeuaCW48auV3Ebgo4uxjGt3mnaiI7ObfEYtzf/MEyYaCWdBCvMwYMhrzGfXjS Kl3UbJsBOJP0lxy/ulPMg3exZXEZdvEyb9+FDjyQUdwos4Af8ago978fO6oaGSOGYuMkFDp0G4G C/n+Pob7Yjh5Q3iCfy/rJDot2WwOsrPEX7Kst2zwPBKFW4B2so29PsI7YuH5/l3gw+zz280FiN/ hIkrD134MIWMUi8lVuQIF6JOdyI3CeSVe5Rw5eE8R/gh7liO+WXG7KIz0HonYuTwJSZcE5v81j3 soOvFqVNhwwHz5D3wzX3RI= X-Received: by 2002:a17:902:d4cb:b0:2e9:3dd0:c7d with SMTP id d9443c01a7336-2e93dd018f8mr35751525ad.20.1792043058476; Wed, 14 Oct 2026 22:44:18 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:18 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 41/82] tinyproxy: patch CVE-2026-55202 Date: Thu, 15 Oct 2026 18:41:29 +1300 Message-ID: <7c8cd0805fda2a804d16c22f79b68760a2537a19.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:28 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130961 From: Ankur Tyagi Backport commit identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-55202 [1]https://security-tracker.debian.org/tracker/CVE-2026-55202 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 233e6a56e5311eff91c8a46c36a790db1fb38933) Signed-off-by: Ankur Tyagi --- .../tinyproxy/tinyproxy/CVE-2026-55202.patch | 107 ++++++++++++++++++ .../tinyproxy/tinyproxy_1.11.3.bb | 1 + 2 files changed, 108 insertions(+) create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch new file mode 100644 index 0000000000..4e446542e2 --- /dev/null +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch @@ -0,0 +1,107 @@ +From 04b34f814076d790db26925d7df7c30798910c99 Mon Sep 17 00:00:00 2001 +From: rofl0r +Date: Sat, 18 Apr 2026 00:03:15 +0200 +Subject: [PATCH] reqs: improve stathost detection (#606) + +until now, only the basicauth code checked the host header, regular connections didn't. + +- add a new helper function to compare a hostname with optional + trailingcolon/port against the stathost. +- add stathost check via host header before transparent proxy check, + else stathost might be misdetected as a trans host request. +- refactor existing stathost checks to use the new helper + +this should make it easier to access the stathost, for example by +injecting a host header into a curl command line with -H: + + $ curl -H "Host: tinyproxy.stats" 127.0.0.1:8080 + +the stathost can also be specified as an ip address, e.g. +Stathost "127.0.0.10" + a separate Listen statement for that ip. +in such a case e.g. + + $ curl http://127.0.0.10:8080 + +would work too, even if curl didn't add a Host header (but it does anyway). + +(cherry picked from commit 09312a185ae25cc486b4ff5987638a7917a48bce) + +CVE: CVE-2026-55202 +Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce] + +Signed-off-by: Ankur Tyagi +--- + src/reqs.c | 37 +++++++++++++++++++++++++------------ + 1 file changed, 25 insertions(+), 12 deletions(-) + +diff --git a/src/reqs.c b/src/reqs.c +index e3cfe76..d5037cf 100644 +--- a/src/reqs.c ++++ b/src/reqs.c +@@ -316,6 +316,17 @@ static int send_connect_method_response (struct conn_s *connptr) + connptr->protocol.minor); + } + ++/* determine whether a hostname with optional trailing colon/port is the ++ stathost */ ++static int is_stathost (const char* host) ++{ ++ const char *p = config->stathost; ++ const char *q = host; ++ if (!p || !q) return 0; ++ while (*p && *(p++) == *(q++)); ++ return *p == 0 && (*q == 0 || *q == ':'); ++} ++ + /* + * Break the request line apart and figure out where to connect and + * build a new request line. Finally connect to the remote server. +@@ -384,6 +395,16 @@ BAD_REQUEST_ERROR: + goto fail; + } + ++ /* ++ * Check to see if they're requesting the stat host ++ */ ++ if (is_stathost (pseudomap_find (hashofheaders, "host"))) { ++got_stathost: ++ log_message (LOG_NOTICE, "Request for the stathost."); ++ connptr->show_stats = TRUE; ++ goto fail; ++ } ++ + #ifdef REVERSE_SUPPORT + if (config->reversepath_list != NULL) { + /* +@@ -497,19 +518,11 @@ BAD_REQUEST_ERROR: + } + } + #endif +- +- +- /* +- * Check to see if they're requesting the stat host +- */ +- if (config->stathost && strcmp (config->stathost, request->host) == 0) { +- log_message (LOG_NOTICE, "Request for the stathost."); +- connptr->show_stats = TRUE; +- goto fail; +- } ++ /* check whether hostname from url is the stathost */ ++ if (is_stathost (request->host)) ++ goto got_stathost; + + safefree (url); +- + return request; + + fail: +@@ -1688,7 +1701,7 @@ void handle_connection (struct conn_s *connptr, union sockaddr_union* addr) + + if (!authstring && config->stathost) { + authstring = pseudomap_find (hashofheaders, "host"); +- if (authstring && !strncmp(authstring, config->stathost, strlen(config->stathost))) { ++ if (authstring && is_stathost(authstring)) { + authstring = pseudomap_find (hashofheaders, "authorization"); + stathost_connect = 1; + } else authstring = 0; diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb index e84aeae53c..25df44301b 100644 --- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb @@ -11,6 +11,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz file://CVE-2026-3945-2.patch \ file://CVE-2026-31842.patch \ file://CVE-2026-54387.patch \ + file://CVE-2026-55202.patch \ " SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592" From patchwork Thu Oct 15 05:41:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100840 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1810CCC6B38 for ; Thu, 15 Oct 2026 05:44:29 +0000 (UTC) Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32829.1792043061164867530 for ; Wed, 14 Oct 2026 22:44:21 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=I95wwa+K; spf=pass (domain: gmail.com, ip: 209.85.214.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2e608cd460eso26541815ad.3 for ; Wed, 14 Oct 2026 22:44:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043060; x=1792647860; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=5nMTyb0vKOi3P//qeXlTLkqofKMU3vrnbV4IpQhFZxM=; b=I95wwa+KY50yL7B5B0Rny4v7TkXO5ppOFNwn/ldP/ggGPfYpYmG+cgP+kBp/b+9SG2 7/E7AighPVImP1U4VgHLzf+97NTMcTgnNBg3rPGe9RYauOxMTgoWnBH3iL/KMBSiSDEL 4blkucfM+QFpupgkUS2IFgjlLUVnSXRmBN3lKUCswxR+BuhLCRhhEHK7fH4qsP2iDda0 gzCal6J6DL9Z3FiFaruo7vP6qGlncrbhjZtGczzFq5+stJzSKi7Rxc+2AKUqHseXdXw2 bWXZudr7+YpcjKXA0GTuvDTGBUmBV0p7BLaLnpumC7XaAHIrr07EkT55/MCyXBpE23nI iJmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043060; x=1792647860; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=5nMTyb0vKOi3P//qeXlTLkqofKMU3vrnbV4IpQhFZxM=; b=ZLmZEWI19ItZUNk1LDAzvfDzrzpd7Mbu79JK+23wUDZb1RTVS8YaK+pCWhecnoWw6y hFAOxSCUwjF8YoJts6MZKAkSKXs3ejqkpABFCC8TrON3RTxa4ORjWfywMpRR5EO2Kbdy 4XuoQhtC7NER4rXQ7SyaGqxzRIwmKlTHA0mUIgmvIQfChSU1wkmgFyI+JIGuhTNsgkla SyRSHIx5B3mxc66LrjfQ/nbVaKi4pqYBBlxAdH2pn0rsfAu3QZCYws6wymYkBGmfMKw8 0QESZXZ3lUKblraycmn3ugqW+6EbGZBclTRVicOBN0dZ/4xNDwYebT6DHUGUpRDcwhQY fNPQ== X-Gm-Message-State: AFq9FYKVpPY1fLE7lnNjg8Q8yScKdMrHBCRhUrl8K3OE/m722OsDlkGF EtbNyfBxLZiIUYZR7mT1bJxQXMe1g7gsnHIQuzmnmTnoTIXzXDakjdLdffyvdg== X-Gm-Gg: AYBFou2q5ls2qfrA3BOw7ZIOj8xDRIwYpVU4mEVHFNgja1WRp5Cm21mXbxKy4smLu+x U5nJQEPA4kVRtH/PCBTer5u7lExRdU3MTYrKDxTMq20L8qKdAma8T06aOZ9lF2xJfmDFWs6V69T izyizPeCc2NB6N1AW7l8JbVjHYDqHGDFPF7uJO4yCzehqRFcMacgVXD1Q68pi9GAq2M9HAlJgrv TLcb3db0gb+/6RnGlUhIJJco0ICAf6pQ7QZebCpehbf0ba+2++OS67oRsY2pDE1TxOf/HET5kRP 5KxkYouk/AhRgm/GosiSupVD9KICxPjg4h5skqVV+HTJi2ThL00MQ+JseX6AH68e4/vpo15riAa LzeawrSyt9HWcQmQcsPP1UjWjgAfy6sz1DcYdcL0UFTnkrDu7VCrn9Rt7pEEVDjjTIm39E2NYGH 48RUKyYtA3/0dTDCR+6dB65hUJfoIBZtxsqMCgIqetHJdxJAbBmUKPwPHtBwzIKLjQYFxWuyx3t YpOQrSiRLe0xvslMc5nte8= X-Received: by 2002:a17:903:38cc:b0:2e8:773a:e902 with SMTP id d9443c01a7336-2e8773aeaafmr128851695ad.58.1792043060386; Wed, 14 Oct 2026 22:44:20 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.18 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:20 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 42/82] wolfssl: mark CVEs patched Date: Thu, 15 Oct 2026 18:41:30 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130962 From: Ankur Tyagi CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version. Details: https://nvd.nist.gov/vuln/detail/cve-2023-6937 https://nvd.nist.gov/vuln/detail/cve-2024-5814 [1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities [2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit c12fcc9b481d5fcd94db96cd062042301a4f24b1) Signed-off-by: Ankur Tyagi --- meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb index 8fc6068560..a2b41b2d3c 100644 --- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb +++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb @@ -72,3 +72,5 @@ CVE_STATUS[CVE-2026-5504] = "fixed-version: fixed in 5.9.1" CVE_STATUS[CVE-2026-5507] = "fixed-version: fixed in 5.9.1" CVE_STATUS[CVE-2026-5772] = "fixed-version: fixed in 5.9.1" CVE_STATUS[CVE-2026-5778] = "fixed-version: fixed in 5.9.1" +CVE_STATUS[CVE-2023-6937] = "fixed-version: fixed since v5.6.6" +CVE_STATUS[CVE-2024-5814] = "fixed-version: fixed since v5.7.2" From patchwork Thu Oct 15 05:41:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100843 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28CD5CC6B3A for ; Thu, 15 Oct 2026 05:44:29 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32831.1792043063734425620 for ; Wed, 14 Oct 2026 22:44:23 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=rBVuNcc/; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2e8fe8e343fso19139025ad.2 for ; Wed, 14 Oct 2026 22:44:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043063; x=1792647863; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=410cQXAPwpLj42NqWqZOPmkjIHcRoGdRu5fN1xO3Hrw=; b=rBVuNcc/0rnV25DmW95AnTAEbffHKOP+JcDagZXQrntISDqtVp71CLKRgXk//UXmd7 we6Atk3NRpzhAXOJTVkdC/PfQaw/ZDeJf1CiDHNWf+EUkEh6mu/9LQmLYlTwnSg/Jun2 7ir1NHaC42l58wxC6Hp8Syhi3rSMmvpw0kbYnFfQGoJmlZBsMMr2mvHcqewAvkuWrOUe dtBX21JaBHRtsbAybWLcyf+y46hh0RBAPGEHGixiKcCJvkULiBujzyRapvndqxqs0i7T PBuH6XVKtM9nmALnqAPkG/gbpYXK6rCzCrrOSUKgsc6GZvMv4vdaTxbEq6zSu19fmTRz VUvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043063; x=1792647863; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=410cQXAPwpLj42NqWqZOPmkjIHcRoGdRu5fN1xO3Hrw=; b=BVnfHitYoJGdvWKwSk7NjMDsQKZYPOHSekiUZqS4oYXNg/Zoe2x700SyPitfi9Q3Qu KESl+FTe19+ZvaYRZpmgsuRa2A4/lEVgJ0OJ1DEh6XXZZxy8GJu1YHP3shNMYdWQAdG4 M2UUQvrOU733QBJ1xdKPYPaiRd7IS9+Ys2Lla3/hD2YcKdHdR+m+UBnASKlMS5o6FYr+ 2uYHlmGN/vnSDLNzKJgGD10Yy6jogm2ukyNSG1DZ2QwdDz4e+DFQNKS/Q2bFkXvQAcMt ItrRgWNd6welNSH+xXDyKPVZo2884GthBTtCWIWFq3sYepI2FnsZJWs7VChyETnAnxV6 B4aA== X-Gm-Message-State: AFq9FYJ/p9d+hi3cmnTLJebpb5wicfg8a8W+9jXBMpdHKRgF2lIwi4R/ 4fFNzGOCqqu/5G9iEv/NVx/3WGcRairf5W5MkGg9HEJNutkSnx6H7lhKIiER7g== X-Gm-Gg: AYBFou3QNbi+I4yUQW/IVxwyaAEvjgRJ9DzgnZuBqgFoUB+8OA3dZZvPeIH+x+7YJmd Y9tvOQBV+PhIg628wYTpWpaD+2+lZcISOc9Cp++a6FOUj3+D1Hi/79ZdqCe8zS4Yy8jciyoJI+V UV4ldVNjxp9sOGLPffuoYQ7vcAhc2SkAoTx8Eq6W6SISiC3vWm8taZCAsP2dhQILY2ywYhaVxrL z+J4N1EvINqL5HnE6R5WymmOPVBFiLEn/QjTOQOBvkjx2VMl/LIJRnJ/Ug3t7DGVhH0ZE9uXI5U giNR7cO0X+e7eEe3YCWCKUhd9JHe2dirbV7bYlJvQSFKkmCiEOkw+xd6M8QfTATO+fi05kOhcEt 4hlfvV4b+Kv0WSjHLNH7s4KZlr9CdevQJ0YrUAMbSzuL295N8yQbimvFJCVflU1xSXbVVtGkol+ +OZOSDBvGJJZtyC1pXlrvKaN02poTY5t5GQDypRTBrmsQBhqlH27FkozOi7gu9/1igVEILWZpGE sa1i57XCAcHEfMfP2HPqYA= X-Received: by 2002:a17:903:19e7:b0:2e2:c84b:43e9 with SMTP id d9443c01a7336-2e842837a3amr168425045ad.1.1792043063054; Wed, 14 Oct 2026 22:44:23 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:22 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 43/82] python3-gunicorn: mark CVE-2024-1135 patched Date: Thu, 15 Oct 2026 18:41:31 +1300 Message-ID: <359cbb2b7d80678192535944bca28e0f4a85193f.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130963 From: Ankur Tyagi Debian[1] also identified the commit. Details: https://nvd.nist.gov/vuln/detail/cve-2024-1135 [1]https://security-tracker.debian.org/tracker/CVE-2024-1135 Signed-off-by: Ankur Tyagi --- meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb b/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb index 545947446c..e19be89360 100644 --- a/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb @@ -41,3 +41,5 @@ EOF } RDEPENDS:${PN} += "python3-setuptools python3-fcntl" + +CVE_STATUS[CVE-2024-1135] = "fixed-version: fixed since v22.0.0" From patchwork Thu Oct 15 05:41:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100841 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11534CC6B39 for ; Thu, 15 Oct 2026 05:44:29 +0000 (UTC) Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32832.1792043065647158676 for ; Wed, 14 Oct 2026 22:44:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=PlPtRAUc; spf=pass (domain: gmail.com, ip: 209.85.214.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2db80fcdf8bso28339635ad.2 for ; Wed, 14 Oct 2026 22:44:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043065; x=1792647865; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=PdoOGoShBIaKsmxgsFEKeTs6cqMJE0impqUX5+QtO7s=; b=PlPtRAUcac3eiO9fC0tCzgkcN6Cn9akQ5iJCr+xaD8fIYvgy088pz8UV0scFRokvrR 1fqC24EnpO5M2uu1K0BHmtmzR3PpqKYBZCdod6TxlcsOf06gOcuHoMiWXvntn0oowalW zMwusewfqG7eDo0lQOfQPxFpam7FGLgy7oRfhLxKQtxwt9/DMkvbC4PMwY38n9za1hHa lkkOKZxtXzvGGIoBlMYqZ0Zx9hGX0rJ5SeEn73sdI1TUk2Y1EkJAwCldz1gSlhVhmLaP beovYTTbmkqhis4sFWu03VsayU0HtKfqI0KG5QUFvvNGch7fc2nJSQB46+GacHidw9j1 TMGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043065; x=1792647865; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=PdoOGoShBIaKsmxgsFEKeTs6cqMJE0impqUX5+QtO7s=; b=JL7eH0FTzh7e0IT/h7V4lOYXpY0mq3hjr9xyQuK7MINVt37BNVJySsOK4IpQy8Hkpd kZHP32MiFVi8A9DiO5AjPwf3E9t2v0qthRAQIf/RIaPgZrh8oZBVWV5MKRd0JWREwRY3 RH0G5B/ncCYSG8IfNzsFk4EtnKOEoojj9uHT2qi5L6Y6snxF1iQMmyVvV2evgleWDxrk lvv2tRJzIlM7lWGCifCMS9qp3gAv4I/Io1j055hzupz3/SiyEWI6IQbsv7OllSILArei S94EQUarGutJvp2iYHJbKLLrbtFPqdak1cinsMYxLnsOYRqOOaeSawJWLNh27+uq3/jT OBsw== X-Gm-Message-State: AFq9FYK4cwa3pI22ZPvksE0ClkU9ug2h5bud6XbUY8iaf4he9X5vhihG IY2IKMtrRRdFzwoC5elehWjsmgs3qnGHQWAPlW/h1DI+U70f/CInPh/kDBXThw== X-Gm-Gg: AYBFou2SOE9MvlRVPS+qfAgXIB3o0KKBjHmLzcSUAggLSY1IxbXyGARJwf5XTzkQ5QQ NeOh869dxutj45H41e7Lfrlp/ymj+JvFjZwJynkqaSHJQA9jJ6RJMURsyGm7nLbjGZOI/6+EYAG p2aOiweYTxZ+bEsaP8oH7B70+bhzYPMkF07Sd9TJZJJvkELmSy9USTOX8Q3CahRK4Maxz5VbMC8 qmxOAtz2+I41SCDbO/oDaO4Lk/83wDD9l5ONAkF9X7+bzBFjzc4+r3/t9KuQKGwU/Gv6MFwE8Xt d4ecKOZm+sdtXWYBA5eqg7j+7WTr8a2YecG0AaGJSSKihp/qBW3MjarzuQVIuhiqR40gErYzJvh 8h+3peHRyV4TnbHIIhop9ZUVuaFzKb20Pe9qs6kL/1L4pJ/JHKyiMXVqJAE7+eIdksuYstwT3dA Q/aPKCCuhP0b0bd8omSf9PbpWIPKd+tDfJ7B2f87Cp3xABY0/QsonifR2lQeli/vWgNgov8j6+9 yw6Q1GCAGyrHB6Wm6mQHwc= X-Received: by 2002:a17:902:cf4b:b0:2e6:13b1:e196 with SMTP id d9443c01a7336-2e842cea1famr141111985ad.74.1792043064975; Wed, 14 Oct 2026 22:44:24 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.23 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:24 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 44/82] pgpool2: upgrade 4.7.2 -> 4.7.3 Date: Thu, 15 Oct 2026 18:41:32 +1300 Message-ID: <48393460adf89c370e2b1fda81ec9ebce0aa655b.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130964 From: Ankur Tyagi Changelog: https://www.pgpool.net/docs/latest/en/html/release-4-7-3.html Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 192d012d9a1f40061901ad4302a4d90fc08769aa) Signed-off-by: Ankur Tyagi --- .../pgpool2/{pgpool2_4.7.2.bb => pgpool2_4.7.3.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-networking/recipes-support/pgpool2/{pgpool2_4.7.2.bb => pgpool2_4.7.3.bb} (95%) diff --git a/meta-networking/recipes-support/pgpool2/pgpool2_4.7.2.bb b/meta-networking/recipes-support/pgpool2/pgpool2_4.7.3.bb similarity index 95% rename from meta-networking/recipes-support/pgpool2/pgpool2_4.7.2.bb rename to meta-networking/recipes-support/pgpool2/pgpool2_4.7.3.bb index c6b6a22c64..2648cc1f9f 100644 --- a/meta-networking/recipes-support/pgpool2/pgpool2_4.7.2.bb +++ b/meta-networking/recipes-support/pgpool2/pgpool2_4.7.3.bb @@ -16,7 +16,7 @@ SRC_URI = "https://www.pgpool.net/source/pgpool-II-${PV}.tar.gz \ file://pgpool.sysconfig \ file://pgpool.service \ " -SRC_URI[sha256sum] = "e72b9d0ff3620f7da7e33a58dda44b77919d056752dc9bd86b2985c4988d1938" +SRC_URI[sha256sum] = "4bf9df3e13feb8e64bee486b4ea54c9076296c2d9406165b0b68d32086fce250" S = "${UNPACKDIR}/pgpool-II-${PV}" From patchwork Thu Oct 15 05:41:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100839 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4646ECC6B3C for ; Thu, 15 Oct 2026 05:44:29 +0000 (UTC) Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33258.1792043067768056750 for ; Wed, 14 Oct 2026 22:44:27 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=ovtuaEPZ; spf=pass (domain: gmail.com, ip: 209.85.214.175, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2e915887d9dso17337705ad.1 for ; Wed, 14 Oct 2026 22:44:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043067; x=1792647867; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=qeQ9QHwlxiDJ3Gh9W72GUq9UkqWYiO2+mQlb9VZTTfY=; b=ovtuaEPZk8t2GBLfCNVfH36uuI0eXHg6t4+NnA+lGada1hPbp2Q5fhGVLJRiQg5zm7 5W5WqO9VKv96wpf9JlJdCIp08hX/LhK3CgEwrlr7aDz2SSfASdjlqmuIon4BmyGaJC6S n76EZeHN0Snu4pgo34m3IlzeikdAlkh9pIKintynL/TIRjOsIKffQIVfLEhi04XB2N/r WV0LFZuUP30HOQXpapemK3RMA7O/XlPsvGEHzXjWgkYQarIkXnGHLsW2kvZt5Z+0tlMT 6pr+ZJr91G/YsFGW2vWBAwgN1t33ztMfF3nO1OhpcmRuPy6X8By2u9O21Iu+RnvX2hOz L1cQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043067; x=1792647867; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=qeQ9QHwlxiDJ3Gh9W72GUq9UkqWYiO2+mQlb9VZTTfY=; b=tlxWaTCR9+LxEd82wEYDhThgTwErxvWU2dee0T7Ac92NnfoqWD8j4tjHQmBw/tXSRh ywufm6nx6m2dLLMfVHHs4cskS8Kdbj2+Zup9/aEpNa88pl3/gWmgoCunl5RbvsN90eoN /FKyrM0w7QJb1IQ0rnoyjyO579LE8FGPcedKvRnWPkJAolpadFlG7huTLb8bCLEszhAq 7QjqhwR/frArCN3+u1vNMRp7e+3X6TbXNQysJaL57oRalqdS4hHV4/+h/KruU5i7Bwfd etjMZe6IE1wPr4K0n7KvtsJmOmpUAgfg3qbzCkFDogt7DcWHg0Km1GKOSLN3KsXMzQ93 uQ2A== X-Gm-Message-State: AFq9FYIGto/CCz5ZwIH/Rd2gQrgzbFjJRdPwARD1Aqv347cSi/P2Mtwz XT7ZqWlTDtDbzZqUK8/jI3uuZLsZ8NUC6YLQyRGvTAM5lT9COzhpUIY8oPFi3w== X-Gm-Gg: AYBFou0ITnymNIWPPQppFoOzrqX+I51JBs1yIuGhI7gy+9++DYGdV5A5Usq/DG7pI0C SsQRoUIZze/hslB9kSENZ/+83cYCxW8sKrC00ouu0cDaRIiKy3ZbT+mPNmCCto/cq28gx4Yy1/V 5excHsMpwYX6AXzGV4c66HTLjqz+z1g04He3oH+SifZjFiIYnzImfzHUsRqbAiZkrKybGDPqkeV FOsZEFWCYpVofChVydAUP1qjct1INeKK2aNRdVuB+Nu+2FfGWTwnNj8pgQiBy+wCBzIhvAHExpO vxpylp5PsrAiqbR1oVT+vFKDKD0oD6vdP7tYOirpU21kdo3iGrLMrZJHA14uHJUmupO9eSAccNk ol95m5yN6VeMvDljn9xh8tfVdOyYRX8/CRdYoyBKlf7Gezh1i2j+zlIbe9KvrkGCuvWv/g2b4q6 ZoAtfeoUAOVaiUkz7FFgTKEV5//YzEhst3spyyQ91QpbB2RHBcho0m/M/4+mIqxVt+5o1qaFmMF 3Dhv8+3Ifc6dCWou4cyjIs= X-Received: by 2002:a17:902:e744:b0:2e2:ffcb:87a9 with SMTP id d9443c01a7336-2e842ab6aaamr151172295ad.24.1792043067149; Wed, 14 Oct 2026 22:44:27 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.25 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:26 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 45/82] smarty: upgrade 5.8.4 -> 5.8.5 Date: Thu, 15 Oct 2026 18:41:33 +1300 Message-ID: <9c7e3a2ba9d9107a3132218512497a33b292b4ab.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:29 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130965 From: Ankur Tyagi Changelog: https://github.com/smarty-php/smarty/releases/tag/v5.8.5 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 3fe4c2247419cbe376ad010e2e56536bec3faab0) Signed-off-by: Ankur Tyagi --- .../recipes-support/smarty/{smarty_5.8.4.bb => smarty_5.8.5.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-support/smarty/{smarty_5.8.4.bb => smarty_5.8.5.bb} (95%) diff --git a/meta-oe/recipes-support/smarty/smarty_5.8.4.bb b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb similarity index 95% rename from meta-oe/recipes-support/smarty/smarty_5.8.4.bb rename to meta-oe/recipes-support/smarty/smarty_5.8.5.bb index dcb7c85a80..83f428d388 100644 --- a/meta-oe/recipes-support/smarty/smarty_5.8.4.bb +++ b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb @@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=2c0f216b2120ffc367e20f2b56df51b3" SRC_URI = "git://github.com/smarty-php/smarty.git;protocol=https;branch=master;tag=v${PV}" -SRCREV = "94a27cbbc7820198d7adc17a2be8d457fb267753" +SRCREV = "0ae663525dcbc9e996feb2a867e43bc85f960938" INHIBIT_DEFAULT_DEPS = "1" From patchwork Thu Oct 15 05:41:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100844 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D0EBCC6B2F for ; Thu, 15 Oct 2026 05:44:39 +0000 (UTC) Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33259.1792043069615014368 for ; Wed, 14 Oct 2026 22:44:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Isr+pMlK; spf=pass (domain: gmail.com, ip: 209.85.214.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2e8fe8e343fso19139325ad.2 for ; Wed, 14 Oct 2026 22:44:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043069; x=1792647869; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=05pmy58e9f+lkcU6wBrTK4VJVqku53rpnZuEpFOE+sU=; b=Isr+pMlKC3OMxSpM+1FhEO8lSbMF1II367EBWO6YCr9TRhbtb2UFxxmW9zk8VpPQnB VqS7NLz81PB3ATkCXYg2G0r7aKn+LAwxnBoa9WEANM1W+mjYmj02N2rMyX5aPnCik2xC DX7wnxzGQ6u69+XjVqamoeCETEibah9RR+Wr+DsZmD8Qvtl5LIXgO48VdwM42l0LLSKO 7iFDcB4zPCssNH9BK5ocm7cf2MFP+9MVB63a8pk542AUmgk6ZWEyCunwasE/IfekuRQ6 MmEKzsDmZVzRiTUqrXbasDGtDdCgI8QJ8Ffvzk/8LmoUWGDpW8YYZu+UCquAgs6S6h8q YEZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043069; x=1792647869; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=05pmy58e9f+lkcU6wBrTK4VJVqku53rpnZuEpFOE+sU=; b=iJdaL/80M62afB9dyBoxg1GE8/OZm5ngYbHgtAg3LxnpFPyuk5pXsAjdSH8fh/xJ/l mVqhdSXF9GXDTFiNbHdDMch/GoCoVafIlqgPHrFMbnAFmtnUsVkiVEbDt1squXEnMqmo ZziQsDCeF0uix0Aav3wJrLgFxsgXdt/2mW6XUoS/VH3auOJuowqdDuTciF/fumMLVlat lDRp3YrqSQH4t51g76miJ3YDSLXudod7g3aNQzOmcdxtReRKrDFWQhBQivbHh1l1qax2 QVkpIKzHSGctFzDWCiAerqN/Mp9txWE9IpduggZr9xSCvu5uUPKfA1zyRigDAn4csCZ6 Z0RA== X-Gm-Message-State: AFq9FYJDDD8A46J9/2coW2cjAUP9LS7p7GzmI3GzC+wwhuI7fio+57Ww XvraX3tH1LMX7g3b9rFoTErafnzJXHTIX1Xabm78TfcCN+QhNe8plBGX3HMghg== X-Gm-Gg: AYBFou1A3Iy4awFA7Kh0xL+GhJC93w0Bl5lErJZefF5VFe+GrV5eA0OAk7/FHeVLG2d LsiGUNKeaN40rvbnL3JtrFJTADP0iQQTdLhJTK6Aa3VmYPXN33D/ZH9bNAFv6kfybh6U/FqB7Jm cfbAGAqhSwKl2lFvXAmruMJ0VAsPwtraV55fw7iF6uIQl9PLbAJHosk5CNGwXsArIpskPiHN+FL ++thJkxSFf/QCa0RQQ7DiqLsiCSopCClwY9BNpPObJAz0t8IVSHFgZyIuPIiM5pXAB7gXAsz++2 R3teY0/4CK2BoV3jf7tpgkjBJIqdQLqq/0PBOybMXgp3G3c/j+GZj5CTGTL2o+SE+swhviIioB/ kfqr+gmv+DQ5NQ4bo5NAGkY53hXNvjooLc9OUM2NWBxKR6M2eJmNEBsp6p1112S3qv+YGdYRVBX LE9zIEFinjE1y99Jct3UjzzGNAwnKXA6wCatBK9+nls6P0efpKpbjk8D50JMNsKwYsXi35qcf8J mUC7pEpA1doK0jet+o90yc= X-Received: by 2002:a17:902:eccb:b0:2e9:4e83:196c with SMTP id d9443c01a7336-2e94e836539mr24454435ad.60.1792043068921; Wed, 14 Oct 2026 22:44:28 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.27 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:28 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 46/82] python3-astroid: upgrade 4.3.2 -> 4.3.3 Date: Thu, 15 Oct 2026 18:41:34 +1300 Message-ID: <783752d9f0336233358bfd93512938f6ee5044d9.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130966 From: Ankur Tyagi Changelog: https://github.com/pylint-dev/astroid/releases/tag/v4.3.3 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 486ef820db2ec71ff8da90f4c9634a200d6a15bf) Signed-off-by: Ankur Tyagi --- .../{python3-astroid_4.3.2.bb => python3-astroid_4.3.3.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-astroid_4.3.2.bb => python3-astroid_4.3.3.bb} (89%) diff --git a/meta-python/recipes-devtools/python/python3-astroid_4.3.2.bb b/meta-python/recipes-devtools/python/python3-astroid_4.3.3.bb similarity index 89% rename from meta-python/recipes-devtools/python/python3-astroid_4.3.2.bb rename to meta-python/recipes-devtools/python/python3-astroid_4.3.3.bb index 55f4d01194..c9a209aba0 100644 --- a/meta-python/recipes-devtools/python/python3-astroid_4.3.2.bb +++ b/meta-python/recipes-devtools/python/python3-astroid_4.3.3.bb @@ -4,7 +4,7 @@ SECTION = "devel/python" LICENSE = "LGPL-2.1-only" LIC_FILES_CHKSUM = "file://LICENSE;md5=a70cf540abf41acb644ac3b621b2fad1" -SRC_URI[sha256sum] = "8cdaf5b7f3f4f39557ae05ed8b0852136b43a04ab686db7d39255b206233677a" +SRC_URI[sha256sum] = "d03854b09d92c08e18d8e7d9185d393961186ed0747136d8fcb2d1c008a504ec" inherit pypi python_setuptools_build_meta From patchwork Thu Oct 15 05:41:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100848 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4FD3BCC6B38 for ; Thu, 15 Oct 2026 05:44:39 +0000 (UTC) Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32834.1792043072852048021 for ; Wed, 14 Oct 2026 22:44:32 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=gYIllsDT; spf=pass (domain: gmail.com, ip: 209.85.214.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2e940d5d2beso5642715ad.0 for ; Wed, 14 Oct 2026 22:44:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043072; x=1792647872; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Vk/rKU84FJ4vvlVRH7vePD/7VmeXZxXasKrtWafR0Ro=; b=gYIllsDTBMDTci3eySKTarMWsUHYUfsSJKfe9juPaX4WPnCa+nHXQdciwrTNZqG4W2 UUs7kwBaOqDHwa96RLHNjgA78cDu2pn5kcX2CQ57NN9xdx4BCoLb09aU131Wriinalo8 JxX7FHf6SreMeUE/UrkxXvc8FbOyc0XPh9TTF/wZKBIEUGXP9fluCmk2mQesiLs7f53E l1ovzK4jhsNbfbODZcslzFUV0OTiaLIwmkSQYA/Vp23BurHN8E30zerQnlWtR7gEwHr9 dY9o3RzYMXjbBEPr2UrL9ck4n02KP1a1/5KAy5edWMZ7EZQLiN9vlY7VtcPBsp4IHR8V BoKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043072; x=1792647872; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Vk/rKU84FJ4vvlVRH7vePD/7VmeXZxXasKrtWafR0Ro=; b=j0XYqTGetiQuSemHPMcsvtDl5/41m5beeV9Q1qmZgGTpeApidAxmL6FOx/1sBJjcDN GWr5IL9dH8YkgD7WeLP3jdngyc0jEKhpnFGvvzeMbmHJ62quAeRyRyrQs1b7OxGbcwXv tdCK2Tcpxa13YoTQ1iXKM8riu8x827SKFtFqDpy1NL8PPwoSIOVnzGHjugi955nn7Mh6 MsGQDxhPMrHfxsn2ipcfBxkelZhjeK2mqSCc+AZIpppA+VVHUyV28qUPDsxhJyBEI4aS Y524Jb1hG0vJJRoLD3nq2nn6UBPRa/fwdiJqssCuuWH8N/HLdQ5SFny59xqQwWaeVgXG FjcA== X-Gm-Message-State: AFq9FYKkTMGm6HdYqx4QasWAwPa5ZhbOSu+I0ST4dYW5e5WFlgP2XuUs i4+RrVWW9p5LWFDVEKbfC27DcElD5hbuo3RXe2RwmGhqBTF41rTzZOkGWwXYJA== X-Gm-Gg: AYBFou1Ql/bkhcC4i8PL3I2ESGMBrZGmo0+c0cLZ5cmQ1tcGrp3EIPzUekrcrtv8JlG GoKfqtv7iAvT1Vnm9SlDw+5YjEjMsOQim13s/2DhH2Vmk/UOJ0YWukdRO5JjfsjfpMdueaPN2xJ 5/k0oFQ5Vm7/SoQdLv3537WhQi9yiNhJXybO0giSDfoefLWKLc7pb7zNxZnpa37jKbdrn4Nvy6s PphSsEXJxmQELAmX2n74MB58kbjV9IBYyyNsxN6pqlqoxpgn4gbBwK4HGZyzznzhMzdgPOTxOHQ lDm5AnvaW7+HVBkwucUqQWgiOg/whAvycYDCqk+MZc/ooxgPCm8oM29zMp23SMbyC9W9tiYXOB5 uE9Hh9EwUzFIDFhh/s/n/dRtGzNPppyGLY4a3b8IPelc7spqDYJR6OKjGy7HpqnK5JPay/JhRgx IcpFh4zZOzwfJUoVfU6ihJ3eurdFSvufz0E5ShKGI7qsx92UNdPyRVl/zKuTcI50UiuOsXMX5Wh jc0sw9ICW4UMuWNy0jfnP4= X-Received: by 2002:a17:903:2f91:b0:2e8:b20a:88cf with SMTP id d9443c01a7336-2e8b20a8a88mr99116215ad.11.1792043072244; Wed, 14 Oct 2026 22:44:32 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.29 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:30 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 47/82] python3-django: upgrade 6.0.8 -> 6.0.9 Date: Thu, 15 Oct 2026 18:41:35 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130967 From: Ankur Tyagi Changelog: https://docs.djangoproject.com/en/dev/releases/6.0.9/ Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit c39562d398bdde11ba32c9144a8189f87ef922d7) Signed-off-by: Ankur Tyagi --- .../python/{python3-django_6.0.8.bb => python3-django_6.0.9.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-django_6.0.8.bb => python3-django_6.0.9.bb} (75%) diff --git a/meta-python/recipes-devtools/python/python3-django_6.0.8.bb b/meta-python/recipes-devtools/python/python3-django_6.0.9.bb similarity index 75% rename from meta-python/recipes-devtools/python/python3-django_6.0.8.bb rename to meta-python/recipes-devtools/python/python3-django_6.0.9.bb index 0c7fb2197d..acdd2c21d0 100644 --- a/meta-python/recipes-devtools/python/python3-django_6.0.8.bb +++ b/meta-python/recipes-devtools/python/python3-django_6.0.9.bb @@ -1,7 +1,7 @@ require python3-django.inc inherit python_setuptools_build_meta -SRC_URI[sha256sum] = "cb0bd962d27fc866f3c514b20aae6a7df56ec80b488f9899da46d675cd051526" +SRC_URI[sha256sum] = "8ce037c971f421cfb47d38c097ca233a8f6dd42d9e9501a37e02dd7d08c5cb3f" # Set DEFAULT_PREFERENCE so that the LTS version of django is built by # default. To build the 6.x branch, From patchwork Thu Oct 15 05:41:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100846 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 603FDCC6B3A for ; Thu, 15 Oct 2026 05:44:39 +0000 (UTC) Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32837.1792043074718139016 for ; Wed, 14 Oct 2026 22:44:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=czhpYI5/; spf=pass (domain: gmail.com, ip: 209.85.214.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2e7e742a2c7so33103665ad.0 for ; Wed, 14 Oct 2026 22:44:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043074; x=1792647874; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=KxPTG+bCzUOtHwNxY6FJnuYeduvZ2xA0OthbZMU+0nI=; b=czhpYI5/PzbL+L4UdqE4eDNm2PKiXcecILjqvzrVUoD0baP/ZQehz5OIEkIA0XVVqX JfzlkZd+9t8hoTHjOKX014YT2jR5CZMC+zhFlG5uAB9DXMTf5CN++ejm6xNe8FIYhMef I4lvF7NfKcqdDL5aKrP4fxE/bizVju96Zi4xGKjjF7uEwy7PW6lfvNhCglHPjol9qvqS kFRtW3S+qQY4yK4sBuuG/NNWtuD5/lXefefCeL9iB2jufO4WwdsTxm0+FsAXkX58Hcyg Rtvc/0ba5YSzJNbl+8noTwCQ+x4QlFUBSawnBmSKmCVN+0Oeg9W9AlgiVnntCr9fpGfv snYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043074; x=1792647874; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=KxPTG+bCzUOtHwNxY6FJnuYeduvZ2xA0OthbZMU+0nI=; b=aoCH4Apx8pP6OUb3I848lEj7BcRODSiQuD3ZbbYKMj8oc6kkvRw0L1cVgSLJQPX/+2 AUCThKsr89/nWyExh/4WBSb0kI+XVYCeFJUiFGUps+dkBPUsrvdKyKb5Vi5cvwwGUdiB QkdEWZNvkBJladXuF+sfqByrTFVpAxYVM/HEOki4lUQ9S56VYtjjnkjIW3yGxGmwcsc6 GNfaK7o/pxISy6c8fdRmDbG4CyMZ1kfqGL9O2UHRU4YdfD0Cysxnj043raIxDIFr53dL lmNCnQ9n8cuMaCz1+7+OSwbt2pfzKg0THaI5KhBzq1pCgdUP6bSEZ8ikwJxjE91D5h2m ec/Q== X-Gm-Message-State: AFq9FYLgmevJ8OqlQNjKkm/VSKhs9AT4yR/9f4tl1gzaUGFg79T9/EDM ZMyi7UN3hlZO6VuoqHPspMhYOVSQBlUDCNsFOP5lMez57FcgitwL/dGEdJ7wOg== X-Gm-Gg: AYBFou1jeY/Ry+JhUcp6VtR5COio0HCj5Nd4QWZTysZIY9BUB+Jc3pKIfiUjmNsoq9i abunE5NmTY3FxGOBoIoQFZytaxulFOkpRVrSJUSUueDJ8AHASKW9Qwh6Mb5cxG0n03uqcFnB/uf MWcAtKHdZdr8rZpdhe7PxQyxgyEgBAU4hW+DP2bn+HY3iuVi2hXq408esObGga3PnEKWfjCm2M0 F91a537yTfEX3Toah67+EJ2bA0LSuH1G2rdBrARcLs+7CQ1kv7SSL/tKo4gmpDyUWUjimD2+sJu lM7Ltnt33UhmMg6e0kXTd0K4m7ZrTTb5VPpCVO9mAUdp3Xqp2MO++lF+37OcdtSLFfq9ayaUtrN wRzgOWxDIxVKmAnaPjfFbxRIF4eXmAThdk6+Bkak6ngxOKvIaffQMcrYqsRd4PvvJW0Ou42705w 4Pih0Rt7Xba9geCgfW0azDe1erKX3WHd/MO13oAPMplhRuvuT7Ej+fTu67/uNB7j+eoH5JQF1My k2Gd8c5IuACymdO+SCJPyM= X-Received: by 2002:a17:902:e748:b0:2e6:1c24:d5f2 with SMTP id d9443c01a7336-2e840542be6mr128116535ad.36.1792043074028; Wed, 14 Oct 2026 22:44:34 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.32 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:33 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 48/82] python3-django: upgrade 5.2.17 -> 5.2.18 Date: Thu, 15 Oct 2026 18:41:36 +1300 Message-ID: <962410d82f285c6296662ba772588c684cfca0d6.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130968 From: Ankur Tyagi Changelog: https://docs.djangoproject.com/en/dev/releases/5.2.18/ Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 0640fa901df7783fc9f544a6bbfde5b771e22b96) Signed-off-by: Ankur Tyagi --- .../{python3-django_5.2.17.bb => python3-django_5.2.18.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-django_5.2.17.bb => python3-django_5.2.18.bb} (61%) diff --git a/meta-python/recipes-devtools/python/python3-django_5.2.17.bb b/meta-python/recipes-devtools/python/python3-django_5.2.18.bb similarity index 61% rename from meta-python/recipes-devtools/python/python3-django_5.2.17.bb rename to meta-python/recipes-devtools/python/python3-django_5.2.18.bb index a9009adaf9..eb84122116 100644 --- a/meta-python/recipes-devtools/python/python3-django_5.2.17.bb +++ b/meta-python/recipes-devtools/python/python3-django_5.2.18.bb @@ -2,4 +2,4 @@ require python3-django.inc inherit python_setuptools_build_meta SRC_URI += "file://0001-fix-test_msgfmt_error_including_non_ascii-test.patch" -SRC_URI[sha256sum] = "9d4d93be539a18ab80d058eb515900e10951e04c537c5a6b394fc49528d3251f" +SRC_URI[sha256sum] = "461c5dd06d2ea16bd5ca37d3f46e4def1d6b0fe7588c6f4e2119517bb0af8b2d" From patchwork Thu Oct 15 05:41:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100845 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B942CC6B39 for ; Thu, 15 Oct 2026 05:44:39 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33260.1792043076509745443 for ; Wed, 14 Oct 2026 22:44:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=X2Nnsu92; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2dd76b1361dso12002325ad.1 for ; Wed, 14 Oct 2026 22:44:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043076; x=1792647876; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=zf2z5lSjXeVTjCY+5tAe6ThiIjq+B00NWRY557XdNMk=; b=X2Nnsu92R81iSs4L3GuI6+e7BECLe7p0qCRVr7GuxivUKIWXw3n44opbUg0sKu7XPu tS/t9zY9aVRhnKGznC7DZcvcewnRbeuWLnegxI6Udze5fH9rfUueCm//cs34rvjzHZKr RsvAccUVkeXYLTU+h7g9H6S4FzEd1IqhpHvj83iurDvi0re1v58SHRERzx8D5vXSBOE3 12pAwEwc1V4wMFfoZKYMbU/ttWNHM306YdtpOhUNXU0jZKeY5mDCnMH+CiB4oSFqpdUy A5w2pYaRCO1YZadxL/SMKzKTFVIGNRKHnHKFnhQgKX60eh0f4jFrTIs1Q8ruGWfJ5NVG 3zVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043076; x=1792647876; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=zf2z5lSjXeVTjCY+5tAe6ThiIjq+B00NWRY557XdNMk=; b=Oyc5BGC1Y7mj72H89f5ohXS3vEqSQWrgAXTTTv67S/htPMZwnomh7kqKcbbSv3/46z 7NeuTBY7jWQw9bTJlhkSNY+dtc0KN6/nqXBYCVl/c085fvFpsbfziWTQEaWODpAUUCt/ Mrpe4SZHHkXiMam8AdHyjxuxz+MF/PSzeEfb4ZdSaQaMZvV7NV3fqySrwsoEDzsaH3B8 IGy86NyNZ9fXIluLSQfPCSwoaEKOCHsyOj/SIHE8nLSLoXVbesHa7+WvLNby9md0gy1Q VV0JY5AF9anRqgjdikalMQgtzicd4GeKFf3MFKLSOnMfN9id37cwovUeKGcs+Z2gH2BZ nkNQ== X-Gm-Message-State: AFq9FYIw9Q5Y6e8vK3GY9io7/v/rFNjccoEesA2ldLxLZ004upDl7NdZ LhsFep8bt3wIR69/eRRR9sM05G4hljZXEbxKNvOxiel8kFEloOI2yjDhcZG2+Q== X-Gm-Gg: AYBFou3PkYlNx4Th73OLI2gkw7fj1/75KiM7jEpC703YW0LUKrjzt5nCJpCOv9Fp4nq phiS94K/ZRWNJirifS+skfVs3ACJGlV1l/zHyGq4wvbuiRNTU+xmEgyK0uPV4OiYkyOYq3/KdXR KH22ZWGLO5dLsBTgN9FOitp2FnyfaLT3PP+vPsYRQFTwG9ixjGQ3iFjNrTG/PmH4/+zyR9Yvy/l fBH2DOzICtAqTuQCEcJdX5acsIEvA9pkiXULmHAeAJAs0O5jWF9fR++npSLKHgQ5Y50JMl2ta+K AVEFbL+yyp89bB7Fny7peIzyFa6wpsr4k4vp5kBOS52VKo+hjb89tV8e9k/MRlf0KSC7c2H6zqr ihnaElWY3ZK1w0i8dbm6q7Pz6+ziHWNzy5SxvKJeNJhGGiatb/y2yuPlvegsKh4NM/OrSrpUjhq 5KuYpAcnYzkevTivRoYXxchhwjO5/FKp3HiNA9XVUgPHdre76pnsR1BBt8IIoti6xIulB655ytc ZWyyd+hCJTMOHVUXO85/VAPXg== X-Received: by 2002:a17:903:1a0e:b0:2e5:54b9:6b5c with SMTP id d9443c01a7336-2e842ab9b86mr137745845ad.20.1792043075825; Wed, 14 Oct 2026 22:44:35 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.34 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:35 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 49/82] python3-tzdata: upgrade 2026.4 -> 2026.5 Date: Thu, 15 Oct 2026 18:41:37 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130969 From: Ankur Tyagi Changelog: https://github.com/python/tzdata/releases/tag/2026.5 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 01bd918ea8c7a391e977b9ab409605fa7fc5d953) Signed-off-by: Ankur Tyagi --- .../{python3-tzdata_2026.4.bb => python3-tzdata_2026.5.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-tzdata_2026.4.bb => python3-tzdata_2026.5.bb} (86%) diff --git a/meta-python/recipes-devtools/python/python3-tzdata_2026.4.bb b/meta-python/recipes-devtools/python/python3-tzdata_2026.5.bb similarity index 86% rename from meta-python/recipes-devtools/python/python3-tzdata_2026.4.bb rename to meta-python/recipes-devtools/python/python3-tzdata_2026.5.bb index 9bd29afa61..4590cec28d 100644 --- a/meta-python/recipes-devtools/python/python3-tzdata_2026.4.bb +++ b/meta-python/recipes-devtools/python/python3-tzdata_2026.5.bb @@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=804220b73c90950be376e7ff7b2066bb \ file://licenses/LICENSE_APACHE;md5=86d3f3a95c324c9479bd8986968f4327 \ " -SRC_URI[sha256sum] = "f1b8bd365d8d210c55353f4d7f8d6d8561c0ba50d704b700d195a9424bba0d79" +SRC_URI[sha256sum] = "8cc73c0a0bfca7dbfa59235d60b2eff82231dee33f53d206db1acd9173cfc0a7" inherit pypi python_setuptools_build_meta ptest-python-pytest From patchwork Thu Oct 15 05:41:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100847 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82E78CC6B3C for ; Thu, 15 Oct 2026 05:44:39 +0000 (UTC) Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32840.1792043078642179242 for ; Wed, 14 Oct 2026 22:44:38 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=dthIUtTa; spf=pass (domain: gmail.com, ip: 209.85.214.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2e86dce4510so24893125ad.3 for ; Wed, 14 Oct 2026 22:44:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043078; x=1792647878; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=pyAS73C4CY/oRDyagHMj90yapEnPT7ieYY8JHkn7hHs=; b=dthIUtTa3a8ih5v3/9pQCbx7OdgN/vRTyqB/kMUMqbyTZi4Sv5BAMDDMEN+OmAOABv uE/8m3x1/sO4HYKlwIu54xTPrngvKT8CE6yUmc733gPeGrAmrBUK6R31TX1tuYjVMDXR g751642jV0Udb4P/1stRnqlHtq2Gv/xpiGyG9X17nlxgJGuuc/Qlu8k8rCE16Zfnm4EH pTeCEYD1wG6DchzrHxj2mZfQtEHdWC3XqP0zTawMxf85f60UqyiqbpUgcQvEtfAEeuDW 2qJO7GnvE4Th7VFWsrKkma2UQC4wlu3Q/g7+Yd6dER+6eI9gU6nbnJ7Fz/B9xj05O8+T g+Mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043078; x=1792647878; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=pyAS73C4CY/oRDyagHMj90yapEnPT7ieYY8JHkn7hHs=; b=RrdUX7LRA24gitZ6XUYEtEcQ+XdXmHahFyZHE14gTQLkiwasd57N2cKmWkDAHluK0K pLOCNDoxd6B6+c6yhAh6WD752qLK+UcBBw8Btv9B/517d47pCbciMfBtNghQ8a+3zYwa 339kFHli2ZMQpmiesL425su58YB9KKWaWB1CCluGc+c0TlMZPK4XyZkKTFDeSQ5zEXAE QybWW7c9w7F5xStvNNMH0HZeMIxMUcrG16CvI6ItmdCMUfuYkpxRkU0bDI+LA+sw3ugF rHQA6cp+us9LHDH0Yd8lmo8XEkjw3DSrxmpma2HORLb5kkQ8nwCIN2ZG1EQTodtOPKnO ZFmg== X-Gm-Message-State: AFq9FYKLyRCHyG8g4nRrzQQmuEq1PRS+JeZJzaZUkMLZwGGGPuuNYcoq FiJW+1d3meNcTDEAQQxIYoq2T/txm+zl2dsqWjbpW0yrIIRB+k3QbdzPkSi7RA== X-Gm-Gg: AYBFou2rlyq6ktwcE9SuNnrEAbvR78x0L5SlNvcxsgKS5MkmlGdbZM22KevBob8AnH6 HjqTMPka8j4XNk50N25NjWb/Qg5XVLFYMD2u8FMOnEu42Auh7WbrAbaMzvnEPWG3IqenYpmCF8t euKJ4xg9UQHuDJDEP7UaRaIceXMnbtDWPiyvkEIHwjdNJorfI9U5tb88zlLbHhQDUloX4wRzOnN 95V8PbSf2BcX7H79IsJXpHJBJLO6/R7+FaRTUMyEJhTwx5ORT1pvvy4txRD6svovjtbDX4tc9YE X4RaKEB1LnYqbc2QpkDa1qVgWzXjVdvZGHcBtA7RXXkirsRRktY6wO5I0TnMB+KiAAxuPhGSCN3 ZlcSbTPpX2T+Kerqhn0OdvbI38DHRNdmAEdgvneCp6j35jsf7vWI0XAIyrAcawOqhQHkBf2FV7+ pSaU7P7KZDY43q8Kgjy1Hqw58WFt9yOXcF9U01B746SHvmd/dCHNdx/ivID5r+dNtnGCLjcibmQ C4idlwAIEDfUc7DSvX5Zac= X-Received: by 2002:a17:903:2f87:b0:2e3:598:75d5 with SMTP id d9443c01a7336-2e842f24cefmr127538105ad.74.1792043078001; Wed, 14 Oct 2026 22:44:38 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.36 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:37 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 50/82] python3-werkzeug: upgrade 3.1.8 -> 3.1.9 Date: Thu, 15 Oct 2026 18:41:38 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:39 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130970 From: Ankur Tyagi Changelog: https://github.com/pallets/werkzeug/releases/tag/3.1.9 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 0d101e1633262c35907fde6fd2708c0317eedbb5) Signed-off-by: Ankur Tyagi --- .../{python3-werkzeug_3.1.8.bb => python3-werkzeug_3.1.9.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-werkzeug_3.1.8.bb => python3-werkzeug_3.1.9.bb} (91%) diff --git a/meta-python/recipes-devtools/python/python3-werkzeug_3.1.8.bb b/meta-python/recipes-devtools/python/python3-werkzeug_3.1.9.bb similarity index 91% rename from meta-python/recipes-devtools/python/python3-werkzeug_3.1.8.bb rename to meta-python/recipes-devtools/python/python3-werkzeug_3.1.9.bb index fae4de2a3f..d3b1598f78 100644 --- a/meta-python/recipes-devtools/python/python3-werkzeug_3.1.8.bb +++ b/meta-python/recipes-devtools/python/python3-werkzeug_3.1.9.bb @@ -10,7 +10,7 @@ HOMEPAGE = "https://werkzeug.palletsprojects.com" LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=5dc88300786f1c214c1e9827a5229462" -SRC_URI[sha256sum] = "9bad61a4268dac112f1c5cd4630a56ede601b6ed420300677a869083d70a4c44" +SRC_URI[sha256sum] = "55ca7c70a75689be937aa27f8ff4b018f06ff4838fc73045560bf0f5a1291060" CVE_PRODUCT = "pallets:werkzeug palletsprojects:werkzeug" From patchwork Thu Oct 15 05:41:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100849 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7658ECC6B2F for ; Thu, 15 Oct 2026 05:44:49 +0000 (UTC) Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32841.1792043080374866963 for ; Wed, 14 Oct 2026 22:44:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=AAPz9C3z; spf=pass (domain: gmail.com, ip: 209.85.214.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2e946155442so10723445ad.3 for ; Wed, 14 Oct 2026 22:44:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043080; x=1792647880; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=mW+LoniTCzW7aiiRq9s8iP9NX/H3QVJLMlsKCSNCor0=; b=AAPz9C3zQ8FdSeIPl0+49s/Jg4faiOg0Zpd9Jqe1K8W7H5x83E8M9wwZVqEukTeBk7 7HPLfGS1sl8CtbZA+xNy0aetr+0IBfuQAgRwcC+rexfnB7bzdLgq/qK5fOqtqVVIZKWs JjwEUyL8XMzZuRP/aBPqXd1Og5nnkuO8enycLJtVOnGeZkIcOpLQKfdgFGz0qzTaNhHv ppe7jewKOSjlSa7mGi2212ysMsYMbvqEAgtoKyiIY0kHK2hYFV3wtpMgkuFCn4Aujn6f +5LWoA89V5SsldxiQDhesD6F2/hYR0iR7Dp2QS+kkZpFXqWCZFf9jT6RA/AsjIuH6CnB QSDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043080; x=1792647880; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=mW+LoniTCzW7aiiRq9s8iP9NX/H3QVJLMlsKCSNCor0=; b=Rll42gvvkOXR51fF7cpexTKRvyUBy0oV/JXfSCkFC8xZkSBJq8/pRTlI4siFg6wrCC FLRCELLZhiuThK8NkPsM+RWKmnJiA0JzVBpMrytigOOFlHnCwyWQctety3y96xEHyaKC XA9ph5fA+pUBMFHe0/9306kPgKsEmX2vx94tZOiayc2DRLf6GER0LrMwqh5wGfS2jZK9 2CNBXvLESJHaEG814tkELLpWQdIB9zVVKnZqkMIL2kxnnfo+rocsDBEEwA9dbqrJINvf bzUIRco5SU6FVUylLkRJ86NObzDCovynMBNFhHGa9sYrTtxlR7C10souTQ/GseXXAtrP Boog== X-Gm-Message-State: AFq9FYLtMkYwwdlVXzoRUMgqsHQm4TFhbRsiACZAvsuUPiQYqT1eqBZu loaV1t1X+SfIqonUE9icvY0BnHY3uJjA2O21WEkEeahVruhi3SLcQo4tCjrk2Q== X-Gm-Gg: AYBFou2Md6BIQu/8vgZbw2JtoZjvcxFr824jkNPu4FHbV7PM+kb9cRnXDtuuML1Zmd+ NMu4NeG30CYsg+wdJN/oQnRjw66mEJRlwY83BpCIjjoRYMrdf44NdzexT64MpO/OyaPfjcw43vV HpcTv7Piq4XiEomcDaZsO6FCWkMDmsV4fcEBo3t1JCvT1utzjVLm6O8303H/Bul1D2RQocg9xSE R2OoChNpiG3xQVI2vOqyc8JpYKY8Ndqnc97jOgv0BlimMwQYT5l89+DNH0tPJz7Y4siXwsLEKeO 25a6EpcWEDWDuZ6oatOGzSzjqDUIvedyi9CnpITu3hkVhgM3f7bcF2ACSqLW7bnQaYPFp3u7agB 4PJndTtUqFDhbO/IC3fL496iv0fi1wdyu5IxqDAioLKNt1Mnx9FnpEWY9N8L+mxj1ntFFJ3LsSZ ENrTAKVa9iZftnZ1ag7PqonWfEiSi4SPuHNMld5JSNzhuKjw/i9ACClRxhxf7gfw6eCn47uqCuI vqbnDq7EMRDEJ43hFfqU10= X-Received: by 2002:a17:902:e74d:b0:2dd:9b53:f9ba with SMTP id d9443c01a7336-2e84280a4f8mr155463525ad.1.1792043079757; Wed, 14 Oct 2026 22:44:39 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.38 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:39 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 51/82] python3-zeroconf: upgrade 0.151.3 -> 0.151.5 Date: Thu, 15 Oct 2026 18:41:39 +1300 Message-ID: <15b8501f248d1812df71b88778eb28038c24d8c3.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130971 From: Ankur Tyagi Changelog: https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.4 https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.5 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 92fff734092811bbca94ddfa3847a49ef5bea427) Signed-off-by: Ankur Tyagi --- ...{python3-zeroconf_0.151.3.bb => python3-zeroconf_0.151.5.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-zeroconf_0.151.3.bb => python3-zeroconf_0.151.5.bb} (88%) diff --git a/meta-python/recipes-devtools/python/python3-zeroconf_0.151.3.bb b/meta-python/recipes-devtools/python/python3-zeroconf_0.151.5.bb similarity index 88% rename from meta-python/recipes-devtools/python/python3-zeroconf_0.151.3.bb rename to meta-python/recipes-devtools/python/python3-zeroconf_0.151.5.bb index beadc0b3ed..4111f49a11 100644 --- a/meta-python/recipes-devtools/python/python3-zeroconf_0.151.3.bb +++ b/meta-python/recipes-devtools/python/python3-zeroconf_0.151.5.bb @@ -3,7 +3,7 @@ HOMEPAGE = "https://github.com/jstasiak/python-zeroconf" LICENSE = "LGPL-2.1-or-later" LIC_FILES_CHKSUM = "file://COPYING;md5=6ede793c8b5508eab1acfad7c0c4e335" -SRC_URI[sha256sum] = "ce6c548e665759b6150cef4db9ab9d7bdd89857e90c513abd6b7340bdd7dbd6a" +SRC_URI[sha256sum] = "28c2ec9d772007eedf11b41a9c9fd3d5c684c17b00721ff8f1ee31b20ad286a1" SRC_URI += "file://run-ptest" From patchwork Thu Oct 15 05:41:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100852 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8D095CC6B38 for ; Thu, 15 Oct 2026 05:44:49 +0000 (UTC) Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33263.1792043082183263444 for ; Wed, 14 Oct 2026 22:44:42 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=YzXYFg+y; spf=pass (domain: gmail.com, ip: 209.85.214.173, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2dd9cbb661bso35500775ad.3 for ; Wed, 14 Oct 2026 22:44:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043081; x=1792647881; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=v7wNuTsw1tO8TRt2bx8zyQzYcI3n3JSAyFpfDOt5gGU=; b=YzXYFg+yWiRU64jHxmqbttngaY/mTiDLOP8cqup/NEk+WmNU7WqmJWghw/pVz+fm2T F+x8daJa6Av4+bI+/o6H95E+ku+q8hbUBvQk3O8OQAFgd9tkxFYjbRWfCxdWW0vRBHMj yGmeIkOnipm+F5g4akqRxjevyuixo+pkKp9hA02LGk92BG9H2+flwXzjYALY9w4vJZV7 7iH57Ux4zG6pQdegD5dSseVaZNcA6MGB49dJyKQ0h3lZv21uYXZoXXrcdmWkSwYfVtP1 NwNasB4RAIsVKzuOr45d4oj+Xwqmbnc3AIF/E/h1VHQ4NzbqBC8/gdZwpLlJU+QYfqPm 6vCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043081; x=1792647881; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=v7wNuTsw1tO8TRt2bx8zyQzYcI3n3JSAyFpfDOt5gGU=; b=f94H8tdeSENcIggjL9WiUYxgJKzPsAGkTTsxjODWeXeD9f+GoSOr2p/NHKJYByPX+6 /MZIDJ4KfZ9l72D8OOVpQmrjkQ/2Y9R6rcZA4YG+/CGdUqFqBVKg2OEhjmvW+3V6ffFX HrHCxeTGnxpz7iSLL6y36zmsRDALE3huEJwfHs8WVsdSC8UkQDkypH9Qs2Wj4YnVf0QC Vn+Rlh/xI21XU6nHxPRIox87mqZqtSPGLim5q2o17JANmj+RsA72IWkoQIaYCulUiaVc T8vAdul7c/ck5/O9xoI15aMMnpaQPYiX3os2fMUVyZnXUEBWuKG0S/tBrfqddCylunb3 hbhQ== X-Gm-Message-State: AFq9FYKD/qgoeig+ljCOd3IWoxCOY7cyb3jK5ue/t58hG4cJ2rBsoeG+ q5k8ssS3RiR5QK2TSlLsqHiUONwa7gy89T9RuoTDdzSqY59/HOrsBCxGmfUFkg== X-Gm-Gg: AYBFou35fT96YeGATJoFbSyfllAR6G8nWpYn+uBycRP4oVmA5YMoUAHKzRj7lzSVCet rIwBR+pMKcpTjSUNsI7Tj2brgsvPdkcpseLlOr4po4JaNfQENRi5LBnZD0As5wI+11NBzj8/K1S MVDIcyEVdfmrYKn56TVKub1hpx9S4U8Jn7TSOlDg6r4AWaYZ6Kk3SD2s4/jYZR1aOezQ0uajP+/ U+Av8nzo24MAVIRlBqzjkVmLeFVF92jG8JACluOdS0Kx4I/5zI9RuaTs7Lp4JVyo6BpA+y18QHM 1MoSmF5Jh5Peva2EHCmj/9BjfaJ5VJYVG2RHodfq7Y4+rzaGgIL1QIdtgD4t2Vbkq+s/NzlAfcy Axq/lrKcGJTqPW/1NyYeLp8o8cFafV+N/h2zv+5YKTxR+C7jhDQ96zJ361fwrUvu7u5E6Ldborf mdRHWD4m6LnMc/GA1wouQXRBFUpQ3in6uYyEF4fZnWKCSAS8U8Gt5s/y5l8QOyW7LsLepbmdrmb OIhtc4wwnSjCvTmo4W+83Q= X-Received: by 2002:a17:902:f609:b0:2e9:5b4e:b8a1 with SMTP id d9443c01a7336-2e95b4f1282mr11315795ad.55.1792043081510; Wed, 14 Oct 2026 22:44:41 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:41 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 52/82] swagger-ui: upgrade 5.33.0 -> 5.33.1 Date: Thu, 15 Oct 2026 18:41:40 +1300 Message-ID: <41441be1cea37115153b9c8eabc6595649ac387d.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130972 From: Ankur Tyagi Changelog: https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.1 Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit 50c590bebc5269b1aadce1d907466c0fee131619) Signed-off-by: Ankur Tyagi --- .../swagger-ui/{swagger-ui_5.33.0.bb => swagger-ui_5.33.1.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-webserver/recipes-devtools/swagger-ui/{swagger-ui_5.33.0.bb => swagger-ui_5.33.1.bb} (94%) diff --git a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.0.bb b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb similarity index 94% rename from meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.0.bb rename to meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb index 45a3bb6d17..db2bb498a8 100644 --- a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.0.bb +++ b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb @@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" SRC_URI = "git://github.com/swagger-api/swagger-ui;branch=main;protocol=https;tag=v${PV}" -SRCREV = "cfd4a6c3cbaeeb7c13a8bada7c754de42d78cd5b" +SRCREV = "cac3d136b5e37bfbe3288c8591f6f4fcf9870599" CVE_STATUS[CVE-2016-1000229] = "fixed-version: fixed since 2.2.1" From patchwork Thu Oct 15 05:41:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100851 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9D78ACC6B3A for ; Thu, 15 Oct 2026 05:44:49 +0000 (UTC) Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32846.1792043084032022471 for ; Wed, 14 Oct 2026 22:44:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=k89P1jjZ; spf=pass (domain: gmail.com, ip: 209.85.214.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2e86dce4510so24893445ad.3 for ; Wed, 14 Oct 2026 22:44:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043083; x=1792647883; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=5NIk/Kgw5xvOD+JQHcmNKy9sbOP7mjMFnU6Y9lu4Afw=; b=k89P1jjZ8x1nejgwmULrJJLzVq480ikiDjb19U92Pg3yGtVue+GDGN3YEsjyciQ2Yb mpMZcaNDT+3H+eI5tsq1+SX2NXD4nuBVDFepklxcRFx0PddRAytD/VuaClJj7sYZFC89 DBpfFAIbcQSG0oUt0oPDJ1iODZadUVx5pJRO8ueRTKsj4PZYidB3Mnsp6H3ZYCEvwU0S MjezuPOFlFMjVCxtZjWHnY+Z4LmLW4h7etpUUsqfLLYrO0ClN6tIpL0+72WcneLbTut4 CSCyTTsafGNNDzBb0QChceJcCFI4Hd5wETv0DPBjoCd+0Tcm2RHLUqUFqYlYvhUz+PWb I0lA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043083; x=1792647883; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=5NIk/Kgw5xvOD+JQHcmNKy9sbOP7mjMFnU6Y9lu4Afw=; b=UBufP2aIjmYkiE4HXMwvx329G5H7lRU7WKAzQ+06sSPk19ItcDyFcT+M0b+4IozwBq +IMQvy16ELR/PKf0FqWGgKAhBnU5xbc+aBoMFIAejmUw2+ch7K0PlyNqhNORGmyJkH4T 4Yv3j3x5yfC3HdGoZFPtuGjZ29CkvD0WqnwVXywMZeM+QYZOc1ciBMV1M6ULGi7PtIU2 58NCi8z9ujf+qgkfiaviUfb1pB7ZvNQNQ1PaMKo1h3HHDFHD5jlTsiQMgpL9NFpIW/RN tKQmW5Uo9vZ3FREvywsVkpY3JT1GpCADNPFbPkmnGS6pnF2qrR5DwBVfSU9AzXBmojFm 4IaQ== X-Gm-Message-State: AFq9FYLjcVMuyILlEU+c/NIdqoEV9GtlAUT0yZuujtDMSCXs9q5grwnH dRoIZbcFuflDLmWKg57836UkNkCuYXMdetmgJLmqtk7de+9xb+/9LlcdHWxweA== X-Gm-Gg: AYBFou3RNV+/RDJnV/qUkr5fVocpO+m62m7gp+X510n/98y7I/sRKm/72Fk4VvHVCXJ cgIRPS/YO5fGjNUd8L6CT2eZx3U27VLZjjKC9gQ/MlCPlaTFtYy7hbUxe3UVBUYfD3CpZ5EYBTq Nf7DRnGau7xrqimOOGcFDZtrRMfhpvU1NzXhrpHTb+4mhIZgd/5uqUXir+OaYIdATJGVkCCponf 9nBdRO9GfV/mtqMyvQFj5yC6g2iVKwMIAlyFkw5yC/Mfis3cSdV1sI8w7BMnbdE/vvo7yJsnDjM I8N4OXRBQPFBj/UbCcc690Pga/3mw/lendz7FvJqx2SpUmZDVIvTGNE6CFJWzygglBRYHZRfS2u g8Jt4KjFdK0p57COZsyLSqBPUr5f9cN33Vsl0eonSl5X8ja21z/EtVbNbgvxkOrpnwzvsmPaPWX r1xmxGT8OJmqvk5XIQ5S0EczaaXHq+AZG/fSYFk1r8R70w1Vzx0WbASZDmDk3/IbDp/Jauf5B9H PJXpZrS+GwJizQzRN6QHzw= X-Received: by 2002:a17:903:3888:b0:2dd:ad73:c983 with SMTP id d9443c01a7336-2e842bc1478mr139844295ad.27.1792043083369; Wed, 14 Oct 2026 22:44:43 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.41 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:43 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 53/82] openvpn: ignore CVE-2026-84256 Date: Thu, 15 Oct 2026 18:41:41 +1300 Message-ID: <2f0a62d30c1ec36d867a16785c8859102e416261.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130973 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-84256 Signed-off-by: Ankur Tyagi --- meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb index 604162a7f2..9bf699124c 100644 --- a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb +++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb @@ -18,6 +18,7 @@ UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads" SRC_URI[sha256sum] = "3ab8f48fd6c26d49ba2333a092433949afdb5c85c0e6a1ff265784fbc04a2463" CVE_STATUS[CVE-2020-27569] = "not-applicable-config: Applies only Aviatrix OpenVPN client, not openvpn" +CVE_STATUS[CVE-2026-84256] = "not-applicable-platform: Issue only applies on Windows" INITSCRIPT_PACKAGES = "${PN}" INITSCRIPT_NAME:${PN} = "openvpn" From patchwork Thu Oct 15 05:41:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100850 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84C5FCC6B39 for ; Thu, 15 Oct 2026 05:44:49 +0000 (UTC) Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33264.1792043086129201362 for ; Wed, 14 Oct 2026 22:44:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=VfVI7adA; spf=pass (domain: gmail.com, ip: 209.85.214.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2e8f2c3ad6bso20405345ad.1 for ; Wed, 14 Oct 2026 22:44:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043085; x=1792647885; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Y2GZ05SsQvVqj9UW6c9UqSdHRBrdcYCibIAz3PnqTEY=; b=VfVI7adAL0oVigTrd06/dLrWgHC2JEV1VR6fXzqPqucnGjW8rx0eOEJu/nxNkWMlM7 1AUvYWTT1Koo1gosnyTuMqvApUkySeDigsb6uZoWA3jnhQwgkeKnUWEoPk4pBklMycpW bhnq6BlRel8ryb24YlzG2Gtbof1LvyxqswQFVv6NRxFbN4XsmrS3XaLBiPOWy3cbx5hC la3rl6+xtaAKcVTvNZnd5oFA2DdBys12be7iQ/kaEP/PjnQTb1bMROCW8PEQuWO4Idyl aHsKkPwZuiEqfV//fGEmywQunpKYJeBcXxTJ3EXcuxYely3GpSc7JxJUcdsdzztEyISS gkMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043085; x=1792647885; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Y2GZ05SsQvVqj9UW6c9UqSdHRBrdcYCibIAz3PnqTEY=; b=S0SmRaT4kuCQzw6MdlfmBVymCidFwXTNmc9jZayYhxgwjhORZTSrKBCIvtxwyQrAoi W9EjSc/uJpJ5fXqVsvHBi1sgCyUkNbZupTetRK+isHGtwh1tCr8G8kMDd4zaDO2YGWq/ OnrfLGXsQrN3ROWY0kLBNyWMpRJZoOcuncZIVN/69TGdFT5FtPg+/yIcD6U8UiPnfmx4 h/TURz9vJDU1TjdU/ubVC1OqIzBRFqLizSoouTCa2FDCQzZU08/qrbL1NNLG9ykv4Hpm EX9Q4IZx8D+62ddNvrpR0NtRIqI40JQVQ7T8WQZFj4pZ+saLgy9zflmGMFDNUQ1eYnhS UqMg== X-Gm-Message-State: AFq9FYJ7VPSsDbEX495xYoPb8yo7lLx1sR1PRkwSqtCcC6SyPJhJFvrw OLkRB93oeQbQl6eGaEMpwCOwIWlDqttdxmyr5QZbFC8A67fUrc7itpe5y+BN2Q== X-Gm-Gg: AYBFou0GvDgQ8Dty70MTrsMg+RWmPnpwUpXEH6C7cdxOmVyTGtjGWcrXtu5JCtC43/+ vzFzpeQdudGKzaXnEm1HyNduVWS8HUMj2QScxN2R1NRumbmIlWTw6uxcIB9bxmYHZFSaFyd3uB1 A+YPGS28/zE0ty2N+M7i8onkcKCqTFfouJrdVGXDAJoBSfsaCdOdG9yABwCGwXTER+ccO5bl7uI Dr7Q4xXjwnRO22b0IRbE6pz/BiIOuEgW4D++pscORoTfF1GVgb9dmkMCw6sheM4zL2J5pR8Bokw P+k1GqjxsCAWh7EISJOe8k8vV/wSGKcFQmpNSkm7N7QiOo+JUEx6mUjhlI+9ceBWgRVDhYd2GVl XhvrBnSSLJ5kqQGMcKzSzxBMfQQAIRTwnpgt0MK9rPEv5GoL04e7bHs/hUWsXLElDNj1blBlZ3P XcHoSGTM9UGpewRu8qc4qOih/N8GfAyDydRM/zAnJzB8gLgojkkH7DK1ILMomv3vevgUbUjNZZo SzsQX5JeX8PQUwRKqCP4Ew= X-Received: by 2002:a17:902:ef4f:b0:2e5:c563:c0dc with SMTP id d9443c01a7336-2e842cdb0f8mr162741675ad.42.1792043085250; Wed, 14 Oct 2026 22:44:45 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.43 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:44 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 54/82] openvpn: patch CVE-2026-88964 Date: Thu, 15 Oct 2026 18:41:42 +1300 Message-ID: <7bd75dc53f49ca24e01ec11125c81481cc82175a.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130974 From: Ankur Tyagi Backport commit identified by Debian[1], also mentioned in the release note https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8 [1]https://security-tracker.debian.org/tracker/CVE-2026-88964 Signed-off-by: Ankur Tyagi --- .../openvpn/openvpn/CVE-2026-88964.patch | 78 +++++++++++++++++++ .../recipes-support/openvpn/openvpn_2.7.7.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch diff --git a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch new file mode 100644 index 0000000000..a2b9b0ec8a --- /dev/null +++ b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch @@ -0,0 +1,78 @@ +From 22526848c6606698d6374c496f36009b9c6787ce Mon Sep 17 00:00:00 2001 +From: Cole Munz +Date: Sun, 13 Sep 2026 15:23:17 +0200 +Subject: [PATCH] options: fix unsigned underflow when clearing + domain_search_list + +remove_option() and update_option() clear the domain search list with + + while (o->domain_search_list_len-- > 0) + +domain_search_list_len is unsigned, and the post-decrement runs on the +final test too. When the length reaches 0 the condition is false but +the decrement has already wrapped it to UINT_MAX, so the field is left +corrupted. The next reset then does + + o->domain_search_list[UINT_MAX] = NULL + +and walks far out of bounds, writing NULL through each slot. A server +can drive this reset path against a client with PUSH_UPDATE, so on +Windows and Android this is a remotely reachable out-of-bounds write. + +v2: + Change to the semantics used for all the other lists there - set + length to 0 and clear the list with CLEAR(). + +Change-Id: I3724236d4acc3d05d786274d6baf34a21c570594 +Signed-off-by: Cole Munz +Acked-by: Razvan Cojocaru +Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1914 +Github: OpenVPN/openvpn-private-issues#178 +CVE: 2026-88964 +Message-Id: <20260913132322.2283-1-gert@greenie.muc.de> +URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg39157.html +Signed-off-by: Gert Doering +(cherry picked from commit aa12dd64b74142bbbff9f37cec05959ba115c06d) +(cherry picked from commit d586f8ad9bfc582cc7984fcd482dc7cfacc940e2) + +CVE: CVE-2026-88964 +Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/d586f8ad9bfc582cc7984fcd482dc7cfacc940e2] +Signed-off-by: Ankur Tyagi +--- + src/openvpn/options.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/src/openvpn/options.c b/src/openvpn/options.c +index b7d035b6..847572c2 100644 +--- a/src/openvpn/options.c ++++ b/src/openvpn/options.c +@@ -5220,12 +5220,12 @@ remove_option(struct context *c, struct options *options, char *p[], bool is_inl + memset(o->ntp, 0, sizeof(o->ntp)); + o->nbdd_len = 0; + memset(o->nbdd, 0, sizeof(o->nbdd)); +- while (o->domain_search_list_len-- > 0) +- { +- o->domain_search_list[o->domain_search_list_len] = NULL; +- } ++ o->domain_search_list_len = 0; ++ CLEAR(o->domain_search_list); + o->disable_nbt = 0; + o->dhcp_options = 0; ++ CLEAR(options->dns_options.from_dhcp); ++ + #if defined(TARGET_ANDROID) + o->http_proxy_port = 0; + o->http_proxy = NULL; +@@ -5524,10 +5524,8 @@ update_option(struct context *c, struct options *options, char *p[], bool is_inl + CLEAR(o->ntp); + o->nbdd_len = 0; + CLEAR(o->nbdd); +- while (o->domain_search_list_len-- > 0) +- { +- o->domain_search_list[o->domain_search_list_len] = NULL; +- } ++ o->domain_search_list_len = 0; ++ CLEAR(o->domain_search_list); + o->disable_nbt = 0; + o->dhcp_options = 0; + diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb index 9bf699124c..6338a0c816 100644 --- a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb +++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb @@ -11,6 +11,7 @@ SRC_URI = "https://github.com/OpenVPN/openvpn/releases/download/v${PV}/${BP}.tar file://0001-configure.ac-eliminate-build-path-from-openvpn-versi.patch \ file://openvpn \ file://run-ptest \ + file://CVE-2026-88964.patch \ " UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads" From patchwork Thu Oct 15 05:41:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100853 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C629CCC6B3B for ; Thu, 15 Oct 2026 05:44:49 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33266.1792043088250421654 for ; Wed, 14 Oct 2026 22:44:48 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Y8j6ROW9; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2d6d28aa26cso7126975ad.2 for ; Wed, 14 Oct 2026 22:44:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043088; x=1792647888; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=yl091zSqxJ1wyONVqV3/9eoGbFJvQFprUh6CXfXL+Aw=; b=Y8j6ROW9X20zuDoeFPDIMO7M7YlBGnUhjDnPn3yAFauDM7ABjL+0i/jcvJxpdlGl9F qDgO/FkhNjcYVUdHS1ymRDSdh5Z7vUPLxBQwofCG8xia+CNu1L8ybjVNa10o5x8eRqDx kMtGjADSfWb3Faj+USbt/8s6Ne89aGrbOENkjXpR+mVi77WzcmJi91kVvGBthXde9lkd b1fgP3fzGiOJ0d6oW3ZuRjdDt6mnbTlN7j+xfC69PIsPFWV+eGat+aXE50kQYbsEBHTq 1FDx4hJzyi/ujLiPgLStqO0Sby4NdZBvrunFuafnpSRd5iCTrykRlZhs5+2tzW+BFuGW 8kqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043088; x=1792647888; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=yl091zSqxJ1wyONVqV3/9eoGbFJvQFprUh6CXfXL+Aw=; b=JuVsbMxiyt7BhAjQwL3DIRLEvHe1GF+lx3b5Ef4McWtU3HpRDZDwyga7qT6hMnyiOT enByna/siTNrIIw7z+KRXsHfSNnIp29e1dyU8gYzQGDZ5N2nJquzX/sMcnESR6rh0P/J Fj9ecegArodfgnDmE6EbCLDy69226qpmFG/DQXMVxg3kZtM5zymgBC2yp+QD8xyDrhEA 2hwtY02jkkhewMm0IV6uVVSJa+WRbvwcddzWrke2iTZBDG7n6fnhKXbZAvh9qSzNNPOP kkuT5Z8l+P30rW8s/kNgixYnfnilzTa3PdWpCvBBgTcPkwkSNaT6sPwbpPGGBxSlkv/I Xdfg== X-Gm-Message-State: AFq9FYLG55Een3Nflahuyeg4fgKamaALJLkhFdQ4Hlv0RSkaPNIunPJo XdkzbWsDr7W6rpLI/O6Z0y1pOXHocN9Xu1lgQ4d+d2MZ63niTaF2f4hq3if5Kw== X-Gm-Gg: AYBFou16kVuBfjKllIP52QzFlo7wtugKYJYsTdezwc1DJSlcYzc/If7ZyZTztp2wc+E xccPBZf6QatEiKvNrlc0YOqO1HMPfF/wZDbdMIEnEVXvXbshmDvUNJMoELQ9gcfbZPXlBznNgoo e/GDqg6KFENmjpc7qKBQ9JXb9IMdJSwp2B223EOf/DS8r2rrJW3jfdkWg9+tZQkB4yZ3k/PU4TR 0JRjPEbn7W4fcAtil2TGUH4ZwNHuoopbDKgSeej/ccQgmxOJs7FG1+qwqqrazvSmAxcmtYa1pKX FdJUomg3oRwBz2cxITH1C5qQCFjBxzRFQvrFv3Fo1Z3OW3T86/VxyBZcTYLu6o0enFfOpha2Jez IhsPY/x51RssV0dp32/hSgDRAxCSyctPuulSUcwKw1Vl4JUyI+pJNdckRydrEjlfAN6DGO11gwL sHqJ48LMjjrjmll0FoJL39zSkmVbmtjWSVaBxya+WP3gpUbsyZU7PeekYoDgQVgJOLOGo5ZPE5G LfjmOzN1unM0K3MwKWXm+E= X-Received: by 2002:a17:903:950:b0:2e6:136e:f264 with SMTP id d9443c01a7336-2e842dfd193mr149451585ad.50.1792043087395; Wed, 14 Oct 2026 22:44:47 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.45 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:46 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 55/82] openvpn: patch CVE-2026-84790 Date: Thu, 15 Oct 2026 18:41:43 +1300 Message-ID: <6df0b8c57663e0aee6e405dd7e4624c8e0817dfd.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130975 From: Ankur Tyagi Backport commit identified by Debian[1], also mentioned in the release note https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8 [1]https://security-tracker.debian.org/tracker/CVE-2026-84790 Signed-off-by: Ankur Tyagi --- .../openvpn/openvpn/CVE-2026-84790.patch | 361 ++++++++++++++++++ .../recipes-support/openvpn/openvpn_2.7.7.bb | 1 + 2 files changed, 362 insertions(+) create mode 100644 meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch diff --git a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch new file mode 100644 index 0000000000..b6f70d106d --- /dev/null +++ b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch @@ -0,0 +1,361 @@ +From 493c3b382a907ff2d5870cd0d21526bd2e866ebb Mon Sep 17 00:00:00 2001 +From: Max Fillinger +Date: Thu, 17 Sep 2026 14:46:05 +0200 +Subject: [PATCH] Check for null-bytes in certificate subjects + +When using the OpenSSL library, we escaped embedded null-bytes in a +certificate's subject in x509_get_subject(), but in +extract_x509_field_ssl(), we copied any null-bytes that are contained in +the field value. When using the option --verify-x509-name, this could +lead to an incorrect name being accepted. For example, the common name +"admin\0impersonator" would be accepted when running with +--verify-x509-name admin name. + +To fix this, this commit makes x509_get_subject() return an error if the +subject contains an embedded null-byte. This way, OpenVPN won't connect +with peers that present such certificates. + +As a defense-in-depth measure, we also check for null-bytes in +extract_x509_field_ssl() in case a future version of OpenVPN has a code +path that avoids x509_get_subject(). + +With Mbed TLS, the x509_get_subject() function already returned an error +when there is an embedded null-byte. (As of Mbed TLS 3.5.) Here too, we +added a check for null-bytes to the function where we extract individual +fields from the subject. + +Also, backend_x509_get_username() is changed so that it returns the +value of the *last* matching field, to be consistent with the behavior +of the OpenSSL backend. + +This is a partial backport of the commit +"Check for \0 and RFC 2253 chars in cert subjects" from the master +branch but skipping the part about escaping RFC 2253 characters to avoid +user-visible changes in a patch release. We do not consider the +null-byte check "user-visible" because we don't expect users to put +null-bytes into the common name. + +v2: The previous version of the commit unescaped control characters in +the subject, so it had user-visible changes after all. This version +escapes any control characters in the subject. + +Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2. +Contributing Researcher: Vivek Parikh. + +CVE: 2026-84790 +Reported-by: Vivek Parikh +Github: OpenVPN/openvpn-private-issues#163 + +Change-Id: Iea1481e94ba1abe18c39d81cd797187c88427571 +Signed-off-by: Max Fillinger +Acked-by: Steffan Karger +Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1902 +Message-Id: <20260917124610.14291-1-gert@greenie.muc.de> +URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg39304.html +Signed-off-by: Gert Doering +(cherry picked from commit cf4384eef4676a01bd3ee98fa602f7b2af8079ea) + +CVE: CVE-2026-84790 +Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/cf4384eef4676a01bd3ee98fa602f7b2af8079ea] + +Signed-off-by: Ankur Tyagi +--- + src/openvpn/ssl_verify_mbedtls.c | 51 ++++++++++------ + src/openvpn/ssl_verify_openssl.c | 41 ++++++++++--- + tests/unit_tests/openvpn/test_ssl.c | 92 ++++++++++++++++++++++++++++- + 3 files changed, 155 insertions(+), 29 deletions(-) + +diff --git a/src/openvpn/ssl_verify_mbedtls.c b/src/openvpn/ssl_verify_mbedtls.c +index 66cc66e5..1319c079 100644 +--- a/src/openvpn/ssl_verify_mbedtls.c ++++ b/src/openvpn/ssl_verify_mbedtls.c +@@ -214,6 +214,24 @@ fieldname_to_oid(const char *fieldname) + } + } + ++static bool ++asn1_buf_is_cstr_compatible(const mbedtls_asn1_buf *asn1_buf) ++{ ++ if (!(asn1_buf->tag == MBEDTLS_ASN1_UTF8_STRING || asn1_buf->tag == MBEDTLS_ASN1_PRINTABLE_STRING ++ || asn1_buf->tag == MBEDTLS_ASN1_IA5_STRING)) ++ { ++ return false; ++ } ++ for (size_t i = 0; i < asn1_buf->len; i++) ++ { ++ if (asn1_buf->p[i] == '\0') ++ { ++ return false; ++ } ++ } ++ return true; ++} ++ + result_t + backend_x509_get_username(char *cn, size_t cn_len, char *x509_username_field, mbedtls_x509_crt *cert) + { +@@ -259,16 +277,17 @@ backend_x509_get_username(char *cn, size_t cn_len, char *x509_username_field, mb + } + + /* Find field_oid in the subject name. */ +- mbedtls_x509_name *name = &cert->subject; +- while (name != NULL) ++ mbedtls_x509_name *name = NULL; ++ mbedtls_x509_name *next = &cert->subject; ++ while (next != NULL) + { +- if (strlen(field_oid) == name->oid.len +- && 0 == memcmp(name->oid.p, field_oid, name->oid.len)) ++ if (strlen(field_oid) == next->oid.len ++ && 0 == memcmp(next->oid.p, field_oid, next->oid.len)) + { +- break; ++ name = next; + } + +- name = name->next; ++ next = next->next; + } + + /* Not found, return an error if this is the peer's certificate */ +@@ -277,6 +296,11 @@ backend_x509_get_username(char *cn, size_t cn_len, char *x509_username_field, mb + goto fail; + } + ++ if (!asn1_buf_is_cstr_compatible(&name->val)) ++ { ++ goto fail; ++ } ++ + /* Check that we have room in the buffer, including the terminating '/0' byte. */ + if (cn_len <= name->val.len) + { +@@ -586,22 +610,11 @@ do_setenv_x509(struct env_set *es, const char *name, char *value, int depth) + static char * + asn1_buf_to_c_string(const mbedtls_asn1_buf *orig, struct gc_arena *gc) + { +- size_t i; + char *val; + +- if (!(orig->tag == MBEDTLS_ASN1_UTF8_STRING || orig->tag == MBEDTLS_ASN1_PRINTABLE_STRING +- || orig->tag == MBEDTLS_ASN1_IA5_STRING)) ++ if (!asn1_buf_is_cstr_compatible(orig)) + { +- /* Only support C-string compatible types */ +- return string_alloc("ERROR: unsupported ASN.1 string type", gc); +- } +- +- for (i = 0; i < orig->len; ++i) +- { +- if (orig->p[i] == '\0') +- { +- return string_alloc("ERROR: embedded null value", gc); +- } ++ return string_alloc("ERROR: Unsupported string type or embedded null bytes.", gc); + } + val = gc_malloc(orig->len + 1, false, gc); + memcpy(val, orig->p, orig->len); +diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c +index a30099d0..1f2804ff 100644 +--- a/src/openvpn/ssl_verify_openssl.c ++++ b/src/openvpn/ssl_verify_openssl.c +@@ -196,12 +196,13 @@ extract_x509_field_ssl(const X509_NAME *x509, const char *field_name, char *out, + int lastpos = -1; + int tmp = -1; + unsigned char *buf = NULL; ++ result_t ret = FAILURE; + + ASN1_OBJECT *field_name_obj = OBJ_txt2obj(field_name, 0); + if (field_name_obj == NULL) + { + msg(D_TLS_ERRORS, "Invalid X509 attribute name '%s'", field_name); +- return FAILURE; ++ goto exit; + } + + ASSERT(size > 0); +@@ -222,28 +223,31 @@ extract_x509_field_ssl(const X509_NAME *x509, const char *field_name, char *out, + /* Nothing found */ + if (lastpos == -1) + { +- return FAILURE; ++ goto exit; + } + + const X509_NAME_ENTRY *x509ne = X509_NAME_get_entry(x509, lastpos); + if (!x509ne) + { +- return FAILURE; ++ goto exit; + } + + const ASN1_STRING *asn1 = X509_NAME_ENTRY_get_data(x509ne); + if (!asn1) + { +- return FAILURE; ++ goto exit; + } +- if (ASN1_STRING_to_UTF8(&buf, asn1) < 0) ++ int length = ASN1_STRING_to_UTF8(&buf, asn1); ++ if (length < 0 || (size_t)length != strlen((char *)buf)) + { +- return FAILURE; ++ goto exit; + } + + strncpynt(out, (char *)buf, size); + +- const result_t ret = (strlen((char *)buf) < size) ? SUCCESS : FAILURE; ++ ret = (strlen((char *)buf) < size) ? SUCCESS : FAILURE; ++ ++exit: + OPENSSL_free(buf); + return ret; + } +@@ -384,15 +388,34 @@ x509_get_subject(X509 *cert, struct gc_arena *gc) + goto err; + } + ++ /* Get the subject with unescaped control characters so that we can check for null bytes. */ + X509_NAME_print_ex(subject_bio, X509_get_subject_name(cert), 0, +- XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN | ASN1_STRFLGS_UTF8_CONVERT +- | ASN1_STRFLGS_ESC_CTRL); ++ XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN | ASN1_STRFLGS_UTF8_CONVERT); + + if (BIO_eof(subject_bio)) + { + goto err; + } + ++ BIO_get_mem_ptr(subject_bio, &subject_mem); ++ if (memchr(subject_mem->data, 0, subject_mem->length) != NULL) ++ { ++ msg(M_WARN, "ERROR: Certificate subject contains a '\\0' byte."); ++ goto err; ++ } ++ ++ /* Now output the subject with escaped control characters. */ ++ if (BIO_reset(subject_bio) != 1) ++ { ++ goto err; ++ } ++ X509_NAME_print_ex(subject_bio, X509_get_subject_name(cert), 0, ++ XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN | ASN1_STRFLGS_UTF8_CONVERT ++ | ASN1_STRFLGS_ESC_CTRL); ++ if (BIO_eof(subject_bio)) ++ { ++ goto err; ++ } + BIO_get_mem_ptr(subject_bio, &subject_mem); + + subject = gc_malloc(subject_mem->length + 1, false, gc); +diff --git a/tests/unit_tests/openvpn/test_ssl.c b/tests/unit_tests/openvpn/test_ssl.c +index 7e7679c5..adfc07a8 100644 +--- a/tests/unit_tests/openvpn/test_ssl.c ++++ b/tests/unit_tests/openvpn/test_ssl.c +@@ -884,6 +884,94 @@ crypto_test_print_cert_details(void **state) + free_certificate(cert); + } + ++/* Certificate with two CNs, "foo" and "bar". ++ * ++ * Generated with: ++ * openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -subj "/CN=foo/CN=bar" \ ++ * -noenc -out two_cns.crt -keyout two_cns.key ++ */ ++static const char *cert_with_two_cns = ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIByTCCAVCgAwIBAgIUZuvd8Wfnq5jeRc3ohoJ/Vza54wQwCgYIKoZIzj0EAwIw\n" ++ "HDEMMAoGA1UEAwwDZm9vMQwwCgYDVQQDDANiYXIwHhcNMjYwODI4MTU1NjAwWhcN\n" ++ "MjYwOTI3MTU1NjAwWjAcMQwwCgYDVQQDDANmb28xDDAKBgNVBAMMA2JhcjB2MBAG\n" ++ "ByqGSM49AgEGBSuBBAAiA2IABERAfb210NOACy+QVYAu3EXrcGhTJpZDfhpDnE/h\n" ++ "PvPMWGWzqecTYdseArxZc0T/5Xma36IKCjGGsgN9ypZ5oQugQlB/NrVRCJIuHSGA\n" ++ "hGBWFvnUsqdNo765lGwVdBwhY6NTMFEwHQYDVR0OBBYEFPwnD+wK9R81Syk0qyTI\n" ++ "dFT/BNoJMB8GA1UdIwQYMBaAFPwnD+wK9R81Syk0qyTIdFT/BNoJMA8GA1UdEwEB\n" ++ "/wQFMAMBAf8wCgYIKoZIzj0EAwIDZwAwZAIwGxazGb6RRQtXzOWCPLRKId4e+E88\n" ++ "cwoCK3UwzEr8+Ddf54w5cEZC54f5J6AKFUJjAjBpT/JqF41uK57H+8i/16oZkBcm\n" ++ "OyQnlH8W/UzZo3/weTEBTcNW0iuCpIrS6im8pSk=\n" ++ "-----END CERTIFICATE-----\n"; ++ ++void ++ssl_test_extract_last_matching_field(void **state) ++{ ++ /* When there are multiple fields of the same type in the certificate's subject, OpenVPN ++ * should extract the value of the last matching field. This is essentially arbitrary and there ++ * is no correct choice here, but this test exists to make sure that the behavior is consistent ++ * between different backends. ++ */ ++ openvpn_x509_cert_t *cert = get_certificate(cert_with_two_cns); ++ ++ char username[TLS_USERNAME_LEN + 1] = { 0 }; ++ assert_int_equal(backend_x509_get_username(username, sizeof(username), "CN", cert), SUCCESS); ++ assert_string_equal(username, "bar"); ++ free_certificate(cert); ++} ++ ++/* Certificate with a null-byte embedded in the CN. ++ * ++ * Generated with the following Python script: ++ * ++ * from cryptography import x509 ++ * from cryptography.x509.oid import NameOID, ExtensionOID, ExtendedKeyUsageOID ++ * from cryptography.hazmat.primitives import hashes, serialization ++ * from cryptography.hazmat.primitives.asymmetric import ec ++ * import datetime ++ * ++ * private_key = ec.generate_private_key(ec.SECP384R1()) ++ * now = datetime.datetime.now(datetime.timezone.utc) ++ * name = "with\x00null" ++ * ++ * cert = (x509.CertificateBuilder() ++ * .subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, name)])) ++ * .issuer_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, name)])) ++ * .public_key(private_key.public_key()) ++ * .serial_number(x509.random_serial_number()) ++ * .not_valid_before(now) ++ * .not_valid_after(now + datetime.timedelta(days=10 * 365)) ++ * .sign(private_key, hashes.SHA256())) ++ * ++ * print(str(cert.public_bytes(serialization.Encoding.PEM), encoding='utf-8')) ++ **/ ++static const char *cert_with_null = ++ "-----BEGIN CERTIFICATE-----\n" ++ "MIIBZTCB66ADAgECAhRLWdNRl+C20KKBG4QC9HFPWlOtBzAKBggqhkjOPQQDAjAU\n" ++ "MRIwEAYDVQQDDAl3aXRoAG51bGwwHhcNMjYwODI4MTQzMDA4WhcNMzYwODI1MTQz\n" ++ "MDA4WjAUMRIwEAYDVQQDDAl3aXRoAG51bGwwdjAQBgcqhkjOPQIBBgUrgQQAIgNi\n" ++ "AAT7PE+vJCBiB4CVHBcvJVF9n5n/dGQIn4C8HeYE8M2iXYCIRW5wg6/mlPaeiJY/\n" ++ "Ywh3pa8zhto1+aczbJKTvLgRwXn6N5vNpME1c5iWMzY0WHe1dJyVtoRBvkNvy5+k\n" ++ "GuEwCgYIKoZIzj0EAwIDaQAwZgIxAP2ekdQ8muG8Nv2o3PsBp0CqiaSNByGiP75i\n" ++ "k099bUFvHp/3LSp8Wf4JK2iWzc5h6gIxAINBGg2xjlmMgpXxROKA9qQqaM3d92Mp\n" ++ "EzZyRyPM3PGR83ZPbIaYDq8lCVxVlbYr/Q==\n" ++ "-----END CERTIFICATE-----\n"; ++ ++void ++ssl_test_reject_null_in_cert_subject(void **state) ++{ ++ openvpn_x509_cert_t *cert = get_certificate(cert_with_null); ++ struct gc_arena gc = gc_new(); ++ ++ /* Trying to get the subject as a whole should fail. */ ++ assert_ptr_equal(x509_get_subject(cert, &gc), NULL); ++ ++ /* Trying to extract the common name should fail. */ ++ char username[TLS_USERNAME_LEN + 1] = { 0 }; ++ assert_int_equal(backend_x509_get_username(username, sizeof(username), "CN", cert), FAILURE); ++ gc_free(&gc); ++ free_certificate(cert); ++} + + int + main(void) +@@ -908,7 +996,9 @@ main(void) + cmocka_unit_test(test_data_channel_roundtrip_bf_cbc), + cmocka_unit_test(test_data_channel_known_vectors_epoch), + cmocka_unit_test(test_data_channel_known_vectors_shortpktid), +- cmocka_unit_test(crypto_test_print_cert_details) ++ cmocka_unit_test(crypto_test_print_cert_details), ++ cmocka_unit_test(ssl_test_extract_last_matching_field), ++ cmocka_unit_test(ssl_test_reject_null_in_cert_subject) + + }; + diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb index 6338a0c816..f4aa8fce9c 100644 --- a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb +++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb @@ -12,6 +12,7 @@ SRC_URI = "https://github.com/OpenVPN/openvpn/releases/download/v${PV}/${BP}.tar file://openvpn \ file://run-ptest \ file://CVE-2026-88964.patch \ + file://CVE-2026-84790.patch \ " UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads" From patchwork Thu Oct 15 05:41:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100854 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1C73CC6B38 for ; Thu, 15 Oct 2026 05:44:59 +0000 (UTC) Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32850.1792043090512042850 for ; Wed, 14 Oct 2026 22:44:50 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=l5sJzzoS; spf=pass (domain: gmail.com, ip: 209.85.214.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2e6038cebefso36462285ad.0 for ; Wed, 14 Oct 2026 22:44:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043090; x=1792647890; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=bEDQS+kx9VMgq5JbOjminOwY+7UtO3rsA4XnZSG/ZsI=; b=l5sJzzoSYUbN/VDfivt4vIU/zfzNfDTSbo1HcNRyckCZ/4r82V6XkqGPiba+8j9yU7 eB5Kr/dN1JF/VDfxk4op0tz3So4umHnXFXyeXXZetcRzPutnU3309tHX/POZov1+JCzv 9LKssJlcVWVkiPiZBGuIalnP/7XvHKlXbNgtPWM7B817Pft66dO52N4s6osgNR0YbTVU Y1F+4e4JkFPokZ3XOw9OlsWINoaYq2T5vM+MMfStc/TFJbPuUI4w3M4jXnlh/cuoqhYh vXHPxhCqMxYXwx5Ec9nIKijqeEpAfj86J11AWsqO6Fj5RYVLBU8OPDqE+fwhp4vKRMBv FNyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043090; x=1792647890; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=bEDQS+kx9VMgq5JbOjminOwY+7UtO3rsA4XnZSG/ZsI=; b=mGXhAub/N24dLkqIM3RgpazU9NCcmx3IXDFMBD5qgvT+HJi31+5R0vmo2Hwa8qOPAm 0QJSrXEeMuOp1TijuM54L3922c1WZu4aUKkWXkFznX40Os1C6S8YbuG840ysGrnGor8Z gnNRfArxEH0yhR7k44JhJYlaZ2awQhVO91499OC9uYg0Qjer0vvI4GzauZzSRb07/6ap +Fn9vgHZmdD80gtZQuwtgUuVgN6ne6GNzuFedi9yTPmqpehs0Kw3DX+mezCrfTqftW3p B/OK3zupG/fwdbHAkM/CbhcNFDxKNGlPT7YR+2Bb09E8eUnpBQEiOBbe8tYFWFhp+VhK nSbw== X-Gm-Message-State: AFq9FYLd/WRNFlU9giVoGS840127riGr3bqvCJ4kxpzLxJncPAM51LBJ JlAB97WDABONFu2Fg8Vo7JquC6LM9SLLUC0o2WAMzUuLwRMl7F0eNX4T43h0kw== X-Gm-Gg: AYBFou2zJTt5kxyHrvlxJWMTo8luEtdOcXKCwn7fwq3w+SuOvcUT2rNFyLihDRfhybY 80B7otOnEbvzU4pvPNFBOmRuciFOQtbPeD9BwBmsU1uNzfYa5IkAeci6UNOFHckkPp3NlkOE8/q wlD533IVehdwt4dBt7l5GMbiY8MQnjOImv7quh7e6fgL6hWslDiFbFqB+d9m2Be6CRUgcJJxdrY 2mDDlfIOCRt93tUuL8+MW9PPH0Mf2CkqY5jGOb62I/lGt2ybLThd4b8zzzQk2Z6fZi4Cwkjqs69 Ebaq5mqb+PSbX4diqhcrzQnxpDDERDC12MbtDgu8wVss3obyLxeU1vCnFbsMByjEC6/V3l+czS9 tq+o5gtEXdBkeUSjFSUBUCH+sWLllpCpRLX4z07mWOkkai7RNHemVLzG1P19MGhWyVjxMTt0i9Z I+Xqr1381c+NTgOOSy3hl3UzD/p6eALOMK/Y6SMfaXphR1XCZl4/hK50zWQvK/UJB30ucAEe6m5 7+lwxzHy3vMV76vbtoIDt4= X-Received: by 2002:a17:902:cec2:b0:2e6:1715:e48d with SMTP id d9443c01a7336-2e842ac8863mr172177035ad.35.1792043089753; Wed, 14 Oct 2026 22:44:49 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:49 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 56/82] python3-eventlet: mark CVE-2023-29483 fixed Date: Thu, 15 Oct 2026 18:41:44 +1300 Message-ID: <183033afe8737f3bea8f7f864bb3452fc30142c0.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130976 From: Ankur Tyagi Fix[1] for the CVE is part of the upstream version. Details: https://nvd.nist.gov/vuln/detail/cve-2023-29483 [1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 47b2ce9cc77297c740ecf50d00d6956f5a867144) Signed-off-by: Ankur Tyagi --- meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb b/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb index 3292950e2c..67a69b1478 100644 --- a/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb +++ b/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb @@ -17,3 +17,5 @@ RDEPENDS:${PN} += " \ python3-dnspython \ python3-greenlet \ " + +CVE_STATUS[CVE-2023-29483] = "fixed-version: fixed since v0.35.2" From patchwork Thu Oct 15 05:41:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100855 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD8B3CC6B39 for ; Thu, 15 Oct 2026 05:44:59 +0000 (UTC) Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32851.1792043092509503764 for ; Wed, 14 Oct 2026 22:44:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=YcUC7edj; spf=pass (domain: gmail.com, ip: 209.85.214.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2e8455755f3so25501925ad.0 for ; Wed, 14 Oct 2026 22:44:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043092; x=1792647892; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=nHw5JRLgOlcFY5DYdmACJelptg6LctIJStO918gX8nQ=; b=YcUC7edjAEjWz85Fvi7G3NvafkBarmpBRPC5qcBwgbL7iCf4LKo5hrxvh8dB3rmumW KVsKbPViA/ket7QZkiAEiwCfWx45sU24B7igzbWISOzpxK82LOYFgQkQwsdv5sgNIIee usjIl4oWSp4pU028771CH/BXrpIHKBPO5VVx7ZlmAYfH0/wColV5XBtlFkofEsGQnEN1 jaUAXwfMxnB4oWBckWQxs2/DkyO1zm+97S6YTtXfcADacVUHbXGJLce4p40ygzelM5h3 T0TWSYg1x8fk1ppq5sVvuDlvo4usePtZzYW7LEQ11/bXvAsj6Oym8n54DsojKzPxp65I OeLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043092; x=1792647892; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=nHw5JRLgOlcFY5DYdmACJelptg6LctIJStO918gX8nQ=; b=q3mOCM0itx7iNXUA6+KsGOJ0Qg1L6MY1mvY2GswWBJKdFxKOng3BfEL7HZTY+hRlJD UwKGecBoHk3H3ac86PZ7/Nw98C1jxcsvb5b3Nupvtr+xFocJQ7jZfrfBc6lCN/x8/lNy FI1ouHCVAS5MeXi37RvByooq+53SngWU/NczsuS7Z4UHqiMaTG4P/AiCP+QL35RCTMXW qMizo9hn81D3b1RqmFYIrIeu/gmIXUZLeThNT3gyXWkyJtK1jJPLQjNPtYeH3xacTb+p 6kl8iqxwmiXbKgRIpdZ8F0CdhxBYyRNlETXl7kf3uL6WLlwntsXIbyNHp5q79EaxJ0Pm waFw== X-Gm-Message-State: AFq9FYJwBSoNS2OKojiSFUW2vBWFPs5jS36Yn4QyxgUaV1Daod9v182B LEMiRqGS7OfSce8XzOwyeOoiweBv1bR6g/OrKPJ/twAXXH8/pW3N7raVgLqF2Q== X-Gm-Gg: AYBFou3mSrwuOYOra4p90PlJPCjrvYqvgepNHHbjNvhbuE4Hw5HXSLoaMcoptzB2ThA QTpzB1pCx762IW++4F+tWitve9AuRSqF6NyqnDITk2WAzQBiietOXy3WSN3GP3fFJbJK69Vkkcn kQMWeeK7ArXJv0aJTddrKSWUsx6hqD9iY8EO/iOkpP4EYs6aDHNMt/pvjtg+OyNODidj66F6Pee axje9o2vFrvUIAXpcKPz5+b7rBRf0k3Sv1y03rnIqr+syFsHbIOjtCNYQSw7Qaw+G1xwnlboTjm TddBwSnKdWH7tMvWfw3vcpT0EpXeBu6eqFcwbAEZxLbd2f8Ko0JqL9BRGDauAF5Vj1YC6LWxzp+ 71lRLsFso9c4lXVndeGttHmlSyanAPY9QuXMu/68w8CX/wrgyzmPTjH/b3OieFTxnb1oGDABVOk f4Zz8MGs6wIGLDGX6cCv3y0vn2Ap7D+/tsLhp5kFbe6GjmHHyLUn7uwaGwNPe4+QL3ITLee4qXL b/x36vs+ZhTt0p3TZUd7Hw= X-Received: by 2002:a17:902:d505:b0:2e5:e53d:f458 with SMTP id d9443c01a7336-2e842bcb8afmr169792515ad.41.1792043091741; Wed, 14 Oct 2026 22:44:51 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:51 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 57/82] cjson: patch CVE-2026-87933 Date: Thu, 15 Oct 2026 18:41:45 +1300 Message-ID: <1964bbc4750d6889f7cb8a2a00c0776c2247f5dd.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130977 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-87933 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 2b3f5cbbd85177f06cea6f89f0b6d83bba48da40) Signed-off-by: Ankur Tyagi --- .../cjson/cjson/CVE-2026-87933.patch | 110 ++++++++++++++++++ .../recipes-devtools/cjson/cjson_1.7.19.bb | 1 + 2 files changed, 111 insertions(+) create mode 100644 meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch diff --git a/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch b/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch new file mode 100644 index 0000000000..3972e5eafc --- /dev/null +++ b/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch @@ -0,0 +1,110 @@ +From a1b370963c98e1374e5538e97841f9d476a8932e Mon Sep 17 00:00:00 2001 +From: lilu5458 +Date: Wed, 16 Sep 2026 09:55:35 +0800 +Subject: [PATCH] Fix: heap-use-after-free in merge_patch when patch is subtree + of target (#1065) + +When cJSONUtils_MergePatch(target, patch) is called with a non-object +patch (scalar, array, or NULL) that happens to be a subtree of target, +merge_patch() called cJSON_Delete(target) first, which freed the patch +memory, and then cJSON_Duplicate(patch, 1) read the already-freed memory, +triggering a heap-use-after-free (detected by AddressSanitizer at +cJSON_Duplicate_rec, cJSON.c:2808). + +Fix: duplicate the patch first into a local variable, then delete the +target, then return the duplicate. This matches the Option B approach +proposed in issue #1060. + +Verified locally: +- Reproduced the UAF with a minimal PoC under ASan before the fix. +- After the fix the PoC runs cleanly (exit 0, correct result [1,2,3]). +- Added a regression unit test + (merge_patch_should_not_read_freed_memory_when_patch_is_subtree). +- Full ctest suite passes (22/22 tests). + +Fixes #1060 + +Signed-off-by: lilu +(cherry picked from commit 6d9f2443ab071f86e5d9b43025a40929ec41c46c) + +CVE: CVE-2026-87933 +Upstream-Status: Backport [https://github.com/DaveGamble/cJSON/commit/6d9f2443ab071f86e5d9b43025a40929ec41c46c] + +Signed-off-by: Ankur Tyagi +--- + cJSON_Utils.c | 8 ++++++-- + tests/old_utils_tests.c | 34 ++++++++++++++++++++++++++++++++++ + 2 files changed, 40 insertions(+), 2 deletions(-) + +diff --git a/cJSON_Utils.c b/cJSON_Utils.c +index 8fa24f8..6f41875 100644 +--- a/cJSON_Utils.c ++++ b/cJSON_Utils.c +@@ -1324,9 +1324,13 @@ static cJSON *merge_patch(cJSON *target, const cJSON * const patch, const cJSON_ + + if (!cJSON_IsObject(patch)) + { +- /* scalar value, array or NULL, just duplicate */ ++ /* scalar value, array or NULL, just duplicate. ++ * Duplicate the patch first in case it is a subtree of target, ++ * otherwise cJSON_Delete(target) would free the patch memory ++ * and the subsequent cJSON_Duplicate would read freed memory. */ ++ cJSON *duplicate = cJSON_Duplicate(patch, 1); + cJSON_Delete(target); +- return cJSON_Duplicate(patch, 1); ++ return duplicate; + } + + if (!cJSON_IsObject(target)) +diff --git a/tests/old_utils_tests.c b/tests/old_utils_tests.c +index 690dbb5..bdc7393 100644 +--- a/tests/old_utils_tests.c ++++ b/tests/old_utils_tests.c +@@ -189,6 +189,39 @@ static void merge_tests(void) + } + } + ++static void merge_patch_should_not_read_freed_memory_when_patch_is_subtree(void) ++{ ++ /* When patch is a subtree of target, merge_patch must duplicate the patch ++ * before deleting target. Otherwise cJSON_Delete(target) frees the patch ++ * memory and the subsequent cJSON_Duplicate reads freed memory (UAF). ++ * See CVE candidate: heap-use-after-free in merge_patch (cJSON_Utils.c). */ ++ cJSON *target = cJSON_Parse("{\"a\":[1,2,3]}"); ++ cJSON *patch = cJSON_GetObjectItem(target, "a"); ++ cJSON *result = NULL; ++ cJSON *first = NULL; ++ cJSON *second = NULL; ++ cJSON *third = NULL; ++ ++ TEST_ASSERT_NOT_NULL(target); ++ TEST_ASSERT_NOT_NULL(patch); ++ ++ /* patch (array [1,2,3]) is a subtree of target. This used to trigger ++ * heap-use-after-free under AddressSanitizer before the fix. */ ++ result = cJSONUtils_MergePatch(target, patch); ++ TEST_ASSERT_NOT_NULL(result); ++ TEST_ASSERT_TRUE(cJSON_IsArray(result)); ++ TEST_ASSERT_EQUAL_INT(3, cJSON_GetArraySize(result)); ++ ++ first = cJSON_GetArrayItem(result, 0); ++ second = cJSON_GetArrayItem(result, 1); ++ third = cJSON_GetArrayItem(result, 2); ++ TEST_ASSERT_EQUAL_INT(1, first->valueint); ++ TEST_ASSERT_EQUAL_INT(2, second->valueint); ++ TEST_ASSERT_EQUAL_INT(3, third->valueint); ++ ++ cJSON_Delete(result); ++} ++ + static void generate_merge_tests(void) + { + size_t i = 0; +@@ -219,6 +252,7 @@ int main(void) + RUN_TEST(misc_tests); + RUN_TEST(sort_tests); + RUN_TEST(merge_tests); ++ RUN_TEST(merge_patch_should_not_read_freed_memory_when_patch_is_subtree); + RUN_TEST(generate_merge_tests); + + return UNITY_END(); diff --git a/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb b/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb index d914018331..b4e57d7297 100644 --- a/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb +++ b/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb @@ -7,6 +7,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=218947f77e8cb8e2fa02918dc41c50d0" SRC_URI = "git://github.com/DaveGamble/cJSON.git;branch=master;protocol=https \ file://run-ptest \ file://0001-allow-build-with-cmake-4.patch \ + file://CVE-2026-87933.patch \ " SRCREV = "c859b25da02955fef659d658b8f324b5cde87be3" From patchwork Thu Oct 15 05:41:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100856 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E1809CC6B3B for ; Thu, 15 Oct 2026 05:44:59 +0000 (UTC) Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33267.1792043094236738143 for ; Wed, 14 Oct 2026 22:44:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=j5AKSk73; spf=pass (domain: gmail.com, ip: 209.85.214.173, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2e7006bbf77so10878495ad.0 for ; Wed, 14 Oct 2026 22:44:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043094; x=1792647894; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=aCNrHROzSGrBwyuBelOAqyHW2e2UcD7LzYWMrr5DFYU=; b=j5AKSk734VELBfLLLcjL30z3EGbpBGDLYlYztQKtk4wlYOzseRvt47HzfJUjAesIGF HwkJWyWG76o7Pf5MK95r0xrQQGV8wZsifxOUZTRS4U8FQ5uSooT2yiw547CfOQdpQ/0A VkQxQ6mskCp0lh46CDCi+4dIMEga4ae0+4gpmclAgmB5TXaADRKP8fMUp0RSkw9RxtgR 8aR1845mY4NXtNq0Wfa56SNKycWaPV4KcFSyrQBxyCyP5dh+oPsPvjYFYy2vXtBZAfEh iyjj3eCvzxrfzFPTLNym1uEf0jXNggF7aKSSuEXAfepgHbiY+B6Gs2fGR9hGqZmcxLVK gTKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043094; x=1792647894; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=aCNrHROzSGrBwyuBelOAqyHW2e2UcD7LzYWMrr5DFYU=; b=hzsgBBdJ+8txAmjYqUwtpO9LJez9WRxCbNEd1XQ/0y7VW8WCxRnm5okDiq0MOBppVb yqDRwEZwy+GfhdXZST+3g93MIG0w61sSkk5gPROfZfArMF5ae5a0QDw+Okoj4JFpMOcd ZVHD5lsUm8sK0MlXoiYYpSGmIc7rH184d/QZJkuKRLjRvJSpxl+0624FcTPLmqadqVrQ 2qNFZqNq490W9X9tbD1hKf1uAzGVwo+gjd/q9/vdrK9rRoMS2UGc4X4FvIbjRJ5SsoOK X+ueWguVvF032POEWjyzOjTWMWu2zuoqtSCnqDAa92XWDtH4D0y0Ezm0t+VonkNkJ3gB REtw== X-Gm-Message-State: AFq9FYIA+7KVru4sUVWvqpQRTkNOBc3uSps6pd4r8UDcp3aK3F30tUzO woz6Nn+6CgZOMk3R6kAXlxNTnsacda7vZTY5MqIATD6cJFOyPhgfLjs8oPGU4A== X-Gm-Gg: AYBFou2vYGhy93BqSRHM8qQDb1bMA/L8GzzQ3YaVw42IJcHH+FIWg9Vl0D3asOF3tFH nhQkWOSSvvIvVi2xEbW80P4k6Cm8WI8rH0V4vFiNB7zZ0SR9TZ8DzB4t0W4nRQZWrg7R64VY3iB VV5/ocLqMvqpda/FjcSsyYcq/SDOhklEPsmbg5P1LOkubK//zDGPXdwXNKqOfxIxmBX7Z7Vom8g EddYhbSmB+PikbmgFT4j8Al7deMeNgKWFbMSBdLovO6Yq13Z64AvwzBiPbwHnWtvsqKZ7m0s5Ia e6Q0w4jIxK9/i4xUSVPHBLqgLgW0NvwWoN2lkGudEsdK78dftEn+JgOaj9qEdvoHi4OFlEStyw1 JC9mVc9eCbw9rNfUXujkaw1A2bxpc49rRWvdHFYnrk3Y7EmiIsEZMOB6MrCKOoavnY8pfs2XCx3 VwRpMd6CMuZDk/TEmIY1ErTfYHm9yzxGO1IIVtt7L1heWJSfpcjsWyvBW9Bdz4qjZINWjFj9kwU EwftLK4eUCn+mFrKm31yNI= X-Received: by 2002:a17:903:2309:b0:2e2:dfe4:adab with SMTP id d9443c01a7336-2e842ab82b7mr145273775ad.10.1792043093556; Wed, 14 Oct 2026 22:44:53 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:53 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 58/82] smarty: mark CVE-2026-82531 patched Date: Thu, 15 Oct 2026 18:41:46 +1300 Message-ID: <95be90acc06ac239870bc9075ec9ad2084f1edbf.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130978 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-82531 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/smarty/smarty_5.8.5.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-support/smarty/smarty_5.8.5.bb b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb index 83f428d388..c700ed5d93 100644 --- a/meta-oe/recipes-support/smarty/smarty_5.8.5.bb +++ b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb @@ -35,3 +35,4 @@ FILES:${PN} += "${datadir}/php/smarty3/" RDEPENDS:${PN} = "php" CVE_PRODUCT = "smarty:smarty smarty-php:smarty" +CVE_STATUS[CVE-2026-82531] = "fixed-version: fixed in v5.8.5" From patchwork Thu Oct 15 05:41:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100858 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C80F3CC6B2F for ; Thu, 15 Oct 2026 05:44:59 +0000 (UTC) Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32852.1792043096238819499 for ; Wed, 14 Oct 2026 22:44:56 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=giLs52ey; spf=pass (domain: gmail.com, ip: 209.85.214.175, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2d71d1cc8b2so26196645ad.1 for ; Wed, 14 Oct 2026 22:44:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043096; x=1792647896; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Qb8/j2uKVCmvYEcp11K6RjURHYDD16OFpwlyTN8Ral8=; b=giLs52eyxv3vwDzvnacuipTlhkziikO0VbdbauK/JUo2Cc9MhYIMxgVqQ22IW+ecg/ N65ESvvA81Mc2JLxiMYmanVEtJZ4ygexa3i7L/QbxUr1IU+z7B1NbK0TUhzpF61eyyVF f5ZpR09JYgtco1RWg1UZUm8lfDycNWwUjaNgsEtwqedxh5UbQNaAxvk+TFv5wcn9oJT+ OHRuSx8f1R1HZ+ZDi9WaQkvdeO6CM8eci9NbXy6QpQsPh2pIKxe8oExiVHLwA7tndH+0 DZdBpzV7TE/kq6IifV7fpFM7jKNKS0cY+Boe2y0r5w5D0VXMX3JcQV9v4IK+KLaeEigY GQPw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043096; x=1792647896; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Qb8/j2uKVCmvYEcp11K6RjURHYDD16OFpwlyTN8Ral8=; b=l3IgROcDtTxzLos2MNy65mAKVkVQhJ7MBrvHSeNI+iy62KCBFtj/XSSiWvaFGUfhKe EpyWa9VcGEi5JKZzQRscDbuJnxlCBO9xiQTzffxBpW+Gj2LuOQr1bSHhUiHbnhslwwJe +ZeAYxARAGm13Swum1U/1N4RZL9VnDNBOWuZlQP00te82HnqZmuRp5U7CAnYg01ATH+r gQGvDtwkFEcj/L5TEauDOYVzR0YpIyvw5oMOkkIZC0ppp4Ez0Y3mbN4k/1SOSLkuVCB+ WAnJXjHsKZb+ybjwmFGa4/b1TSiR7qyWOeCUNoha7TKd7PpK7U/DAVF2KvZKOEtRL8n3 KqcQ== X-Gm-Message-State: AFq9FYKvN+hdXkKw1pyyT2nMY3w3ZcjbBMhYNDgPg1vJGrsV4nrxi18t BriIrVLSOXHUFVqlhc9bWV27pw4D1WiGVHW/0aCcfJv6uBEzvqXpnYAZU4mcHg== X-Gm-Gg: AYBFou0q7z+7OMyDau0FLktlSbG500y6fAsAZfh0/RjsQJPD3LCgOgIZpWAcy7xNaYo zxAvVuyUl8QHSUsveMQrL3NpHLENMwA//MB5XmG3Rsuqou+2aKIpiFu3vB06WQfix2cIYwv7Dqk 1vJ+aitax+SGnxZgOgQxrwKgwqryIWw2kpcDQWMHHDTAjZ3OA1asuV45WDvt0T7CCiDlkvHzGIq 3UyGry4zu4YibPkDKrSVwZVYIe/QmeX/u2SbbTGPr8oRbkAAkyVxdyrR+LplJn3yy6+6HNvDUV2 OiqAmMB0TX2t7BFKafYSnWlTnixnUedvwx+16mRY+EMM4+bmkdBJ/AtXK9sY8ErXKpH5iTepQag V3iqpWHVKFLYQWrTMN1OaL+khX+erOwisfujAq64uFETQb9i96FQ3PRi40znM73fJE4P5EJuciV mB5wa9csVmZXX0MBEd9uFXb8Dyn8fjTeGY72yXG5iKQoLds4Upuelnbn7V2ehjW8b7CiCGNHjDB sY0UEA7d+57BcVp9m6pKPE= X-Received: by 2002:a17:902:fc43:b0:2e2:da27:a926 with SMTP id d9443c01a7336-2e84280dfa1mr153159165ad.1.1792043095501; Wed, 14 Oct 2026 22:44:55 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:55 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 59/82] ntopng: patch CVE-2026-84990 Date: Thu, 15 Oct 2026 18:41:47 +1300 Message-ID: <151f9c3204cfc0e34d283f756a529253e236e7c7.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:44:59 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130979 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-84990 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 2d932fa4e349690dc42485b9dd04ab04d19710d9) Signed-off-by: Ankur Tyagi --- .../ntopng/files/CVE-2026-84990.patch | 53 +++++++++++++++++++ .../recipes-support/ntopng/ntopng_6.6.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch diff --git a/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch b/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch new file mode 100644 index 0000000000..0b443e3050 --- /dev/null +++ b/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch @@ -0,0 +1,53 @@ +From 2f36e393fc35f576d7c447af337848e81990b084 Mon Sep 17 00:00:00 2001 +From: Alfredo Cardigliano +Date: Fri, 17 Jul 2026 11:51:03 +0200 +Subject: [PATCH] Add admin check in conf backup listing and download + +(cherry picked from commit f912ee93bc143330b6ff3bb946ee7211e5ee9e1a) + +CVE: CVE-2026-84990 +Upstream-Status: Backport [https://github.com/ntop/ntopng/commit/f912ee93bc143330b6ff3bb946ee7211e5ee9e1a] +Signed-off-by: Ankur Tyagi +--- + .../rest/v2/get/system/configurations/download_backup.lua | 5 +++++ + .../v2/get/system/configurations/list_available_backups.lua | 6 ++++++ + 2 files changed, 11 insertions(+) + +diff --git a/scripts/lua/rest/v2/get/system/configurations/download_backup.lua b/scripts/lua/rest/v2/get/system/configurations/download_backup.lua +index 1603a94c48..404b09ed97 100644 +--- a/scripts/lua/rest/v2/get/system/configurations/download_backup.lua ++++ b/scripts/lua/rest/v2/get/system/configurations/download_backup.lua +@@ -12,6 +12,11 @@ local backup_config = require("backup_config") + + -- ############################################## + ++if not isAdministratorOrPrintErr() then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end ++ + local download = _GET["download"] + local epoch = _GET["epoch"] + +diff --git a/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua b/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua +index d901a876b0..8a08ad15d5 100644 +--- a/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua ++++ b/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua +@@ -8,11 +8,17 @@ package.path = dirs.installdir .. "/scripts/lua/modules/system_config/?.lua;" .. + + -- ############################################## + ++require "lua_utils" + local backup_config = require("backup_config") + local rest_utils = require("rest_utils") + + -- ############################################## + ++if not isAdministratorOrPrintErr() then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end ++ + local rc = rest_utils.consts.success.ok + + local order = _GET["order"] or "desc" diff --git a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb index 03350f240c..b4a1ff1883 100644 --- a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb +++ b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb @@ -19,6 +19,7 @@ SRC_URI = "gitsm://github.com/ntop/ntopng;protocol=https;branch=6.6-stable \ file://0001-luaengine-Use-lua-5.5-API-signature-for-lua_newstate.patch \ file://ntopng.service \ file://0001-Fix-build-with-OpenSSL-4.0.patch \ + file://CVE-2026-84990.patch \ " # don't use the lua under thirdparty as it supports cross compiling badly From patchwork Thu Oct 15 05:41:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100857 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A9CACC6B3A for ; Thu, 15 Oct 2026 05:45:00 +0000 (UTC) Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33268.1792043098388065155 for ; Wed, 14 Oct 2026 22:44:58 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Wq1IUlb3; spf=pass (domain: gmail.com, ip: 209.85.214.173, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2e95bd1c14cso3273125ad.2 for ; Wed, 14 Oct 2026 22:44:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043098; x=1792647898; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Fu7dE7rXvJZDuxDzliREsmItfHQTI6WQZRQJ4oaFchY=; b=Wq1IUlb3mNTcRMeVcTsRERGgzKwMIpZ9ShC6tM9fV8/yKa988FO2CxZ3eGGifY947T Tb3QwAigd1nf7PwPXreCmux8jzTczaiTyUdxYi3NELykRpu8tKf0j2kHw5NLXXHOpoH0 uxtwsaqmi2UPfcJUpI/Ylk4evxitgoClI2n/eNPVcmR1PwsYvhcsL8uSvj/Hdb2X7ws2 yoBMAkn2rG9YNL/98B/mBYSeFBWusVrGW2zj7tKWQus+74D8YbpoadxuVzjw4JIFTbKd Ws23roSh40F0weU/bQ8WvJEeuX1KjQfWmiQcqM6+okew/9NKK5LYPsIOipuZJo1zVUz8 SKqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043098; x=1792647898; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Fu7dE7rXvJZDuxDzliREsmItfHQTI6WQZRQJ4oaFchY=; b=05bLtUiATR2gxgjsLblndS37ddsSNSezxvt/xSp2RDaTmDgoPdf0kDq0EYc3+oVI1H EHDv0mNCJzB3ySALUH6w47J0hgR/IKQ/9PogCCBVgUCOYhup+d0soFdBk/oIUy2sNmEW /SJqBgxBobXyLo/huI1V4yT51i6dAfSK5lnqbz3npRdsDJ1gAo9cjvtt/95lJtO8WAgI QWk1k9x8oZ31p4LEeSce9R04Aj1ZMyj2tZMbRADhL2GHOc/nZPVWFvxLSv5xLK4qU35b UgrUjdG51NZlp7eLXJ3r+cmKN+EzTujnvVZgkZwZmI9nxqpiBUydAp5lbNDN4SWMWLJ8 2Ycg== X-Gm-Message-State: AFq9FYIRqS54vEgBrd6kl3/1OlDxVkHib210lLKOk5kmI2zpLYKRMZ+s /4weOjxGPOCMMDquirFo2HBnubPNhLhh4cTSEZaZGU9mFese80LrR/anhUAtcw== X-Gm-Gg: AYBFou2cIRmaG8zTkb/bhnPkF94jaVrvhDpn+SHQn6uca3CwAPizdBsCh/HdgU6fvkb wJqLVpyybZdbG+jI3Oz2+pclNWtZ5WDuBBe2NXHeB7Bp8rpPLBCMfXWYSSUgy5YOlzRXK/JxYym ltCiqpmuOckfxR9bMxmcB4tgDRT0iBVKrulsH52d2BGxtdrfThrER7/RyV9kDaTB7+UaxRmndbe Nwc9ww+T8pYUf+itTeU4A6hFMXdZmWBfpUbCRJLINIHPJLpAhQhC/9PByiOy7DjynjU2xL1PdIP yXMVQNNNpxPk96tCNwm9i5EVxkgBTLpmD6iEOp/4qXTEvSOTqRHH43h9kaot6q4AVHVOyZfveYm wZvRNcIV3MttS4QCvKsQBCv5ZWPP/YyPXFWI4Ll5sdzdaie3Iwv22/BcqtknSA/mBqKRvGeOwoz /lnoxICsQseQNcBIsdAhwQ067ROZBLdgxpvqEW2fGScU0fMxz447RZWm/I0vzDZtQRqVcaFVRGQ T3fieuTPqPf5Gvc8pwSPcY= X-Received: by 2002:a17:903:244e:b0:2e5:2e03:9c8b with SMTP id d9443c01a7336-2e842cd481amr168994865ad.11.1792043097722; Wed, 14 Oct 2026 22:44:57 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:57 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 60/82] ntopng: patch CVE-2026-86090 and CVE-2026-86091 Date: Thu, 15 Oct 2026 18:41:48 +1300 Message-ID: <8527b6772dc792b0b80bdb03d354ed8cb931639c.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130980 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-86090 https://nvd.nist.gov/vuln/detail/cve-2026-86091 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit ae180302f4c7f7dc0ba45c330d55b127aeefaf01) Signed-off-by: Ankur Tyagi --- .../files/CVE-2026-86090-CVE-2026-86091.patch | 67 +++++++++++++++++++ .../recipes-support/ntopng/ntopng_6.6.bb | 1 + 2 files changed, 68 insertions(+) create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch diff --git a/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch b/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch new file mode 100644 index 0000000000..a8a3ba72ac --- /dev/null +++ b/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch @@ -0,0 +1,67 @@ +From c6f4d42e1bb029463f927532819c5f5b331ea066 Mon Sep 17 00:00:00 2001 +From: Alfredo Cardigliano +Date: Thu, 16 Jul 2026 14:42:29 +0200 +Subject: [PATCH] Fix user capability check for deleting notification endpoints + and pools + +(cherry picked from commit 7d830f31af367745431c5d92e2e82fc432f6bdd8) + +CVE: CVE-2026-86090 CVE-2026-86091 +Upstream-Status: Backport [https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8] +Signed-off-by: Ankur Tyagi +--- + scripts/lua/modules/pools/pools_rest_utils.lua | 5 +++++ + scripts/lua/rest/v2/delete/endpoints.lua | 6 ++++++ + scripts/lua/rest/v2/delete/recipients.lua | 6 ++++++ + 3 files changed, 17 insertions(+) + +diff --git a/scripts/lua/modules/pools/pools_rest_utils.lua b/scripts/lua/modules/pools/pools_rest_utils.lua +index 9b692ea5db..73f08e0c8d 100644 +--- a/scripts/lua/modules/pools/pools_rest_utils.lua ++++ b/scripts/lua/modules/pools/pools_rest_utils.lua +@@ -452,6 +452,11 @@ end + + -- @brief Get all pools of all the available (currently implemented) pool instances + function pools_rest_utils.delete_all_instances_pools() ++ if not auth.has_capability(auth.capabilities.pools) then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++ end ++ + local all_instances = pools_lua_utils.all_pool_instances_factory() + + for _, instance in pairs(all_instances) do +diff --git a/scripts/lua/rest/v2/delete/endpoints.lua b/scripts/lua/rest/v2/delete/endpoints.lua +index 31852cedab..6d25c01953 100644 +--- a/scripts/lua/rest/v2/delete/endpoints.lua ++++ b/scripts/lua/rest/v2/delete/endpoints.lua +@@ -10,6 +10,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" .. + local rest_utils = require "rest_utils" + local endpoints = require("endpoints") + local recipients = require "recipients" ++local auth = require "auth" ++ ++if not auth.has_capability(auth.capabilities.notifications) then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end + + endpoints.reset_configs() + recipients.cleanup() +diff --git a/scripts/lua/rest/v2/delete/recipients.lua b/scripts/lua/rest/v2/delete/recipients.lua +index cbdffcae4c..14b3956498 100644 +--- a/scripts/lua/rest/v2/delete/recipients.lua ++++ b/scripts/lua/rest/v2/delete/recipients.lua +@@ -8,6 +8,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" .. + + local rest_utils = require "rest_utils" + local recipients = require "recipients" ++local auth = require "auth" ++ ++if not auth.has_capability(auth.capabilities.notifications) then ++ rest_utils.answer(rest_utils.consts.err.not_granted) ++ return ++end + + recipients.cleanup() + rest_utils.answer(rest_utils.consts.success.ok) diff --git a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb index b4a1ff1883..808967e969 100644 --- a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb +++ b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb @@ -20,6 +20,7 @@ SRC_URI = "gitsm://github.com/ntop/ntopng;protocol=https;branch=6.6-stable \ file://ntopng.service \ file://0001-Fix-build-with-OpenSSL-4.0.patch \ file://CVE-2026-84990.patch \ + file://CVE-2026-86090-CVE-2026-86091.patch \ " # don't use the lua under thirdparty as it supports cross compiling badly From patchwork Thu Oct 15 05:41:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100859 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00024CC6B38 for ; Thu, 15 Oct 2026 05:45:09 +0000 (UTC) Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32856.1792043100374696637 for ; Wed, 14 Oct 2026 22:45:00 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=MEvGcYc5; spf=pass (domain: gmail.com, ip: 209.85.214.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2e60f9af6e6so14000085ad.3 for ; Wed, 14 Oct 2026 22:45:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043100; x=1792647900; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=2NjEwcz1evegYdskFb76XdF6DQwohpaVPIJPmv8IdZU=; b=MEvGcYc5XilcYvDDHqiG6mZHTJOYjk+CzcXunLC8KmRZT7F254Z4oz7y1c23SCwV3Q rBF0Y4kr0jcvephlioYHXwFvzVxJ5Y/d0fakkC5hW9uVD3FPnrMzuFWZ/i3Y1U61uK1n cu/p7jxpLZIp6frJavMkjHsQHNwsMlWqmTQoOQNG4uYZvmD1UbDegfZONvI1sgon9Ysq h15AEtwek8RzKCjZ1A5HsUFvi9by/dKlSTDa2pTbe/W/fPsXNBnvGr0GPaveT64jeW7M +406c68ZbNqrTFesH15ksyuv1txC+sJ9TCeCzNKUYnSZurOsvvHZ8HgT0EMDm297TvGy kTeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043100; x=1792647900; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=2NjEwcz1evegYdskFb76XdF6DQwohpaVPIJPmv8IdZU=; b=ZwuKUyRM7yRcqV5HLgHx+dMmKq2GF4WrQXXx87ibt624fhtkKwKBCACXC4z59zODwO d2MtfbSBN+bFa2PTP1mGeHwi2BS9dUKHIRfffcfxnellG3vD65fHuVf3rvorNyQXpeIp EwkMRmGQafbyt55zvbGQhAjpPS/Qq7EjEH3OxI4u78Re3Je97VE95E0Vj0hzU836x0ag zf9EMOfbOZT3aX6D5E924ZIDgvpZiSgGe8k5FlePcGV2N95pWd9L28YNIewVgeHnTO93 KRoGAFtoYqYHCrdgOCi0Y6oWJZio91FjcRvWAkKHXRkMGmNFFiLceV1EgYi6KDm4d1rg byIg== X-Gm-Message-State: AFq9FYIu+fHAm/pxjYHeCEYH5hhPKdNpkayIh1kl3SrkLFipZibS2vwW tJgwMqqlaUdOB7LCzYBZf+/5vV1mWofHOraeBNCoxAZ9/NypIeZJPAemPr/lLQ== X-Gm-Gg: AYBFou0l6C6O/QtDNVgqEwwylSyeHEAAPYdH9/RdogpIEiQhKLRP61ahS//BCRtbaE+ tk4C4NB/Xbw1x5aiYEbLDd7LTUifJhFZjTKoTRbv8SYygb3rTecGnK3wHo9oYnk9zghVUBT0qes cQCKKVTS3CiphAwN5Lw9n6f9YXwwKxZP6PojogVdHy39/rcyk4sFB2s3CSKrMn6gzkFrwe07LSm Q0P4qLgaW9EC+4KozQCacsZX255MLQJD67MQG/fPaIzh67FF/8sB05USdT/U8vQ96A0KALrzIiA sxHDyVXvb/D4DBwV5fhR4Ov6jIMQke5Us9Y7Kgd1EftmSlnm26+zSlbB0w6gpijLnD7Ht8yVGAJ 1B4taIKDx51Ct/vDTj5qbD9RmBaU2HiJkePNGgNIfS1hCg7fYPC1blHWK1Xjrk1rbDcNlH/CwYa RJ+RzzmqSkgKgssRTodBYOD/3b4/FhlXQHaOdETYKF+Va+RoUT/hmQoiyUuwYwFX73PKv7A13Qd kmGIFtOTQxSi5WPdETyapQ= X-Received: by 2002:a17:902:f70f:b0:2e9:660a:7944 with SMTP id d9443c01a7336-2e9660a7bc6mr3027795ad.58.1792043099639; Wed, 14 Oct 2026 22:44:59 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.44.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:44:59 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 61/82] sngrep: patch CVE-2026-90558 Date: Thu, 15 Oct 2026 18:41:49 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130981 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-90558 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 36ddee53b179b5108186cc3e8d76c0f6a5e5d069) Signed-off-by: Ankur Tyagi --- .../sngrep/sngrep/CVE-2026-90558.patch | 84 +++++++++++++++++++ .../recipes-support/sngrep/sngrep_1.8.4.bb | 4 +- 2 files changed, 87 insertions(+), 1 deletion(-) create mode 100644 meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch diff --git a/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch b/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch new file mode 100644 index 0000000000..64fd8044a9 --- /dev/null +++ b/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch @@ -0,0 +1,84 @@ +From 399346a12ca3bcf7703734fa33b5b3427775b014 Mon Sep 17 00:00:00 2001 +From: Kaian +Date: Fri, 7 Aug 2026 08:45:42 +0200 +Subject: [PATCH] fix: prevent stack buffer overflow in SIP attribute + formatting + +call_get_attribute() formatted the Call-ID, X-Call-ID and Reason header +text with an unbounded sprintf("%s"). Call-ID/X-Call-ID can hold up to +MAX_CALLID_SIZE/MAX_XCALLID_SIZE (1023 bytes) and Reason text is copied +from the raw payload (up to MAX_SIP_PAYLOAD), while all callers pass a +255-byte SIP_ATTR_MAXLEN stack buffer (call list rendering, sort compare). +A SIP message with a long Call-ID, X-Call-ID or Reason header overflowed +the stack, triggerable via pcap, live capture or HEP/EEP remote capture. + +Bound these writes with "%.*s" and SIP_ATTR_MAXLEN - 1. Also fix a +matching off-by-one in msg_get_attribute(), where the existing "%.*s" +used SIP_ATTR_MAXLEN as the precision and could write 256 bytes +(255 chars + NUL) into the 255-byte buffer. + +Thanks to TristanInSec for reporting the issue. + +(cherry picked from commit 1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b) + +CVE: CVE-2026-90558 +Upstream-Status: Backport [https://github.com/irontec/sngrep/commit/1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b] + +SIP contract change was dropped during backport as it was introduced in +v1.8.4[1] + +[1]https://github.com/irontec/sngrep/commit/c61a26d90c166f996e31aceefc9c2f8f831ccd86 + +Signed-off-by: Ankur Tyagi +--- + src/sip_call.c | 6 +++--- + src/sip_msg.c | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/src/sip_call.c b/src/sip_call.c +index bea879a..68ecb50 100644 +--- a/src/sip_call.c ++++ b/src/sip_call.c +@@ -257,10 +257,10 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value) + sprintf(value, "%d", call->index); + break; + case SIP_ATTR_CALLID: +- sprintf(value, "%s", call->callid); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->callid); + break; + case SIP_ATTR_XCALLID: +- sprintf(value, "%s", call->xcallid); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->xcallid); + break; + case SIP_ATTR_MSGCNT: + sprintf(value, "%d", vector_count(call->msgs)); +@@ -282,7 +282,7 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value) + break; + case SIP_ATTR_REASON_TXT: + if (call->reasontxt) +- sprintf(value, "%s", call->reasontxt); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->reasontxt); + break; + case SIP_ATTR_WARNING: + if (call->warning) +diff --git a/src/sip_msg.c b/src/sip_msg.c +index 379a40a..6762862 100644 +--- a/src/sip_msg.c ++++ b/src/sip_msg.c +@@ -136,13 +136,13 @@ msg_get_attribute(sip_msg_t *msg, int id, char *value) + } + break; + case SIP_ATTR_METHOD: +- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, sip_get_msg_reqresp_str(msg)); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, sip_get_msg_reqresp_str(msg)); + break; + case SIP_ATTR_SIPFROM: +- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_from); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_from); + break; + case SIP_ATTR_SIPTO: +- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_to); ++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_to); + break; + case SIP_ATTR_SIPFROMUSER: + if (msg->sip_from && (ar = strchr(msg->sip_from, '@'))) { diff --git a/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb b/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb index 5bb30da6db..c7457fd0c0 100644 --- a/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb +++ b/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb @@ -15,7 +15,9 @@ DEPENDS = "\ ncurses \ " -SRC_URI = "git://github.com/irontec/sngrep.git;protocol=https;branch=master;tag=v${PV}" +SRC_URI = "git://github.com/irontec/sngrep.git;protocol=https;branch=master;tag=v${PV} \ + file://CVE-2026-90558.patch \ +" SRCREV = "9c370866afaf5ccb258bf03848b2d22f30cf61bd" inherit cmake pkgconfig From patchwork Thu Oct 15 05:41:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100863 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 178D7CC6B2F for ; Thu, 15 Oct 2026 05:45:10 +0000 (UTC) Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32857.1792043102714118530 for ; Wed, 14 Oct 2026 22:45:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=G+m+56on; spf=pass (domain: gmail.com, ip: 209.85.216.54, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-3ab450c0873so4210871a91.3 for ; Wed, 14 Oct 2026 22:45:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043102; x=1792647902; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=PySX8MfFG1SWeTGIfyn2z+EEa0WNcsH5pwKMedREvqM=; b=G+m+56onFKt5+Hz2DH3plg8kl24W8RSDauUimZYgCpUUnGYvcoQt2jm2fz8vVeEsox O5dWrM5anKqRtASu0FP4ze+yiTKouNmXS6KGAfL7a2L8aktEojcZX4JutVfAzatBJZ5/ AsOoH841U6a2RM1beogc4JvsYiyZFhdcwsMfOWNBI3RgLqkvnj+beSScnCV0zkkoeQA8 rN1uBA1x05f/PYm5BCcZdG1VijnDr2X53UrBR7qGBeXDiq+kHR+8IAapXDIvrCHoPsJZ xlgHzsJzRgjkv9Kx9+IskN2NNTRwmitp42mLHFD9k8TS2vqSkaXIxNCWwhz1kkT3wZCo 0fPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043102; x=1792647902; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=PySX8MfFG1SWeTGIfyn2z+EEa0WNcsH5pwKMedREvqM=; b=B99kSoLZ0XQA3zcMxqrQUyaX8RbcJIj60pXiO2obkPLC5xOMzJK8+gPoYKnQ4s5i80 wGzksfuZfCX7KwvmNF3AT1G8PuITrKGGOGUYFRNGY9RQ8sgP3evUnw99lDFekse+GT2V QI3hMBD5kwthenCF0JqEIfKsKvSGDnBAoOvQa2nrqEBeHmCv33PsA6gdx3tyYTgXKVON Scq5Ath7QRItxSWbe71JVPMJswD81fVxx5KStMClX1Bv0fVBlygF874K/DXW/3R9YuJu 2eGM2MNrstJ4ukWr8I1c6s0ka+XsvFp0wYO6OTfrs0lymUrJIFIPhdt7DpuJ19B5myMY 8rjA== X-Gm-Message-State: AFq9FYKeemF7d45IIudlh+Uih4eVdN4Atr03YwbPt2rtkHsvQchTVEiv NhivWZ2kUE/JrjirXXxyDF9jh3/6nSSUdRdgr2JSDAm+qZNVad2aHqoojDmViQ== X-Gm-Gg: AYBFou1pNp9Q61MUrnIqU5LWwvrk6yXWThy3e8QI9soDB6g/CU3lwIZOd+BnioWw07h hClThOS6EkJOzQ1ExcRRsjBMR1UxX/8E7VFPpoMKnqJx31WvW0iNVIFTkW0Qz3OQvV/i0DYiTAF 09mHDXHlDZwaDMqkrTjvrJZsaFedI/mKSzSPpyjlsgc6IBmndjNpRHBb8EW1TGvb+YCPy4wQrqQ qJl9FaB0axqf4eIALFTDAZFg9tdC430t6PRsUiMhC9XbrrYaCXUb/Za6vFF7alea+OGNi/+SX8G SYFzrSBLsKPk/BKXEuJMW5fzkn2L9ZQNS0OKn/3FvPpDOjBpsxyqGheV681nkV/u0kffa75PfhH N9qaRIrXx0604YmtE9XiyaLTxbM1631W2Elc7QU8sSnhqg5+PZiaQrWdrGQOjVDlZBD8PtibJCs XIy1IPxJCPFJgGnhW3l8xpA7uI0AP2KSl4JIgIncdvaHXQpYOu1UM4uxxqEF1ywIAyzdm1OL02T Y4gXaEyl6Bw++ZxXT4zZ3k= X-Received: by 2002:a17:90b:58cb:b0:3ac:e6a:1b2b with SMTP id 98e67ed59e1d1-3ac0e6a4ed3mr8592974a91.0.1792043101860; Wed, 14 Oct 2026 22:45:01 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:01 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 62/82] strongswan: patch CVE-2026-78123 Date: Thu, 15 Oct 2026 18:41:50 +1300 Message-ID: <8ccc60a8be38ca62df2984758643fd11b711e6c5.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130982 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78123 [1]https://download.strongswan.org/security/CVE-2026-78123/strongswan-5.0.2-6.0.7_openssl_pkcs7_info_init.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78123).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit aa064e512a7d50e20f8e9c5a5249ee8bb2ee82ea) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78123.patch | 51 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 4 +- 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch new file mode 100644 index 0000000000..36e6eb1289 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch @@ -0,0 +1,51 @@ +From 23707d346f1f85dba0419c43658a86a80a24f568 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 1 Jun 2026 17:51:35 +0200 +Subject: [PATCH] openssl: Fix undefined memory access when verifying PKCS#7 + containers + +If the signerInfo or recipientInfo structure doesn't contain +issuerAndSerialNumber but instead a subjectKeyIdentifier, then the called +functions will leave the passed name and serial numbers unchanged. While +openssl_x509_name2id() prevents a NULL-pointer dereference, it tries to +DER-encode the object at the passed pointer via i2d_X509_NAME(). +Depending on the stack contents, this likely causes a segmentation fault. + +Fixes: 3c820cdc232a ("Implement PKCS#7 decryption using openssl") +Fixes: c61723c69fb5 ("Implement OpenSSL PKCS#7 signed-data parsing and verification") +Fixes: CVE-2026-78123 + +CVE: CVE-2026-78123 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/e59b4c96990635a482d6532f7905143f2541d8b5] + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/plugins/openssl/openssl_pkcs7.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +index d9abcf8..b15c8d7 100644 +--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c ++++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +@@ -222,8 +222,8 @@ static auth_cfg_t *verify_signature(CMS_SignerInfo *si, + auth_cfg_t *auth, *found = NULL; + identification_t *issuer, *serial; + chunk_t attrs = chunk_empty, sig, attr; +- X509_NAME *name; +- ASN1_INTEGER *snr; ++ X509_NAME *name = NULL; ++ ASN1_INTEGER *snr = NULL; + int i; + + if (CMS_SignerInfo_get0_signer_id(si, NULL, &name, &snr) != 1) +@@ -628,8 +628,8 @@ static bool decrypt(private_openssl_pkcs7_t *this, + identification_t *serial, *issuer; + private_key_t *private; + X509_ALGOR *alg; +- X509_NAME *name; +- ASN1_INTEGER *sn; ++ X509_NAME *name = NULL; ++ ASN1_INTEGER *sn = NULL; + u_char zero = 0; + int oid; + diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index 117c148865..a7636554a6 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -8,7 +8,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" DEPENDS = "flex-native flex bison-native" DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss', '', d)}" -SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2" +SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ + file://CVE-2026-78123.patch \ +" SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Thu Oct 15 05:41:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100861 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24FF6CC6B39 for ; Thu, 15 Oct 2026 05:45:10 +0000 (UTC) Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33270.1792043104418364205 for ; Wed, 14 Oct 2026 22:45:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=nWj4ZA0/; spf=pass (domain: gmail.com, ip: 209.85.214.181, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2e831e86ebfso9643435ad.1 for ; Wed, 14 Oct 2026 22:45:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043104; x=1792647904; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Kl4iyfn1rSLP8mcMOluUdNGkgVtSTu7Y/Di6Nt6CjxI=; b=nWj4ZA0/VBMyjMxK4dpng+/S2DJQlqHuwPwpnMdtxNGBX6ympCfDrRv2U5Ensr6HHV FmrHcmIJ8Dgwql2TcH2jKBgrA3owyIyBd4WzK24sb2Z1S4TYtHNNf2NDG28B7kiL/OHS ibDgV9/QK2WNWen5XCi9c40kMeJHEQkMUeShyw/C+fde+DaqZWiWXDVAXUropnVGECaJ 1gWMv79MjOJB6qfQLaayyAmruoJyb7H311cf13yYkdBPPtsL5242LViHDn9mebLup0uh xDZxbRUzRm4fOJvuXiiyrx8wrTTGvj2f9/pQcTci27QDONN0G6oWllkurNLdyt8VhmxV iajQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043104; x=1792647904; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Kl4iyfn1rSLP8mcMOluUdNGkgVtSTu7Y/Di6Nt6CjxI=; b=Wzid4EQlEy8e1g3fYrZBhi/r0ZyZuCqKhx0JgZmUOZywzOTdfjPfdle77J7a629EhU BVJm2iAaLAzSBKFgkCJ9LI1Y9NxECI57GAqCORqxu1eGzzHnBD00TvR/kzk3ekt6qZCl WuzwM3o/VjLY+8HaruJcR3gJ5rvNIshzKqpuMUnrNsQ0t0VI1lI8gaX0CT4GPdBTOHzh cV0sblyC2FLmYsf9tY4VgqzJT6jNhXvYOluAAddRzC6+RRBorMR2hAirYjnMaate7rY3 kTz6m0yq1GWEXFmztLwvy64k+sqCYVEiLf6q0sAVNoi66ZgBW5QTGfgSf+xvEUNURfph jkLQ== X-Gm-Message-State: AFq9FYKrU9y7EoGFkBzINx0hwCXcd20aZRnJPtiQAzMC9AelEw2Md0a5 fiYy6zvVhXVZSFEe+57FClAxxapOETz/j/ex0tv6NvDDeks3AEAAiZ5HPYXB3g== X-Gm-Gg: AYBFou3fd7J+CXGLAk9K7oG/g/zMGotb69QcOXEdTFPLJrObqD2rLlgLYh7pozyWT/w QxQZa/erZ9bi4pWxtEl+lGOt10QAWvpXjymEVO7l/ggQAsh4pn55cRQ9+sGkuIBwtuM33PWcmBW GvHaFjXqYfc4FZi/z/W1cQ0vNJpg3uReXtt5f5Pgmrn243nm3F3JaQLS90cAOB8xs9NVchU5qBu u/W/1nS4xouh89nVNm3aIxkdlIEkit0PY9rQRYrc0M4WRyJ62zGmhM5UJn30jzB6dwAcICzVnlw V6PiMB9GrUnt3Aa/nRmJ+SZmjQn7TCIjLszh7/9hChkC84njTZv8tmhSOZZ9xJ0axsjDhdZLANU hjEXlaFPtlluY6qCPeGnx2YOob3XX0kH/vTCuQVVejNTP1k9C9TJ06rl5OEejtsrj8vH5CGBdn1 +1ctUbIXTn6U9L3rr4jYd3i4X89HVlGUtvpjldSQS8sq9I9Mbt0lO20FONAbK05S5mjS29exS/c gJr83VaCW9ELwp/NZ7c3z4= X-Received: by 2002:a17:903:110e:b0:2e9:2a1a:8b69 with SMTP id d9443c01a7336-2e92a1a8ba7mr55271995ad.55.1792043103710; Wed, 14 Oct 2026 22:45:03 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:03 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 63/82] strongswan: patch CVE-2026-78124 Date: Thu, 15 Oct 2026 18:41:51 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130983 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78124 [1]https://download.strongswan.org/security/CVE-2026-78124/strongswan-5.0.2-6.0.7_openssl_pkcs7_certs_leak.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78124).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit dd0ba33ed20b4245c82c19b19c55b3710384ce52) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78124.patch | 34 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch new file mode 100644 index 0000000000..5e37ed671a --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch @@ -0,0 +1,34 @@ +From 36ce778a76b4b912699a52cf1109394fce109c83 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 15 Jun 2026 16:02:01 +0200 +Subject: [PATCH] openssl: Fix memory leaks after enumerating certificates in + PKCS#7 container + +This can be triggered via IKEv1. + +Fixes: 04884be3b5f7 ("Implement openssl PKCS#7 certficiate enumeration") +Fixes: CVE-2026-78124 + +CVE: CVE-2026-78124 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/49bf0725fa61198d1e29d5b4c2651c9190b2c10c] + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/plugins/openssl/openssl_pkcs7.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +index b15c8d7..cefe1ae 100644 +--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c ++++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c +@@ -132,6 +132,10 @@ typedef struct { + METHOD(enumerator_t, cert_destroy, void, + cert_enumerator_t *this) + { ++ if (this->certs) ++ { ++ sk_X509_pop_free(this->certs, X509_free); ++ } + DESTROY_IF(this->cert); + free(this); + } diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index a7636554a6..82cd4738fb 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -10,6 +10,7 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss', SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78123.patch \ + file://CVE-2026-78124.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Thu Oct 15 05:41:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100860 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1027FCC6B3A for ; Thu, 15 Oct 2026 05:45:10 +0000 (UTC) Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33272.1792043106886544385 for ; Wed, 14 Oct 2026 22:45:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=cvfQhzxx; spf=pass (domain: gmail.com, ip: 209.85.214.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2e86dce4510so24894895ad.3 for ; Wed, 14 Oct 2026 22:45:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043106; x=1792647906; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=/spFjGBu+l/0TF0RD9LUyxEsSeNwPyZCTqz2qpNpq9g=; b=cvfQhzxxnXRW9YsOgl75P57IHO4xJOK7nolKADBF2ittgARufgb3ao21WZtYODjy4z aC2SQaob4EmLymClNqRunX+yZENrZERvkVUv6wCs7/NMya3h2z8F19bScEO8tjy6x46b U08VtQZWyFEyRLm6IFZ4RrIpFzApb6qm+6wx+iLJ3nAHO6g4UByZFnJd2aM94v94LUWj JdOcojWvUdlBHimItFOM5pCEC2ypddRX7O8EoCtMFkCEDCP4SymwRnbwZJOySGqrVNDt 3KJJygdzzpdW9NDveKfoxpiWy24jyK3OitBiOYCsJ4i6+hySkI6SnAskr6TsApPjOhkK zYUw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043106; x=1792647906; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=/spFjGBu+l/0TF0RD9LUyxEsSeNwPyZCTqz2qpNpq9g=; b=zoDV4QN1fCHMw7jzNVmJ90dDscQXyQdkmhG/icPJtVV3HAY/5ZwtYlnjQpTioT4IP0 DCw5l+TNsiHcy9MUgfiqFfVBuT248LW0dLN+eChkPHW6mdIx0W+zaqsbG75TUpYhI1pA 5fIIs98v7U3x8UIxaftQSRwt2F5dgIIUy/9PqIwo+JOz1Az1wwamrxAzhJ4FqMCLZT+o jj/0DIYlgy3K9lNJezW4IlFqRrYT2Z0/DjeY5y8xK4lLH+e0qBicYSwROTrF+73/xRJU 6UknQhSxO4LYh9o8aKB0yJaJqNJYjgXIqpS36Z8K22epDwq5NwOah0zWLv2d5OMz7iRR 9ggA== X-Gm-Message-State: AFq9FYL3E6bZXvfqln/U0Lh7fHOZsDWdxdMN4In0Q/SecVGWZu8CHfWq M7Iish3MQTH5ElkMVZV/p1hBwKlNWQQpsK8xz35Pju4tarpzR5Pm0g5kPlkHBg== X-Gm-Gg: AYBFou0mk2MLX79uNh8tfNe4zfSQy5QHhsXg1/0QqlwS6ftMPRLfzxFSaOZ/WUz66e/ vK/hBGB95N5Ras2kDBfrbpfkXW2Me4VwSvQoDbfANQuIYoqreRgunmxL1EMBNn+K7BwU4aLTiwU JCmAA/ZVTxprUFVqccjGdHQibRqncxWADxKAd3la8Yv96uuB7hWxQyZzPvK0ewnedK8PVCdvsP9 1HX1BtIW57he2t+s2i72QeuZiH/chwxCjgAGwdrbLG+aNj59jA2cgEMIvESPgZN8yJzQz7kUkbL c2oodFls1lg/hGDZyjrYUi88NDLyAWF0N3JXUxYwEFQj8pxxCzzlrR/SW7/yZtQC9B8CxF9k2xE ZEDc2/boQ+oG/wgnC4Px0yVrkM6NMdhTSyXbajc20RcAWFYQqFog+GgtLWuXuBOHhBaA0YIBSKQ mvvAdlu/9xAIq9R2VF1qpmD/M3IFPIeV34UtAjhXGJFTCXI8j2ugQSJKS5fzU70cVag3t6Pf4A5 L92QkTSAb5yaMdrkwXYuAE= X-Received: by 2002:a17:902:e748:b0:2e8:1c90:f4c2 with SMTP id d9443c01a7336-2e842ce7fbfmr149651005ad.50.1792043106115; Wed, 14 Oct 2026 22:45:06 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:05 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 64/82] strongswan: patch CVE-2026-78126 Date: Thu, 15 Oct 2026 18:41:52 +1300 Message-ID: <9b00eaf6ee3e99fd2d6eb7c9dbccb06d32c91d2c.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130984 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78126 [1]https://download.strongswan.org/security/CVE-2026-78126/strongswan-4.4.0-6.0.7_eap_aka_sync_fail.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78126).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit e228e7711e49349b1342ae2be83530ab34883f98) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78126.patch | 37 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch new file mode 100644 index 0000000000..307d1a9834 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch @@ -0,0 +1,37 @@ +From 13aa926cad7ec7f668249b6513c938b8c2e95af4 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Thu, 4 Jun 2026 10:00:02 +0200 +Subject: [PATCH] eap-aka: Only accept AKA-Synchronization-Failure if expected + +This fixes a NULL-pointer dereference if the client sends such an error +before the server issued a challenge and allocated this->rand. + +Fixes: 26e246769224 ("ported EAP-AKA branch into trunk") +Fixes: 4735965fc048 ("EAP servers check if the received EAP message was expected") +Fixes: CVE-2026-78126 + +CVE: CVE-2026-78126 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/7bedb451346261370256d390a8c155b86e4b455d] + +Signed-off-by: Ankur Tyagi +--- + src/libcharon/plugins/eap_aka/eap_aka_server.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/libcharon/plugins/eap_aka/eap_aka_server.c b/src/libcharon/plugins/eap_aka/eap_aka_server.c +index 0712ccc..95d4b03 100644 +--- a/src/libcharon/plugins/eap_aka/eap_aka_server.c ++++ b/src/libcharon/plugins/eap_aka/eap_aka_server.c +@@ -505,6 +505,12 @@ static status_t process_synchronize(private_eap_aka_server_t *this, + simaka_attribute_t type; + chunk_t data, auts = chunk_empty; + ++ if (this->pending != AKA_CHALLENGE) ++ { ++ DBG1(DBG_IKE, "received %N, but not expected", ++ simaka_subtype_names, AKA_SYNCHRONIZATION_FAILURE); ++ return FAILED; ++ } + if (this->synchronized) + { + DBG1(DBG_IKE, "received %N, but peer did already resynchronize", diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index 82cd4738fb..2abc616c37 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -11,6 +11,7 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss', SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78123.patch \ file://CVE-2026-78124.patch \ + file://CVE-2026-78126.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Thu Oct 15 05:41:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100862 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D121CC6B3B for ; Thu, 15 Oct 2026 05:45:10 +0000 (UTC) Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33273.1792043109006847487 for ; Wed, 14 Oct 2026 22:45:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=r5EsaNT+; spf=pass (domain: gmail.com, ip: 209.85.214.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2e934449bb0so12232525ad.0 for ; Wed, 14 Oct 2026 22:45:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043108; x=1792647908; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=DMOJ+wdKtsBYkFERsEOue3c/hDi2ukGCx5whtwPoGAo=; b=r5EsaNT+tIkAcnlD9hI4jJENBCF8zXIkodnZLNT6vXtDasufMD2RenRSiYFZNSscWw B7DiaH7HybMe7UshvD1qM4b9KCilPkA2LEj2hVDU2AFPAh1gx+MDCHEN5okl60Co82yM yqOlAR4KR0tF9YaovG9Gd+Pazn5utaQfOOPzv11KgctNcQZ2Jg4i92p5ceIJN62Iiifw rn8uBugKuvhFuohcNF7Fi50w1HqD4qIBjxsbipJfAcgBG9Y+vwPCjUzFdl38L6BILOls dIKKMGoWM1RlArnlnyYfqVSpzlD+CIa86JgosJ08D5WOgELt6LN+bGG2gNQtAj0BXFLZ L3PQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043108; x=1792647908; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=DMOJ+wdKtsBYkFERsEOue3c/hDi2ukGCx5whtwPoGAo=; b=v8wVuhYxzPjy+tEpx1py6Wd/NlAYVVovhI9WfkpfgTTs/SkakrqyUcVODeJtQkIXnQ 6TrghrOf5cTfrg2vN+WKs0Rvz4gULiY85FzmqxM+x72otMiZt93gM3AxOO9bi2CC22XF oivTd2XOUcMGNSm2WJwQfiiX3aqjLbNQFVwdNYpBPXv8orAqylYThqc3g8O3rZky7fVX 4swzYpFPqoYwRDGCU5SZSqdFsnoEgnEC1mcFeyRtA6Mr6S7lqWtqW7QBDrv9AL3YxaYT /1FUrEKf3p65SkXkB25wdP9zTeBRdAmfcr0T3v8i6oqgEwt4bVjSq+8LCPy6k52AOrYM CRfg== X-Gm-Message-State: AFq9FYJlfoLiGklEtLSvMb59vx82Ud72f5ydKjlrUhDNCmTV0e9k8e8l itdfUwzsbBkWNu7WWVN7VJY7yAfgpFUT9zihbM3yZWAeZg7r7l+mrpKPi6J4+w== X-Gm-Gg: AYBFou2Nxi8uKmVTNH8Ot6DkRhv7IVnWRLVhmZW87fjZlOifSbpuboiApUmrF81PhMU 7HZCPu+EAR2SVkOtd50vhnYDgHR+TDpH68bsR/lTEWksq4YQR/hFB7HBZDTc+NZ6Y2ljdYleym1 AN4BHcbVYxA6iWLCN4/FXeJayoSgsOWCF3zc0b/vYHIg16WjWH2dScLfrnoOjmgXS8OTKiBTi8Y s5yJO3XpXPUFuxSiPubAn/SOsZ4woO5XNiFxYxQi+5FPf7ccNvfkohISG4hqJf6Mu3wCh7sbjoI xjZDh8MZeWJDOEsGYPBP4m7AsagRf+/N92CLrTXduuVg4jMX99KzEbE8u5f61vVRAqxL3eV6yb2 kZIHOvnwNIT1dOs9/CukcFkujF3wZpHzEXJdCypkihjgfX5zPTvIdwg90Z/BJokpQ/kdLqfIHjF XXhWmwyogtxXT465Znc70t1O+lkDBq0hs/3QAHffNBJ/NEoMUJv27ksBU/GAkGBOPO9cQHaH2Hz M/h7EkM/2y9zfiqRrQCbe0= X-Received: by 2002:a17:90b:35c2:b0:3ac:7c52:fae5 with SMTP id 98e67ed59e1d1-3ac7c52fe5amr3124149a91.50.1792043108197; Wed, 14 Oct 2026 22:45:08 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:07 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 65/82] strongswan: patch CVE-2026-78127 Date: Thu, 15 Oct 2026 18:41:53 +1300 Message-ID: <22d52d3b4230228ab48cdd1a2bc758b28211fe22.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130985 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78127 [1]https://download.strongswan.org/security/CVE-2026-78127/strongswan-5.3.1-6.0.7_message_log_leak.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78127).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 7b8fd4df2e4eb82ad4558d6d3ddde57524ce9216) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78127.patch | 115 ++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 116 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch new file mode 100644 index 0000000000..43def8b9b1 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch @@ -0,0 +1,115 @@ +From b38d55b7df137e599c0364a8f0e6d3e1ab84ed50 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 8 Jun 2026 09:19:42 +0200 +Subject: [PATCH] message: Avoid memory leak if string buffer for message is + too small + +This leaked 40 or 80 bytes per parsed message for the enumerators that +were not destroyed. While triggering an OOM condition will require quite +a lot of messages and the DoS protection also helps avoiding that this +is triggered quickly, it all depends on the memory constraints of the +system and the time available to the attacker. Also, if IKEv1 is allowed, +it could get quicker as the lack of message IDs doesn't allow dismissing +unexpected messages before parsing them. + +Fixes: 092958c89d52 ("fixed payload debug message") +Fixes: 6a4a47511f75 ("Show contents of the CP payload in message_t stringification") +Fixes: CVE-2026-78127 + +CVE: CVE-2026-78127 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/4b7108ac0f84fbf40da2b510eb6333afa2a54240] + +Signed-off-by: Ankur Tyagi +--- + src/libcharon/encoding/message.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c +index 8da9a1d..a4bf9cb 100644 +--- a/src/libcharon/encoding/message.c ++++ b/src/libcharon/encoding/message.c +@@ -1398,7 +1398,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + payload->get_type(payload)); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1424,7 +1424,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + } + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1454,7 +1454,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + eap->get_code(eap), method); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1495,7 +1495,8 @@ static char* get_string(private_message_t *this, char *buf, int len) + attribute->get_type(attribute)); + if (written >= len || written < 0) + { +- return buf; ++ attributes->destroy(attributes); ++ goto err; + } + pos += written; + len -= written; +@@ -1507,7 +1508,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + written = snprintf(pos, len, ")"); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1529,7 +1530,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + } + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1544,7 +1545,7 @@ static char* get_string(private_message_t *this, char *buf, int len) + frag->get_total_fragments(frag)); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; +@@ -1557,16 +1558,16 @@ static char* get_string(private_message_t *this, char *buf, int len) + written = snprintf(pos, len, "(%d)", unknown->get_type(unknown)); + if (written >= len || written < 0) + { +- return buf; ++ goto err; + } + pos += written; + len -= written; + } + } +- enumerator->destroy(enumerator); +- +- /* remove last space */ + snprintf(pos, len, " ]"); ++ ++err: ++ enumerator->destroy(enumerator); + return buf; + } + #endif diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index 2abc616c37..d8ed26d841 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -12,6 +12,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78123.patch \ file://CVE-2026-78124.patch \ file://CVE-2026-78126.patch \ + file://CVE-2026-78127.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Thu Oct 15 05:41:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100864 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38CE7CC6B39 for ; Thu, 15 Oct 2026 05:45:20 +0000 (UTC) Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33275.1792043111164562838 for ; Wed, 14 Oct 2026 22:45:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Zh2Zb/Mt; spf=pass (domain: gmail.com, ip: 209.85.214.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2e6038cebefso36464565ad.0 for ; Wed, 14 Oct 2026 22:45:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043110; x=1792647910; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=kQX8ZX3OmqB3os19hZtjRRMHYNsxUulUgZR6g/FqSpY=; b=Zh2Zb/MtEhhhv1KDYHwmaD5GalAXvITx4p3/D9g55z61lAI9bO/unGHd1nYENBVTYX QvIqcxTM2GRqqd1hC7TsI7Dxm+k70YFn9uvy0yLSRud3rvv0lbR1IEtmrPk5tx25JDuF QywsJCgJQJy/jci8mH05XcFEF77uYl7d7LuxFgiuq2nu87YpWavRHcLcLftHPuKTzyUo sWb6eJvEiH8/JZEFm1K6se+frLUllg4SP01x3Cim/F4bhE6DoTwxDg2nEGVM71RUpmwF ERYUHdJJaQXzDLl8zofr5zrAGFfhtu/1B4p2TQIDbZM4tnLo+RYuKb92aqiM9OaDG7Mn h7pg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043110; x=1792647910; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=kQX8ZX3OmqB3os19hZtjRRMHYNsxUulUgZR6g/FqSpY=; b=uVxeWnj3YQmmi5ckh8b17ij1QxqAjSHYfr2M9XD1uWFyInNzg3ypDohLSETGE9XH30 m3a2+8CASTH/972Evgeec03tsdZk5PRc6K+2j21Ceo9q8QswmHvN1QiCc3VOII9Chaye 5FBk1ddXliVmLpLH5KrcYBSvwkWxd2wc/l+jaNw0SfKGOsikFII5eCAsBJsBzJs2VXkI ZTpXZg/ni2iyqWPqLs6abkJ7HxPE6LaO9jLzRsLUYZjNDPlCtVgPIXfzfgOhOkqDuaPb DJWRNRKH9zf61G7FdTyK1AVwDqnyfyH0DH8TgXHPeywcg3HTgzj+Ik8auB7+nzympoJN R03g== X-Gm-Message-State: AFq9FYJZR+hkGS8U7u+93wMEPtSeiL9YQ96zONt18UBYsL2eP1cyCU5M WCZNhvICEN/tpgx4qj14s5EnYX8fhoaw4Dm3DQ241lNawSZsW55oJQzbtH4afg== X-Gm-Gg: AYBFou2B7KKGCWuClUoDODDNiQO/ioVKPu9Rt9VreJx5AsZYJZhu8n2IzeJmEPVgVlc myraVo/lUxc98tcZMJTy/m8BkYeRevkQB8b9GJetnySLx/dPWlMYfxZ4U5uFSrinaZH+hynFaJk qVZaMNnMorOuMJD3e2Em7k9/C8Fat5oZNkdkQMy50fuqt9Qahm0AVT2YRIoU4IO+/DoX5BvdF9k ssS/0OvPO/i2wxsIMzeCci2Q8kbW/Wl1ot16CwLnKWP01xI3hbregyjwgupJiHmeyRljskklbJr ZSjFBEvgeiwELQBkAK/iK8D7k0pBSIkpYMDw/9ePPfkrx9ZEXFfh0aVo3rPTJESbHzyd2WqEhEK iLiLU7266zgdF4EIVhQ3GXQQap1gU3wG3iRKzxsU5H149gkB7W3VvY0hfDrAM3MSVB6zzNsuXM6 0ZbyXLnwYMK/ODBnlSNl+qHsWnIB6b0uifg57RttPiRt2iDNqfoQ3ivH3o7vd2dGnVBkgzyuJPP g7YTnz0X5ODpn/h164c73k= X-Received: by 2002:a17:903:32c9:b0:2e9:4175:306e with SMTP id d9443c01a7336-2e941753b75mr34085255ad.42.1792043110457; Wed, 14 Oct 2026 22:45:10 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.08 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:10 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 66/82] strongswan: patch CVE-2026-78129 Date: Thu, 15 Oct 2026 18:41:54 +1300 Message-ID: <7004be1e6365b4b0bef7a8c04bfff8a931d40bac.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130986 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78129 [1]https://download.strongswan.org/security/CVE-2026-78129/strongswan-5.6.3-6.0.7_pkcs5_params_dos.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78129).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 9ea8363e3055e4b608c0e19d5db87e1fbfcad7e2) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78129.patch | 155 ++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 156 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch new file mode 100644 index 0000000000..5f327989a0 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch @@ -0,0 +1,155 @@ +From ec14a504137915cc45080323238c64d348d020eb Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Tue, 23 Jun 2026 11:55:31 +0200 +Subject: [PATCH] pkcs5: Validate parsed parameters to avoid DoS attacks + +With the unbounded iterations, an attacker can craft a PKCS#7 file and +send it during IKEv1 to block the processing thread practically for an +unlimited amount of time. + +As the key length is used for an allocation on the stack, not limiting +it could cause a crash. We validate it after parsing the params, but +since `encryption_algorithm_from_oid()` only returns trusted key lengths +that are lower than the limit, that's fine. + +The unlimited salt length had no direct impact (the maximum is bound by +the accepted message size), but we now limit it as well before cloning. + +Fixes: 4076e3ee9121 ("Extract PKCS#5 handling from pkcs8 plugin to separate helper class") +Fixes: fd1ff46f6143 ("Added support for PKCS#5 v2 schemes when decrypting PKCS#8 files.") +Fixes: cab127cba66c ("Added support for encrypted PKCS#8 files (for some PKCS#5 v1.5 schemes).") +Fixes: CVE-2026-78129 + +CVE: CVE-2026-78129 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/f60a55e36f95e210ab067de295c9f6bacefcdd1a] + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/crypto/pkcs5.c | 65 +++++++++++++++++++++++++++++++- + 1 file changed, 64 insertions(+), 1 deletion(-) + +diff --git a/src/libstrongswan/crypto/pkcs5.c b/src/libstrongswan/crypto/pkcs5.c +index 822656f..e01010b 100644 +--- a/src/libstrongswan/crypto/pkcs5.c ++++ b/src/libstrongswan/crypto/pkcs5.c +@@ -14,6 +14,8 @@ + * for more details. + */ + ++#include ++ + #include "pkcs5.h" + + #include +@@ -22,6 +24,15 @@ + #include + #include + ++/** maximum accepted length for salts in parsed parameters */ ++#define PKCS5_SALT_LEN_MAX 128 ++ ++/** maximum accepted iteration count in parsed parameters */ ++#define PKCS5_ITERATIONS_MAX 1000000 ++ ++/** maximum key length accepted in parsed parameters */ ++#define PKCS5_KEY_LEN_MAX 64 ++ + typedef struct private_pkcs5_t private_pkcs5_t; + + /** +@@ -379,6 +390,41 @@ METHOD(pkcs5_t, decrypt, bool, + keymat, key, iv); + } + ++/** ++ * Make sure the salt has an appropriate length ++ */ ++static bool validate_salt_length(chunk_t salt) ++{ ++ if (salt.len > PKCS5_SALT_LEN_MAX) ++ { ++ DBG1(DBG_ASN, " salt length %zu exceeds maximum of %zu bytes", ++ salt.len, (size_t)PKCS5_SALT_LEN_MAX); ++ return FALSE; ++ } ++ return TRUE; ++} ++ ++/** ++ * Validate that parsed parameters are in an allowed range ++ */ ++static bool validate_params(private_pkcs5_t *this) ++{ ++ if (!this->iterations || this->iterations > PKCS5_ITERATIONS_MAX) ++ { ++ DBG1(DBG_ASN, " iteration count %" PRIu64 " is out of range " ++ "(1-%" PRIu64 ")", this->iterations, ++ (uint64_t)PKCS5_ITERATIONS_MAX); ++ return FALSE; ++ } ++ if (this->keylen > PKCS5_KEY_LEN_MAX) ++ { ++ DBG1(DBG_ASN, " key length %zu exceeds maximum of %zu bytes", ++ this->keylen, (size_t)PKCS5_KEY_LEN_MAX); ++ return FALSE; ++ } ++ return TRUE; ++} ++ + /** + * ASN.1 definition of a PBEParameter structure + */ +@@ -399,7 +445,7 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0) + asn1_parser_t *parser; + chunk_t object; + int objectID; +- bool success; ++ bool success = FALSE; + + parser = asn1_parser_create(pbeParameterObjects, blob); + parser->set_top_level(parser, level0); +@@ -410,6 +456,10 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0) + { + case PBEPARAM_SALT: + { ++ if (!validate_salt_length(object)) ++ { ++ goto end; ++ } + this->salt = chunk_clone(object); + break; + } +@@ -421,6 +471,11 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0) + } + } + success = parser->success(parser); ++ if (success) ++ { ++ success = validate_params(this); ++ } ++end: + parser->destroy(parser); + return success; + } +@@ -471,6 +526,10 @@ static bool parse_pbkdf2_params(private_pkcs5_t *this, chunk_t blob, int level0) + { + case PBKDF2_SALT: + { ++ if (!validate_salt_length(object)) ++ { ++ goto end; ++ } + this->salt = chunk_clone(object); + break; + } +@@ -500,6 +559,10 @@ static bool parse_pbkdf2_params(private_pkcs5_t *this, chunk_t blob, int level0) + } + } + success = parser->success(parser); ++ if (success) ++ { ++ success = validate_params(this); ++ } + end: + parser->destroy(parser); + return success; diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index d8ed26d841..5a7a12d903 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -13,6 +13,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78124.patch \ file://CVE-2026-78126.patch \ file://CVE-2026-78127.patch \ + file://CVE-2026-78129.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Thu Oct 15 05:41:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100867 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D311CC6B38 for ; Thu, 15 Oct 2026 05:45:20 +0000 (UTC) Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32860.1792043114245997331 for ; Wed, 14 Oct 2026 22:45:14 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=QjEASTbR; spf=pass (domain: gmail.com, ip: 209.85.214.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2df8c28a0b1so22821685ad.1 for ; Wed, 14 Oct 2026 22:45:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043114; x=1792647914; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Tpx6wHmaqrgpjQKmI4jUXEEKGskH2a6/Ik7uFEpL7oE=; b=QjEASTbRqN2keDOHDJDqrSoGlWX9t+aN/59W7pdnixNHXhJYCfTLFHX1nHzDc44ygl n8BgdhZ6gFLPtmV0TetZCQ9Pg9py6sjNM6O9N3RZLY/W/RbZs3B9Qe9VsvU4Ex+cKXGH e8HtfF1w9Bw+GQXvgrrKK/Ti+wO5ECvJNSZnmsFUvv1CiLcoQTttwDzpcG/osWyLXoVf lrwLTnDMDrq+8R/TVNBhPm2hUE3Dl8FaMVipExMrnaCyQSJHA8lTCRmvkXhA9wDPueMN 36IVMT5MfxGJClfroqbYn/FNJ08Dqd/nEERH62XjwRfutJsTlr/C6WDsDaNX3en1y3GK oJJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043114; x=1792647914; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Tpx6wHmaqrgpjQKmI4jUXEEKGskH2a6/Ik7uFEpL7oE=; b=BKkBEdB9SMPdvVkWA3MzYT58ExWzeXIuRXrMCXNXgMpIKgzl0qOVrP0UPzysIfkCGL MGv8s5Hg97TlPyIvnP98DdRExdFVe1CpViUybIycGTy1L7h/FbbQs/0USa5L29OyXzHh If+vCZG9+Qv9pOVzaZeEUYGlkYoetewmgTbY0DXvyyAO+xA6so8HMvsOqszJFxlwl54t qACutE0Hb4PDfLYOXeRfCjPAn12XUm7Ih5LOw0MfXGZUvYP1PCTl9r0l0xmmVNQa03yr bUtKpOqeRceFYo8l5r1UVj7At0jeONVSoK+9ZvhJ3iuyx26MAMNwIMC2s7/7o7djan6t qRtQ== X-Gm-Message-State: AFq9FYLtuHAO3W9AoO/qtrkHQ+LgZwC3wRapdy60l9lBD+4PDiMgOynB Qfc+orgKeUullgEJxcpqA6PqQZjW3ePFa/C7ovrFbe3ei6Ztm2Ctb+UTj9YjuQ== X-Gm-Gg: AYBFou0hkobALXZFouZbx4vQ8GWNY9Ytfm15ElFCOhuhCsNeScH8+cK4GcuKdTD5yty ueLlg4CYkOywafNDGLmwtgL+YEvQu1har7RHYXtsdDD9Cc749mj3fSeMNydfR2vhqb3GPCyltIF YmmljP51eHbJuZiGoK299hdViCNkifYTpPDATyD1RrrUat189RSuDj/sjArsNN/az1UCeda+S1A 4WwCIIElbrS+nYAKyTeJPzNRVeCsRczIxTib91fSkV9FUlAJ0I5GJlNsmK6iks1azO8am/N2qxH lsAWEtrtLHLPzx6aIs0weTWKl6uZ0s4NNJL56boiV1IdLlEjHLwyzclQnalN/dgFOxCv59dnDYK kMJkoPYBilFgDDc9hubc3+vz9h4I3kSMe8DTegrbS2qRWaCtXue6i0aQnUPWxtBN4HXOJ8XH9yk IB9Ftl+oXGvjVbsKL3Jht0qrQP9ugvEuUJoTw20x2sPQws/AnhCczxIHuhF0kLDmxCQA3Tf45HM tMBQtsOyE7jAiPqhkAt1sQ= X-Received: by 2002:a17:902:f786:b0:2e2:c28d:ab6b with SMTP id d9443c01a7336-2e84270882amr146562355ad.0.1792043113171; Wed, 14 Oct 2026 22:45:13 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:12 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 67/82] strongswan: patch CVE-2026-78133 Date: Thu, 15 Oct 2026 18:41:55 +1300 Message-ID: <036fde2bb0b3bd4f7df18bfd39b90f6e11ef9354.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130987 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78133 [1]https://download.strongswan.org/security/CVE-2026-78133/strongswan-6.0.0-6.0.7_ikev2_rekey_collision.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78133).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 7a5589163324a26c8c3569d8e5ec11f078df0ef5) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78133.patch | 620 ++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 621 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch new file mode 100644 index 0000000000..f009168a9a --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch @@ -0,0 +1,620 @@ +From 3f5768c48bc9dff62511c91157e0a9bd12b2159b Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Fri, 5 Jun 2026 08:15:46 +0200 +Subject: [PATCH] ikev2: Prevent use-after-free during collision after passive + multi-KE rekeying failed + +During a multi-KE rekey collision, where the initial response to the +active rekeying is delayed (or withheld), the active task already keeps +track of the passive task to eventually resolve the collision (it can +only do so once all nonces are known). + +If the passive task then fails, e.g. due to a missing or invalid KE +payload, and completes with SUCCESS, `collide()` previously recognized +that the passive task is not yet complete returned FALSE, which caused +the task manager to destroy the task. However, the reference in the +active task would remain. So once the active rekeying progresses and +the collision is resolved, that dangling pointer would get dereferenced +for an indirect method call. This happens via the `get_lower_nonce` +function pointer of the `child_create_t` instance in the private task +struct. So besides having to be authenticated, an attacker has to get +two indirections right to exploit this flaw for a potential RCE. +Otherwise, the effects are a crash or basically undefined behavior +triggered by the method call. + +By passing whether the passive task is done (and would get destroyed), +the active tasks can properly clear the held reference. + +Note that this patch includes another fix for a state change during +Child SA rekeying that's included in 6.1.0 (4611f41b1e14 ("child-rekey: +Only reset state of SAs not actively rekeyed if passive rekeying +fails")). + +Fixes: d2b2e1b3fae8 ("ikev2: Make CHILD_SAs properly trackable during rekey collisions") +Fixes: ca3e6d2d144e ("ike-rekey: Support IKE_SA rekeying with multiple key exchanges") +Fixes: CVE-2026-78133 + +CVE: CVE-2026-78133 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/eb615b452539461d57503f50041f01773c1ccf86] + +Signed-off-by: Ankur Tyagi +--- + src/libcharon/sa/ikev2/task_manager_v2.c | 13 +- + src/libcharon/sa/ikev2/tasks/child_rekey.c | 47 ++++-- + src/libcharon/sa/ikev2/tasks/child_rekey.h | 3 +- + src/libcharon/sa/ikev2/tasks/ike_rekey.c | 40 +++-- + src/libcharon/sa/ikev2/tasks/ike_rekey.h | 3 +- + src/libcharon/tests/suites/test_child_rekey.c | 136 ++++++++++++++++ + src/libcharon/tests/suites/test_ike_rekey.c | 147 ++++++++++++++++++ + 7 files changed, 361 insertions(+), 28 deletions(-) + +diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c +index 0f3b937..5a19ce8 100644 +--- a/src/libcharon/sa/ikev2/task_manager_v2.c ++++ b/src/libcharon/sa/ikev2/task_manager_v2.c +@@ -927,7 +927,8 @@ static status_t process_response(private_task_manager_t *this, + * Handle exchange collisions, returns TRUE if the given passive task was + * adopted by the active task and the task manager lost control over it. + */ +-static bool handle_collisions(private_task_manager_t *this, task_t *task) ++static bool handle_collisions(private_task_manager_t *this, task_t *task, ++ bool done) + { + enumerator_t *enumerator; + task_t *active; +@@ -951,7 +952,7 @@ static bool handle_collisions(private_task_manager_t *this, task_t *task) + if (type == TASK_IKE_REKEY || type == TASK_IKE_DELETE) + { + ike_rekey_t *rekey = (ike_rekey_t*)active; +- adopted = rekey->collide(rekey, task); ++ adopted = rekey->collide(rekey, task, done); + break; + } + continue; +@@ -959,7 +960,7 @@ static bool handle_collisions(private_task_manager_t *this, task_t *task) + if (type == TASK_CHILD_REKEY) + { + child_rekey_t *rekey = (child_rekey_t*)active; +- adopted = rekey->collide(rekey, task); ++ adopted = rekey->collide(rekey, task, done); + break; + } + continue; +@@ -1011,14 +1012,14 @@ static status_t build_response(private_task_manager_t *this, message_t *request) + case SUCCESS: + /* task completed, remove it */ + array_remove_at(this->passive_tasks, enumerator); +- if (!handle_collisions(this, task)) ++ if (!handle_collisions(this, task, TRUE)) + { + task->destroy(task); + } + break; + case NEED_MORE: + /* processed, but task needs another exchange */ +- if (handle_collisions(this, task)) ++ if (handle_collisions(this, task, FALSE)) + { + array_remove_at(this->passive_tasks, enumerator); + } +@@ -1029,7 +1030,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request) + /* FALL */ + case DESTROY_ME: + /* destroy IKE_SA, but SEND response first */ +- if (handle_collisions(this, task)) ++ if (handle_collisions(this, task, FALSE)) + { + array_remove_at(this->passive_tasks, enumerator); + } +diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.c b/src/libcharon/sa/ikev2/tasks/child_rekey.c +index fb3ba2a..e984668 100644 +--- a/src/libcharon/sa/ikev2/tasks/child_rekey.c ++++ b/src/libcharon/sa/ikev2/tasks/child_rekey.c +@@ -403,7 +403,7 @@ METHOD(task_t, build_r, status_t, + child_sa_t *child_sa, *old_replacement; + child_sa_state_t state = CHILD_INSTALLED; + uint32_t reqid; +- bool followup_sent = FALSE; ++ bool active, followup_sent = FALSE; + + if (!this->child_sa) + { +@@ -423,7 +423,8 @@ METHOD(task_t, build_r, status_t, + message->add_notify(message, TRUE, TEMPORARY_FAILURE, chunk_empty); + return SUCCESS; + } +- if (actively_rekeying(this, &followup_sent) && followup_sent) ++ active = actively_rekeying(this, &followup_sent); ++ if (active && followup_sent) + { + DBG1(DBG_IKE, "peer initiated rekeying, but we did too and already " + "sent IKE_FOLLOWUP_KE"); +@@ -483,8 +484,9 @@ METHOD(task_t, build_r, status_t, + /* like installing the outbound SA, we only trigger the child-rekey + * event once the old SA is deleted */ + } +- else if (this->child_sa->get_state(this->child_sa) == CHILD_REKEYING) +- { /* rekeying failed, reuse old child */ ++ else if (!active && ++ this->child_sa->get_state(this->child_sa) == CHILD_REKEYING) ++ { /* rekeying failed, reuse old child, unless we are actively rekeying */ + this->child_sa->set_state(this->child_sa, state); + } + return SUCCESS; +@@ -1127,8 +1129,22 @@ METHOD(child_rekey_t, handle_delete, child_rekey_collision_t, + return CHILD_REKEY_COLLISION_NONE; + } + ++/** ++ * Clear the colliding passive task if it did not complete successfully. ++ */ ++static void clear_collision(private_child_rekey_t *this, task_t *other) ++{ ++ if (this->collision == other) ++ { ++ DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} " ++ "failed", this->child_sa->get_name(this->child_sa), ++ this->child_sa->get_unique_id(this->child_sa)); ++ this->collision = NULL; ++ } ++} ++ + METHOD(child_rekey_t, collide, bool, +- private_child_rekey_t *this, task_t *other) ++ private_child_rekey_t *this, task_t *other, bool done) + { + private_child_rekey_t *rekey = (private_child_rekey_t*)other; + child_sa_t *other_child; +@@ -1142,16 +1158,25 @@ METHOD(child_rekey_t, collide, bool, + other_child = rekey->child_create->get_child(rekey->child_create); + if (!other_child) + { +- /* ignore passive tasks that did not successfully create a CHILD_SA */ ++ /* ignore passive tasks that did not successfully create a CHILD_SA, ++ * if we are already tracking it in the multi-KE case, clear it */ ++ clear_collision(this, other); + return FALSE; + } + if (other_child->get_state(other_child) != CHILD_INSTALLED) + { +- DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} is not " +- "yet complete", this->child_sa->get_name(this->child_sa), +- this->child_sa->get_unique_id(this->child_sa)); +- /* we do reference the task to check its state later */ +- this->collision = other; ++ if (done) ++ { /* passive task failed, clear it if necessary */ ++ clear_collision(this, other); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} is " ++ "not yet complete", this->child_sa->get_name(this->child_sa), ++ this->child_sa->get_unique_id(this->child_sa)); ++ /* we do reference the task to check its state later */ ++ this->collision = other; ++ } + return FALSE; + } + if (this->collision && this->collision != other) +diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.h b/src/libcharon/sa/ikev2/tasks/child_rekey.h +index a8daed7..fef0bba 100644 +--- a/src/libcharon/sa/ikev2/tasks/child_rekey.h ++++ b/src/libcharon/sa/ikev2/tasks/child_rekey.h +@@ -79,10 +79,11 @@ struct child_rekey_t { + * are going on and notifies the active task by passing the passive. + * + * @param other passive task ++ * @param done passive task is done and gets destroyed if not adopted + * @return whether the task was adopted and should be removed from + * the task manager's control + */ +- bool (*collide)(child_rekey_t* this, task_t *other); ++ bool (*collide)(child_rekey_t* this, task_t *other, bool done); + }; + + /** +diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.c b/src/libcharon/sa/ikev2/tasks/ike_rekey.c +index c7e8ffb..f275d2d 100644 +--- a/src/libcharon/sa/ikev2/tasks/ike_rekey.c ++++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.c +@@ -743,8 +743,23 @@ METHOD(ike_rekey_t, did_collide, bool, + return this->collision != NULL; + } + ++/** ++ * Clear the colliding passive task if it did not complete successfully. ++ */ ++static bool clear_collision(private_ike_rekey_t *this, ++ private_ike_rekey_t *other) ++{ ++ if (this->collision == other) ++ { ++ DBG1(DBG_IKE, "colliding passive rekeying failed, ignore"); ++ this->collision = NULL; ++ return TRUE; ++ } ++ return FALSE; ++} ++ + METHOD(ike_rekey_t, collide, bool, +- private_ike_rekey_t* this, task_t *other) ++ private_ike_rekey_t* this, task_t *other, bool done) + { + DBG1(DBG_IKE, "detected %N collision with %N", task_type_names, + TASK_IKE_REKEY, task_type_names, other->get_type(other)); +@@ -760,23 +775,30 @@ METHOD(ike_rekey_t, collide, bool, + + if (!rekey->ike_init) + { +- DBG1(DBG_IKE, "colliding exchange did not result in an IKE_SA, " +- "ignore"); +- if (this->collision == rekey) ++ if (!clear_collision(this, rekey)) + { +- this->collision = NULL; ++ DBG1(DBG_IKE, "colliding exchange did not result in an " ++ "IKE_SA, ignore"); + } + break; + } +- /* we keep track of the passive exchange in any case, if not +- * complete yet, this method might be called again later */ +- this->collision = rekey; ++ /* we keep track of the passive exchange, if not complete yet, this ++ * method might be called again later */ + if (rekey->flags & IKE_REKEY_DONE) + { ++ this->collision = rekey; + this->flags |= IKE_REKEY_ADOPTED_PASSIVE; + return TRUE; + } +- DBG1(DBG_IKE, "colliding passive exchange is not yet complete"); ++ else if (done) ++ { /* passive task failed, clear it if necessary */ ++ clear_collision(this, rekey); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "colliding passive exchange is not yet complete"); ++ this->collision = rekey; ++ } + break; + } + default: +diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.h b/src/libcharon/sa/ikev2/tasks/ike_rekey.h +index 5fab349..e68fa62 100644 +--- a/src/libcharon/sa/ikev2/tasks/ike_rekey.h ++++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.h +@@ -54,10 +54,11 @@ struct ike_rekey_t { + * are going on and notifies the active task by passing the passive. + * + * @param other passive task ++ * @param done passive task is done and gets destroyed if not adopted + * @return whether the task was adopted and should be removed from + * the task manager's control + */ +- bool (*collide)(ike_rekey_t* this, task_t *other); ++ bool (*collide)(ike_rekey_t* this, task_t *other, bool done); + }; + + /** +diff --git a/src/libcharon/tests/suites/test_child_rekey.c b/src/libcharon/tests/suites/test_child_rekey.c +index 1c81e75..4ef081a 100644 +--- a/src/libcharon/tests/suites/test_child_rekey.c ++++ b/src/libcharon/tests/suites/test_child_rekey.c +@@ -2546,6 +2546,141 @@ START_TEST(test_collision_delayed_response_multi_ke) + } + END_TEST + ++/** ++ * Remove the KE payload from the IKE_FOLLOWUP_KE request ++ */ ++static bool remove_ke(listener_t *listener, ike_sa_t *ike_sa, ++ message_t *message, bool incoming, bool plain) ++{ ++ if (plain && incoming && ++ message->get_exchange_type(message) == IKE_FOLLOWUP_KE && ++ message->get_request(message)) ++ { ++ enumerator_t *enumerator = message->create_payload_enumerator(message); ++ payload_t *pld; ++ ++ while (enumerator->enumerate(enumerator, &pld)) ++ { ++ if (pld->get_type(pld) == PLV2_KEY_EXCHANGE) ++ { ++ message->remove_payload_at(message, enumerator); ++ pld->destroy(pld); ++ break; ++ } ++ } ++ enumerator->destroy(enumerator); ++ free(listener); ++ return FALSE; ++ } ++ return TRUE; ++} ++ ++#define remove_ke_from_ike_followup_ke() ({ \ ++ listener_t *_ke_listener; \ ++ INIT(_ke_listener, \ ++ .message = remove_ke, \ ++ ); \ ++ exchange_test_helper->add_listener(exchange_test_helper, _ke_listener); \ ++}) ++ ++/** ++ * This simulates an incorrect behavior by the peer. It triggers a collision by ++ * not responding to the initial CREATE_CHILD_SA and then sends an invalid ++ * IKE_FOLLOWUP_KE (in this case the KE payload is missing). The initiator ++ * has to correctly track and then untrack the passive rekey task. ++ * ++ * Peer A Peer B ++ * rekey ----\ /---- rekey ++ * \-----/----> detect collision and withhold response ++ * detect collision <---------/ ++ * ----------------> ++ * handle failure <---------------- send invalid additional KE ++ * handle rekey <---------------- send withheld response ++ */ ++START_TEST(test_collision_delayed_response_multi_ke_failure) ++{ ++ ike_sa_t *a, *b; ++ message_t *msg; ++ ++ assert_track_sas_start(); ++ ++ exchange_test_helper->establish_sa(exchange_test_helper, ++ &a, &b, &multi_ke_conf); ++ ++ /* make sure the responder wins the collision so it continues */ ++ exchange_test_helper->nonce_first_byte = 0x00; ++ initiate_rekey(a, 1); ++ assert_ipsec_sas_installed(a, 1, 2); ++ exchange_test_helper->nonce_first_byte = 0xff; ++ initiate_rekey(b, 2); ++ assert_ipsec_sas_installed(b, 1, 2); ++ ++ /* these should not get called as no SA goes down or gets rekeyed */ ++ assert_hook_not_called(child_updown); ++ assert_hook_not_called(child_rekey); ++ ++ /* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_child_sa_state(b, 2, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(b, 1, 2); ++ ++ /* <-- CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(a, 1, 2); ++ ++ /* the responder is not responding */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ ++ /* CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } --> */ ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_num_tasks(b, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(b, 1, TASK_QUEUE_ACTIVE); ++ assert_child_sa_state(b, 2, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(b, 1, 2); ++ ++ /* remove the KE payload in the IKE_FOLLOWUP_KE request */ ++ remove_ke_from_ike_followup_ke(); ++ ++ /* <-- IKE_FOLLOWUP_KE { N(ADD_KE) } */ ++ assert_no_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_single_notify(OUT, INVALID_SYNTAX); ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(a, 1, 2); ++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE); ++ ++ /* <-- CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } (delayed) */ ++ exchange_test_helper->process_message(exchange_test_helper, a, msg); ++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(a, 1, TASK_QUEUE_ACTIVE); ++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED); ++ assert_ipsec_sas_installed(a, 1, 2); ++ ++ /* drop the STATE_NOT_FOUND error message from the initiator */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ msg->destroy(msg); ++ ++ /* since we explicitly forced the responder to win, it already removed ++ * the passive task it won't accept the request */ ++ ++ /* IKE_FOLLOWUP_KE { KEi, N(ADD_KE) } --> */ ++ assert_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ ++ /* child_rekey/child_updown */ ++ assert_hook(); ++ assert_hook(); ++ assert_track_sas(2, 2); ++ ++ call_ikesa(a, destroy); ++ call_ikesa(b, destroy); ++} ++END_TEST ++ + /** + * In this scenario one of the peers does not notice that there is a + * rekey collision: +@@ -4436,6 +4571,7 @@ Suite *child_rekey_suite_create() + tcase_add_loop_test(tc, test_collision_delayed_response, 0, 4); + tcase_add_loop_test(tc, test_collision_delayed_response_delete, 0, 4); + tcase_add_loop_test(tc, test_collision_delayed_response_multi_ke, 0, 4); ++ tcase_add_test(tc, test_collision_delayed_response_multi_ke_failure); + tcase_add_loop_test(tc, test_collision_delayed_request, 0, 6); + tcase_add_loop_test(tc, test_collision_delayed_request_more, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_request_more_delete, 0, 3); +diff --git a/src/libcharon/tests/suites/test_ike_rekey.c b/src/libcharon/tests/suites/test_ike_rekey.c +index c6691ac..2c41022 100644 +--- a/src/libcharon/tests/suites/test_ike_rekey.c ++++ b/src/libcharon/tests/suites/test_ike_rekey.c +@@ -1784,6 +1784,152 @@ START_TEST(test_collision_delayed_response_multi_ke) + } + END_TEST + ++/** ++ * Remove the ADDITIONAL_KEY_EXCHANGE notify payload from the IKE_FOLLOWUP_KE ++ * request ++ */ ++static bool remove_notify(listener_t *listener, ike_sa_t *ike_sa, ++ message_t *message, bool incoming, bool plain) ++{ ++ if (plain && incoming && ++ message->get_exchange_type(message) == IKE_FOLLOWUP_KE && ++ message->get_request(message)) ++ { ++ enumerator_t *enumerator = message->create_payload_enumerator(message); ++ payload_t *pld; ++ ++ while (enumerator->enumerate(enumerator, &pld)) ++ { /* we only expect one notify, so just remove the first */ ++ if (pld->get_type(pld) == PLV2_NOTIFY) ++ { ++ message->remove_payload_at(message, enumerator); ++ pld->destroy(pld); ++ break; ++ } ++ } ++ enumerator->destroy(enumerator); ++ free(listener); ++ return FALSE; ++ } ++ return TRUE; ++} ++ ++#define remove_notify_from_ike_followup_ke() ({ \ ++ listener_t *_ke_listener; \ ++ INIT(_ke_listener, \ ++ .message = remove_notify, \ ++ ); \ ++ exchange_test_helper->add_listener(exchange_test_helper, _ke_listener); \ ++}) ++ ++/** ++ * This simulates an incorrect behavior by the peer. It triggers a collision by ++ * not responding to the initial CREATE_CHILD_SA and then sends an invalid ++ * IKE_FOLLOWUP_KE (in this case by removing the ADDITIONAL_KEY_EXCHANGE ++ * notify). The initiator has to correctly track and then untrack the passive ++ * rekey task. ++ * ++ * Peer A Peer B ++ * rekey ----\ /---- rekey ++ * \-----/----> detect collision and withhold response ++ * detect collision <---------/ ++ * ----------------> ++ * handle failure <---------------- send invalid additional KE ++ * handle rekey <---------------- send withheld response ++ */ ++START_TEST(test_collision_delayed_response_multi_ke_failure) ++{ ++ ike_sa_t *a, *b; ++ message_t *msg; ++ ++ assert_track_sas_start(); ++ ++ exchange_test_helper->establish_sa(exchange_test_helper, ++ &a, &b, &multi_ke_conf); ++ ++ /* these should not get called as no SA goes down or gets rekeyed */ ++ assert_hook_not_called(ike_updown); ++ assert_hook_not_called(ike_rekey); ++ assert_hook_not_called(child_updown); ++ ++ /* make sure the responder wins the collision so it continues */ ++ exchange_test_helper->nonce_first_byte = 0x00; ++ initiate_rekey(a); ++ exchange_test_helper->nonce_first_byte = 0xff; ++ initiate_rekey(b); ++ ++ /* CREATE_CHILD_SA { SA, Ni, KEi } --> */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_ike_sa_state(b, IKE_REKEYING); ++ assert_child_sa_count(b, 1); ++ assert_ike_sa_count(0); ++ ++ /* <-- CREATE_CHILD_SA { SA, Ni, KEi } */ ++ exchange_test_helper->nonce_first_byte = 0xff; ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_ike_sa_state(a, IKE_REKEYING); ++ assert_child_sa_count(a, 1); ++ assert_ike_sa_count(0); ++ ++ /* the responder is not responding */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ ++ /* simplify next steps by checking in original IKE_SAs */ ++ charon->ike_sa_manager->checkin(charon->ike_sa_manager, a); ++ charon->ike_sa_manager->checkin(charon->ike_sa_manager, b); ++ assert_ike_sa_count(2); ++ ++ /* CREATE_CHILD_SA { SA, Nr, KEr, N(ADD_KE) } --> */ ++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ assert_num_tasks(b, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(b, 1, TASK_QUEUE_ACTIVE); ++ assert_ike_sa_state(b, IKE_REKEYING); ++ assert_ike_sa_count(2); ++ ++ /* remove the ADD_KE notify from the IKE_FOLLOWUP_KE request */ ++ remove_notify_from_ike_followup_ke(); ++ ++ /* <-- IKE_FOLLOWUP_KE { KEi } */ ++ assert_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_no_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ assert_single_notify(OUT, STATE_NOT_FOUND); ++ exchange_test_helper->process_message(exchange_test_helper, a, NULL); ++ assert_ike_sa_state(a, IKE_REKEYING); ++ assert_child_sa_count(a, 1); ++ assert_ike_sa_count(2); ++ ++ /* <-- CREATE_CHILD_SA { SA, Nr, KEr } (delayed) */ ++ exchange_test_helper->process_message(exchange_test_helper, a, msg); ++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE); ++ assert_num_tasks(a, 1, TASK_QUEUE_ACTIVE); ++ assert_ike_sa_state(a, IKE_REKEYING); ++ assert_child_sa_count(a, 1); ++ assert_ike_sa_count(2); ++ ++ /* drop the STATE_NOT_FOUND error message from the initiator */ ++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender); ++ msg->destroy(msg); ++ ++ /* since we explicitly forced the responder to win, it already removed ++ * the passive task it won't accept the request */ ++ ++ /* IKE_FOLLOWUP_KE { KEi, N(ADD_KE) } --> */ ++ assert_payload(IN, PLV2_KEY_EXCHANGE); ++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE); ++ exchange_test_helper->process_message(exchange_test_helper, b, NULL); ++ ++ /* ike_updown/rekey/child_updown */ ++ assert_hook(); ++ assert_hook(); ++ assert_hook(); ++ assert_track_sas(2, 2); ++ ++ charon->ike_sa_manager->flush(charon->ike_sa_manager); ++} ++END_TEST ++ + /** + * In this scenario one of the peers does not notice that there is a rekey + * collision because the other request is dropped: +@@ -2590,6 +2736,7 @@ Suite *ike_rekey_suite_create() + tcase_add_loop_test(tc, test_collision_ke_invalid_delayed_retry, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_response, 0, 4); + tcase_add_loop_test(tc, test_collision_delayed_response_multi_ke, 0, 4); ++ tcase_add_test(tc, test_collision_delayed_response_multi_ke_failure); + tcase_add_loop_test(tc, test_collision_dropped_request, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_request, 0, 3); + tcase_add_loop_test(tc, test_collision_delayed_request_and_delete, 0, 3); diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index 5a7a12d903..bd3191d35d 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -14,6 +14,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78126.patch \ file://CVE-2026-78127.patch \ file://CVE-2026-78129.patch \ + file://CVE-2026-78133.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Thu Oct 15 05:41:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100866 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5FB17CC6B3A for ; Thu, 15 Oct 2026 05:45:20 +0000 (UTC) Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32861.1792043115930163088 for ; Wed, 14 Oct 2026 22:45:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=M1cp0Qil; spf=pass (domain: gmail.com, ip: 209.85.214.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2e7e742a2c7so33107425ad.0 for ; Wed, 14 Oct 2026 22:45:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043115; x=1792647915; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=QWEYDV99Zj+PR0BNtmTW2g3aHPvohqUOT6ScDs+PuZE=; b=M1cp0QilYNNEKR2QOP40wHG5U7cTS39ph1veSCjQJ+ZWsEFOnK/ReAr2YNSxVG9UdF Bv+Z2uZ3hmm+lrY9gzdvYYzPa0VX++3tPD48KkpG+QhjUQWzwpY4N1417nRqWMVoRN// ofynF5Mve4i3eXz005vfod0pfwwhN+e+oU+FAjRo5tQR3NZZCEncLk/NvSc2OWFSMQXd hWvzYMrKzGL/O/42Xy62Avc1GNpxCWtObWHpT1dtJNbUST58AevOH8jtQfVIseGKxotK Z5nHzzfROQyL45F02pTuktwitNEkXd9OieynXauOWnK4zGBdWqu5ybsPrmPoBQqIUjKV B3aQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043115; x=1792647915; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=QWEYDV99Zj+PR0BNtmTW2g3aHPvohqUOT6ScDs+PuZE=; b=VYXiJTek1PzH/XmQs7/zIYVgKO4b1DEojqwWdMG8kFlzt6++kV5ifCrJvZaGC7iwbx EpLWibra7qehMo/FABT9voFlJ3k+8YzD+1sq67Es81B161aLp7oo4WXKPmAZA+4Xq2SH yqbNVqp8D+EJoklCopt/kfkqO64YfRLzWnOuUb54Hd85RYK41qc++TNpOcLPCv2gFxKK gv45j29l5GEpxFx+Icfkg3BXeL5oKXWOm8dOBQ8r7HmoTvRcnePYEMaVIvxV5DZp+frh WQNiIYnp1wpSs4R3iNvlaTPTpdlT6raagjKjWm5DDO2Gdubu2FGy6tPayVPLOVoKGgXo QxvQ== X-Gm-Message-State: AFq9FYKvxeZHnYgcyLyUnRfu/OPc+rITuVxBpYnlFyxK6DWq6wHx06sA 7kpiP4nshjSVK19+iYpluGyXjZcO9GbYraqj5ZWllG37CrcetMcKpIT5bUFKBQ== X-Gm-Gg: AYBFou3SOjQ2fqp59CKaXa7oMN2+R8uMOQ2RUOydb5bIBS2oIIefWYG1yi9hry22IY7 MUXquzDT2YKzBgVL1Q7mCoovNHrRTd/pMmMVVb7eL9WtuFFC9z02dJF9FuJi/oyaPoXQxbQysMI prJM25wOm1i17fqgaVucIzmEZot2tXb0pX1RAULyYFRGtPh2QZG/IeCbnezkeMjjt+QwykNVvBJ 3w7jhrFGY+GHNHwYDy6TfjWMEZsGUZmi9gHgI0fVnFmEmAVMszsPl6Vt4B/EgCzJ8gFWaOA3sJd bFCVY7OJf7CDdzTOAWgmg9n2oHx+MMrtyj0FDp+FFq/cYHlpY1x017l+KhCMLP5ETNyWSezWRrz h/aa8Dw1C0IoFraNBGChRS7q2MfZtVZ4oUYk4AceStTjpuRbkVGs1AuP2IsP8mo3RGMC7Wx2FhE 0jK2xsdGovNWmlowDlGM1vTY/Kx3i4TyDtUNgrwtvKmQi4WN3xIQmGRBb8dQgrhznXGq5SqOs9L m0c2/CIkhBwOjHoV/1GXcoN9Q0eTWMYPQ== X-Received: by 2002:a17:902:b788:b0:2e8:4ef1:6fd3 with SMTP id d9443c01a7336-2e84ef17552mr81529045ad.13.1792043115182; Wed, 14 Oct 2026 22:45:15 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:14 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 68/82] strongswan: patch CVE-2026-78131 Date: Thu, 15 Oct 2026 18:41:56 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130988 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78131 [1]https://download.strongswan.org/security/CVE-2026-78131/strongswan-5.5.3-6.0.7_x509_ac_leaks.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78131).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 41cb8cca46d3f97981245f2213942d2006df121f) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78131.patch | 86 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 87 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch new file mode 100644 index 0000000000..da53f8e5a0 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch @@ -0,0 +1,86 @@ +From d1d29ac675b42a8c4a6454db84803bfecf5a0d99 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Fri, 12 Jun 2026 15:55:43 +0200 +Subject: [PATCH] x509: Fix memory leaks when parsing attribute certificates + +This can be triggered by an attribute certificate with lots of GeneralName +entries or AuthorityKeyIdentifier extensions. There is no verification +before the certificate is parsed. + +Fixes: 3134379ac7f1 ("x509: Fix some whitespaces and do some minor style cleanups in acert") +Fixes: 26930a8c3e42 ("certificate factory can load certs from file") +Fixes: CVE-2026-78131 + +CVE: CVE-2026-78131 +Upstream-Status: Backport [1][2] + +[1]https://github.com/strongswan/strongswan/commit/23c9b9a2708e4958292d828424523fa63c0be829 +[2]https://github.com/strongswan/strongswan/commit/9762cc3b091b423543510113a5d05215daf16951 + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/plugins/x509/x509_ac.c | 33 +++++++----------------- + 1 file changed, 9 insertions(+), 24 deletions(-) + +diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c +index 3fc5de2..68b7cf9 100644 +--- a/src/libstrongswan/plugins/x509/x509_ac.c ++++ b/src/libstrongswan/plugins/x509/x509_ac.c +@@ -186,41 +186,25 @@ extern bool x509_parse_generalNames(chunk_t blob, int level0, bool implicit, + static bool parse_directoryName(chunk_t blob, int level, bool implicit, + identification_t **name) + { +- identification_t *directoryName; +- enumerator_t *enumerator; +- bool first = TRUE; + linked_list_t *list; + + list = linked_list_create(); + if (!x509_parse_generalNames(blob, level, implicit, list)) + { +- list->destroy(list); ++ list->destroy_offset(list, offsetof(identification_t, destroy)); + return FALSE; + } +- +- enumerator = list->create_enumerator(list); +- while (enumerator->enumerate(enumerator, &directoryName)) +- { +- if (first) +- { +- *name = directoryName; +- first = FALSE; +- } +- else +- { +- DBG1(DBG_ASN, "more than one directory name - first selected"); +- directoryName->destroy(directoryName); +- break; +- } +- } +- enumerator->destroy(enumerator); +- list->destroy(list); +- +- if (first) ++ if (list->remove_first(list, (void**)name) != SUCCESS) + { + DBG1(DBG_ASN, "no directoryName found"); ++ list->destroy(list); + return FALSE; + } ++ if (list->get_count(list)) ++ { ++ DBG1(DBG_ASN, "more than one directory name - first selected"); ++ } ++ list->destroy_offset(list, offsetof(identification_t, destroy)); + return TRUE; + } + +@@ -539,6 +523,7 @@ static bool parse_certificate(private_x509_ac_t *this) + DBG2(DBG_ASN, " need to parse crlDistributionPoints"); + break; + case OID_AUTHORITY_KEY_ID: ++ chunk_free(&this->authKeyIdentifier); + this->authKeyIdentifier = + x509_parse_authorityKeyIdentifier(object, + level, &this->authKeySerialNumber); diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index bd3191d35d..af687f5e4d 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -15,6 +15,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78127.patch \ file://CVE-2026-78129.patch \ file://CVE-2026-78133.patch \ + file://CVE-2026-78131.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Thu Oct 15 05:41:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100865 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38CA2CC6B2F for ; Thu, 15 Oct 2026 05:45:20 +0000 (UTC) Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32863.1792043118856043427 for ; Wed, 14 Oct 2026 22:45:18 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Wm6Qhv2R; spf=pass (domain: gmail.com, ip: 209.85.214.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2e934449bb0so12233305ad.0 for ; Wed, 14 Oct 2026 22:45:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043118; x=1792647918; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=q3bjbu3SYHQnOKZUSQVvueM5tc9yw5nav+41CQmL1xA=; b=Wm6Qhv2R2oKGFWZIUfB5LOFqT/uNLvDUkSwIlNl1/qjDoxDZvpCH3+7pCVRZ46+5Nc o7a86GpKHmol/kE35aJn9Dl0e2A8UAtSX12wp90/LyESrT9fYbNKeRJsTFlOAGr1G3Kt Tf8erqDQi9DoA5ok6XM18iHdke7PLDg7P3QlvrFy/jeKJ5zGkrKxUyswTYPsdBrX/mGX 3ZJWXuksszQ1/44wsVqe+kNEaukIrozVqARBXVTNqiGfkYm3QUrtOddeCXfxCDeilFcd hh0rKBTIZ13LTeBvoW/UjY0ah7q/+8BvzOYoUBMzmPpKyQYEJAn5+uK7DzhqaXu9XNhz E1nA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043118; x=1792647918; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=q3bjbu3SYHQnOKZUSQVvueM5tc9yw5nav+41CQmL1xA=; b=rCPpkUN9edW7DJhSfTUDXVaSug+NxYXqDPpsaU+44DOhW4VBJ62eTNtwrGx0Hu/59h 0HvWEEESjkMBW7POzjvfcDfnYYtxZBYW7pmLzqKVtyJXcInPZtyYSYySvC7CzMdIz0nI Y3KM0fgE6qtredDoV+b92fS3RX5sYXQDYwqo2WLwzDj/ae/rWZLTxCKm203FgLZ2sOPz xORxfsV+CUNKJ5RdacCLcL/YzA5Jd0kjphjVW/QLC3Jv3UlY0coxIfjNWl/BiS+hh2BC vmNexcBsbH6K7Zsyn09Qd3qE925o9GoFV3680Oiu4Mz+LHhMKGb4sXmSA+Uzb9j3Og3W B7qQ== X-Gm-Message-State: AFq9FYJkm9X03/Fn7AnCNjfagyIIAZKDXqTW0/tnG6LwU0nYXI6qM8bG hIAhNp0vzyeH4ptjnTnGFKXZCe4F3iG3y3lOyt3sxZBdyCBPbepNUKxoR4TNrQ== X-Gm-Gg: AYBFou3Fj2faYLTVDjBEUsgTZJj0EzfVH7w2mPDCyvUHTpnY6mYgx0cCqYH0+ww9UKX md6ag7xX3RzM0gYjANdlohLlea0sRI7k1WyvytVMtQ1+4az6aH0ItsiRXdxAHUBpu7HwdSm6zmz hlU5kEUxW4eUSQFRdrseuJkB9NGy5Af8Qu/MogSMqGvfRWkPdQEhlOZj6Ej+BxMTFw4IefGTA/2 K8GBEEyHMYSooZxPUWFQxCdGyfCkMM2c+VxsTBPsKzCzZ50yabRWUSJ58H92hq+YZLtGshnd07q sCDwNMJrqzoTjgi8YpsxFTxGjSThmbm3acnEBjJzS5vegK1fGSaEuzW6SJo64DtMcN+NmHbMXbV dWVZTSHLFkQtWds1f+gxyFYqUVbr7eY6qOm3MybptPg1c6zYTtI6xk4pDGGvMy7X+HBDlBa2Oyw jAErUn4wqbvlQPNTiXvUUrJzYpZxaV357godj12TrxYSoBxYURg7R8sRN7pv8WBRKo2byy48j/Y oowje26aeO6mA5ERBveM2OMjlO1C71RiQ== X-Received: by 2002:a17:902:d50a:b0:2e3:1bb4:610d with SMTP id d9443c01a7336-2e842f31562mr157143835ad.50.1792043117565; Wed, 14 Oct 2026 22:45:17 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:16 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 69/82] strongswan: patch CVE-2026-78130 Date: Thu, 15 Oct 2026 18:41:57 +1300 Message-ID: <359b6fb06745cc3e4e87f248d3e45c7398bf1078.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130989 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78130 [1]https://download.strongswan.org/security/CVE-2026-78130/strongswan-5.1.3-6.0.7_x509_ac_issuer_null.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78130).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit d831ff4ac956483745e6df0fe9a4f6fe055440f8) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78130.patch | 49 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 50 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch new file mode 100644 index 0000000000..8fe5c7f278 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch @@ -0,0 +1,49 @@ +From 254d971bbe7479fe5fffc34cd1dd1e349a48e7aa Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Fri, 19 Jun 2026 11:57:48 +0200 +Subject: [PATCH] x509: Avoid NULL-pointer dereference if issuerName is missing + in attribute certificate + +If neither authoritiyKeyIdentifier nor issuerName are encoded in an +attribute certificate, the validation in `acert_validator.c:verify()` +will cause a NULL-pointer dereference via `issued_by()` (the lookup +with NULL identity will enumerate all trusted certificates). + +Fixes: 26930a8c3e42 ("certificate factory can load certs from file") +Fixes: CVE-2026-78130 + +CVE: CVE-2026-78130 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/bee6ce27761e1f38958be36ebe6688ef963c3d22] + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/plugins/x509/x509_ac.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c +index 68b7cf9..11a847e 100644 +--- a/src/libstrongswan/plugins/x509/x509_ac.c ++++ b/src/libstrongswan/plugins/x509/x509_ac.c +@@ -898,7 +898,11 @@ METHOD(certificate_t, has_issuer, id_match_t, + { + return ID_MATCH_PERFECT; + } +- return this->issuerName->matches(this->issuerName, issuer); ++ if (this->issuerName) ++ { ++ return this->issuerName->matches(this->issuerName, issuer); ++ } ++ return ID_MATCH_NONE; + } + + METHOD(certificate_t, issued_by, bool, +@@ -935,7 +939,8 @@ METHOD(certificate_t, issued_by, bool, + } + else + { +- if (!this->issuerName->equals(this->issuerName, ++ if (!this->issuerName || ++ !this->issuerName->equals(this->issuerName, + issuer->get_subject(issuer))) + { + return FALSE; diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index af687f5e4d..4f6a5d2ae7 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -16,6 +16,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78129.patch \ file://CVE-2026-78133.patch \ file://CVE-2026-78131.patch \ + file://CVE-2026-78130.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Thu Oct 15 05:41:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100868 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67856CC6B2F for ; Thu, 15 Oct 2026 05:45:30 +0000 (UTC) Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33276.1792043120357690579 for ; Wed, 14 Oct 2026 22:45:20 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=ASgLfbNv; spf=pass (domain: gmail.com, ip: 209.85.214.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2dd1dcdcf95so25873125ad.1 for ; Wed, 14 Oct 2026 22:45:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043120; x=1792647920; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=MzhOadSLXEjkCZQf8kF0CiKxu747zV1HS66bc/YW6YM=; b=ASgLfbNvrDiem3tc7yzIonF9xNVCaSr63FZ4EJuXNam9/9rs9Ddj/n8JSR4nuP93K6 DYFo7BR281IRcDhv2Uz+wNf5SaKW5QHCDYwWvTAaPiWteP4wpwoVBYUWEBrpSIB5R96u +2aawg1wpeBZzhbSx39qR8lbhif+nFD3ziKjg8i6e7e2u5l3hiSM0Ffd+21QG3tLixSg 34zY3KzmYptgqneUaU2K5wWEOFmKhT0xfcBgj8ZwvWmRdIsh8i9lwv0ISpERBNJHyjzu lEtClkIHzWOQCzxPvbgelISUabMFXaI1cd+DLn8GbmQ+qrUF7ZtKiRmnGC9bON6MsH5m E5TA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043120; x=1792647920; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=MzhOadSLXEjkCZQf8kF0CiKxu747zV1HS66bc/YW6YM=; b=1pkgZDUwXE4L0NU/C6DW7QstTERWuT31S7JXjMrIK7UY2qjCYC7vg1fvfPVkgG9GUs FQB37O4LWGi7kBmcuqwQVKbBUov1wUgCB8WcYeOOtcOxm2IbP+WI9do3wuoaDYqyyvZ0 Ekm+/96Xmt9u/pq0GkOD/bLX3L+DyWB/TEozP+NQ0Mj+khxjEcYlhtLGQy0F2sJbPlZo aLNm631TT1qDRq9LJwFeCBTegtutTGq3qprYj0z6JFe0VRXtrtGpWsDoTkEc2Vf6yFj1 VFJnl6Vz/64fcbpzDxRQKwWbWMsrPVeVNnDSVSRQVWEMDFhW9w8Wqoo3N96ruwt6keug N+lg== X-Gm-Message-State: AFq9FYJ7DeX+QuIw14Li/18QTf4Dr6vDF+1R3inIUgpXDOKmovkejZWe LMyzsyNB0sGtnUs/57bzfx+ON3v2s3IzoovDeiSl5ACjj6gtuEGMiA+lz00bZQ== X-Gm-Gg: AYBFou3DvD5NvOucpxL8ymdcw36xKiiTle1hc6YE8EMDl+ljE0thTn/TUxWXGWAq40d FYSYP2WGP9XIXqBANHR0q4ltZuLfSmfm1/J+A+CYXWhNsZ67CxXlUmSuwxfiHejIHlkiYem41/L XtqY0/quSknfUJNTE8GuyGSDQsPTsy0XZl5zTV9CEzWlNbgro1iJrT2M7B5045iSmMcfU+gyMDu 2+AgvniyhF/1iAx9nKr+4mf2LtKBrJU74jWR+Gy6pzdpcox9IXEiWKmW8uqTNy0KeTXqSp0BrLR LGMql9GfqcPKnr1D1g9NXJe7Fd0V78vS+EcgkjTJiFp9lveSYNeNtuEYqsmWreVWpnATucnFNDT xOoCDu5Quhg5J8slZrImUlZdtjFh8uqr99J6jZaFldctHRWeQWjRcpvlwhuy/FrceL2sSDoYa2W K/Lplr9P2yav3FTTMlHEWm7lYy32LBw89A8oxjBn5R3s0YSVCN0ltUH60D74Txluvv7vb74SduD SfAVPTMgpzLOBmajqyP3hI= X-Received: by 2002:a17:903:324d:b0:2df:a0d4:71de with SMTP id d9443c01a7336-2e842710e5amr108689665ad.0.1792043119649; Wed, 14 Oct 2026 22:45:19 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.18 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:19 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 70/82] strongswan: patch CVE-2026-78132 Date: Thu, 15 Oct 2026 18:41:58 +1300 Message-ID: <2afc7f40c8bcb6fecd5e0ab185ec4c3825b13bba.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130990 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78132 [1]https://download.strongswan.org/security/CVE-2026-78132/strongswan-5.1.3-6.0.7_x509_ac_ietfattr_loop.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78132).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit dd3053a1a3806a37d1297e726d3eababfb539f8e) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78132.patch | 75 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 76 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch new file mode 100644 index 0000000000..f3ddd5b61a --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch @@ -0,0 +1,75 @@ +From d8144c609148eda1ca55eac2ecddcd81bbd799b5 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Wed, 1 Jul 2026 16:24:23 +0200 +Subject: [PATCH] x509: Prevent infinite loop when parsing ietfAttrSyntax in + attribute certificates + +This is the same issue that was fixed with 407fcca200fd ("asn1-parser: +Fix CHOICE parsing") for other CHOICE elements. This one was missed and +can be triggered pre-auth by sending an attribute certificate to a peer. +Since it's parsed before verifying it, the certificate doesn't have to +be valid. + +For versions older than 5.5.3, this patch requires prior application of +the fix for CVE-2017-9023, which introduced proper CHOICE handling in +the ASN.1 parser. + +Fixes: a17598bc6992 ("x509: Integrate IETF attribute handling, and obsolete ietf_attributes_t") +Fixes: CVE-2026-78132 + +CVE: CVE-2026-78132 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/86bf2cbf5d9941b7ef16a1b25f0baf5589e0b64e] + +Signed-off-by: Ankur Tyagi +--- + src/libstrongswan/plugins/x509/x509_ac.c | 36 +++++++++++------------- + 1 file changed, 17 insertions(+), 19 deletions(-) + +diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c +index 11a847e..46c1f58 100644 +--- a/src/libstrongswan/plugins/x509/x509_ac.c ++++ b/src/libstrongswan/plugins/x509/x509_ac.c +@@ -249,26 +249,24 @@ static void parse_roleSyntax(chunk_t blob, int level0) + */ + static const asn1Object_t ietfAttrSyntaxObjects[] = + { +- { 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */ +- { 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT | +- ASN1_BODY }, /* 1 */ +- { 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */ +- { 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */ +- { 2, "octets", ASN1_OCTET_STRING, ASN1_OPT | +- ASN1_BODY }, /* 4 */ +- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 5 */ +- { 2, "oid", ASN1_OID, ASN1_OPT | +- ASN1_BODY }, /* 6 */ +- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 7 */ +- { 2, "string", ASN1_UTF8STRING, ASN1_OPT | +- ASN1_BODY }, /* 8 */ +- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 9 */ +- { 1, "end loop", ASN1_EOC, ASN1_END }, /* 10 */ +- { 0, "exit", ASN1_EOC, ASN1_EXIT } ++ { 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */ ++ { 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT|ASN1_BODY }, /* 1 */ ++ { 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */ ++ { 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */ ++ { 2, "value choice", ASN1_EOC, ASN1_CHOICE }, /* 4 */ ++ { 3, "octets", ASN1_OCTET_STRING, ASN1_OPT|ASN1_BODY }, /* 5 */ ++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 6 */ ++ { 3, "oid", ASN1_OID, ASN1_OPT|ASN1_BODY }, /* 7 */ ++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 8 */ ++ { 3, "string", ASN1_UTF8STRING, ASN1_OPT|ASN1_BODY }, /* 9 */ ++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 10 */ ++ { 2, "end choices", ASN1_EOC, ASN1_END|ASN1_CHOICE }, /* 11 */ ++ { 1, "end loop", ASN1_EOC, ASN1_END }, /* 12 */ ++ { 0, "exit", ASN1_EOC, ASN1_EXIT } + }; +-#define IETF_ATTR_OCTETS 4 +-#define IETF_ATTR_OID 6 +-#define IETF_ATTR_STRING 8 ++#define IETF_ATTR_OCTETS 5 ++#define IETF_ATTR_OID 7 ++#define IETF_ATTR_STRING 9 + + /** + * Parse group memberships, IETF attributes diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index 4f6a5d2ae7..b070ecf862 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -17,6 +17,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78133.patch \ file://CVE-2026-78131.patch \ file://CVE-2026-78130.patch \ + file://CVE-2026-78132.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Thu Oct 15 05:41:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100870 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C012CC6B3A for ; Thu, 15 Oct 2026 05:45:30 +0000 (UTC) Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32865.1792043122760457089 for ; Wed, 14 Oct 2026 22:45:22 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=aINAlmW3; spf=pass (domain: gmail.com, ip: 209.85.214.182, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2d6e954afbdso8093705ad.2 for ; Wed, 14 Oct 2026 22:45:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043122; x=1792647922; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=YzDN2WXDjx/KHUzHrIsOFlDnmDHdBZPoZDvkvHLMd3o=; b=aINAlmW3h3Xqzh3UV46//hmZ+faERx8Bd/bZw03HjgUOo1T+4Zeecz3fSmWj+Y+o8L j8ZrM7Xh0cJBL9Blu15dtvwbPh2WoTkZfsSHQKomOwl3xr9PvHQJXyTRQ0cDfQCFeFvj oJCHrdKprMo6/hclWXBV7IKyhHfZ3T6HjrsDSqCRWzKxGElY4pAmoPlzSPTa/vJIx+mP /lD49DAnCA52aMzSw0HQC+XLYoC54m+0ztQl69W0+A/wIIYJ+DiYbUe6p4m7Z48Umk8V OEpsSXpF8BPK9xF0E0g8wqmrMfrPPc5WsEK3IKBcfqgQzBrFLn8Z6UMn83ppLYjyuzBq /EQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043122; x=1792647922; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=YzDN2WXDjx/KHUzHrIsOFlDnmDHdBZPoZDvkvHLMd3o=; b=j/ucooSa0d+3HbdhqW+hc3ZSN1aXjR7Myrao3rU+yYmuO+ju+1SG+35XPVYwk6DuOb Zx99tjnY+36OZ+UX0zvhBhu1XqkcE07ArYAWifltBF98oXmN5wzrDn8IISfrQmXHyYc8 VAeu+wQTG74PzZJIDEmQjYhGjVcLWT4bpAF0gAnVRhoiAGzax4+Ia6rSX1CGLJbjGYJY s8AS7BDm+Lid8gDmFmQL9oIyJSJaiCCcWv/ouovKZ4rlHIC8Q30tPHitrZ9gsWUZ+QbY 4+VMF51zgoiaf8QDEcR/rYYZ3WNCYoku83fEjqeHSOfN/k6yukxGaJCbjyG9XvXuKJD6 Tr/Q== X-Gm-Message-State: AFq9FYKDHgl+FIGwr2o7j8DENJjzVwy6/BPU8HDpxiSHonZnaB8bUUk+ euVBP6TAE7RY4fTPMlh7DrfVyU/4lnXqiUp3FKkhaJ+MURCf7d3agq95uHk+Og== X-Gm-Gg: AYBFou0yjoKvAKht3F9aHiS3ePD3gUCwRR6rjF/v6HcqSLWP+UkOb9oowGwMx2bPaE+ MR351xLSOps9JMUn/1Qwy4GBOmtUkQb+dRdO3XaLREIgJ4ZVHFa1DsH7M+KQ7uYVwMv2r2aTmsv PdJa9pmhhswYpSsWp6MVRIsivRaNqwh5wXWSg0We3jIcW3sZ0sp8uz3h7i5PYBN3SZur2JqhTgH LCo5TLbjWu0HvVYw5jh8/i4rh3d06Dck3nbF05jCGgvEB8Vywdny8MpQdsDvoyL+/4GV1wLizXL r2un27z1TiLmVT2aeTeXWixps8K/J5DUKnqy5ohQeJxX/2L/DPX5x6auV1dF1fdBVI1+zxydhT4 +d5O02yPdlIk4IMXRR2UJJJl9cJlCPhut9u1jYYrH/ipWhJ/5yorSJDuQdd8Uq4MzaZjVGjCZBE nl+1r0Oi5Fowx9KSifb2QvAak3TtQBsJiTNcdKv2VjunouaInBQWW06yWWEIOIggqUUOYCfqLFo S4bASh0JQiXNdq4ZD6Ms+gVNg== X-Received: by 2002:a17:903:3243:b0:2dd:ad74:ac32 with SMTP id d9443c01a7336-2e842bc61a1mr157370745ad.27.1792043122052; Wed, 14 Oct 2026 22:45:22 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:21 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 71/82] strongswan: patch CVE-2026-78135 Date: Thu, 15 Oct 2026 18:41:59 +1300 Message-ID: <991006d982c557ef61f4a3f49c61d94671b1bc4d.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130991 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78135 [1]https://download.strongswan.org/security/CVE-2026-78135/strongswan-5.9.7-6.0.7_early_create_child_sa.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78135).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 9b02fe48505f14e351e473e246d971d64eb84ad0) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78135.patch | 72 +++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 73 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch new file mode 100644 index 0000000000..1b6c472b30 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch @@ -0,0 +1,72 @@ +From 2c3d63bd7a05f88d25354dfe7805a5a6e474a699 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 27 Jul 2026 08:53:50 +0200 +Subject: [PATCH] ikev2: Properly reject CREATE_CHILD_SA requests on + unestablished IKE_SAs + +The previous check was not actually enforced as long as there were still +tasks in the passive queue (it was originally added to fix an issue on +initiators, so the passive queue was expected to be empty). This allowed +an unauthenticated attacker to potentially establish a usable Child SA +if certain preconditions were met. + +First, it required that the initiator is authenticated with EAP so the +authentication and the creation of the first Child SA is deferred. +Second, the responder must either not configure an IP address pool or +an explicit remote TS, otherwise, traffic selector negotiation fails. + +Note that the half-open IKE SA and the installed IPsec SA will be removed +after the default timeout of 30 seconds. + +Fixes: 8503077175cd ("ikev2: Reject CREATE_CHILD_SA exchange on unestablished IKE_SAs") +Fixes: c60c7694d2d8 ("merged tasking branch into trunk") +Fixes: CVE-2026-78135 + +CVE: CVE-2026-78135 +Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/4dcb132266a954202509a3b4b3be99378f3e3b4d] + +Signed-off-by: Ankur Tyagi +--- + src/libcharon/sa/ikev2/task_manager_v2.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c +index 5a19ce8..f9e9ab9 100644 +--- a/src/libcharon/sa/ikev2/task_manager_v2.c ++++ b/src/libcharon/sa/ikev2/task_manager_v2.c +@@ -1134,9 +1134,18 @@ static status_t process_request(private_task_manager_t *this, + delete_payload_t *delete; + ike_sa_state_t state; + ++ state = this->ike_sa->get_state(this->ike_sa); ++ if (message->get_exchange_type(message) == CREATE_CHILD_SA && ++ (state == IKE_CREATED || state == IKE_CONNECTING)) ++ { ++ DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " ++ "unestablished IKE_SA, rejected"); ++ return FAILED; ++ } ++ ++ /* create tasks depending on request type, if not already some queued */ + if (array_count(this->passive_tasks) == 0) +- { /* create tasks depending on request type, if not already some queued */ +- state = this->ike_sa->get_state(this->ike_sa); ++ { + switch (message->get_exchange_type(message)) + { + case IKE_SA_INIT: +@@ -1177,14 +1186,6 @@ static status_t process_request(private_task_manager_t *this, + { /* FIXME: we should prevent this on mediation connections */ + bool notify_found = FALSE, ts_found = FALSE; + +- if (state == IKE_CREATED || +- state == IKE_CONNECTING) +- { +- DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " +- "unestablished IKE_SA, rejected"); +- return FAILED; +- } +- + enumerator = message->create_payload_enumerator(message); + while (enumerator->enumerate(enumerator, &payload)) + { diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index b070ecf862..df0333b458 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -18,6 +18,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78131.patch \ file://CVE-2026-78130.patch \ file://CVE-2026-78132.patch \ + file://CVE-2026-78135.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Thu Oct 15 05:42:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100872 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90159CC6B39 for ; Thu, 15 Oct 2026 05:45:30 +0000 (UTC) Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33277.1792043125310348456 for ; Wed, 14 Oct 2026 22:45:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=JAz+jZp/; spf=pass (domain: gmail.com, ip: 209.85.214.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2e934449bb0so12233835ad.0 for ; Wed, 14 Oct 2026 22:45:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043125; x=1792647925; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=lDzfUb7EUQSzzFg19JafujucagwpaQT3G62qx3at3mU=; b=JAz+jZp/G4sluSRy7ub44T0gaMYoqz/9A2E6m9iCoPdXiJKNj2c6xz6DL4P4v4WQnS +IXhj+D+TpYYkLuYBkpQBri9EYKO4iTLSIAsc6KNkuEPsef3HRQ+GeROBxHtOmWQHMaz +uqKOBOEtAEDgx4XN3raiLnMZW/lNSOBJWzBVrNSMyi3mfv/gAMcQ32ixlb+my26DUY1 OuyZAe/TPcjdgykiM5HFdKxS3gdwUT8o/g3jJ270+D2xIbB6wEDeROHkcLh5ooXJnBhh EqXQGD+6sXKytjMmBzcxin2JVDxm0e8PAv6WPIjQjoDEkKSYDuL/kPurynZYU/eCOaVl 4I/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043125; x=1792647925; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=lDzfUb7EUQSzzFg19JafujucagwpaQT3G62qx3at3mU=; b=b/LbhdZMpVaLSHkk4WoWnEKxil+jeuh2c8jeE6gdnkGUrf8u/1VuI/IwG7SJF1K0Gz oeo4vCQs/YZrHB+Aqq++H25EI7GfUDKyICGwhk+CwuBSnH1ZQxUxQjgZkK516N4wPLm7 tKDTRadWb2PVm9CCjgt3Cu95jYIVkwD0iVlz9c8Lk3XSq98lxB7hR6egvEG2h0em9che gd1pZGExeQ6VTS/z8b6568Dic0RBbkCj0DapVDNpunYsiNd9kI1AWyHz2/L1X1jlQW+B 6zXb+0xkxguXcHp071cJ2gUOSNeJfz1ILxnlXiKbsig/rQ6e8ROZ0IPj2IY7fiATEyp7 PpeA== X-Gm-Message-State: AFq9FYJ8MpzPanILQ+na0xGFW/EOE4+po/p6rptMWTXwbRBaqzhHLtZr kQcmODo+C+eqjckB9GqAfEpwT94tJnQRa0HuivdWNkMpoPsNd7ziK8yusFoL4A== X-Gm-Gg: AYBFou1KvZSM50ofujeL9g4lqkex8MgGfztLe81C+MKVsicsQUOZtHWcIkG9wWk8And 5s+HgfhxSMd7KDwmo3bLKrWk7nl+oaZL6w426d/+cGVVPIGr/1TGc2dw7p87mI7rMPy4gVUhRNC GQIGsGgAfQ/00akTibX4MfwWCkwJ2oDz3WcsvaXpBD+wOAQC0TYipWXWxM4SZS1s7ZFw6RBIeLp nDhAVXGdFRMAZQTOWePcaIq4Ynj9OYikWE1S3l1ICbqmTzgBMo1KCHqLeDvsjDKbTaZiaQVOSpo +/EFA/inlSeCbXwrtfcvf+9M38MSkkWzXx+F9naLEU2kPJhGuzVH88shdNU+/5Gqv7psjtPcA1B yhRp5XBUnXMycq0iMeDoJYlLUYrdQSYNo3m+lzRGp1DNBGaVBRZkavXveE/rvP0qo9hF7SfwU3i BvF1PPDJ1NvjNXserZxKgbBfBTY7su6nTbtr6QvoulmFN7PYJ9g0mbcD/TvU8rrA4sa8fg0QZ2L 4aJ56MT5kyrd2NwwDCL+a4= X-Received: by 2002:a17:903:b84:b0:2e9:6788:9379 with SMTP id d9443c01a7336-2e967889672mr1296165ad.32.1792043124382; Wed, 14 Oct 2026 22:45:24 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.22 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:23 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 72/82] strongswan: patch CVE-2026-78134 Date: Thu, 15 Oct 2026 18:42:00 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130992 From: Ankur Tyagi Use patch[1] provided by strongSwan[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-78134 [1]https://download.strongswan.org/security/CVE-2026-78134/strongswan-5.9.10-6.0.7_eap_inner_auth_cfg.patch [2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78134).html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 2352f801006e75c74ac8892d88a38d4a2e3d2f32) Signed-off-by: Ankur Tyagi --- .../strongswan/CVE-2026-78134.patch | 712 ++++++++++++++++++ .../strongswan/strongswan_6.0.7.bb | 1 + 2 files changed, 713 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch new file mode 100644 index 0000000000..86646e5e96 --- /dev/null +++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch @@ -0,0 +1,712 @@ +From d95e9d363b0e23d0ba3080bb518695e05a453748 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Mon, 27 Jul 2026 15:05:45 +0200 +Subject: [PATCH] eap-ttls/peap: Return auth-cfg with details on TLS and inner + EAP method + +This fixes several issues with binding identities to the IKE SA. + +If the client is authenticated with a certificate, the previous code still +used the client's proclaimed inner EAP-Identity when starting the EAP-TNC +method. So that method would potentially operate on an unverified +identity. + +Second, if the inner EAP method overrides the client identity (the only +one is currently EAP-MSCHAPV2), the missing merge meant that the outer +IKE/EAP identity could potentially be unconfirmed. + +For inner methods that don't override the identity (e.g. EAP-MD5), not +propagating the inner EAP-Identity could potentially have the same +effect. + +While the EAP-TTLS implementation returned the auth-cfg of the TLS +exchange since the first referenced commit, this was mainly intended to +enforce public key constraints. So it didn't cover the phase 2 EAP +methods. For some reason EAP-PEAP did not get that method at all in that +changeset, so we'll add that now. + +Additionally, the EAP-PEAP implementation now forwards the phase 2 EAP +method type to EAP-TNC like the EAP-TTLS implementation already did, +which allows a more informed decision on the client's identity. + +Fixes: 0864a31d13ff ("eap-ttls: Support EAP auth information getter in EAP-TTLS") +Fixes: 79f2102cb442 ("implemented server side support for EAP-TTLS") +Fixes: 2a421163bf4f ("make TNC client authentication type available to IMVs") +Fixes: 1be296dfb2af ("implemented the PEAP tunneling protocol as an EAP plugin") +Fixes: CVE-2026-78134 + +CVE: CVE-2026-78134 +Upstream-Status: Backport [1][2] + +[1]https://github.com/strongswan/strongswan/commit/e059077d3f3e307e78be7f91e5648aa5f94916a8 +[2]https://github.com/strongswan/strongswan/commit/6a7210731f6dd2889d22bf20310ab0ed7274d0d8 + +Signed-off-by: Ankur Tyagi +--- + src/libcharon/plugins/eap_peap/eap_peap.c | 49 ++++++++++- + .../plugins/eap_peap/eap_peap_peer.c | 20 +++++ + .../plugins/eap_peap/eap_peap_peer.h | 7 ++ + .../plugins/eap_peap/eap_peap_server.c | 81 ++++++++++++++++--- + .../plugins/eap_peap/eap_peap_server.h | 7 ++ + src/libcharon/plugins/eap_ttls/eap_ttls.c | 43 +++++++++- + .../plugins/eap_ttls/eap_ttls_peer.c | 19 +++++ + .../plugins/eap_ttls/eap_ttls_peer.h | 7 ++ + .../plugins/eap_ttls/eap_ttls_server.c | 56 +++++++++++-- + .../plugins/eap_ttls/eap_ttls_server.h | 7 ++ + 10 files changed, 278 insertions(+), 18 deletions(-) + +diff --git a/src/libcharon/plugins/eap_peap/eap_peap.c b/src/libcharon/plugins/eap_peap/eap_peap.c +index 3573cba..cd942f1 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap.c ++++ b/src/libcharon/plugins/eap_peap/eap_peap.c +@@ -40,6 +40,25 @@ struct private_eap_peap_t { + * TLS stack, wrapped by EAP helper + */ + tls_eap_t *tls_eap; ++ ++ /** ++ * Role ++ */ ++ bool is_server; ++ ++ /** ++ * Actual server/client implementation ++ */ ++ union { ++ tls_application_t *application; ++ eap_peap_server_t *server; ++ eap_peap_peer_t *client; ++ } impl; ++ ++ /** ++ * Cached auth data for TLS and inner EAP methods ++ */ ++ auth_cfg_t *auth; + }; + + /** Maximum number of EAP-PEAP messages/fragments allowed */ +@@ -113,10 +132,34 @@ METHOD(eap_method_t, is_mutual, bool, + return TRUE; + } + ++METHOD(eap_method_t, get_auth, auth_cfg_t*, ++ private_eap_peap_t *this) ++{ ++ if (!this->auth) ++ { ++ auth_cfg_t *inner; ++ ++ this->auth = auth_cfg_create(); ++ this->auth->merge(this->auth, ++ this->tls_eap->get_auth(this->tls_eap), FALSE); ++ if (this->is_server) ++ { ++ inner = this->impl.server->get_auth(this->impl.server); ++ } ++ else ++ { ++ inner = this->impl.client->get_auth(this->impl.client); ++ } ++ this->auth->merge(this->auth, inner, FALSE); ++ } ++ return this->auth; ++} ++ + METHOD(eap_method_t, destroy, void, + private_eap_peap_t *this) + { + this->tls_eap->destroy(this->tls_eap); ++ DESTROY_IF(this->auth); + free(this); + } + +@@ -135,6 +178,7 @@ static private_eap_peap_t *eap_peap_create_empty(void) + .get_type = _get_type, + .is_mutual = _is_mutual, + .get_msk = _get_msk, ++ .get_auth = _get_auth, + .get_identifier = _get_identifier, + .set_identifier = _set_identifier, + .destroy = _destroy, +@@ -147,7 +191,7 @@ static private_eap_peap_t *eap_peap_create_empty(void) + /** + * Generic private constructor + */ +-static eap_peap_t *eap_peap_create(private_eap_peap_t * this, ++static eap_peap_t *eap_peap_create(private_eap_peap_t *this, + identification_t *server, + identification_t *peer, bool is_server, + tls_application_t *application) +@@ -157,6 +201,9 @@ static eap_peap_t *eap_peap_create(private_eap_peap_t * this, + bool include_length; + tls_t *tls; + ++ this->is_server = is_server; ++ this->impl.application = application; ++ + if (is_server && !lib->settings->get_bool(lib->settings, + "%s.plugins.eap-peap.request_peer_auth", FALSE, + lib->ns)) +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_peer.c b/src/libcharon/plugins/eap_peap/eap_peap_peer.c +index 95213a3..f6c087a 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_peer.c ++++ b/src/libcharon/plugins/eap_peap/eap_peap_peer.c +@@ -52,6 +52,11 @@ struct private_eap_peap_peer_t { + */ + eap_method_t *ph2_method; + ++ /** ++ * Auth data for phase 2 methods ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -166,6 +171,12 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->ph2_method->get_auth) ++ { ++ this->auth->merge(this->auth, ++ this->ph2_method->get_auth(this->ph2_method), ++ FALSE); ++ } + this->ph2_method->destroy(this->ph2_method); + this->ph2_method = NULL; + /* fall through to NEED_MORE */ +@@ -220,11 +231,18 @@ METHOD(tls_application_t, build, status_t, + return INVALID_STATE; + } + ++METHOD(eap_peap_peer_t, get_auth, auth_cfg_t*, ++ private_eap_peap_peer_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_peap_peer_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->ph2_method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -247,10 +265,12 @@ eap_peap_peer_t *eap_peap_peer_create(identification_t *server, + .build = _build, + .destroy = _destroy, + }, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), + .peer = peer->clone(peer), + .ph1_method = eap_method, ++ .auth = auth_cfg_create(), + .avp = eap_peap_avp_create(FALSE), + ); + +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_peer.h b/src/libcharon/plugins/eap_peap/eap_peap_peer.h +index 53c25cd..7d16957 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_peer.h ++++ b/src/libcharon/plugins/eap_peap/eap_peap_peer.h +@@ -38,6 +38,13 @@ struct eap_peap_peer_t { + * Implements the TLS application data handler. + */ + tls_application_t application; ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_peap_peer_t *this); + }; + + /** +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.c b/src/libcharon/plugins/eap_peap/eap_peap_server.c +index 29ab9b4..388c3c6 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_server.c ++++ b/src/libcharon/plugins/eap_peap/eap_peap_server.c +@@ -20,6 +20,8 @@ + #include + #include + ++#include ++ + typedef struct private_eap_peap_server_t private_eap_peap_server_t; + + /** +@@ -77,6 +79,16 @@ struct private_eap_peap_server_t { + */ + eap_method_t *ph2_method; + ++ /** ++ * Type of the completed phase 2 EAP method ++ */ ++ eap_type_t phase2_type; ++ ++ /** ++ * Auth data for phase 2 method ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -132,8 +144,11 @@ static status_t start_phase2_auth(private_eap_peap_server_t *this) + /** + * If configured, start EAP-TNC protocol + */ +-static status_t start_phase2_tnc(private_eap_peap_server_t *this) ++static status_t start_phase2_tnc(private_eap_peap_server_t *this, ++ eap_type_t auth_type) + { ++ eap_inner_method_t *inner_method; ++ + if (this->start_phase2_tnc && lib->settings->get_bool(lib->settings, + "%s.plugins.eap-peap.phase2_tnc", FALSE, lib->ns)) + { +@@ -145,6 +160,8 @@ static status_t start_phase2_tnc(private_eap_peap_server_t *this) + DBG1(DBG_IKE, "%N method not available", eap_type_names, EAP_TNC); + return FAILED; + } ++ inner_method = (eap_inner_method_t *)this->ph2_method; ++ inner_method->set_auth_type(inner_method, auth_type); + this->start_phase2_tnc = FALSE; + + /* synchronize EAP message identifiers of inner protocol with outer */ +@@ -218,9 +235,13 @@ METHOD(tls_application_t, process, status_t, + DBG1(DBG_IKE, "received tunneled EAP-PEAP AVP [EAP/%N]", + eap_code_short_names, code); + in->destroy(in); +- /* if EAP_SUCCESS check if to continue phase2 with EAP-TNC */ +- return (this->phase2_result == EAP_SUCCESS && code == EAP_SUCCESS) ? +- start_phase2_tnc(this) : FAILED; ++ if (this->phase2_result == EAP_SUCCESS && code == EAP_SUCCESS) ++ { ++ /* only accept SUCCESS once after a successful inner method */ ++ this->phase2_result = EAP_FAILURE; ++ return start_phase2_tnc(this, this->phase2_type); ++ } ++ return FAILED; + } + + if (this->ph2_method) +@@ -245,6 +266,10 @@ METHOD(tls_application_t, process, status_t, + if (!received_vendor && received_type == EAP_IDENTITY) + { + chunk_t eap_id; ++ bool peer_auth; ++ ++ peer_auth = lib->settings->get_bool(lib->settings, ++ "%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns); + + if (this->ph2_method == NULL) + { +@@ -271,9 +296,22 @@ METHOD(tls_application_t, process, status_t, + + if (this->ph2_method->get_msk(this->ph2_method, &eap_id) == SUCCESS) + { +- this->peer->destroy(this->peer); +- this->peer = identification_create_from_data(eap_id); +- DBG1(DBG_IKE, "received EAP identity '%Y'", this->peer); ++ identification_t *id; ++ ++ id = identification_create_from_data(eap_id); ++ if (peer_auth && !id->equals(id, this->peer)) ++ { ++ DBG1(DBG_IKE, "received tunneled EAP identity '%Y', keeping " ++ "certificate-authenticated identity '%Y'", id, this->peer); ++ id->destroy(id); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "received EAP identity '%Y'", id); ++ this->auth->add(this->auth, AUTH_RULE_EAP_IDENTITY, id); ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } + } + + in->destroy(in); +@@ -281,10 +319,9 @@ METHOD(tls_application_t, process, status_t, + this->ph2_method = NULL; + + /* Start Phase 2 of EAP-PEAP authentication */ +- if (lib->settings->get_bool(lib->settings, +- "%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns)) ++ if (peer_auth) + { +- return start_phase2_tnc(this); ++ return start_phase2_tnc(this, EAP_TLS); + } + else + { +@@ -305,11 +342,26 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->ph2_method->get_auth) ++ { ++ identification_t *id; ++ auth_cfg_t *auth; ++ ++ auth = this->ph2_method->get_auth(this->ph2_method); ++ id = auth->get(auth, AUTH_RULE_EAP_IDENTITY); ++ if (id) ++ { ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } ++ this->auth->merge(this->auth, auth, FALSE); ++ } + DBG1(DBG_IKE, "%N phase2 authentication of '%Y' with %N successful", + eap_type_names, EAP_PEAP, this->peer, + eap_type_names, type); + this->ph2_method->destroy(this->ph2_method); + this->ph2_method = NULL; ++ this->phase2_type = type; + + /* EAP-PEAP requires the sending of an inner EAP_SUCCESS message */ + this->phase2_result = EAP_SUCCESS; +@@ -407,11 +459,18 @@ METHOD(eap_peap_server_t, set_tls, void, + this->tls = tls; + } + ++METHOD(eap_peap_server_t, get_auth, auth_cfg_t*, ++ private_eap_peap_server_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_peap_server_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->ph2_method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -435,10 +494,12 @@ eap_peap_server_t *eap_peap_server_create(identification_t *server, + .destroy = _destroy, + }, + .set_tls = _set_tls, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), + .peer = peer->clone(peer), + .ph1_method = eap_method, ++ .auth = auth_cfg_create(), + .start_phase2 = TRUE, + .start_phase2_tnc = TRUE, + .start_phase2_id = lib->settings->get_bool(lib->settings, +diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.h b/src/libcharon/plugins/eap_peap/eap_peap_server.h +index 3abe88b..8080e9f 100644 +--- a/src/libcharon/plugins/eap_peap/eap_peap_server.h ++++ b/src/libcharon/plugins/eap_peap/eap_peap_server.h +@@ -47,6 +47,13 @@ struct eap_peap_server_t { + * @param tls TLS connection + */ + void (*set_tls)(eap_peap_server_t *this, tls_t *tls); ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_peap_server_t *this); + }; + + /** +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls.c b/src/libcharon/plugins/eap_ttls/eap_ttls.c +index d8ad781..3df78bb 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls.c ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls.c +@@ -40,6 +40,25 @@ struct private_eap_ttls_t { + * TLS stack, wrapped by EAP helper + */ + tls_eap_t *tls_eap; ++ ++ /** ++ * Role ++ */ ++ bool is_server; ++ ++ /** ++ * Actual server/client implementation ++ */ ++ union { ++ tls_application_t *application; ++ eap_ttls_server_t *server; ++ eap_ttls_peer_t *client; ++ } impl; ++ ++ /** ++ * Cached auth data for TLS and inner EAP methods ++ */ ++ auth_cfg_t *auth; + }; + + /** Maximum number of EAP-TTLS messages/fragments allowed */ +@@ -116,13 +135,31 @@ METHOD(eap_method_t, is_mutual, bool, + METHOD(eap_method_t, get_auth, auth_cfg_t*, + private_eap_ttls_t *this) + { +- return this->tls_eap->get_auth(this->tls_eap); ++ if (!this->auth) ++ { ++ auth_cfg_t *inner; ++ ++ this->auth = auth_cfg_create(); ++ this->auth->merge(this->auth, ++ this->tls_eap->get_auth(this->tls_eap), FALSE); ++ if (this->is_server) ++ { ++ inner = this->impl.server->get_auth(this->impl.server); ++ } ++ else ++ { ++ inner = this->impl.client->get_auth(this->impl.client); ++ } ++ this->auth->merge(this->auth, inner, FALSE); ++ } ++ return this->auth; + } + + METHOD(eap_method_t, destroy, void, + private_eap_ttls_t *this) + { + this->tls_eap->destroy(this->tls_eap); ++ DESTROY_IF(this->auth); + free(this); + } + +@@ -153,6 +190,10 @@ static eap_ttls_t *eap_ttls_create(identification_t *server, + .destroy = _destroy, + }, + }, ++ .is_server = is_server, ++ .impl = { ++ .application = application, ++ }, + ); + if (is_server && !lib->settings->get_bool(lib->settings, + "%s.plugins.eap-ttls.request_peer_auth", FALSE, +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c +index 63126a5..f8229f5 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c +@@ -54,6 +54,11 @@ struct private_eap_ttls_peer_t { + */ + eap_method_t *method; + ++ /** ++ * Auth data for phase 2 method ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -215,6 +220,11 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->method->get_auth) ++ { ++ this->auth->merge(this->auth, ++ this->method->get_auth(this->method), FALSE); ++ } + this->method->destroy(this->method); + this->method = NULL; + /* fall through to NEED_MORE */ +@@ -275,11 +285,18 @@ METHOD(tls_application_t, build, status_t, + return INVALID_STATE; + } + ++METHOD(eap_ttls_peer_t, get_auth, auth_cfg_t*, ++ private_eap_ttls_peer_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_ttls_peer_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -301,10 +318,12 @@ eap_ttls_peer_t *eap_ttls_peer_create(identification_t *server, + .build = _build, + .destroy = _destroy, + }, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), + .peer = peer->clone(peer), + .start_phase2 = TRUE, ++ .auth = auth_cfg_create(), + .avp = eap_ttls_avp_create(), + ); + +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h +index 0c3d90a..69a8435 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h +@@ -37,6 +37,13 @@ struct eap_ttls_peer_t { + * Implements the TLS application data handler. + */ + tls_application_t application; ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_ttls_peer_t *this); + }; + + /** +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c +index fc97f81..e1de1bf 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c +@@ -60,6 +60,11 @@ struct private_eap_ttls_server_t { + */ + eap_method_t *method; + ++ /** ++ * Auth data for phase 2 method ++ */ ++ auth_cfg_t *auth; ++ + /** + * Pending outbound EAP message + */ +@@ -220,6 +225,10 @@ METHOD(tls_application_t, process, status_t, + if (!received_vendor && received_type == EAP_IDENTITY) + { + chunk_t eap_id; ++ bool peer_auth; ++ ++ peer_auth = lib->settings->get_bool(lib->settings, ++ "%s.plugins.eap-ttls.request_peer_auth", FALSE, lib->ns); + + if (this->method == NULL) + { +@@ -244,9 +253,22 @@ METHOD(tls_application_t, process, status_t, + + if (this->method->get_msk(this->method, &eap_id) == SUCCESS) + { +- this->peer->destroy(this->peer); +- this->peer = identification_create_from_data(eap_id); +- DBG1(DBG_IKE, "received EAP identity '%Y'", this->peer); ++ identification_t *id; ++ ++ id = identification_create_from_data(eap_id); ++ if (peer_auth && !id->equals(id, this->peer)) ++ { ++ DBG1(DBG_IKE, "received tunneled EAP identity '%Y', keeping " ++ "certificate-authenticated identity '%Y'", id, this->peer); ++ id->destroy(id); ++ } ++ else ++ { ++ DBG1(DBG_IKE, "received EAP identity '%Y'", id); ++ this->auth->add(this->auth, AUTH_RULE_EAP_IDENTITY, id); ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } + } + + in->destroy(in); +@@ -254,8 +276,7 @@ METHOD(tls_application_t, process, status_t, + this->method = NULL; + + /* Start Phase 2 of EAP-TTLS authentication */ +- if (lib->settings->get_bool(lib->settings, +- "%s.plugins.eap-ttls.request_peer_auth", FALSE, lib->ns)) ++ if (peer_auth) + { + return start_phase2_tnc(this, EAP_TLS); + } +@@ -278,6 +299,20 @@ METHOD(tls_application_t, process, status_t, + switch (status) + { + case SUCCESS: ++ if (this->method->get_auth) ++ { ++ identification_t *id; ++ auth_cfg_t *auth; ++ ++ auth = this->method->get_auth(this->method); ++ id = auth->get(auth, AUTH_RULE_EAP_IDENTITY); ++ if (id) ++ { ++ this->peer->destroy(this->peer); ++ this->peer = id->clone(id); ++ } ++ this->auth->merge(this->auth, auth, FALSE); ++ } + DBG1(DBG_IKE, "%N phase2 authentication of '%Y' with %N successful", + eap_type_names, EAP_TTLS, this->peer, + eap_type_names, type); +@@ -348,11 +383,18 @@ METHOD(tls_application_t, build, status_t, + return INVALID_STATE; + } + ++METHOD(eap_ttls_server_t, get_auth, auth_cfg_t*, ++ private_eap_ttls_server_t *this) ++{ ++ return this->auth; ++} ++ + METHOD(tls_application_t, destroy, void, + private_eap_ttls_server_t *this) + { + this->server->destroy(this->server); + this->peer->destroy(this->peer); ++ this->auth->destroy(this->auth); + DESTROY_IF(this->method); + DESTROY_IF(this->out); + this->avp->destroy(this->avp); +@@ -374,11 +416,13 @@ eap_ttls_server_t *eap_ttls_server_create(identification_t *server, + .build = _build, + .destroy = _destroy, + }, ++ .get_auth = _get_auth, + }, + .server = server->clone(server), +- .peer = peer->clone(peer), ++ .auth = auth_cfg_create(), + .start_phase2 = TRUE, + .start_phase2_tnc = TRUE, ++ .peer = peer->clone(peer), + .avp = eap_ttls_avp_create(), + ); + +diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.h b/src/libcharon/plugins/eap_ttls/eap_ttls_server.h +index 1e13f55..3348706 100644 +--- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.h ++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.h +@@ -37,6 +37,13 @@ struct eap_ttls_server_t { + * Implements the TLS application data handler. + */ + tls_application_t application; ++ ++ /** ++ * Get authentication details of this EAP method and its inner method(s). ++ * ++ * @return auth method, internal data ++ */ ++ auth_cfg_t *(*get_auth)(eap_ttls_server_t *this); + }; + + /** diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb index df0333b458..bb6c6bf2a3 100644 --- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb +++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb @@ -19,6 +19,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \ file://CVE-2026-78130.patch \ file://CVE-2026-78132.patch \ file://CVE-2026-78135.patch \ + file://CVE-2026-78134.patch \ " SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55" From patchwork Thu Oct 15 05:42:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100869 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 753D3CC6B38 for ; Thu, 15 Oct 2026 05:45:30 +0000 (UTC) Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32867.1792043127089226286 for ; Wed, 14 Oct 2026 22:45:27 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=nK9LCOiK; spf=pass (domain: gmail.com, ip: 209.85.214.169, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2e8246b13cbso36322545ad.2 for ; Wed, 14 Oct 2026 22:45:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043126; x=1792647926; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=RqoBVTvuWIA3oRwlp4pXxdSlrh9dq7DOjEbbCIaPUvY=; b=nK9LCOiKDLaSeAAAoYqjm+ScUPAs6B7y7JA6qEAJRdSCFbPM4m6YRji1vfhPUhVgIB dyx01FXaZ5iH6DlLEgq/T8KF7eBJNDAy5Tj0UCqogkoekeJ8g2r22rADT2KAqbXR4a1r iWbXY0LwD4S7JjUOCzbbLg13GMzkc8+SXa/rqnoxMx3/peZLcPq8t7UWqgHuR8RL0RBX ZjQcWZiAmJNOxTRGh3PRt1P5q60aYs6Ynt0OBIAqaxhvcffhmd2LMbYkAWJwNcOL2RrI +3oiwja4M2Ijs4g9/ecGysYOYQ+b7LnDCS4ybztwlISWAlDknroLmqNz0D/Emjq0Eq6k j7lg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043126; x=1792647926; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=RqoBVTvuWIA3oRwlp4pXxdSlrh9dq7DOjEbbCIaPUvY=; b=f5OJdGtJbezfbG/OdVXt44VscMB3JSLA+HQWAu/bgtNKO1i1GjAelJP6H5XzD4DtbA sZHogzCDnn8VW0fh9d96KHJYaxByE3r5/NFD8IeG18PukKg9Rjz9XQ6Gc0ENLP1zIOvZ b4xunNvKLhl9fbJVX6h78myH1HOw769TDDtPBq6M36FOynzH/aN3xLKjZ2vwJhu3YDII RtO1fotTUw1sdVwAMnLQmCofMMa6vgp3tTfKMicysfPvLXVxfFs4m4byszbFQleGhXHU ZysLP3R1ARbVmSURBFs7PIu1sL2AKb3aqxMfwW0Ms0bY1009tUz8R8ayKGrahS6bJpAA zoWw== X-Gm-Message-State: AFq9FYLmjHqc8tbk195kwNqI71X9JMD/cn++lhCONJ9T8Agvqhb9MPJQ DQ2hyZkrL/oQG7ovSg8nhd1sx6xdNEJRQTNZ2i7HxymVHJLZl6i5ZyhPx6M1qQ== X-Gm-Gg: AYBFou1c1+lNcNoXETNSduyQHPMer+nu/Ki3S68bO+J62iVZBI6PzwtoBjnj93bY9Ny YqYcNp1jlchApGP6kXdKkbNIDfSfIzZv4aftz63UoSgG3vj3b87ttfIl5Hcn8DImz5pewV3dKxD OsnOqoy5nHEf1bqhnGIkupN1BJ81uJsu+etb6By2GqUW+bWasEHVht8W3zqoJsAI6DKux5CyFpi wSzN7LYMnewclsV0xTvBneHYNc/koOyCYruNplSkDLBRFq8vPYs8a/Qu8a671sk9Le4znV8OG1R aFir+zzAuPATswXSO2TJIy3Qpqe9uqo39/zjCWJoevw+4Ssk8XigthkOe/YLxtSGE+JdO9AW4DS JAAElqLFdiLZASrJV+EaXg+WhMejocdYPtpEhwz60b5BTAczI+6D6krLCObX4Fu8y4eYYd7qajf PWBbiEqlf0NrS8DpcR+To8TXQIjl7Fv5jAq731L8K9dyhtXCn0VHYPWFIHRqc3YLesERDZEAkso LrjvTPI5w30MUYJYlq3zE4= X-Received: by 2002:a17:902:c943:b0:2e8:1d5c:f6f2 with SMTP id d9443c01a7336-2e842ab21fbmr172443515ad.24.1792043126329; Wed, 14 Oct 2026 22:45:26 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.24 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:26 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 73/82] tesseract: patch CVE-2026-88052 Date: Thu, 15 Oct 2026 18:42:01 +1300 Message-ID: <3d862201ffa201c5fd627852f11144ce7fe1cdd0.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130993 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88052 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 251dd7f80d1fc19515e162f5afd1eb889839bbaf) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88052.patch | 165 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 5 +- 2 files changed, 168 insertions(+), 2 deletions(-) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch new file mode 100644 index 0000000000..e55968135a --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch @@ -0,0 +1,165 @@ +From c60ad589ff3a645a3fdf13cb24fe719313145a06 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 18:34:33 +0200 +Subject: [PATCH] Reject unicharset files whose inserts desync id from unichars + +UNICHARSET::load_via_fgets reads the unichar count via sscanf and +trusts it as the loop bound, indexing the unichars vector with the +loop index id via the unchecked set_* accessors. unichar_insert is a +no-op for duplicate (or empty) representations, so once any insert +no-ops, unichars.size() falls behind id and the subsequent +set_*(id, ...) and unichars[id].properties writes land past the end +of the vector - a deterministic heap out-of-bounds write (including a +std::string assignment via set_normed) for every remaining line, on +both the LSTM and legacy init paths. A malformed unicharset with a +duplicate line (e.g. two identical entries) triggers it; a +non-positive header count likewise loads an empty unicharset +"successfully". + +Key changes: +- unicharset.cpp: reject unicharset_size <= 0, and after each insert + verify the vector actually grew to id + 1; on mismatch report the + offending line and reject the file instead of writing out of bounds. +- unittest: add unicharset_load_test with a duplicate-representation + unicharset (on unpatched code the test dies on the + container-overflow in load_via_fgets), a zero and a negative count, + and a positive control that a valid unicharset still loads. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 2d04d640db2e8c7e3bab2369d599343b5a8b8443) + +CVE: CVE-2026-88052 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/2d04d640db2e8c7e3bab2369d599343b5a8b8443] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 +++ + src/ccutil/unicharset.cpp | 12 ++++++ + unittest/unicharset_load_test.cc | 64 ++++++++++++++++++++++++++++++++ + 3 files changed, 81 insertions(+) + create mode 100644 unittest/unicharset_load_test.cc + +diff --git a/Makefile.am b/Makefile.am +index bec9ab0e..22c2c7a0 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1220,6 +1220,7 @@ check_PROGRAMS += tfile_test + if ENABLE_TRAINING + check_PROGRAMS += unichar_test + check_PROGRAMS += unicharcompress_test ++check_PROGRAMS += unicharset_load_test + check_PROGRAMS += unicharset_test + check_PROGRAMS += validate_grapheme_test + check_PROGRAMS += validate_indic_test +@@ -1493,6 +1494,10 @@ unicharcompress_test_SOURCES = unittest/unicharcompress_test.cc + unicharcompress_test_CPPFLAGS = $(unittest_CPPFLAGS) + unicharcompress_test_LDADD = $(TRAINING_LIBS) $(ICU_UC_LIBS) + ++unicharset_load_test_SOURCES = unittest/unicharset_load_test.cc ++unicharset_load_test_CPPFLAGS = $(unittest_CPPFLAGS) ++unicharset_load_test_LDADD = $(TESS_LIBS) ++ + unicharset_test_SOURCES = unittest/unicharset_test.cc + unicharset_test_CPPFLAGS = $(unittest_CPPFLAGS) + unicharset_test_LDADD = $(TRAINING_LIBS) $(ICU_UC_LIBS) +diff --git a/src/ccutil/unicharset.cpp b/src/ccutil/unicharset.cpp +index b29ec3b7..0e72ae48 100644 +--- a/src/ccutil/unicharset.cpp ++++ b/src/ccutil/unicharset.cpp +@@ -791,6 +791,9 @@ bool UNICHARSET::load_via_fgets( + sscanf(buffer, "%d", &unicharset_size) != 1) { + return false; + } ++ if (unicharset_size <= 0) { ++ return false; ++ } + for (UNICHAR_ID id = 0; id < unicharset_size; ++id) { + char unichar[256]; + unsigned int properties; +@@ -884,6 +887,15 @@ bool UNICHARSET::load_via_fgets( + } else { + this->unichar_insert_backwards_compatible(unichar); + } ++ // A duplicate or empty representation makes the insert a no-op, ++ // desynchronizing id from the unichars vector; the set_* calls and ++ // unichars[id] below would then write out of bounds. The file is ++ // malformed, so reject it. ++ if (size() != static_cast(id) + 1) { ++ fprintf(stderr, "%s:%d unichar %d has a duplicate or empty representation\n", ++ __FILE__, __LINE__, id); ++ return false; ++ } + + this->set_isalpha(id, properties & ISALPHA_MASK); + this->set_islower(id, properties & ISLOWER_MASK); +diff --git a/unittest/unicharset_load_test.cc b/unittest/unicharset_load_test.cc +new file mode 100644 +index 00000000..d775e233 +--- /dev/null ++++ b/unittest/unicharset_load_test.cc +@@ -0,0 +1,64 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: unicharset_load_test.cc ++// Description: Tests that UNICHARSET::load_via_fgets rejects unicharset ++// files whose insertions desynchronize the id loop index ++// from the unichars vector (duplicate or empty ++// representations), which would make the subsequent set_* ++// calls write out of bounds, and non-positive size counts. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "serialis.h" // for TFile ++#include "unicharset.h" ++ ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Loads the given unicharset text via the TFile-based loader. ++bool LoadUnicharset(const char *text, UNICHARSET *unicharset) { ++ TFile fp; ++ if (!fp.Open(text, std::strlen(text))) { ++ return false; ++ } ++ return unicharset->load_from_file(&fp, false); ++} ++ ++// A duplicate representation makes the second insert a no-op, so on ++// unpatched code the set_* calls for the remaining lines write past ++// the end of the unichars vector (ASan container-overflow). ++TEST(UnicharsetLoadTest, RejectsDuplicateRepresentation) { ++ const char *text = "3\nA 0 Latin\nA 0 Latin\nB 0 Latin\n"; ++ UNICHARSET unicharset; ++ EXPECT_FALSE(LoadUnicharset(text, &unicharset)); ++} ++ ++// A non-positive size count must be rejected; on unpatched code a ++// zero or negative count loads an empty unicharset successfully. ++TEST(UnicharsetLoadTest, RejectsNonPositiveCount) { ++ const char *texts[] = {"0\n", "-1\n"}; ++ for (const char *text : texts) { ++ UNICHARSET unicharset; ++ EXPECT_FALSE(LoadUnicharset(text, &unicharset)); ++ } ++} ++ ++// A valid unicharset must still be accepted. ++TEST(UnicharsetLoadTest, AcceptsValidUnicharset) { ++ const char *text = "3\nA 0 Latin\nB 0 Latin\nC 0 Latin\n"; ++ UNICHARSET unicharset; ++ ASSERT_TRUE(LoadUnicharset(text, &unicharset)); ++ EXPECT_EQ(unicharset.size(), 3u); ++ EXPECT_STREQ(unicharset.id_to_unichar(1), "B"); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 0d9b178dc9..81359b761b 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -6,8 +6,9 @@ LICENSE = "Apache-2.0" LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef" -SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV}" - +SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \ + file://CVE-2026-88052.patch \ +" DEPENDS = "leptonica" From patchwork Thu Oct 15 05:42:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100871 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B43A4CC6B3B for ; Thu, 15 Oct 2026 05:45:30 +0000 (UTC) Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32868.1792043129117669116 for ; Wed, 14 Oct 2026 22:45:29 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=e77U/bUt; spf=pass (domain: gmail.com, ip: 209.85.214.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2e82462a3f1so9770535ad.3 for ; Wed, 14 Oct 2026 22:45:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043128; x=1792647928; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=9Xu+zkfTcubefsRDXfR68Hr9MeQvRbPWzNonwptWFoY=; b=e77U/bUtqSm+CbnUIJORa2xNFeoDxuU4dmxwZ6CeDUfCBYWqLyvv0T9twspIXWhdMW jT56z0axDoCvh3Hce5dfrUlG7aC7P2i8vIpaeF1R4VQKLKbni+VCnzcvAsKtaFuThxop XoLFjPmiSAC0NCVyo84yOZUgROT07iAR147FrK4yzyco5MaBbgieq6OROAgeh54BqO+d 9E5pTRH0/VNYmU2DI0onF8XfAHT6cop+VilDXHJu5n3JnW5TZmPZwGY0XowV5OrMsPdR rAJSNAU+/qcpJfTStPAoQhHgWLdDk0Yqe10/ussrCkXcnG+xpQgn2y/M/R4YP4aGMWQc tfeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043128; x=1792647928; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=9Xu+zkfTcubefsRDXfR68Hr9MeQvRbPWzNonwptWFoY=; b=dmVlARIV3efNUM/9jdScXTHLd5y4cvoaNPgO3aDOd+uIdm5JNQSF0gwUP793g28tvA DLPpMgFG8L4ogH/d5PVy3ZR/fQXTVlpaEvXlUUjEVE9vNSXOMrhWjR74ORkIP7qCmEY8 4fg+1c9NEcCq74g9YjV8rqkixRWUzUYAnW6eO8Oyo7u4J5gFeEFp76sN4aaPDu2WG21C kw8qHqHSNrAIdffQxjnf6D1EiCpKLTTGcEqYIiKf02+0L3Pdpx2J0DT64QVXuWf+0Tl/ I8sfOOEcnIZOa85LVm5kn/FfrK2VMNQyLwHwer26Bd1n0FJifSarU+hCpaSauxl9+cxV ElCg== X-Gm-Message-State: AFq9FYIOss58Afgkb6wI7hdhnY4HOYtBO/o5ijalb7P3tIrqX74SvC6I jMNPurvPM5gC4KECPxNmBMcZ//OJyB5j5Df1/JtEo0+pyIjSgwr4/RKFw+/ndA== X-Gm-Gg: AYBFou2dvqXasG8vlZ/t9F5GsRd/NMMNZzMGNFpV5Hg0+fc90lhqg1RWfFTuAdaZ5fu 9N//Ff5/q4JeXfVh5z1skE2ZjEuQxc2C0b5MkxlVg5woz8uVmJDxIeCgh5s8tX1fqb8PYabhoWI MfS9uHqukS84VwWLKyYLzyaYWbI+Kya9xCJP6BY7myFuuJEMxI1xAGimlFZLselY/+UWl7df1ar WwfNbr9uSCQAx6alp546RNIkVoMfQvJ35qX7IOfV59hcWUve4vbwtO9J/Y7LPmEtGDuupjmZs4S MdGzCAhpcaWFgU5wSpVE4e5P+biIuGt3gkFs6wts8Di2TSK/H/i447l7sMc9SRCvi2wNDoju3xx kYWaHqpvfwZLveQlZumS5a4hrr6NrDn6dSXp+WtRSYFODucn71kTBTjMTv/5Y8kR06ICyDYFZyw AqvLNldc2thwmisIKY/3OI+ho9CJcK2f2DTWOTgeQ7HhdG7+7gOnL4Uuvlo2ikPeaAZBQjoMiWJ PsBLQ0/2LhZ1sgya4p8Fxg= X-Received: by 2002:a17:903:ac8:b0:2e9:528c:ba02 with SMTP id d9443c01a7336-2e9528cbc9bmr21289655ad.60.1792043128313; Wed, 14 Oct 2026 22:45:28 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.26 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:27 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 74/82] tesseract: patch CVE-2026-88048 Date: Thu, 15 Oct 2026 18:42:02 +1300 Message-ID: <221a1e49f420405d5a956207d15dfa91f034c311.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130994 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88048 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 9e544d6e5087f701a0d6a9d66ae3f87b6dcc8c5e) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88048.patch | 227 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 228 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch new file mode 100644 index 0000000000..abfd502667 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch @@ -0,0 +1,227 @@ +From b2fbc8282c34f0a5a426622a9eb6a79ad0df0fe4 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 15:23:59 +0200 +Subject: [PATCH] Validate FullyConnected weight matrix dimensions at load + +FullyConnected::DeSerialize read the WeightMatrix without checking +that its dimensions match the layer's declared ni/no. MatrixDotVector +drives the dot product from the matrix dimensions (writes w.dim1() +results, reads w.dim2()-1 inputs) while the scratch buffers are sized +from no_ and ni_, so a crafted .traineddata with a mismatched matrix +performed a heap out-of-bounds write (up to 65535 rows) and out-of- +bounds read on the first recognition step (crash, or heap corruption +with attacker-influenced size and content). + +Key changes: +- weightmatrix.h: add Dim1()/Dim2() accessors for the active weight + matrix (int or float), alongside the existing NumOutputs(). +- fullyconnected.cpp: reject the layer in DeSerialize unless + Dim1() == no_ and Dim2() == ni_ + 1 (the second dimension + includes the bias column), the layout that InitWeightsFloat + always produces. +- unittest: new fullyconnected_test that builds a Softmax network + with mismatched matrix dimensions and expects CreateFromFile to + return nullptr; on unpatched code the test reaches Forward and + ASan catches the out-of-bounds write in MatrixDotVector. A + second test verifies that matching dimensions are still accepted. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 103dc134eb36411ddc6833ec20aa2c76795bd0ff) + +CVE: CVE-2026-88048 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/103dc134eb36411ddc6833ec20aa2c76795bd0ff] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/lstm/fullyconnected.cpp | 11 ++- + src/lstm/weightmatrix.h | 7 ++ + unittest/fullyconnected_test.cc | 115 ++++++++++++++++++++++++++++++++ + 4 files changed, 137 insertions(+), 1 deletion(-) + create mode 100644 unittest/fullyconnected_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 22c2c7a0..284f8b53 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1158,6 +1158,7 @@ if !DISABLED_LEGACY_ENGINE + check_PROGRAMS += equationdetect_test + endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += fileio_test ++check_PROGRAMS += fullyconnected_test + check_PROGRAMS += heap_test + check_PROGRAMS += imagedata_test + if !DISABLED_LEGACY_ENGINE +@@ -1290,6 +1291,10 @@ fileio_test_SOURCES = unittest/fileio_test.cc + fileio_test_CPPFLAGS = $(unittest_CPPFLAGS) + fileio_test_LDADD = $(TRAINING_LIBS) + ++fullyconnected_test_SOURCES = unittest/fullyconnected_test.cc ++fullyconnected_test_CPPFLAGS = $(unittest_CPPFLAGS) ++fullyconnected_test_LDADD = $(TESS_LIBS) ++ + heap_test_SOURCES = unittest/heap_test.cc + heap_test_CPPFLAGS = $(unittest_CPPFLAGS) + heap_test_LDADD = $(TESS_LIBS) +diff --git a/src/lstm/fullyconnected.cpp b/src/lstm/fullyconnected.cpp +index a0ee1b02..d999f575 100644 +--- a/src/lstm/fullyconnected.cpp ++++ b/src/lstm/fullyconnected.cpp +@@ -121,7 +121,16 @@ bool FullyConnected::Serialize(TFile *fp) const { + + // Reads from the given file. Returns false in case of error. + bool FullyConnected::DeSerialize(TFile *fp) { +- return weights_.DeSerialize(IsTraining(), fp); ++ if (!weights_.DeSerialize(IsTraining(), fp)) { ++ return false; ++ } ++ // The weight matrix must match the declared sizes (the second dimension ++ // includes the bias column); otherwise Forward would read or write ++ // outside the scratch buffers sized from ni_ and no_. ++ if (weights_.Dim1() != no_ || weights_.Dim2() != ni_ + 1) { ++ return false; ++ } ++ return true; + } + + // Runs forward propagation of activations on the input line. +diff --git a/src/lstm/weightmatrix.h b/src/lstm/weightmatrix.h +index eaca3ffb..6c5ab236 100644 +--- a/src/lstm/weightmatrix.h ++++ b/src/lstm/weightmatrix.h +@@ -107,6 +107,13 @@ public: + int NumOutputs() const { + return int_mode_ ? wi_.dim1() : wf_.dim1(); + } ++ // The dimensions of the active weight matrix (wi_ in int mode, else wf_). ++ int Dim1() const { ++ return int_mode_ ? wi_.dim1() : wf_.dim1(); ++ } ++ int Dim2() const { ++ return int_mode_ ? wi_.dim2() : wf_.dim2(); ++ } + // Provides one set of weights. Only used by peep weight maxpool. + const TFloat *GetWeights(int index) const { + return wf_[index]; +diff --git a/unittest/fullyconnected_test.cc b/unittest/fullyconnected_test.cc +new file mode 100644 +index 00000000..f9697de4 +--- /dev/null ++++ b/unittest/fullyconnected_test.cc +@@ -0,0 +1,115 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: fullyconnected_test.cc ++// Description: Tests that a FullyConnected (softmax) network layer with ++// weight-matrix dimensions that do not match the declared ++// ni/no is rejected at load. Without the check, ++// MatrixDotVector writes w.dim1() results into a scratch ++// buffer sized from no_ and reads w.dim2()-1 inputs from ++// a buffer sized from ni_ (heap out-of-bounds write/read) ++// on the first recognition step. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "network.h" // for Network, NetworkType ++#include "networkio.h" ++#include "networkscratch.h" ++#include "serialis.h" // for TFile ++ ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++void PutDoubleLE(ByteWriter *w, double d) { ++ union { ++ double d; ++ uint64_t u; ++ } conv; ++ conv.d = d; ++ w->PutU32(static_cast(conv.u & 0xFFFFFFFF)); ++ w->PutU32(static_cast(conv.u >> 32)); ++} ++ ++// Builds a serialized NT_SOFTMAX network: header with the given ni/no, ++// then a float-mode WeightMatrix with the given (corrupt) dimensions. ++// The matrix is stored as doubles on disk (see WeightMatrix::DeSerialize). ++std::vector MakeSoftmaxNetwork(int ni, int no, int32_t dim1, int32_t dim2) { ++ ByteWriter w; ++ w.PutU8(static_cast(NT_SOFTMAX)); ++ w.PutU8(0); // training: TS_DISABLED ++ w.PutU8(0); // needs_to_backprop ++ w.PutU32(0); // network_flags ++ w.PutU32(static_cast(ni)); ++ w.PutU32(static_cast(no)); ++ w.PutU32(0); // num_weights (not cross-checked, kept consistent anyway) ++ w.PutU32(0); // name (empty string) ++ // WeightMatrix::DeSerialize: ++ w.PutU8(128); // mode: kDoubleFlag, float mode ++ w.PutS32(dim1); ++ w.PutS32(dim2); ++ PutDoubleLE(&w, 0.0); // empty_ cell ++ for (int32_t i = 0; i < dim1 * dim2; ++i) { ++ PutDoubleLE(&w, 0.0); // weight data ++ } ++ return w.data(); ++} ++ ++// A FullyConnected layer whose weight matrix does not match the declared ++// sizes must be rejected by CreateFromFile; on unpatched code the test ++// reaches Forward, where MatrixDotVector performs the out-of-bounds ++// write this regression test guards against. ++TEST(FullyconnectedTest, RejectsWeightMatrixDimensionMismatch) { ++ // ni_=no_=1 but dim1=3 (OOB write of 3 results into a 1-result buffer) ++ // and dim2=5 (OOB read of 4 inputs from a 1-input buffer). ++ std::vector bytes = MakeSoftmaxNetwork(1, 1, 3, 5); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the mismatched layer is rejected at load. ++ } ++ NetworkIO input; ++ input.Resize2d(false, /*width=*/1, /*num_features=*/1); ++ NetworkScratch scratch; ++ NetworkIO output; ++ net->Forward(false, input, nullptr, &scratch, &output); ++ delete net; ++ FAIL() << "crafted FullyConnected layer with mismatched weight matrix was accepted"; ++} ++ ++// Consistent dimensions must still be accepted. ++TEST(FullyconnectedTest, AcceptsMatchingDimensions) { ++ std::vector bytes = MakeSoftmaxNetwork(1, 2, 2, 2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ ASSERT_NE(net, nullptr); ++ delete net; ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 81359b761b..bed16f9806 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -8,6 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef" SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \ file://CVE-2026-88052.patch \ + file://CVE-2026-88048.patch \ " DEPENDS = "leptonica" From patchwork Thu Oct 15 05:42:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100874 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5009CC6B2F for ; Thu, 15 Oct 2026 05:45:40 +0000 (UTC) Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32869.1792043131358042647 for ; Wed, 14 Oct 2026 22:45:31 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=hq9fOmt6; spf=pass (domain: gmail.com, ip: 209.85.215.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-cd62c570b5dso801726a12.2 for ; Wed, 14 Oct 2026 22:45:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043131; x=1792647931; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=0jtEXI6DzBOUNNFoHZSKvXiTIYRqf/dnrlUdsu1s60M=; b=hq9fOmt6r6YdwnL2U2nYmDtFux6p2DJa4aHBJFaD25VfWMFtMXVvbPnh6ZmsxW0Bjh JueLIiFln+5NBtGYnNZhMIuqMMUqvSsYcaFOVweEEIuPKRCJ+au+eSPHOz6Zi1twLpyh AWZM561eH7Ypcd/CHCOY0QjeckjQ5MRXOqfdgWpC2CleIgyX4R5hI601u/lwdVHbquNU PmgALIUNcPzq5rVtyGKKRwcyaAxG/HATjqImbPJQzqNHKq8N89aYSL9lL4N+QbPZQg8d UGdPIEfeyJpgLGopmOb9jX5HRpR/y2xDKRKb3GL47bmqV/W5leqmeyvYz07a6X9aW6Gm LLvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043131; x=1792647931; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=0jtEXI6DzBOUNNFoHZSKvXiTIYRqf/dnrlUdsu1s60M=; b=Bnpu2IAobzQWq2mORwy8VPc2TDkfJEazt8F5f/Sog0uQrWrKWmsw43c0mntRm93hoj lROel1Db+EWShJNgIMAxhv5Rn615DX9ojvtB7KGhKfBFkClO8rRiu86aJyYNgIApdO2O hwfn704qKRdnu1F6cOpIhT6hoo/pG+2ztcD5UOubXogxcLVJ82D+H+X3RZQ8q87t+IBo oUhUlMxPPKG2zVpTSELk4QfBKZvI0/a/IT/wn68PK5u1g6lpL6/HhzKVSo6c2FcY39Uq D/h0yDhBOvBSmZnc+h7kDoNf2lV8MRkiq5waAOw0Wjnu2x89p0Ugl6vZJ+iDsTUnkE43 Ptzw== X-Gm-Message-State: AFq9FYJqqZQu3S0YJUFamf577iz/F5vu3VDpb+jnmZtdxbaIuc4a1ro3 iAlIlSmN3hu/w+7uAQPzn+msCPyl85wa++Y68e/VySzfgtQLqSB4SRf6gMF2Jw== X-Gm-Gg: AYBFou2wqnOmG+QONWkMJjmSupB+zf8lCBUa5K1tr2lAYTRMPHg8LL4oSFBpbYP7mwz x35GOaK2JQyCldrBu20ZoqFleNHRq49Bz/tWNFMo+P/Jbw1/yQebjpyQmS1h5ViFsSrGSK1beOV xZLHOIog4kw0yC41n05VFy4Dy9pyKBNcbSiKDXIh0Ts4qDy8dZkPoo0CpHi2hBYirMFzLS8JMx1 8z8+TkS5Y8FQtsf01Bk9S/nT17DyrmSEWrhq7kUnuvUVlBIWgHP9RToYX7MW9YAO41UVBiHQ+yb kb/cAabh5CJu3S283jPyHQFGVDmxKnAHjPoNWlUf4V/oJgxh+RTPs+/3a1/OVseeYPCiDS8cc+D G8hlpjT/knZ8t+BpcTNGRcR/dDY6qzmYPkxzGP6zvXpJhrb/AJ4rgXCGvgxGzKfbx/CXFw8a++m 0DI75EIp+51SQSqHCDzs8wh7+OknbdSt/T7TqFpZo7RPAQKpEwERt/PzJqj7pKMb2ks+1vIFA5L uw8xGHX9dSzkxrfE429ES0= X-Received: by 2002:a17:90b:3b84:b0:3ab:c80:9370 with SMTP id 98e67ed59e1d1-3ab3a736596mr13512866a91.20.1792043130362; Wed, 14 Oct 2026 22:45:30 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.28 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:30 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 75/82] tesseract: patch CVE-2026-88049 Date: Thu, 15 Oct 2026 18:42:03 +1300 Message-ID: <8f56f67a2f5391ee89988dae7769209512da7161.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130995 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88049 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 218b6a19b168587a67d1eab85160c302013164db) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88049.patch | 315 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 316 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch new file mode 100644 index 0000000000..b6a5e5275d --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch @@ -0,0 +1,315 @@ +From 62fabbca097d127e7d5a8fe3869102d2e4918b80 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 16:41:51 +0200 +Subject: [PATCH] Validate LSTM gate matrix dimensions against na_/no_ at load + +LSTM::DeSerialize read na_ from the untrusted TESSDATA_LSTM component +and derived ns_ from the CI gate matrix's dim1, but never checked that +the deserialized dimensions were mutually consistent. The forward pass +sizes its buffers from na_, no_ and ns_ while the gate matrices drive +their own dimensions, so a crafted .traineddata performed heap +out-of-bounds writes and reads during the first recognition step, e.g. +WriteTimeStepPart writing ns_ floats at offset ni_+nf_ into a source_ +buffer sized from na_ (up to ~256 KB with an attacker-chosen gate +matrix dim1). + +The bounds assertions added by 2f4d2f4 (CVE-2026-73066) covered only +NetworkIO::CopyTimeStepGeneral and Randomize, leaving +WriteTimeStepPart and AddTimeStepPart unguarded. + +Key changes: +- weightmatrix.h: add Dim1()/Dim2() accessors for the active weight + matrix (int or float), alongside the existing NumOutputs(). +- lstm.cpp: reject the layer in DeSerialize unless na_ == + ni_ + nf_ + (is_2d_ ? 2 : 1) * ns_, every deserialized gate has + Dim1() == ns_ and Dim2() == na_ + 1 (the layout InitWeightsFloat + always produces), ns_ == no_ for plain NT_LSTM/NT_LSTM_SUMMARY, and + the softmax layer's sizes match ns_/no_ for the softmax variants. +- networkio.cpp: add the same defense-in-depth bounds assertions to + WriteTimeStepPart and AddTimeStepPart as 2f4d2f4 added to + CopyTimeStepGeneral and Randomize. +- unittest: add lstm_layer_test with crafted NT_LSTM layers for the + na_ mismatch, gate dim1 mismatch, and gate dim2 mismatch cases + (each rejected at load; on unpatched code the tests reach Forward + and ASan catches the out-of-bounds write in WriteTimeStepPart), + plus a positive control that a consistent layer loads and runs. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit b494ac18925f9d9aff9ef5815475de9943ab19bf) + +CVE: CVE-2026-88049 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/b494ac18925f9d9aff9ef5815475de9943ab19bf] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 + + src/lstm/lstm.cpp | 20 ++++ + src/lstm/networkio.cpp | 2 + + unittest/lstm_layer_test.cc | 177 ++++++++++++++++++++++++++++++++++++ + 4 files changed, 204 insertions(+) + create mode 100644 unittest/lstm_layer_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 284f8b53..4bcc858b 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1171,6 +1171,7 @@ check_PROGRAMS += layout_test + check_PROGRAMS += ligature_table_test + check_PROGRAMS += linlsq_test + check_PROGRAMS += list_test ++check_PROGRAMS += lstm_layer_test + if ENABLE_TRAINING + check_PROGRAMS += lstm_recode_test + check_PROGRAMS += lstm_squashed_test +@@ -1352,6 +1353,10 @@ loadlang_test_SOURCES = unittest/loadlang_test.cc + loadlang_test_CPPFLAGS = $(unittest_CPPFLAGS) + loadlang_test_LDADD = $(TESS_LIBS) $(LEPTONICA_LIBS) + ++lstm_layer_test_SOURCES = unittest/lstm_layer_test.cc ++lstm_layer_test_CPPFLAGS = $(unittest_CPPFLAGS) ++lstm_layer_test_LDADD = $(TESS_LIBS) ++ + lstm_recode_test_SOURCES = unittest/lstm_recode_test.cc + lstm_recode_test_CPPFLAGS = $(unittest_CPPFLAGS) + lstm_recode_test_LDADD = $(TRAINING_LIBS) +diff --git a/src/lstm/lstm.cpp b/src/lstm/lstm.cpp +index 7bfd19b5..bfffa5de 100644 +--- a/src/lstm/lstm.cpp ++++ b/src/lstm/lstm.cpp +@@ -274,12 +274,32 @@ bool LSTM::DeSerialize(TFile *fp) { + is_2d_ = na_ - nf_ == ni_ + 2 * ns_; + } + } ++ // The deserialized dimensions must be mutually consistent: the forward ++ // pass sizes its buffers from na_, no_ and ns_ while the gate matrices ++ // drive their own dimensions. ++ if (na_ != ni_ + nf_ + (is_2d_ ? 2 : 1) * ns_) { ++ return false; ++ } ++ for (int w = 0; w < WT_COUNT; ++w) { ++ if (w == GFS && !Is2D()) { ++ continue; ++ } ++ if (gate_weights_[w].Dim1() != ns_ || gate_weights_[w].Dim2() != na_ + 1) { ++ return false; ++ } ++ } ++ if ((type_ == NT_LSTM || type_ == NT_LSTM_SUMMARY) && ns_ != no_) { ++ return false; ++ } + delete softmax_; + if (type_ == NT_LSTM_SOFTMAX || type_ == NT_LSTM_SOFTMAX_ENCODED) { + softmax_ = static_cast(Network::CreateFromFile(fp)); + if (softmax_ == nullptr) { + return false; + } ++ if (softmax_->NumInputs() != ns_ || softmax_->NumOutputs() != no_) { ++ return false; ++ } + } else { + softmax_ = nullptr; + } +diff --git a/src/lstm/networkio.cpp b/src/lstm/networkio.cpp +index 8e1c6679..7a31034b 100644 +--- a/src/lstm/networkio.cpp ++++ b/src/lstm/networkio.cpp +@@ -641,6 +641,7 @@ void NetworkIO::AddTimeStep(int t, TFloat *inout) const { + + // Adds part of a single timestep to floats. + void NetworkIO::AddTimeStepPart(int t, int offset, int num_features, float *inout) const { ++ ASSERT_HOST(offset + num_features <= NumFeatures()); + if (int_mode_) { + const int8_t *line = i_[t] + offset; + for (int i = 0; i < num_features; ++i) { +@@ -662,6 +663,7 @@ void NetworkIO::WriteTimeStep(int t, const TFloat *input) { + // Writes a single timestep from floats in the range [-1, 1] writing only + // num_features elements of input to (*this)[t], starting at offset. + void NetworkIO::WriteTimeStepPart(int t, int offset, int num_features, const TFloat *input) { ++ ASSERT_HOST(offset + num_features <= NumFeatures()); + if (int_mode_) { + int8_t *line = i_[t] + offset; + for (int i = 0; i < num_features; ++i) { +diff --git a/unittest/lstm_layer_test.cc b/unittest/lstm_layer_test.cc +new file mode 100644 +index 00000000..2c874995 +--- /dev/null ++++ b/unittest/lstm_layer_test.cc +@@ -0,0 +1,177 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: lstm_layer_test.cc ++// Description: Tests that an NT_LSTM network layer with mutually ++// inconsistent deserialized dimensions is rejected at ++// load. The forward pass sizes its buffers from na_, no_ ++// and ns_ while the gate weight matrices drive their own ++// dimensions, so a crafted .traineddata performs heap ++// out-of-bounds writes/reads during the first ++// recognition step (e.g. WriteTimeStepPart writing ns_ ++// floats into a source_ buffer sized from na_). ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "network.h" // for Network, NetworkType ++#include "networkio.h" ++#include "networkscratch.h" ++#include "serialis.h" // for TFile ++#include "stridemap.h" ++ ++#include ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++void PutDoubleLE(ByteWriter *w, double d) { ++ union { ++ double d; ++ uint64_t u; ++ } conv; ++ conv.d = d; ++ w->PutU32(static_cast(conv.u & 0xFFFFFFFF)); ++ w->PutU32(static_cast(conv.u >> 32)); ++} ++ ++// A serialized float-mode WeightMatrix with the given dimensions, ++// all weight data zeroed. ++void PutGateMatrix(ByteWriter *w, int32_t dim1, int32_t dim2) { ++ w->PutU8(128); // mode: kDoubleFlag, float mode ++ w->PutS32(dim1); ++ w->PutS32(dim2); ++ PutDoubleLE(w, 0.0); // empty_ cell ++ for (int32_t i = 0; i < dim1 * dim2; ++i) { ++ PutDoubleLE(w, 0.0); ++ } ++} ++ ++// A serialized 1-D NT_LSTM network: header with the given ni/no, na_, ++// then the four gates CI, GI, GF1, GO (GFS is not serialized for 1-D). ++std::vector MakeLstmNetwork(int ni, int no, int32_t na, ++ const int32_t gate_dim1[4], const int32_t gate_dim2[4]) { ++ ByteWriter w; ++ w.PutU8(static_cast(NT_LSTM)); ++ w.PutU8(0); // training: TS_DISABLED ++ w.PutU8(0); // needs_to_backprop ++ w.PutU32(0); // network_flags ++ w.PutU32(static_cast(ni)); ++ w.PutU32(static_cast(no)); ++ w.PutU32(0); // num_weights ++ w.PutU32(0); // name (empty string) ++ w.PutS32(na); ++ for (int g = 0; g < 4; ++g) { ++ PutGateMatrix(&w, gate_dim1[g], gate_dim2[g]); ++ } ++ return w.data(); ++} ++ ++// Builds the input a standalone LSTM layer would receive: one row of ++// the given width with ni features. ++NetworkIO MakeInput(int ni, int width) { ++ StrideMap stride_map; ++ stride_map.SetStride({{1, width}}); ++ NetworkIO input; ++ input.ResizeToMap(false, stride_map, ni); ++ return input; ++} ++ ++// Runs Forward on the loaded network; on unpatched code the out-of- ++// bounds access this regression test guards against fires here. ++void RunForward(Network *net, int ni, int width) { ++ NetworkIO input = MakeInput(ni, width); ++ NetworkScratch scratch; ++ NetworkIO output; ++ net->Forward(false, input, nullptr, &scratch, &output); ++ delete net; ++} ++ ++// na_ must equal ni_ + nf_ + ns_ for a 1-D LSTM; here na_=2 but the ++// CI matrix makes ns_=64, so the layer must be rejected. On unpatched ++// code Forward writes 64 floats at offset ni_=1 into a source_ buffer ++// sized for na_=2 (heap out-of-bounds write). ++TEST(LstmLayerTest, RejectsInconsistentNa) { ++ const int32_t dim1[4] = {64, 64, 64, 64}; ++ const int32_t dim2[4] = {3, 3, 3, 3}; ++ std::vector bytes = MakeLstmNetwork(1, 1, 2, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the inconsistent layer is rejected at load. ++ } ++ RunForward(net, 1, 2); ++ FAIL() << "crafted LSTM layer with inconsistent na_ was accepted"; ++} ++ ++// All gate matrices must have dim1 == ns_; here the GI matrix has ++// dim1=9 while ns_=5. On unpatched code the GI gate dot product writes ++// 9 results into a temp line sized for 5 (heap out-of-bounds write). ++TEST(LstmLayerTest, RejectsGateDim1Mismatch) { ++ const int32_t dim1[4] = {5, 9, 5, 5}; ++ const int32_t dim2[4] = {7, 7, 7, 7}; ++ std::vector bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the inconsistent layer is rejected at load. ++ } ++ RunForward(net, 1, 2); ++ FAIL() << "crafted LSTM layer with inconsistent gate dim1 was accepted"; ++} ++ ++// All gate matrices must have dim2 == na_ + 1; here the GI matrix has ++// dim2=9 while na_=6. On unpatched code the GI gate dot product reads ++// 8 inputs from a buffer sized for 6 (heap out-of-bounds read). ++TEST(LstmLayerTest, RejectsGateDim2Mismatch) { ++ const int32_t dim1[4] = {5, 5, 5, 5}; ++ const int32_t dim2[4] = {7, 9, 7, 7}; ++ std::vector bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ if (net == nullptr) { ++ return; // Fixed: the inconsistent layer is rejected at load. ++ } ++ RunForward(net, 1, 2); ++ FAIL() << "crafted LSTM layer with inconsistent gate dim2 was accepted"; ++} ++ ++// A fully consistent 1-D LSTM layer must still be accepted and usable. ++TEST(LstmLayerTest, AcceptsConsistentLayer) { ++ const int32_t dim1[4] = {5, 5, 5, 5}; ++ const int32_t dim2[4] = {7, 7, 7, 7}; ++ std::vector bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ Network *net = Network::CreateFromFile(&fp); ++ ASSERT_NE(net, nullptr); ++ RunForward(net, 1, 2); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index bed16f9806..24c8312552 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -9,6 +9,7 @@ SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef" SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \ file://CVE-2026-88052.patch \ file://CVE-2026-88048.patch \ + file://CVE-2026-88049.patch \ " DEPENDS = "leptonica" From patchwork Thu Oct 15 05:42:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100877 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA6FBCC6B3A for ; Thu, 15 Oct 2026 05:45:40 +0000 (UTC) Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32871.1792043133363162229 for ; Wed, 14 Oct 2026 22:45:33 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=rkNa5N5q; spf=pass (domain: gmail.com, ip: 209.85.214.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2e7e742a2c7so33108875ad.0 for ; Wed, 14 Oct 2026 22:45:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043133; x=1792647933; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=3R3PIVwduR84cNu++N7KgpS36Y6qS/pdF5Wj1ZB5rm8=; b=rkNa5N5qyhdtjLQFTiJ5t5fwgzDzGjVC2IlXaCoO1NqzP8NvI7RSCVas49WbrczoJR vspBGFqseDbufR9tmvuutAcU4tWlesqUYYz/NfyvnC9x/FmySA0EVV4Fm4uivxjAlyhD zbGosTr9eoK9eP1ETWxX0RB+JZ5/RycFmUi3d43s7Dba1GsSEjStcG5EIaeVqKrpKl+r 5iNBvbq5LD2/Ry8R+Avy+rb91uvoStXYTUqsiblVC7G1w/NYFRKu7CEotaSF3ioZ8ZLg p+vQcB4OAmxHpkCD8+5Ug8AKnZVnrFElAvSeCkDSHSeYtEddnwMLYHUGISDvlTEZWKKT XVIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043133; x=1792647933; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=3R3PIVwduR84cNu++N7KgpS36Y6qS/pdF5Wj1ZB5rm8=; b=dKCVDF1+hCOUvWTaUPixQuXUaztV8eyxbAR/02mgAkU5035zPqUFtIKQSXuvUAdj/H K3BndPO1zNZAbdy5RGRTkdeCwFo+gfasNrks3LwswiNd4H5utvyYrS9DsavkEHha7ZDH aLSOqX0BrkxHYcystiswts++hwndqG/rZGbATxfUw7QSM3PluGspWaMQKB7bgw5J/+fb g/ILTBIfQP++QUcgSfADBvIqId9h4ldMyGm/HKWDvpR5gEt47xMz/C4Pxe1KZDiWFEYn LIOkYIoCDlkWRf5m935gf4WtxLElquC99QMZzQGGmtjH+INUK/kQ3YGcrHDfR/APOPyP SIzw== X-Gm-Message-State: AFq9FYJq9aEemBl9S1BMZmxUoksYcI/LExbQyTBf0MwJ9WrdqJX8OE3Y F6gIX2sASLhmzENJ5UsUKtfBmpN0Zp5gqiJIDgAWieg8zgwRzpnwCVip40JUag== X-Gm-Gg: AYBFou0lA6fNFiar0i5jgbQdnBXmQ9wQl5XyByuuPvPOsUkkKRoxq9U3MlzFcGhIzZ/ I4l9sEBuSULY5r+GZIAjN0b/CseEkyM/z57KwCbabIN/0ZXHihsBkTsWmFIuFlVxYdkkVopi/+Z H6oQI4nzyD/j4RQbxkYKFstJEf6PcqN/wKynSu5cfs43/uadaDt0fJ2S00AMhmXpfGhXrquxlCY gApjSMge22+gzSMiHDUvw4HbDLZ9X+WjvEQwB0WjhKv8B2Nt6mgzu5e4tg0/IN+QCESMErFJtAo ydVaeovArDbeIy2HaOo0NnAIOjHdLI2rM8Kf/FL+Qx/fW9233veXaz71sijSGNgvfGxbtoic7du m6yDyKEcvNc93XAL31G3PjMZ2gR3aV2UeERMq9nWz9tAfD66p4KaVnpjYYawTxFekWG68u3NTTq 5OuISwj/5DcB+c5grUiOUf5MpoOBw8hFa0nf+QPwD73awJXBN/cf3BiKwcEnb9sYhtAEHovuDBD HESuZJVUqwVp3j286KSXZo= X-Received: by 2002:a17:903:22cf:b0:2df:b510:cebb with SMTP id d9443c01a7336-2e842835a01mr119792495ad.6.1792043132523; Wed, 14 Oct 2026 22:45:32 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:32 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 76/82] tesseract: patch CVE-2026-88050 Date: Thu, 15 Oct 2026 18:42:04 +1300 Message-ID: <08a6852a7e3046a5a0a13f4c0700213b6f663ea8.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130996 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88050 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 4aab0847c2e6b786437d140dd3c589e6773b9224) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88050.patch | 209 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 210 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch new file mode 100644 index 0000000000..21fa5e9a67 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch @@ -0,0 +1,209 @@ +From 5426c23fe7fe32b62bd5694f68f71772f273c821 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 16:56:51 +0200 +Subject: [PATCH] Reject recoder code values outside the sane range at load + +RecodedCharID::DeSerialize (hardened by 82727cc to check length_ +only) still read the individual code values as raw signed int32. +UnicharCompress::ComputeCodeRange computes code_range_ as 1 plus the +maximum code using a signed > comparison, so a code value of -1 +never raises the maximum and yields code_range_ = 0. SetupDecoder +then resizes is_valid_start_ to 0 and writes is_valid_start_[code(0)] +on the size-0 vector, an out-of-bounds write at a wild wrapped +index (deterministic crash) on LSTMRecognizer load. A code value of +INT32_MAX instead wraps code_range_ negative and makes resize() +throw. + +Key changes: +- unicharcompress.h: validate each deserialized code value to be + within [0, UINT16_MAX), the same arbitrary cap used elsewhere for + .traineddata counts; reject the recoder otherwise. +- unicharcompress.h/.cpp: add defense-in-depth bounds assertions to + IsValidFirstCode and SetupDecoder, matching the style of the + NetworkIO assertions from 2f4d2f4. +- unittest: add recoder_test, which feeds a crafted UnicharCompress + with a -1 code and an INT32_MAX code and expects DeSerialize to + fail (on unpatched code the -1 case dies on the SEGV in + SetupDecoder, the huge case on the uncaught length_error), plus a + positive control that valid codes load and answer + code_range()/IsValidFirstCode() correctly. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit c94a5532ee04db5a4919542832fd94caee5ea58f) + +CVE: CVE-2026-88050 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/c94a5532ee04db5a4919542832fd94caee5ea58f] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/ccutil/unicharcompress.cpp | 1 + + src/ccutil/unicharcompress.h | 13 ++++- + unittest/recoder_test.cc | 91 ++++++++++++++++++++++++++++++++++ + 4 files changed, 109 insertions(+), 1 deletion(-) + create mode 100644 unittest/recoder_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 4bcc858b..63ca6686 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1202,6 +1202,7 @@ endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += progress_test + check_PROGRAMS += qrsequence_test + check_PROGRAMS += recodebeam_test ++check_PROGRAMS += recoder_test + check_PROGRAMS += rect_test + check_PROGRAMS += resultiterator_test + check_PROGRAMS += scanutils_test +@@ -1435,6 +1436,10 @@ recodebeam_test_SOURCES = unittest/recodebeam_test.cc + recodebeam_test_CPPFLAGS = $(unittest_CPPFLAGS) + recodebeam_test_LDADD = $(TRAINING_LIBS) $(ICU_I18N_LIBS) $(ICU_UC_LIBS) + ++recoder_test_SOURCES = unittest/recoder_test.cc ++recoder_test_CPPFLAGS = $(unittest_CPPFLAGS) ++recoder_test_LDADD = $(TESS_LIBS) ++ + rect_test_SOURCES = unittest/rect_test.cc + rect_test_CPPFLAGS = $(unittest_CPPFLAGS) + rect_test_LDADD = $(TESS_LIBS) +diff --git a/src/ccutil/unicharcompress.cpp b/src/ccutil/unicharcompress.cpp +index f909f76e..b3dd440f 100644 +--- a/src/ccutil/unicharcompress.cpp ++++ b/src/ccutil/unicharcompress.cpp +@@ -400,6 +400,7 @@ void UnicharCompress::SetupDecoder() { + for (unsigned c = 0; c < encoder_.size(); ++c) { + const RecodedCharID &code = encoder_[c]; + decoder_[code] = c; ++ ASSERT_HOST(code(0) >= 0 && code(0) < code_range_); + is_valid_start_[code(0)] = true; + RecodedCharID prefix = code; + uint32_t len = code.length(); +diff --git a/src/ccutil/unicharcompress.h b/src/ccutil/unicharcompress.h +index 9b696d03..6919b7d2 100644 +--- a/src/ccutil/unicharcompress.h ++++ b/src/ccutil/unicharcompress.h +@@ -84,7 +84,17 @@ public: + if (length_ > kMaxCodeLen) { + return false; + } +- return fp->DeSerialize(&code_[0], length_); ++ if (!fp->DeSerialize(&code_[0], length_)) { ++ return false; ++ } ++ // Code values index arrays sized from the maximum code; reject values ++ // that are out of the sane range for a recoded alphabet. ++ for (uint32_t i = 0; i < length_; ++i) { ++ if (code_[i] < 0 || code_[i] >= static_cast(UINT16_MAX)) { ++ return false; ++ } ++ } ++ return true; + } + bool operator==(const RecodedCharID &other) const { + if (length_ != other.length_) { +@@ -190,6 +200,7 @@ public: + int DecodeUnichar(const RecodedCharID &code) const; + // Returns true if the given code is a valid start or single code. + bool IsValidFirstCode(int code) const { ++ ASSERT_HOST(code >= 0 && code < code_range_); + return is_valid_start_[code]; + } + // Returns a list of valid non-final next codes for a given prefix code, +diff --git a/unittest/recoder_test.cc b/unittest/recoder_test.cc +new file mode 100644 +index 00000000..48dfa7ea +--- /dev/null ++++ b/unittest/recoder_test.cc +@@ -0,0 +1,91 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: recoder_test.cc ++// Description: Tests that a UnicharCompress (LSTM recoder) with code ++// values outside the sane range is rejected at load. ++// Negative code values leave code_range_ at zero, so ++// SetupDecoder writes is_valid_start_[code(0)] out of ++// bounds on a size-0 vector; huge code values wrap ++// code_range_ and make resize() throw. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "serialis.h" // for TFile ++#include "unicharcompress.h" ++ ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++// A serialized UnicharCompress with one length-1 RecodedCharID per ++// given code value (self-normalizing). ++std::vector MakeRecoder(const std::vector &codes) { ++ ByteWriter w; ++ w.PutU32(codes.size()); ++ for (int32_t code : codes) { ++ w.PutU8(1); // self_normalized_ ++ w.PutU32(1); // length_ ++ w.PutS32(code); // code_[0] ++ } ++ return w.data(); ++} ++ ++// A recoder code of -1 keeps code_range_ at 0, so on unpatched code ++// SetupDecoder performs an out-of-bounds write into the size-0 ++// is_valid_start_ vector. ++TEST(RecoderTest, RejectsNegativeCode) { ++ std::vector bytes = MakeRecoder({-1}); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ UnicharCompress recoder; ++ EXPECT_FALSE(recoder.DeSerialize(&fp)); ++} ++ ++// A recoder code of INT32_MAX wraps code_range_ to a negative value, ++// so on unpatched code SetupDecoder's resize() throws. ++TEST(RecoderTest, RejectsHugeCode) { ++ std::vector bytes = MakeRecoder({INT32_MAX}); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ UnicharCompress recoder; ++ EXPECT_FALSE(recoder.DeSerialize(&fp)); ++} ++ ++// A valid recoder must still be accepted and usable. ++TEST(RecoderTest, AcceptsValidCodes) { ++ std::vector bytes = MakeRecoder({0, 1}); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ UnicharCompress recoder; ++ ASSERT_TRUE(recoder.DeSerialize(&fp)); ++ EXPECT_EQ(recoder.code_range(), 2); ++ EXPECT_TRUE(recoder.IsValidFirstCode(0)); ++ EXPECT_TRUE(recoder.IsValidFirstCode(1)); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 24c8312552..6acedcee98 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -10,6 +10,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88052.patch \ file://CVE-2026-88048.patch \ file://CVE-2026-88049.patch \ + file://CVE-2026-88050.patch \ " DEPENDS = "leptonica" From patchwork Thu Oct 15 05:42:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100875 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD876CC6B39 for ; Thu, 15 Oct 2026 05:45:40 +0000 (UTC) Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32872.1792043135345195812 for ; Wed, 14 Oct 2026 22:45:35 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=kpD4GVj5; spf=pass (domain: gmail.com, ip: 209.85.214.175, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2e8fe8e343fso19143885ad.2 for ; Wed, 14 Oct 2026 22:45:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043135; x=1792647935; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=W2azljDXcg9TEmoasMdOM7wxqWIT/xnZVzzgM+sCy6w=; b=kpD4GVj5F52kEe5zI+u/be8aS5psnAI5JeHuGcDQYw5GWRPrK36HvCiGaP4JdknfyE 1nXQUOkUZNiQ2jghbOVvAyBkw942wtsxR7rDoobVVjZIrbw8CqHNweIOeLU+ihyW2kXR ZBcnYdsKvls7+Ew+NFpUV25qZ0l9jFuStE1JdJczIxinQD5xLdWPpllZRiI91bn9sLt+ I5HWTqu+oND/0GjojesV/HPVNtkjd9WIBvYSYesdPVHOzFPnOhdWo3IQ19hG90pfvZj2 bNcHCGzSd/gbBuRYOXazWr+Lu59C+Dfju8vZ//xpgCVO9rG8rjNcTKCjBuqwfrqUzd+p v1Uw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043135; x=1792647935; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=W2azljDXcg9TEmoasMdOM7wxqWIT/xnZVzzgM+sCy6w=; b=ldhGmJsh87BhPcAnHl2Qk7z9b8GDia9X0PY/fVdF2wX0cyu1MgYjwjGL95ZxLUWAnq PZVr6ScnuZcR24KBeQdzLZ0Ni9LFHYM2TICuM6tKhAVeL4LtEDHLbSC5MKv7LMJQ7E/Y 3s2wdIw/6Gg3Wo19QF5Lo0oDWNT4YFaRoSIVJDGxa9kgbzQtTTODfYOxf4N7yJfMhWik 6Gzg5nPtlL95zP/3x+/185l72ykK7qAEM8/sXrNJuu9wlozkYGVIU9l26x6ZWUhRs3Iy MRPSuKOmqwrQSBG+yAwNlGn7UYPE1t1Fw3zH4VSvdwpCu/pTMOspP9kn5v0aOZCj3LiU rqkQ== X-Gm-Message-State: AFq9FYKUjWugtNcdMgbjsmr2bsxWvPnrMYEhIBxLxKS2SB8WEw+XolZA eWTGmZFXVGur3ojYUQLpIcyg6Y543RqTvxhHVsgjFpjcBVZu6N7rIPacU+DAFg== X-Gm-Gg: AYBFou2YAxfPI620YU/z/U8vPXan/5V6pQnkWCd3VyKMTwvoRCPE+u6r1k98Fymg/1m UZd8HLw3+O3EG0VwvGYRALe67qKDiN86ow5tp77Xw+yfIZdHg7u6/p7aUe4Vt8cetxp6OaEvjtz ukOJgyeg4zBHa5n3Sx51Yc7azosr+we2cBW+jb2In83jPnZR9PpfD0CqQx2HV7hLzqPTTIA9o9O pp2WcoRpHA+CiIDL8SfmXUUzPYl8ZWFHrD6BM3/mZFP+oQnOG8sNDWJ+74alzHgvksw9LFHMKvP kp2Kt7aDirVfFRVLKMMEoVh/HN7RN+d+CaRyKSE4Neuy8dMIQfyikkMvk8Jx5QTE4GEwm9S6FYA yZnud/lCL6NidLRzvMGtP6UVOI0a2IGbNWdX3Lvl18qSp3hk+GuJd8cumeuxsAQH1Joi6+Vy2By GMe6/adIJI9s/yZORh+C68YVodjrrNhJpEKo5hbqcv2/0j2Vg9Y4UdsSBRvqjgisTOWGM9EiQfO Di1KWRPiDuN9HJNQmj82IA= X-Received: by 2002:a17:903:324d:b0:2e3:1e96:7f1a with SMTP id d9443c01a7336-2e842718deemr142595365ad.0.1792043134458; Wed, 14 Oct 2026 22:45:34 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.32 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:34 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 77/82] tesseract: patch CVE-2026-88047 Date: Thu, 15 Oct 2026 18:42:05 +1300 Message-ID: <21dc40e65a8e4d96b7dce4029455fcd376904f9f.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130997 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88047 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit b8fa7aac9168b6ebfdcc2ea3493c332f0db69491) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88047.patch | 225 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 226 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch new file mode 100644 index 0000000000..780f686e61 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch @@ -0,0 +1,225 @@ +From e974684acbe3aeb6bc6192b06a048537c345b713 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Mon, 24 Aug 2026 13:39:22 +0200 +Subject: [PATCH] Limit unichar extraction in ReadNormProtos to the buffer size + +Classify::ReadNormProtos parsed each normproto line with +`stream >> unichar >> NumProtos` into a char unichar[2 * UNICHAR_LEN + 1] +stack buffer, but char* extraction from an istream has no length limit +(the stream width was never set). A crafted TESSDATA_NORMPROTO component +in a .traineddata file whose first proto-line token exceeds 60 +characters (the 100-byte line buffer allows up to 99) overflows the +stack buffer during legacy engine initialization (CWE-121). + +Toolchain note: Apple's libc++ provides a C++20 array overload of +operator>>(basic_istream&, char(&)[N]) that implicitly bounds the +extraction to the array size, so builds against that standard library +are incidentally protected. Standard libraries without that overload +(e.g. libstdc++) still take the unbounded char* overload, so the +explicit width limit below makes the behavior defined on all +toolchains. + +Key changes: +- normmatch.cpp: read the unichar token with + std::setw(2 * UNICHAR_LEN + 1); char* extraction takes at most + width - 1 characters, which fits the buffer exactly. Overlong + tokens are truncated and the line is rejected like any other + unparseable line. +- unittest: add normproto_test covering a 99-character token (the + maximum a 100-byte line can hold), a token of exactly 2 * + UNICHAR_LEN characters, and a well-formed component. A minimal + reproduction of the unbounded extraction crashes an ASan build + with a stack-buffer-overflow. + +Reported-by: Tristan Madani +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 1bda5079b1c8a7e25f523486837426903d29ce84) + +CVE: CVE-2026-88047 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/1bda5079b1c8a7e25f523486837426903d29ce84] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/classify/normmatch.cpp | 6 +- + unittest/CMakeLists.txt | 1 + + unittest/normproto_test.cc | 111 +++++++++++++++++++++++++++++++++++++ + 4 files changed, 122 insertions(+), 1 deletion(-) + create mode 100644 unittest/normproto_test.cc + +diff --git a/Makefile.am b/Makefile.am +index 63ca6686..cc748455 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1184,6 +1184,7 @@ check_PROGRAMS += mastertrainer_test + endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += matrix_test + check_PROGRAMS += networkio_test ++check_PROGRAMS += normproto_test + if ENABLE_TRAINING + check_PROGRAMS += normstrngs_test + endif # ENABLE_TRAINING +@@ -1388,6 +1389,10 @@ networkio_test_SOURCES = unittest/networkio_test.cc + networkio_test_CPPFLAGS = $(unittest_CPPFLAGS) + networkio_test_LDADD = $(TESS_LIBS) + ++normproto_test_SOURCES = unittest/normproto_test.cc ++normproto_test_CPPFLAGS = $(unittest_CPPFLAGS) ++normproto_test_LDADD = $(TESS_LIBS) ++ + normstrngs_test_SOURCES = unittest/normstrngs_test.cc + normstrngs_test_CPPFLAGS = $(unittest_CPPFLAGS) + normstrngs_test_LDADD = $(TRAINING_LIBS) $(ICU_I18N_LIBS) $(ICU_UC_LIBS) +diff --git a/src/classify/normmatch.cpp b/src/classify/normmatch.cpp +index d5bd7e6a..1ce7c928 100644 +--- a/src/classify/normmatch.cpp ++++ b/src/classify/normmatch.cpp +@@ -28,6 +28,7 @@ + + #include + #include ++#include // for std::setw + #include // for std::istringstream + + namespace tesseract { +@@ -190,7 +191,10 @@ NORM_PROTOS *Classify::ReadNormProtos(TFile *fp) { + while (fp->FGets(line, kMaxLineSize) != nullptr) { + std::istringstream stream(line); + stream.imbue(std::locale::classic()); +- stream >> unichar >> NumProtos; ++ // unichar holds at most 2 * UNICHAR_LEN characters; the width limit ++ // (width - 1 characters for char* extraction) keeps the extraction ++ // from overflowing the buffer on overlong lines. ++ stream >> std::setw(2 * UNICHAR_LEN + 1) >> unichar >> NumProtos; + if (stream.fail()) { + continue; + } +diff --git a/unittest/CMakeLists.txt b/unittest/CMakeLists.txt +index a660c9b1..4c677a60 100644 +--- a/unittest/CMakeLists.txt ++++ b/unittest/CMakeLists.txt +@@ -59,6 +59,7 @@ set(LEGACY_TESTS + indexmapbidi_test.cc + intfeaturemap_test.cc + mastertrainer_test.cc ++ normproto_test.cc + osd_test.cc + params_model_test.cc + shapetable_test.cc +diff --git a/unittest/normproto_test.cc b/unittest/normproto_test.cc +new file mode 100644 +index 00000000..574b2f3d +--- /dev/null ++++ b/unittest/normproto_test.cc +@@ -0,0 +1,111 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: normproto_test.cc ++// Description: Tests that Classify::ReadNormProtos handles a normproto ++// line whose first (unichar) token exceeds the ++// unichar[2 * UNICHAR_LEN + 1] stack buffer. The ++// istream extraction has no intrinsic length limit, so a ++// crafted NORMPROTO component in a .traineddata file ++// could overflow the stack buffer during legacy engine ++// initialization. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "classify.h" ++#include "serialis.h" // for TFile ++ ++#include ++#include ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Minimal unicharset (space and 'a'). ++const char kMinUnicharset[] = ++ "2\n" ++ "NULL 1 0,255,0,255,0,0,0,0,0,0 Latin 2 0 2\n" ++ "a 1 0,255,0,255,0,0,0,0,0,0 Latin 2 0 2\n"; ++ ++// Builds a normproto component: a sample-size line (5), five parameter ++// description lines, then the given raw proto lines. ++std::vector MakeNormproto(const std::string &lines) { ++ std::string data = "5\n"; ++ for (int i = 0; i < 5; ++i) { ++ data += "e e 0 1\n"; ++ } ++ data += lines; ++ return std::vector(data.begin(), data.end()); ++} ++ ++class NormprotoTest : public testing::Test { ++protected: ++ void SetUp() override { ++ tmpl_ = "/tmp/tess_normproto_test_XXXXXX"; ++ char *dir = mkdtemp(tmpl_.data()); ++ ASSERT_NE(dir, nullptr); ++ dir_ = dir; ++ std::string uc_path = dir_ + "/eng.unicharset"; ++ FILE *f = fopen(uc_path.c_str(), "w"); ++ ASSERT_NE(f, nullptr); ++ ASSERT_EQ(fwrite(kMinUnicharset, 1, sizeof(kMinUnicharset) - 1, f), ++ sizeof(kMinUnicharset) - 1); ++ fclose(f); ++ // Load the minimal unicharset into the classifier's inherited ++ // unicharset member. ++ ASSERT_TRUE(classifier_.unicharset.load_from_file(uc_path.c_str())); ++ } ++ void TearDown() override { ++ std::remove((dir_ + "/eng.unicharset").c_str()); ++ rmdir(dir_.c_str()); ++ } ++ std::string dir_; ++ std::string tmpl_; ++ Classify classifier_; ++}; ++ ++// A 99-character first token (the maximum FGets can return) overflows ++// unichar[2 * UNICHAR_LEN + 1] on unpatched code; the width-limited ++// extraction must reject the line instead. ++TEST_F(NormprotoTest, ToleratesOverlongUnicharToken) { ++ std::vector bytes = MakeNormproto(std::string(99, 'A') + "\n"); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp); ++ ASSERT_NE(classifier_.NormProtos, nullptr); ++ classifier_.FreeNormProtos(); ++ EXPECT_EQ(classifier_.NormProtos, nullptr); ++} ++ ++// A token of exactly 2 * UNICHAR_LEN characters is the maximum legitimate ++// size; it must not be truncated or rejected by the width limit. ++TEST_F(NormprotoTest, ToleratesMaxLenUnicharToken) { ++ std::vector bytes = MakeNormproto(std::string(2 * UNICHAR_LEN, 'A') + " 0\n"); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp); ++ ASSERT_NE(classifier_.NormProtos, nullptr); ++ classifier_.FreeNormProtos(); ++ EXPECT_EQ(classifier_.NormProtos, nullptr); ++} ++ ++// A well-formed normproto component must still parse. ++TEST_F(NormprotoTest, ReadsValidNormprotos) { ++ std::vector bytes = MakeNormproto("a 0\n"); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp); ++ ASSERT_NE(classifier_.NormProtos, nullptr); ++ classifier_.FreeNormProtos(); ++ EXPECT_EQ(classifier_.NormProtos, nullptr); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 6acedcee98..25d357d903 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -11,6 +11,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88048.patch \ file://CVE-2026-88049.patch \ file://CVE-2026-88050.patch \ + file://CVE-2026-88047.patch \ " DEPENDS = "leptonica" From patchwork Thu Oct 15 05:42:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100873 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2409CC6B38 for ; Thu, 15 Oct 2026 05:45:40 +0000 (UTC) Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33280.1792043137372080942 for ; Wed, 14 Oct 2026 22:45:37 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=rUqcemYN; spf=pass (domain: gmail.com, ip: 209.85.214.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2e940d5d2beso5646215ad.0 for ; Wed, 14 Oct 2026 22:45:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043137; x=1792647937; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=4LFV5BDa5k3G5pVC9Yn1kpg0hPNqgW+fbIO2Z4XRXf0=; b=rUqcemYNUDCc1yaCeDQRvusu8uuAaGB9dhzTimMa9ILkhLkGRi1+hnxaOqDeaKUy0q Wighzh2JuWK8Onuc76aQ5XnVyNaLLHu1yjUxFizSLWlZeThxuZoEXsb295h62loFH3tb HdutbNo/+ZdRIWi9XlvUG+xSFq3FsEYUu4ERB5jG81dVZFEjReHVOg99DNaYyWaS4mbR ikWgQexwIPGQpnjgvv8GDlgd5IT/fCEZsuy+T+CArdg1191w4CdTozZ6kHKwnEdrUG/L 2i3JwuwWP6sgYz/j4tgm+KH05hyS/Isb0MOXMcz641lHQazCm7qD4F8klldCX0gI2AA7 zjnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043137; x=1792647937; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=4LFV5BDa5k3G5pVC9Yn1kpg0hPNqgW+fbIO2Z4XRXf0=; b=CGKphK1PherF1zt8qG41ADM+HODVXHr/dvPXFQfpMLgc72nnf08jUa74fB1Wi9nw6t eE9iLVeUkCmIcvvNSk2cYutryuVa+qrOh0n7f2c49571cgbAD1SgXBd6DCdopCvSj8BJ vx4BlTQqBCtDZ7QzTwQaPH96Z4KacQfgg1NHU/1Lu/O+ZrIY35G8fhU/V7+yJ5F+kFhR W324k93l5h1IXhAmlFN1asLq5ROAHCklKQXSZeZy8umqftSl3z2RjBnc9nxcNW+xT+/P 0UyQmEgdn4uJf7QpizS4TLqvnCC93YxSPP8w8QfblYd5+tkFKylsF/c26Jra8l8GGjgI 7JBQ== X-Gm-Message-State: AFq9FYIiuwKPOP3NVt1TXFW21P5Uv3Kwnnae8PfnYBMV4plN63SsIs8p zX0rt3KJODynkk8M01H59GaW2Cxp+BaQ4ztBvVQWgoaNG8smQ2bF0LPTZArbiA== X-Gm-Gg: AYBFou1T8/Hcn7cE3jrPbL4jhgTZGfcKZc5z01osgPkypcX4ApDNJZae6XHrET2mD9W JNri7YdDcCh6Sl9ZjpgFx4AkBh6hUgFf98UkyhEbjVCCAAfmOqwDv32W1WHq3XoSHALx42RbrsG GGpe8MTwXtcfqU9iWaxCsnzwqJxQE6CvBe/AhfkX+OP3K9KduA2Ra1hL+r2PMg+ods8WwD1Nmxv /j/43fULzPC7PS8BUWawTNcpodd7fxY2wCAKzI95xQXuzTKLkQyBrV8cb398xpjJNixw/Ap2jwi uP84rA78C4gIS0ZI6ftosvr/VK4XNLR+9FIUnDp1HE0Xmwl0zck6nK5xIrzBAO1e+59mmDodkqI 4sccKOpSpaIFWXD0J6ZGTgumXGc2QGRUv5LEl3PpICXadt4+dowfAAczytEF/+4+Lgk+j8oMi6C hTfjnThp2/rBD3KYLjySxabNcREDUMTtRQEz0bna/WH0l+ro7jX2sw3+EprzQE1pSNXlAYKoCsX y4OpRfpzsd5EqxbkPIquSQ= X-Received: by 2002:a17:902:cf0a:b0:2e8:b5af:22e0 with SMTP id d9443c01a7336-2e8b5af2c29mr97672655ad.41.1792043136562; Wed, 14 Oct 2026 22:45:36 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.34 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:36 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 78/82] tesseract: patch CVE-2026-88051 Date: Thu, 15 Oct 2026 18:42:06 +1300 Message-ID: <9ca7f33f69826ac0ebec288801cd0a3ffc1f2144.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130998 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88051 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 727354dae2ee3075ad388bcfe22156ab1ea6fcf5) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88051.patch | 184 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 185 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch new file mode 100644 index 0000000000..1956d49672 --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch @@ -0,0 +1,184 @@ +From 79bf602b0cd5216c125f86eaf3c768daae256930 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 20:29:37 +0200 +Subject: [PATCH] Validate vector counts in GenericVector::read + +The callback form of GenericVector::read read two independent int32 +fields from the file: reserved sized the allocation via reserve(), +while size_used_ drove the element loop. Neither was capped and no +size_used_ <= reserved invariant was checked, so a crafted +.traineddata (e.g. the fontinfo table of a version >= 4 inttemp +component) performed a heap out-of-bounds write during legacy +engine initialization. + +Key changes: +- genericvector.h: reject negative or over-limit reserved + (matching the 50000000 cap of the DeSerialize overloads) and + reject size_used_ < 0 or size_used_ > reserved before entering + the read loop. Legit files always satisfy size_used_ <= reserved, + as write() persists size_reserved_ first. +- unittest: add genericvector_test covering size_used_ beyond + reserved (on unpatched code the ASan build dies on a + heap-buffer-overflow in the read loop), negative counts, and a + consistent vector that must still load. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 56e09ca12e751623fe796ce1554ce704bffd2ef0) + +CVE: CVE-2026-88051 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/56e09ca12e751623fe796ce1554ce704bffd2ef0] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/ccutil/genericvector.h | 10 ++++ + unittest/genericvector_test.cc | 91 ++++++++++++++++++++++++++++++++++ + 3 files changed, 106 insertions(+) + create mode 100644 unittest/genericvector_test.cc + +diff --git a/Makefile.am b/Makefile.am +index cc748455..c67f0f63 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1159,6 +1159,7 @@ check_PROGRAMS += equationdetect_test + endif # !DISABLED_LEGACY_ENGINE + check_PROGRAMS += fileio_test + check_PROGRAMS += fullyconnected_test ++check_PROGRAMS += genericvector_test + check_PROGRAMS += heap_test + check_PROGRAMS += imagedata_test + if !DISABLED_LEGACY_ENGINE +@@ -1298,6 +1299,10 @@ fullyconnected_test_SOURCES = unittest/fullyconnected_test.cc + fullyconnected_test_CPPFLAGS = $(unittest_CPPFLAGS) + fullyconnected_test_LDADD = $(TESS_LIBS) + ++genericvector_test_SOURCES = unittest/genericvector_test.cc ++genericvector_test_CPPFLAGS = $(unittest_CPPFLAGS) ++genericvector_test_LDADD = $(TESS_LIBS) ++ + heap_test_SOURCES = unittest/heap_test.cc + heap_test_CPPFLAGS = $(unittest_CPPFLAGS) + heap_test_LDADD = $(TESS_LIBS) +diff --git a/src/ccutil/genericvector.h b/src/ccutil/genericvector.h +index 4a5bbe12..cbe1e203 100644 +--- a/src/ccutil/genericvector.h ++++ b/src/ccutil/genericvector.h +@@ -654,10 +654,20 @@ bool GenericVector::read(TFile *f, const std::function &c + if (f->FReadEndian(&reserved, sizeof(reserved), 1) != 1) { + return false; + } ++ // Arbitrarily limit the number of elements to protect against bad data. ++ const uint32_t limit = 50000000; ++ if (reserved < 0 || static_cast(reserved) > limit) { ++ return false; ++ } + reserve(reserved); + if (f->FReadEndian(&size_used_, sizeof(size_used_), 1) != 1) { + return false; + } ++ // size_used_ is an independent file field; without this check the reads ++ // below land past the end of the buffer sized from reserved. ++ if (size_used_ < 0 || size_used_ > reserved) { ++ return false; ++ } + if (cb != nullptr) { + for (int i = 0; i < size_used_; ++i) { + if (!cb(f, data_ + i)) { +diff --git a/unittest/genericvector_test.cc b/unittest/genericvector_test.cc +new file mode 100644 +index 00000000..269b00f0 +--- /dev/null ++++ b/unittest/genericvector_test.cc +@@ -0,0 +1,91 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: genericvector_test.cc ++// Description: Tests that the callback form of GenericVector::read ++// rejects vectors whose size_used_ exceeds reserved (or ++// whose counts are negative). reserved sizes the buffer ++// while size_used_ is an independent file field driving ++// the element loop, so a crafted .traineddata (e.g. the ++// fontinfo table of a version >= 4 inttemp component) ++// performs a heap out-of-bounds write during legacy ++// engine initialization. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include "genericvector.h" ++#include "serialis.h" // for TFile ++ ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutS32(int32_t v) { ++ uint32_t u = static_cast(v); ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((u >> (8 * i)) & 0xFF)); ++ } ++ } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++// A serialized vector header (reserved, size_used_) followed by the ++// given number of int32 elements. ++std::vector MakeVector(int32_t reserved, int32_t size_used, int32_t num_elements) { ++ ByteWriter w; ++ w.PutS32(reserved); ++ w.PutS32(size_used); ++ for (int32_t i = 0; i < num_elements; ++i) { ++ w.PutS32(i); ++ } ++ return w.data(); ++} ++ ++// reserved=4 but size_used_=0x10000: on unpatched code the callback ++// loop writes 65536 ints past the 4-int buffer (heap out-of-bounds ++// write). ++TEST(GenericVectorTest, RejectsSizeUsedBeyondReserved) { ++ std::vector bytes = MakeVector(4, 0x10000, 0x10000); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ GenericVector v; ++ EXPECT_FALSE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); })); ++} ++ ++// Negative counts must be rejected; on unpatched code the read ++// "succeeds" and leaves size_used_ negative. ++TEST(GenericVectorTest, RejectsNegativeCounts) { ++ std::vector bytes = MakeVector(-1, -1, 0); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ GenericVector v; ++ EXPECT_FALSE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); })); ++} ++ ++// A consistent vector must still be accepted. ++TEST(GenericVectorTest, AcceptsConsistentVector) { ++ std::vector bytes = MakeVector(4, 2, 2); ++ TFile fp; ++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size())); ++ GenericVector v; ++ ASSERT_TRUE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); })); ++ EXPECT_EQ(v.size(), 2); ++ EXPECT_EQ(v[0], 0); ++ EXPECT_EQ(v[1], 1); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index 25d357d903..be6ec1e463 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88049.patch \ file://CVE-2026-88050.patch \ file://CVE-2026-88047.patch \ + file://CVE-2026-88051.patch \ " DEPENDS = "leptonica" From patchwork Thu Oct 15 05:42:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100876 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3C27CC6B3B for ; Thu, 15 Oct 2026 05:45:40 +0000 (UTC) Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32873.1792043139984825332 for ; Wed, 14 Oct 2026 22:45:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=o5GHzJ9T; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2d6e954afbdso8094435ad.2 for ; Wed, 14 Oct 2026 22:45:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043139; x=1792647939; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Ug9eKCO58Y4VLl98m5Gdv4zQb9sK2CAyt5HE5vVxfgI=; b=o5GHzJ9TuPbTcc+MZsYNfFE9+rstoN4Gt19kjBHYA2FyV3BWeKFBO31h1OkN58Yl2s iDX9hZLj3Rt6b2aPRh5L4y7BD88gOnzhCwE3X5Cg28m3Rs580+nfw8Gfub15sY+c1RWv XmOs7fZlsg0gmEkDsLZqMqfSFe+E/ZbDzyAu53Xkhrgwh7uvQT3VfIulqcOI2UqXPpfX yzSy4RJzu8GZP+BUz+WRTm+oAqihBncRYdleI00K8KhkLS5LtAp6zwIgubkO+BeShK9Q v/vncLAIKHdYleMLrBBfyC1xKB0yvwNDUr/i6LAvTUvQMpRuvXoLcHTeXuSIPVGCwWPt 2Cww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043139; x=1792647939; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Ug9eKCO58Y4VLl98m5Gdv4zQb9sK2CAyt5HE5vVxfgI=; b=cIyMT4Ds0SV571pDU2GFpkNDG0Ixg+DEmpYvarM06L+EB2cZpvtlyt7V6WEcBYg/70 K6/tQ9iBu2i7w+2QUCj3LRSbi3EFzxHayCUrNzBjflg55CW2CKrn/JnmwtM7t3RyCVvZ wTX3dRBWcBGmAmp5evzjxqbz93a93CVi8Qj+UYABnLKsTkkJtg/Qk2E9BLdRIn07lCKn vnG7oVSkSOxijqtLdGHyrTzSJ7DD3VIHlDTlI8TJH6KTFlIiAGeCL+sNX0Nc8pP3uWiB 6vPJcqCjxVj6RVKfnEOZ/ReRxHX0PAQVP8Xk7D5G7TOxxbGn8iD7wnQ1avVWotyfJASP KoZA== X-Gm-Message-State: AFq9FYIKVggKAsqHxjhTbFl2sT2bDMZCHzC7zJy1CNUtOA/zD435URYn HOFX7FcHjeTKMGdi1iYNZFkXgOSVlcfkJkWFKLR2uvCJhKfGxHddV8ddx/gyDw== X-Gm-Gg: AYBFou1n8LsvTK23S3O/r557GyClr146UpCBqQUkKWDOOWdfut7KAwwwr9YOn5d32qR Wy2uRW++htwxrI9p+OzKuS1q0NLrRpshPH5s1FJWW2HUhVL//SbPp9HPWXwxrgOHafqPk3dmEzb gTVS+8p7RWjWZ1OcMU01+OUwpnQMfVqTwLf52F4awK8aigf7CljWSCLXLbK7ELW1f/UWcAp1+8i HlLpCZ08dZzu4JKMTcPTpI8PzZ0nrmuFJaIjxwmhKqwrW4H2/zyymEVF8o0X27RcoD9769CLqxq C0n1jTJUvNEIwlxialcaqAD+5JbSAMsvHr1CQW42+DqOXdbkotd0Oz5Zfkkc5V6V8LIOQi+txwA N3gPHRCbM19cWi06KTgyyuSjHVYUtJ5/gMAl6FKAuU0sOBWGfnV4OpATNhRNm3hU2Wj+W8mnLuC C/N1nhDVZuZ1fEhmjebQlaWUB2+TamdhfQLjTYx1fQFfB+0fVTQcRQ7oRKUrEjUM3cKpbgwv1vm RTLh+3UD2WXn6LrQdIrCsA= X-Received: by 2002:a17:902:dacd:b0:2d9:56dd:f804 with SMTP id d9443c01a7336-2e842ab8e10mr157932375ad.13.1792043139102; Wed, 14 Oct 2026 22:45:39 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.36 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:38 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 79/82] tesseract: patch CVE-2026-88054 Date: Thu, 15 Oct 2026 18:42:07 +1300 Message-ID: <68a702ac5dde65111b6d03fbaa8555e1e9697254.1791945956.git.ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130999 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-88054 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 4c00053135fb03b6043c960dc96a839b675f7eec) Signed-off-by: Ankur Tyagi --- .../tesseract/tesseract/CVE-2026-88054.patch | 274 ++++++++++++++++++ .../tesseract/tesseract_5.5.3.bb | 1 + 2 files changed, 275 insertions(+) create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch new file mode 100644 index 0000000000..32e70c0f6f --- /dev/null +++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch @@ -0,0 +1,274 @@ +From 83bbac0975f52a5171776fddcc800a2aaa5206a3 Mon Sep 17 00:00:00 2001 +From: Stefan Weil +Date: Fri, 21 Aug 2026 14:38:55 +0200 +Subject: [PATCH] Reject empty network stacks in LSTM .traineddata + deserialization + +Plumbing::DeSerialize read the network stack size from the untrusted +TESSDATA_LSTM component and only rejected size > 10000. A crafted +.traineddata with a top-level Series/Parallel/Reversed layer with an +empty stack survived load; LSTMRecognizer initialization then called +network_->CacheXScaleFactor(network_->XScaleFactor()), which +dereferences stack_[0] on the empty vector: +- Series: Series::CacheXScaleFactor (series.cpp) +- Parallel/Reversed: inherited Plumbing::XScaleFactor +The virtual call through the wild pointer crashed the process at +initialization (deterministic denial of service). + +Key changes: +- plumbing.cpp: reject size == 0 for all plumbing types, and + size < 2 for NT_SERIES (Series::Forward requires two or more + networks and always aborts on one). +- tessedit.cpp: fail the language load gracefully when the LSTM model + cannot be loaded, instead of aborting via ASSERT_HOST, so + TessBaseAPI::Init returns -1 on corrupt traineddata. +- unittest: add plumbing_test, which builds a minimal traineddata + with empty/undersized LSTM plumbing stacks and expects a graceful + init failure. On unpatched code the tests die on the original + SEGV in Series::CacheXScaleFactor / Plumbing::XScaleFactor. + +Reported-by: Zhixi "Jace" Sun +Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud) +Signed-off-by: Stefan Weil +(cherry picked from commit 552771236b0d80cbdb0c7dd856120fa21a4672e5) + +CVE: CVE-2026-88054 +Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/552771236b0d80cbdb0c7dd856120fa21a4672e5] +Signed-off-by: Ankur Tyagi +--- + Makefile.am | 5 ++ + src/ccmain/tessedit.cpp | 7 +- + src/lstm/plumbing.cpp | 6 ++ + unittest/plumbing_test.cc | 165 ++++++++++++++++++++++++++++++++++++++ + 4 files changed, 182 insertions(+), 1 deletion(-) + create mode 100644 unittest/plumbing_test.cc + +diff --git a/Makefile.am b/Makefile.am +index c67f0f63..a6ee0931 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -1198,6 +1198,7 @@ if ENABLE_TRAINING + check_PROGRAMS += pango_font_info_test + endif # ENABLE_TRAINING + check_PROGRAMS += paragraphs_test ++check_PROGRAMS += plumbing_test + if !DISABLED_LEGACY_ENGINE + check_PROGRAMS += params_model_test + endif # !DISABLED_LEGACY_ENGINE +@@ -1427,6 +1428,10 @@ paragraphs_test_SOURCES = unittest/paragraphs_test.cc + paragraphs_test_CPPFLAGS = $(unittest_CPPFLAGS) + paragraphs_test_LDADD = $(TESS_LIBS) + ++plumbing_test_SOURCES = unittest/plumbing_test.cc ++plumbing_test_CPPFLAGS = $(unittest_CPPFLAGS) ++plumbing_test_LDADD = $(TESS_LIBS) ++ + if !DISABLED_LEGACY_ENGINE + params_model_test_SOURCES = unittest/params_model_test.cc + params_model_test_CPPFLAGS = $(unittest_CPPFLAGS) +diff --git a/src/ccmain/tessedit.cpp b/src/ccmain/tessedit.cpp +index 7ec89bd9..722ed09b 100644 +--- a/src/ccmain/tessedit.cpp ++++ b/src/ccmain/tessedit.cpp +@@ -169,7 +169,12 @@ bool Tesseract::init_tesseract_lang_data(const std::string &language, OcrEngineM + #endif // ndef DISABLED_LEGACY_ENGINE + if (mgr->IsComponentAvailable(TESSDATA_LSTM)) { + lstm_recognizer_ = new LSTMRecognizer(language_data_path_prefix.c_str()); +- ASSERT_HOST(lstm_recognizer_->Load(this->params(), lstm_use_matrix ? language : "", mgr)); ++ if (!lstm_recognizer_->Load(this->params(), lstm_use_matrix ? language : "", mgr)) { ++ delete lstm_recognizer_; ++ lstm_recognizer_ = nullptr; ++ tprintf("Error: Failed to load the LSTM model from %s\n", tessdata_path.c_str()); ++ return false; ++ } + } else { + #ifdef DISABLED_LEGACY_ENGINE + // The legacy engine is compiled out, so we cannot fall back to it. +diff --git a/src/lstm/plumbing.cpp b/src/lstm/plumbing.cpp +index f0133148..15cf3d62 100644 +--- a/src/lstm/plumbing.cpp ++++ b/src/lstm/plumbing.cpp +@@ -226,6 +226,12 @@ bool Plumbing::DeSerialize(TFile *fp) { + if (size > 10000) { + return false; + } ++ // Reject empty stacks: XScaleFactor, CacheXScaleFactor and other methods ++ // unconditionally dereference stack_[0] during network initialization. ++ // A Series needs at least two networks (see Series::Forward). ++ if (size == 0 || (type() == NT_SERIES && size == 1)) { ++ return false; ++ } + for (uint32_t i = 0; i < size; ++i) { + Network *network = CreateFromFile(fp); + if (network == nullptr) { +diff --git a/unittest/plumbing_test.cc b/unittest/plumbing_test.cc +new file mode 100644 +index 00000000..27486f86 +--- /dev/null ++++ b/unittest/plumbing_test.cc +@@ -0,0 +1,165 @@ ++/////////////////////////////////////////////////////////////////////// ++// File: plumbing_test.cc ++// Description: Tests that a corrupt TESSDATA_LSTM component in a ++// .traineddata file is rejected without crashing. A ++// plumbing layer (Series/Parallel/Reversed) with an ++// empty or undersized network stack would make ++// XScaleFactor/CacheXScaleFactor dereference stack_[0] ++// during engine initialization. ++// ++// Licensed under the Apache License, Version 2.0 (the "License"); ++// you may not use this file except in compliance with the License. ++// You may obtain a copy of the License at ++// http://www.apache.org/licenses/LICENSE-2.0 ++// ++/////////////////////////////////////////////////////////////////////// ++ ++#include "include_gunit.h" ++ ++#include ++ ++#include "network.h" // for NetworkType ++#include "tessdatamanager.h" // for TessdataManager, TESSDATA_LSTM ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++namespace tesseract { ++namespace { ++ ++// Minimal unicharset with the special codes (space, Joined, Broken) that ++// UNICHARSET::load_from_file expects, as embedded in the TESSDATA_LSTM ++// component by LSTMRecognizer::Serialize. ++const char kMinUnicharset[] = ++ "3\n" ++ "NULL 0 NULL 0\n" ++ "Joined 7 0,69,188,255,486,1218,0,30,486,1188 Latin 26 0 98 Joined\n" ++ "|Broken|0|1 f 0,69,186,255,892,2138,0,80,892,2058 Common 84 10 84 |Broken|0|1\n"; ++ ++// Appends raw little-endian values to a byte buffer. ++class ByteWriter { ++public: ++ void PutU8(uint32_t v) { data_.push_back(static_cast(v & 0xFF)); } ++ void PutU32(uint32_t v) { ++ for (int i = 0; i < 4; ++i) { ++ data_.push_back(static_cast((v >> (8 * i)) & 0xFF)); ++ } ++ } ++ void PutS32(int32_t v) { PutU32(static_cast(v)); } ++ void PutString(const char *s) { ++ PutU32(static_cast(std::strlen(s))); ++ data_.insert(data_.end(), s, s + std::strlen(s)); ++ } ++ void PutRaw(const char *s) { data_.insert(data_.end(), s, s + std::strlen(s)); } ++ const std::vector &data() const { return data_; } ++ ++private: ++ std::vector data_; ++}; ++ ++// Serialized network header as written by Network::Serialize: ++// int8 type, int8 training, int8 needs_to_backprop, int32 network_flags, ++// int32 ni, int32 no, int32 num_weights, string name. ++void AppendNetworkHeader(ByteWriter *w, NetworkType type) { ++ w->PutU8(static_cast(type)); ++ w->PutU8(0); // training: TS_DISABLED ++ w->PutU8(0); // needs_to_backprop ++ w->PutU32(0); // network_flags ++ w->PutU32(0); // ni ++ w->PutU32(0); // no ++ w->PutU32(0); // num_weights ++ w->PutString(""); // name ++} ++ ++// A minimal valid child network (NT_INPUT with a 1x1x1x1 shape). ++void AppendInputChild(ByteWriter *w) { ++ AppendNetworkHeader(w, NT_INPUT); ++ w->PutS32(1); // batch ++ w->PutS32(1); // height ++ w->PutS32(1); // width ++ w->PutS32(1); // depth ++ w->PutS32(0); // loss type ++} ++ ++// Builds a TESSDATA_LSTM component whose top-level network is a plumbing ++// layer of the given type with the given (corrupt) stack size, followed by ++// the remaining fields of LSTMRecognizer::DeSerialize. ++std::vector MakeLstmComponent(NetworkType type, uint32_t stack_size) { ++ ByteWriter w; ++ AppendNetworkHeader(&w, type); ++ w.PutU32(stack_size); // Plumbing::DeSerialize reads this as uint32 ++ for (uint32_t i = 0; i < stack_size; ++i) { ++ AppendInputChild(&w); ++ } ++ w.PutRaw(kMinUnicharset); // unicharset (raw text, no recoder/unicharset components) ++ w.PutString(""); // network_str_ ++ w.PutS32(0); // training_flags_ ++ w.PutS32(0); // training_iteration_ ++ w.PutS32(0); // sample_iteration_ ++ w.PutS32(0); // null_char_ ++ w.PutU32(0); // adam_beta_ (float 0.0) ++ w.PutU32(0); // learning_rate_ (float 0.0) ++ w.PutU32(0); // momentum_ (float 0.0) ++ return w.data(); ++} ++ ++// Writes a traineddata file with the given (corrupt) LSTM component to ++// dir/eng.traineddata. ++bool WriteCorruptTraineddata(const std::string &dir, const std::vector &lstm) { ++ TessdataManager mgr; ++ mgr.OverwriteEntry(TESSDATA_LSTM, lstm.data(), static_cast(lstm.size())); ++ return mgr.SaveFile((dir + "/eng.traineddata").c_str(), nullptr); ++} ++ ++class PlumbingTest : public testing::Test { ++protected: ++ void SetUp() override { ++ tmpl_ = "/tmp/tess_plumbing_test_XXXXXX"; ++ char *dir = mkdtemp(tmpl_.data()); ++ ASSERT_NE(dir, nullptr); ++ dir_ = dir; ++ } ++ void TearDown() override { ++ std::remove((dir_ + "/eng.traineddata").c_str()); ++ rmdir(dir_.c_str()); ++ } ++ // Expects the LSTM engine to reject the corrupted traineddata ++ // gracefully (init failure) instead of crashing. ++ void ExpectInitFails(const std::vector &lstm) { ++ ASSERT_TRUE(WriteCorruptTraineddata(dir_, lstm)); ++ tesseract::TessBaseAPI api; ++ EXPECT_EQ(api.Init(dir_.c_str(), "eng", tesseract::OEM_LSTM_ONLY), -1); ++ } ++ std::string dir_; ++ std::string tmpl_; ++}; ++ ++// Empty NT_SERIES stack: Series::CacheXScaleFactor would dereference ++// stack_[0] on the empty vector during initialization. ++TEST_F(PlumbingTest, RejectsEmptySeriesStack) { ++ ExpectInitFails(MakeLstmComponent(NT_SERIES, 0)); ++} ++ ++// Empty NT_PARALLEL stack: Plumbing::XScaleFactor would dereference ++// stack_[0] on the empty vector during initialization. ++TEST_F(PlumbingTest, RejectsEmptyParallelStack) { ++ ExpectInitFails(MakeLstmComponent(NT_PARALLEL, 0)); ++} ++ ++// Empty NT_XREVERSED stack: same crash as the parallel case. ++TEST_F(PlumbingTest, RejectsEmptyReversedStack) { ++ ExpectInitFails(MakeLstmComponent(NT_XREVERSED, 0)); ++} ++ ++// A Series with a single network: Series::Forward requires at least two ++// networks, so such a model can never work. ++TEST_F(PlumbingTest, RejectsSingleNetworkSeries) { ++ ExpectInitFails(MakeLstmComponent(NT_SERIES, 1)); ++} ++ ++} // namespace ++} // namespace tesseract diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb index be6ec1e463..c96aca1dde 100644 --- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb +++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb @@ -13,6 +13,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag file://CVE-2026-88050.patch \ file://CVE-2026-88047.patch \ file://CVE-2026-88051.patch \ + file://CVE-2026-88054.patch \ " DEPENDS = "leptonica" From patchwork Thu Oct 15 05:42:08 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100878 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DFD87CC6B2F for ; Thu, 15 Oct 2026 05:45:50 +0000 (UTC) Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32874.1792043141821927505 for ; Wed, 14 Oct 2026 22:45:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=hycAaxvk; spf=pass (domain: gmail.com, ip: 209.85.214.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2e831e86ebfso9646305ad.1 for ; Wed, 14 Oct 2026 22:45:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043141; x=1792647941; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=JI5SPv4Mgvuqc1EQWVSgRUqv2OsgGWNzaQr9ubcQptE=; b=hycAaxvkNg2arM+DRjW7/vkoN38WeLsH5u00HhskCXx8w3ixniGPbAqdr2xJbP4ziC qJWW0Us/z6hW2ag8FpYlVA5Ns+GackrRHpw8QIAKIVfUoopZCv2LZvQ7vSW2MsvTqD6c SGZz56vR5+gZfuflotZSvo2EYb5wQEkieoy5e6yG1N6LmuVgCW/YACJKT/9FP6xdX/kx LH+aERSCrCMpk1F2cMrXktshfS2QsDApCA93hC7P7Jim4Th/dVbtshhqlyEEBHPZhscU gJEG4g3vWsSkRPe/Vn+yO5DaALKPkCmiIsAtBB4V+spyGY6ZCLXfyEJ5ZwNbB7c8CkkA MP3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043141; x=1792647941; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=JI5SPv4Mgvuqc1EQWVSgRUqv2OsgGWNzaQr9ubcQptE=; b=HmFKsLZ/pJDoWvbESUUd8dIQ+WxUYbc9PbtB+Zf/pXHB0lg5HDwOevgj57th933q66 oUls3OhE0XY8W5A8xHox8/KGNYrA15X27XniwgsD8lUyTQ7cwowzt7KhNPEa2FMw12Zs rbgSybff7DVO7qXP+tn74QOnX+2k73gpMDJhHyVSCny71T6k+mQv1IjZU8DzhiwJY9L5 +BgsgNHRs59FXSIdd934yjok9J8KmX4eMdWnzLYeLwQZfS8sNDDZJtSvhTkUC47nHU1u LCsIVy/kgMmG3h8wOwkjRqwlnWYo8zqToBf95Q6KvGZxz7pIcMt4uW60AuokqUd7Eg9A Ar2g== X-Gm-Message-State: AFq9FYIyCW+sJxnImkKtizCry6BbIjp4naoIPhBN8L9AeIdjsxQF5cj8 cofxhn0ElDITXlW1BejiLy//qzxQEPUUzU4J4OmszuAXLxsHPuHxkDjQZxUSsQ== X-Gm-Gg: AYBFou22gDBd5NwAu09hwOazMKKpjYQePi49BE+WYMOPXLhMECQ/sNMMyHzl9Sut6pI esN9REdTRz9Df4Qq0KRu2kX8xc/uPr1PpJ8rtoOYFLZBpw4l5e2aVjiCS9t2qb58d8qm5M8TbsE j6EjWj4l3ml+80Evi4l+OApfmwCYt7ramdsZR9A1VNd8tQEYI86SuFEwUMcSoo2x+4WbPS6KnH8 qFB7jN2Y/QjwTCjpGxSmDMtvp24kM6kF60KtngT5/PADQtfYvtizvkpeNkB5rMM8WCeFG26iRRp 99/L66GqfBbSBt+m+vRe2mWEHZ4Z1TefIIySpgicw+gZn37dWGxqny8OezyuhTiXEYnwcDrqsdQ rYNpYgu9wvozGlR8G9BnXkHfQk9CQ3efKHd59ngqliE11IhG3HqPMMwPdcz2KBBBQLwsTGcweEA wmfeKM8mu4beeAzDPk+7dO2jIlf8k8ln9u1OJbiKNnTSPSMxxJkravhnIc2JBEpMMkan+lCX7tL udaH3M6H8jp3Z28dIGhOCPGcw== X-Received: by 2002:a17:903:a8f:b0:2e6:20fa:b414 with SMTP id d9443c01a7336-2e842cfbc14mr159658075ad.45.1792043141054; Wed, 14 Oct 2026 22:45:41 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:40 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 80/82] gpsd: patch CVE-2026-60122 Date: Thu, 15 Oct 2026 18:42:08 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131000 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-60122 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit da527bb6ba21025da9ff5eafc758156d659f6c9f) Signed-off-by: Ankur Tyagi --- .../gpsd/gpsd/CVE-2026-60122.patch | 45 +++++++++++++++++++ .../recipes-navigation/gpsd/gpsd_3.27.5.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch new file mode 100644 index 0000000000..da8fa5f4d2 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch @@ -0,0 +1,45 @@ +From 50bf98d0240b94bbec6ce06be33cdaf99e2f6214 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Mon, 20 Jul 2026 20:12:16 -0700 +Subject: [PATCH] clients/gpsprof.py.in: ensure sats.used is boolean. Issue + 406 + +Prevfent command injection by sates.used. Force to boolean. + +(cherry picked from commit 5a9c44a42136b9bb98d460a8a716e9fd344a8d93) + +CVE: CVE-2026-60122 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index e91367ee3..07123d417 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -334,8 +334,11 @@ class spaceplot(plotter): + # get sat used count + sats_used = 0 + for sat in self.session.satellites: +- if sat.used: ++ if sat.used is True: + sats_used += 1 ++ else: ++ # ensure it is boolean. ++ sat.used = False + + if 'altHAE' not in self.session.data: + self.session.data['altHAE'] = gps.NaN +@@ -783,6 +786,10 @@ class polarplot(plotter): + used += 1 + if 'polarunused' == self.name: + continue ++ else: ++ # ensure it is boolean. ++ sat['used'] = False; ++ + if (('polarused' == self.name and + sat['used'] is False)): + continue diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb index 52d86503a1..2bb70aca46 100644 --- a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb +++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb @@ -11,6 +11,7 @@ SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \ file://CVE-2026-58459-1.patch \ file://CVE-2026-58459-2.patch \ file://CVE-2026-58459-3.patch \ + file://CVE-2026-60122.patch \ file://gpsd.init \ " SRC_URI[sha256sum] = "409873f5048462ef1ac413a51ab35caa8b50b31be62b3347bee1cc2994e7c649" From patchwork Thu Oct 15 05:42:09 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100879 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2324CC6B39 for ; Thu, 15 Oct 2026 05:45:50 +0000 (UTC) Received: from mail-pl1-f174.google.com (mail-pl1-f174.google.com [209.85.214.174]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.33284.1792043143682757557 for ; Wed, 14 Oct 2026 22:45:43 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=HUceQUSu; spf=pass (domain: gmail.com, ip: 209.85.214.174, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2e82462a3f1so9771395ad.3 for ; Wed, 14 Oct 2026 22:45:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043143; x=1792647943; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=FF3VdqW/SLEoZqSMcWv0EcoTA/jQYH8gb2/wzSxnO2U=; b=HUceQUSuBlrloR/ULYXHWJ4zcuRckZ4eKxl2Qrmjxzc87TiLN4ZZbpNt1aEwsaM6/C h3eOrsD7k1jk3WsoNtNdWXnYMZUvHIRKnajzCrHF0uvAlzUpT4nZKIVqUVza30WekO3v hguJ5QZANWaldJZTg95DdSnt/LmD/QkW1cx9KbTlgDyG0X4lWwYAaaF4fdUupbOGwuar KHBRd3ECBIwWcc0oNcNVlkWCaTUaRORPvSs+Nv2gxWFfnQ5w71tQqU50HFYCQVXnKw3a iCR4rRZ3Cclc2TVhdWPa0ni3QxxhRbJERhN0EQEAcjK+FQmp7rhqZnc37ePkRwegFUO/ 9rlg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043143; x=1792647943; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=FF3VdqW/SLEoZqSMcWv0EcoTA/jQYH8gb2/wzSxnO2U=; b=HM8qlYxDuPsErq+TKkX4Oq//fcEJpJVF+J+WASZCjHflNr2pIkaWbO8EkP2ksoaKgK YWlIoc/fpBSZ+L/PNQSHN8FBVTLZtD4RzqB4xCR+RHaNo+RlMW6Zo/GK9SBXQ4H9RkEf Zpn7vDNPmo3HQfKeEpXUND68EUiq58Ca1EdH2RbsEFDiJ2oz/WYYFsjq7OaNZpI4WicK +hEM0lzgvt1vuUwTo4CDP7uQTv+lvR8+X4zh0Sztb4afJV8bZ6PPjb2zRMvUvyz+ctP1 boqJQ6ZXWGNZCoDRu1WilEMRAjPtIDkZYoDY3EtCveWAgUCToEyyT+UZfe54YrfXat35 ANMQ== X-Gm-Message-State: AFq9FYLIuXr+dq3K2rWrhQQ38ldbmL7tbPdsL6yYeA65xlhN3t4ILTpq vqgYCZPAizExgIRlXAoGSu5EyDTW2np7ZdDChEO680WTBbSrakjAKEqHyHKs5Q== X-Gm-Gg: AYBFou3cLQ0STnMONd9jdbdARpq9Whkv+Lxnhi1qV2YFiJ9aolGFlHOjka2ub36QDoR 1zkOWoG2XYPKRX69gdBWedulRhILVr8xhr9wQVWGfeniKbo5o3nHSVDm3pscPYyNK1FlglNKDLF NrxlOQrNbnElSm4P+/gmGxT51QB4K7vnTr2ZzNOcNPhWaNWuZfi9MXGHtMtE6L1LYuEewRbaRB2 gdRVUIKiRp6Gpq4+boxJ2iV6B/IITDXvSJjjC5JeujfXlzqDsIFrIHr8p04g1we71sqFaM0kBui p8cVnmPq2JKchq1YjRO5pjc69/1S3ZExXzh++TJ3msep0amPEogOhqirRJsSYurifvpDSU5MW6B B+CntjTQAoTXfctPlR5ongD5xAA60CrCcYoMtoIVqoo3u4HkO777JNSSgfKhtwISyxXvWOhPb11 m1SQ93odko/SWiSr4muqs+9O8ILB5IX5ZBPY0dscBCwgumqiilnNpkVKnGBLwXo/qvy8clK+4a3 zyobqqedvGarpvyvGE4X/M= X-Received: by 2002:a17:902:e88f:b0:2dd:ad74:ac29 with SMTP id d9443c01a7336-2e842ac8b20mr168493205ad.27.1792043143002; Wed, 14 Oct 2026 22:45:43 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.41 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:42 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 81/82] apache2: fix build with OpenSSL 4 Date: Thu, 15 Oct 2026 18:42:09 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131001 From: Markus Volk ASN1_STRING is opaque in OpenSSL 4, so mod_md fails to compile in md_ocsp.c. Backport the httpd 2.4.x commit that switches to the getter functions. The fix is part of httpd 2.4.69, which master gets through the upgrade. Upstream-Status: Backport [https://github.com/apache/httpd/commit/6cd9ea8dcb5bf68a195e90578c7f05e12eba5468] AI-Generated: Uses Claude Code (Claude Opus 5.5) Signed-off-by: Markus Volk --- ...mod_md-Add-OpenSSL-4.0-compatibility.patch | 47 +++++++++++++++++++ .../recipes-httpd/apache2/apache2_2.4.68.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta-webserver/recipes-httpd/apache2/apache2/0011-mod_md-Add-OpenSSL-4.0-compatibility.patch diff --git a/meta-webserver/recipes-httpd/apache2/apache2/0011-mod_md-Add-OpenSSL-4.0-compatibility.patch b/meta-webserver/recipes-httpd/apache2/apache2/0011-mod_md-Add-OpenSSL-4.0-compatibility.patch new file mode 100644 index 0000000000..ee127681ec --- /dev/null +++ b/meta-webserver/recipes-httpd/apache2/apache2/0011-mod_md-Add-OpenSSL-4.0-compatibility.patch @@ -0,0 +1,47 @@ +From 6cd9ea8dcb5bf68a195e90578c7f05e12eba5468 Mon Sep 17 00:00:00 2001 +From: Rainer Jung +Date: Wed, 17 Jun 2026 09:48:52 +0000 +Subject: [PATCH] mod_md: Add OpenSSL 4.0 compatibility + +* Use getters instead of direct member access. + +* Struct was made opaque in OpenSSL 4. Getters exist since OpenSSL 1.1.0. + +* Keep OpenSSL 1.0.2 compatibility. + +Merge from icing/md: +https://github.com/icing/mod_md/commit/9fd90380db0722f0ccc14ff1c4da0ca21d4da75c + +Backport of r1935161 from trunk, [mod_md CTR] + + +Upstream-Status: Backport [https://github.com/apache/httpd/commit/6cd9ea8dcb5bf68a195e90578c7f05e12eba5468] +--- +diff --git a/modules/md/md_ocsp.c b/modules/md/md_ocsp.c +index aee799a7b39..2e7f14dff31 100644 +--- a/modules/md/md_ocsp.c ++++ b/modules/md/md_ocsp.c +@@ -533,13 +533,23 @@ static const char *certid_summary(const OCSP_CERTID *certid, apr_pool_t *p) + serial = issuer = key = "???"; + OCSP_id_get0_info(&aname_hash, &amd_nid, &akey_hash, &aserial, (OCSP_CERTID*)certid); + if (aname_hash) { ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + data.len = (apr_size_t)aname_hash->length; + data.data = (const char*)aname_hash->data; ++#else ++ data.len = (apr_size_t)ASN1_STRING_length(aname_hash); ++ data.data = (const char*)ASN1_STRING_get0_data(aname_hash); ++#endif + md_data_to_hex(&issuer, 0, p, &data); + } + if (akey_hash) { ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + data.len = (apr_size_t)akey_hash->length; + data.data = (const char*)akey_hash->data; ++#else ++ data.len = (apr_size_t)ASN1_STRING_length(akey_hash); ++ data.data = (const char*)ASN1_STRING_get0_data(akey_hash); ++#endif + md_data_to_hex(&key, 0, p, &data); + } + if (aserial) { diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.68.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.68.bb index dc8c0df12d..f178007ab7 100644 --- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.68.bb +++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.68.bb @@ -16,6 +16,7 @@ SRC_URI = "${APACHE_MIRROR}/httpd/httpd-${PV}.tar.bz2 \ file://0008-Fix-perl-install-directory-to-usr-bin.patch \ file://0009-support-apxs.in-force-destdir-to-be-empty-string.patch \ file://0001-make_exports.awk-not-expose-the-path.patch \ + file://0011-mod_md-Add-OpenSSL-4.0-compatibility.patch \ " SRC_URI:append:class-target = " \ From patchwork Thu Oct 15 05:42:10 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100880 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17A87CC6B38 for ; Thu, 15 Oct 2026 05:45:51 +0000 (UTC) Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32875.1792043145530408329 for ; Wed, 14 Oct 2026 22:45:45 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=seWkyide; spf=pass (domain: gmail.com, ip: 209.85.214.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2e95bd1c14cso3278925ad.2 for ; Wed, 14 Oct 2026 22:45:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792043145; x=1792647945; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=oepr5rvGsFOP/ucaUJ6BleehzODGj89mYx1dg03XcFE=; b=seWkyide3/SI43UPHzxiR+OPAwuIIq9DW1JsiEiPEJKChPXNr6T/paQo95nKgJl6Jt inY6x+mhLh912TdipsIzNJx+Y49o4+QiTR3cURlrK2rpIK2CvmX2/ybBYQMzkgIEOHOo eDyBD0CaFb9kajf9FBXTFk5GdmWYfv7J1TeTYx9cjsywwCzHGlRCBSvRTMEituoezurZ HOJawxTFC1OLKSt+QpK3cl3I6/olBk13AwEKKxCkHG4OsN3qFf3L5M+uuvBsZFKzFjmV HzJbxvrlj6VhEvQYiSN87KDZ84xSkDDpwIk2xM6e7RMB+gGPqGpbngeVXoD+0g/wEqe7 e4bA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792043145; x=1792647945; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=oepr5rvGsFOP/ucaUJ6BleehzODGj89mYx1dg03XcFE=; b=qtVFmHrjjRDJ3kZSB2pIsWJCnDIQ9ti27dcy1EayhBoyKjzR2NoQGXa7Nco4mGBsRz kWbooiXRtCnFQQVElZejVoGwPSsU22ogjFeWKpocHs9XNwk8ZVeamYqb4J9ss/KeMB/e rUoKynpdj/olgUD/FIEW3Yq7F9N87hHQsKKEssadWfsPqno/mz9Mc1DQYnvDHNKZU+4V qGeI08EiEIHfqesbo4TlW/SSzRZ99LHR/ILQr7p5loAZlpWnkTD+Dxp3AFwghbgAIuqe B9A0Fvi6GpL4OQiWUED73z/0ffSysgBHg3BOILvKL20yjFLGw1/+1FleWd5wEvtDaVcb FJQg== X-Gm-Message-State: AFq9FYLWMIuwZ/zN64FMqAexezn6PGInC4PmAtwOcMFjMmznz6jnpXIX YtXY9CcBfUGPEKytEMon3UyB31iBzHmKc5isjtsdrgdkdu3ejMiYwctZbluKMQ== X-Gm-Gg: AYBFou26Wa3y0ys0GncbzZ1VtIeYVJJLWO0E4hJFl0OXwjI+TbXxdO6Vri3EvArTQcV qfH3b0V1F3BmuzMnYz2qHs+oPisasjjMud1k+Q2XIO9ftuFxOWLYW7iPQ5xj36b1pzATT2NcJLY au6vNyOHL6AIvzZHOreDPvdCMi0WqdMycnxy7nKxSBtVTDs95KOT0Z4hdQUSUHb2qZPQjT/Rnrj 5TF01MzDnOW4Om3dvjFRKZRqatKrgsJB7DJgnJcTypXGFjI7x5RbJz0dYXWanzck/IezGVWreY2 F86bDfA9++Eei0qr/pZFACv3XNevvPET3CANUFq4sp9dQZ2Cu0dxd3C1LqIjJnK7I7Wa/VBaeOJ bEJ+EMsg8rh5vbxh7uO/ncsFD3el6fGNw9FMKdYYiY150xzgdZkVoVOX4SDCajxZlUbj/NvbK7R 6oFnH2OHoRqLEJPkWJZfJPFuGfUicuRixtl/66gjn3ZriIQnapLomsoElFTkx4oe9ZcxbjAFR2U KwqvRBfGljZDUdXQVE+wZk= X-Received: by 2002:a17:903:46c8:b0:2df:9a7e:d41f with SMTP id d9443c01a7336-2e842e14a25mr159383355ad.41.1792043144823; Wed, 14 Oct 2026 22:45:44 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2e967875e58sm549125ad.36.2026.10.14.22.45.43 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 22:45:44 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Subject: [PATCH 82/82] lvgl-demo-fb: fix SRCREV Date: Thu, 15 Oct 2026 18:42:10 +1300 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 05:45:51 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131002 From: Ankur Tyagi Previous SRCREV does not belong to any branch on this repository and build fails with error: ERROR: lvgl-demo-fb-9.5.0+git-r0 do_fetch: Fetcher failure: Unable to find revision 045137cf0fa1781483cb796261a11b5eb21e99d9 in branch release/v9.5 even from upstream ERROR: lvgl-demo-fb-9.5.0+git-r0 do_fetch: Bitbake Fetcher Error: FetchError('Unable to fetch URL from any source.', 'git://github.com/lvgl/lv_port_linux_frame_buffer.git;protocol=https;branch=release/v9.5;name=demo') Signed-off-by: Ankur Tyagi --- meta-oe/recipes-graphics/lvgl/lvgl-demo-fb_9.5.0.bb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta-oe/recipes-graphics/lvgl/lvgl-demo-fb_9.5.0.bb b/meta-oe/recipes-graphics/lvgl/lvgl-demo-fb_9.5.0.bb index cd6441ded7..dc96b999f3 100644 --- a/meta-oe/recipes-graphics/lvgl/lvgl-demo-fb_9.5.0.bb +++ b/meta-oe/recipes-graphics/lvgl/lvgl-demo-fb_9.5.0.bb @@ -14,7 +14,7 @@ SRC_URI = "\ git://github.com/lvgl/lvgl;protocol=https;branch=release/v9.5;tag=v9.5.0;name=lvgl;subdir=${BB_GIT_DEFAULT_DESTSUFFIX}/lvgl \ " -SRCREV_demo = "045137cf0fa1781483cb796261a11b5eb21e99d9" +SRCREV_demo = "b0aeee00922fdd8f2c5e3409ce464a8f714cf919" SRCREV_lvgl = "85aa60d18b3d5e5588d7b247abf90198f07c8a63" SRCREV_FORMAT = "demo_lvgl" # The version check runs against the first SRC_URI (the demo repo), whose tags