From patchwork Thu Nov 12 04:44:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103806 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6929.1794458677166760557 for ; Wed, 11 Nov 2026 20:44:37 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=K01Zv6VT; spf=pass (domain: gmail.com, ip: 209.85.210.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-8b29b83fdf1so1763038b3a.2 for ; Wed, 11 Nov 2026 20:44:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458676; x=1795063476; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=h0FUFLEZTGzlWamemxAXdZY+ZtgQNv3UyFvsYDXcDYQ=; b=K01Zv6VT8r5o6lVsQUkSRfwtX0Qt0qCWUGysDVQqd6hySvHhEvSwuYvkcc3EN6OD4q hf2HyFyYnNuuMj9Il53chwZkBDzCISkF0kp/B6VJmWXuUvZS76337PRP18X+qGgkLgSn h1+iVbhCDuphkjFudlGkwx5DLMKk5rkU/IHqARvhCYigp5Ev5pmlKZ6WIlCsDb9G8YyG o0+Sh/E0C1RzyhGyHv8g+cQk/7WK50j/L/ryX2Ge01P5YMYDil1n+ajltIk3tQlaHLo/ uXa4QbKSvsheniQV5y4aJvKjJGUfLUaGdf8i2ppBemudnHs3zZ9ofYOa00YtNjzGAMEm eY7Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458676; x=1795063476; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=h0FUFLEZTGzlWamemxAXdZY+ZtgQNv3UyFvsYDXcDYQ=; b=lQCOeP+dptkM1Wiw2NX38xK4iBlY2jOy7BLfZxeg4LpDTg4goxWDe9yCUJu204XFAL dqF/wXETGIm4WxkXDwyhx8yu+vnon+vDtCEH29Lpj+5n9Xr8uGT/HDRBq8nOeQ1wI8yg mRo/6FLF/Z6geOAfZzePVy3IyjN3ccPqoYiFnywcEu7LVEGA4w9ONKMEz3wbYtj7J8Bt vyco+s1qbd+WkeCNjDQkQ2dl+sS/aUSn1ADr8FtCMaqmoKPgJxw9nexGp3pvxLZ8qKYi t4CWq5Ivi+N+EUlGGkpbzOnfob1K92ythIYp5zz104X/RwyEGmf1fZhMpRYg0XjrT7fN 4YBw== X-Gm-Message-State: APuU4Z/V+x6VFpBx/j96FqWobtZ/Ensff9KCcU46jh4zn2ullUcJg04w ldXGUysLWtJQZflzDwDRZJPGoBDR2WfCaKJkcV4CXSheQcQqLt6Co0tfnUma3g== X-Gm-Gg: AYBFou1dMNYkE+7yWKWjbBTOoRaBtnKm9W1GTHJpbMvKlRysv6aktSHNPPL1BuxXweR NRwqQc90yg776c67VQhzfiXl2mPR71RsYjNCTMnRorDAtWxQMT9EELbvvsKGh32EQUki1dpjWKa l7qE3HGor8tgKfG1vgwvoB+K0LzSdaIO8emam3jcesaa8hpqjrKT7wNd216GLgET8gZrEob0FhS XAiG7zPXeM/Q//c7OTIyKEHvoCgfH0a+kM/vmRm4vlgacm42mdJ5QhsDs3FSqDzcPZu/9iWOhyt VbrU26wjGikuxBCa4p5mavWFwLrBMg3LPdhmnKEQwcJrJ/V7p/DNtSi1DOtc0hwSrF+uk5B9VBk U9N5A19+UpM81+KF3zuQ8z1p5B1l3gQypCO36R49d3lzAwJscDISwpF8YEexLmXt4uZA8yvLWWS xoXp5+pXkYIwFGtoPzrV6KMffwvWbYShIemIUVOJwUrnXaPf/Bt0ujH4QGXBNv95p1/n9wbmGXT hzptwNql1rEcUgd7oxUE9UBBt1MTQEuTHyZhtSISShMDCVbXcK4bg/TvETSy+LxXKzbbxx+hF3a pORX1ZXFrX03H/dBnyauYayyYwcZ7RQ1X5Sdw1fZV7X26NRiILekAAfgFSjpVw== X-Received: by 2002:a05:6a20:1446:b0:3eb:a628:1095 with SMTP id adf61e73a8af0-3f2fd18b6c1mr3982688637.20.1794458676240; Wed, 11 Nov 2026 20:44:36 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:44:35 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 1/16] 7zip: upgrade 26.05 -> 26.06 Date: Thu, 12 Nov 2026 17:44:11 +1300 Message-ID: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:44:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132152 From: Ankur Tyagi Changelog: https://github.com/ip7z/7zip/releases/tag/26.06 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-extended/7zip/{7zip_26.05.bb => 7zip_26.06.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-extended/7zip/{7zip_26.05.bb => 7zip_26.06.bb} (98%) diff --git a/meta-oe/recipes-extended/7zip/7zip_26.05.bb b/meta-oe/recipes-extended/7zip/7zip_26.06.bb similarity index 98% rename from meta-oe/recipes-extended/7zip/7zip_26.05.bb rename to meta-oe/recipes-extended/7zip/7zip_26.06.bb index 050673f678..375f55f0ef 100644 --- a/meta-oe/recipes-extended/7zip/7zip_26.05.bb +++ b/meta-oe/recipes-extended/7zip/7zip_26.06.bb @@ -12,7 +12,7 @@ SRC_URI = "git://github.com/ip7z/7zip.git;protocol=https;branch=main;tag=${PV} \ file://0001-Remove-treating-warning-as-errors.patch \ file://7z_wrapper.sh \ " -SRCREV = "b88c6bc09339de32f7d18bbab900686b244f42ba" +SRCREV = "d3296e39e1f1f92c7b41c0c3848e65640428d42d" UPSTREAM_CHECK_URI = "https://github.com/ip7z/7zip/releases/latest" From patchwork Thu Nov 12 04:44:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103807 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pf1-f181.google.com (mail-pf1-f181.google.com [209.85.210.181]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6836.1794458679284660239 for ; Wed, 11 Nov 2026 20:44:39 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=Y7xC8tkj; spf=pass (domain: gmail.com, ip: 209.85.210.181, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-8b8ecfa886bso241294b3a.0 for ; Wed, 11 Nov 2026 20:44:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458679; x=1795063479; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=wOP29ozpki2ZcLEcdAReRlCMfqJh2G7tO+pqYnkedD4=; b=Y7xC8tkjeNfIjHEDGTYKZAlJh8POElxV8XVc8S8GL4/k7dz6+nmIzUseFcIIGV4NuZ p7I9/iYvKF0FSBzd3UfjYfZDiT2jN25RqfE06jmZ9Uiw5fxddlYhgf+IWQTlR6ijzxwH AVnck0Rk3/QknZ1VoMM75ZYo9Vm08zVsaWLGllaIE2U8UfimJUKvx1Jd6M0V5RAMH8Dt D+ERoxbdlH2v2vo7hFF6L2qkouX13wGvUlAJ9QgqYPnxuKyxEdKatmPgiFSJZrEuC2OE Px0TzdcEQDZjKtgx5N3oUSOsBRqdSnK6YY/qugL0fEdxXGAROZHGO86RpTn8BR6DlQSI IJ+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458679; x=1795063479; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=wOP29ozpki2ZcLEcdAReRlCMfqJh2G7tO+pqYnkedD4=; b=B2+ruz268WDJHfVYbtMNEIZ5KAtGSWc/KRBWwImafEqCaSH2Ip7BcGyqdu2dkNcaaD AzyqXNm8dMU5IGcKTLbJAm4+q6IHZoPG3aPP1VlDWnz4xp0UfZUD7j8yH9y3UG1wD8eN 0HBNMYJr3hdBegZenDNRIFEXD6Hf2OHzm0FYqCP1OzDjw93ZGZqu/pXyQSgEy2lPwanZ GRxkN/jF9kqwNNZi1I/EB+Y6STeHta1dhBFkGiAYhec+Lu/U5fpqYSa5svLYfbgtrYsH PDnJTlGZhZ52PlFzglhcqd85959nw0TVD18uGALQ6maccgVVRaUbRqBi73uKXgNcxGyo Rk+w== X-Gm-Message-State: APuU4Z+h+Kr9Haex/B3KOlL+WEtEvcA3bCPrnshu+QGMckCKvmf591Zo vTWNd544EWDPZ3hVSbg/h5NiNRLJjnoOi6+xEvt4YhXecMco9izYaHdJ2L8LLw== X-Gm-Gg: AYBFou2SUs6wwalH1Tuy70Lg7UWHFuDL3Dl5Vv7bD767dSFpAviLh7cJtB5FaoThygK y30mOLLe8idG8DRt9tqGnPePTHJ7aemFV/QuoBRxj37HwRLRR0p89a3XXUMgzSFZcx4SuM46zpK r1RVHw56aKB3ykTFGkL60t0apoxjGOsJg17/mlVXUEsw9DgmBO/bbgutnG5HDjp+YG6U9EkdzpA 72CEfZDFu/lYHQ1oq7XLDuUcK+UF6afy4sYXvxjnPHl9JpR7rsZ0niUXzZXpkVq+fVUANCkjQux Mr9ALJvFvczhG9/CsRvXEgp8nA0ch5/vWXmUtR5CNd8oBg/XLzcjT6X0inkf6KEpLZL3m3H/6SP DAZSCdgJRf1CuxdqOwkmK1erokIVHSL5UcVlJfQLHnTpWWRzaD+GY/YPXHtWSwNtHWLgM0Hy+7k wHsmFn1nGNehLOF+Uyu1HCBj89CbgdLnMYUdHDGh9vOhvshKVq/631dM72+GLZk+zp6Npwa7JTo npYDDb1ags5uf/aNCMB3wKJxokW0jvc5RYqPsKDfgQqjjQrPOqR/r3OqPYqTY8U6XzUvGjLZ2nE 7Qwx2sDoMxxYbDN2295stL8NxiOedlouCzmnkYxTfyr9LGJ9eHhtLdEtJD2VSg== X-Received: by 2002:a05:6a21:8201:b0:3e2:3de2:5937 with SMTP id adf61e73a8af0-3f63514fe97mr1195617637.44.1794458678459; Wed, 11 Nov 2026 20:44:38 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:44:38 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 2/16] apitrace: patch CVE-2026-126050 Date: Thu, 12 Nov 2026 17:44:12 +1300 Message-ID: <20261112044426.3933391-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:44:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132153 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-126050 Signed-off-by: Ankur Tyagi --- .../apitrace/apitrace/CVE-2026-126050.patch | 39 +++++++++++++++++++ .../apitrace/apitrace_14.0.bb | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch diff --git a/meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch b/meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch new file mode 100644 index 0000000000..4b0d3b2768 --- /dev/null +++ b/meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch @@ -0,0 +1,39 @@ +From a7c7db06b56f22235eeea2da608ef84dd401f3b6 Mon Sep 17 00:00:00 2001 +From: Deus Rex research team +Date: Tue, 10 Nov 2026 13:05:32 +0000 +Subject: [PATCH] trace: Fix heap out-of-bounds write in + SnappyFile::flushReadCache(). + +The Snappy trace reader takes each chunk's compressed length from a +4-byte field in the file and reads that many bytes into +m_compressedCache, a heap buffer allocated once with a fixed size of +snappy::MaxCompressedLength(1 MiB) = 1223370 bytes. The length is never +compared with that size, so a .trace file that declares and supplies a +longer chunk makes the read write past the end of the buffer. + +(cherry picked from commit 3890c5a448addfd75ccbe1bd09e3075de6fb3395) +CVE: CVE-2026-126050.patch +Upstream-Status: Backport [https://github.com/apitrace/apitrace/commit/3890c5a448addfd75ccbe1bd09e3075de6fb3395] +Signed-off-by: Ankur Tyagi +--- + lib/trace/trace_file_snappy.cpp | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/lib/trace/trace_file_snappy.cpp b/lib/trace/trace_file_snappy.cpp +index 5b60ec9d..9b0a681d 100644 +--- a/lib/trace/trace_file_snappy.cpp ++++ b/lib/trace/trace_file_snappy.cpp +@@ -224,6 +224,13 @@ void SnappyFile::flushReadCache(size_t skipLength) + return; + } + ++ if (compressedLength > snappy::MaxCompressedLength(SNAPPY_CHUNK_SIZE)) { ++ std::cerr << "error: invalid compressed chunk length in trace\n"; ++ m_stream.setstate(std::ios_base::failbit); ++ createCache(0); ++ return; ++ } ++ + m_stream.read((char*)m_compressedCache, compressedLength); + if (m_stream.fail()) { + std::cerr << "warning: unexpected end of file while reading trace\n"; diff --git a/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb b/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb index cb5ee92e04..7c51f45842 100644 --- a/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb +++ b/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb @@ -8,6 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=aeb969185a143c3c25130bc2c3ef9a50 \ SRCREV = "18cfd388ac47a9e00978b34d6c20341f3e2cdb56" SRC_URI = "gitsm://github.com/${BPN}/${BPN}.git;branch=master;protocol=https;tag=${PV} \ file://0001-zstd-disable-the-x86-64-BMI2-assembly-fast-loops.patch \ + file://CVE-2026-126050.patch \ " DEPENDS += "zlib libpng python3-native" From patchwork Thu Nov 12 04:44:13 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103808 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6934.1794458681449232434 for ; Wed, 11 Nov 2026 20:44:41 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=RlnRBoq/; spf=pass (domain: gmail.com, ip: 209.85.216.53, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-3b0d09df973so3021145a91.0 for ; Wed, 11 Nov 2026 20:44:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458681; x=1795063481; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HDlEgziNqunqggW/luFDNrufEbsRgIUzQyEFSwkgPBc=; b=RlnRBoq/WEuO5pla38af5eQpI9ifkozrfMn4a6pLeO5Y3vv41a0NPvL4SDfGoIhxai OI/1JUsifFoaTqBlV8Ay0PT81agzz8X8TNLbHpTLP1WAZVIEf/w/8CR7vkfbXAZcRrZu 82bpcbQixIN0+nKx5nEwOCbNQrkQ71ydXBMqgu0uPZvES4v+GpM+5XaBYyVUgTz7tjAj SufFsvJffkN8O/h3XK+k2idXTVivPxpb6bZSmOG0djBGEvrbIqnlnfaa0jq3tp1+sxgN hALeJux98BwBJTUqYEN03szAlQwi+uXGuM7vcEd8cwyhsjtLCASerCoE+0fUlr+F0UJv C10w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458681; x=1795063481; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=HDlEgziNqunqggW/luFDNrufEbsRgIUzQyEFSwkgPBc=; b=fWV7UPzrlqSStzl6MFNIDl5rtBTGeuNAwL9qhU8LQZD2MJJIUWeP+OLa/gbSeEPb0M oPGkAavLZoXrD0DD3TzLp+Lspv1hd3dPyHnzMy+evVVrAH0tbxNeok4TqV967buopkiZ c4DBs9IPvdjXjnjJUdpyvyDHJhcS9PoQ7zk57KPMpjqGGP3JYtNC+7L2KmLuYWM6Mmf/ 8d0lZmbwt7iNSGMkwTLC4pdQVbmZIvKNQj2D0F9BA9oIfGAmSyJlbzW/4bJa/1KFYyTl S9aeTw6sjL2ybtIoPeytH2g8Bm9xvXy8VBfA9YhIYREzU1FyTT8w31LwPyrEpPslHAU3 iw3w== X-Gm-Message-State: APuU4Z8PeoOBJ1TlCTMxQi3gmQ5CA9xIKQAC7Po2dX/om16CG/Z3CDAJ IAFmL658+mkAqL31qov1N8zSrZ59vFzF5f5o9qieio87E/oYSvKCEj1hgKmKSw== X-Gm-Gg: AYBFou1eccC2z2cdOGes7+tXD8IOP8A4/d/brR1Rr0FuzfNpV1WSNRkGbYMQHO1SpH2 BrIN/woEwykX9sD4bnNq1zHnqmJzFnQ/o1KrD5We5HG7GrdgK49gxG5eFWsj1KaIYLT4gm4gk0e xWsDDgFhycw13jfRuKOge5Pe72hWjG/L71ObtVwhkmSXiwX9g74vNlBULB9NLPq3Qd/a8zAmn21 Ln0agJxkvoqtPoSmhhDlbm6qi7wqlmlzdBFLu7IUderrKwR0KV1pxwG7xF+dcCTWfe3Og37RdTf 4Xevsj0iW2hzEJ9m7F/Uc6nHF+6Lqyj+Rt9wDWSfFDuH+/1bLjsfkCYbr3EvvpjKY/FFdxIC3cD aMVzp/sb8ykJ3b/U8eUNcoyYmAFAcvXdgt6BP9h4d3LexZSM9CidIPXxlQyiU66IWq/I4YQAWFN f98kutk6cYAX5KtmXARmfoSY9+sKHnUFG7Chywj7SRuIkHgT2aLdUORv6cUBmF/lA2eTc6rAX6z fOoG8oDzJMDsh4fTzRN7eWamb2dUKquDCyDYYAek4XPN3OYP4xOmPvyZTUppX1oLLZB4pdIiNxT PNdo6dW68bMu3OGjopR5MmlnMMX0/Nm6iLfy88NtkdcD44WwYmkU466iFc7W2w== X-Received: by 2002:a17:90b:224e:b0:3ae:5572:c4e2 with SMTP id 98e67ed59e1d1-3b182f198d0mr4598647a91.57.1794458680625; Wed, 11 Nov 2026 20:44:40 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:44:40 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-webserver][blacksail][PATCH 3/16] cockpit: mark CVE-2024-2947 fixed Date: Thu, 12 Nov 2026 17:44:13 +1300 Message-ID: <20261112044426.3933391-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:44:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132154 From: Ankur Tyagi Commit[1] also identified by Debian[2] Details: https://nvd.nist.gov/vuln/detail/cve-2024-2947 [1]https://github.com/cockpit-project/cockpit/commit/9c4cc9b6df632082538b53bdc8ee9ec1c5cad4da [2]https://security-tracker.debian.org/tracker/CVE-2024-2947 Signed-off-by: Ankur Tyagi --- meta-webserver/recipes-webadmin/cockpit/cockpit_366.1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-webserver/recipes-webadmin/cockpit/cockpit_366.1.bb b/meta-webserver/recipes-webadmin/cockpit/cockpit_366.1.bb index e12cabcd98..3aa1f155e7 100644 --- a/meta-webserver/recipes-webadmin/cockpit/cockpit_366.1.bb +++ b/meta-webserver/recipes-webadmin/cockpit/cockpit_366.1.bb @@ -202,3 +202,4 @@ do_install:append() { } CVE_PRODUCT = "cockpit-project:cockpit" +CVE_STATUS[CVE-2024-2947] = "fixed-version: fixed since v314" From patchwork Thu Nov 12 04:44:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103809 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6838.1794458683555952356 for ; Wed, 11 Nov 2026 20:44:43 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=nXOE/G3v; spf=pass (domain: gmail.com, ip: 209.85.210.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-8b6399ebb41so3376749b3a.0 for ; Wed, 11 Nov 2026 20:44:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458683; x=1795063483; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2h/7Xw7QWiKqNawLALhqEGQOuq9Yggf5eN9lcwkDIwU=; b=nXOE/G3vJ6HUwVVkLP7yb4sW3oHlWE6gBfr4oa+wjjzR/iQnKCF9i8QfiGbs2NeDC/ rh7F84WBeis5T5phOXLUdjpwoJNUI8i9tE1OV9jpbDR8gb3bT8wYXHU+SDUs2rfuoyjQ sjZ7q+u5UTfmQtiiWE5idQ92hpw60PVuUa6LjxUg+gzFN0LQJd14IjpTMKhjL6mTwcBo fLPtqYAk4B2EhxvITW8aFx8p8co7xfB50N2SJtLLXuZbNlnEuWzHrUIG/bacBA7CnpSS PeSgFlAQrCgKW01lXzwiCBnxBhKht2yK4I0E3hoizQOVpmOQxAd3pjRuAe5xUje2l1ml YmUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458683; x=1795063483; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=2h/7Xw7QWiKqNawLALhqEGQOuq9Yggf5eN9lcwkDIwU=; b=uNcy3xq9lk8VDeJpMBEvhq8RCYrhubDoW5KuJ91CCLr5qvQxJ+l0aHqaf47cci0Uc3 z/9FVNzDkfMuoGfgy0VMLRDnTbEPrC5cipIEmFNPi32nN6v6Q7Vb8MqWv+qP23wQH195 ian1Xh6SNAhGpyDrD/VxCYEmKNMLcssOyjIyJkjzhYIxp3zSZP8aPu0R+TSF0CTQ520O vakNXrXIeCfqPHWQvVQqu2EUd6TESLCxKr4YYryttg6+XgivK4TL5AL5v8HDK6Tp/ipo RV0iic0p6YiY0Q0QvNToOLcHQFG4UqXkAaNtNl4ZsFb7zElcH1s5AcgFJoycxH6x2J2r 4NYg== X-Gm-Message-State: APuU4Z/9vgG+Ym9IJeu7FmRcC0Z4pAhJzOF8IvhEix0XeT3dYAOdX4Td sUbkoxeJiHPbKtc1e3/E3w1E45CxGkWairMPfjwJtk4oYoQX3C+KoNfjngObsw== X-Gm-Gg: AYBFou1nZQkehRzCRUpV+brKxTIqFz2Eqz34WuxVdIS/8IsSzCYvTatolzkHyg0srpo YueD/zW8MVMWzltT7NSsgZ0S8PAEa/2yR2mAJF+F/mcgYMMHM9htGRq5inh4upAhYWcBkZ005YV 0Qtkc6Tgw0tXiMbWOE4jEqgXYJC8ILQ/zBzPe9VN/VIfS86qUbdvLycY4lA4ut1Dq3dItPGHeBq JUZzTSBEZDsTpztSGHhUAJ9WbEjCadDCoInwvUS7HFJ2c9cA9QsewQSe8ARjyUYZHK8cbJtzwj8 z0xtVf/ocvzXelmFRsKirJsr0esA1wsMhaQY+jnZabW9tFKeKsYEu/TenOWM88V9iAtWk534pa8 gmH5rTX2PRS+Z/rQlI7xZTbONTFnfQh+h2c84UdFRqz4mwtxBmZ2GpU56Ji88KWCEBvu8W7wau2 E6Ud1wc4Hs81O/NjQYarC6MjoKPTvaQXcir2+OjMlfdBKCYUtf5IFE1uVfGNy2Z0aSp6UTYAdZX C2+Ci7HpPTSEcknd08BmcVpw19E/IFwi8Jls16r66vDpqs9/ihcFoHARixJoVez9RHkaWN6cKCB gvRaJN+0LRP6OZ+qSreJeZXKFoGzgWCw7aPvUjzHrQS9TVpKOnUex0qVQ564VA== X-Received: by 2002:a05:6a20:a120:b0:3e2:1418:aae2 with SMTP id adf61e73a8af0-3f2ffbcee70mr4861629637.68.1794458682872; Wed, 11 Nov 2026 20:44:42 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:44:42 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 4/16] brotli: set CVE_PRODUCT to "google:brotli" Date: Thu, 12 Nov 2026 17:44:14 +1300 Message-ID: <20261112044426.3933391-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:44:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132155 From: Ankur Tyagi cve-check class is setting default CVE_PRODUCT to 'brotli' which ignores the CVEs from NVD Database. Reference: CVE-2026-111497 https://nvd.nist.gov/vuln/detail/cve-2026-111497 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-extended/brotli/brotli_1.2.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-extended/brotli/brotli_1.2.1.bb b/meta-oe/recipes-extended/brotli/brotli_1.2.1.bb index dca16cb79b..14d7fe96e5 100644 --- a/meta-oe/recipes-extended/brotli/brotli_1.2.1.bb +++ b/meta-oe/recipes-extended/brotli/brotli_1.2.1.bb @@ -20,3 +20,5 @@ do_install:append () { } BBCLASSEXTEND = "native nativesdk" + +CVE_PRODUCT = "google:brotli" From patchwork Thu Nov 12 04:44:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103810 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6936.1794458686576332713 for ; Wed, 11 Nov 2026 20:44:46 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=Tb3ZhRJX; spf=pass (domain: gmail.com, ip: 209.85.210.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-8a4c72951b8so391398b3a.3 for ; Wed, 11 Nov 2026 20:44:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458686; x=1795063486; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=wS0oBfFXLAO7f85Gl3HZi9YwcyL9mR19tTPYvUs6LTE=; b=Tb3ZhRJXd2wBL+Lo5tkc4PymmdI3IDLuTslFdvf2NG/yT8Wg1a3QzJCD73PEdD2hzN idXkGX8GtbDEP+SqtRgTR6ixRrDPYzCRJ9HHDLmuWO3UarT1wmVi3X9O4rvXLhBaCARp XlaOjlIyNlZ6gh6QUYc3/pZ+izuCySxMcHO39b9NyJvc/q7Z4U2Ol5N/1/lxPL41TUbj mVKFHzclfszGbQHrFdJVbPPaPIqMLWcXo2wpWYcYHn7rMovIGu3g98PHkvPEIa6aFklX 5SQlDOIecb9Rl52M7jgVFJ1DVCMYz2xGhnC9rpahV1wzswP8IE2qXqOM9urtN5WaaRVx o4TA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458686; x=1795063486; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=wS0oBfFXLAO7f85Gl3HZi9YwcyL9mR19tTPYvUs6LTE=; b=awSqpao+IYiiiGcR/pgnzlaU7ZugALfU50FrXTN+Z2NcMs/1hR+1dHrQNSvKuiNiQ9 000l0DpBeHMhp2e4YdMBMiIiklmED9fdUv+ivdlTrlypvOfZ9/c93WmZw/9ZlhqQyjXn WE8oqlMS27G7Jxy/zc6+aQk0axH4LpBEPIpPm/+5hSwI50wBYXMx6Gl0nVNOdOQ8BEh/ TSKFQ6mEAT/CIUF6JfncZd61JYWMwy80Co7hnCVRMGvsxNtxyM1KH7d9OGe+xNPrK/Uy kgbh+wJt6SaMITAn6Hf94hmEBLWfac+V7gEenkIxxAlzCEP+O9Sp9dc/2PvotZ0Fpd6c aI2Q== X-Gm-Message-State: APuU4Z+V/ufXcE3GFWDQkDUUKuBUil461zCsQErN3qOX526Yhk0AXmBw 1lp1aGysIi5K5yY3Bhlwnjed5GcjRF5qEbkMlRu2XGHbwbngtLqrmHQ58Iq0kg== X-Gm-Gg: AYBFou2LHti2juuZbyijHBE5WD+K7b9cKXO+s7R7V1qleBIrv8Ajl5HlOu0HAitQllV +wWAJKTb/v6akbyh43jTfU6K/woBAaHoCcEzEaPhMkI71CDQ3Xym6dau0giJEe9BFLZYa+nlj2P epaB5LdJ63SdVHXYMJK5cJFrL+5Pgg2IwUtwAYoix52GxfO/EFkyoWU/KQKRhYoUJtY5qTxja/E dWFCREw6+8CQDdz0ZDp3WBxJG+AJlJAAVhhbcPm2gZPH3fNhCw9e39BtylXtF8gfpVPfIECcCiV YjNHpAuyHad1sdwXGAiT8g07zZPyYFjjgHSqzLDSeYBy+5gcQWe+x7TEQK4NyQEkxtNJ3tkjLqq M+erAFbjzTcOb6Zky6L6YSX5nvLuqYal9TzXn0io6Vzk59uJFDPtETXofml4STlffhJGQs2hIVC tbdm4DFS4JtQBU6YWdo782sbuzSFD0uVOSQDEcU32SQjfcFE6Vvz91vCteVwp/hgNZTiReNbKsN EIBi92WH247LjuLYI7NFUBQEyT+90PuHUc0+k+PpEAW/8oApWpaJV94HU/NQJfwazhbN7LjioUx 2xKvr5Me1CS7Y9QkdfcvJK2HH6G6qWkdfBXiFEnpVB4Whu93OjmoHfZxBYi09g== X-Received: by 2002:a05:6a21:a96:b0:3e2:3c7:7754 with SMTP id adf61e73a8af0-3f2feedbf30mr4774200637.65.1794458685457; Wed, 11 Nov 2026 20:44:45 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:44:44 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][blacksail][PATCH 5/16] ettercap: patch CVEs CVE-2026-125400 - CVE-2026-125406 Date: Thu, 12 Nov 2026 17:44:15 +1300 Message-ID: <20261112044426.3933391-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:44:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132156 From: Ankur Tyagi Also backport commits[1][2][3] to cherry pick commit identified by NVD. Details: https://nvd.nist.gov/vuln/detail/cve-2026-125400 [1]https://github.com/Ettercap/ettercap/commit/593a11ff49e61293fcf4ed24f8b017df0aeac6fd [2]https://github.com/Ettercap/ettercap/commit/feeae6fa366e01a3dd9f1857ec6aae847b2ae00c [3]https://github.com/Ettercap/ettercap/commit/ffd9e06c3cdab9c056f7e729b5083ed81126315e Signed-off-by: Ankur Tyagi --- .../ettercap/ettercap_0.8.4.1.bb | 4 + .../ettercap/files/CVE-2026-125400-06_1.patch | 121 +++ .../ettercap/files/CVE-2026-125400-06_2.patch | 149 ++++ .../ettercap/files/CVE-2026-125400-06_3.patch | 92 ++ .../ettercap/files/CVE-2026-125400-06_4.patch | 807 ++++++++++++++++++ 5 files changed, 1173 insertions(+) create mode 100644 meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_1.patch create mode 100644 meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_2.patch create mode 100644 meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_3.patch create mode 100644 meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_4.patch diff --git a/meta-networking/recipes-support/ettercap/ettercap_0.8.4.1.bb b/meta-networking/recipes-support/ettercap/ettercap_0.8.4.1.bb index 9a2090719b..8ac3c7703c 100644 --- a/meta-networking/recipes-support/ettercap/ettercap_0.8.4.1.bb +++ b/meta-networking/recipes-support/ettercap/ettercap_0.8.4.1.bb @@ -23,6 +23,10 @@ RDEPENDS:${PN} += "bash ethtool libgcc" SRC_URI = "gitsm://github.com/Ettercap/ettercap;branch=master;protocol=https;tag=v${PV} \ file://0001-ec.h-do-not-strip-a-pre-existing-_GNU_SOURCE-define.patch \ + file://CVE-2026-125400-06_1.patch \ + file://CVE-2026-125400-06_2.patch \ + file://CVE-2026-125400-06_3.patch \ + file://CVE-2026-125400-06_4.patch \ " SRCREV = "0dc8409779f3a09cbfff4434b9a4d7b33480d88d" diff --git a/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_1.patch b/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_1.patch new file mode 100644 index 0000000000..5fdc42d48b --- /dev/null +++ b/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_1.patch @@ -0,0 +1,121 @@ +From d6ae972f54be633b3b7b2d7905f89cf53abbb839 Mon Sep 17 00:00:00 2001 +From: Gianfranco Costamagna +Date: Fri, 24 Apr 2026 11:37:12 +0200 +Subject: [PATCH] ec_gg: Add new GG_MAX_LEN equal to 70 + +(cherry picked from commit 593a11ff49e61293fcf4ed24f8b017df0aeac6fd) + +CVE: CVE-2026-125400 CVE-2026-125401 CVE-2026-125402 CVE-2026-125403 CVE-2026-125404 CVE-2026-125405 CVE-2026-125406 +Upstream-Status: Backport [https://github.com/Ettercap/ettercap/commit/593a11ff49e61293fcf4ed24f8b017df0aeac6fd] + +Signed-off-by: Ankur Tyagi +--- + src/dissectors/ec_gg.c | 31 ++++++++++++++++--------------- + 1 file changed, 16 insertions(+), 15 deletions(-) + +diff --git a/src/dissectors/ec_gg.c b/src/dissectors/ec_gg.c +index 82799f93..fa303e87 100644 +--- a/src/dissectors/ec_gg.c ++++ b/src/dissectors/ec_gg.c +@@ -149,22 +149,23 @@ uncomment #define below if you want to see all contacts status changes - be care + + /* globals */ + +-#define GG_LOGIN50_CMD 0x0000000c +-#define GG_LOGIN60_CMD 0x00000015 +-#define GG_LOGIN70_CMD 0x00000019 ++#define GG_LOGIN50_CMD 0x0000000c ++#define GG_LOGIN60_CMD 0x00000015 ++#define GG_LOGIN70_CMD 0x00000019 + +-#define GG_WELCOME_CMD 0x00000001 ++#define GG_WELCOME_CMD 0x00000001 + +-#define GG_SEND_MSG_CMD 0x0000000b +-#define GG_RECV_MSG_CMD 0x0000000a ++#define GG_SEND_MSG_CMD 0x0000000b ++#define GG_RECV_MSG_CMD 0x0000000a + + #define GG_NEW_STATUS_CMD 0x00000002 + + #define GG_STATUS_CMD 0x00000002 + +-#define GG_STATUS50_CMD 0x0000000c ++#define GG_STATUS50_CMD 0x0000000c + #define GG_STATUS60_CMD 0x0000000f + #define GG_STATUS70_CMD 0x00000017 ++#define GG_MAX_LEN 70 + + struct gg_hdr { + u_int32 type; +@@ -182,7 +183,7 @@ struct gg_login50_hdr { + u_int32 version; + u_int8 local_ip[4]; + u_int16 local_port; +- char description[71]; /* 70+1 (0x0) */ ++ char description[GG_MAX_LEN + 1]; /* 70+1 (0x0) */ + u_int32 time; + }__attribute__ ((packed)); + +@@ -198,7 +199,7 @@ struct gg_login60_hdr { + u_int16 remote_port; + u_int8 image_size; + u_int8 unknown2; /* 0xbe */ +- char description[71]; /* 70+1 (0x0) */ ++ char description[GG_MAX_LEN + 1]; /* 70+1 (0x0) */ + u_int32 time; + }__attribute__ ((packed)); + +@@ -217,7 +218,7 @@ struct gg_login70_hdr { + u_int16 remote_port; + u_int8 image_size; + u_int8 unknown5; /* 0xbe */ +- char description[71]; /* 70+1 (0x0) */ ++ char description[GG_MAX_LEN + 1]; /* 70+1 (0x0) */ + u_int32 time; + }__attribute__ ((packed)); + +@@ -238,14 +239,14 @@ struct gg_recv_msg_hdr { + + struct gg_new_status_hdr { + u_int32 status; +- char description[71]; /* 70+1 (0x0) */ ++ char description[GG_MAX_LEN + 1]; /* 70+1 (0x0) */ + u_int32 time; + }; + + struct gg_status_hdr { + u_int32 uin; + u_int32 status; +- char description[71]; /* 70+1 (0x0) */ ++ char description[GG_MAX_LEN + 1]; /* 70+1 (0x0) */ + u_int32 time; + }; + +@@ -256,7 +257,7 @@ struct gg_status50_hdr { + u_int16 remote_port; + u_int32 version; + u_int16 unknown1; /* remote port again? */ +- char description[71]; /* 70+1 (0x0) */ ++ char description[GG_MAX_LEN + 1]; /* 70+1 (0x0) */ + u_int32 time; + }__attribute__ ((packed)); + +@@ -268,7 +269,7 @@ struct gg_status60_hdr { + u_int8 version; + u_int8 image_size; + u_int8 unknown1; /* 0x00 */ +- char description[71]; /* 70+1 (0x0) */ ++ char description[GG_MAX_LEN + 1]; /* 70+1 (0x0) */ + u_int32 time; + }__attribute__ ((packed));; + +@@ -281,7 +282,7 @@ struct gg_status70_hdr { + u_int8 image_size; + u_int8 unknown1; /* 0x00 */ + u_int32 unknown2; /* 0x00 */ +- char description[71]; /* 70+1 (0x0) */ ++ char description[GG_MAX_LEN + 1]; /* 70+1 (0x0) */ + u_int32 time; + }__attribute__ ((packed));; + diff --git a/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_2.patch b/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_2.patch new file mode 100644 index 0000000000..af8e290f40 --- /dev/null +++ b/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_2.patch @@ -0,0 +1,149 @@ +From 6e5c1c1f7d18a381ef64877538e2a7fb714083e2 Mon Sep 17 00:00:00 2001 +From: Gianfranco Costamagna +Date: Fri, 24 Apr 2026 11:40:16 +0200 +Subject: [PATCH] fix Heap buffer overflow in GG Dissector, thanks to + for the bug report and fix Closes: #1306 + +(cherry picked from commit feeae6fa366e01a3dd9f1857ec6aae847b2ae00c) + +CVE: CVE-2026-125400 CVE-2026-125401 CVE-2026-125402 CVE-2026-125403 CVE-2026-125404 CVE-2026-125405 CVE-2026-125406 +Upstream-Status: Backport [https://github.com/Ettercap/ettercap/commit/feeae6fa366e01a3dd9f1857ec6aae847b2ae00c] + +Signed-off-by: Ankur Tyagi +--- + src/dissectors/ec_gg.c | 64 ++++++++++++++++++++++++++---------------- + 1 file changed, 40 insertions(+), 24 deletions(-) + +diff --git a/src/dissectors/ec_gg.c b/src/dissectors/ec_gg.c +index fa303e87..2a7dd8a6 100644 +--- a/src/dissectors/ec_gg.c ++++ b/src/dissectors/ec_gg.c +@@ -359,10 +359,12 @@ FUNC_DECODER(dissector_gg) + if ((gg->type == GG_LOGIN50_CMD) && !FROM_SERVER("gg", PACKET)) { + gg_get_status(gg_login50->status,tbuf); + gg_get_version(gg_login50->version,tbuf3); +- if ((int)gg->len-22 < 0) ++ size_t offset=22; ++ if (gg->len-offset < 0) + return NULL; +- strncpy(tbuf2,gg_login50->description, (gg->len)-22); +- tbuf2[(gg->len)-22]='\0'; ++ size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); ++ strncpy(tbuf2,gg_login50->description, copy_len); ++ tbuf2[copy_len]='\0'; + sprintf(user,"%u",gg_login50->uin); + PACKET->DISSECTOR.user = strdup(user); + sprintf(pass,"%u",gg_login50->hash); +@@ -381,10 +383,12 @@ if ((gg->type == GG_LOGIN50_CMD) && !FROM_SERVER("gg", PACKET)) { + else if (gg->type == GG_LOGIN60_CMD) { + gg_get_status(gg_login60->status,tbuf); + gg_get_version(gg_login60->version,tbuf3); +- if ((int)gg->len-31 < 0) ++ size_t offset=31; ++ if (gg->len-offset < 0) + return NULL; +- strncpy(tbuf2,gg_login60->description, (gg->len)-31); +- tbuf2[(gg->len)-31]='\0'; ++ size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); ++ strncpy(tbuf2,gg_login60->description, copy_len); ++ tbuf2[copy_len]='\0'; + sprintf(user,"%u",gg_login60->uin); + PACKET->DISSECTOR.user = strdup(user); + sprintf(pass,"%u",gg_login60->hash); +@@ -405,10 +409,12 @@ else if (gg->type == GG_LOGIN60_CMD) { + else if (gg->type == GG_LOGIN70_CMD) { + gg_get_status(gg_login70->status,tbuf); + gg_get_version(gg_login70->version,tbuf3); +- if ((int)gg->len-92 < 0) ++ size_t offset=92; ++ if (gg->len-offset < 0) + return NULL; +- strncpy(tbuf2,gg_login70->description, (gg->len)-92); +- tbuf2[(gg->len)-92]='\0'; ++ size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); ++ strncpy(tbuf2,gg_login70->description, copy_len); ++ tbuf2[copy_len]='\0'; + sprintf(user,"%u",gg_login70->uin); + PACKET->DISSECTOR.user = strdup(user); + sprintf(pass,"%X%X%X%X%X",gg_login70->hash[0],gg_login70->hash[1],gg_login70->hash[2],gg_login70->hash[3],gg_login70->hash[4]); +@@ -454,10 +460,12 @@ else if (gg->type == GG_WELCOME_CMD) { + #ifdef GG_CONTACTS_STATUS_CHANGES + else if ((gg->type == GG_STATUS_CMD) && FROM_SERVER("gg", PACKET)) { + gg_get_status(gg_status->status,tbuf); +- if ((int)gg->len-8 < 0) ++ size_t offset=8; ++ if (gg->len-offset < 0) + return NULL; +- strncpy(tbuf2,gg_status->description, (gg->len)-8); +- tbuf2[(gg->len)-8]='\0'; ++ size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); ++ strncpy(tbuf2,gg_status->description, copy_len); ++ tbuf2[copy_len]='\0'; + DISSECT_MSG("GG : %s:%d -> %s:%d - STATUS CHANGED UIN: %u STATUS: %s (%s)\n", ip_addr_ntoa(&PACKET->L3.src, tmp), + ntohs(PACKET->L4.src), + ip_addr_ntoa(&PACKET->L3.dst, tmp2), +@@ -468,10 +476,12 @@ else if ((gg->type == GG_STATUS_CMD) && FROM_SERVER("gg", PACKET)) { + #endif + else if ((gg->type == GG_NEW_STATUS_CMD) && !FROM_SERVER("gg", PACKET)) { + gg_get_status(gg_new_status->status,tbuf); +- if ((int)gg->len-4 < 0) ++ size_t offset=4; ++ if (gg->len-offset < 0) + return NULL; +- strncpy(tbuf2,gg_new_status->description, (gg->len)-4); +- tbuf2[(gg->len)-4]='\0'; ++ size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); ++ strncpy(tbuf2,gg_new_status->description, copy_len); ++ tbuf2[copy_len]='\0'; + DISSECT_MSG("GG : %s:%d -> %s:%d - NEW STATUS STATUS: %s (%s)\n", ip_addr_ntoa(&PACKET->L3.src, tmp), + ntohs(PACKET->L4.src), + ip_addr_ntoa(&PACKET->L3.dst, tmp2), +@@ -482,10 +492,12 @@ else if ((gg->type == GG_NEW_STATUS_CMD) && !FROM_SERVER("gg", PACKET)) { + else if ((gg->type == GG_STATUS50_CMD) && FROM_SERVER("gg", PACKET)) { + gg_get_status(gg_status50->status,tbuf); + gg_get_version(gg_status50->version,tbuf3); +- if ((int)gg->len-20 < 0) ++ size_t offset=20; ++ if (gg->len-offset < 0) + return NULL; +- strncpy(tbuf2,gg_status50->description, (gg->len)-20); +- tbuf2[(gg->len)-20]='\0'; ++ size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); ++ strncpy(tbuf2,gg_status50->description, copy_len); ++ tbuf2[copy_len]='\0'; + DISSECT_MSG("GG4/5 : %s:%d -> %s:%d - STATUS CHANGED UIN: %u STATUS: %s (%s) VERSION: %s RIP: %u.%u.%u.%u:%u\n", ip_addr_ntoa(&PACKET->L3.src, tmp), + ntohs(PACKET->L4.src), + ip_addr_ntoa(&PACKET->L3.dst, tmp2), +@@ -499,10 +511,12 @@ else if ((gg->type == GG_STATUS50_CMD) && FROM_SERVER("gg", PACKET)) { + else if (gg->type == GG_STATUS60_CMD) { + gg_get_status(gg_status60->status,tbuf); + gg_get_version(gg_status60->version,tbuf3); +- if ((int)gg->len-14 < 0) ++ size_t offset=14; ++ if (gg->len-offset < 0) + return NULL; +- strncpy(tbuf2,gg_status60->description, (gg->len)-14); +- tbuf2[(gg->len)-14]='\0'; ++ size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); ++ strncpy(tbuf2,gg_status60->description, copy_len); ++ tbuf2[copy_len]='\0'; + DISSECT_MSG("GG6 : %s:%d -> %s:%d - STATUS CHANGED UIN: %u STATUS: %s (%s) VERSION: %s RIP: %u.%u.%u.%u:%u\n", ip_addr_ntoa(&PACKET->L3.src, tmp), + ntohs(PACKET->L4.src), + ip_addr_ntoa(&PACKET->L3.dst, tmp2), +@@ -515,11 +529,13 @@ else if (gg->type == GG_STATUS60_CMD) { + } + else if (gg->type == GG_STATUS70_CMD) { + gg_get_status(gg_status70->status,tbuf); +- if ((int)gg->len-18 < 0) ++ size_t offset=18; ++ if (gg->len-offset < 0) + return NULL; ++ size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + gg_get_version(gg_status70->version,tbuf3); +- strncpy(tbuf2,gg_status70->description, (gg->len)-18); +- tbuf2[(gg->len)-18]='\0'; ++ strncpy(tbuf2,gg_status70->description, copy_len); ++ tbuf2[copy_len]='\0'; + DISSECT_MSG("GG7 : %s:%d -> %s:%d - STATUS CHANGED UIN: %u STATUS: %s (%s) VERSION: %s RIP: %u.%u.%u.%u:%u\n", ip_addr_ntoa(&PACKET->L3.src, tmp), + ntohs(PACKET->L4.src), + ip_addr_ntoa(&PACKET->L3.dst, tmp2), diff --git a/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_3.patch b/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_3.patch new file mode 100644 index 0000000000..f649082cb9 --- /dev/null +++ b/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_3.patch @@ -0,0 +1,92 @@ +From 4fee3420f939bb738e883a8baad15a6da473ab8a Mon Sep 17 00:00:00 2001 +From: Gianfranco Costamagna +Date: Fri, 24 Apr 2026 11:48:23 +0200 +Subject: [PATCH] ec_gg: don't check if two unsigned integers go <0, check just + if the len is greater than the offset + +(cherry picked from commit ffd9e06c3cdab9c056f7e729b5083ed81126315e) + +CVE: CVE-2026-125400 CVE-2026-125401 CVE-2026-125402 CVE-2026-125403 CVE-2026-125404 CVE-2026-125405 CVE-2026-125406 +Upstream-Status: Backport [https://github.com/Ettercap/ettercap/commit/ffd9e06c3cdab9c056f7e729b5083ed81126315e] + +Signed-off-by: Ankur Tyagi +--- + src/dissectors/ec_gg.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/src/dissectors/ec_gg.c b/src/dissectors/ec_gg.c +index 2a7dd8a6..aaabd9b9 100644 +--- a/src/dissectors/ec_gg.c ++++ b/src/dissectors/ec_gg.c +@@ -360,7 +360,7 @@ if ((gg->type == GG_LOGIN50_CMD) && !FROM_SERVER("gg", PACKET)) { + gg_get_status(gg_login50->status,tbuf); + gg_get_version(gg_login50->version,tbuf3); + size_t offset=22; +- if (gg->len-offset < 0) ++ if (gg->len < offset) + return NULL; + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_login50->description, copy_len); +@@ -384,7 +384,7 @@ else if (gg->type == GG_LOGIN60_CMD) { + gg_get_status(gg_login60->status,tbuf); + gg_get_version(gg_login60->version,tbuf3); + size_t offset=31; +- if (gg->len-offset < 0) ++ if (gg->len < offset) + return NULL; + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_login60->description, copy_len); +@@ -410,7 +410,7 @@ else if (gg->type == GG_LOGIN70_CMD) { + gg_get_status(gg_login70->status,tbuf); + gg_get_version(gg_login70->version,tbuf3); + size_t offset=92; +- if (gg->len-offset < 0) ++ if (gg->len < offset) + return NULL; + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_login70->description, copy_len); +@@ -461,7 +461,7 @@ else if (gg->type == GG_WELCOME_CMD) { + else if ((gg->type == GG_STATUS_CMD) && FROM_SERVER("gg", PACKET)) { + gg_get_status(gg_status->status,tbuf); + size_t offset=8; +- if (gg->len-offset < 0) ++ if (gg->len < offset) + return NULL; + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_status->description, copy_len); +@@ -477,7 +477,7 @@ else if ((gg->type == GG_STATUS_CMD) && FROM_SERVER("gg", PACKET)) { + else if ((gg->type == GG_NEW_STATUS_CMD) && !FROM_SERVER("gg", PACKET)) { + gg_get_status(gg_new_status->status,tbuf); + size_t offset=4; +- if (gg->len-offset < 0) ++ if (gg->len < offset) + return NULL; + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_new_status->description, copy_len); +@@ -493,7 +493,7 @@ else if ((gg->type == GG_STATUS50_CMD) && FROM_SERVER("gg", PACKET)) { + gg_get_status(gg_status50->status,tbuf); + gg_get_version(gg_status50->version,tbuf3); + size_t offset=20; +- if (gg->len-offset < 0) ++ if (gg->len < offset) + return NULL; + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_status50->description, copy_len); +@@ -512,7 +512,7 @@ else if (gg->type == GG_STATUS60_CMD) { + gg_get_status(gg_status60->status,tbuf); + gg_get_version(gg_status60->version,tbuf3); + size_t offset=14; +- if (gg->len-offset < 0) ++ if (gg->len < offset) + return NULL; + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_status60->description, copy_len); +@@ -530,7 +530,7 @@ else if (gg->type == GG_STATUS60_CMD) { + else if (gg->type == GG_STATUS70_CMD) { + gg_get_status(gg_status70->status,tbuf); + size_t offset=18; +- if (gg->len-offset < 0) ++ if (gg->len < offset) + return NULL; + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + gg_get_version(gg_status70->version,tbuf3); diff --git a/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_4.patch b/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_4.patch new file mode 100644 index 0000000000..81c4c4a8a5 --- /dev/null +++ b/meta-networking/recipes-support/ettercap/files/CVE-2026-125400-06_4.patch @@ -0,0 +1,807 @@ +From eb36ce39dc88056e854745d36dcc04b2d09a296f Mon Sep 17 00:00:00 2001 +From: "Emilio A. Escobar" +Date: Tue, 8 Sep 2026 08:37:37 -0700 +Subject: [PATCH] Fix seven memory-safety bugs reachable from network traffic + +All seven were reported by the DREAM Security Research Team against v0.8.4.1 +(3548c10c) and validated against master. + +Vulnerability discovered by: Adiel Sol, Arad Inbar, Erez Cohen, Nir Somech, +Ben Grinberg, Daniel Lubel, Shir Sadon (DREAM Security Research Team) + +Each has a draft advisory; the GHSA id is cited in the comment at every fix +site. CVE ids have been requested and are not assigned yet. + +GHSA-f3j5-rhhr-85j5 - use-after-free in func_pcre (src/ec_filter.c) + The PCRE2 match data was freed before pcre2_get_ovector_pointer() was + called on it, and the resulting pointer then drove an allocation size, + two memcpy offsets into the pcap buffer, and the packet length delta. + The offsets are now copied out of the match data before it is released, + which also plugs the leaks on the no-match paths of both level 5 and 6. + This is the default build path wherever pcre2 is installed. + +GHSA-vrjv-f8gv-2h35 - heap overflow in gg_get_version (ec_gg.c) + The helper composed up to 44 bytes into a 30-byte allocation via + sprintf()/strcat(). Both helpers now build into a private buffer and hand + back only a bounded copy. Also fixes user[10]/pass[40], which were one + byte short for a u_int32 uin and 41 bytes short for five %X, and the + scratch buffers leaked by the short-packet guards. + +GHSA-v48w-7cvh-c7f4 - SNI heap over-read (ec_sslwrap.c) + val_len was read from the ClientHello and passed to strndup() without + being checked against the extension length, so it read up to 64KB past + the buffer and shipped the result to the upstream server. The reported + double free was not reproducible - ae->hostname is freed once and + SAFE_FREE() NULLs - but the callback fires twice and leaked the first + allocation, so it now releases any previous value before reassigning. + +GHSA-hq2w-pg4m-6w63 - out-of-bounds read in sslw_remove_sts (ec_sslwrap.c) + The search for the end of the STS header used the length of the whole + packet from an already-advanced pointer, reading past the buffer, and did + not check memmem() for NULL - h_end became 0x2, header_length underflowed + and memcpy() got a near-SIZE_MAX length. Bounded and NULL-checked; len + still describes the whole packet, as the rebuild below is sized from it. + +GHSA-j37f-7jx3-rf8j - size_t underflow in ccmp_decrypt (ec_encryption_ccmp.c) + len -= WPA_CCMP_TRAILER wrapped for frames shorter than 8 bytes and the + decrypt loop then ran ~2^60 times up the stack. Both the outer and inner + function now reject undersized frames, and the UINT16_MAX check moved + above the VLA it was meant to bound. + +GHSA-jw9q-j2rm-94j2 - heap over-read in the NTLM parser (ec_http.c) + lmResponse/ntResponse/uUser offsets were used as displacements from the + decoded message with no bounds checking, letting a peer read 24 bytes + from anywhere in a 4GB window and have us log the result. The decoded + length is now kept and every offset/length pair validated against it; + short blobs are rejected before msgType is read at offset 8. + +GHSA-w5ch-7c4x-crcc - stack underflow in the telnet dissector (ec_telnet.c) + Backspace handling decremented the write pointer with no lower bound, so + leading backspaces walked it below the VLA and later characters wrote + attacker-chosen bytes underneath it. Bounded by str. + +Verified with an AddressSanitizer build: the func_pcre use-after-free +reproduces end to end via etterfilter + a crafted pcap and is gone after +the fix, and extracted harnesses confirm the gg, ccmp and telnet fixes. +Existing test suite passes. + +Co-Authored-By: Claude Opus 5 (1M context) +Claude-Session: https://claude.ai/code/session_01U7DPkxps63uUMetZEJSTLr +(cherry picked from commit a8c1a5085791b38c234be0e4129302fdc36964e0) + +CVE: CVE-2026-125400 CVE-2026-125401 CVE-2026-125402 CVE-2026-125403 CVE-2026-125404 CVE-2026-125405 CVE-2026-125406 +Upstream-Status: Backport [https://github.com/Ettercap/ettercap/commit/a8c1a5085791b38c234be0e4129302fdc36964e0] + +Signed-off-by: Ankur Tyagi +--- + src/dissectors/ec_gg.c | 138 +++++++++++++++++++++---------------- + src/dissectors/ec_http.c | 101 +++++++++++++++++++++++---- + src/dissectors/ec_telnet.c | 8 ++- + src/ec_encryption_ccmp.c | 38 ++++++++-- + src/ec_filter.c | 46 ++++++++++--- + src/ec_sslwrap.c | 36 ++++++++-- + 6 files changed, 274 insertions(+), 93 deletions(-) + +diff --git a/src/dissectors/ec_gg.c b/src/dissectors/ec_gg.c +index aaabd9b9..adf7f6f2 100644 +--- a/src/dissectors/ec_gg.c ++++ b/src/dissectors/ec_gg.c +@@ -166,6 +166,9 @@ uncomment #define below if you want to see all contacts status changes - be care + #define GG_STATUS60_CMD 0x0000000f + #define GG_STATUS70_CMD 0x00000017 + #define GG_MAX_LEN 70 ++/* GHSA-vrjv-f8gv-2h35: sized for the longest string each helper can build */ ++#define GG_TBUF_SIZE 64 ++#define GG_TBUF3_SIZE 64 + + struct gg_hdr { + u_int32 type; +@@ -290,8 +293,8 @@ struct gg_status70_hdr { + + FUNC_DECODER(dissector_gg); + void gg_init(void); +-void gg_get_status(u_int32 status, char *str); +-void gg_get_version(u_int32 version, char *str); ++void gg_get_status(u_int32 status, char *str, size_t size); ++void gg_get_version(u_int32 version, char *str, size_t size); + + /************************************************/ + +@@ -320,7 +323,12 @@ FUNC_DECODER(dissector_gg) + struct gg_recv_msg_hdr *gg_recv_msg; + struct gg_new_status_hdr *gg_new_status; + char *tbuf, *tbuf2, *tbuf3; +- char user[10], pass[40]; ++ /* GHSA-vrjv-f8gv-2h35: a u_int32 uin needs 11 bytes and 5 x %X needs 41 */ ++ char user[12], pass[48]; ++ ++/* GHSA-vrjv-f8gv-2h35: the short-packet guards below used to return without ++ * releasing the three scratch buffers */ ++#define GG_BAIL() do { SAFE_FREE(tbuf); SAFE_FREE(tbuf2); SAFE_FREE(tbuf3); return NULL; } while(0) + + /* don't complain about unused var */ + (void)end; +@@ -352,16 +360,16 @@ FUNC_DECODER(dissector_gg) + + DEBUG_MSG("Gadu-Gadu --> TCP dissector_gg (%.8X:%.8X)", gg->type, gg->len); + +- SAFE_CALLOC(tbuf, 50, sizeof(char)); +- SAFE_CALLOC(tbuf2, 71, sizeof(char)); +- SAFE_CALLOC(tbuf3, 30, sizeof(char)); ++ SAFE_CALLOC(tbuf, GG_TBUF_SIZE, sizeof(char)); ++ SAFE_CALLOC(tbuf2, GG_MAX_LEN + 1, sizeof(char)); ++ SAFE_CALLOC(tbuf3, GG_TBUF3_SIZE, sizeof(char)); + + if ((gg->type == GG_LOGIN50_CMD) && !FROM_SERVER("gg", PACKET)) { +- gg_get_status(gg_login50->status,tbuf); +- gg_get_version(gg_login50->version,tbuf3); ++ gg_get_status(gg_login50->status, tbuf, GG_TBUF_SIZE); ++ gg_get_version(gg_login50->version, tbuf3, GG_TBUF3_SIZE); + size_t offset=22; + if (gg->len < offset) +- return NULL; ++ GG_BAIL(); + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_login50->description, copy_len); + tbuf2[copy_len]='\0'; +@@ -381,11 +389,11 @@ if ((gg->type == GG_LOGIN50_CMD) && !FROM_SERVER("gg", PACKET)) { + gg_login50->local_port); + } + else if (gg->type == GG_LOGIN60_CMD) { +- gg_get_status(gg_login60->status,tbuf); +- gg_get_version(gg_login60->version,tbuf3); ++ gg_get_status(gg_login60->status, tbuf, GG_TBUF_SIZE); ++ gg_get_version(gg_login60->version, tbuf3, GG_TBUF3_SIZE); + size_t offset=31; + if (gg->len < offset) +- return NULL; ++ GG_BAIL(); + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_login60->description, copy_len); + tbuf2[copy_len]='\0'; +@@ -407,11 +415,11 @@ else if (gg->type == GG_LOGIN60_CMD) { + gg_login60->remote_port); + } + else if (gg->type == GG_LOGIN70_CMD) { +- gg_get_status(gg_login70->status,tbuf); +- gg_get_version(gg_login70->version,tbuf3); ++ gg_get_status(gg_login70->status, tbuf, GG_TBUF_SIZE); ++ gg_get_version(gg_login70->version, tbuf3, GG_TBUF3_SIZE); + size_t offset=92; + if (gg->len < offset) +- return NULL; ++ GG_BAIL(); + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_login70->description, copy_len); + tbuf2[copy_len]='\0'; +@@ -459,10 +467,10 @@ else if (gg->type == GG_WELCOME_CMD) { + } + #ifdef GG_CONTACTS_STATUS_CHANGES + else if ((gg->type == GG_STATUS_CMD) && FROM_SERVER("gg", PACKET)) { +- gg_get_status(gg_status->status,tbuf); ++ gg_get_status(gg_status->status, tbuf, GG_TBUF_SIZE); + size_t offset=8; + if (gg->len < offset) +- return NULL; ++ GG_BAIL(); + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_status->description, copy_len); + tbuf2[copy_len]='\0'; +@@ -475,10 +483,10 @@ else if ((gg->type == GG_STATUS_CMD) && FROM_SERVER("gg", PACKET)) { + } + #endif + else if ((gg->type == GG_NEW_STATUS_CMD) && !FROM_SERVER("gg", PACKET)) { +- gg_get_status(gg_new_status->status,tbuf); ++ gg_get_status(gg_new_status->status, tbuf, GG_TBUF_SIZE); + size_t offset=4; + if (gg->len < offset) +- return NULL; ++ GG_BAIL(); + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_new_status->description, copy_len); + tbuf2[copy_len]='\0'; +@@ -490,11 +498,11 @@ else if ((gg->type == GG_NEW_STATUS_CMD) && !FROM_SERVER("gg", PACKET)) { + } + #ifdef GG_CONTACTS_STATUS_CHANGES + else if ((gg->type == GG_STATUS50_CMD) && FROM_SERVER("gg", PACKET)) { +- gg_get_status(gg_status50->status,tbuf); +- gg_get_version(gg_status50->version,tbuf3); ++ gg_get_status(gg_status50->status, tbuf, GG_TBUF_SIZE); ++ gg_get_version(gg_status50->version, tbuf3, GG_TBUF3_SIZE); + size_t offset=20; + if (gg->len < offset) +- return NULL; ++ GG_BAIL(); + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_status50->description, copy_len); + tbuf2[copy_len]='\0'; +@@ -509,11 +517,11 @@ else if ((gg->type == GG_STATUS50_CMD) && FROM_SERVER("gg", PACKET)) { + gg_status50->remote_port); + } + else if (gg->type == GG_STATUS60_CMD) { +- gg_get_status(gg_status60->status,tbuf); +- gg_get_version(gg_status60->version,tbuf3); ++ gg_get_status(gg_status60->status, tbuf, GG_TBUF_SIZE); ++ gg_get_version(gg_status60->version, tbuf3, GG_TBUF3_SIZE); + size_t offset=14; + if (gg->len < offset) +- return NULL; ++ GG_BAIL(); + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); + strncpy(tbuf2,gg_status60->description, copy_len); + tbuf2[copy_len]='\0'; +@@ -528,12 +536,12 @@ else if (gg->type == GG_STATUS60_CMD) { + gg_status60->remote_port); + } + else if (gg->type == GG_STATUS70_CMD) { +- gg_get_status(gg_status70->status,tbuf); ++ gg_get_status(gg_status70->status, tbuf, GG_TBUF_SIZE); + size_t offset=18; + if (gg->len < offset) +- return NULL; ++ GG_BAIL(); + size_t copy_len = MIN(gg->len - offset, GG_MAX_LEN); +- gg_get_version(gg_status70->version,tbuf3); ++ gg_get_version(gg_status70->version, tbuf3, GG_TBUF3_SIZE); + strncpy(tbuf2,gg_status70->description, copy_len); + tbuf2[copy_len]='\0'; + DISSECT_MSG("GG7 : %s:%d -> %s:%d - STATUS CHANGED UIN: %u STATUS: %s (%s) VERSION: %s RIP: %u.%u.%u.%u:%u\n", ip_addr_ntoa(&PACKET->L3.src, tmp), +@@ -564,133 +572,147 @@ else { + return NULL; + } + +-void gg_get_status(u_int32 status, char *str) { ++void gg_get_status(u_int32 status, char *str, size_t size) { ++ char buf[128]; ++ ++ buf[0] = '\0'; + + switch ((status&0x00ff)) { + + case 0x0014: +- strcpy(str,"invisible"); ++ strcpy(buf,"invisible"); + break; + + case 0x0002: +- strcpy(str,"available"); ++ strcpy(buf,"available"); + break; + + case 0x0003: +- strcpy(str,"busy"); ++ strcpy(buf,"busy"); + break; + + case 0x0006: +- strcpy(str,"blocked"); ++ strcpy(buf,"blocked"); + break; + + case 0x0001: +- strcpy(str,"not available"); ++ strcpy(buf,"not available"); + break; + + case 0x0016: +- strcpy(str,"invisible + descr"); ++ strcpy(buf,"invisible + descr"); + break; + + case 0x0004: +- strcpy(str,"available + descr"); ++ strcpy(buf,"available + descr"); + break; + + case 0x0005: +- strcpy(str,"busy + descr"); ++ strcpy(buf,"busy + descr"); + break; + + case 0x0015: +- strcpy(str,"not available + descr"); ++ strcpy(buf,"not available + descr"); + break; + + default: +- strcpy(str,"unknown"); ++ strcpy(buf,"unknown"); + } + + if ((status&0xff00)==0x8000) +- strcat(str," + private"); ++ strcat(buf," + private"); ++ ++/* GHSA-vrjv-f8gv-2h35: the helper composes into an ample private buffer ++ * and only ever hands the caller a bounded copy */ ++snprintf(str, size, "%s", buf); + + } + +-void gg_get_version(u_int32 version, char *str) { ++void gg_get_version(u_int32 version, char *str, size_t size) { ++ char buf[128]; ++ ++ buf[0] = '\0'; + + switch ((version&0x00ff)) { + + case 0x0000002A: +- strcpy(str,"7.7"); ++ strcpy(buf,"7.7"); + break; + + case 0x00000029: +- strcpy(str,"7.6"); ++ strcpy(buf,"7.6"); + break; + + case 0x00000024: +- strcpy(str,"6.1/7.6"); ++ strcpy(buf,"6.1/7.6"); + break; + + case 0x00000028: +- strcpy(str,"7.5"); ++ strcpy(buf,"7.5"); + break; + + case 0x00000027: + case 0x00000026: + case 0x00000025: +- strcpy(str,"7.0"); ++ strcpy(buf,"7.0"); + break; + + case 0x00000022: + case 0x00000021: + case 0x00000020: +- strcpy(str,"6.0"); ++ strcpy(buf,"6.0"); + break; + + case 0x0000001E: + case 0x0000001C: +- strcpy(str,"5.7"); ++ strcpy(buf,"5.7"); + break; + + case 0x0000001B: + case 0x00000019: +- strcpy(str,"5.0"); ++ strcpy(buf,"5.0"); + break; + + case 0x00000018: +- strcpy(str,"5.0/4.9"); ++ strcpy(buf,"5.0/4.9"); + break; + + case 0x00000017: + case 0x00000016: +- strcpy(str,"4.9"); ++ strcpy(buf,"4.9"); + break; + + case 0x00000015: + case 0x00000014: +- strcpy(str,"4.8"); ++ strcpy(buf,"4.8"); + break; + + case 0x00000011: +- strcpy(str,"4.6"); ++ strcpy(buf,"4.6"); + break; + + case 0x00000010: + case 0x0000000f: +- strcpy(str,"4.5"); ++ strcpy(buf,"4.5"); + break; + + case 0x0000000b: +- strcpy(str,"4.0"); ++ strcpy(buf,"4.0"); + break; + + default: +- sprintf(str,"unknown (0x%X)",version); ++ sprintf(buf,"unknown (0x%X)",version); + } + + if ((version&0xf0000000)==0x40000000) +- strcat(str," + has audio"); ++ strcat(buf," + has audio"); + + if ((version&0x0f000000)== 0x04000000) +- strcat(str," + eraomnix"); ++ strcat(buf," + eraomnix"); ++ ++/* GHSA-vrjv-f8gv-2h35: the helper composes into an ample private buffer ++ * and only ever hands the caller a bounded copy */ ++snprintf(str, size, "%s", buf); + + } + +diff --git a/src/dissectors/ec_http.c b/src/dissectors/ec_http.c +index 6384d0af..30f09a94 100644 +--- a/src/dissectors/ec_http.c ++++ b/src/dissectors/ec_http.c +@@ -26,6 +26,8 @@ + #include + #include + ++#include /* offsetof() */ ++ + /* globals */ + #define USER 0 + #define PASS 1 +@@ -105,6 +107,7 @@ static int Parse_Basic_Auth(char *ptr, char *from_here, struct packet_object *po + static int Parse_User_Agent(char *end, char *from_here, struct packet_object *po); + static char *unicodeToString(char *p, size_t len); + static void dumpRaw(char *str, unsigned char *buf, size_t len); ++static char *unicodeToStringChecked(char *base, size_t buflen, u_int32 offset, u_int16 len); + int http_fields_init(void); + + #define CVAL(buf,pos) (((unsigned char *)(buf))[pos]) +@@ -112,7 +115,19 @@ int http_fields_init(void); + #define SVAL(buf,pos) (PVAL(buf,pos)|PVAL(buf,(pos)+1)<<8) + #define IVAL(buf,pos) (SVAL(buf,pos)|SVAL(buf,(pos)+2)<<16) + +-#define GetUnicodeString(structPtr, header) unicodeToString(((char*)structPtr) + IVAL(&structPtr->header.offset,0) , SVAL(&structPtr->header.len,0)/2) ++/* ++ * GHSA-jw9q-j2rm-94j2: the offset and length of every NTLM string are taken ++ * verbatim from the packet, so both have to be validated against the size of ++ * the decoded message before they are used as a displacement. buflen is the ++ * number of bytes base64decode() actually produced. ++ */ ++#define NTLM_FIELD_IN_BOUNDS(buflen, off, cnt) \ ++ ((size_t)(off) <= (size_t)(buflen) && (size_t)(cnt) <= (size_t)(buflen) - (size_t)(off)) ++ ++#define GetUnicodeString(structPtr, header, buflen) \ ++ unicodeToStringChecked((char*)(structPtr), (buflen), \ ++ IVAL(&(structPtr)->header.offset,0), \ ++ SVAL(&(structPtr)->header.len,0)) + + /************************************************/ + +@@ -465,7 +480,21 @@ static int Parse_NTLM_Auth(char *ptr, char *from_here, struct packet_object *po) + ec_strtok(to_decode, "\r", &tok); + + char *decoded; +- base64decode(to_decode, &decoded); ++ int decoded_len; ++ ++ decoded_len = base64decode(to_decode, &decoded); ++ ++ /* ++ * GHSA-jw9q-j2rm-94j2: base64decode() sizes its output from the input ++ * string, so a short blob left every read below out of bounds - starting ++ * with msgType, which lives at offset 8. ++ */ ++ if (decoded_len < (int)sizeof(tSmbStdHeader)) { ++ SAFE_FREE(to_decode); ++ SAFE_FREE(decoded); ++ return 1; ++ } ++ + hSmb = (tSmbStdHeader *) decoded; + msgType = IVAL(&hSmb->msgType, 0); + +@@ -476,7 +505,14 @@ static int Parse_NTLM_Auth(char *ptr, char *from_here, struct packet_object *po) + tSmbNtlmAuthChallenge *challenge_struct; + + challenge_struct = (tSmbNtlmAuthChallenge *) decoded; +- ++ ++ /* the fixed part up to and including challengeData must be present */ ++ if (decoded_len < (int)(offsetof(tSmbNtlmAuthChallenge, challengeData) + 8)) { ++ SAFE_FREE(to_decode); ++ SAFE_FREE(decoded); ++ return 1; ++ } ++ + /* Create a session to remember the server challenge */ + dissect_create_session(&s, po, DISSECT_CODE(dissector_http)); + SAFE_CALLOC(s->data, 1, sizeof(struct http_status)); +@@ -502,17 +538,42 @@ static int Parse_NTLM_Auth(char *ptr, char *from_here, struct packet_object *po) + if (conn_status->c_status == NTLM_WAIT_RESPONSE) { + /* Fill the user and passwords */ + response_struct = (tSmbNtlmAuthResponse *) decoded; +- po->DISSECTOR.user = strdup(GetUnicodeString(response_struct, uUser)); +- SAFE_CALLOC(po->DISSECTOR.pass, strlen(po->DISSECTOR.user) + 150, sizeof(char)); +- snprintf(po->DISSECTOR.pass, strlen(po->DISSECTOR.user) + 150, "(NTLM) %s:\"\":\"\":", po->DISSECTOR.user); +- outstr = po->DISSECTOR.pass + strlen(po->DISSECTOR.pass); +- dumpRaw(outstr,((unsigned char*)response_struct)+IVAL(&response_struct->lmResponse.offset,0), 24); +- outstr[48] = ':'; +- outstr+=49; +- dumpRaw(outstr,((unsigned char*)response_struct)+IVAL(&response_struct->ntResponse.offset,0), 24); +- outstr[48] = ':'; +- outstr += 49; +- strcat(po->DISSECTOR.pass, (const char*)conn_status->c_data); ++ ++ u_int32 lm_off = IVAL(&response_struct->lmResponse.offset, 0); ++ u_int32 nt_off = IVAL(&response_struct->ntResponse.offset, 0); ++ char *ntlm_user; ++ ++ /* ++ * GHSA-jw9q-j2rm-94j2: the fixed header has to be there, and both ++ * response offsets have to address 24 bytes that are really inside ++ * the decoded message. Both used to be added to the message base ++ * unchecked, letting a peer read - and have us log - heap memory ++ * from anywhere in a 4GB window above the allocation. ++ */ ++ if (decoded_len >= (int)offsetof(tSmbNtlmAuthResponse, buffer) && ++ NTLM_FIELD_IN_BOUNDS(decoded_len, lm_off, 24) && ++ NTLM_FIELD_IN_BOUNDS(decoded_len, nt_off, 24) && ++ (ntlm_user = GetUnicodeString(response_struct, uUser, decoded_len)) != NULL) { ++ ++ po->DISSECTOR.user = strdup(ntlm_user); ++ SAFE_CALLOC(po->DISSECTOR.pass, strlen(po->DISSECTOR.user) + 150, sizeof(char)); ++ snprintf(po->DISSECTOR.pass, strlen(po->DISSECTOR.user) + 150, "(NTLM) %s:\"\":\"\":", po->DISSECTOR.user); ++ outstr = po->DISSECTOR.pass + strlen(po->DISSECTOR.pass); ++ dumpRaw(outstr, ((unsigned char*)response_struct) + lm_off, 24); ++ outstr[48] = ':'; ++ outstr+=49; ++ dumpRaw(outstr, ((unsigned char*)response_struct) + nt_off, 24); ++ outstr[48] = ':'; ++ outstr += 49; ++ strcat(po->DISSECTOR.pass, (const char*)conn_status->c_data); ++ } else { ++ DEBUG_MSG("HTTP --> malformed NTLM type 3 message, skipped"); ++ session_free(s); ++ SAFE_FREE(ident); ++ SAFE_FREE(to_decode); ++ SAFE_FREE(decoded); ++ return 1; ++ } + + /* Are we authenticating to the proxy or to a website? */ + if (Proxy_Auth) +@@ -865,6 +926,18 @@ static void dumpRaw(char *str, unsigned char *buf, size_t len) + snprintf(str, 3, "%02x", buf[i]); + } + ++/* ++ * Bounds-checked wrapper around unicodeToString(). Returns NULL when the ++ * packet-supplied offset/length pair does not fit inside the decoded message. ++ */ ++static char *unicodeToStringChecked(char *base, size_t buflen, u_int32 offset, u_int16 len) ++{ ++ if (!NTLM_FIELD_IN_BOUNDS(buflen, offset, len)) ++ return NULL; ++ ++ return unicodeToString(base + offset, len / 2); ++} ++ + /* A little helper function */ + static char *unicodeToString(char *p, size_t len) + { +diff --git a/src/dissectors/ec_telnet.c b/src/dissectors/ec_telnet.c +index cbf97b33..dab44afe 100644 +--- a/src/dissectors/ec_telnet.c ++++ b/src/dissectors/ec_telnet.c +@@ -151,7 +151,13 @@ FUNC_DECODER(dissector_telnet) + stringlen = strlen((const char*)str); + for (p = str, i = 0; i < stringlen; i++) { + if (str[i] == '\b' || str[i] == 0x7f) { +- p--; ++ /* ++ * GHSA-w5ch-7c4x-crcc: a backspace arriving before any ++ * printable character used to walk p below str, after which ++ * this loop wrote attacker-chosen bytes underneath the VLA. ++ */ ++ if (p > str) ++ p--; + } else { + *p = str[i]; + p++; +diff --git a/src/ec_encryption_ccmp.c b/src/ec_encryption_ccmp.c +index 8f8761e8..3c78733c 100644 +--- a/src/ec_encryption_ccmp.c ++++ b/src/ec_encryption_ccmp.c +@@ -56,15 +56,35 @@ int wpa_ccmp_decrypt(u_char *mac, u_char *data, size_t len, struct wpa_sa sa) + { + u_char mic[WPA_CCMP_TRAILER]; + u_char PN[6]; /* 48 bit Packet Number */ +- size_t data_len = len - sizeof(struct wpa_header); + u_char AAD[AES_BLOCK_SIZE*2]; + u_char BZERO[AES_BLOCK_SIZE], A[AES_BLOCK_SIZE], B[AES_BLOCK_SIZE]; +- u_char decbuf[len]; + AES_KEY aes_ctx; ++ size_t data_len; + +- if (len > UINT16_MAX) { +- return -E_NOTHANDLED; +- } ++ /* ++ * GHSA-j37f-7jx3-rf8j: len is the payload that follows the WPA header, so ++ * it has to be at least large enough to hold the CCMP MIC trailer. It used ++ * to be used unchecked: data_len underflowed for len < 8, the memset near ++ * the end of this function wrote before data, and ccmp_decrypt() wrapped ++ * its own length and ran away up the stack. ++ * ++ * The upper bound is checked here too, before the decbuf VLA is sized from ++ * len rather than after it. ++ */ ++ if (len > UINT16_MAX) ++ return -E_NOTHANDLED; ++ ++ if (len < WPA_CCMP_TRAILER) ++ return -E_NOTHANDLED; ++ ++ /* ++ * Numerically identical to the previous len - sizeof(struct wpa_header) ++ * (both are 8), but this is the value CCM actually wants in B0: the length ++ * of the plaintext payload, i.e. everything except the MIC trailer. ++ */ ++ data_len = len - WPA_CCMP_TRAILER; ++ ++ u_char decbuf[len]; + + /* init the AES with the decryption key from SA */ + AES_set_encrypt_key(sa.decryption_key, 128, &aes_ctx); +@@ -191,6 +211,14 @@ static int ccmp_decrypt(u_char *enc, u_char *BZERO, u_char *B, u_char *A, u_char + { + int i = 1; + ++ /* ++ * GHSA-j37f-7jx3-rf8j: len is unsigned, so a frame shorter than the ++ * trailer wrapped this subtraction to ~SIZE_MAX and the loop below then ++ * wrote AES blocks far past the caller's stack buffer. ++ */ ++ if (len < WPA_CCMP_TRAILER) ++ return -E_NOTHANDLED; ++ + /* remove the trailer from the length */ + len -= WPA_CCMP_TRAILER; + +diff --git a/src/ec_filter.c b/src/ec_filter.c +index a436d6df..7b6ca084 100644 +--- a/src/ec_filter.c ++++ b/src/ec_filter.c +@@ -567,8 +567,18 @@ static int func_pcre(struct filter_op *fop, struct packet_object *po) + return -E_NOTFOUND; + #else + #ifdef HAVE_PCRE2 +- PCRE2_SIZE *ovec; ++ /* ++ * GHSA-f3j5-rhhr-85j5: hold our own copy of the ovector. ++ * The ovector lives inside the pcre2_match_data block, so a pointer to it ++ * is only valid while that block is alive. Copying the offsets out lets us ++ * release the match data on every path without the rest of the function ++ * reading (and computing memcpy offsets from) freed heap memory. ++ */ ++ PCRE2_SIZE ovec[PCRE_OVEC_SIZE]; ++ PCRE2_SIZE *ovec_src; + pcre2_match_data *match_data; ++ uint32_t ovec_pairs, n; ++ memset(&ovec, 0, sizeof(ovec)); + #else + int ovec[PCRE_OVEC_SIZE]; + memset(&ovec, 0, sizeof(ovec)); +@@ -583,14 +593,28 @@ static int func_pcre(struct filter_op *fop, struct packet_object *po) + /* search in the real packet */ + #ifdef HAVE_PCRE2 + match_data = pcre2_match_data_create_from_pattern(fop->op.func.ropt->pregex, NULL); +- if ( (ret = pcre2_match(fop->op.func.ropt->pregex, (PCRE2_SPTR)po->DATA.data, po->DATA.len, 0, 0, match_data, NULL)) < 0) +-#else +- if ( (ret = pcre_exec(fop->op.func.ropt->pregex, fop->op.func.ropt->preg_extra, po->DATA.data, po->DATA.len, 0, 0, ovec, sizeof(ovec) / sizeof(*ovec))) < 0) +-#endif ++ if ( (ret = pcre2_match(fop->op.func.ropt->pregex, (PCRE2_SPTR)po->DATA.data, po->DATA.len, 0, 0, match_data, NULL)) < 0) { ++ /* also plugs the leak this path used to have */ ++ pcre2_match_data_free(match_data); + return -E_NOTFOUND; ++ } ++ ++ /* snapshot the offsets before the match data goes away */ ++ ovec_src = pcre2_get_ovector_pointer(match_data); ++ ovec_pairs = pcre2_get_ovector_count(match_data); ++ if (ovec_pairs > PCRE_OVEC_SIZE / 2) ++ ovec_pairs = PCRE_OVEC_SIZE / 2; ++ for (n = 0; n < ovec_pairs * 2; n++) ++ ovec[n] = ovec_src[n]; + +-#ifdef HAVE_PCRE2 + pcre2_match_data_free(match_data); ++ ++ /* never let a marker index past the pairs we actually copied */ ++ if (ret > (int)ovec_pairs) ++ ret = (int)ovec_pairs; ++#else ++ if ( (ret = pcre_exec(fop->op.func.ropt->pregex, fop->op.func.ropt->preg_extra, po->DATA.data, po->DATA.len, 0, 0, ovec, sizeof(ovec) / sizeof(*ovec))) < 0) ++ return -E_NOTFOUND; + #endif + + /* the pcre wants to modify the packet */ +@@ -621,9 +645,6 @@ static int func_pcre(struct filter_op *fop, struct packet_object *po) + } + /* now: i = strlen(q) */ + +-#ifdef HAVE_PCRE2 +- ovec = pcre2_get_ovector_pointer(match_data); +-#endif + SAFE_CALLOC(replaced, markers*(ovec[1]-ovec[0]) + i + 1, sizeof(char)); + + po->flags |= PO_MODIFIED; +@@ -707,11 +728,14 @@ static int func_pcre(struct filter_op *fop, struct packet_object *po) + /* search in the decoded one */ + #ifdef HAVE_PCRE2 + match_data = pcre2_match_data_create_from_pattern(fop->op.func.ropt->pregex, NULL); +- if ( pcre2_match(fop->op.func.ropt->pregex, (PCRE2_SPTR)po->DATA.disp_data, po->DATA.disp_len, 0, 0, match_data, NULL) < 0) ++ if ( pcre2_match(fop->op.func.ropt->pregex, (PCRE2_SPTR)po->DATA.disp_data, po->DATA.disp_len, 0, 0, match_data, NULL) < 0) { ++ pcre2_match_data_free(match_data); ++ return -E_NOTFOUND; ++ } + #else + if ( pcre_exec(fop->op.func.ropt->pregex, fop->op.func.ropt->preg_extra, po->DATA.disp_data, po->DATA.disp_len, 0, 0, NULL, 0) < 0) +-#endif + return -E_NOTFOUND; ++#endif + + #ifdef HAVE_PCRE2 + pcre2_match_data_free(match_data); +diff --git a/src/ec_sslwrap.c b/src/ec_sslwrap.c +index 8581c7a9..873225b7 100644 +--- a/src/ec_sslwrap.c ++++ b/src/ec_sslwrap.c +@@ -573,7 +573,16 @@ static int sslw_clienthello_cb(SSL *ssl, int *alert, void *arg) + + ae = (struct accepted_entry *)arg; + +- /* extract hostname value from SNI extension */ ++ /* ++ * Extract hostname value from SNI extension. ++ * ++ * This callback is invoked more than once per handshake (it returns ++ * SSL_CLIENT_HELLO_RETRY the first time), so release whatever the previous ++ * invocation stored before taking ownership of a new string. SAFE_FREE() ++ * NULLs as it frees, which keeps this safe to re-enter and makes a double ++ * free of ae->hostname unreachable on every path that reaches here. ++ */ ++ SAFE_FREE(ae->hostname); + ae->hostname = sslw_get_clienthello_sni(ssl); + + if (ae->tls_handshake_state != SSL_CLIENTHELLO_INTERCEPTED) { +@@ -600,8 +609,14 @@ static char* sslw_get_clienthello_sni(SSL *ssl) + sni_type = sni[2]; + val_len = sni[3] << 8 | sni[4]; + +- if (sni_type == TLSEXT_NAMETYPE_host_name) +- return strndup(sni+5, val_len); ++ /* ++ * GHSA-v48w-7cvh-c7f4: val_len comes straight off the wire and the ++ * client_hello callback runs before OpenSSL validates extension ++ * bodies, so it has to be checked against the extension we actually ++ * got. Without this, strndup() walked up to 64KB past the buffer. ++ */ ++ if (sni_type == TLSEXT_NAMETYPE_host_name && val_len <= len - 5) ++ return strndup((const char *)sni + 5, val_len); + } + } + +@@ -1309,9 +1324,22 @@ static int sslw_remove_sts(struct packet_object *po) + len = end - ptr; + + ptr = (u_char*)memmem(ptr, len, "\r\nStrict-Transport-Security:", slen); ++ if (ptr == NULL) ++ return -E_NOTFOUND; + ptr += 2; + +- h_end = (u_char*)memmem(ptr, len, "\r\n", 2); ++ /* ++ * GHSA-hq2w-pg4m-6w63: len still described the whole buffer, so this search ++ * ran up to (ptr - po->DATA.data) bytes past the end of it and could match ++ * out of bounds. Bound it by what is actually left after the advanced ++ * pointer, and bail out when the header is not terminated inside this ++ * packet - h_end used to become 0x2 there, underflowing header_length and ++ * handing memcpy() a near-SIZE_MAX length. len itself must keep describing ++ * the whole packet, since the reconstruction below is sized from it. ++ */ ++ h_end = (u_char*)memmem(ptr, (size_t)(end - ptr), "\r\n", 2); ++ if (h_end == NULL) ++ return -E_NOTFOUND; + h_end += 2; + + size_t before_header = ptr - po->DATA.data; From patchwork Thu Nov 12 04:44:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103811 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6839.1794458688358851996 for ; Wed, 11 Nov 2026 20:44:48 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=xdAd/A77; spf=pass (domain: gmail.com, ip: 209.85.210.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-8b904d10882so1723165b3a.0 for ; Wed, 11 Nov 2026 20:44:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458688; x=1795063488; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=FUz6b237LeBwom0vnUx9UXSM0szJhlsGYhXyLTK8h0Y=; b=xdAd/A77QVdHEKDi1Nrn5FaEyA6q6z5VK74X1pQQcTnTmTRv/nLlhc8pADhdCvMcNm Wu8Dpuce4MCRb/ld9J6nwAqNFAptW5IrzHDuX2oBfb1VaEu8SPIITornaKnLFz5zfmqM KTZjfsEnRXTYXnp/t6fn8UkHrDRCQjiH+mCYrkUC2lghpa8qCqto10zxqOEuMzgXldkO 76c/sB1k5nIxdswSrA88BDwYAwPDRV28K09NK20wyN1bDUoyF+/se1wSv2HqVfR1AL84 omEjz9NzoaRnP6fsIubEKTICgxP7ebrs99fYMwSssa4R7l+s2+isDsX+nbkJEmEFINLx JkAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458688; x=1795063488; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=FUz6b237LeBwom0vnUx9UXSM0szJhlsGYhXyLTK8h0Y=; b=SltzNPvejkl6x2J/Sdz/OpUG6qlaxXDiUHQ3UL4jxH8Zp2ytviyU4nwKUYuS+X+RJY LPStKunTX9YHTXCE6JwqdgVvTtBly5yqYCisWgV+9mRleX1EgtfFsBLbpGbF0LJxSViT PkUCC6rsZu0zzIbjM9PcEhd21ca2Y3PjGzoTPsBb9D6FlTeWQsyQKtxNfhxnQDhaRwXx viigodoXct+tOy34QQ1x6rRuHI60WdfKTTpwurTb2LjvpSVo34jLFMwSSWkcehnPis0i u1M2hQ1j9V0zHanNUtIIh5QQH5fk++tEujuFhoHkm8U+DDaUH0zF8Csbto3N4kO3waBo N8ag== X-Gm-Message-State: APuU4Z+9Dp0He9INhsv3ePfvPYnuw9WbGsqXCP+rP+e7IQ7gJE3a+Y1I 3h+Nz9wKAzhWkNU6NRrES6V3/SwbJT9bSBDPLG+CckCkmTbXP+O1BpJfNSVzCQ== X-Gm-Gg: AYBFou3WwTOpCs2fDHA6DTiNL+MlrcapYEayLAfnSCYOloSnOWakBk2IbIAJcyLSa96 5VnLE+1s3spwJmP3p/OHLdApBsJtrOp5/36nd8wI72muLfqlbRGv5+3N65gy5g4Z/RD4TEZM0vd hcMnIiAGeFPSbEn7t47SckP4EUPyFidorghZfNtmN5fm6KKl0F33mA1z7ypJDmOQK5Pm5N+StLX +AxyYMp0H/nY34jh2M5sIWnvpvhBfuEPecAuu2eiZwtyz5AIEYP+pFFB+uqI5EHp8lCLHA3YF8g mo2z9/PnKIM5nfCWazoiy9wY7IEVnTswrRBlSiY2JqJDtWNBTvTyZRqiE+HbaJURUnYUK+y5zcr t7k/AFji4o068nLUP4R/0SFx4Ue9uQI6hqLWpl8H7nrlbPzqgycRSukNMUVbBQ7D1ezxAe9hBFE kBoTpvuq8YhzqMPe9Ksi5g6HyFsCtgmmDCXvHyxCe27THugm3zeIECrld0DmOPekNLL87r+pLNz siF3p1TA9uZTJLV5GcVOWWqArGneQUCWsUr3/rb2+5GxqoluaS+jR/C9VV6WIJ5A4Z8ERg5c4mW kOtpGRLdPHhPWnOVkbX1yI25ZgNFYF0Mnbc1N6dvhlxj4iJl8y0V9JkHt0WJ5nyl8scdK7ZaTL+ g09HTj5s= X-Received: by 2002:a05:6a20:4388:b0:3e2:1aa6:ac24 with SMTP id adf61e73a8af0-3f2fd8a102emr4574061637.32.1794458687665; Wed, 11 Nov 2026 20:44:47 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:44:47 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][blacksail][PATCH 6/16] mpv: patch CVE-2026-123095 Date: Thu, 12 Nov 2026 17:44:16 +1300 Message-ID: <20261112044426.3933391-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:44:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132157 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-123095 Signed-off-by: Ankur Tyagi --- .../mplayer/mpv/CVE-2026-123095.patch | 35 +++++++++++++++++++ .../recipes-multimedia/mplayer/mpv_0.41.0.bb | 4 ++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch diff --git a/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch b/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch new file mode 100644 index 0000000000..9cbd7d8b96 --- /dev/null +++ b/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch @@ -0,0 +1,35 @@ +From 29025d6211cbbceb5e74c3619ddec9dc2fb20ed7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= +Date: Wed, 4 Nov 2026 20:28:57 +0100 +Subject: [PATCH] ytdl_hook: reject playlist entry URLs with control characters + +The entries are joined into a memory:// M3U playlist, one URL per line. +A URL with a line break became several entries, and only the first line +went through url_is_safe(). The other lines were loaded with the origin +of the opened URL, so any protocol was allowed. Skip any URLs with +control characters. + +Fixes: e6e6b0dcc7 +Fixes: GHSA-p99g-m25w-x8xv +(cherry picked from commit c3096515dcd26c14004f985538b5aa41db613856) +CVE: CVE-2026-123095 +Upstream-Status: Backport [https://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856] +Signed-off-by: Ankur Tyagi +--- + player/lua/ytdl_hook.lua | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/player/lua/ytdl_hook.lua b/player/lua/ytdl_hook.lua +index 65ef859595..2b0edb193a 100644 +--- a/player/lua/ytdl_hook.lua ++++ b/player/lua/ytdl_hook.lua +@@ -1111,6 +1111,9 @@ local function run_ytdl_hook(url) + -- links without protocol as returned by --flat-playlist + if not site then + msg.error("Playlist entry does not have unique URL, can't add it.") ++ elseif site:find("%c") then ++ -- a line break would add entries to the playlist ++ msg.error("Playlist entry URL contains control characters, can't add it.") + elseif not site:find("://") then + -- youtube extractor provides only IDs, + -- others come prefixed with the extractor name and ":" diff --git a/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb b/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb index c8a0222ebf..8c68de04c2 100644 --- a/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb +++ b/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb @@ -23,7 +23,9 @@ LIC_FILES_CHKSUM = "file://LICENSE.GPL;md5=570a9b3749dd0463a1778803b12a6dce" LICENSE_FLAGS = "commercial" SRCREV = "41f6a645068483470267271e1d09966ca3b9f413" -SRC_URI = "git://github.com/mpv-player/mpv;name=mpv;branch=release/${@oe.utils.trim_version('${PV}', 2)};protocol=https;tag=v${PV}" +SRC_URI = "git://github.com/mpv-player/mpv;name=mpv;branch=release/${@oe.utils.trim_version('${PV}', 2)};protocol=https;tag=v${PV} \ + file://CVE-2026-123095.patch \ +" inherit meson pkgconfig mime-xdg From patchwork Thu Nov 12 04:44:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103812 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6937.1794458691142027111 for ; Wed, 11 Nov 2026 20:44:51 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=IurHVTXm; spf=pass (domain: gmail.com, ip: 209.85.216.54, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-3b0e0e65adbso1952699a91.3 for ; Wed, 11 Nov 2026 20:44:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458690; x=1795063490; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DJ8Sqp2Qy8v/2Tm+GlgAu/UL6bsjajOG1m6Q/zvsfgI=; b=IurHVTXmxC/S/fhIOzAvcEbn7mHviKxD4gSKVPaGaa3w64tES2/zqrwoKeMABRrtvl qU9L+UVLHHFZ0BNbTLEBoA2jsKXRgIy/gWIiJ44yF47GeRzRMohk97ZL9aEv1AwkLpUJ l6lmCEdCtmCfsC+lwoeR7hMQbziK/N2UbJlD2/1s1LcuetJeVaE7pw294OxTDEZ5pUxn Hiv7JLAvZVN7qmE9erdLa4v6HIjNJ9bLFaT8GiE9ZX5vAMcagUE6KmgzWDL2Kv/QEkzU YNzKbC7r1idmAHxOrSS1httZ+dObGs1pkZRkFxNdq1EFHDyZJe/B3Os8oHMEviyJeihs j1eQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458690; x=1795063490; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DJ8Sqp2Qy8v/2Tm+GlgAu/UL6bsjajOG1m6Q/zvsfgI=; b=YRZEnr8S7ULhw4F9K7rMv4y7hzircyW37dmyFrrdWdKprq4sAOlsjphnU46gYqMs3T 85U/q11kXk8sD3qGyab1uZfCOT1HIKVEkJXkGdS/cxF3LpSkXXINTJsyDV/Arpm5kB0n aCxrfZec8DLQdScOKPsmdOrW1yrH9tgN3q5g4RCRyQEFt3TbULDN+0c/y4pNYMVE3MZB fP0Cccrt0M7vFZ1qUxBYeQexsaAa+kqAFX6N2SYljCk0IRHjY3+dBdwt/3PwDLXjuqA2 afgTKPUBKdqSCw8y8qwKjwk7+YLnRW/FutbGgRz2+A418jLf3EVQW5sc4i3aFt7a1U6H bRDw== X-Gm-Message-State: APuU4Z95QEpn+txS9mbiKFewT0hMt+gy+PP0NWoH5jyLPkr86U8g1yZh gRUAoNff0UAGdckvfeu0OVeX7JxfQ5lS0MaXmlSVPEvSl9Zhue2UospQdxrv7g== X-Gm-Gg: AYBFou1C5R8PwQUVr7Bb6jYTfYE4m3B5fzCCJbtioL01byFnLVByhW5l9IZk30Z2oQJ T3XpraBo0ZSu46TatYEK6/07vglMEzGjnbrNs/m8u24orQs0AGw65hpcAAxJVwz9PWtY/8mIpBQ hhKwh0Ij9pMA9QlJdXlJbhjEddmmEEUZ6f5TaX5gEDwGbP6bSg44FPuR/JX0q9wU+1HqOouCVcZ rl4v/ldtL8O1dBuaeTaOcCeeqXtJogR0KJ9E4130uBiFIC3NipSHJ0ZWk0e8XfckCTFvJ5eZtiQ IcQ6TN5KukEIghiyb50eYfcbI1YIar/D4Uq5sPX83RRQ4nQv9kvyi5E0NS4QNfY0LMu/wBsp87E pxxvaBAIS1hMbWqPcPoWrcdnqdhpsW/HuZXfGsyUMCf0R0p+gDfa1pfTOW8fkrC42ClncyBuHyw bo4eirMc3xiJ5F8TdWlo9DeCna/4+zzs5uQrAew6Rz3+kPWkUWYfLED4Izv13dFa8uJyAY7xVjS V/hPD1S4bc1Snrmxnobk5aNMjf0WmYuAjpCPbVnZpjNZ5eLe+9DsXn6sYC+eKZ4xTL+Nm2A2+hc aNAEIwH1PsGk6KiJp7Fjc3B4hlu2K8VvOPo32GhX/6V6eD/UeJL0Ff9qR1jX4EFEKz8PdvTm6+M CQIVKNyE= X-Received: by 2002:a17:90b:3c44:b0:3b0:97b8:d6bc with SMTP id 98e67ed59e1d1-3b182ec221dmr4080622a91.16.1794458690245; Wed, 11 Nov 2026 20:44:50 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:44:49 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][blacksail][PATCH 7/16] tinyproxy: patch CVE-2026-125371 Date: Thu, 12 Nov 2026 17:44:17 +1300 Message-ID: <20261112044426.3933391-7-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:44:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132158 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-125371 Signed-off-by: Ankur Tyagi --- .../tinyproxy/tinyproxy/CVE-2026-125371.patch | 70 +++++++++++++++++++ .../tinyproxy/tinyproxy_1.11.3.bb | 1 + 2 files changed, 71 insertions(+) create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-125371.patch diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-125371.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-125371.patch new file mode 100644 index 0000000000..7a86af207c --- /dev/null +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-125371.patch @@ -0,0 +1,70 @@ +From 8c8463fb1a0bf7db82d3dfc6f363d5b339e96cd3 Mon Sep 17 00:00:00 2001 +From: rofl0r +Date: Tue, 15 Sep 2026 06:42:05 +0000 +Subject: [PATCH] acl: use hostspec parser to disallow suffix hostname matches + +the existing ad-hoc parsing in acl.c allowed an attacker to +use e.g. an "untrusted.net" domain name to access a reachable +tinyproxy instance if it had an allow list entry for "trusted.net". + +exploiting it would require that the attacker has prior knowledge +of the instance's configuration or is damn good at guessing and +well-budgeted to register lots of potentially matching domains. + +fix by re-using the existing hardened hostspec parser. + +closes #627 + +(cherry picked from commit 3991ac8f98c6a9f05b3265018b812dbf2ca92c28) +CVE: CVE-2026-125371 +Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28] +Signed-off-by: Ankur Tyagi +--- + src/acl.c | 25 +++++++++---------------- + 1 file changed, 9 insertions(+), 16 deletions(-) + +diff --git a/src/acl.c b/src/acl.c +index 2d141ba..db526db 100644 +--- a/src/acl.c ++++ b/src/acl.c +@@ -105,7 +105,6 @@ acl_string_processing (struct acl_s *acl, const char *ip_address, + { + int match; + struct addrinfo hints, *res, *ressave; +- size_t test_length, match_length; + char ipbuf[512]; + + assert (acl && acl->h.type == HST_STRING); +@@ -153,23 +152,17 @@ STRING_TEST: + return -1; + } + +- test_length = strlen (string_addr); +- match_length = strlen (acl->h.address.string); +- + /* +- * If the string length is shorter than AC string, return a -1 so +- * that the "driver" will skip onto the next control in the list. ++ * compare the reverse-resolved client hostname against the ACL ++ * entry, using the shared hostspec matcher so that hostname ++ * entries are matched at label boundaries: plain entries match ++ * the whole hostname exactly, and leading-dot entries match the ++ * apex host plus every subdomain below it. This prevents ++ * suffix-collision bypasses, e.g. "Allow trusted.net" must not ++ * admit "untrusted.net" (GH issue #627). + */ +- if (test_length < match_length) +- return -1; +- +- if (strcasecmp +- (string_addr + (test_length - match_length), +- acl->h.address.string) == 0) { +- if (acl->access == ACL_DENY) +- return 0; +- else +- return 1; ++ if (hostspec_match (string_addr, &acl->h) != 0) { ++ return acl->access != ACL_DENY; + } + + /* Indicate that no tests succeeded, so skip to next control. */ diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb index 46d3a4d7c6..86e7e906b1 100644 --- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb @@ -13,6 +13,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz file://CVE-2026-54387.patch \ file://CVE-2026-55202.patch \ file://CVE-2026-54388.patch \ + file://CVE-2026-125371.patch \ " SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592" From patchwork Thu Nov 12 04:44:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103813 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6938.1794458693140419802 for ; Wed, 11 Nov 2026 20:44:53 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=ATiN1vwO; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3acb11973c3so3063386a91.3 for ; Wed, 11 Nov 2026 20:44:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458692; x=1795063492; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QP6oPwa70E5kCFOZjGla0Yl4/YlmeEjF3j013wiu/k0=; b=ATiN1vwODvprFJ6S1lkgBTua76KOwZslfFE7C6sQgwk+ZV/hgiN4Cgqa2SsCqkhBsX 4HZR4y3uVrQiEU3AjGVZfhW+Do/kGO3IyDNhq6fHvGzjsPeQEdS6o26RnxPgdzgFeFEa kw59wF+xdmM+N7h3U2ou9tlaZG6ry07+fgTjDbogcuNUlF6G/IPdtzQ4r7uukCerLvc6 dwZXTCaQSdRW+dNA7bRgzMidO0MbUUdCc6oAEQsHMpnOH9m+0UViWys5d80JbanP5m4g L1nsWpKcQYQQe5PJn3oAnEr2p6IjTWK9HhGPTCqaCdNQnaeCd7+hRHLOaXo7MpxCdHDN KChw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458692; x=1795063492; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=QP6oPwa70E5kCFOZjGla0Yl4/YlmeEjF3j013wiu/k0=; b=0VTlzAuYXhOlNH4M8ALeh3mP/EB8nrSJJG7flbmLHv8QcOnUEVJulGvFTgU4awpCHU 1ocVAnOLaqEyLkmBfsO/8jjEbZ71T0kxPkArV/l4aG9eBO/KfAzRJto8etbOG4nbaghV rEH+BFXu+ckQqPraaEQIDn6uJuBMYile7DsW5hoFdO69ojN2LxxtWHWpFgGfcuLtsbKo SYwNkkUenAX4yvr2kA7ih+7V52/ux2KhDIU6NpLnPN+JXljXQsT313OKC5hYDLP1hsiR PsRM/2km81B4WR5MvKL0vROkAyNLBdoqPt/dBCFvtys/BLSuN5T/PS27eDIfyzGBIPYY 42mg== X-Gm-Message-State: APuU4Z/6mWRf9CiTaTUlzIYV83MBn6f8aJLhxTznvIBlcJFtSIgpqWeE OWjJXL99W82jghqTlbtEVWber+a7K9JgW3rxfWOH2dVlEbDkpdHrT9uR4KVh9w== X-Gm-Gg: AYBFou2RfHIMDnfAE4l0itmKG7hslpy/Gy6vQkvtbLYI+KBbJU+pO0ABPRZ5Wycekd/ 9NaQgHXrcetguks6Wd06GIqDVzp/tCWn1g1T9CmBvBbY86REdNa/vZumTQl3RHPShgH539pvZAA H+9aTpFpnTzNRKIofZ4k2pxrHBojsI9o1EIA+RcM80FdDUaoR8L/ik/tEWlSOX4SRpNVGMHvQnG aoKwBd13bOpn0zJANYKdqLz8rlj5JGRpfRfAbI9ld0uPbpXo++HGv4BpkQCFF458xrHocoWEBa9 dB+emAvzPBpWPCHGiWpFyl+sLZ9qcoyJkTpWfpS5DGJBw1LUPpXAY6ERISCVdyfYN7ToMPcZQ1B hJKKSSWLAPtSqKYcvRpl3bBW6HkoPtCOA/TL3HWM+eI9pIl39aDlV+wPiQDzx6+Bglohymq0ucz VTbACgHY+8Pn5xXI2N+0k86/sc6EfVNZhodGM1HyG1D+UYftLGkPNe4q9whKCgWLqV8Sh1Uvbvx 7ImI0Df0vJEaVzsEL8rUKXJl2orXBjGtj/9N8GiKJWFBK5gp1tcJBlafIxJMOT9fkXS89MEMygp kEU6SWQB0imRbjmPvdF9Jsi5AQ8ff1azSXRF8OqcgqJz07xI/N1ekY6xgzLUE+xm0NmvNB5lQmV 68ii5mGk= X-Received: by 2002:a17:90b:37c3:b0:3a8:59d3:5317 with SMTP id 98e67ed59e1d1-3b182ebe741mr4813302a91.32.1794458692429; Wed, 11 Nov 2026 20:44:52 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:44:52 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-webserver][blacksail][PATCH 8/16] webmin: patch CVE-2026-125391 Date: Thu, 12 Nov 2026 17:44:18 +1300 Message-ID: <20261112044426.3933391-8-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:44:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132159 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-125391 Signed-off-by: Ankur Tyagi --- .../webmin/files/CVE-2026-125391.patch | 37 +++++++++++++++++++ .../recipes-webadmin/webmin/webmin_2.653.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125391.patch diff --git a/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125391.patch b/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125391.patch new file mode 100644 index 0000000000..077adc95d5 --- /dev/null +++ b/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125391.patch @@ -0,0 +1,37 @@ +From 86791cd2bd1848b3967dc86ae0909493e768db7e Mon Sep 17 00:00:00 2001 +From: Ilia Ross +Date: Sun, 8 Nov 2026 17:38:12 +0100 +Subject: [PATCH] Fix Samba account option command injection + +(cherry picked from commit 18cab89b1fc74ab7e8b1b8b90bbccbe5aba99154) +CVE: CVE-2026-125391 +Upstream-Status: Backport [https://github.com/webmin/webmin/commit/18cab89b1fc74ab7e8b1b8b90bbccbe5aba99154] +Signed-off-by: Ankur Tyagi +--- + samba/samba-lib.pl | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/samba/samba-lib.pl b/samba/samba-lib.pl +index bafd03b8b..2bd90ba26 100755 +--- a/samba/samba-lib.pl ++++ b/samba/samba-lib.pl +@@ -656,7 +656,8 @@ if ($has_pdbedit) { + "cd / && $config{'pdbedit'} -a -s $config{'smb_conf'} -t -u ". + quotemeta($user->{'name'}). + ($config{'sync_gid'} ? " -g $config{'sync_gid'}" : ""). +- " -c '[".join("", @opts)."]' $ws <$temp 2>&1"); ++ " -c ".quotemeta("[".join("", @opts)."]"). ++ " $ws <$temp 2>&1"); + $? && &error("$config{'pdbedit'} failed : 
$out
"); + } + else { +@@ -700,7 +701,8 @@ if ($has_pdbedit) { + $out = &backquote_logged( + "cd / && $config{'pdbedit'} -r -s $config{'smb_conf'} -u ". + quotemeta($_[0]->{'name'}). +- " -c '[".join("", @opts)."]' 2>&1"); ++ " -c ".quotemeta("[".join("", @opts)."]"). ++ " 2>&1"); + $? && &error("$config{'pdbedit'} failed : 
$out
"); + } + } diff --git a/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb b/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb index a46c3aad16..e4380e16a0 100644 --- a/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb +++ b/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb @@ -17,6 +17,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/webadmin/webmin-${PV}.tar.gz \ file://media-tomb.patch \ file://mysql-config-fix.patch \ file://webmin.service \ + file://CVE-2026-125391.patch \ " SRC_URI[sha256sum] = "9acc680d3d45cee876f36fc8810ce68bb6e44a0365e245a4298a180e0d016696" UPSTREAM_CHECK_URI = "http://www.webmin.com/download.html" From patchwork Thu Nov 12 04:44:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103814 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6840.1794458695079692065 for ; Wed, 11 Nov 2026 20:44:55 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=C4V01Lh/; spf=pass (domain: gmail.com, ip: 209.85.210.175, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f175.google.com with SMTP id d2e1a72fcca58-8b29b83fdf1so1763141b3a.2 for ; Wed, 11 Nov 2026 20:44:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458694; x=1795063494; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3FKr6IdO3AGErrp84q6Y01mG8CJRDIV41AlHUtn2j/s=; b=C4V01Lh/6Fejs+cT0XCZVtSKZ4jNxCPq3b+lzQBnOMjTFVj03igUtpxIgjE4WRcGKu P6j/s5V/GIiXrckiRouwie0DHNotDs96Eroi2afIqu+qg7KrfHFi+CDBdBsBge1/9DiR ZixhMzNlwh6/Ou0CpvRPU5ykMpd24ZxNfSE1lUS+udgVuR5KmG1ufvzMjfEnV4hLElqA 2vV/WisusorNye5Z3Qe3KVy9QmOH4GRNVjocYkD84VkpjfSIG1Mg0s3+fh6iULREX5hY 9NA9DHXXs837xg9vjfD08LqGl9Y4a+sxjvmS8ffsTiHRPUyHqnfngrHCbgFJpVlc04nK 0MkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458694; x=1795063494; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=3FKr6IdO3AGErrp84q6Y01mG8CJRDIV41AlHUtn2j/s=; b=Heu/aXT+Nu1l/u2qU2Ow0Q74y2qrHEwJqXa9Rx+LcuvXzyZjAdqFfIU1YOZR9wvtIF k6F+z9aLioKm0+Tebcb2nyQmvIlRPVYdE9HOJJ/f/pdMS8NAxcSGidGPIcTyiM6UrHu4 EyaWaxiX0VynG4zRaRj3aUXBVXZpEL9LNYesRF4IpmEB6NzP2Zn4/SvSiUgvXbZgI6Ft mUTIOoxvHwjHNmxlbx60YmEiScp+P4HaCvcsYHfXWEFnLI6duscF+VRljH4ENWMCp0yE 7DzVGwHZswFWqEf8j2wqgj7PrrHAyl+m11hNIgtAeBW0t8+O8RCvgiZAJ1pOyjK4vZBC /BQg== X-Gm-Message-State: APuU4Z/MDwB1o5jsWVJ/WUS9dxvIJ87yjsVFMZAXqV3AplO99BU/Bf6D A99U1ums/gVLpUzcKuniVDHt2CyBOwoiCBiHe04qbtm/SO+YKN45PAofXY6Uaw== X-Gm-Gg: AYBFou2l5adS17YbehqX+GW+FE8no/vxzd2ASg4Nd74/VyqVe/9QARZC7LqjGyp46hs MgYjf0KYktfLlKxfXQNeKVxo1JGr2Y5wgoz/eN+CeQ64KBOdH8848oHM9s+r5Lipz6UF/5e0KKv +OAtT4FAtz7BJkwt0+nkT3xv3fmlNy9hA4x9oMI5va5CsuyK8ZZCqOdZ8CLun5PKjgxTSsw249x 81bCJDuW+rzgWQeNJzPiPu2NzgFMSdMBftbJOjpJev0vlq4im0zR6LA7NxjQ9A0X6c98jb/g75+ +rEhSKv+tNve6kpAIW3KjibDL0nNbnKVIuc0GDYoFFGUY3khI63z/z0wCq+Sy7S2Llq54wOP3cx 5BPe3aELEMPE8zPxfgWGg6xIz8ZXX3ZxOLmCiwF/KitwZZqU7MTJ+b1zx7qeCG/8kVx5GfaL3lK LTp1da2mogUsjY401x32oSv2OGSHXaQuS+0y5FsWW65jNfsrDrfS/K5nKhaPwAoF385hg11sLeg r9CeuyhoJKmhghlZ24qnBquCn0pWMj52cTl4tbV0fuKm6y4q0cfFyFpGk2oSxOdSg3EZofascIZ H+VDsrL8rCyDs6e1qgH2qFtcVqN9hLXiGncz2NB2y6OMSHG3nHbb8kJu3R8Sq3FIKDnEXhNdUDf I71N0ECk= X-Received: by 2002:a05:6a21:a91:b0:3e2:6fe6:9b91 with SMTP id adf61e73a8af0-3f2fa4934f1mr4686421637.12.1794458694413; Wed, 11 Nov 2026 20:44:54 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:44:54 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-webserver][blacksail][PATCH 9/16] webmin: patch CVE-2026-125392 Date: Thu, 12 Nov 2026 17:44:19 +1300 Message-ID: <20261112044426.3933391-9-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:44:56 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132160 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-125392 Signed-off-by: Ankur Tyagi --- .../webmin/files/CVE-2026-125392.patch | 26 +++++++++++++++++++ .../recipes-webadmin/webmin/webmin_2.653.bb | 1 + 2 files changed, 27 insertions(+) create mode 100644 meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125392.patch diff --git a/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125392.patch b/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125392.patch new file mode 100644 index 0000000000..f357eb703a --- /dev/null +++ b/meta-webserver/recipes-webadmin/webmin/files/CVE-2026-125392.patch @@ -0,0 +1,26 @@ +From 261c858c1f09b734add7239b835c1085eab3106c Mon Sep 17 00:00:00 2001 +From: Jamie Cameron +Date: Sun, 8 Nov 2026 17:20:57 -0800 +Subject: [PATCH] Add HTML escaping in all-records mode + +(cherry picked from commit 224cbd91467c98c3147df695fe9abc8149183356) +CVE: CVE-2026-125392 +Upstream-Status: Backport [https://github.com/webmin/webmin/commit/224cbd91467c98c3147df695fe9abc8149183356] +Signed-off-by: Ankur Tyagi +--- + bind8/edit_recs.cgi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/bind8/edit_recs.cgi b/bind8/edit_recs.cgi +index 2141c0a12..627143b37 100755 +--- a/bind8/edit_recs.cgi ++++ b/bind8/edit_recs.cgi +@@ -268,7 +268,7 @@ for(my $i=0; $i<@_; $i++) { + if (length($joined) > 80) { + $joined = substr($joined, 0, 80)." ..."; + } +- push(@cols, $joined); ++ push(@cols, &html_escape($joined)); + } + if ($config{'allow_comments'} && $in{'type'} ne "WKS") { + push(@cols, &html_escape($r->{'comment'})); diff --git a/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb b/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb index e4380e16a0..8598994a17 100644 --- a/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb +++ b/meta-webserver/recipes-webadmin/webmin/webmin_2.653.bb @@ -18,6 +18,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/webadmin/webmin-${PV}.tar.gz \ file://mysql-config-fix.patch \ file://webmin.service \ file://CVE-2026-125391.patch \ + file://CVE-2026-125392.patch \ " SRC_URI[sha256sum] = "9acc680d3d45cee876f36fc8810ce68bb6e44a0365e245a4298a180e0d016696" UPSTREAM_CHECK_URI = "http://www.webmin.com/download.html" From patchwork Thu Nov 12 04:44:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103815 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6940.1794458697613581767 for ; Wed, 11 Nov 2026 20:44:57 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=tqSXP6ku; spf=pass (domain: gmail.com, ip: 209.85.215.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-cc751eddf25so2075943a12.3 for ; Wed, 11 Nov 2026 20:44:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458697; x=1795063497; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=LSJSGAJPx03D7Tpd3VpFQct2bfESpAi2T5mLwdAAEZE=; b=tqSXP6kuAZ98EjINd3msHIORRT2pyckn17bjq18lCfncC8nDUL62i7SYnMZRy5sF9/ Jw55wR50AsqjK1uQsBswq82K3DhZgD3b6xhcyUNaYn+0uqQo0z0gIxyzbfQQawItdZEV QXlVXH8KB+E06nYjEQIkuspwnKYkOovddt5jD1D3jjkSgj47kMCT36//N0zKf1MiRzUp kjwPfpv3/c87UwglKf0tZhVewuFsLnG+TajwW7eAAZHVEtUfwWFLOoT2vzZ2zF5MTibc 6HiIkQdZkF8i1zHF5BQUDZQH44B08zeS+zuu4XZjpw+dcteMRklkybL3LJA7Ukb/1b/x nRGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458697; x=1795063497; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=LSJSGAJPx03D7Tpd3VpFQct2bfESpAi2T5mLwdAAEZE=; b=OTujW7PleSQ2JT9/39eHPn5rTyZN5N+9/1pXJrvumdESyNNAN0YyF+Cpehd4SEabUb q9LHovfD6DfmmYkVbZrTM52Dmp+NmLNEdrfcD4KErlGz7vS6dhEBd6R6iJbI3ws9Lfws QJV8IAeYJXAkPT/MVIrQkbnHjQE7fn387vwKnTAMqdjTQpaGWCvDrXmHJUTo2WuKlrBp raIxlwae+ZqZN2BcqqDyu5bW2cLBKO63xqbZW58kA5Yu9JApoNReLiogW2I9VsXj1xRJ IVNPcDvT8G4DwGjcs10Hsh814EqPkD61EjC+xXTiLkHtrLbk8e6132EcXhD/PSLnBdC4 gq5A== X-Gm-Message-State: APuU4Z/omZCS/ZBQT5mOaRaGQQSqh+osaxLHbGI/8b5ibTnX5YklB1lR kYBYUfhjsJdBh0iHwo3rGuN8Flu26n+ZcXCPeZrsuEcom7lgJN4vUY5PmLKrvA== X-Gm-Gg: AYBFou1+vyRJt5deQciTbzqTsESXmgAmbLlghrRzi2MQnjYOwSYFr3nKyufojXhgpnC xPCXr0GH1UdMLpo1iyChZC2oe+3s/C4GXFRQ42UyzmVJBc48oj4Rh/9udeHzKVDpi7HmL/SvVVv zLsrZP9vE+GB1w05jrxNfGDat65M932ktCetAOfms5lvXj63BnPAO7tpRhLjbYioECfd/lVc3gJ PDXO3xzlVYWnoBMYeQIYdB7YWY+vCoVxJyxXmb8Pql/MPa5OjPgGeaZgcgOb8EV1WQqdGX+6djK 2LcXLR4ty2aGB5ELtoJ0j5T1IPLn5PjBjRnb/pZBYA7yl5rSK5FT8EaBAjE2BUH91yAFGnZJdmg PuW776i0SztkMgki7BEPX1s6wqU1kSz++Il5m2HR+7W2zZPsNwy7hiRA86Syt/FtPmQI6SclN5z RiosC/pCmNTyT1/sq0RiZfaPEkqDUqS8yZaaiUOLk1flPAfPu0W8tG8LEOy8c3VPBGs3RnrRAyh +lDzLOHIPQHars/mlWiXA/gYPWCrjQN+Gr48x71qzEzbzjidQxQyFQPr7fwl8pUupBAV4ioryS5 eJl2ajrYDwm1yC4QatjLdPBfJ7W93IqVWCOGDviuMTsSgJZcE+9FfTL6g6LaQw== X-Received: by 2002:a17:90b:3ec1:b0:3ac:74b3:a8f3 with SMTP id 98e67ed59e1d1-3b182efb251mr4119112a91.44.1794458696734; Wed, 11 Nov 2026 20:44:56 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:44:56 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][blacksail][PATCH 10/16] python3-aiohttp: patch CVE-2026-111063 Date: Thu, 12 Nov 2026 17:44:20 +1300 Message-ID: <20261112044426.3933391-10-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:45:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132161 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-111063 Signed-off-by: Ankur Tyagi --- .../python3-aiohttp/CVE-2026-111063.patch | 136 ++++++++++++++++++ .../python/python3-aiohttp_3.14.3.bb | 2 + 2 files changed, 138 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111063.patch diff --git a/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111063.patch b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111063.patch new file mode 100644 index 0000000000..f9654a5a9b --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111063.patch @@ -0,0 +1,136 @@ +From 2dcbe838baee9938cdf4f0b7a8c682b92913bb76 Mon Sep 17 00:00:00 2001 +From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com> +Date: Sun, 27 Sep 2026 21:27:34 +0100 +Subject: [PATCH] [PR #13830/e11d2836 backport][3.14] Fix secure shared cookie + (#13832) + +**This is a backport of PR #13830 as merged into master +(e11d2836203a21bec59095498e578d37801027e7).** + +Co-authored-by: Sam Bull +(cherry picked from commit 999c356d61e966faffa97b06ab0d0455226d36c5) + +CVE: CVE-2026-111063 +Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5] + +Signed-off-by: Ankur Tyagi +--- + CHANGES/13830.bugfix.rst | 1 + + aiohttp/cookiejar.py | 3 +++ + docs/client_reference.rst | 3 ++- + docs/spelling_wordlist.txt | 1 + + tests/test_client_functional.py | 9 +++++++-- + tests/test_cookiejar.py | 28 ++++++++++++++++++++++++++++ + 6 files changed, 42 insertions(+), 3 deletions(-) + create mode 100644 CHANGES/13830.bugfix.rst + +diff --git a/CHANGES/13830.bugfix.rst b/CHANGES/13830.bugfix.rst +new file mode 100644 +index 000000000..2a3976924 +--- /dev/null ++++ b/CHANGES/13830.bugfix.rst +@@ -0,0 +1 @@ ++Fixed ``CookieJar.filter_cookies()`` sending shared cookies (cookies without a ``Domain`` attribute) marked ``Secure`` over unencrypted connections -- by :user:`Dreamsorcerer`. +diff --git a/aiohttp/cookiejar.py b/aiohttp/cookiejar.py +index 2b9722470..0d2f3e05c 100644 +--- a/aiohttp/cookiejar.py ++++ b/aiohttp/cookiejar.py +@@ -478,6 +478,9 @@ class CookieJar(AbstractCookieJar): + # Send shared cookie + key = ("", "") + for c in self._cookies[key].values(): ++ if is_not_secure and c["secure"]: ++ continue ++ + # Check cache first + if c.key in self._morsel_cache[key]: + filtered[c.key] = self._morsel_cache[key][c.key] +diff --git a/docs/client_reference.rst b/docs/client_reference.rst +index 734201128..a237fb64b 100644 +--- a/docs/client_reference.rst ++++ b/docs/client_reference.rst +@@ -2544,7 +2544,8 @@ Utilities + :param ~yarl.URL response_url: URL of response, ``None`` for *shared + cookies*. Regular cookies are coupled with server's URL and + are sent only to this server, shared ones are sent in every +- client request. ++ client request (except that shared cookies marked ``Secure`` ++ are only sent over encrypted connections). + + .. method:: filter_cookies(request_url) + +diff --git a/docs/spelling_wordlist.txt b/docs/spelling_wordlist.txt +index 24561f52d..88638bf12 100644 +--- a/docs/spelling_wordlist.txt ++++ b/docs/spelling_wordlist.txt +@@ -369,6 +369,7 @@ un + unawaited + unclosed + undercounting ++unencrypted + unescaped + unhandled + unicode +diff --git a/tests/test_client_functional.py b/tests/test_client_functional.py +index 9470876d0..639ca4606 100644 +--- a/tests/test_client_functional.py ++++ b/tests/test_client_functional.py +@@ -2909,12 +2909,17 @@ async def test_morsel_with_attributes(aiohttp_client) -> None: + c = http.cookies.Morsel() + c.set("test3", "456", "456") + c["httponly"] = True +- c["secure"] = True + c["max-age"] = 1000 + ++ # A Secure shared cookie must be withheld entirely: the test server ++ # is plain http, so it must not reach the handler at all. ++ c2: http.cookies.Morsel[str] = http.cookies.Morsel() ++ c2.set("test4", "789", "789") ++ c2["secure"] = True ++ + app = web.Application() + app.router.add_get("/", handler) +- client = await aiohttp_client(app, cookies={"test2": c}) ++ client = await aiohttp_client(app, cookies={"test2": c, "test4": c2}) + + async with client.get("/") as resp: + assert 200 == resp.status +diff --git a/tests/test_cookiejar.py b/tests/test_cookiejar.py +index 9276ff252..9f279801b 100644 +--- a/tests/test_cookiejar.py ++++ b/tests/test_cookiejar.py +@@ -1206,6 +1206,34 @@ async def test_treat_as_secure_origin() -> None: + assert len(filtered_cookies) == 1 + + ++async def test_treat_as_secure_origin_sends_secure_shared_cookie() -> None: ++ endpoint = URL("http://127.0.0.1/") ++ ++ jar = CookieJar(unsafe=True, treat_as_secure_origin=[endpoint]) ++ jar.update_cookies(SimpleCookie("shared-secure-cookie=first; Secure;")) ++ ++ filtered_cookies = jar.filter_cookies(request_url=endpoint) ++ assert "shared-secure-cookie" in filtered_cookies ++ ++ ++async def test_filter_cookies_with_secure_shared_cookie() -> None: ++ """Secure shared cookies (no Domain attribute) must not be sent over cleartext.""" ++ jar = CookieJar() ++ jar.update_cookies( ++ SimpleCookie("shared-secure-cookie=first; Secure; shared-cookie=second;") ++ ) ++ ++ filtered = jar.filter_cookies(URL("http://example.com/")) ++ assert set(filtered.keys()) == {"shared-cookie"} ++ ++ filtered = jar.filter_cookies(URL("https://example.com/")) ++ assert set(filtered.keys()) == {"shared-cookie", "shared-secure-cookie"} ++ ++ # The morsel cached by the https request must not bypass the Secure check. ++ filtered = jar.filter_cookies(URL("http://example.com/")) ++ assert set(filtered.keys()) == {"shared-cookie"} ++ ++ + async def test_filter_cookies_does_not_leak_memory() -> None: + """Test that filter_cookies doesn't create empty cookie entries. + diff --git a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb index b862076869..3f97b89ef2 100644 --- a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb +++ b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb @@ -6,6 +6,8 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=b5e9e27554f71f0f132919037cb967b2" SRC_URI[sha256sum] = "9491196535a88924a60afd5b5f434b5b203b6cc616250878dbdb223a8f7844bc" +SRC_URI += "file://CVE-2026-111063.patch" + CVE_PRODUCT = "aiohttp:aiohttp" CVE_STATUS_GROUPS = "CVE_AIOHTTP_FIX_3_13_4" CVE_AIOHTTP_FIX_3_13_4[status] = "fixed-version: fixed in 3.13.4" From patchwork Thu Nov 12 04:44:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103816 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6941.1794458699606109289 for ; Wed, 11 Nov 2026 20:44:59 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=MiWWAmkb; spf=pass (domain: gmail.com, ip: 209.85.215.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-cc147d86bebso269086a12.0 for ; Wed, 11 Nov 2026 20:44:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458699; x=1795063499; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=SAF7qDbL8eA6kMUKZU8F1PSUIQVQEg3hxxtPho6fm+0=; b=MiWWAmkb8yOmqrbc7kQOzmnRZH8HeBxX4SbwbAx2iW6C+ovq6SWkJCKpgcUiKgwKuO cV7JxMLcTjRoPrQbfLDCaOzAtxztE7WI4JzDTXJr/9J6Cq59mevXAoxQRZaoxSJ5MmBh v3g8Rdwdfpb00ogagD0A6ds4npdvpj52+rPlyUEbTKX6NeBZ/8vwEplAQeMmGBbwITXh HsmkdXo/TX5x5+gBgu1jyDRydizNMIDRCk0WHXTKeitGJTnuswXSxsFQm6QOXR6LgdEu t3Z8YZ7RM496/MccVvlTYVa7Vw1o8hhNaOq+KAVYsDFkTOn9SNeG/CaenGOL3avo+s9C FzpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458699; x=1795063499; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=SAF7qDbL8eA6kMUKZU8F1PSUIQVQEg3hxxtPho6fm+0=; b=drLMv9bqVvzDPTepptNvSz8Vbdg9NM3PYWdlcCKzol3839XeCZvGpiwmwRGK7zbGBn LLKAFp0U3NXsWY14ZieymUwddGEIaBh7K0PCfSL16DW8Bpc2eaeVNAxRqsRQg/hz3Zjp TGspUhOS/mczgvPjXnqZUwhqezZbBGpLZei0P3ToSX7RhN2Kq4oGjEcyPfGg3gSeU6LJ YuW5rxN7yTbjCPXj6gMlyrmPoMqe4sC1kb7eNfr9XCFiip6Wa36ipJTgkuH8QkSFZaB1 GtDJMvW44IkEvN839YKNIUzPgJeQBgjSqzRrUzokpniHrb2fUbVxc+alUPTq2xAzWeMi dpwQ== X-Gm-Message-State: APuU4Z9umcBrRzXbZHySVMZ0yRZq0hDCLAayxKLxoWs4QZl4qahuv8Tz T0xfDrcvBUESMoLTODRlnjIvWeI3VuLzlbmoEa2XcBMXtDCwn4TRTGTvZVXbHQ== X-Gm-Gg: AYBFou3dTIAF/mhHJIxk4BQVOoPur6AcBVB8YrHI3HPgM46Euzc/qoVAfo0/ncaLya6 Irl9RQndZxhQahypRND5vJUXLceVFAsXJQG/fTv+IKbaKs3MwdqRAC39oA/oHUm6d8YnBvrBHYQ cfU/Tl1MEV6qdp6jTU5mqjpXNfff+JGAPl1bDNGfHnqKbsAhO0lPM8H12ZFI+c33Uq0jwdzTdOf NLtB6/1oerKpXTN4nEHtTnNEQF7CWwvyGtkopiZNzfhoV7ZA3leBc83oq0f80ktW9vP4ikojqDh yMm7zIsLK2pcxQj9GXW5CbSZt9fT1Ao7u06+hzRZdy1PyFQoPnjPKe45znnEQvzLaM8HGdBwrdK b80jtiePDGRG7DBo0hkSCGcGzb6TGB72TM9SpIX4xBfFqesV/4J0X6SD7eY5GJbUvh05y6DTqnO JzO6Y3BkQ68vXzBdDcxFMIb3wg4zHxUE2xwK/oy+B7Up7FMIU0rM9yQ95IzZO/lM+brhfPM9gO0 gw2Ux39NCfGAnA/C7q90N+9FTGM+ubymRoJfaMmnDijncHENBkK5D7dnlxAeXimpDTZO/7LQnvN 4IwWu7nvTAir9RFZD7PgvHnt67AAB5tP8vD2Xv8L67ctWo4EpdWtIzEk6XS89Q== X-Received: by 2002:a05:6a20:6a03:b0:3e2:3de2:5947 with SMTP id adf61e73a8af0-3f6335874cemr1238078637.16.1794458698816; Wed, 11 Nov 2026 20:44:58 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:44:58 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][blacksail][PATCH 11/16] python3-aiohttp: patch CVE-2026-111065 Date: Thu, 12 Nov 2026 17:44:21 +1300 Message-ID: <20261112044426.3933391-11-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:45:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132162 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-111065 Signed-off-by: Ankur Tyagi --- .../python3-aiohttp/CVE-2026-111065.patch | 172 ++++++++++++++++++ .../python/python3-aiohttp_3.14.3.bb | 4 +- 2 files changed, 175 insertions(+), 1 deletion(-) create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111065.patch diff --git a/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111065.patch b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111065.patch new file mode 100644 index 0000000000..affe7e62a9 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111065.patch @@ -0,0 +1,172 @@ +From 16a92b236b34f86d3873e29292b78159dd3ff19f Mon Sep 17 00:00:00 2001 +From: "patchback[bot]" <45432694+patchback[bot]@users.noreply.github.com> +Date: Wed, 9 Sep 2026 14:43:30 +0100 +Subject: [PATCH] [PR #13677/9e08ba02 backport][3.14] Fix cookie overflow + (#13679) + +**This is a backport of PR #13677 as merged into master +(9e08ba02abe573ce9e4cc541d4e3c3646adb43a7).** + +--------- + +Co-authored-by: Sam Bull +(cherry picked from commit 9dd8eaf4e31f1237ef2c1574a8c82a739fca5805) + +CVE: CVE-2026-111065 +Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805] + +Signed-off-by: Ankur Tyagi +--- + CHANGES/13677.bugfix.rst | 1 + + aiohttp/client.py | 5 ++++ + aiohttp/cookiejar.py | 10 ++++++- + tests/test_client_functional.py | 46 ++++++++++++++++++++++++++++++++- + tests/test_cookiejar.py | 22 ++++++++++++++++ + 5 files changed, 82 insertions(+), 2 deletions(-) + create mode 100644 CHANGES/13677.bugfix.rst + +diff --git a/CHANGES/13677.bugfix.rst b/CHANGES/13677.bugfix.rst +new file mode 100644 +index 000000000..bea67cba7 +--- /dev/null ++++ b/CHANGES/13677.bugfix.rst +@@ -0,0 +1 @@ ++Fixed a possible ``OverflowError`` on cookies and a connection not being closed properly -- by :user:`Dreamsorcerer`. +diff --git a/aiohttp/client.py b/aiohttp/client.py +index 12f236d6c..df9fbd8c9 100644 +--- a/aiohttp/client.py ++++ b/aiohttp/client.py +@@ -697,6 +697,7 @@ class ClientSession: + + timer = tm.timer() + req: ClientRequest | None = None ++ resp: ClientResponse | None = None + try: + with timer: + # https://www.rfc-editor.org/rfc/rfc9112.html#name-retrying-requests +@@ -1020,6 +1021,10 @@ class ClientSession: + handle.cancel() + handle = None + ++ if resp is not None: ++ # A failure occurred after the response was received. ++ resp.close() ++ + if req is not None and req._body is not None: + await req._body.close() + +diff --git a/aiohttp/cookiejar.py b/aiohttp/cookiejar.py +index 0d2f3e05c..b949cc118 100644 +--- a/aiohttp/cookiejar.py ++++ b/aiohttp/cookiejar.py +@@ -425,7 +425,15 @@ class CookieJar(AbstractCookieJar): + if max_age := cookie["max-age"]: + try: + delta_seconds = int(max_age) +- max_age_expiration = min(time.time() + delta_seconds, self.MAX_TIME) ++ # https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.2 ++ if delta_seconds <= 0: ++ max_age_expiration = 0.0 ++ else: ++ # Cap first to protect against OverflowError on next line. ++ delta_seconds = min(delta_seconds, self.MAX_TIME) ++ max_age_expiration = min( ++ time.time() + delta_seconds, self.MAX_TIME ++ ) + self._expire_cookie(max_age_expiration, domain, path, name) + except ValueError: + cookie["max-age"] = "" +diff --git a/tests/test_client_functional.py b/tests/test_client_functional.py +index 639ca4606..f07104b81 100644 +--- a/tests/test_client_functional.py ++++ b/tests/test_client_functional.py +@@ -15,7 +15,7 @@ import tarfile + import time + import zipfile + import zlib +-from collections.abc import AsyncIterator, Awaitable, Callable ++from collections.abc import AsyncIterator, Awaitable, Callable, Sequence + from contextlib import suppress + from typing import Any, NoReturn + from unittest import mock +@@ -3050,6 +3050,50 @@ async def test_set_cookies_max_age_overflow(aiohttp_client) -> None: + assert int(cookie["max-age"]) == int(overflow) + + ++async def test_connection_released_when_cookie_processing_fails( ++ aiohttp_client: AiohttpClient, ++) -> None: ++ class EvilJar(aiohttp.CookieJar): ++ def update_cookies_from_headers( ++ self, headers: Sequence[str], response_url: URL ++ ) -> None: ++ raise RuntimeError("boom") ++ ++ hold = asyncio.Event() ++ ++ async def hostile(request: web.Request) -> web.StreamResponse: ++ ret = web.StreamResponse() ++ ret.content_length = 2 ++ ret.set_cookie("sid", "x") ++ await ret.prepare(request) ++ await ret.write(b"x") ++ await hold.wait() ++ assert False ++ ++ async def clean(request: web.Request) -> web.Response: ++ return web.Response() ++ ++ app = web.Application() ++ app.router.add_get("/hostile", hostile) ++ app.router.add_get("/clean", clean) ++ connector = aiohttp.TCPConnector(limit=1) ++ client = await aiohttp_client(app, connector=connector, cookie_jar=EvilJar()) ++ ++ try: ++ for _ in range(2): ++ with pytest.raises(RuntimeError, match="boom") as excinfo: ++ await client.get("/hostile") ++ assert not connector._acquired ++ del excinfo ++ ++ # The single connector slot is free again: an unaffected request ++ # succeeds instead of waiting forever for a connection. ++ async with client.get("/clean") as resp: ++ assert resp.status == 200 ++ finally: ++ hold.set() ++ ++ + async def test_request_conn_error() -> None: + client = aiohttp.ClientSession() + with pytest.raises(aiohttp.ClientConnectionError): +diff --git a/tests/test_cookiejar.py b/tests/test_cookiejar.py +index 9f279801b..be6da2a5f 100644 +--- a/tests/test_cookiejar.py ++++ b/tests/test_cookiejar.py +@@ -2069,3 +2069,25 @@ async def test_cookie_jar_unsafe_property() -> None: + + jar_unsafe = CookieJar(unsafe=True) + assert jar_unsafe.unsafe is True ++ ++ ++async def test_update_cookies_max_age_beyond_float_range_is_clamped() -> None: ++ """A hostile Max-Age larger than float max must clamp, not raise OverflowError.""" ++ url = URL("https://example.com/") ++ jar = CookieJar() ++ ++ jar.update_cookies_from_headers([f"sid=x; Max-Age={'9' * 309}"], url) ++ ++ assert "sid" in jar.filter_cookies(url) ++ assert jar._expirations[("example.com", "", "sid")] == CookieJar.MAX_TIME ++ ++ ++async def test_update_cookies_negative_max_age_beyond_float_range_expires() -> None: ++ """A negative Max-Age below float min must expire the cookie, not raise.""" ++ url = URL("https://example.com/") ++ jar = CookieJar() ++ ++ jar.update_cookies_from_headers([f"sid=x; Max-Age=-{'9' * 309}"], url) ++ ++ assert "sid" not in jar.filter_cookies(url) ++ assert len(jar) == 0 diff --git a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb index 3f97b89ef2..f3bb555408 100644 --- a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb +++ b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb @@ -6,7 +6,9 @@ LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=b5e9e27554f71f0f132919037cb967b2" SRC_URI[sha256sum] = "9491196535a88924a60afd5b5f434b5b203b6cc616250878dbdb223a8f7844bc" -SRC_URI += "file://CVE-2026-111063.patch" +SRC_URI += "file://CVE-2026-111063.patch \ + file://CVE-2026-111065.patch \ +" CVE_PRODUCT = "aiohttp:aiohttp" CVE_STATUS_GROUPS = "CVE_AIOHTTP_FIX_3_13_4" From patchwork Thu Nov 12 04:44:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103817 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6942.1794458702030473566 for ; Wed, 11 Nov 2026 20:45:02 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=oW8X7lzf; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-3ac91ac8924so2232335a91.1 for ; Wed, 11 Nov 2026 20:45:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458701; x=1795063501; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=jkOSClZIalhZgkHS9HxGU4OnrmAudc4stNu0zE/BspI=; b=oW8X7lzfU8VUMmWbyBFymkHg1rJbioGZu6qkRUV7cdiv4VLGPY3Try9Tg/Encmr+7q +nYwTgd7Vnx+0wts/NJ7rd8wHDVhEyKtXZ5hXjGDSi08EV64mcHJEsMXhTlP6Wr3M6av F9hwRIlR3CoEr4pDz9LiuMYciTKRIU+CYCN1tjIGZl2x9EGS7MNxhQjjiTz1uFiSHw9X rLgJiovPKBlxjzt94E/Zpu0V2n1nqeEcfnk4rrwvarokmFiQ4DWfcVEUe/QRt1TAaLSO sWpKvDtJyiU5PFjEeMNhcKv/gfIPGzjpdg01FHQnUUCRZr9lIHHqzPe60ZNND4MAER5E ZgPQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458701; x=1795063501; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=jkOSClZIalhZgkHS9HxGU4OnrmAudc4stNu0zE/BspI=; b=hxdk8QCjZ6FRU4p1vVyebXrdO4iONmTUjGBd7nulXqCVQMZLBnbep/nTNH41Jcvqoo Vv4t+IYFu0CgYsFQuZK2JebnDX7PGzKVV/6ssLLE5B1mazgDoXaEmhpBvMVX0JJ6Ktns um4MFFI6Sq3bG5Au2nx3zq09+phEEJJGxeckgmZlL1a6Fsm9c0U3wtgXwjp/rCo/pBfZ 0Qm4D3pxYGn7yV9wQByjge0LAqoNOJuh5e0ROG2aDPSrknLiqxD6/k1/vKPopKiHo6a4 llrgPNNZCAxlkLc4SF/S0M4Qnr3eX4QHooHHHSwq1S7M8SaBWV/wB3UPdsemy3KhcLb7 hT3w== X-Gm-Message-State: APuU4Z+9ECdiKsZcWJWa0vsZQ7Y6J4FnmbHZv3/3RC9a/4JQJVW3kNdX MGKFNJIVDT7rL1IyC1fIVRwmQByF/0JevpE9rBuA/AxA1d2vg5AtlATXRzj5Ew== X-Gm-Gg: AYBFou2prTvZaGMuoUNfAEBjP3eTjMrpVhd6KopJU19skoNE7h+Q6k745gDNuZr5Efn NraAXrbhTyaJIHTqVXpHgxRfhnNtRIwkWN8fTSlZmbn//IVMjQZrRM32PbCu3FVFIf0s18kPxe7 Ka57cxFvPXLIx7JMTouYC2GVOwldCJOk/4Qpp2mCyq9b55bjhtEny4Zl0zhP7FL9VNKQrNsbJPp krKbzWJ79LvB3tV5PF385em5pkZusBm0Z9j2YF3KmqnYpiwFs6DubFieJ642sxro6eS3EoWPyEb xbDhANPaYBcG6VCiDDW3SU9z/Ba6s6qUbPuYVV9Ri30HZDo7Ocb7OxfTRntV64EQu4z7MfYOzP7 RL9gcJ4oVODIuqNw7XVq6lK1GZw5+TYVFHxsjxxG0BopQjUrUMp9tvl5C+wetIL3ZUTgS74DwYy 3RGoMB0mbgB93pBc39b67OgBS/rJdAx3+M9D/qXkgFv2rvAKU1pQ+sh4sFlkHGkoUOgxcw+ep4X 1hPSb42XQVGiDiGByfvS172wsJjIClPFRVUVKWG4iSJ27Rbxr+oQ0SNT6whVEwaN3YnRA32I8qa idV3BDEYIwN7X0nq1ocDE4X0YMhnO7QFX81fx5bvN7nfY7yAsszm6CS5p5PVHg== X-Received: by 2002:a17:90b:518b:b0:3b0:e388:d9da with SMTP id 98e67ed59e1d1-3b182f28620mr4810527a91.29.1794458701157; Wed, 11 Nov 2026 20:45:01 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.44.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:45:00 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][blacksail][PATCH 12/16] python3-aiohttp: patch CVE-2026-111066 Date: Thu, 12 Nov 2026 17:44:22 +1300 Message-ID: <20261112044426.3933391-12-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:45:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132163 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-111066 Signed-off-by: Ankur Tyagi --- .../python3-aiohttp/CVE-2026-111066.patch | 382 ++++++++++++++++++ .../python/python3-aiohttp_3.14.3.bb | 1 + 2 files changed, 383 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111066.patch diff --git a/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111066.patch b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111066.patch new file mode 100644 index 0000000000..5f11f31d54 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111066.patch @@ -0,0 +1,382 @@ +From a45985a1dba1aaacad2b12724b450496a6ab0903 Mon Sep 17 00:00:00 2001 +From: Sam Bull +Date: Tue, 18 Aug 2026 21:54:45 +0100 +Subject: [PATCH] Reduce number of file descriptors needed in multipart + messages (#13426) (#13475) + +(cherry picked from commit c92ed4c48dafd40d5ed4c86587af9e081ac7d971) +(cherry picked from commit 2d94633b7f1b4c1ba07d647b629a8440652b2d09) + +CVE: CVE-2026-111066 +Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09] + +Signed-off-by: Ankur Tyagi +--- + CHANGES/13426.bugfix.rst | 1 + + aiohttp/web_request.py | 91 ++++++++++++++----- + tests/test_web_functional.py | 166 ++++++++++++++++++++++++++++++++++- + 3 files changed, 234 insertions(+), 24 deletions(-) + create mode 100644 CHANGES/13426.bugfix.rst + +diff --git a/CHANGES/13426.bugfix.rst b/CHANGES/13426.bugfix.rst +new file mode 100644 +index 000000000..8b9ee295f +--- /dev/null ++++ b/CHANGES/13426.bugfix.rst +@@ -0,0 +1 @@ ++Switched multipart handling to use spooled temporary files to reduce number of file descriptors needed -- by :user:`Dreamsorcerer`. +diff --git a/aiohttp/web_request.py b/aiohttp/web_request.py +index ca925e2ac..eaed708eb 100644 +--- a/aiohttp/web_request.py ++++ b/aiohttp/web_request.py +@@ -3,13 +3,13 @@ import datetime + import io + import re + import string +-import tempfile ++import sys + import types + import warnings + from collections.abc import Iterator, Mapping, MutableMapping + from re import Pattern + from types import MappingProxyType +-from typing import TYPE_CHECKING, Any, Final, Optional, TypeVar, cast, overload ++from typing import IO, TYPE_CHECKING, Any, Final, Optional, TypeVar, cast, overload + from urllib.parse import parse_qsl + + import attr +@@ -54,6 +54,30 @@ from .typedefs import ( + from .web_exceptions import HTTPRequestEntityTooLarge, NotAppKeyWarning + from .web_response import StreamResponse + ++if sys.version_info >= (3, 11): ++ from tempfile import SpooledTemporaryFile ++else: ++ import tempfile ++ ++ class SpooledTemporaryFile(tempfile.SpooledTemporaryFile[bytes], io.IOBase): ++ """Make the spooled file satisfy the documented `FileField.file` type. ++ ++ `tempfile.SpooledTemporaryFile` only became an `io.IOBase` subclass in ++ 3.11 (python/cpython#70363), and never grew the three capability ++ predicates before then. Both underlying files (`io.BytesIO` before ++ rollover, a `w+b` temp file after) are readable, writable and seekable. ++ """ ++ ++ def readable(self) -> bool: ++ return True ++ ++ def writable(self) -> bool: ++ return True ++ ++ def seekable(self) -> bool: ++ return True ++ ++ + __all__ = ("BaseRequest", "FileField", "Request") + + +@@ -66,11 +90,18 @@ if TYPE_CHECKING: + _T = TypeVar("_T") + + ++# Multipart file parts are buffered in memory and only spilled to a temporary ++# file once they outgrow this size. A temp file per part would let a body made ++# of many tiny parts exhaust the process's file descriptors; spooling bounds ++# that at ``client_max_size // _FILE_SPOOL_MAX_SIZE`` descriptors per request. ++_FILE_SPOOL_MAX_SIZE: Final[int] = 1024**2 ++ ++ + @attr.s(auto_attribs=True, frozen=True, slots=True) + class FileField: + name: str + filename: str +- file: io.BufferedReader ++ file: IO[bytes] + content_type: str + headers: CIMultiDictProxy[str] + +@@ -754,8 +785,13 @@ class BaseRequest(MutableMapping[str | RequestKey[Any], Any], HeadersMixin): + multipart = await self.multipart() + max_size = self._client_max_size + +- size = 0 ++ payload = self._payload + while (field := await multipart.next()) is not None: ++ # This check is needed for empty payloads, which still add ++ # overhead without entering the loop and the check below. ++ if 0 < max_size < payload.total_bytes: ++ raise HTTPRequestEntityTooLarge(max_size) ++ + field_ct = field.headers.get(hdrs.CONTENT_TYPE) + + if isinstance(field, BodyPartReader): +@@ -767,20 +803,35 @@ class BaseRequest(MutableMapping[str | RequestKey[Any], Any], HeadersMixin): + # present. + # https://tools.ietf.org/html/rfc7578#section-4.4 + if field.filename: +- # store file in temp file +- tmp = await self._loop.run_in_executor( +- None, tempfile.TemporaryFile +- ) ++ tmp = SpooledTemporaryFile(_FILE_SPOOL_MAX_SIZE) ++ # rolled means the temp file now uses the disk, at ++ # which point we want to run in the executor. ++ rolled = False + while chunk := await field.read_chunk(size=DEFAULT_CHUNK_SIZE): ++ # Bounds one part, mid-read. ++ if 0 < max_size < payload.total_bytes: ++ if rolled: ++ await self._loop.run_in_executor(None, tmp.close) ++ else: ++ tmp.close() ++ raise HTTPRequestEntityTooLarge(max_size) + async for decoded_chunk in field.decode_iter(chunk): +- await self._loop.run_in_executor( +- None, tmp.write, decoded_chunk ++ # Update before writing, so we know if next ++ # write is going to hit the disk. ++ rolled = rolled or ( ++ tmp.tell() + len(decoded_chunk) ++ > _FILE_SPOOL_MAX_SIZE + ) +- size += len(decoded_chunk) +- if 0 < max_size < size: +- await self._loop.run_in_executor(None, tmp.close) +- raise HTTPRequestEntityTooLarge(max_size) +- await self._loop.run_in_executor(None, tmp.seek, 0) ++ if rolled: ++ await self._loop.run_in_executor( ++ None, tmp.write, decoded_chunk ++ ) ++ else: ++ tmp.write(decoded_chunk) ++ if rolled: ++ await self._loop.run_in_executor(None, tmp.seek, 0) ++ else: ++ tmp.seek(0) + + if field_ct is None: + field_ct = "application/octet-stream" +@@ -788,7 +839,7 @@ class BaseRequest(MutableMapping[str | RequestKey[Any], Any], HeadersMixin): + ff = FileField( + field.name, + field.filename, +- cast(io.BufferedReader, tmp), ++ tmp, + field_ct, + field.headers, + ) +@@ -797,8 +848,7 @@ class BaseRequest(MutableMapping[str | RequestKey[Any], Any], HeadersMixin): + # deal with ordinary data + raw_data = bytearray() + while chunk := await field.read_chunk(): +- size += len(chunk) +- if 0 < max_size < size: ++ if 0 < max_size < payload.total_bytes: + raise HTTPRequestEntityTooLarge(max_size) + raw_data.extend(chunk) + +@@ -865,10 +915,7 @@ class BaseRequest(MutableMapping[str | RequestKey[Any], Any], HeadersMixin): + if self._post is None or self.content_type != "multipart/form-data": + return + +- # NOTE: Release file descriptors for the +- # NOTE: `tempfile.Temporaryfile`-created `_io.BufferedRandom` +- # NOTE: instances of files sent within multipart request body +- # NOTE: via HTTP POST request. ++ # Release the temp files created within multipart request body. + for file_name, file_field_object in self._post.items(): + if isinstance(file_field_object, FileField): + file_field_object.file.close() +diff --git a/tests/test_web_functional.py b/tests/test_web_functional.py +index d126347aa..78304a72c 100644 +--- a/tests/test_web_functional.py ++++ b/tests/test_web_functional.py +@@ -1,6 +1,8 @@ + import asyncio ++import base64 + import io + import json ++import os + import pathlib + import socket + import sys +@@ -31,6 +33,7 @@ from aiohttp.pytest_plugin import AiohttpClient, AiohttpServer + from aiohttp.streams import StreamReader + from aiohttp.typedefs import Handler + from aiohttp.web_protocol import MAX_MSG_QUEUE_SIZE, RequestHandler ++from aiohttp.web_request import _FILE_SPOOL_MAX_SIZE + + try: + import brotlicffi as brotli +@@ -2072,8 +2075,167 @@ async def test_post_max_client_size_for_file(aiohttp_client) -> None: + await resp.release() + + +-async def test_response_with_bodypart(aiohttp_client) -> None: +- async def handler(request): ++def _multipart_file_parts(count: int, body: bytes = b"") -> bytes: ++ """Raw multipart/form-data body of ``count`` file parts, boundary ``b``.""" ++ return ( ++ b"".join( ++ b'--b\r\nContent-Disposition: form-data; name="f%d"; ' ++ b'filename="x"\r\n\r\n' % index + body + b"\r\n" ++ for index in range(count) ++ ) ++ + b"--b--\r\n" ++ ) ++ ++ ++async def test_post_max_client_size_counts_multipart_headers( ++ aiohttp_client: AiohttpClient, ++) -> None: ++ async def handler(request: web.Request) -> NoReturn: ++ await request.post() ++ assert False ++ ++ app = web.Application(client_max_size=1) ++ app.router.add_post("/", handler) ++ client = await aiohttp_client(app) ++ ++ body = _multipart_file_parts(55) ++ assert len(body) > 1 ++ async with client.post( ++ "/", data=body, headers={CONTENT_TYPE: "multipart/form-data; boundary=b"} ++ ) as resp: ++ assert resp.status == 413 ++ ++ ++@pytest.mark.parametrize( ++ "max_size", ++ (_FILE_SPOOL_MAX_SIZE, 2 * _FILE_SPOOL_MAX_SIZE), ++ ids=("spooled", "rolled-over"), ++) ++async def test_post_max_client_size_within_single_part( ++ aiohttp_client: AiohttpClient, max_size: int ++) -> None: ++ async def handler(request: web.Request) -> NoReturn: ++ await request.post() ++ assert False ++ ++ app = web.Application(client_max_size=max_size) ++ app.router.add_post("/", handler) ++ client = await aiohttp_client(app) ++ ++ # A sole oversized part is never followed by a boundary, so only the ++ # per-chunk check can reject it, and it must do so before buffering. The ++ # larger limit lets the part reach the disk first, so the spool is then ++ # closed off the event loop too. ++ data = FormData() ++ with io.BytesIO(b"x" * (3 * _FILE_SPOOL_MAX_SIZE)) as file_handle: ++ data.add_field("file", file_handle, filename="x.bin") ++ async with client.post("/", data=data) as resp: ++ assert resp.status == 413 ++ ++ ++@pytest.mark.parametrize("filename", (b"", b'; filename="x"'), ids=("field", "file")) ++async def test_post_max_client_size_counts_undecoded_bytes( ++ aiohttp_client: AiohttpClient, filename: bytes ++) -> None: ++ async def handler(request: web.Request) -> NoReturn: ++ await request.post() ++ assert False ++ ++ limit = 64 * 1024 ++ app = web.Application(client_max_size=limit) ++ app.router.add_post("/", handler) ++ client = await aiohttp_client(app) ++ ++ # base64 decodes to exactly the limit but arrives 4/3 larger. The limit is ++ # on the request body, so both kinds of part must reject it alike. ++ encoded = base64.b64encode(b"A" * limit) ++ assert len(encoded) > limit ++ body = ( ++ b'--b\r\nContent-Disposition: form-data; name="f"' + filename + b"\r\n" ++ b"Content-Transfer-Encoding: base64\r\n\r\n" + encoded + b"\r\n--b--\r\n" ++ ) ++ async with client.post( ++ "/", data=body, headers={CONTENT_TYPE: "multipart/form-data; boundary=b"} ++ ) as resp: ++ assert resp.status == 413 ++ ++ ++@pytest.mark.skipif(not os.path.isdir("/dev/fd"), reason="needs /dev/fd to count fds") ++@pytest.mark.parametrize( ++ ("parts", "part_body", "expected_fds"), ++ ( ++ (55, b"payload", 0), ++ (1, b"x" * (_FILE_SPOOL_MAX_SIZE + 1), 1), ++ ), ++ ids=("many-small-parts", "one-oversized-part"), ++) ++async def test_post_file_fields_descriptor_cost( ++ aiohttp_client: AiohttpClient, parts: int, part_body: bytes, expected_fds: int ++) -> None: ++ """Only a part past the spool size may cost a descriptor.""" ++ ++ async def handler(request: web.Request) -> web.Response: ++ before = set(await asyncio.to_thread(os.listdir, "/dev/fd")) ++ data = await request.post() ++ after = set(await asyncio.to_thread(os.listdir, "/dev/fd")) ++ assert len(data) == parts ++ return web.Response(text=str(len(after - before))) ++ ++ app = web.Application(client_max_size=8 * 1024**2) ++ app.router.add_post("/", handler) ++ client = await aiohttp_client(app) ++ ++ with io.BytesIO(_multipart_file_parts(parts, part_body)) as body: ++ async with client.post( ++ "/", ++ data=body, ++ headers={CONTENT_TYPE: "multipart/form-data; boundary=b"}, ++ ) as resp: ++ assert resp.status == 200 ++ assert await resp.text() == str(expected_fds) ++ ++ ++@pytest.mark.parametrize( ++ "size", ++ ( ++ 0, ++ 1, ++ _FILE_SPOOL_MAX_SIZE - 1, ++ _FILE_SPOOL_MAX_SIZE, ++ _FILE_SPOOL_MAX_SIZE + 1, ++ ), ++) ++async def test_post_file_field_spool_rollover( ++ aiohttp_client: AiohttpClient, size: int ++) -> None: ++ """A part is byte-identical either side of the spool/temp-file boundary.""" ++ payload = (b"0123456789abcdef" * (size // 16 + 1))[:size] ++ ++ async def handler(request: web.Request) -> web.Response: ++ field = (await request.post())["file"] ++ assert isinstance(field, aiohttp.web_request.FileField) ++ assert isinstance(field.file, io.IOBase) ++ assert field.file.readable() ++ assert field.file.writable() ++ assert field.file.seekable() ++ content = await asyncio.to_thread(field.file.read) ++ assert len(content) == size ++ assert content == payload ++ return web.Response() ++ ++ app = web.Application(client_max_size=8 * 1024**2) ++ app.router.add_post("/", handler) ++ client = await aiohttp_client(app) ++ ++ data = FormData() ++ with io.BytesIO(payload) as file_handle: ++ data.add_field("file", file_handle, filename="x.bin") ++ async with client.post("/", data=data) as resp: ++ assert resp.status == 200 ++ ++ ++async def test_response_with_bodypart(aiohttp_client: AiohttpClient) -> None: ++ async def handler(request: web.Request) -> web.Response: + reader = await request.multipart() + part = await reader.next() + return web.Response(body=part) diff --git a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb index f3bb555408..2477b6a0e8 100644 --- a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb +++ b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb @@ -8,6 +8,7 @@ SRC_URI[sha256sum] = "9491196535a88924a60afd5b5f434b5b203b6cc616250878dbdb223a8f SRC_URI += "file://CVE-2026-111063.patch \ file://CVE-2026-111065.patch \ + file://CVE-2026-111066.patch \ " CVE_PRODUCT = "aiohttp:aiohttp" From patchwork Thu Nov 12 04:44:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103818 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6843.1794458704018913920 for ; Wed, 11 Nov 2026 20:45:04 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=VyzoaRLN; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-3b0a519049aso2574037a91.1 for ; Wed, 11 Nov 2026 20:45:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458703; x=1795063503; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HqOMFeep3KRPc3J5qe/hX98ShiZ+fyhI9KmFYO61Y7s=; b=VyzoaRLN2dBXLJMhaJd0rZiKscQFY6/x32pky49qnii2oWFYeiZ53pN1n8RSWkGZ9N qnyPe7rz3ylC/oyDRjx1u6Q966+9q0KUmZMFLL0s4JwZC4iKe2wcYL8mkwkRO/wVDTiL m91vfFNfT1Hcz6AY3gBVcibE4Jx4s7YVVI1p+iQ0ptVP3hlXnjZlMKlsU7MVdw5+mGSU 9hoslKm9qVB841GzItNuU9y4tqsR9jGCPyIEMUwqK7iD5H9oQDJJQpcax3Q/MH9lfD3J pgrA05ZbgniuMWkyVtTya7ARWCxQabY40o8CzZWdMx+lKp6r716aC59tQPEmLQ5BW7Ln E8Iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458703; x=1795063503; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=HqOMFeep3KRPc3J5qe/hX98ShiZ+fyhI9KmFYO61Y7s=; b=UyYjGjdApjHxHBvDMs0VhLyH6XxCP83cUmYljL+2Uijb30cCEfpSYwBjF+vFBenZI2 pPu44sI3L/1lJsjD78KOzKLF8LDjW3hYpWdnPfScS1r4fCy0EwnmrVSdB2jHbisAsmaA jr5Lqo6UJHupV354F6aCFqTNEpDzdtOKjQKySVnc4D9LP/Bc2+FeVKdp6bAXaeT5WBWi ovtXXFtFpfeeUHTYy2N5EletrFpcpxL6n79QtnwwK7THbFZ3XsRPaHhFUVub5vrNU7HE 3sHI6ly6Gvsv19DjWCx8ZP28nrT0FiFx8641xfSk1THuTYeCS7j0YFNizK0Q3Vx8AToS rECw== X-Gm-Message-State: APuU4Z9BxVrZyiN5J5+A6aK6OaLXtflD6wQ+q/yAkv3dyHkD69+9mSXV ZWm16dx7PLYvhg7OueNjKMs/sdrCYGVnPCd1+eiiMngo2k6cgefE2AyLiCz+pg== X-Gm-Gg: AYBFou0IsTd6blChd4GhBiH6k9hRzZvcOs+TkUBPqWwG6fXyWNcE3IIyeM7r7LxbPHb ddPedrsNSm0swYe913SHu14BJz04/dX3O2HkvN38tvUX3AqlPDbDdxmlG4MeELVAYzp4CH5YQO5 T9EwbaHzoNP9cgtsGbJTUp0yiYLvlehXOHDnknTre1o9StMC7dWVTTrzXfY97UTpdzuOSfKH0IC k0LRDwiSVNhwwXvxOiyIVKWyik4nWd4RF9SXR/Fi1NrEB+kJwU30I/zmhvCsEXIuMMU1NoqTNx0 JkYguHnlPZOybAb6hnxnMWKXPAASM2Y8b33QIMlNB2kocrGJjRzvLF816//RFzw0S52EH7Mn8EA wINbpIMyOB5kfZztkPR14lgI0d1HHJ/djjsGx2CnXPp6LKk5w2/KUurogYYAAuq7vWd5EDfVc81 S1LpD4OYXk77zV+q6/GEqaZ0cP+VmpZS7Y12FmNOtGVguRWT3xh4jj7ezMf+An56FNh3VzdJ9Le AZcWXmiJWAiihwNXSklpd12CL3DCN5Xjn3qhJbYj2tJk2hmEXx+KRj9cTAAxJgJWvj7xFcxZGyH QhCr1WIiRRCGSpgrVZ3jHrHQpzH7BLG0XIPgoqQQ5xe+slCcCzuUfDwt+w62CA== X-Received: by 2002:a17:90b:3c46:b0:3ac:adce:60be with SMTP id 98e67ed59e1d1-3b182e95fa9mr4399377a91.21.1794458703173; Wed, 11 Nov 2026 20:45:03 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.45.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:45:02 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][blacksail][PATCH 13/16] python3-aiohttp: patch CVE-2026-111748 Date: Thu, 12 Nov 2026 17:44:23 +1300 Message-ID: <20261112044426.3933391-13-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:45:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132164 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-111748 Signed-off-by: Ankur Tyagi --- .../python3-aiohttp/CVE-2026-111748.patch | 170 ++++++++++++++++++ .../python/python3-aiohttp_3.14.3.bb | 1 + 2 files changed, 171 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111748.patch diff --git a/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111748.patch b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111748.patch new file mode 100644 index 0000000000..ade4af77a2 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111748.patch @@ -0,0 +1,170 @@ +From 75abab9fcf5382fb46947fe9f53142f6aa60abbc Mon Sep 17 00:00:00 2001 +From: Sam Bull +Date: Sun, 27 Sep 2026 18:11:00 +0100 +Subject: [PATCH] Use protocol scheme for absolute-form requests (#13821) + (#13827) (#13828) + +(cherry picked from commit a921cfd0fec28d5a9e5bf8d6f4372b8fa63c49df) +(cherry picked from commit 93d91e37e7c6035d09e89646b3de737735ed91b5) +(cherry picked from commit 6d4e7b01f9b951aa084a75d7356e907d4ee80411) + +CVE: CVE-2026-111748 +Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411] + +Dropped tests changes during the backport + +Signed-off-by: Ankur Tyagi +--- + CHANGES/13821.bugfix.rst | 1 + + aiohttp/_cparser.pxd | 3 ++- + aiohttp/_http_parser.pyx | 29 +++++++++++++++++++++++++---- + aiohttp/http_parser.py | 26 ++++++++++++++++++++++---- + aiohttp/web_request.py | 7 ++++++- + 5 files changed, 56 insertions(+), 10 deletions(-) + create mode 100644 CHANGES/13821.bugfix.rst + +diff --git a/CHANGES/13821.bugfix.rst b/CHANGES/13821.bugfix.rst +new file mode 100644 +index 000000000..f35418d2d +--- /dev/null ++++ b/CHANGES/13821.bugfix.rst +@@ -0,0 +1 @@ ++Fixed the web server trusting the scheme of an absolute-form request-target -- by :user:`Dreamsorcerer`. +diff --git a/aiohttp/_cparser.pxd b/aiohttp/_cparser.pxd +index 903f35c45..3a427002d 100644 +--- a/aiohttp/_cparser.pxd ++++ b/aiohttp/_cparser.pxd +@@ -67,7 +67,8 @@ cdef extern from "llhttp.h": + HTTP_RESPONSE + + enum llhttp_method: +- HTTP_CONNECT ++ HTTP_CONNECT, ++ HTTP_OPTIONS + + void llhttp_settings_init(llhttp_settings_t* settings) + void llhttp_init(llhttp_t* parser, llhttp_type type, +diff --git a/aiohttp/_http_parser.pyx b/aiohttp/_http_parser.pyx +index 0fe6084e5..4660a0c90 100644 +--- a/aiohttp/_http_parser.pyx ++++ b/aiohttp/_http_parser.pyx +@@ -722,12 +722,20 @@ cdef class HttpRequestParser(HttpParser): + return + self._path = self._buf.decode('utf-8', 'surrogateescape') + try: +- idx3 = len(self._path) + if self._cparser.method == cparser.HTTP_CONNECT: + # authority-form, + # https://datatracker.ietf.org/doc/html/rfc7230#section-5.3.3 +- self._url = URL.build(authority=self._path, encoded=True) +- elif idx3 > 1 and self._path[0] == '/': ++ try: ++ self._url = URL.build(authority=self._path, encoded=True) ++ host = self._url.raw_host ++ except ValueError: ++ host = None ++ if host is None: ++ raise InvalidURLError( ++ self._path.encode(errors="surrogateescape") ++ .decode("latin1") ++ ) ++ elif self._path[0] == '/': + # origin-form, + # https://datatracker.ietf.org/doc/html/rfc7230#section-5.3.1 + idx1 = self._path.find("?") +@@ -758,10 +766,23 @@ cdef class HttpRequestParser(HttpParser): + fragment=fragment, + encoded=True, + ) ++ elif self._path == '*' and self._cparser.method == cparser.HTTP_OPTIONS: ++ # asterisk-form, ++ self._url = URL(self._path, encoded=True) + else: + # absolute-form for proxy maybe, + # https://datatracker.ietf.org/doc/html/rfc7230#section-5.3.2 +- self._url = URL(self._path, encoded=True) ++ try: ++ self._url = URL(self._path, encoded=True) ++ host = self._url.raw_host ++ except ValueError: ++ host = None ++ # https://www.rfc-editor.org/rfc/rfc9110#section-4.2.1-4 ++ if host is None: ++ raise InvalidURLError( ++ self._path.encode(errors="surrogateescape") ++ .decode("latin1") ++ ) + finally: + PyByteArray_Resize(self._buf, 0) + +diff --git a/aiohttp/http_parser.py b/aiohttp/http_parser.py +index 0c9fd086b..678aee020 100644 +--- a/aiohttp/http_parser.py ++++ b/aiohttp/http_parser.py +@@ -685,7 +685,18 @@ class HttpRequestParser(HttpParser[RawRequestMessage]): + if method == "CONNECT": + # authority-form, + # https://datatracker.ietf.org/doc/html/rfc7230#section-5.3.3 +- url = URL.build(authority=path, encoded=True) ++ try: ++ url = URL.build(authority=path, encoded=True) ++ host = url.raw_host ++ except ValueError: ++ # Duplicated so mypy understands that url must be defined below. ++ raise InvalidURLError( ++ path.encode(errors="surrogateescape").decode("latin1") ++ ) ++ if host is None: ++ raise InvalidURLError( ++ path.encode(errors="surrogateescape").decode("latin1") ++ ) + elif path.startswith("/"): + # origin-form, + # https://datatracker.ietf.org/doc/html/rfc7230#section-5.3.1 +@@ -708,9 +719,16 @@ class HttpRequestParser(HttpParser[RawRequestMessage]): + else: + # absolute-form for proxy maybe, + # https://datatracker.ietf.org/doc/html/rfc7230#section-5.3.2 +- url = URL(path, encoded=True) +- if url.scheme == "": +- # not absolute-form ++ try: ++ url = URL(path, encoded=True) ++ host = url.raw_host ++ except ValueError: ++ # Duplicated so mypy understands that url must be defined below. ++ raise InvalidURLError( ++ path.encode(errors="surrogateescape").decode("latin1") ++ ) ++ # https://www.rfc-editor.org/rfc/rfc9110#section-4.2.1-4 ++ if host is None: + raise InvalidURLError( + path.encode(errors="surrogateescape").decode("latin1") + ) +diff --git a/aiohttp/web_request.py b/aiohttp/web_request.py +index eaed708eb..5f6c92333 100644 +--- a/aiohttp/web_request.py ++++ b/aiohttp/web_request.py +@@ -196,8 +196,14 @@ class BaseRequest(MutableMapping[str | RequestKey[Any], Any], HeadersMixin): + self._cache: dict[str, Any] = {} + url = message.url + if url.absolute: ++ if scheme is None and url.scheme: ++ # Absolute URL is peer-controlled, use the protocol. ++ scheme = "https" if protocol.ssl_context else "http" + if scheme is not None: ++ # Authority-form (CONNECT) has no scheme: leave the target ++ # unchanged unless clone(scheme=...) overrides it. + url = url.with_scheme(scheme) ++ self._cache["scheme"] = scheme + if host is not None: + url = url.with_host(host) + # absolute URL is given, +@@ -205,7 +211,6 @@ class BaseRequest(MutableMapping[str | RequestKey[Any], Any], HeadersMixin): + # all other properties should be good + self._cache["url"] = url + self._cache["host"] = url.host +- self._cache["scheme"] = url.scheme + self._rel_url = url.relative() + else: + self._rel_url = url diff --git a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb index 2477b6a0e8..3654f95532 100644 --- a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb +++ b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb @@ -9,6 +9,7 @@ SRC_URI[sha256sum] = "9491196535a88924a60afd5b5f434b5b203b6cc616250878dbdb223a8f SRC_URI += "file://CVE-2026-111063.patch \ file://CVE-2026-111065.patch \ file://CVE-2026-111066.patch \ + file://CVE-2026-111748.patch \ " CVE_PRODUCT = "aiohttp:aiohttp" From patchwork Thu Nov 12 04:44:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103819 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pf1-f178.google.com (mail-pf1-f178.google.com [209.85.210.178]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6944.1794458706136175192 for ; Wed, 11 Nov 2026 20:45:06 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=UrjG8luX; spf=pass (domain: gmail.com, ip: 209.85.210.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f178.google.com with SMTP id d2e1a72fcca58-8b67f25e6e1so1914959b3a.0 for ; Wed, 11 Nov 2026 20:45:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458705; x=1795063505; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JczhozRz3vzKyF+dmJZAfyVNQCPv8vcOXRxLVtrpa20=; b=UrjG8luX8H18zrvNUHmLQ8bYZ/en6s984kXoDWv1GXxG1GpFva3ajvzW0C9vaIJ3sB XYxJqXfrZMDLsfiQ3mbVyM/uQ0ZaFdFBm5sV5Js+PHpVbxwJqAFbFTcExYSFG4zvYMZk jliu3DjvjiJD6B6NTlA2cSQBmmmD1tpYreDjN3Uipqv3Oc8MO4A6RgY1SrFBQj1zHV2g 9vsheT4lJp+a5ZWiGTcsuhSBnR7pVTEoMKcrUSwHSzZizpeJWZ7RZ8gUz8DthMXKWvjx rTnSBajer+P0npbjAUzvfHjRDj5LWvL65Vm6VCPtxUTFdvzTH4IqoWrSgDNqT7ec+/R8 YtvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458705; x=1795063505; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=JczhozRz3vzKyF+dmJZAfyVNQCPv8vcOXRxLVtrpa20=; b=2lNilSPmSYBIF8eJqWVnkw8QdXimrw9eCSh5dAx51nLS0mJVzManTC6snBSzFOjQfb aZq4YogGuWmnBnnZ+R7oXyfJ7yPyFv2zMI9LyDVpddRPw+EYtWe3rOBOCwZLp2aPqm9N w07oW7k4RDFRuXan1RjBOEinkBceCV+zDgzsWTdJZjhIbmKEe2ccapa/G/8Ehxw/rhTL lKuSriTvnNjlVcoyoxKaZApJhMSL7x11pWsXWP8Z/8OtPKDbsYaN7xLXB6PEBMSWDP5I u1BWJaE6ckniOvsYkPgYsOG2fPvvMSlCYUCjZgblqBtt4dg8mb+BZDaVEeGOJV/YqGUU TJnQ== X-Gm-Message-State: APuU4Z/vk+P8lJF02hUVjVsc7NU1i/OB7SVDOSevfJWGfXEmls/c0TJo MCdnSaVBPALEv9AyCusTlAjwdM+EFFT+dQos9woz+RfSaIH0DSrIE0lVs3ENag== X-Gm-Gg: AYBFou3Nwnye0iSsu9j1DkKgBsDe4Wl6lSmz/oIsCEjVq0FHFunwtNj3x/hO8PtfAkc M3xGbUaXjpAruMhk2mfzCHZ6f4l8aYQh//8rqJl4GAyN6RgZyhnJEWnGGvPywbbwoT81V6g1L5S LzRW43hRVtHp7ev/JdsucZhoYwfrLBOySMEN+s8wiPIxShdyOpKRhKIa0s9qwSi4lnMj4M9Z7V1 XIEXExzdqDzx8pMkWyU77aXOsjwZeuRJUj3fkCNcLXd5bFNDDOpyAJySoKt4kyWK+yeyBRtvIzR fUiCiGC8xx3u4qbG4U41uf+OcrwG+SX6gRvKBrToPHWr0bYNnGa1klOlhLsQ/3i3yHSffhEx6ua 4HpWnar+D8lbuqUf+b0PVQqOT2mlX5vBjcvP7NMf+iddfM0gHPba6tPSkohmyyey5kde+OyNbZN dK6gu7NEVR8NANrtz7JkCym1zxlWMG3j/udGoc6ADkbA2vLWu+vJg2S+HyXV/u2dnqbAfIHWfE1 VD7fQa2pmvD/MilbV+X2VXohXUN+fUCqtrkvZqBy3p0cWrpZvtVn+bFTHyJP55wL5on04tHM4pn 6henS09q+jd7txA0GleM3CHcNs4ZKKUxqdTpRqu7nhEZef2Go8zLZNPDQ8WZrQ== X-Received: by 2002:a05:6a20:6a24:b0:3eb:abb7:f92b with SMTP id adf61e73a8af0-3f2fd69cf4cmr4819130637.21.1794458705379; Wed, 11 Nov 2026 20:45:05 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.45.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:45:05 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][blacksail][PATCH 14/16] python3-aiohttp: patch CVE-2026-111749 Date: Thu, 12 Nov 2026 17:44:24 +1300 Message-ID: <20261112044426.3933391-14-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:45:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132165 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-111749 Signed-off-by: Ankur Tyagi --- .../python3-aiohttp/CVE-2026-111749.patch | 262 ++++++++++++++++++ .../python/python3-aiohttp_3.14.3.bb | 1 + 2 files changed, 263 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111749.patch diff --git a/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111749.patch b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111749.patch new file mode 100644 index 0000000000..d1a7c60fb5 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111749.patch @@ -0,0 +1,262 @@ +From 66405536d4410c7456a52d2b6780e827f4e56d44 Mon Sep 17 00:00:00 2001 +From: Sam Bull +Date: Wed, 9 Sep 2026 02:21:06 +0100 +Subject: [PATCH] Fix host-only state on cookie expiration (#13674) (#13676) + +(cherry picked from commit 9332972cfcb0f5a2b6677e7307819ab8f13b5d09) +(cherry picked from commit 6a07c171ef9f3be583e2907dcd1931372efca8d6) + +CVE: CVE-2026-111749 +Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/6a07c171ef9f3be583e2907dcd1931372efca8d6] + +Signed-off-by: Ankur Tyagi +--- + CHANGES/13674.bugfix.rst | 1 + + aiohttp/abc.py | 2 +- + aiohttp/cookiejar.py | 29 ++++++++-------- + docs/client_reference.rst | 10 ++++-- + tests/test_client_session.py | 2 +- + tests/test_cookiejar.py | 64 ++++++++++++++++++++++++++++++++++-- + 6 files changed, 89 insertions(+), 19 deletions(-) + create mode 100644 CHANGES/13674.bugfix.rst + +diff --git a/CHANGES/13674.bugfix.rst b/CHANGES/13674.bugfix.rst +new file mode 100644 +index 000000000..5152bceae +--- /dev/null ++++ b/CHANGES/13674.bugfix.rst +@@ -0,0 +1 @@ ++Fixed host-only cookie state being lost on expiration -- by :user:`Dreamsorcerer`. +diff --git a/aiohttp/abc.py b/aiohttp/abc.py +index b67287318..74ca7216e 100644 +--- a/aiohttp/abc.py ++++ b/aiohttp/abc.py +@@ -181,7 +181,7 @@ class AbstractCookieJar(Sized, IterableBase): + + @property + @abstractmethod +- def host_only_cookies(self) -> frozenset[tuple[str, str]]: ++ def host_only_cookies(self) -> frozenset[tuple[str, str, str]]: + """Return the host-only cookies stored in this jar.""" + + @abstractmethod +diff --git a/aiohttp/cookiejar.py b/aiohttp/cookiejar.py +index b949cc118..1af02144e 100644 +--- a/aiohttp/cookiejar.py ++++ b/aiohttp/cookiejar.py +@@ -134,7 +134,8 @@ class CookieJar(AbstractCookieJar): + self._morsel_cache: defaultdict[tuple[str, str], dict[str, Morsel[str]]] = ( + defaultdict(dict) + ) +- self._host_only_cookies: set[tuple[str, str]] = set() ++ # Cookie identity is (domain, path, name). ++ self._host_only_cookies: set[tuple[str, str, str]] = set() + self._unsafe = unsafe + self._quote_cookie = quote_cookie + if treat_as_secure_origin is None: +@@ -166,7 +167,7 @@ class CookieJar(AbstractCookieJar): + return MappingProxyType(self._cookies) + + @property +- def host_only_cookies(self) -> frozenset[tuple[str, str]]: ++ def host_only_cookies(self) -> frozenset[tuple[str, str, str]]: + """Return the host-only cookies stored in this jar.""" + return frozenset(self._host_only_cookies) + +@@ -195,7 +196,7 @@ class CookieJar(AbstractCookieJar): + if attr_val: + morsel_data[attr] = attr_val + # Persist or it reloads as a domain cookie and leaks to subdomains. +- if (domain, name) in self._host_only_cookies: ++ if (domain, path, name) in self._host_only_cookies: + morsel_data["host_only"] = True + if (exp := self._expirations.get((domain, path, name))) is not None: + morsel_data["expires_timestamp"] = exp +@@ -358,7 +359,7 @@ class CookieJar(AbstractCookieJar): + + def _delete_cookies(self, to_del: list[tuple[str, str, str]]) -> None: + for domain, path, name in to_del: +- self._host_only_cookies.discard((domain, name)) ++ self._host_only_cookies.discard((domain, path, name)) + self._cookies[(domain, path)].pop(name, None) + self._morsel_cache[(domain, path)].pop(name, None) + self._expirations.pop((domain, path, name), None) +@@ -395,18 +396,12 @@ class CookieJar(AbstractCookieJar): + domain = "" + del cookie["domain"] + +- if not domain and hostname is not None: +- # Set the cookie's domain to the response hostname +- # and set its host-only-flag +- self._host_only_cookies.add((hostname, name)) +- domain = cookie["domain"] = hostname +- + if domain and domain[0] == ".": + # Remove leading dot + domain = domain[1:] + cookie["domain"] = domain + +- if hostname and not self._is_domain_match(domain, hostname): ++ if domain and hostname and not self._is_domain_match(domain, hostname): + # Setting cookies for different domains is not allowed + continue + +@@ -422,6 +417,14 @@ class CookieJar(AbstractCookieJar): + cookie["path"] = path + path = path.rstrip("/") + ++ if not domain and hostname is not None: ++ self._host_only_cookies.add((hostname, path, name)) ++ domain = cookie["domain"] = hostname ++ else: ++ # A cookie with an explicit Domain attribute replaces any ++ # host-only cookie with the same (domain, path, name) identity. ++ self._host_only_cookies.discard((domain, path, name)) ++ + if max_age := cookie["max-age"]: + try: + delta_seconds = int(max_age) +@@ -522,7 +525,7 @@ class CookieJar(AbstractCookieJar): + for name, cookie in self._cookies[p].items(): + domain = cookie["domain"] + +- if (domain, name) in self._host_only_cookies and domain != hostname: ++ if domain != hostname and p + (name,) in self._host_only_cookies: + continue + + # Skip edge case when the cookie has a trailing slash but request doesn't. +@@ -672,7 +675,7 @@ class DummyCookieJar(AbstractCookieJar): + return MappingProxyType({}) + + @property +- def host_only_cookies(self) -> frozenset[tuple[str, str]]: ++ def host_only_cookies(self) -> frozenset[tuple[str, str, str]]: + """Return an empty frozenset.""" + return frozenset() + +diff --git a/docs/client_reference.rst b/docs/client_reference.rst +index a237fb64b..476e6e81f 100644 +--- a/docs/client_reference.rst ++++ b/docs/client_reference.rst +@@ -2611,11 +2611,17 @@ Utilities + + .. attribute:: host_only_cookies + +- A :class:`frozenset` of ``(domain, name)`` tuples indicating which +- cookies are host-only (not sent to subdomains). ++ A :class:`frozenset` of ``(domain, path, name)`` tuples indicating ++ which cookies are host-only (not sent to subdomains). + + .. versionadded:: 3.14 + ++ .. versionchanged:: 3.14.4 ++ ++ The tuples gained the *path* element; host-only state is tracked ++ per ``(domain, path, name)`` cookie identity so that same-named ++ cookies on other paths cannot affect it. ++ + + .. class:: DummyCookieJar(*, loop=None) + +diff --git a/tests/test_client_session.py b/tests/test_client_session.py +index 6b3516879..4481a4bf8 100644 +--- a/tests/test_client_session.py ++++ b/tests/test_client_session.py +@@ -758,7 +758,7 @@ async def test_cookie_jar_usage(loop: Any, aiohttp_client: Any) -> None: + return MappingProxyType({}) + + @property +- def host_only_cookies(self) -> frozenset[tuple[str, str]]: ++ def host_only_cookies(self) -> frozenset[tuple[str, str, str]]: + return frozenset() + + def clear(self, predicate: abc.ClearCookiePredicate | None = None) -> None: +diff --git a/tests/test_cookiejar.py b/tests/test_cookiejar.py +index be6da2a5f..4fd2959e1 100644 +--- a/tests/test_cookiejar.py ++++ b/tests/test_cookiejar.py +@@ -878,7 +878,45 @@ async def test_cookie_jar_host_only_cookies_property() -> None: + + host_only = jar.host_only_cookies + assert isinstance(host_only, frozenset) +- assert ("example.com", "hostonly") in host_only ++ assert ("example.com", "", "hostonly") in host_only ++ ++ ++async def test_host_only_marker_survives_same_name_expiry_on_other_path() -> None: ++ """Expiring a same-name cookie on another path must not clear host-only state.""" ++ jar = CookieJar() ++ origin = URL("http://auth.example.com/") ++ subdomain = URL("http://evil.auth.example.com/") ++ ++ jar.update_cookies_from_headers(["sid=secret; Path=/"], origin) ++ assert "sid" not in jar.filter_cookies(subdomain) ++ ++ # Attacker-controlled descendant expires a same-name cookie on its own path. ++ jar.update_cookies_from_headers( ++ ["sid=gone; Domain=auth.example.com; Path=/attacker; Max-Age=0"], ++ subdomain, ++ ) ++ ++ assert ("auth.example.com", "", "sid") in jar.host_only_cookies ++ assert "sid" not in jar.filter_cookies(subdomain) ++ assert jar.filter_cookies(origin)["sid"].value == "secret" ++ ++ ++async def test_explicit_domain_replacement_clears_host_only_marker() -> None: ++ """A replacing cookie with an explicit Domain is a domain cookie.""" ++ jar = CookieJar() ++ origin = URL("http://example.com/") ++ subdomain = URL("http://sub.example.com/") ++ ++ jar.update_cookies_from_headers(["sid=hostonly; Path=/"], origin) ++ assert ("example.com", "", "sid") in jar.host_only_cookies ++ assert "sid" not in jar.filter_cookies(subdomain) ++ ++ jar.update_cookies_from_headers( ++ ["sid=domainwide; Domain=example.com; Path=/"], origin ++ ) ++ ++ assert jar.host_only_cookies == frozenset() ++ assert jar.filter_cookies(subdomain)["sid"].value == "domainwide" + + + async def test_cookie_jar_cookies_property_immutable() -> None: +@@ -1857,7 +1895,7 @@ async def test_save_load_json_preserves_host_only_scope(tmp_path: Path) -> None: + jar_load = CookieJar() + jar_load.load(file_path=file_path) + +- assert jar_load.host_only_cookies == frozenset({("auth.example.com", "sid")}) ++ assert jar_load.host_only_cookies == frozenset({("auth.example.com", "", "sid")}) + assert "sid" not in jar_load.filter_cookies(subdomain) + assert "sid" in jar_load.filter_cookies(issuer) + +@@ -1882,6 +1920,28 @@ async def test_save_load_json_domain_cookie_still_matches_subdomain( + assert "sid" in jar_load.filter_cookies(subdomain) + + ++async def test_save_load_json_host_only_per_path(tmp_path: Path) -> None: ++ """Verify save/load keeps host-only state per (domain, path, name).""" ++ file_path = tmp_path / "per_path.json" ++ origin = URL("https://example.com/") ++ subdomain = URL("https://sub.example.com/") ++ ++ jar_save = CookieJar() ++ jar_save.update_cookies_from_headers( ++ ["sid=hostonly; Path=/", "sid=domainwide; Domain=example.com; Path=/api"], ++ origin, ++ ) ++ jar_save.save(file_path=file_path) ++ ++ jar_load = CookieJar() ++ jar_load.load(file_path=file_path) ++ ++ assert jar_load.host_only_cookies == frozenset({("example.com", "", "sid")}) ++ assert "sid" not in jar_load.filter_cookies(subdomain) ++ filtered = jar_load.filter_cookies(URL("https://sub.example.com/api/x")) ++ assert filtered["sid"].value == "domainwide" ++ ++ + async def test_save_load_json_preserves_max_age_deadline(tmp_path: Path) -> None: + """Verify save/load restores the absolute deadline without resetting it.""" + file_path = tmp_path / "max_age.json" diff --git a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb index 3654f95532..78845ffb56 100644 --- a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb +++ b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb @@ -10,6 +10,7 @@ SRC_URI += "file://CVE-2026-111063.patch \ file://CVE-2026-111065.patch \ file://CVE-2026-111066.patch \ file://CVE-2026-111748.patch \ + file://CVE-2026-111749.patch \ " CVE_PRODUCT = "aiohttp:aiohttp" From patchwork Thu Nov 12 04:44:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103820 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.6845.1794458708251688266 for ; Wed, 11 Nov 2026 20:45:08 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=JDUhulX8; spf=pass (domain: gmail.com, ip: 209.85.210.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-8b612fd74e1so1393113b3a.0 for ; Wed, 11 Nov 2026 20:45:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458708; x=1795063508; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bnhZOEUmH7DZgb+dCxIVsEa2abQGsaAOGIYQhRfpgCQ=; b=JDUhulX8lJLkY3NBEhMYWnQ7B0h4QTahm6l0pxJ8r7pu95qVrKHvvw649G8ietEb7T MlnuyA0+ki+FJ5tDmHzm42d5ANd/nnbin+WyPvAe6c/MVxd5oAXuB1BWd1o729/oBmTn zXh7bCYXDoNp3nRda+ZUrKnIRdLBcLcRMb8xjdi4EqAJ+PtXr2f1bKco2nTwQrUGJ+bq deUW8FNqFkyZG7Zb4RVS3Y4Ey//WD4LCpillWP9M9HSIrfkZH/2TV20ByJamvuwQ/B0h CkrAstRzqbNyYXXAZsFYTMSxuWD3cobN4CRLvOhBaYhBg/+/inwMagdTHmFK7yqVaOOX czLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458708; x=1795063508; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=bnhZOEUmH7DZgb+dCxIVsEa2abQGsaAOGIYQhRfpgCQ=; b=wb8xDDEOMkApy5DIvBWn1zOfBCl9u0PwZYW3Es28DaKssgl5ANrduVHFWsldExZvnq IsCxYDX6FVVFyuCO5aDW9s/G8IkoKinrvuC39wz0cMgxbGC7Jva75otvPwaB09hfmy6V W7UAYuqmneK6eKAeLwpxzKyJR/fCYd+Tw2IsGf69KMPHccNJRdY1syMkyRvK/nvRvhQ3 B4FzJaIviAApXkOIQ14zIyaY6GXfAhpdYzGc3YjDJMOqOly1nJlWkErWYfIZvQSL4xVV vd6nzxL9OEGv+hia0TA3WHonWw63vbljxtMskmJsGGMzDDnKwQbmu9mJEgrCu/dgx2HI U8ZA== X-Gm-Message-State: APuU4Z+bnRVyhjG3+yAlhC3wFJExs7xsme6Sxg0kTpKOJqiZv3QvA3+9 jLdWYW+CzofrGbR71Pfzl3/ykTLysPps5SuG7YRRShxxyeCdZbAybFMi+X1f0Q== X-Gm-Gg: AYBFou3jSa/O81ZaYIV0XPpPEc59tDpE7l2xBYXh+Ze9ols32qkQzl+66olRYmKPoCo NVjeqZfsQ/8l+3VwfsZbOyfPg2QKEeDN03+0OBppEtbpnqrpTM4nP2pEXdkfwsFd2D29BV8aRV3 tpYt1yg7aP5362mtd67606vLl1i/jzpPm0FBSDX42pEgpPDz41W6YMDLeXl0Tjb2rN8Ugh8CesE /GbAYY1JDXu5wcoB61ubQaeIoybEebtdzWQ6ZCfCrtjY2TX8lrqsTdFlm+COKsnARLLHIgAwz9n DZdlqcRYZhE8LNuJU1GNcUmJA+dKIi9wHo3D9kRM+vWCruXM1txyQhnqMk59MItNx8LQLkAWeIt OA6ScJMSnd+xAuRmixEmY3GrbCV7Y5vYcZGA0I3UwCsDXqU3YCHVObare1sp6UngUc8GCgRlIvA O1cLqqM/GrL9/gVwyTOiEB/MN8Wh/11s1qMv9PG+wzHyZXR2oqll0OQtUMTSKvzOK0l+Ecr7c0l PnqO/UPMpYHnKjouAbGEGNFVANUD7mckellTCeDEexhZ1T7YmpfIx/VjXCkB4fzYr2ddu42946w m9lUwXxVJqd/Q8PIp5L5w2DuP3VSF5GYgkOLZ9jw+bWMYvUqhmDcDBCjmGqlLw== X-Received: by 2002:a05:6a21:778d:b0:3eb:39fd:badf with SMTP id adf61e73a8af0-3f2f749d75amr3644779637.0.1794458707582; Wed, 11 Nov 2026 20:45:07 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.45.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:45:07 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][blacksail][PATCH 15/16] python3-aiohttp: patch CVE-2026-111750 Date: Thu, 12 Nov 2026 17:44:25 +1300 Message-ID: <20261112044426.3933391-15-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:45:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132166 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-111750 Signed-off-by: Ankur Tyagi --- .../python3-aiohttp/CVE-2026-111750.patch | 82 +++++++++++++++++++ .../python/python3-aiohttp_3.14.3.bb | 1 + 2 files changed, 83 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111750.patch diff --git a/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111750.patch b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111750.patch new file mode 100644 index 0000000000..ff9088ad3c --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-aiohttp/CVE-2026-111750.patch @@ -0,0 +1,82 @@ +From 18e23a890422e952b0fdbf09e02794adda56c120 Mon Sep 17 00:00:00 2001 +From: Sam Bull +Date: Wed, 9 Sep 2026 01:25:13 +0100 +Subject: [PATCH] Fix head request parsing (#13671) (#13673) + +(cherry picked from commit 5789546e37fe35af27d0a2f840870b22bc15bfc4) +(cherry picked from commit 9b27347e61454d9f8ca2055f4c67a37dee336e83) + +CVE: CVE-2026-111750 +Upstream-Status: Backport [https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83] + +Signed-off-by: Ankur Tyagi +--- + CHANGES/13671.bugfix.rst | 1 + + aiohttp/http_parser.py | 6 +++++- + tests/test_http_parser.py | 27 ++++++++++++++++++++++++++- + 3 files changed, 32 insertions(+), 2 deletions(-) + create mode 100644 CHANGES/13671.bugfix.rst + +diff --git a/CHANGES/13671.bugfix.rst b/CHANGES/13671.bugfix.rst +new file mode 100644 +index 000000000..e6fbc7000 +--- /dev/null ++++ b/CHANGES/13671.bugfix.rst +@@ -0,0 +1 @@ ++Fixed pure-Python request parser not reading a body in a ``HEAD`` request -- by :user:`Dreamsorcerer`. +diff --git a/aiohttp/http_parser.py b/aiohttp/http_parser.py +index 678aee020..947060c9a 100644 +--- a/aiohttp/http_parser.py ++++ b/aiohttp/http_parser.py +@@ -433,8 +433,12 @@ class HttpParser(abc.ABC, Generic[_MsgT]): + + assert self.protocol is not None + # calculate payload ++ # https://www.rfc-editor.org/info/rfc9112/#name-message-body-length ++ # https://www.rfc-editor.org/info/rfc9110/#section-9.3.1-6 ++ # EMPTY_BODY_METHODS should only apply to responses. ++ # self.method is None on request parser. + empty_body = code in EMPTY_BODY_STATUS_CODES or bool( +- method and method in EMPTY_BODY_METHODS ++ self.method and self.method in EMPTY_BODY_METHODS + ) + if not empty_body and ( + (length is not None and length > 0) or msg.chunked +diff --git a/tests/test_http_parser.py b/tests/test_http_parser.py +index fcc1b6018..e9d40532b 100644 +--- a/tests/test_http_parser.py ++++ b/tests/test_http_parser.py +@@ -2181,7 +2181,32 @@ def test_http_request_chunked_payload_and_next_message(parser) -> None: + assert not payload2.is_eof() + + +-def test_http_request_chunked_payload_chunks(parser) -> None: ++def test_http_request_parser_head_with_content_length_payload( ++ parser: HttpRequestParser, ++) -> None: ++ smuggled = b"GET /smuggled HTTP/1.1\r\nHost: a\r\n\r\n" ++ text = ( ++ b"HEAD /test HTTP/1.1\r\nHost: a\r\nContent-Length: %d\r\n\r\n" % len(smuggled) ++ + smuggled ++ + b"POST /next HTTP/1.1\r\nHost: a\r\nContent-Length: 0\r\n\r\n" ++ ) ++ messages, upgraded, tail = parser.feed_data(text) ++ ++ assert len(messages) == 2 ++ msg, payload = messages[0] ++ assert msg.method == "HEAD" ++ assert b"".join(payload._buffer) == smuggled ++ assert payload.is_eof() ++ ++ msg2, payload2 = messages[1] ++ assert msg2.method == "POST" ++ assert msg2.path == "/next" ++ assert payload2.is_eof() ++ assert not upgraded ++ assert not tail ++ ++ ++def test_http_request_chunked_payload_chunks(parser: HttpRequestParser) -> None: + text = b"GET /test HTTP/1.1\r\nHost: a\r\ntransfer-encoding: chunked\r\n\r\n" + msg, payload = parser.feed_data(text)[0][0] + diff --git a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb index 78845ffb56..81ed8a849b 100644 --- a/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb +++ b/meta-python/recipes-devtools/python/python3-aiohttp_3.14.3.bb @@ -11,6 +11,7 @@ SRC_URI += "file://CVE-2026-111063.patch \ file://CVE-2026-111066.patch \ file://CVE-2026-111748.patch \ file://CVE-2026-111749.patch \ + file://CVE-2026-111750.patch \ " CVE_PRODUCT = "aiohttp:aiohttp" From patchwork Thu Nov 12 04:44:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103821 X-Patchwork-Delegate: ankur.tyagi85@gmail.com Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6945.1794458710459515217 for ; Wed, 11 Nov 2026 20:45:10 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=REx5CUhT; spf=pass (domain: gmail.com, ip: 209.85.210.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-8b67f25e6e1so1914976b3a.0 for ; Wed, 11 Nov 2026 20:45:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794458710; x=1795063510; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=+W+3ebitfH7Z2kx9Dq0ky1ws67GrYQknPDAcWL2i/bE=; b=REx5CUhTRf8aGCHQhrr+NelpH9fEsXyUw/MoOx4Tf3HP6GUBaGfulNNWhMdsIqCK7a H4HP4aTfwMexzasp21x/iRczqHENdjUbvJ+a2EORmSqw30dw+NxdpTzBSy8XeiCRIvFh c93zoope93sgvTZkIpG4pCsvtFESInmXWzjrj3hLGOEfNHHbSz+Qc9wq3o89/MLAUQ3t sh125biFzMkFPy78d1nPQdj3YKOqSFjTpUQFHnO1EuLuJhDQf/ND4K/Ix4vteI8+Lc5D rFZ2hgiMuGVwF8CNOVWH7pYvQ8R2K/B81UESLBNJLGzeNURwMcuMJBrXfOtokGUm//8b PWmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794458710; x=1795063510; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=+W+3ebitfH7Z2kx9Dq0ky1ws67GrYQknPDAcWL2i/bE=; b=2OQxhd55nNa1MZ8gH/NYqi//OSVrWgEbBcYPdb50KBruH1rUu4QfPicVlL7Lksgeju M7VNWLve9qfTiWqMgs5kYYX9KDeaDIoAl3aK9/MbK2rPfwrRA6zY+ldlIMurPffK+WUB eGKpaezVLap8+e25f8dFzPK+8nbJ+81QHOXcWO584YG0IhhZPx3I9Ue/y8QJigPQrIwi zknsrJXqynBbOHxeiem7Pd8Zsz1sfs+x31q8gFoeaPVZb/43XBJXFe5GMgS8NbrQMHal 5AE0gJBWCVmhsRTRnF72RkJfRUTcMe8dHXzVHquA3SFvr6yU/EOuuOQbjMAvQ9xgxY5A E6vA== X-Gm-Message-State: APuU4Z9hwr4MN9QhwaWXAmdNpyII1IiRFry8jEVf/DpMhBZ4iW+SJcyZ /OgZvYC9whGY3umEOpiksjMxMulLzHJ76H6R9USph2OlI9r1MsaDL+nRahsT+A== X-Gm-Gg: AYBFou0KZy+GhD1dfCtWzevE/l1fvQwkDpS/kRHE5S/fVlC9dx2noM7wgRcNsHiV/ah dbRLkqk0oyzZqSuAYoT79rjdGRIguZB5ke9cQQClxONudlDmw3OyNSYbvQksZpmyiU9O9OM/ZMy fVErSRVlpIG1xIitrFyznQTW3at9aE/HKlqg9y20sZJPeZasbsSwIpTc9IWTNYDNhuKg1NnjiIc H46AA++cY6KyhF0td8EaFl8PrUg7pn7TpzDWQTR5uWCBLvdu1ICu7TCMzV/Z6EU1ZS7Pa33udU6 a7ojkZvwF6PlgRUku9pkhN8C3pUK/JFB2cNGf/fQjr0STVdz2HoOznU89+MAY8SNE4t2vREzvGR OryfNfRkb/koafwzFvfRSa9O46s6MKPT0Fl2Ob64pL9SRm2n8ENRe+1NR1rBH4Rotdsv8UvR68C /EJNfpsWKzkfIzjBXY+qd2cl6r991SR0NJ2xJPiEo+SsSc9xv/DZOiBhKdBTBOy381sEOVCutD6 a0LltdOZfDODI1ip5FYJL9jsNDDCnKud296Re80VcAIYiZ7UAyrKpDSmRNfPBex8iy9WVylOBnJ /lqmJ07bcyqTsR5vepMS9VpnDK+QAxHbbCDLEgl2Zm8Dvuqo7eTISTrfrSvMjquGGpl6Za1PQIr jQNOHd0w= X-Received: by 2002:a05:6a20:cf88:b0:3e0:c955:cd5a with SMTP id adf61e73a8af0-3f2ffdc33demr5004318637.68.1794458709764; Wed, 11 Nov 2026 20:45:09 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cdd8d7dd5bbsm2238527a12.30.2026.11.11.20.45.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 20:45:09 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][blacksail][PATCH 16/16] python3-filelock: upgrade 4.0.4 -> 4.0.12 Date: Thu, 12 Nov 2026 17:44:26 +1300 Message-ID: <20261112044426.3933391-16-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> References: <20261112044426.3933391-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 04:45:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132167 From: Ankur Tyagi Changelog: https://py-filelock.readthedocs.io/en/latest/changelog.html#release-4-0-5 https://py-filelock.readthedocs.io/en/latest/changelog.html#release-4-0-6 https://py-filelock.readthedocs.io/en/latest/changelog.html#release-4-0-7 https://py-filelock.readthedocs.io/en/latest/changelog.html#release-4-0-8 https://py-filelock.readthedocs.io/en/latest/changelog.html#release-4-0-9 https://py-filelock.readthedocs.io/en/latest/changelog.html#release-4-0-10 https://py-filelock.readthedocs.io/en/latest/changelog.html#release-4-0-11 https://py-filelock.readthedocs.io/en/latest/changelog.html#release-4-0-12 Signed-off-by: Ankur Tyagi --- .../{python3-filelock_4.0.4.bb => python3-filelock_4.0.12.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-python/recipes-devtools/python/{python3-filelock_4.0.4.bb => python3-filelock_4.0.12.bb} (93%) diff --git a/meta-python/recipes-devtools/python/python3-filelock_4.0.4.bb b/meta-python/recipes-devtools/python/python3-filelock_4.0.12.bb similarity index 93% rename from meta-python/recipes-devtools/python/python3-filelock_4.0.4.bb rename to meta-python/recipes-devtools/python/python3-filelock_4.0.12.bb index 23cc4484c8..cfb84f1c7e 100644 --- a/meta-python/recipes-devtools/python/python3-filelock_4.0.4.bb +++ b/meta-python/recipes-devtools/python/python3-filelock_4.0.12.bb @@ -9,7 +9,7 @@ CVE_PRODUCT = "tox-dev:filelock" SRC_URI += "file://run-ptest" -SRC_URI[sha256sum] = "90999ed63a26ccf86b93b959ab10cf1017f422d816be454ed54cbed263e71ab5" +SRC_URI[sha256sum] = "cf42711a7ac791818b299fab0332a088c65aeeefa36290de98db92c434303b0c" BBCLASSEXTEND = "native nativesdk"