mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-15 06:17:16 +00:00
Code Issues Projects Releases Wiki Activity

ntopng: patch CVE-2026-84990

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84990

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Anuj Mittal committed 2026-10-05 14:41:20 +05:30
1 parent 9c1aeb81bd
commit 2d932fa4e3
2 files changed
+54
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch
+53
View File
@@ -0,0 +1,53 @@
From 2f36e393fc35f576d7c447af337848e81990b084 Mon Sep 17 00:00:00 2001
From: Alfredo Cardigliano <cardigliano@ntop.org>
Date: Fri, 17 Jul 2026 11:51:03 +0200
Subject: [PATCH] Add admin check in conf backup listing and download
(cherry picked from commit f912ee93bc143330b6ff3bb946ee7211e5ee9e1a)
CVE: CVE-2026-84990
Upstream-Status: Backport [https://github.com/ntop/ntopng/commit/f912ee93bc143330b6ff3bb946ee7211e5ee9e1a]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../rest/v2/get/system/configurations/download_backup.lua | 5 +++++
.../v2/get/system/configurations/list_available_backups.lua | 6 ++++++
2 files changed, 11 insertions(+)
diff --git a/scripts/lua/rest/v2/get/system/configurations/download_backup.lua b/scripts/lua/rest/v2/get/system/configurations/download_backup.lua
index 1603a94c48..404b09ed97 100644
--- a/scripts/lua/rest/v2/get/system/configurations/download_backup.lua
+++ b/scripts/lua/rest/v2/get/system/configurations/download_backup.lua
@@ -12,6 +12,11 @@ local backup_config = require("backup_config")
-- ##############################################
+if not isAdministratorOrPrintErr() then
+ rest_utils.answer(rest_utils.consts.err.not_granted)
+ return
+end
+
local download = _GET["download"]
local epoch = _GET["epoch"]
diff --git a/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua b/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua
index d901a876b0..8a08ad15d5 100644
--- a/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua
+++ b/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua
@@ -8,11 +8,17 @@ package.path = dirs.installdir .. "/scripts/lua/modules/system_config/?.lua;" ..
-- ##############################################
+require "lua_utils"
local backup_config = require("backup_config")
local rest_utils = require("rest_utils")
-- ##############################################
+if not isAdministratorOrPrintErr() then
+ rest_utils.answer(rest_utils.consts.err.not_granted)
+ return
+end
+
local rc = rest_utils.consts.success.ok
local order = _GET["order"] or "desc"
meta-networking/recipes-support/ntopng/ntopng_6.6.bb
+1
View File
@@ -18,6 +18,7 @@ SRC_URI = "gitsm://github.com/ntop/ntopng;protocol=https;branch=6.6-stable \
file://0001-configure.ac.in-Allow-dynamic-linking-against-ndpi-3.patch \
file://0001-luaengine-Use-lua-5.5-API-signature-for-lua_newstate.patch \
file://ntopng.service \
file://CVE-2026-84990.patch \
"
# don't use the lua under thirdparty as it supports cross compiling badly