mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-15 06:17:16 +00:00
Code Issues Projects Releases Wiki Activity

ntopng: patch CVE-2026-86090 and CVE-2026-86091

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-86090
https://nvd.nist.gov/vuln/detail/cve-2026-86091

(cherry picked from commit ae180302f4)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi authored and Khem Raj committed 2026-10-12 21:57:14 -07:00
1 parent 4e8a7265bd
commit ba9537ae1f
2 files changed
+68
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch
+67
View File
@@ -0,0 +1,67 @@
From c6f4d42e1bb029463f927532819c5f5b331ea066 Mon Sep 17 00:00:00 2001
From: Alfredo Cardigliano <cardigliano@ntop.org>
Date: Thu, 16 Jul 2026 14:42:29 +0200
Subject: [PATCH] Fix user capability check for deleting notification endpoints
and pools
(cherry picked from commit 7d830f31af367745431c5d92e2e82fc432f6bdd8)
CVE: CVE-2026-86090 CVE-2026-86091
Upstream-Status: Backport [https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
scripts/lua/modules/pools/pools_rest_utils.lua | 5 +++++
scripts/lua/rest/v2/delete/endpoints.lua | 6 ++++++
scripts/lua/rest/v2/delete/recipients.lua | 6 ++++++
3 files changed, 17 insertions(+)
diff --git a/scripts/lua/modules/pools/pools_rest_utils.lua b/scripts/lua/modules/pools/pools_rest_utils.lua
index 9b692ea5db..73f08e0c8d 100644
--- a/scripts/lua/modules/pools/pools_rest_utils.lua
+++ b/scripts/lua/modules/pools/pools_rest_utils.lua
@@ -452,6 +452,11 @@ end
-- @brief Get all pools of all the available (currently implemented) pool instances
function pools_rest_utils.delete_all_instances_pools()
+ if not auth.has_capability(auth.capabilities.pools) then
+ rest_utils.answer(rest_utils.consts.err.not_granted)
+ return
+ end
+
local all_instances = pools_lua_utils.all_pool_instances_factory()
for _, instance in pairs(all_instances) do
diff --git a/scripts/lua/rest/v2/delete/endpoints.lua b/scripts/lua/rest/v2/delete/endpoints.lua
index 31852cedab..6d25c01953 100644
--- a/scripts/lua/rest/v2/delete/endpoints.lua
+++ b/scripts/lua/rest/v2/delete/endpoints.lua
@@ -10,6 +10,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" ..
local rest_utils = require "rest_utils"
local endpoints = require("endpoints")
local recipients = require "recipients"
+local auth = require "auth"
+
+if not auth.has_capability(auth.capabilities.notifications) then
+ rest_utils.answer(rest_utils.consts.err.not_granted)
+ return
+end
endpoints.reset_configs()
recipients.cleanup()
diff --git a/scripts/lua/rest/v2/delete/recipients.lua b/scripts/lua/rest/v2/delete/recipients.lua
index cbdffcae4c..14b3956498 100644
--- a/scripts/lua/rest/v2/delete/recipients.lua
+++ b/scripts/lua/rest/v2/delete/recipients.lua
@@ -8,6 +8,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" ..
local rest_utils = require "rest_utils"
local recipients = require "recipients"
+local auth = require "auth"
+
+if not auth.has_capability(auth.capabilities.notifications) then
+ rest_utils.answer(rest_utils.consts.err.not_granted)
+ return
+end
recipients.cleanup()
rest_utils.answer(rest_utils.consts.success.ok)
meta-networking/recipes-support/ntopng/ntopng_6.6.bb
+1
View File
@@ -20,6 +20,7 @@ SRC_URI = "gitsm://github.com/ntop/ntopng;protocol=https;branch=6.6-stable \
file://ntopng.service \
file://0001-Fix-build-with-OpenSSL-4.0.patch \
file://CVE-2026-84990.patch \
file://CVE-2026-86090-CVE-2026-86091.patch \
"
# don't use the lua under thirdparty as it supports cross compiling badly