Ankur Tyagi
bb956bf8ff
redis: upgrade 8.10.2 -> 8.10.3
...
Changelog:
https://github.com/redis/redis/releases/tag/8.10.3
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 53276e6882ankur.tyagi85@gmail.com >
2026-10-28 08:22:29 +13:00
James Lee
948fbdea56
mctp: upgrade 2.6 -> 2.6.1
...
mctp 2.6.1 is a bugfix release that corrects mctpd's systemd service
file. mctpd requires CAP_NET_RAW to send MCTP control messages when
running as an unprivileged user. This capability is missing from
version 2.6, breaking mctpd.
Bump mctp and mctpd to version 2.6.1 to correct this.
Changelog:
https://github.com/CodeConstruct/mctp/blob/v2.6.1/CHANGELOG.md
Signed-off-by: James Lee <james@codeconstruct.com.au >
2026-10-28 07:30:41 +13:00
Jason Schonberg
0d9abd6842
c-ares: backport security fixes from 1.34.9
...
Add the eight unique upstream commits that fix the security advisories addressed in c-ares 1.34.9.
Several advisories share commits, so patches are ordered by commit rather than duplicated per advisory; each patch lists the GHSA IDs it resolves.
Assisted-by: opencode (big-pickle)
Signed-off-by: Jason Schonberg <schonm@gmail.com >
2026-10-27 17:43:29 +13:00
Ankur Tyagi
d3e07213ff
python3-oauthlib: patch CVE-2026-49265
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49265
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
1ea3019791
python3-brotli: upgrade 1.2.0 -> 1.2.1
...
Changelog:
https://github.com/google/brotli/blob/v1.2.1/CHANGELOG.md#121---2026-10-21
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
2a8300a0ef
7zip: upgrade 26.04 -> 26.05
...
Changelog:
https://github.com/ip7z/7zip/releases/tag/26.05
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 533d0a63acankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
e5a8e3e298
7zip: upgrade 26.03 -> 26.04
...
Changelog:
https://github.com/ip7z/7zip/releases/tag/26.04
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 1c45c216f6ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
496cb3f327
apache2: upgrade 2.4.68 -> 2.4.69
...
Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.69
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit cf030e73b8ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Jason Schonberg
1e4a1a7cdc
php: upgrade 8.5.11 -> 8.5.12
...
This is a security update. Fixes unauthenticated remote code execution.
CVE-2026-109618 CVE-2026-109619
Advisory: https://www.php.net/archive/2026.php#2026-10-21-5
Changelog: https://www.php.net/ChangeLog-8.php#8.5.12
Signed-off-by: Jason Schonberg <schonm@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 898ac0ba1cankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Jason Schonberg
82e99aebb4
brotli: upgrade 1.2.0 -> 1.2.1
...
This is a security release
CVE-2026-111497: out-of-bounds write permits remote code execution
Changelog: https://github.com/google/brotli/releases/tag/v1.2.1
Signed-off-by: Jason Schonberg <schonm@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit b5d66bf60dankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
a252864b76
ntpsec: upgrade 1.2.5 -> 1.2.6
...
Changelog:
https://gitlab.com/NTPsec/ntpsec/-/blob/NTPsec_1_2_6/NEWS.adoc?ref_type=tags
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit b730ef39a1ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
03be564adc
unbound: upgrade 1.26.1 -> 1.26.2
...
Details:
https://github.com/NLnetLabs/unbound/releases/tag/release-1.26.2
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
fa4dfa140d
libmspack: patch CVE-2026-110602
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-110602
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Peter Marko
f16173e6a4
python3-grpcio: update gRPC repo roots
...
See https://emudhra.we-have-a-problem.com/
Use a copy function instead of adding the patch two times becuase there
are two copies of certificates in the sources.
Signed-off-by: Peter Marko <peter.marko@siemens.com >
2026-10-26 23:14:51 +13:00
Peter Marko
1a0a133351
grpc: update gRPC repo roots
...
See https://emudhra.we-have-a-problem.com/
Signed-off-by: Peter Marko <peter.marko@siemens.com >
2026-10-26 23:14:40 +13:00
Peter Marko
8a760baf57
nss: remove compromised eMudhra certificates
...
See https://emudhra.we-have-a-problem.com/
Signed-off-by: Peter Marko <peter.marko@siemens.com >
2026-10-26 23:14:32 +13:00
Ankur Tyagi
a07cefff6a
swagger-ui: upgrade 5.33.2 -> 5.33.3
...
Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.3
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 67b4387a4dankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
b625e91dcf
libvncserver: patch CVE-2026-50538
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50538
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
105c0a7d4b
libvncserver: patch CVE-2026-32853
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32853
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
3f2eb98cd8
libvncserver: patch CVE-2026-32854
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32854
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
4ba15423c7
libvncserver: patch CVE-2026-44988
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44988
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
3e1f043594
ncp: ignore CVE-2025-14577 and CVE-2026-35087
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14577
https://nvd.nist.gov/vuln/detail/cve-2026-35087
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
60a1ac73cb
mtr: patch CVE-2026-14461
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-14461
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Peter Marko
ac8179c9b1
nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629
...
These CVEs are fixed in latest release however still show-up in open
CVE reports. Reason is that the DB contains entries:
{
"lessThan": "*",
"status": "affected",
"version": "1.23.3",
"versionType": "custom"
}
Which should mean that the first affected release is 1.23.3, however
without the upper limit it will match all higher releases.
The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it
works by flagging CVEs where at least one version match is present.
Signed-off-by: Peter Marko <peter.marko@siemens.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 959f4c8f09mominux@gmail.com >
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:19 +13:00
Peter Marko
3ee18e1a42
nginx: upgrade 1.30.5 -> 1.30.6
...
2026-10-14 nginx-1.30.6 stable and nginx-1.31.7 mainline versions have
been released, with fixes for buffer overflow vulnerability when using
alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when
evaluating string expressions with variables (CVE-2026-93479), request
body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery
vulnerability when using TLS session ticket key rotation
(CVE-2026-97629), and use-after-free vulnerability when using
ngx_http_ssi_module with AIO (CVE-2026-97205).
Signed-off-by: Peter Marko <peter.marko@siemens.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 6cdd413248ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
b05877ef8e
netdata: mark CVE-2026-83602 fixed
...
Fix identified by NVD is included in the patch release[1] v2.10.4
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-83602
[1]https://github.com/netdata/netdata/pull/22825
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
406da4cb70
nmap: patch CVE-2026-72712
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-72712
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
e3266bede8
nmap: patch CVE-2026-58058
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-58058
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
7629323ae3
pjproject: patch CVE-2026-84975
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84975
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
eaf5f50981
pjproject: patch CVE-2026-77396
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-77396
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:00 +13:00
Ankur Tyagi
59a6a134d6
pjproject: patch CVE-2026-57166
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57166
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
aac29142ed
pjproject: patch CVE-2026-57165
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57165
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
274e935099
pjproject: patch CVE-2026-57164
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57164
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
3cc8b60359
pjproject: patch CVE-2026-57163
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57163
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
f7758a033e
pjproject: patch CVE-2026-57162
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57162
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
371f20419d
pjproject: patch CVE-2026-57161
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57161
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
78f0ee20cc
pjproject: patch CVE-2026-57160
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57160
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
bb27c215be
pjproject: mark CVE-2026-26967 fixed
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-26967
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
27b41701a0
opensc: patch CVE-2026-103531
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-103531
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
3e78f34c9b
poppler: patch CVE-2026-102620
...
Also backport commit[1] to allow cherry-pick of the commit fixing the CVE.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-102620
[1]https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
435cd16e9b
poppler: patch CVE-2026-102621
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-102621
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
bedbe1184f
postfix: ignore CVE-2023-32182
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2023-32182
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
9771015a7d
proftpd: mark CVE-2026-53994 fixed
...
Debian[1] identified the issue[2] associated with this CVE.
Changelog[3] confirms the resolution.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-53994
[]https://security-tracker.debian.org/tracker/CVE-2026-53994
[]https://github.com/proftpd/proftpd/issues/2115
[]https://github.com/proftpd/proftpd/blob/v1.3.9b/NEWS#L35
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:10 +13:00
Ankur Tyagi
3e0c7af047
psqlodbc: patch CVE-2026-109448
...
Backport the commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-109448
[1]https://security-tracker.debian.org/tracker/CVE-2026-109448
PTEST pass:
root@qemuarm64:~# ptest-runner psqlodbc
START: ptest-runner
2026-10-17T09:22
BEGIN: /usr/lib/psqlodbc/ptest
...
DURATION: 43
END: /usr/lib/psqlodbc/ptest
2026-10-17T09:23
STOP: ptest-runner
TOTAL: 1 FAIL: 0
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:07 +13:00
Ankur Tyagi
622cd276dd
rapidjson: mark CVE-2024-38517 fixed
...
Commit mentioned in the NVD is part of the current version:
$ git log HEAD --oneline | grep 8269bc2b
8269bc2b Prevent int underflow when parsing exponents
Details:
https://nvd.nist.gov/vuln/detail/cve-2024-38517
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:13:53 +13:00
Ankur Tyagi
babb18114e
samba: ignore CVE-2026-2340
...
Also confirmed in the release notes[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-2340
[1]https://www.samba.org/samba/history/samba-4.23.8.html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-17 12:06:28 +13:00
Ankur Tyagi
bc11cbea9e
python3-cbor2: upgrade 6.1.4 -> 6.1.5
...
Changelog:
https://github.com/agronholm/cbor2/releases/tag/6.1.5
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-16 18:37:03 +13:00
Ankur Tyagi
2b5240d701
python3-pyjwt: upgrade 2.13.0 -> 2.14.0
...
Changelog:
https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-16 18:36:57 +13:00
Ankur Tyagi
6894d75451
libxmp: upgrade 4.7.3 -> 4.7.4
...
Changelog:
https://github.com/libxmp/libxmp/releases/tag/libxmp-4.7.4
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:35:24 +13:00
Ankur Tyagi
3fb79999f2
libmikmod: upgrade 3.3.14 -> 3.3.15
...
Changelog:
https://sourceforge.net/p/mikmod/mikmod/ci/libmikmod-3.3.15/tree/libmikmod/NEWS
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:35:19 +13:00
Ankur Tyagi
James Lee
Jason Schonberg
Peter Marko