mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-25 17:32:06 +00:00
Code Issues Projects Releases Wiki Activity
31,140 Commits 64 Branches 0 Tags
scarthgap
Commit Graph

31140 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Adarsh Jagadish Kamini bec755063a thrift: fix CVE-2026-58389 
Backport patch to fix CVE-2026-58389.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-58389

Upstream fix:
  https://github.com/apache/thrift/commit/0ab16e3a83637711f4e0f788c205f66576fd0a55

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Roland Kovacs 356ce58534 thrift: fix multiple CVEs 
CVE-2026-43868:
  Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.

CVE-2026-43869:
  Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
  This CVE only affects the Java client, which is not built by the recipe. Marked as
  'not-applicable-config'.
  Upstream commit:
    https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66

CVE-2026-43870:
  Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory
  ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers
  ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability
  in Apache Thrift.

Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Tugrul Kukul 6e099da67d jq: fix CVE-2026-44777 
Backport patch to fix CVE-2026-44777.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-44777

Upstream fix:
  https://github.com/jqlang/jq/commit/f58787c41835d9b17795730cb04925fdba25c71c

Tested with ptest:
Before: PASSED: 7, FAILED: 0, SKIPPED: 0
After: PASSED: 7, FAILED: 0, SKIPPED: 0

Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Tugrul Kukul 65604c0d46 jq: fix CVE-2026-39956 
Backport patch to fix CVE-2026-39956.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-39956
  https://www.cve.org/CVERecord?id=CVE-2026-39956
  https://security-tracker.debian.org/tracker/CVE-2026-39956
  https://osv.dev/list?q=CVE-2026-39956

Upstream fix:
  https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03 [nvd]

Tested with ptest:
Before: PASSED: 7, FAILED: 0, SKIPPED: 0
After: PASSED: 7, FAILED: 0, SKIPPED: 0

Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Ankur Tyagi 3a6720afef nginx: upgrade 1.26.0 -> 1.26.3 
Made patches for CVE-2024-7347, CVE-2025-23419 specific for v1.24.0 as
these vulnerabilities are fixed in v1.26.3.

Dropped CVE-2025-2341.patch for nginx-1.26.3

Changelog:
https://nginx.org/en/CHANGES-1.26

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:19 +05:30
Ankur Tyagi 24891ee0b9 nginx: upgrade 1.25.5 -> 1.26.0 
Stable branch 1.26.0 is off 1.25.5 and identical
https://github.com/nginx/nginx/compare/release-1.25.5...release-1.26.0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:18 +05:30
Ankur Tyagi 265199312c redis: upgrade 6.2.21 -> 6.2.23 
https://github.com/redis/redis/releases/tag/6.2.22
https://github.com/redis/redis/releases/tag/6.2.23

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:14 +05:30
Ankur Tyagi 1bc6d30b77 redis: upgrade 7.2.12 -> 7.2.15 
Refreshed patches for this version.

https://github.com/redis/redis/releases/tag/7.2.13
https://github.com/redis/redis/releases/tag/7.2.14
https://github.com/redis/redis/releases/tag/7.2.15

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:13 +05:30
Vijay Anusuri 319421fd5b libssh: Remove duplicate CVE_STATUS entry for CVE-2025-14821 
The CVE_STATUS entry for CVE-2025-14821 was added twice in the recipe.
Remove the duplicate entry to keep the recipe clean

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:13 +05:30
Hetvi Thakar 35f85f87b8 python3-twisted: Fix CVE-2026-42304 
This patch applies the upstream 26.4.0rc2 backport for
CVE-2026-42304. The upstream fix merge is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch header
because the fix expands to multiple commits.

[1] https://github.com/twisted/twisted/commit/2d196123264efb0027eecfe1b430be4a9babdbd8
[2] https://github.com/advisories/GHSA-grgv-6hw6-v9g4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:12 +05:30
Hetvi Thakar 3c9dd88058 python3-pyjwt: Fix CVE-2026-48526 
Reject JSON Web Key documents passed directly as HMAC secrets. This
prevents public asymmetric JWK data from being reused as an HMAC key
when an application permits mixed symmetric and asymmetric algorithms.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-xgmm-8j9v-c9wx

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:12 +05:30
Hetvi Thakar b9877579dc python3-pyjwt: Fix CVE-2026-48525 
Reject a non-empty compact payload segment for b64=false tokens before
Base64URL decoding. The segment is unused for detached JWS verification,
so decoding it allowed unauthenticated CPU and memory consumption.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-w7vc-732c-9m39

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:11 +05:30
Hetvi Thakar fffe550dfc python3-pyjwt: Fix CVE-2026-48524 
Preserve a valid cached JWK set when a refresh request fails. The
previous finally block stored None on errors, turning a transient JWKS
outage into an authentication failure for otherwise cached keys.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-fhv5-28vv-h8m8

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:11 +05:30
Hetvi Thakar 773e345eca python3-pyjwt: Fix CVE-2026-48522 
Restrict PyJWKClient JWKS retrieval to HTTP and HTTPS. urllib
otherwise accepts schemes such as file, FTP and data, allowing
attacker-influenced URLs to reach unintended resources.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-993g-76c3-p5m4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:10 +05:30
Darsh Kelaiya 49bb7f1369 python3-flask: fix CVE-2026-27205 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/pallets/flask/commit/c17f379390731543eea33a570a47bd4ef76a54fa
[2] https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:10 +05:30
Emanuele Ghidoli 07d8247914 jq: fix build broken by the CVE-2026-43895 backport 
Since da15df26e6 ("jq: Fix CVE-2026-43895") "bitbake jq" fails with:

  cc1: fatal error: src/parser.c: No such file or directory

That patch is the only jq patch touching both src/parser.c and
src/parser.y. git orders the diff alphabetically, so patch(1) writes
parser.y after parser.c and the shipped pre-generated parser looks
outdated. Maintainer mode is disabled, so make runs the no-op '.y.c'
rule; having "rebuilt" the target it stops resolving it through VPATH and
looks for it in ${B}, where it does not exist.

Touch the generated bison/flex sources before configure so they are never
considered stale. This also covers any future patch touching src/parser.y
or src/lexer.l.

With maintainer mode enabled bison will no longer regenerate parser.c,
which is fine: the CVE patches update the .y and the generated .c
consistently.

Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:04 +05:30
Benjamin Bouvier 80956c31c2 tcpdump: add CVE_PRODUCT 
Add exact CPE name in CVE_PRODUCT.

Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 112120131d)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:03 +05:30
Benjamin Bouvier 3a32c083e1 librelp: add CVE_PRODUCT 
Add exact CPE name in CVE_PRODUCT.

Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 09c542c2f4)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:03 +05:30
s-tokumoto bf51775fe9 fuse: Add "fuse:fuse" to CVE_PRODUCT 
Since there are vulnerabilities that cannot be detected by the existing
CVE_PRODUCT, add "fuse:fuse" to CVE_PRODUCT.

https://nvd.nist.gov/vuln/detail/CVE-2010-0789
https://nvd.nist.gov/vuln/detail/CVE-2005-1858

Signed-off-by: Shunsuke Tokumoto <s-tokumoto@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a223dd3557)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:02 +05:30
Adarsh Jagadish Kamini 35cb02fda2 thrift: fix CVE-2026-48144 
Backport patch to fix CVE-2026-48144.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-48144

Upstream fix:
  https://github.com/apache/thrift/commit/2b8baabc9be52807b08825e825bc0cd26568a193

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:02 +05:30
Adarsh Jagadish Kamini 7f5c686d97 thrift: fix CVE-2026-58023 
Backport patch to fix CVE-2026-58023.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-58023

Upstream fix:
  https://github.com/apache/thrift/commit/d68305a7308a11df2c1daef16f55dbc19dfa6ff0

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:01 +05:30
Adarsh Jagadish Kamini c83d3fa4c2 thrift: fix CVE-2026-55971 
Backport patch to fix CVE-2026-55971.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-55971

Upstream fix:
  https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:01 +05:30
Jason Schonberg 7e6a93e1ce php: upgrade 8.2.32 -> 8.2.33 
This is a security release.

Changelog: https://www.php.net/ChangeLog-8.php#8.2.33

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:34:58 +05:30
Hetvi Thakar ef3df29f2c libdbi-perl: Fix CVE-2026-14740 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-14740

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-30 07:53:25 +05:30
Hetvi Thakar 3dd0a40ecb libdbi-perl: Fix CVE-2026-14739 
Backport the upstream hard limit for positional placeholders. This is
a follow-up to CVE-2026-10879 and depends on the allocation fix from
the preceding libdbi-perl commit.

Correct the upstream boundary check so that the documented maximum of
99999 placeholders is accepted and values above it are rejected. Add
focused regression coverage for the 99999 and 100000 boundaries.

[1] https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395
[2] https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-14739
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-10879

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-30 07:53:25 +05:30
Hetvi Thakar dacd50f84e libdbi-perl: Fix CVE-2026-14380 
Backport the ordered upstream fix and regression-test chain from DBI
1.650. Add perl-module-load to RDEPENDS to satisfy the runtime
dependency introduced by the primary fix's use of Module::Load.

[1] https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259
[2] https://github.com/perl5-dbi/dbi/commit/d982411aec73b3acfc4e9e465358bca9eb7fede8
[3] https://github.com/perl5-dbi/dbi/commit/f94685f415b08ea4b1f183d48430c4583c1c07d0
[4] https://github.com/perl5-dbi/dbi/commit/7949e551b3c7a8854926b6de84f6cc2ceafb2200
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-14380

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-30 07:53:25 +05:30
Hetvi Thakar 3304a04085 libdbi-perl: Fix CVE-2026-10879 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978
[2] https://security-tracker.debian.org/tracker/CVE-2026-10879

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-30 07:53:25 +05:30
Hetvi Thakar ba75c3486c libdbi-perl: Fix CVE-2026-9698 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-9698

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-30 07:53:25 +05:30
Qliangw 6fe53daabc libuio: fix FILE descriptor leak 
The function uio_line_from_file() fails to close the FILE pointer
when fgets() returns NULL, causing a file descriptor leak.

This can be triggered when reading from /sys files that return
empty content, leading to resource exhaustion over time.

Fix this by using goto-based error handling to ensure fclose()
is called on all exit paths.

Signed-off-by: Qliangw <qili00001@gmail.com>
(cherry picked from commit cd75edf25d)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit d97b5602d7)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 09:45:00 +05:30
Darsh Kelaiya 24202b2e88 dnsmasq: Fix CVE-2026-12969 
This patch applies the upstream fix for CVE-2026-12969 as referenced
in [2], using the upstream commit identified in [1].

[1] https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=14094e88beca519c53151184cc4553656672b54f
[2] https://security-tracker.debian.org/tracker/CVE-2026-12969

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 09:28:54 +05:30
Darsh Kelaiya 1a484a8edd dnsmasq: Fix CVE-2026-12725 
This patch applies the upstream fix for CVE-2026-12725 as referenced
in [2], using the upstream commit identified in [1].

[1] https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=36d081e37477027fd721fea498f3760f529034ad
[2] https://security-tracker.debian.org/tracker/CVE-2026-12725

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 09:28:53 +05:30
Joao Marcos Costa 2bc558d93c nginx: backport fixes for CVE-2026-42533 
The fixes are all part of v1.30.4, as explained in the release notes
[1].

I tested this with the configuration below:

BB_VERSION           = "2.8.1"
BUILD_SYS            = "x86_64-linux"
NATIVELSBSTRING      = "fedora-39"
TARGET_SYS           = "x86_64-oe-linux"
MACHINE              = "qemux86-64"
DISTRO               = "nodistro"
DISTRO_VERSION       = "nodistro.0"
TUNE_FEATURES        = "m64 core2"
TARGET_FPU           = ""
meta                 = "scarthgap:3217490cc554069ae53aa54cf8ad7327ce85fa10"

For more details about the CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-42533

[1] https://github.com/nginx/nginx/releases/tag/release-1.30.4

Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 09:28:53 +05:30
Wang Mingyu f056a64405 monocypher: upgrade 4.0.2 -> 4.0.3 
Changelog:
===========
- Fixed timing leak vulnerability in EdDSA/Ed25519 signatures.
- Various minor documentation fixes.
- Various minor build system fixes.
- Various minor compiler warning fixes.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 25cfd0324c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:27 +05:30
Ankur Tyagi 925aadf07c haveged: upgrade 1.9.22 -> 1.9.23 
Release Notes:
https://github.com/jirka-h/haveged/releases/tag/v1.9.23

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:21 +05:30
Ankur Tyagi 484be66fdf postfix: upgrade 3.8.17 -> 3.8.19 
Release Notes:
https://www.postfix.org/announcements/postfix-3.11.4.html
https://www.postfix.org/announcements/postfix-3.11.5.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:20 +05:30
Khem Raj 6ff79c13bf apache2: upgrade 2.4.67 -> 2.4.68 
This upgrade incorporates the fixes for CVE-2026-49975 CVE-2026-48913
CVE-2026-44631 CVE-2026-44186 CVE-2026-44185 CVE-2026-44119
CVE-2026-43951 CVE-2026-42536 CVE-2026-42535 CVE-2026-34356
CVE-2026-34355 CVE-2026-29170 CVE-2026-29167

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 23cdc4ca43)

Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.68

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:08 +05:30
Darsh Kelaiya ce23e14868 jq: Fix CVE-2026-54679 
This patch applies the upstream fix for CVE-2026-54679 as referenced
in [2], using the upstream commit identified in [1].

[1] https://github.com/jqlang/jq/commit/46d1da30944ce93dd671ac72b6513fc0eb747837
[2] https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:08 +05:30
Darsh Kelaiya 6d3530d6a1 jq: Fix CVE-2026-49839 
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].

[1] https://github.com/jqlang/jq/commit/e987df0d463d85fd70825e042a082427e8275b86
[2] https://github.com/jqlang/jq/security/advisories/GHSA-cfh2-vwfq-qfmm

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:08 +05:30
Darsh Kelaiya 624fedbfa0 jq: Fix CVE-2026-47770 
This patch applies the upstream fix for CVE-2026-47770 as referenced
in [2], using the upstream commit identified in [1].

[1] https://github.com/jqlang/jq/commit/7122866869960b55cea3646bc91334ef55787831
[2] https://github.com/jqlang/jq/security/advisories/GHSA-3pgx-frr7-3jxp

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:07 +05:30
Darsh Kelaiya da15df26e6 jq: Fix CVE-2026-43895 
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].

[1] https://github.com/jqlang/jq/commit/9d223f153c3632a207fa071caaa6292da33ae361
[2] https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:07 +05:30
Benjamin Robin (Schneider Electric) 30eaef2541 dnsmasq: fix CVE-2026-4890 
A Denial of Service (DoS) vulnerability in the DNSSEC validation of
dnsmasq allows remote attackers to cause a denial of service via a
crafted DNS packet.

This patch is used by debian bookworm (2.90-4_deb12u2).
It is also referenced here [1].

[1] https://thekelleys.org.uk/dnsmasq/CVE/CVE-2026-4890.dnsmasq-2.91.diff

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:06 +05:30
Peter Marko 2bc33d99c9 hostapd: set status for CVE-2026-58374 
As desctibed in [1], vulnerable code is not yet present in 2.10.

[1] https://security-tracker.debian.org/tracker/CVE-2026-58374

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:06 +05:30
Deepak Rathore 8b23408f0d ldns: fix CVE-2026-10846 
This patch backports the upstream fixes released in ldns 1.9.2 for
CVE-2026-10846.The upstream commits are referenced in [1], [2], and
[3], and the public CVE advisory is referenced in [4].The individual
backported commit links are also recorded in the embedded patch headers.

[1] https://github.com/NLnetLabs/ldns/commit/a21fb16686bbe3355886905f95e13eab5144d805
[2] https://github.com/NLnetLabs/ldns/commit/9ea51a68d458b43a17ccf4ee98a71325300df524
[3] https://github.com/NLnetLabs/ldns/commit/dc117528dfc60b2dda82d9171b7e9e0b6890da2f
[4] https://www.nlnetlabs.nl/downloads/ldns/CVE-2026-10846.txt

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:05 +05:30
Peter Marko 2b04d2036c libwebsockets: patch CVE-2026-10650 
Pick patch mentioned in NVD report.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:05 +05:30
Benjamin Robin (Schneider Electric) 7eb9410758 nginx: fix CVE-2026-42055 
A heap memory buffer overflow might occur in a worker process when using
a configuration with "ignore_invalid_headers off;" and
"large_client_header_buffers" with large configured values when
proxying a specially crafted request to gRPC backend, allowing an attacker
to cause worker process memory corruption or segmentation fault in a
worker process.

This is a partial cherry-pick of 131be8514da8985b15b74150521afedbf9cc4ea3
since ngx_http_proxy_v2_module.c does not exist in nginx 1.24

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-16 15:49:44 +05:30
Deepak Rathore e802c281bf libidn: fix CVE-2026-57053 
This patch applies the upstream v1.44 backport for
CVE-2026-57053. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://git.savannah.gnu.org/cgit/libidn.git/commit/?id=f57fab06afc1e328bbe197ad3d4a4e83c829593e
[2] https://www.cve.org/CVERecord?id=CVE-2026-57053

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-16 15:49:43 +05:30
Deepak Rathore b02e2e66cb nmap: fix CVE-2026-58058 
This patch applies the upstream master backport for
CVE-2026-58058. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83
[2] https://github.com/advisories/GHSA-wxvj-hc4r-fq45

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-16 15:49:43 +05:30
Deepak Rathore 9d489b45ea mbedtls: set CVE_STATUS for CVE-2025-66442 
Analysis:
- The Mbed TLS advisory states the issue occurs when LLVM
  select-optimize is enabled. [1]
- The same advisory also states that Arm/x86 builds with
  MBEDTLS_HAVE_ASM enabled are not affected. The default mbedtls
  configuration in this branch enables MBEDTLS_HAVE_ASM.
- NVD also describes the issue as occurring only with LLVM's
  select-optimize feature. [2]
- The mbedtls recipes now evaluate the effective build flags across
  target, native, and nativesdk variants, handle the supported
  -mllvm spellings, and only mark the CVE unpatched when the
  vulnerable LLVM option combination is explicitly enabled and the
  Arm/x86 MBEDTLS_HAVE_ASM carve-out does not apply.
- When those conditions are not met, the current mbedtls build
  configuration is not affected.
- Hence ignoring/deferred the CVE for now.

Reference:
[1] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-66442

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0eda0f3c55)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-16 15:49:42 +05:30
Yunseong Kim c8dc986a39 libyang: Fix CVE-2026-41401 and CVE-2026-44673 
CVE-2026-41401:

  Fix incorrect metadata list pointer update in lyd_parse_set_data_flags()
  when freeing the head metadata entry. Without this fix, crafted YANG XML
  documents with specific metadata ordering can trigger invalid pointer
  states in the metadata linked list.

CVE-2026-44673:

  Fix integer overflow and OOM in the LYB binary parser. lyb_read_string()
  wraps len + 1 to 0 when len == UINT64_MAX, and lyb_read_term_value()
  truncates uint64_t to uint32_t causing undersized allocation. Both paths
  are reachable via malformed LYB input with crafted length fields.

Signed-off-by: Yunseong Kim <yunseong.kim@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-16 15:49:42 +05:30
Esa Jaaskela 1f99172329 uutils-coreutils: fix buildpaths QA warning 
The onig_sys and blake3 crates build bundled C via cc crate. The build
path leaks into the the -dbg binary and trips the buildpaths QA check.
Add a -fdebug-prefix-map for ${CARGO_HOME} to CFLAGS to add a correct
mapping.

Signed-off-by: Esa Jaaskela <esa.jaaskela@suomi24.fi>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-16 15:49:41 +05:30