mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-15 06:17:16 +00:00
Code Issues Projects Releases Wiki Activity
31,198 Commits 65 Branches 0 Tags
scarthgap
Commit Graph
31198 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Anuj Mittal 0f00f8b9a2 vboxguestdrivers: fix vboxvideo build on kernels lacking drm_fb_helper_alloc_info 
Kernel 6.6.151 dropped the drm_fb_helper_alloc_info() declaration as
part of a stable backport, causing vbox_fb.c to fail with:

  vbox_fb.c:329:16: error: implicit declaration of function 'drm_fb_helper_alloc_info'

The existing RTLNX_VER_MIN(6,19,0) check can't express this since the
change landed mid-series in 6.6.y/6.12.y/6.18.y. Backport master
commit b249fbbf1b ("vboxguestdrivers: fix
 vboxvideo build on kernels lacking drm_fb_helper_alloc_info"),
adapted for the 7.0.14 recipe.

Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-29 16:10:23 +05:30
Jason Schonberg c8b0f3d79e php: upgrade 8.2.33 -> 8.2.34 
This is a security release.

CVE-2025-1218 CVE-2025-14181
CVE-2026-91765 CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769
CVE-2026-6103 CVE-2026-17545 CVE-2026-92842 CVE-2026-93682

Changelog: https://www.php.net/ChangeLog-8.php#8.2.34

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:34 +05:30
Benjamin Robin (Schneider Electric) a064adfbd1 libwebsockets: fix CVE-2026-19773 
Backport the fix from v5 branch.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:34 +05:30
Benjamin Robin (Schneider Electric) 307a3bdc40 libwebsockets: update to version 4.3.10 
This version already include the fixes for CVE-2025-11677 and for
CVE-2025-11678. The LICENSE was slightly changed to clarify the license
summary.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:33 +05:30
Himani Ramesh Barde cb7844b35d postfix: fix build on hosts with Linux 7.x kernel 
makedefs only recognizes kernel majors 3-6. Hosts running a 7.x
kernel get "Unknown system type: Linux 7.0.0-..." and the native
build fails. Add 7 to the version match in makedefs and sys_defs.h.

Already fixed in postfix 3.11.

Upstream-Status: Backport [postfix 3.11]
Signed-off-by: Himani Ramesh Barde <HimaniRamesh.Barde@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:33 +05:30
Rohini Sangam e22d8fc3e1 python3-pillow: Security fix for CVE-2026-59204 
Pick patch from [1] also mentioned at NVD report in [2]

[1] https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca
[2] https://nvd.nist.gov/vuln/detail/cve-2026-59204

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:32 +05:30
Rohini Sangam 30683c653d python3-pillow: Security fix for CVE-2026-59198 
Pick patch from [1] also mentioned at NVD report in [2]

[1] https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
[2] https://nvd.nist.gov/vuln/detail/cve-2026-59198

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:32 +05:30
Viswanath Kraleti be9e8c94e8 libfastjson: switch git branch from master to main 
Update SRC_URI to use the 'main' branch instead of 'master' since
the upstream GitHub repository has renamed its default branch.

Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 1a742957c1)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:31 +05:30
Peter Marko c3984a6ff2 polkit: patch CVE-2026-4897 and CVE-2026-85498 
Pick patches mentioning these CVEs in their commit messages.
Note that patch for CVE-2026-4897 introduces CVE-2026-85498.
Also pick additional patch introduced between these commits which
touches the added code so the final patch applies cleanly.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:31 +05:30
Peter Marko d764db6fb5 recipes: correct homepage 
Leading space leads to SPDX document validation errors for url in
some tools.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(From meta-oe rev: 64dcb55dc5)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:30 +05:30
Peter Marko 6a48592e95 msgpack-c: patch CVE-2026-72854 
Pick patch from [1] linked from [2] mentioned in [3].
Drop version bump related changes.

[1] https://github.com/msgpack/msgpack-c/pull/1182/commits
[2] https://github.com/msgpack/msgpack-c/issues/1181
[3] https://nvd.nist.gov/vuln/detail/cve-2026-72854

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:30 +05:30
Deepak Rathore 4601216546 rsyslog: Fix CVE-2026-19654 
This patch applies the fix backported to rsyslog 8.2402.0 for
CVE-2026-19654. The upstream fix commit is referenced in [1], and
the public CVE advisory is referenced in [2]. The regression-test
commit is included in the same upstream pull request and referenced
in [3] and the individual commit is reference in [4].

[1] https://github.com/rsyslog/rsyslog/commit/07b3c40a5a78c79ed9109251f842ca7e955dd586
[2] https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29
[3] https://github.com/rsyslog/rsyslog/pull/7410
[4] https://github.com/rsyslog/rsyslog/commit/8e67ae69539153e4e80547dfb5f07ed17222e292

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:29 +05:30
Hitendra Prajapati 3e40d728ae python3-pillow: fix CVE-2026-42311 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-42311

Pick patch from [1] & [2] also mentioned at Debian report in [3]

[1] https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea
[2] https://github.com/python-pillow/Pillow/commit/3b1f70da
[3] https://security-tracker.debian.org/tracker/CVE-2026-42311

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:29 +05:30
Yogita Urade 90e88f77ab hdf5: Fix CVE-2026-17572 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/HDFGroup/hdf5/commit/20f0b9564bc46154e60f8d35578720a599d41552
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-17572

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-21 09:04:15 +05:30
Hetvi Thakar b5874ea07d libssh: Fix CVE-2026-59850 
The stable-0.11 commit shown in [1] is the upstream fix selected for
this backport. The upstream advisory [2] documents CVE-2026-59850 and
identifies libssh 0.11.5 as the fixed release for the 0.11 series.

[1] https://git.libssh.org/projects/libssh.git/commit/?id=6edfb52b3b364577d2db0334c0514a977efceed2
[2] https://www.libssh.org/security/advisories/CVE-2026-59850.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-02 10:39:59 +05:30
Hetvi Thakar 6e303a0123 libssh: Fix CVE-2026-59848 
The stable-0.11 commit shown in [1] is the primary upstream fix selected
for this backport. Commit [2] corrects the request-queue pointer state
introduced by [1], so it is carried immediately afterward as a regression
fix. The upstream advisory [3] documents CVE-2026-59848 and identifies
libssh 0.11.5 as the fixed release for the 0.11 series.

[1] https://git.libssh.org/projects/libssh.git/commit/?id=a30a51003205744c10ba4439306f555206ae8497
[2] https://git.libssh.org/projects/libssh.git/commit/?id=5309aefd99e1775db40bf20869f1fb1cc6c787be
[3] https://www.libssh.org/security/advisories/CVE-2026-59848.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-02 10:39:59 +05:30
Hetvi Thakar df16e6650d libssh: Fix CVE-2026-59846 
libssh 0.10.6 predates the username-validation helper used by the
stable-0.11 fix, so the upstream commit in [1] cannot be applied as-is.
Adapt the same dangerous-character check directly at the ProxyCommand %r
expansion sink and add focused regression coverage.

The upstream advisory [2] identifies libssh 0.11.5 and 0.12.1 as the
fixed releases.

[1] https://gitlab.com/libssh/libssh-mirror/-/commit/56ce3c193eb06af5bf3b07ec0b4c7308b5c72130
[2] https://www.libssh.org/security/advisories/CVE-2026-59846.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-02 10:39:58 +05:30
Hetvi Thakar 0428dc2fe2 libssh: Fix CVE-2026-59844 
The stable-0.11 commit shown in [1] is the upstream fix selected for
this backport. The upstream advisory [2] documents CVE-2026-59844 and
identifies libssh 0.11.5 as the fixed release for the 0.11 series.

[1] https://git.libssh.org/projects/libssh.git/commit/?id=e31f06e5380be4e714d5ad6965981fbf30738da9
[2] https://www.libssh.org/security/advisories/CVE-2026-59844.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-02 10:39:24 +05:30
Hetvi Thakar f6b642b915 libssh: Fix CVE-2026-59843 
The stable-0.11 commit shown in [1] is the upstream fix selected for
this backport. The upstream advisory [2] documents CVE-2026-59843 and
identifies libssh 0.11.5 as the fixed release for the 0.11 series.

[1] https://git.libssh.org/projects/libssh.git/commit/?id=687ef1c44b646b9db0b1c6e8f987edb7c9e4d919
[2] https://www.libssh.org/security/advisories/CVE-2026-59843.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-02 10:38:54 +05:30
Darsh Kelaiya edf29eeda9 python3-aiohttp: fix CVE-2026-34518 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6
[2] https://github.com/aio-libs/aiohttp/commit/6e8f393330f9bd6d7b24a146124ebc42eaa727b9
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34518

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:06 +05:30
Darsh Kelaiya 1108d82e62 python3-aiohttp: fix CVE-2026-34993 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-34993

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:06 +05:30
Darsh Kelaiya b1fdc4d179 python3-aiohttp: fix CVE-2026-34513 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98
[2] https://github.com/aio-libs/aiohttp/commit/8ab84c52fe58ef34794fa9b12f00b06e626adcc0
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34513

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:05 +05:30
Darsh Kelaiya b024b3d0d2 python3-aiohttp: fix CVE-2026-34514 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06
[2] https://github.com/aio-libs/aiohttp/commit/dab9e879be5606682a39b9dd378900eba0afd1a4
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34514

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:05 +05:30
Darsh Kelaiya 334f13cc57 python3-aiohttp: fix CVE-2026-22815 
This patch applies the reviewed upstream fix commits shown in
[1], [2], and [3]. The advisory identifying the fix is referenced in
[4].

The generated aiohttp/_http_parser.c changes are omitted. The
recipe-time Cython regeneration introduced with CVE-2025-69224
regenerates that file from the patched _http_parser.pyx before the
accelerated parser is compiled.

[1] https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36
[2] https://github.com/aio-libs/aiohttp/commit/ed6440ca49ef4907ab9d99ba7e329aab702b7173
[3] https://github.com/aio-libs/aiohttp/commit/30ec25f8a58c5dc3f8fdb3eec31f555eeaabd30a
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-22815

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:04 +05:30
Darsh Kelaiya 12088f5bdd python3-aiohttp: fix CVE-2025-69223 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

The python3-brotli 1.2.0 upgrade commit [4] is omitted because
Scarthgap currently provides python3-brotli 1.1.0. Brotli 1.2.0
adds the bounded decompression API required by the upstream aiohttp
fix. Consequently, this backport disables optional Brotli response
decoding while retaining bounded decompression for the supported
zlib path.

[1] https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
[2] https://github.com/aio-libs/aiohttp/commit/92477c5a74c43dfe0474bd24f8de11875daa2298
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-69223
[4] https://github.com/openembedded/meta-openembedded/commit/382e4de7d8b7d0e980fefcda7a06e5f20f5f26c0

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:04 +05:30
Darsh Kelaiya 10aeacf39f python3-aiohttp: fix CVE-2025-69229 
This patch applies the reviewed upstream fix commits shown in
[1], [2], [3], and [4].
The advisory identifying the fix is referenced in [5].

[1] https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712
[2] https://github.com/aio-libs/aiohttp/commit/271532ea355c65480c8ecc14137dfbb72aec8f6f
[3] https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229
[4] https://github.com/aio-libs/aiohttp/commit/1e4120e87daec963c67f956111e6bca44d7c3dea
[5] https://nvd.nist.gov/vuln/detail/CVE-2025-69229

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:03 +05:30
Darsh Kelaiya 11baed163d python3-aiohttp: fix CVE-2025-69227 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259
[2] https://github.com/aio-libs/aiohttp/commit/d5bf65f15c0c718b6b95e9bc9d0914a92c51e60f
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-69227

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:03 +05:30
Devansh Patel 5891d513a9 python3-web3: add CVE_PRODUCT mapping 
The current inherited "python:web3" mapping does not match the web3.py
identities used by NVD and CVE List V5, so its source-aligned CVE is
missed.

Use "ethereum:web3.py" for the CNA affected-data identity and
"apeworx:web3.py" for the NVD dictionary CPE and NVD configuration
identity.

Backport note: Scarthgap has web3.py 6.17.0 rather than 7.16.0;
CVE-2026-40072 applies to this release and is reported as unpatched.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 19ecb40f50)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:02 +05:30
Darsh Kelaiya f6e53ba11b python3-aiohttp: fix CVE-2025-69224 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

The generated aiohttp/_http_parser.c changes are omitted. Add
python3-cython-native and regenerate the C source from the patched
_http_parser.pyx during do_configure.

[1] https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0
[2] https://github.com/aio-libs/aiohttp/commit/5affd64f86d28a16a8f8e6fea2d217c99bf7831f
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-69224

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:02 +05:30
Darsh Kelaiya 7489d88734 python3-aiohttp: ignore CVE-2026-34515 
Analysis:
- The upstream advisory limits the issue to aiohttp applications running
  on Windows and identifies the affected and fixed versions [1].
- The advisory-selected upstream fix rejects absolute static resource
  paths, explicitly including UNC and Windows drive paths [2].
- NVD independently describes the issue as Windows-specific and records
  the same upstream commit as the patch [3].
- Hence ignoring the CVE for now.

Reference:
[1] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m
[2] https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34515

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:01 +05:30
Devansh Patel c0f1ddc31d python3-cbor2: use exact CVE_PRODUCT mapping 
The inherited "python:cbor2" mapping does not identify the packaged
source. Use "agronholm:cbor2", its NVD dictionary CPE and NVD
configuration identity, restoring the source-aligned records.

Backport note: master replaces a product-only mapping in version 6.1.4;
Scarthgap 5.6.4 has no recipe-local override, so this is an addition.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 7f59d247ee)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:01 +05:30
Devansh Patel b7e7f9cc80 python3-httplib2: correct CVE_PRODUCT mapping 
The inherited "python:httplib2" mapping does not identify the packaged
project. Use "httplib2_project:httplib2" for its exact NVD dictionary
CPE and NVD configuration identity.

Backport note: master replaces a product-only mapping in version 0.32.0;
Scarthgap 0.22.0 has no recipe-local override, so this is an addition.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0a8f71a643)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:00 +05:30
Darsh Kelaiya 8ee24af3c6 python3-django: fix CVE-2026-15830 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15830

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:00 +05:30
Darsh Kelaiya e1fadab9dd python3-django: fix CVE-2026-15337 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/django/django/commit/c72a5dbb64d0777f3f471f1be94e8b2ca91e0959
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15337

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:17:59 +05:30
Darsh Kelaiya 3bc6095e25 python3-django: fix CVE-2026-15307 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15307

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:17:59 +05:30
Hitendra Prajapati 8a6e67f063 opensc: fix for CVE-2026-40528 
Pick patch from [1] also mentioned at NVD report in [2]

[1] https://github.com/OpenSC/OpenSC/commit/0358817ec74aeca654f83e7709c7720b14c5db59
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-40528

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:17:58 +05:30
Devansh Patel b8bd073f05 python3-cbor2: Fix CVE-2026-26209 
Scarthgap already contains 4810cd8c5b [3], which backports
fb4ee161 and e61a5f36 for read-ahead/read-size handling. The
associated submission [4] labels that work as CVE-2026-26209, but
it does not add the max_depth protection required for uncontrolled
recursion [2].

Complete the existing backport with the 5.9.0 max-depth chain:
- bcb6cea4: add the C decoder depth limit [1]
- 94e0d212: add the security-essential pure-Python depth limit
- 53521e7c: apply the required type correction
- a7ac10d5: raise the default depth limit to 400
- d903d62c: synchronize the C function signature default

The 5.9.0 upgrade description [5] also identifies max_depth as the
CVE fix. Full upstream commit links are recorded in the embedded
patch headers.

[1] https://github.com/agronholm/cbor2/commit/bcb6cea4edde1d00ff4f0eece883dea951f66e1b
[2] https://github.com/advisories/GHSA-3c37-wwvx-h642
[3] https://git.openembedded.org/meta-openembedded/commit/?id=4810cd8c5bbc0b4349a78eac85a6a882bc0b03a2
[4] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105607.html
[5] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105418.html

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:25 +05:30
Gyorgy Sarvari 216e1b3a2e smarty: extend CVE_PRODUCT 
Some CVEs assign smarty-php as the vendor to the corresponding CPE.
E.g CVE-2024-35226[1] is tracked with smarty-php:smarty by mitre
(NVD tracks it without CPE).

[1]: https://cveawg.mitre.org/api/cve/CVE-2024-35226

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 1aee6a403c)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:24 +05:30
Benjamin Bouvier 7b773a2854 rsyslog: add CVE_PRODUCT 
Add exact CPE name in CVE_PRODUCT.

Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 42761ba945)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:24 +05:30
Hetvi Thakar 016908224f python3-web3: Fix CVE-2026-40072 
This patch applies the v7 upstream fix for CVE-2026-40072 shown in [1].
The security advisory [2] references the patch-equivalent v8/main fix [3].
The v7 commit was selected because it is the nearest source baseline to
Scarthgap's web3.py 6.17.0 recipe.

[1] https://github.com/ApeWorX/web3.py/commit/d62e67d3b636bd4c5a929696c0f5c4167c31625b
[2] https://github.com/ApeWorX/web3.py/security/advisories/GHSA-5hr4-253g-cpx2
[3] https://github.com/ApeWorX/web3.py/commit/b1c57bb0a124359c9902daaefab4d8af7c3c4c1e

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:23 +05:30
Darsh Kelaiya 7449480403 python3-httplib2: fix CVE-2026-59939 
This patch applies the upstream fix for CVE-2026-59939 as referenced
in [2], using the upstream commit identified in [1].

[1] https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427
[2] https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:23 +05:30
Hetvi Thakar 6752204aad python3-simpleeval: Fix CVE-2026-32640 
Manually backport the three upstream security fixes for
CVE-2026-32640 to the Scarthgap simpleeval 0.9.13 recipe [1][2][3].

Include the required unhashable-container correction [4], which
prevents the recursive security checks from raising TypeError on
legitimate list and tuple values.

Harden the recursive callback-argument validation to inspect sets,
frozensets, and dictionary keys, and safely handle cyclic containers.
Add regression coverage for each of these cases.

Do not include the separate generator/coroutine hardening or the
optional performance follow-up. Omit the new ModuleWrapper API so this
stable-branch fix adds no unrelated public feature.

[1] https://github.com/danthedeckie/simpleeval/commit/9cb4a7b99498
[2] https://github.com/danthedeckie/simpleeval/commit/1654cbf02193
[3] https://github.com/danthedeckie/simpleeval/commit/cffa9f68cee5
[4] https://github.com/danthedeckie/simpleeval/commit/d1e4569db678

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:22 +05:30
Hetvi Thakar 97131550a8 python3-ujson: Fix CVE-2026-54911 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54911

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:22 +05:30
Hetvi Thakar 50f5a96f22 python3-ujson: Fix CVE-2026-44660 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-44660

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:21 +05:30
Hetvi Thakar f6aab7432b python3-ujson: Fix CVE-2026-32874 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/4baeb950df780092bd3c89fc702a868e99a3a1d2
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-32874

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:21 +05:30
Hetvi Thakar 28aefe0fdb python3-ujson: Fix CVE-2026-32875 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-32875

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Darsh Kelaiya b9534a154d python3-filelock: fix CVE-2026-22701 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-22701

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Darsh Kelaiya ac73fd1e99 python3-filelock: fix CVE-2025-68146 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-68146

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Vijay Anusuri 2e49cdb4d2 giflib: Fix CVE-2026-26740 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-26740
[2] https://ubuntu.com/security/CVE-2026-26740

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:07 +05:30
Ankur Tyagi 6bb11ad0c3 jsoncpp: upgrade 1.9.5 -> 1.9.7 
https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.6
https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.7

Also backport patch to fix C++11 ABI breakage when compiled with C++17.

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:06 +05:30