mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-24 11:40:17 +00:00
Code Issues Projects Releases Wiki Activity
31,178 Commits 64 Branches 0 Tags
1108d82e626e56bb4ff7d1e50cd3ffcbf4b620b8
Commit Graph
31178 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Darsh Kelaiya 1108d82e62 python3-aiohttp: fix CVE-2026-34993 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-34993

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:06 +05:30
Darsh Kelaiya b1fdc4d179 python3-aiohttp: fix CVE-2026-34513 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98
[2] https://github.com/aio-libs/aiohttp/commit/8ab84c52fe58ef34794fa9b12f00b06e626adcc0
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34513

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:05 +05:30
Darsh Kelaiya b024b3d0d2 python3-aiohttp: fix CVE-2026-34514 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06
[2] https://github.com/aio-libs/aiohttp/commit/dab9e879be5606682a39b9dd378900eba0afd1a4
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34514

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:05 +05:30
Darsh Kelaiya 334f13cc57 python3-aiohttp: fix CVE-2026-22815 
This patch applies the reviewed upstream fix commits shown in
[1], [2], and [3]. The advisory identifying the fix is referenced in
[4].

The generated aiohttp/_http_parser.c changes are omitted. The
recipe-time Cython regeneration introduced with CVE-2025-69224
regenerates that file from the patched _http_parser.pyx before the
accelerated parser is compiled.

[1] https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36
[2] https://github.com/aio-libs/aiohttp/commit/ed6440ca49ef4907ab9d99ba7e329aab702b7173
[3] https://github.com/aio-libs/aiohttp/commit/30ec25f8a58c5dc3f8fdb3eec31f555eeaabd30a
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-22815

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:04 +05:30
Darsh Kelaiya 12088f5bdd python3-aiohttp: fix CVE-2025-69223 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

The python3-brotli 1.2.0 upgrade commit [4] is omitted because
Scarthgap currently provides python3-brotli 1.1.0. Brotli 1.2.0
adds the bounded decompression API required by the upstream aiohttp
fix. Consequently, this backport disables optional Brotli response
decoding while retaining bounded decompression for the supported
zlib path.

[1] https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
[2] https://github.com/aio-libs/aiohttp/commit/92477c5a74c43dfe0474bd24f8de11875daa2298
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-69223
[4] https://github.com/openembedded/meta-openembedded/commit/382e4de7d8b7d0e980fefcda7a06e5f20f5f26c0

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:04 +05:30
Darsh Kelaiya 10aeacf39f python3-aiohttp: fix CVE-2025-69229 
This patch applies the reviewed upstream fix commits shown in
[1], [2], [3], and [4].
The advisory identifying the fix is referenced in [5].

[1] https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712
[2] https://github.com/aio-libs/aiohttp/commit/271532ea355c65480c8ecc14137dfbb72aec8f6f
[3] https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229
[4] https://github.com/aio-libs/aiohttp/commit/1e4120e87daec963c67f956111e6bca44d7c3dea
[5] https://nvd.nist.gov/vuln/detail/CVE-2025-69229

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:03 +05:30
Darsh Kelaiya 11baed163d python3-aiohttp: fix CVE-2025-69227 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259
[2] https://github.com/aio-libs/aiohttp/commit/d5bf65f15c0c718b6b95e9bc9d0914a92c51e60f
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-69227

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:03 +05:30
Devansh Patel 5891d513a9 python3-web3: add CVE_PRODUCT mapping 
The current inherited "python:web3" mapping does not match the web3.py
identities used by NVD and CVE List V5, so its source-aligned CVE is
missed.

Use "ethereum:web3.py" for the CNA affected-data identity and
"apeworx:web3.py" for the NVD dictionary CPE and NVD configuration
identity.

Backport note: Scarthgap has web3.py 6.17.0 rather than 7.16.0;
CVE-2026-40072 applies to this release and is reported as unpatched.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 19ecb40f50)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:02 +05:30
Darsh Kelaiya f6e53ba11b python3-aiohttp: fix CVE-2025-69224 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

The generated aiohttp/_http_parser.c changes are omitted. Add
python3-cython-native and regenerate the C source from the patched
_http_parser.pyx during do_configure.

[1] https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0
[2] https://github.com/aio-libs/aiohttp/commit/5affd64f86d28a16a8f8e6fea2d217c99bf7831f
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-69224

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:02 +05:30
Darsh Kelaiya 7489d88734 python3-aiohttp: ignore CVE-2026-34515 
Analysis:
- The upstream advisory limits the issue to aiohttp applications running
  on Windows and identifies the affected and fixed versions [1].
- The advisory-selected upstream fix rejects absolute static resource
  paths, explicitly including UNC and Windows drive paths [2].
- NVD independently describes the issue as Windows-specific and records
  the same upstream commit as the patch [3].
- Hence ignoring the CVE for now.

Reference:
[1] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m
[2] https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34515

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:01 +05:30
Devansh Patel c0f1ddc31d python3-cbor2: use exact CVE_PRODUCT mapping 
The inherited "python:cbor2" mapping does not identify the packaged
source. Use "agronholm:cbor2", its NVD dictionary CPE and NVD
configuration identity, restoring the source-aligned records.

Backport note: master replaces a product-only mapping in version 6.1.4;
Scarthgap 5.6.4 has no recipe-local override, so this is an addition.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 7f59d247ee)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:01 +05:30
Devansh Patel b7e7f9cc80 python3-httplib2: correct CVE_PRODUCT mapping 
The inherited "python:httplib2" mapping does not identify the packaged
project. Use "httplib2_project:httplib2" for its exact NVD dictionary
CPE and NVD configuration identity.

Backport note: master replaces a product-only mapping in version 0.32.0;
Scarthgap 0.22.0 has no recipe-local override, so this is an addition.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0a8f71a643)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:00 +05:30
Darsh Kelaiya 8ee24af3c6 python3-django: fix CVE-2026-15830 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15830

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:00 +05:30
Darsh Kelaiya e1fadab9dd python3-django: fix CVE-2026-15337 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/django/django/commit/c72a5dbb64d0777f3f471f1be94e8b2ca91e0959
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15337

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:17:59 +05:30
Darsh Kelaiya 3bc6095e25 python3-django: fix CVE-2026-15307 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15307

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:17:59 +05:30
Hitendra Prajapati 8a6e67f063 opensc: fix for CVE-2026-40528 
Pick patch from [1] also mentioned at NVD report in [2]

[1] https://github.com/OpenSC/OpenSC/commit/0358817ec74aeca654f83e7709c7720b14c5db59
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-40528

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:17:58 +05:30
Devansh Patel b8bd073f05 python3-cbor2: Fix CVE-2026-26209 
Scarthgap already contains 4810cd8c5b [3], which backports
fb4ee161 and e61a5f36 for read-ahead/read-size handling. The
associated submission [4] labels that work as CVE-2026-26209, but
it does not add the max_depth protection required for uncontrolled
recursion [2].

Complete the existing backport with the 5.9.0 max-depth chain:
- bcb6cea4: add the C decoder depth limit [1]
- 94e0d212: add the security-essential pure-Python depth limit
- 53521e7c: apply the required type correction
- a7ac10d5: raise the default depth limit to 400
- d903d62c: synchronize the C function signature default

The 5.9.0 upgrade description [5] also identifies max_depth as the
CVE fix. Full upstream commit links are recorded in the embedded
patch headers.

[1] https://github.com/agronholm/cbor2/commit/bcb6cea4edde1d00ff4f0eece883dea951f66e1b
[2] https://github.com/advisories/GHSA-3c37-wwvx-h642
[3] https://git.openembedded.org/meta-openembedded/commit/?id=4810cd8c5bbc0b4349a78eac85a6a882bc0b03a2
[4] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105607.html
[5] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105418.html

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:25 +05:30
Gyorgy Sarvari 216e1b3a2e smarty: extend CVE_PRODUCT 
Some CVEs assign smarty-php as the vendor to the corresponding CPE.
E.g CVE-2024-35226[1] is tracked with smarty-php:smarty by mitre
(NVD tracks it without CPE).

[1]: https://cveawg.mitre.org/api/cve/CVE-2024-35226

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 1aee6a403c)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:24 +05:30
Benjamin Bouvier 7b773a2854 rsyslog: add CVE_PRODUCT 
Add exact CPE name in CVE_PRODUCT.

Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 42761ba945)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:24 +05:30
Hetvi Thakar 016908224f python3-web3: Fix CVE-2026-40072 
This patch applies the v7 upstream fix for CVE-2026-40072 shown in [1].
The security advisory [2] references the patch-equivalent v8/main fix [3].
The v7 commit was selected because it is the nearest source baseline to
Scarthgap's web3.py 6.17.0 recipe.

[1] https://github.com/ApeWorX/web3.py/commit/d62e67d3b636bd4c5a929696c0f5c4167c31625b
[2] https://github.com/ApeWorX/web3.py/security/advisories/GHSA-5hr4-253g-cpx2
[3] https://github.com/ApeWorX/web3.py/commit/b1c57bb0a124359c9902daaefab4d8af7c3c4c1e

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:23 +05:30
Darsh Kelaiya 7449480403 python3-httplib2: fix CVE-2026-59939 
This patch applies the upstream fix for CVE-2026-59939 as referenced
in [2], using the upstream commit identified in [1].

[1] https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427
[2] https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:23 +05:30
Hetvi Thakar 6752204aad python3-simpleeval: Fix CVE-2026-32640 
Manually backport the three upstream security fixes for
CVE-2026-32640 to the Scarthgap simpleeval 0.9.13 recipe [1][2][3].

Include the required unhashable-container correction [4], which
prevents the recursive security checks from raising TypeError on
legitimate list and tuple values.

Harden the recursive callback-argument validation to inspect sets,
frozensets, and dictionary keys, and safely handle cyclic containers.
Add regression coverage for each of these cases.

Do not include the separate generator/coroutine hardening or the
optional performance follow-up. Omit the new ModuleWrapper API so this
stable-branch fix adds no unrelated public feature.

[1] https://github.com/danthedeckie/simpleeval/commit/9cb4a7b99498
[2] https://github.com/danthedeckie/simpleeval/commit/1654cbf02193
[3] https://github.com/danthedeckie/simpleeval/commit/cffa9f68cee5
[4] https://github.com/danthedeckie/simpleeval/commit/d1e4569db678

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:22 +05:30
Hetvi Thakar 97131550a8 python3-ujson: Fix CVE-2026-54911 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54911

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:22 +05:30
Hetvi Thakar 50f5a96f22 python3-ujson: Fix CVE-2026-44660 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-44660

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:21 +05:30
Hetvi Thakar f6aab7432b python3-ujson: Fix CVE-2026-32874 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/4baeb950df780092bd3c89fc702a868e99a3a1d2
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-32874

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:21 +05:30
Hetvi Thakar 28aefe0fdb python3-ujson: Fix CVE-2026-32875 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-32875

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Darsh Kelaiya b9534a154d python3-filelock: fix CVE-2026-22701 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-22701

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Darsh Kelaiya ac73fd1e99 python3-filelock: fix CVE-2025-68146 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-68146

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Vijay Anusuri 2e49cdb4d2 giflib: Fix CVE-2026-26740 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-26740
[2] https://ubuntu.com/security/CVE-2026-26740

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:07 +05:30
Ankur Tyagi 6bb11ad0c3 jsoncpp: upgrade 1.9.5 -> 1.9.7 
https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.6
https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.7

Also backport patch to fix C++11 ABI breakage when compiled with C++17.

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:06 +05:30
Devansh Patel 6bfefb82b3 hdf5: Fix CVE-2026-26197 
This patch backports the upstream fix first released in HDF5 2.1.0.
The upstream fix commit is referenced in [1], and the public advisory
is referenced in [2].

Although the advisory [2] lists HDF5 2.0.0 as affected, NVD [3]
also marks versions before 2.0.0 as affected, and its CPE
configuration marks versions before 2.1.0 as vulnerable. Scarthgap's
HDF5 1.14.4-3 H5T_ARRAY decoder in src/H5Odtype.c computes the array
element count and decodes the parent datatype without checking for
multiplication overflow or verifying that the stored datatype size
matches the element size multiplied by the element count. The
vulnerable code path is therefore present in 1.14.4-3, so this
backport is applicable.

[1] https://github.com/HDFGroup/hdf5/commit/8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6
[2] https://github.com/HDFGroup/hdf5/security/advisories/GHSA-gh44-7wpq-622f
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-26197

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:06 +05:30
Devansh Patel 436a33ff4c hdf5: Fix CVE-2026-26199 
This patch backports the upstream fix first released in HDF5 2.1.0.
The upstream fix commit is referenced in [1], and the public advisory
is referenced in [2].

[1] https://github.com/HDFGroup/hdf5/commit/9268b803b742f99c1f8793cae74f19e74976b065
[2] https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:05 +05:30
Hitendra Prajapati 9e103dc4d0 libssh: fix for CVE-2026-59845, CVE-2026-59847 
Pick patch from [1], [2] & [3] also mentioned at Debian report in [4] & [5]

[1] https://git.libssh.org/projects/libssh.git/commit/?id=53b8152623290c69657a6774d96888b876e6061f
[2] https://git.libssh.org/projects/libssh.git/commit/?id=c483a187354dfd96b16d3309a74f6d1cf82c2074
[3] https://git.libssh.org/projects/libssh.git/commit/?id=d4847509b792d564d1935dbfea4ee1496ad3d3d9
[4] https://security-tracker.debian.org/tracker/CVE-2026-59845
[5] https://security-tracker.debian.org/tracker/CVE-2026-59847

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:05 +05:30
Hitendra Prajapati 085604ac0b libssh: set status for CVE-2026-59842 
Analysis:
  - CVE-2026-59842 affects information disclosure via short GSSAPI Curve25519 public key.
  - This vulnerable code is not present in the current libssh 0.10.6.
  - Hence ignoring the CVE for this version.

Reference:
1. https://www.cve.org/CVERecord?id=CVE-2026-59842
2. https://www.libssh.org/security/advisories/CVE-2026-59842.txt
3. https://security-tracker.debian.org/tracker/CVE-2026-59842

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:04 +05:30
Hitendra Prajapati b8bc579daa libssh: set status for CVE-2026-15370 
Analysis:
  - CVE-2026-15370 affects stack buffer overflow in SFTP server longname construction.
  - This vulnerable code is not present in the current libssh 0.10.6.
  - Hence ignoring the CVE for this version.

Reference:
https://www.cve.org/CVERecord?id=CVE-2026-15370
https://www.libssh.org/security/advisories/CVE-2026-15370.txt

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:04 +05:30
Gyorgy Sarvari d348bf9a61 python3-twisted: set CVE_PRODUCT 
The related CVEs are tracked with twisted:twisted CPE, so the
default python:twisted CPE doesn't match any entries.

See CVE db query:
sqlite> select * from products where PRODUCT = 'twisted';
CVE-2014-7143|twisted|twisted|14.0.0|=||
CVE-2016-1000111|twisted|twisted|||16.3.1|<
CVE-2019-12387|twisted|twisted|||19.2.1|<
CVE-2019-12855|twisted|twisted|||19.2.1|<=
CVE-2020-10108|twisted|twisted|||19.10.0|<=
CVE-2020-10109|twisted|twisted|||19.10.0|<=
CVE-2022-21712|twisted|twisted|11.1.0|>=|22.1.0|<
CVE-2022-21716|twisted|twisted|21.7.0|>=|22.2.0|<
CVE-2022-24801|twisted|twisted|||22.4.0|<
CVE-2022-39348|twisted|twisted|0.9.4|>=|22.10.0|<
CVE-2023-46137|twisted|twisted|||22.8.0|<=
CVE-2024-41810|twisted|twisted|||24.3.0|<=

Set the CVE_PRODUCT accordingly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a89ab32230)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:03 +05:30
Gyorgy Sarvari 9069df0fdb python3-httpx: set CVE_PRODUCT 
The relevant CVEs are tracked in the CVE db with encode:httpx CPE
instead of the default python:httpx. Set CVE_PRODUCT accordingly.

See CVE db query:
sqlite> select * from products where product like '%httpx%';
CVE-2021-41945|encode|httpx|||0.23.0|<

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8627277b50)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:03 +05:30
Benjamin Bouvier bc6073f183 net-snmp: add CVE_PRODUCT 
Add exact CPE name in CVE_PRODUCT.

Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5efb5b44e8)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:02 +05:30
Adarsh Jagadish Kamini bec755063a thrift: fix CVE-2026-58389 
Backport patch to fix CVE-2026-58389.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-58389

Upstream fix:
  https://github.com/apache/thrift/commit/0ab16e3a83637711f4e0f788c205f66576fd0a55

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Roland Kovacs 356ce58534 thrift: fix multiple CVEs 
CVE-2026-43868:
  Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.

CVE-2026-43869:
  Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
  This CVE only affects the Java client, which is not built by the recipe. Marked as
  'not-applicable-config'.
  Upstream commit:
    https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66

CVE-2026-43870:
  Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory
  ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers
  ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability
  in Apache Thrift.

Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Tugrul Kukul 6e099da67d jq: fix CVE-2026-44777 
Backport patch to fix CVE-2026-44777.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-44777

Upstream fix:
  https://github.com/jqlang/jq/commit/f58787c41835d9b17795730cb04925fdba25c71c

Tested with ptest:
Before: PASSED: 7, FAILED: 0, SKIPPED: 0
After: PASSED: 7, FAILED: 0, SKIPPED: 0

Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Tugrul Kukul 65604c0d46 jq: fix CVE-2026-39956 
Backport patch to fix CVE-2026-39956.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-39956
  https://www.cve.org/CVERecord?id=CVE-2026-39956
  https://security-tracker.debian.org/tracker/CVE-2026-39956
  https://osv.dev/list?q=CVE-2026-39956

Upstream fix:
  https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03 [nvd]

Tested with ptest:
Before: PASSED: 7, FAILED: 0, SKIPPED: 0
After: PASSED: 7, FAILED: 0, SKIPPED: 0

Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Ankur Tyagi 3a6720afef nginx: upgrade 1.26.0 -> 1.26.3 
Made patches for CVE-2024-7347, CVE-2025-23419 specific for v1.24.0 as
these vulnerabilities are fixed in v1.26.3.

Dropped CVE-2025-2341.patch for nginx-1.26.3

Changelog:
https://nginx.org/en/CHANGES-1.26

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:19 +05:30
Ankur Tyagi 24891ee0b9 nginx: upgrade 1.25.5 -> 1.26.0 
Stable branch 1.26.0 is off 1.25.5 and identical
https://github.com/nginx/nginx/compare/release-1.25.5...release-1.26.0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:18 +05:30
Ankur Tyagi 265199312c redis: upgrade 6.2.21 -> 6.2.23 
https://github.com/redis/redis/releases/tag/6.2.22
https://github.com/redis/redis/releases/tag/6.2.23

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:14 +05:30
Ankur Tyagi 1bc6d30b77 redis: upgrade 7.2.12 -> 7.2.15 
Refreshed patches for this version.

https://github.com/redis/redis/releases/tag/7.2.13
https://github.com/redis/redis/releases/tag/7.2.14
https://github.com/redis/redis/releases/tag/7.2.15

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:13 +05:30
Vijay Anusuri 319421fd5b libssh: Remove duplicate CVE_STATUS entry for CVE-2025-14821 
The CVE_STATUS entry for CVE-2025-14821 was added twice in the recipe.
Remove the duplicate entry to keep the recipe clean

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:13 +05:30
Hetvi Thakar 35f85f87b8 python3-twisted: Fix CVE-2026-42304 
This patch applies the upstream 26.4.0rc2 backport for
CVE-2026-42304. The upstream fix merge is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch header
because the fix expands to multiple commits.

[1] https://github.com/twisted/twisted/commit/2d196123264efb0027eecfe1b430be4a9babdbd8
[2] https://github.com/advisories/GHSA-grgv-6hw6-v9g4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:12 +05:30
Hetvi Thakar 3c9dd88058 python3-pyjwt: Fix CVE-2026-48526 
Reject JSON Web Key documents passed directly as HMAC secrets. This
prevents public asymmetric JWK data from being reused as an HMAC key
when an application permits mixed symmetric and asymmetric algorithms.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-xgmm-8j9v-c9wx

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:12 +05:30
Hetvi Thakar b9877579dc python3-pyjwt: Fix CVE-2026-48525 
Reject a non-empty compact payload segment for b64=false tokens before
Base64URL decoding. The segment is unused for detached JWS verification,
so decoding it allowed unauthenticated CPU and memory consumption.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-w7vc-732c-9m39

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:11 +05:30