mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-14 05:49:57 +00:00
Code Issues Projects Releases Wiki Activity
24,247 Commits 64 Branches 0 Tags
12d4f40a4a5881d2e26741fbed672fd841f557f5
Commit Graph

3115 Commits

Author SHA1 Message Date
Gyorgy Sarvari 6d01018250 python3-ldap: patch CVE-2025-61912 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61912

Pick the patch that's mentioned by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-20 18:22:05 +01:00
Gyorgy Sarvari 3a9a13832b python3-ldap: patch CVE-2025-61911 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61911

Pick the patch referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-20 18:22:04 +01:00
Gyorgy Sarvari e660c4f8dc squid: upgrade 4.15 -> 4.17 
These are bugfix releases.

Changelogs:
4.17:
- WCCP: Validate packets better

4.16:
- Regression Fix: --with-valgrind-debug build broken since 4.15
- Bug 5129 pt1: remove Lock use from HttpRequestMethod
- Bug 5128: Translation: Fix '% i' typo in es/ERR_FORWARDING_DENIED
- Bug 4528: ICAP transactions quit on async DNS lookups

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-20 18:22:02 +01:00
Peter Marko c021875bc4 memcached: ignore disputed CVE-2022-26635 
Per [1] this is a problem of applications using memcached inproperly.

This should not be a CVE against php-memcached, but for whatever
software the issue was actually found in. php-memcached and
libmemcached provide a VERIFY_KEY flag if they're too lazy to
filter untrusted user input.

[1] https://github.com/php-memcached-dev/php-memcached/issues/519

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 889ccce684)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-09 14:18:32 +01:00
Gyorgy Sarvari be06039718 wireshark: ignore CVE-2024-24476, CVE-2024-24478 and CVE-2024-24479 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-24476
https://nvd.nist.gov/vuln/detail/CVE-2024-24478
https://nvd.nist.gov/vuln/detail/CVE-2024-24479

Upstream disputes all three vulnerabilities[1]. Looking at the history,
even though they were valid issues for some period of time, none of
them made it to an actual stable release: the vulnerabilities were
caused, caught and fixed in the same development cycle between two
releases.

CVE-2024-24476: vulnerability introduced with[2], fixed with[3]
CVE-2024-24478: vulnerability introduced with[4], fixed with[5]
CVE-2024-24479: vulnerability introduced with[6], fixed with[7]

Ignore all three of these vulnerabilities, as they are not present
in the used recipe version.

[1]: https://www.wireshark.org/docs/relnotes/wireshark-4.2.4.html
[2]: https://github.com/wireshark/wireshark/commit/395e3b6cb595bfc610f3c26e7e9eb1f8729fd952
[3]: https://github.com/wireshark/wireshark/commit/108217f4bb1afb8b25fc705c2722b3e328b1ad78
[4]: https://github.com/wireshark/wireshark/commit/a9a62ff576ae79e0d6afb3214a5d409ec4cdf9d7
[5]: https://github.com/wireshark/wireshark/commit/80a4dc55f4d2fa33c2b36a99406500726d3faaef
[6]: https://github.com/wireshark/wireshark/commit/53ec634ac2bf5f87a594aa72f16ca21c25a146a9
[7]: https://github.com/wireshark/wireshark/commit/c3720cff158c265dec2a0c6104b1d65954ae6bfd

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-09 14:18:22 +01:00
Gyorgy Sarvari bca7f71ca2 wireshark: upgrade 3.4.12 -> 3.4.16 
These are all bugfix releases.

Drop CVE-2022-3190.patch, as it is included in 3.4.16.

Changelogs:
3.4.13: https://www.wireshark.org/docs/relnotes/wireshark-3.4.13.html
3.4.14: https://www.wireshark.org/docs/relnotes/wireshark-3.4.14.html
3.4.15: https://www.wireshark.org/docs/relnotes/wireshark-3.4.15.html
3.4.16: https://www.wireshark.org/docs/relnotes/wireshark-3.4.16.html

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-09 14:17:57 +01:00
Hitendra Prajapati 634719db25 wireshark: fix CVE-2025-11626 
Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/513e5d49724f4a0695c5d2a08ce422c09cb999c8

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-09 08:29:04 +01:00
Gyorgy Sarvari 61ca38f45d openflow: don't overwrite CVE_CHECK_IGNORE 
The recipe contains two CVE_CHECK_IGNORE declarations, and the second
one overwrites the first one - however the first one is also important.

Instead of overwriting it, just append them to each other. Also, move the
operations closer to each other, so it's easier to see what's going on.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Vijay Anusuri 42e868a468 net-snmp: Fix for CVE-2025-68615 
Upstream-Status: Backport from https://github.com/net-snmp/net-snmp/commit/b4e6f826d9ddcc2d72eac432746807e1234266db

Reference: https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari fa7d1a059e tinyproxy: patch CVE-2025-63938 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-63938

Pick the patch that is referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Gyorgy Sarvari 60f0e23124 lldpd: patch CVE-2021-43612 
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-43612

Pick the patch referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Peter Marko 6b7a0197f9 proftpd: set status of CVE-2001-0027 
This ancient CVE [1] is unversioned ("*") in NVD DB.
"mod_sqlpw module in ProFTPD does not reset a cached password..."

Looking at history and changelog, the module was removed [2] around
the time when this CVE was published, likely as reaction to this CVE.
"mod_sqlpw.c, mod_mysql.c and mod_pgsql.c have been REMOVED from the
distribution. They are currently unmaintained and have numerous bugs."

Note: It was later re-introduced as mod_sql when it got fixed under
new maintainer.

[1] https://nvd.nist.gov/vuln/detail/CVE-2001-0027
[2] https://github.com/proftpd/proftpd/blob/v1.3.8b/NEWS#L3362

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 03a1b56bc7)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:03 +01:00
Ankur Tyagi 71adc2f371 civetweb: patch CVE-2025-9648 
Details https://nvd.nist.gov/vuln/detail/CVE-2025-9648

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit eb338ebb60)

Rebased patch on Kirkstone's civetweb.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 6d28476b74 nbdkit: remove unused patch 
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 2ab2b60609 nbdkit: patch CVE-2025-47712 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47712

Pick the patch from the project's repository which explicitly
mentions this vulnerability ID.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 4a97186719 nbdkit: patch CVE-2025-47711 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47711

Pick the patch from the repository which explicitly mentions
this CVE ID.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2026-01-08 22:03:02 +01:00
Gyorgy Sarvari 360720faba mtr: patch CVE-2025-49809 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-49809

Pick the patch mentioned in the NVD report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-25 13:56:58 +01:00
Gyorgy Sarvari 8611f92c20 proftpd: patch CVE-2024-48651 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-48651

Backport the patch mentioned in the NVD report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-17 15:38:00 +01:00
Hitendra Prajapati ea388c67e4 wireshark: fix CVE-2025-13499 
Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/e180152d3dae668249f78c72a55a4ba436b57af7

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-16 08:41:05 +01:00
Kai Kang b1e0fadb72 mbedtls: fix CVE-2025-47917 
CVE-2025-47917 is that the function mbedtls_x509_string_to_names() takes
a head argument and performs a deep free() on it.

Backport patch to fix CVE-2025-47917 and drop the modification in doc
file and comment in header file which lack of context.

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-16 08:39:06 +01:00
Gyorgy Sarvari 4437919060 znc: patch CVE-2024-39844 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-39844

Pick the patch that is mentioned in the oss-security[1] advisory

[1]: https://www.openwall.com/lists/oss-security/2024/07/03/9

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-14 16:18:46 +01:00
Gyorgy Sarvari bc55ba3d8c babeld: fix installation with usrmerge 
In case usrmerge DISTRO_FEATURE is enabled, the recipe installed
the application to /bin folder, which is however a symlink to /usr/bin,
so the installation ultimately failed.

To fix this, set the correct prefix for the installation.

This is a partial backport of f91983f1f3

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-12-02 13:54:02 +01:00
Gyorgy Sarvari b5a19849c5 usbredir: patch CVE-2021-3700 
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-3700

Pick the patch mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-11-30 15:13:57 +01:00
Gyorgy Sarvari eeda504ce9 usrsctp: patch CVE-2019-20503 
Details: https://nvd.nist.gov/vuln/detail/CVE-2019-20503

Pick the patch mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-11-30 15:13:57 +01:00
Gyorgy Sarvari 665e1cad14 spice: correct SRC_URI 
The previous repository was moved to freedesktop's gitlab instance

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-11-17 09:08:37 +01:00
Gyorgy Sarvari b8506b722c nng: Rename default branch of github.com:nanomsg/nng.git 
Default branch is renamed from `master` to `main`. Commitshas are the
same.

Signed-off-by: Jeroen Knoops <jeroen.knoops@philips.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 58679b6a51)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-11-17 09:08:35 +01:00
Gyorgy Sarvari c90f715444 netsniff-ng: update SRC_URI branch 
master branch was renamed to main

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-11-17 09:08:28 +01:00
Gyorgy Sarvari 9b1be4d915 ncftp: correct SRC_URI 
The original xz-compressed tarball isn't available at the download
location anymore - switch to the gz tarball which is still there.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-11-17 09:08:27 +01:00
Gyorgy Sarvari 77b9cc908f usbredir: update SRC_URI 
The previous git repositoy was moved to freedesktop's gitlab instance.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-11-17 09:08:26 +01:00
Gyorgy Sarvari 51b503c1a1 http-parser: fix SRC_URI branch 
master was renamed to main

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8fb37f0f95)
 2025-11-17 09:08:22 +01:00
Yi Zhao edccf97374 mbedtls: upgrade 2.28.9 -> 2.28.10 
ChangeLog
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.10

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ca08c74223)
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-11-05 16:42:50 +01:00
Chen Qi f9577ae033 frr: add CVE_PRODUCT 
The CVE_PRODUCT is frrouting in NVD database.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 10c7793832)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-11-03 16:35:26 +01:00
Gyorgy Sarvari da6b309429 net-snmp: fix ptests 
Add missing dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-29 17:05:14 +01:00
Khem Raj 3f4f321d04 openl2tp: Fix ptests 
- Detect active network interface to use, instead of asking user, this needs
  to run in automation
- Find the location of ppp_null.so with find instead of rpm, rpm is a distro choice
  it can be assumed to be always there.
- Add missing runtime deps for ptests
- Kill openl2tpd started by run-ptest script before exiting, otherwise
  ptest runner hangs forever.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d30427f475)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-29 16:59:58 +01:00
Zhang Peng 50c69deb2c frr: fix CVE-2024-31949 
CVE-2024-31949:
In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability
as a dynamic capability because malformed data results in a pointer not advancing.

Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-31949]
[https://salsa.debian.org/lts-team/packages/frr/-/blob/debian/7.5.1-1.1+deb10u4/debian/patches/CVE-2024-31949.patch?ref_type=tags]

Upstream patches:
[https://github.com/FRRouting/frr/pull/15640/commits/30a332dad86fafd2b0b6c61d23de59ed969a219b]

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-29 16:59:21 +01:00
Gyorgy Sarvari d2da8450c0 freediameter: fix run-ptest reporting 
Add PASS/FAIL printout at the end of the execution.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 21:13:20 +01:00
Gyorgy Sarvari c71d61037e python3-scapy: fix ptests 
1. Enable network access during tests by setting a nameserver
2. Add missing tshark dependency
3. Install missing test files

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 21:13:18 +01:00
Gyorgy Sarvari 0d9619b1bc keepalived: patch CVE-2021-44225 
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-44225

Pick patch mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 18:08:19 +01:00
Vijay Anusuri d342d283b3 unbound: Fix CVE-2022-3204 
Upstream-Status: Backport from https://github.com/NLnetLabs/unbound/commit/137719522a8ea5b380fbb6206d2466f402f5b554

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 11:17:35 +01:00
Vijay Anusuri 0bf05b6de8 unbound: Fix for CVE-2022-30698 and CVE-2022-30699 
Upstream-Status: Backport from https://github.com/NLnetLabs/unbound/commit/f6753a0f1018133df552347a199e0362fc1dac68

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 11:17:35 +01:00
Gyorgy Sarvari 88be6af76b squid: fix esi PACKAGECONFIG 
libxml has derecated the "xmlSetFeature" call, and hid is behind a special
config flag (--with-legacy), which is not used by default in oe-core.

This makes compilation fail, when "esi" PACKAGECONFIG is enabled:

Libxml2Parser.cc:94:5: error: 'xmlSetFeature' was not declared in this scope; did you mean 'xmlHasFeature'?

This backported patch fixes this.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 11:17:33 +01:00
Gyorgy Sarvari efbc247121 squid: patch CVE-2025-59362 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-59362

Pick the PR content that's referenced in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 11:17:30 +01:00
Gyorgy Sarvari bb7620585c squid: patch CVE-2023-46724 
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-46724

Pick the patch from the details of the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 11:17:28 +01:00
Gyorgy Sarvari 4c30475f5d squid: patch CVE-2022-41318 
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-41318

Pick the v4 patch referenced in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 11:17:25 +01:00
Gyorgy Sarvari 3183e67999 squid: patch CVE-2022-41317 
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-41317

Pick the v4 patch referenced in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 11:17:22 +01:00
Gyorgy Sarvari ccfa20cea9 squid: patch CVE-2021-46784 
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-46784

Pick the backported patch from v4 branch, that referenced the same PR[1]
that the patch[2] from the nvd report refers to.

[1]: https://github.com/squid-cache/squid/pull/1022
[2]: https://github.com/squid-cache/squid/commit/5e2ea2b13bd98f53e29964ca26bb0d602a8a12b9

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 11:17:18 +01:00
Gyorgy Sarvari c7a33c2d5a netkit-telnet: patch CVE-2022-39028 
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-39028

Pick the patch mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-27 11:17:13 +01:00
Vijay Anusuri 6c8ae54fc3 proftpd: Fix CVE-2023-48795 
Upstream-Status: Backport from https://github.com/proftpd/proftpd/commit/bcec15efe6c53dac40420731013f1cd2fd54123b

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-20 11:59:36 +02:00
Peter Marko 5bb71a5f0f squid: mark CVE-2025-54574 as patched 
Per [1] CVE-2025-54574 is fixed in patch for CVE-2023-5824.
That was a composite patch from more commits.
When checking it, it really contains also commit [2] which is mentioned
as fix for CVE-2025-54574.

[1] https://security-tracker.debian.org/tracker/CVE-2025-54574
[2] https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-17 10:51:27 +02:00
Rajeshkumar Ramasamy 7eadf76d76 open-vm-tools: fix CVE-2025-41244 
VMware Aria Operations and VMware Tools contain a local privilege
escalation vulnerability. A malicious local actor with non-administrative
privileges having access to a VM with VMware Tools installed and managed
by Aria Operations with SDMP enabled may exploit this vulnerability
to escalate privileges to root on the same VM.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-41244

Upstream-patch:
https://github.com/vmware/open-vm-tools/commit/7ed196cf01f8acd09011815a605b6733894b8aab

Signed-off-by: Rajeshkumar Ramasamy <rajeshkumar.ramasamy@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
 2025-10-17 10:51:26 +02:00