mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 15:47:23 +00:00
Code Issues Projects Releases Wiki Activity
38,690 Commits 65 Branches 0 Tags
38bfc75eab4a4cf82baeb5be71c7c96af5f7fe06
Commit Graph
38690 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Peter Marko 38bfc75eab nss: remove compromised eMudhra certificates 
See https://emudhra.we-have-a-problem.com/

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:05 +05:30
Markus Volk 4fac09a43d fwupd: create the fwupd-refresh user 
fwupd-refresh.service runs as fwupd-refresh, which is only declared in
sysusers.d, so do_rootfs warns "User fwupd-refresh has never been
defined". Create it with useradd.

AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c2c8827787)
Signed-off-by: Jose Quaresma <jose.quaresma@oss.qualcomm.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:05 +05:30
Darsh Kelaiya e3603ef765 ntfs-3g-ntfsprogs: fix CVE-2026-40706 
This patch applies the upstream allocation fix shown in [1]. The NVD
record describing the vulnerability is referenced in [3].

The fix in [1] allocates space for the worst-case number of POSIX ACL
entries in ntfs_build_permissions_posix(). The follow-up in [2] is
included to handle allocation failure: check the malloc result, set
errno to ENOMEM, and return NULL before using the descriptor.

[1] https://github.com/tuxera/ntfs-3g/commit/e48e1ef2a1fcff13a590c2224ec21c5bd5d3e92e
[2] https://github.com/tuxera/ntfs-3g/commit/c5413e242309f88ce5a83c0c2538184b19eea1bc
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-40706

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:04 +05:30
Darsh Kelaiya 1e562aaa59 ntfs-3g-ntfsprogs: fix CVE-2026-42616 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [3].

The follow-up in [2] is included to close the opened attribute when
malloc fails and use a common cleanup path for the attribute and
buffer.

[1] https://github.com/tuxera/ntfs-3g/commit/dc1b682e99b6c055b0281ca543a8420b698420d1
[2] https://github.com/tuxera/ntfs-3g/commit/8cd4718cad4941ef49ea5b3af8cd9ec68a46af7a
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-42616

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:04 +05:30
Darsh Kelaiya a0a6069ddc ntfs-3g-ntfsprogs: fix CVE-2026-42618 
This patch applies the upstream fixes shown in [1] and [2]. The NVD
record describing the vulnerability is referenced in [3].

[1] https://github.com/tuxera/ntfs-3g/commit/e021cbe3d7a42963110e4561f2a1327614c20a00
[2] https://github.com/tuxera/ntfs-3g/commit/6aa66d98980ac1d966d7977c7b079f4fe380eb42
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-42618

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:03 +05:30
Darsh Kelaiya 40eac38e56 ntfs-3g-ntfsprogs: fix CVE-2026-46569 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/961ed5c2fa2f36ef6a347f04e1fa586113c97e7c
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46569

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:03 +05:30
Darsh Kelaiya cc1cc98d51 ntfs-3g-ntfsprogs: fix CVE-2026-46570 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/5ab37421ebbcbf33bf96876c7a034393bda05a25
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46570

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:02 +05:30
Darsh Kelaiya bd5043efd3 ntfs-3g-ntfsprogs: fix CVE-2026-46571 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/b912272b30c552b0457e40a0a68b1fac2587aaea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46571

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:02 +05:30
Darsh Kelaiya 1e0b8b62e2 ntfs-3g-ntfsprogs: fix CVE-2026-46572 and CVE-2026-42617 
This patch applies the upstream fixes shown in [1], [2], and [3].
The NVD records describing the vulnerabilities are referenced in
[4] and [5].

[1] https://github.com/tuxera/ntfs-3g/commit/2ead8a3ccf940c0219ffba587fab54e21462b3a5
[2] https://github.com/tuxera/ntfs-3g/commit/dfd1a7c6eb23a22238ec193451fa59c989b4381f
[3] https://github.com/tuxera/ntfs-3g/commit/edf2b892356684ca8f2fc5898943c7a9b90ffb80
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-46572
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-42617

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:01 +05:30
Darsh Kelaiya 4202adbfe6 net-snmp: fix CVE-2026-89147 
This patch applies the upstream fix [1] for CVE-2026-89147
as shown in the advisory identifying the fix [2].

[1] https://github.com/net-snmp/net-snmp/commit/ad843e83da1c229847ae7884dc08311fad680389
[2] https://ubuntu.com/security/CVE-2026-89147

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:01 +05:30
Darsh Kelaiya aa6d99fed0 python3-aiohttp: fix CVE-2026-69244 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1]. The recipe regenerates the C HTTP parser
from the corrected Cython source during configuration.

[1] https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
[2] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:00 +05:30
Darsh Kelaiya 25f14104c2 python3-aiohttp: fix CVE-2026-69243 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1]. It adapts the Python and C HTTP parser
paths to read a rejected WebSocket upgrade request body before
switching protocols.

[1] https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98
[2] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:00 +05:30
Darsh Kelaiya 70575863c3 python3-aiohttp: fix CVE-2026-59881 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1]. The 3.13.5 backport passes the negotiated
compression setting to the client WebSocket reader.

[1] https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6
[2] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:00 +05:30
Darsh Kelaiya d193d78617 python3-aiohttp: fix CVE-2026-54273 
This patch applies the upstream 3.14.1 backport for
CVE-2026-54273. The upstream fix commit is referenced in [1], its
required follow-up commit is referenced in [2], and the public
advisory is referenced in [3].

The generated aiohttp/_http_parser.c changes are omitted. The
recipe-time Cython regeneration introduced in this patch
regenerates that file from the patched _http_parser.pyx before the
accelerated parser is compiled.

[1] https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf
[2] https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7
[3] https://github.com/advisories/GHSA-4fvr-rgm6-gqmc

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:18:54 +05:30
Yogita Urade ce6bcd3337 python3-pillow: CVE_STATUS for CVE-2026-55798 
Analysis:
- The vulnerable code is WindowsViewer.get_command() constructing an
  unescaped cmd.exe command from a file path. [1]
- Linux uses UnixViewer, which quotes the path, so this Windows command
  path is not used by the target recipe. [1]
- Hence marking this CVE not applicable for the Linux target.

[1] https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:52 +05:30
Yogita Urade 9129c27a01 python3-pillow: Fix CVE-2026-59205 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:51 +05:30
Yogita Urade 1cec74bf36 python3-pillow: Fix CVE-2026-59203 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:51 +05:30
Yogita Urade 8963cc4576 python3-pillow: Fix CVE-2026-59200 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:50 +05:30
Yogita Urade 1d22c2e3b3 python3-pillow: Fix CVE-2026-59199 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:49 +05:30
Yogita Urade dbf1a37262 python3-pillow: Fix CVE-2026-59198 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:49 +05:30
Yogita Urade 293c0ee6ef python3-pillow: Fix CVE-2026-59197 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:48 +05:30
Yogita Urade 6c5fed0692 python3-pillow: Fix CVE-2026-55380 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:48 +05:30
Yogita Urade c782505854 python3-pillow: Fix CVE-2026-54059 CVE-2026-54060 CVE-2026-55379 
This patch applies the upstream fix as referenced in [2], [3]
and [4], using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
[2] https://nvd.nist.gov/vuln/detail/cve-2026-54059
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-54060
[4] https://nvd.nist.gov/vuln/detail/cve-2026-55379

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:47 +05:30
Yogita Urade 11d0cfd949 redis: fix CVE-2026-66373 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/4f62a8bf15c634187d8a87d874f8988032f90b6c
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-66373

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:47 +05:30
Yogita Urade bb81197434 redis: fix CVE-2026-25243 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/b9dde6fc25dec6191b18374335a076a7b31e3d02
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-25243

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:46 +05:30
Yogita Urade 77ca1bfa10 redis: fix CVE-2026-23631 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/0cca172a174642bdae03b871615227896274d9bb
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-23631

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:46 +05:30
Yogita Urade 0d975df7da redis: fix CVE-2026-23479 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-23479

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:45 +05:30
Hetvi Thakar 66ad06b673 nginx: Ignore CVE-2026-60005 
Analysis:
- CVE-2026-60005 affects the optional ngx_http_slice_module [1].
- The slice module is not built by default and requires the explicit
  --with-http_slice_module configure option, which neither Wrynose nginx
  recipe enables by default [1][2].
- Mark the CVE not applicable only when that option is absent; report it
  as unpatched when a bbappend enables the module.

Reference:
[1] https://github.com/advisories/GHSA-vxcv-h5wj-jxr5
[2] https://nginx.org/en/docs/configure.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:45 +05:30
Hetvi Thakar 9b332333cd nginx: Ignore CVE-2026-40460 
Analysis:
- CVE-2026-40460 affects nginx only when the HTTP/3
  QUIC module is enabled [1].
- The module requires the explicit --with-http_v3_module configure
  option, which neither Wrynose nginx recipe enables by default [2].
- Mark the CVE not applicable only when that option is absent; report it
  as unpatched when a bbappend enables the module.

Reference:
[1] https://nginx.org/en/security_advisories.html
[2] https://nginx.org/en/docs/configure.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:44 +05:30
Hetvi Thakar 29166e9b7a nginx: fix CVE-2026-56434 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/ddde692db11ab8238e9ca661007f64c9f6d764d2
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:43 +05:30
Hetvi Thakar a34e2f8489 nginx: fix CVE-2026-42533 
These patches apply the upstream fix sequence as referenced in [6],
using the commits shown in [1] through [5].

Use version-specific fourth patches: nginx 1.28.3 lacks
ngx_http_proxy_v2_module, while the nginx 1.29.7 backport retains the
applicable proxy-v2 bounds checks with its older request-body layout.

[1] https://github.com/nginx/nginx/commit/ea47fabf55e2bc9192ddc27f52486b4e58d5e007
[2] https://github.com/nginx/nginx/commit/7ac67898bdfed2140a1bedcda252074cca11f494
[3] https://github.com/nginx/nginx/commit/78950bdcd443830bde00f6844dba3033c18862b1
[4] https://github.com/nginx/nginx/commit/326b17b0038321c29252e79bf4c53d4773fcb8b5
[5] https://github.com/nginx/nginx/commit/97e40e59b7b4ad6aa36f54ce4f1e64d1e98f24cb
[6] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:43 +05:30
Hetvi Thakar a4a3880b71 nginx: fix CVE-2026-48142 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/60c4243eb8775d51662a01def8a7dad5d9fb34a7
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:42 +05:30
Hetvi Thakar cd674e9d15 nginx: fix CVE-2026-42055 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

Use version-specific backports: nginx 1.28.3 contains only the affected
gRPC module, while nginx 1.29.7 also contains ngx_http_proxy_v2_module
and therefore carries the complete upstream changes for both modules.

[1] https://github.com/nginx/nginx/commit/131be8514da8985b15b74150521afedbf9cc4ea3
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:41 +05:30
Hetvi Thakar ed51539d6e nginx: fix CVE-2026-9256 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/3f135ae2eb60ce376196c898a6c7cb4d774f7068
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:41 +05:30
Hetvi Thakar 67bd79fa89 nginx: fix CVE-2026-42945 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/524977e7c534e87e5b55739fa74601c9f1102686
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:40 +05:30
Hetvi Thakar c20a117ce1 nginx: fix CVE-2026-42946 
These patches apply the upstream fix sequence as
referenced in [3], using the commits shown in [1] and [2].

[1] https://github.com/nginx/nginx/commit/baef7fdac28e4e1fe26509b50b8d15603393e28e
[2] https://github.com/nginx/nginx/commit/39d7d0ba0799fcff6baee52b6525f45739593cfd
[3] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:40 +05:30
Hetvi Thakar 3c92a9dd3a nginx: fix CVE-2026-42934 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/54b7945961b2eaafc480d6b85d9635d0db1c126a
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:39 +05:30
Hetvi Thakar d023b652ac nginx: Fix CVE-2026-40701 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/nginx/nginx/commit/d2b8d47741820c9fb134c6731ecb40b21f3085b1
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:39 +05:30
Hetvi Thakar 578ad71dfe wireshark: upgrade 4.6.4 -> 4.6.8 
Upgrade Wireshark to the latest 4.6 stable release. This brings
security and bug fixes from releases 4.6.5 through 4.6.8.

Release notes:
[1] https://www.wireshark.org/docs/relnotes/wireshark-4.6.5.html
[2] https://www.wireshark.org/docs/relnotes/wireshark-4.6.6.html
[3] https://www.wireshark.org/docs/relnotes/wireshark-4.6.7.html
[4] https://www.wireshark.org/docs/relnotes/wireshark-4.6.8.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:38 +05:30
Hetvi Thakar 88e41d1f3b python3-pyjwt: fix CVE-2026-101918 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:38 +05:30
Hetvi Thakar f1444be16f python3-pyjwt: fix CVE-2026-102275 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:37 +05:30
Hetvi Thakar 395753da37 python3-pyjwt: fix CVE-2026-101917 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:37 +05:30
Hetvi Thakar 95a0df87a1 python3-pyjwt: fix CVE-2026-102271 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:36 +05:30
Hetvi Thakar 2d80df4fa5 python3-pyjwt: fix CVE-2026-102268 and CVE-2026-102270 
This patch applies the shared upstream fix as referenced in [2] and [3],
using the commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9
[3] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:36 +05:30
Hetvi Thakar 6febd066de python3-pyjwt: fix CVE-2026-102267 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:35 +05:30
Hetvi Thakar fb76c963d9 python3-pyjwt: fix CVE-2026-102269 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/e6f48401001609a8f99e71fcaf355fb895d508a8
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:35 +05:30
Hetvi Thakar e93a40cd9d python3-pyjwt: fix CVE-2026-102274 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:34 +05:30
Hetvi Thakar e9ab64a631 python3-pyjwt: fix CVE-2026-103001 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:34 +05:30
Hetvi Thakar 36cb562576 python3-grpcio-tools: set status for CVE-2026-33186 
The vulnerability only affects the Go implementation of the library,
not the Python one. Ignore this CVE due to this.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-33186
https://github.com/advisories/GHSA-p77j-4mvh-x3m3

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:33 +05:30
Hetvi Thakar 594491969e python3-grpcio-tools: set status for CVE-2024-37168 
CVE-2024-37168 affects @grpc/grpc-js, the pure JavaScript
implementation, not the gRPC core code included in grpcio-tools.
Therefore the grpc:grpc CPE association is incorrect.

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-37168

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:32 +05:30