mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-09 06:40:17 +00:00
Code Issues Projects Releases Wiki Activity
31,171 Commits 64 Branches 0 Tags
5891d513a9df0c808d09f0baa8face6381b48c30
Commit Graph
8 Commits
Author SHA1 Message Date
Darsh Kelaiya f6e53ba11b python3-aiohttp: fix CVE-2025-69224 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

The generated aiohttp/_http_parser.c changes are omitted. Add
python3-cython-native and regenerate the C source from the patched
_http_parser.pyx during do_configure.

[1] https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0
[2] https://github.com/aio-libs/aiohttp/commit/5affd64f86d28a16a8f8e6fea2d217c99bf7831f
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-69224

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:02 +05:30
Darsh Kelaiya 7489d88734 python3-aiohttp: ignore CVE-2026-34515 
Analysis:
- The upstream advisory limits the issue to aiohttp applications running
  on Windows and identifies the affected and fixed versions [1].
- The advisory-selected upstream fix rejects absolute static resource
  paths, explicitly including UNC and Windows drive paths [2].
- NVD independently describes the issue as Windows-specific and records
  the same upstream commit as the patch [3].
- Hence ignoring the CVE for now.

Reference:
[1] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m
[2] https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34515

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:01 +05:30
Gyorgy Sarvari ba968dda37 python3-aiohttp: patch CVE-2025-69228 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69228

Backport the patch that is referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-02-12 13:38:12 +05:30
Gyorgy Sarvari cd71a1e57c python3-aiohttp: patch CVE-2025-69226 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69226

Backport the patch that is referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-02-12 13:38:12 +05:30
Gyorgy Sarvari 0f91805c4b python3-aiohttp: patch CVE-2025-69225 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-69225

Backport the patch that is referenced by the NVD report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-02-12 13:38:12 +05:30
Ankur Tyagi 8331a444fd python3-aiohttp: patch CVE-2025-53643 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-53643

Dropped changes to the test and changelog from the original commit.

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-01-26 10:04:48 +05:30
Ankur Tyagi e061e04825 python3-aiohttp: patch CVE-2024-52304 
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-52304

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-01-19 12:14:16 +05:30
Ankur Tyagi 46d5b12103 python3-aiohttp: upgrade 3.9.4 -> 3.9.5 
Bug fixes

- Fixed "Unclosed client session" when initialization of
  :py:class:~aiohttp.ClientSession fails.

- Fixed regression (from :pr:8280) with adding Content-Disposition to the form-data
  part after appending to writer.

- Added default Content-Disposition in multipart/form-data responses to avoid broken
  form-data responses.

https://github.com/aio-libs/aiohttp/releases/tag/v3.9.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-01-19 12:14:15 +05:30