c021875bc4
memcached: ignore disputed CVE-2022-26635
...
Per [1] this is a problem of applications using memcached inproperly.
This should not be a CVE against php-memcached, but for whatever
software the issue was actually found in. php-memcached and
libmemcached provide a VERIFY_KEY flag if they're too lazy to
filter untrusted user input.
[1] https://github.com/php-memcached-dev/php-memcached/issues/519
Signed-off-by: Peter Marko <peter.marko@siemens.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 889ccce684skandigraun@gmail.com >
2026-01-09 14:18:32 +01:00
be06039718
wireshark: ignore CVE-2024-24476, CVE-2024-24478 and CVE-2024-24479
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-24476
https://nvd.nist.gov/vuln/detail/CVE-2024-24478
https://nvd.nist.gov/vuln/detail/CVE-2024-24479
Upstream disputes all three vulnerabilities[1]. Looking at the history,
even though they were valid issues for some period of time, none of
them made it to an actual stable release: the vulnerabilities were
caused, caught and fixed in the same development cycle between two
releases.
CVE-2024-24476: vulnerability introduced with[2], fixed with[3]
CVE-2024-24478: vulnerability introduced with[4], fixed with[5]
CVE-2024-24479: vulnerability introduced with[6], fixed with[7]
Ignore all three of these vulnerabilities, as they are not present
in the used recipe version.
[1]: https://www.wireshark.org/docs/relnotes/wireshark-4.2.4.html
[2]: https://github.com/wireshark/wireshark/commit/395e3b6cb595bfc610f3c26e7e9eb1f8729fd952
[3]: https://github.com/wireshark/wireshark/commit/108217f4bb1afb8b25fc705c2722b3e328b1ad78
[4]: https://github.com/wireshark/wireshark/commit/a9a62ff576ae79e0d6afb3214a5d409ec4cdf9d7
[5]: https://github.com/wireshark/wireshark/commit/80a4dc55f4d2fa33c2b36a99406500726d3faaef
[6]: https://github.com/wireshark/wireshark/commit/53ec634ac2bf5f87a594aa72f16ca21c25a146a9
[7]: https://github.com/wireshark/wireshark/commit/c3720cff158c265dec2a0c6104b1d65954ae6bfd
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-09 14:18:22 +01:00
bca7f71ca2
wireshark: upgrade 3.4.12 -> 3.4.16
...
These are all bugfix releases.
Drop CVE-2022-3190.patch, as it is included in 3.4.16.
Changelogs:
3.4.13: https://www.wireshark.org/docs/relnotes/wireshark-3.4.13.html
3.4.14: https://www.wireshark.org/docs/relnotes/wireshark-3.4.14.html
3.4.15: https://www.wireshark.org/docs/relnotes/wireshark-3.4.15.html
3.4.16: https://www.wireshark.org/docs/relnotes/wireshark-3.4.16.html
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-09 14:17:57 +01:00
634719db25
wireshark: fix CVE-2025-11626
...
Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/513e5d49724f4a0695c5d2a08ce422c09cb999c8
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-09 08:29:04 +01:00
61ca38f45d
openflow: don't overwrite CVE_CHECK_IGNORE
...
The recipe contains two CVE_CHECK_IGNORE declarations, and the second
one overwrites the first one - however the first one is also important.
Instead of overwriting it, just append them to each other. Also, move the
operations closer to each other, so it's easier to see what's going on.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-08 22:03:03 +01:00
42e868a468
net-snmp: Fix for CVE-2025-68615
...
Upstream-Status: Backport from https://github.com/net-snmp/net-snmp/commit/b4e6f826d9ddcc2d72eac432746807e1234266db
Reference: https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-08 22:03:03 +01:00
fa7d1a059e
tinyproxy: patch CVE-2025-63938
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-63938
Pick the patch that is referenced by the NVD advisory.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-08 22:03:03 +01:00
60f0e23124
lldpd: patch CVE-2021-43612
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-43612
Pick the patch referenced by the NVD advisory.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-08 22:03:03 +01:00
6b7a0197f9
proftpd: set status of CVE-2001-0027
...
This ancient CVE [1] is unversioned ("*") in NVD DB.
"mod_sqlpw module in ProFTPD does not reset a cached password..."
Looking at history and changelog, the module was removed [2] around
the time when this CVE was published, likely as reaction to this CVE.
"mod_sqlpw.c, mod_mysql.c and mod_pgsql.c have been REMOVED from the
distribution. They are currently unmaintained and have numerous bugs."
Note: It was later re-introduced as mod_sql when it got fixed under
new maintainer.
[1] https://nvd.nist.gov/vuln/detail/CVE-2001-0027
[2] https://github.com/proftpd/proftpd/blob/v1.3.8b/NEWS#L3362
Signed-off-by: Peter Marko <peter.marko@siemens.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 03a1b56bc7skandigraun@gmail.com >
2026-01-08 22:03:03 +01:00
71adc2f371
civetweb: patch CVE-2025-9648
...
Details https://nvd.nist.gov/vuln/detail/CVE-2025-9648
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
(cherry picked from commit eb338ebb60skandigraun@gmail.com >
2026-01-08 22:03:02 +01:00
6d28476b74
nbdkit: remove unused patch
...
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-08 22:03:02 +01:00
2ab2b60609
nbdkit: patch CVE-2025-47712
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47712
Pick the patch from the project's repository which explicitly
mentions this vulnerability ID.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-08 22:03:02 +01:00
4a97186719
nbdkit: patch CVE-2025-47711
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47711
Pick the patch from the repository which explicitly mentions
this CVE ID.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-08 22:03:02 +01:00
360720faba
mtr: patch CVE-2025-49809
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-49809
Pick the patch mentioned in the NVD report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-12-25 13:56:58 +01:00
8611f92c20
proftpd: patch CVE-2024-48651
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-48651
Backport the patch mentioned in the NVD report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-12-17 15:38:00 +01:00
ea388c67e4
wireshark: fix CVE-2025-13499
...
Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/e180152d3dae668249f78c72a55a4ba436b57af7
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-12-16 08:41:05 +01:00
b1e0fadb72
mbedtls: fix CVE-2025-47917
...
CVE-2025-47917 is that the function mbedtls_x509_string_to_names() takes
a head argument and performs a deep free() on it.
Backport patch to fix CVE-2025-47917 and drop the modification in doc
file and comment in header file which lack of context.
Signed-off-by: Kai Kang <kai.kang@windriver.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-12-16 08:39:06 +01:00
4437919060
znc: patch CVE-2024-39844
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-39844
Pick the patch that is mentioned in the oss-security[1] advisory
[1]: https://www.openwall.com/lists/oss-security/2024/07/03/9
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-12-14 16:18:46 +01:00
bc55ba3d8c
babeld: fix installation with usrmerge
...
In case usrmerge DISTRO_FEATURE is enabled, the recipe installed
the application to /bin folder, which is however a symlink to /usr/bin,
so the installation ultimately failed.
To fix this, set the correct prefix for the installation.
This is a partial backport of f91983f1f3skandigraun@gmail.com >
2025-12-02 13:54:02 +01:00
b5a19849c5
usbredir: patch CVE-2021-3700
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-3700
Pick the patch mentioned in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-11-30 15:13:57 +01:00
eeda504ce9
usrsctp: patch CVE-2019-20503
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2019-20503
Pick the patch mentioned in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-11-30 15:13:57 +01:00
665e1cad14
spice: correct SRC_URI
...
The previous repository was moved to freedesktop's gitlab instance
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-11-17 09:08:37 +01:00
b8506b722c
nng: Rename default branch of github.com:nanomsg/nng.git
...
Default branch is renamed from `master` to `main`. Commitshas are the
same.
Signed-off-by: Jeroen Knoops <jeroen.knoops@philips.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 58679b6a51skandigraun@gmail.com >
2025-11-17 09:08:35 +01:00
c90f715444
netsniff-ng: update SRC_URI branch
...
master branch was renamed to main
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-11-17 09:08:28 +01:00
9b1be4d915
ncftp: correct SRC_URI
...
The original xz-compressed tarball isn't available at the download
location anymore - switch to the gz tarball which is still there.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-11-17 09:08:27 +01:00
77b9cc908f
usbredir: update SRC_URI
...
The previous git repositoy was moved to freedesktop's gitlab instance.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-11-17 09:08:26 +01:00
51b503c1a1
http-parser: fix SRC_URI branch
...
master was renamed to main
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 8fb37f0f95
2025-11-17 09:08:22 +01:00
edccf97374
mbedtls: upgrade 2.28.9 -> 2.28.10
...
ChangeLog
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.10
Signed-off-by: Yi Zhao <yi.zhao@windriver.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit ca08c74223haixiao.yan.cn@windriver.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-11-05 16:42:50 +01:00
f9577ae033
frr: add CVE_PRODUCT
...
The CVE_PRODUCT is frrouting in NVD database.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 10c7793832skandigraun@gmail.com >
2025-11-03 16:35:26 +01:00
da6b309429
net-snmp: fix ptests
...
Add missing dependencies.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-29 17:05:14 +01:00
3f4f321d04
openl2tp: Fix ptests
...
- Detect active network interface to use, instead of asking user, this needs
to run in automation
- Find the location of ppp_null.so with find instead of rpm, rpm is a distro choice
it can be assumed to be always there.
- Add missing runtime deps for ptests
- Kill openl2tpd started by run-ptest script before exiting, otherwise
ptest runner hangs forever.
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit d30427f475skandigraun@gmail.com >
2025-10-29 16:59:58 +01:00
50c69deb2c
frr: fix CVE-2024-31949
...
CVE-2024-31949:
In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability
as a dynamic capability because malformed data results in a pointer not advancing.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-31949 ]
[https://salsa.debian.org/lts-team/packages/frr/-/blob/debian/7.5.1-1.1+deb10u4/debian/patches/CVE-2024-31949.patch?ref_type=tags ]
Upstream patches:
[https://github.com/FRRouting/frr/pull/15640/commits/30a332dad86fafd2b0b6c61d23de59ed969a219b ]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-29 16:59:21 +01:00
d2da8450c0
freediameter: fix run-ptest reporting
...
Add PASS/FAIL printout at the end of the execution.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 21:13:20 +01:00
c71d61037e
python3-scapy: fix ptests
...
1. Enable network access during tests by setting a nameserver
2. Add missing tshark dependency
3. Install missing test files
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 21:13:18 +01:00
0d9619b1bc
keepalived: patch CVE-2021-44225
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-44225
Pick patch mentioned in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 18:08:19 +01:00
d342d283b3
unbound: Fix CVE-2022-3204
...
Upstream-Status: Backport from https://github.com/NLnetLabs/unbound/commit/137719522a8ea5b380fbb6206d2466f402f5b554
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 11:17:35 +01:00
0bf05b6de8
unbound: Fix for CVE-2022-30698 and CVE-2022-30699
...
Upstream-Status: Backport from https://github.com/NLnetLabs/unbound/commit/f6753a0f1018133df552347a199e0362fc1dac68
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 11:17:35 +01:00
88be6af76b
squid: fix esi PACKAGECONFIG
...
libxml has derecated the "xmlSetFeature" call, and hid is behind a special
config flag (--with-legacy), which is not used by default in oe-core.
This makes compilation fail, when "esi" PACKAGECONFIG is enabled:
Libxml2Parser.cc:94:5: error: 'xmlSetFeature' was not declared in this scope; did you mean 'xmlHasFeature'?
This backported patch fixes this.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 11:17:33 +01:00
efbc247121
squid: patch CVE-2025-59362
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-59362
Pick the PR content that's referenced in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 11:17:30 +01:00
bb7620585c
squid: patch CVE-2023-46724
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-46724
Pick the patch from the details of the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 11:17:28 +01:00
4c30475f5d
squid: patch CVE-2022-41318
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-41318
Pick the v4 patch referenced in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 11:17:25 +01:00
3183e67999
squid: patch CVE-2022-41317
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-41317
Pick the v4 patch referenced in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 11:17:22 +01:00
ccfa20cea9
squid: patch CVE-2021-46784
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-46784
Pick the backported patch from v4 branch, that referenced the same PR[1]
that the patch[2] from the nvd report refers to.
[1]: https://github.com/squid-cache/squid/pull/1022
[2]: https://github.com/squid-cache/squid/commit/5e2ea2b13bd98f53e29964ca26bb0d602a8a12b9
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 11:17:18 +01:00
c7a33c2d5a
netkit-telnet: patch CVE-2022-39028
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-39028
Pick the patch mentioned in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 11:17:13 +01:00
6c8ae54fc3
proftpd: Fix CVE-2023-48795
...
Upstream-Status: Backport from https://github.com/proftpd/proftpd/commit/bcec15efe6c53dac40420731013f1cd2fd54123b
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-20 11:59:36 +02:00
5bb71a5f0f
squid: mark CVE-2025-54574 as patched
...
Per [1] CVE-2025-54574 is fixed in patch for CVE-2023-5824.
That was a composite patch from more commits.
When checking it, it really contains also commit [2] which is mentioned
as fix for CVE-2025-54574.
[1] https://security-tracker.debian.org/tracker/CVE-2025-54574
[2] https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988
Signed-off-by: Peter Marko <peter.marko@siemens.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-17 10:51:27 +02:00
7eadf76d76
open-vm-tools: fix CVE-2025-41244
...
VMware Aria Operations and VMware Tools contain a local privilege
escalation vulnerability. A malicious local actor with non-administrative
privileges having access to a VM with VMware Tools installed and managed
by Aria Operations with SDMP enabled may exploit this vulnerability
to escalate privileges to root on the same VM.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-41244
Upstream-patch:
https://github.com/vmware/open-vm-tools/commit/7ed196cf01f8acd09011815a605b6733894b8aab
Signed-off-by: Rajeshkumar Ramasamy <rajeshkumar.ramasamy@windriver.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-17 10:51:26 +02:00
b6c9eb2ce5
tcpreplay: fix CVE-2025-51006
...
Within tcpreplay's tcprewrite, a double free vulnerability has been identified
in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linuxsll2.c.
This vulnerability is triggered when tcpedit_dlt_cleanup() indirectly
invokes the cleanup routine multiple times on the same memory region.
By supplying a specifically crafted pcap file to the tcprewrite binary,
a local attacker can exploit this flaw to cause a Denial of Service (DoS) via memory corruption.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-17 10:51:26 +02:00
0538af085a
tcpreplay: fix CVE-2025-9157
...
A vulnerability was determined in appneta tcpreplay up to 4.5.2-beta2.
The impacted element is the function untrunc_packet of the file
src/tcpedit/edit_packet.c of the component tcprewrite. Executing
manipulation can lead to use after free. It is possible to launch
the attack on the local host. The exploit has been publicly disclosed
and may be utilized. This patch is called 73008f261f1cdf7a1087dc8759115242696d35da.
Applying a patch is advised to resolve this issue.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-17 10:51:26 +02:00
bf9fc50ccc
dovecot: patch CVE-2021-33515
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-33515
Backport the relevant patch.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-12 13:08:38 +02:00
Peter Marko
Gyorgy Sarvari
Hitendra Prajapati
Vijay Anusuri
Ankur Tyagi
Kai Kang
Yi Zhao
Chen Qi
Khem Raj
Zhang Peng
Rajeshkumar Ramasamy
Archana Polampalli