mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-12 15:31:03 +00:00
Code Issues Projects Releases Wiki Activity
40,633 Commits 65 Branches 0 Tags
975c06326df9fb94ce6ecedd3408a45ce55eb736
Commit Graph
40633 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ankur Tyagi 975c06326d zeroconf: ignore CVEs 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-47180
https://nvd.nist.gov/vuln/detail/cve-2026-47183
https://nvd.nist.gov/vuln/detail/cve-2026-47184
https://nvd.nist.gov/vuln/detail/cve-2026-48045
https://nvd.nist.gov/vuln/detail/cve-2026-48487

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-14 09:59:48 +13:00
Ankur Tyagi a9d69bc066 lvgl-demo-fb: fix SRCREV 
Previous SRCREV does not belong to any branch on this repository and build
fails with error:

ERROR: lvgl-demo-fb-9.5.0+git-r0 do_fetch: Fetcher failure: Unable to find revision 045137cf0fa1781483cb796261a11b5eb21e99d9 in branch release/v9.5 even from upstream
ERROR: lvgl-demo-fb-9.5.0+git-r0 do_fetch: Bitbake Fetcher Error: FetchError('Unable to fetch URL from any source.', 'git://github.com/lvgl/lv_port_linux_frame_buffer.git;protocol=https;branch=release/v9.5;name=demo')

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-14 09:26:03 +13:00
Markus Volk db22543b54 apache2: fix build with OpenSSL 4 
ASN1_STRING is opaque in OpenSSL 4, so mod_md fails to compile in
md_ocsp.c. Backport the httpd 2.4.x commit that switches to the getter
functions. The fix is part of httpd 2.4.69, which master gets through the
upgrade.

Upstream-Status: Backport [https://github.com/apache/httpd/commit/6cd9ea8dcb5bf68a195e90578c7f05e12eba5468]

AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
 2026-10-13 21:43:06 +13:00
Ankur Tyagi c7f1f03d1b gpsd: patch CVE-2026-60122 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-60122

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit da527bb6ba)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 68a702ac5d tesseract: patch CVE-2026-88054 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88054

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 4c00053135)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 9ca7f33f69 tesseract: patch CVE-2026-88051 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88051

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 727354dae2)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 21dc40e65a tesseract: patch CVE-2026-88047 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88047

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit b8fa7aac91)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 08a6852a7e tesseract: patch CVE-2026-88050 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88050

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 4aab0847c2)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 8f56f67a2f tesseract: patch CVE-2026-88049 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88049

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 218b6a19b1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 221a1e49f4 tesseract: patch CVE-2026-88048 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88048

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 9e544d6e50)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 3d862201ff tesseract: patch CVE-2026-88052 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88052

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 251dd7f80d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi f12cb02421 strongswan: patch CVE-2026-78134 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78134

[1]https://download.strongswan.org/security/CVE-2026-78134/strongswan-5.9.10-6.0.7_eap_inner_auth_cfg.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78134).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2352f80100)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 991006d982 strongswan: patch CVE-2026-78135 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78135

[1]https://download.strongswan.org/security/CVE-2026-78135/strongswan-5.9.7-6.0.7_early_create_child_sa.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78135).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 9b02fe4850)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 2afc7f40c8 strongswan: patch CVE-2026-78132 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78132

[1]https://download.strongswan.org/security/CVE-2026-78132/strongswan-5.1.3-6.0.7_x509_ac_ietfattr_loop.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78132).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit dd3053a1a3)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 359b6fb067 strongswan: patch CVE-2026-78130 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78130

[1]https://download.strongswan.org/security/CVE-2026-78130/strongswan-5.1.3-6.0.7_x509_ac_issuer_null.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78130).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit d831ff4ac9)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi fd21700848 strongswan: patch CVE-2026-78131 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78131

[1]https://download.strongswan.org/security/CVE-2026-78131/strongswan-5.5.3-6.0.7_x509_ac_leaks.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78131).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 41cb8cca46)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 036fde2bb0 strongswan: patch CVE-2026-78133 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78133

[1]https://download.strongswan.org/security/CVE-2026-78133/strongswan-6.0.0-6.0.7_ikev2_rekey_collision.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78133).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 7a55891633)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 7004be1e63 strongswan: patch CVE-2026-78129 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78129

[1]https://download.strongswan.org/security/CVE-2026-78129/strongswan-5.6.3-6.0.7_pkcs5_params_dos.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78129).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 9ea8363e30)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 22d52d3b42 strongswan: patch CVE-2026-78127 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78127

[1]https://download.strongswan.org/security/CVE-2026-78127/strongswan-5.3.1-6.0.7_message_log_leak.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78127).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 7b8fd4df2e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 9b00eaf6ee strongswan: patch CVE-2026-78126 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78126

[1]https://download.strongswan.org/security/CVE-2026-78126/strongswan-4.4.0-6.0.7_eap_aka_sync_fail.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78126).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit e228e7711e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi a6397902ba strongswan: patch CVE-2026-78124 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78124

[1]https://download.strongswan.org/security/CVE-2026-78124/strongswan-5.0.2-6.0.7_openssl_pkcs7_certs_leak.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78124).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit dd0ba33ed2)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 8ccc60a8be strongswan: patch CVE-2026-78123 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78123

[1]https://download.strongswan.org/security/CVE-2026-78123/strongswan-5.0.2-6.0.7_openssl_pkcs7_info_init.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78123).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit aa064e512a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi a369135b46 sngrep: patch CVE-2026-90558 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-90558

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 36ddee53b1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 8527b6772d ntopng: patch CVE-2026-86090 and CVE-2026-86091 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-86090
https://nvd.nist.gov/vuln/detail/cve-2026-86091

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit ae180302f4)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 151f9c3204 ntopng: patch CVE-2026-84990 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84990

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2d932fa4e3)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 95be90acc0 smarty: mark CVE-2026-82531 patched 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-82531

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 1964bbc475 cjson: patch CVE-2026-87933 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-87933

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2b3f5cbbd8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 183033afe8 python3-eventlet: mark CVE-2023-29483 fixed 
Fix[1] for the CVE is part of the upstream version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-29483

[1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 47b2ce9cc7)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 6df0b8c576 openvpn: patch CVE-2026-84790 
Backport commit identified by Debian[1], also mentioned in the release note
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8

[1]https://security-tracker.debian.org/tracker/CVE-2026-84790

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 7bd75dc53f openvpn: patch CVE-2026-88964 
Backport commit identified by Debian[1], also mentioned in the release note
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8

[1]https://security-tracker.debian.org/tracker/CVE-2026-88964

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 2f0a62d30c openvpn: ignore CVE-2026-84256 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84256

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 41441be1ce swagger-ui: upgrade 5.33.0 -> 5.33.1 
Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.1

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 50c590bebc)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 15b8501f24 python3-zeroconf: upgrade 0.151.3 -> 0.151.5 
Changelog:
https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.4
https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 92fff73409)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi ff9a42b633 python3-werkzeug: upgrade 3.1.8 -> 3.1.9 
Changelog:
https://github.com/pallets/werkzeug/releases/tag/3.1.9

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0d101e1633)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi e56c9807f2 python3-tzdata: upgrade 2026.4 -> 2026.5 
Changelog:
https://github.com/python/tzdata/releases/tag/2026.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 01bd918ea8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 962410d82f python3-django: upgrade 5.2.17 -> 5.2.18 
Changelog:
https://docs.djangoproject.com/en/dev/releases/5.2.18/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0640fa901d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi e987e0bfde python3-django: upgrade 6.0.8 -> 6.0.9 
Changelog:
https://docs.djangoproject.com/en/dev/releases/6.0.9/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c39562d398)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 783752d9f0 python3-astroid: upgrade 4.3.2 -> 4.3.3 
Changelog:
https://github.com/pylint-dev/astroid/releases/tag/v4.3.3

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 486ef820db)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 9c7e3a2ba9 smarty: upgrade 5.8.4 -> 5.8.5 
Changelog:
https://github.com/smarty-php/smarty/releases/tag/v5.8.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 3fe4c22474)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 48393460ad pgpool2: upgrade 4.7.2 -> 4.7.3 
Changelog:
https://www.pgpool.net/docs/latest/en/html/release-4-7-3.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 192d012d9a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 359cbb2b7d python3-gunicorn: mark CVE-2024-1135 patched 
Debian[1] also identified the commit.

Details:
https://nvd.nist.gov/vuln/detail/cve-2024-1135

[1]https://security-tracker.debian.org/tracker/CVE-2024-1135

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi d7ca8eef26 wolfssl: mark CVEs patched 
CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-6937
https://nvd.nist.gov/vuln/detail/cve-2024-5814

[1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities
[2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit c12fcc9b48)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 7c8cd0805f tinyproxy: patch CVE-2026-55202 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55202

[1]https://security-tracker.debian.org/tracker/CVE-2026-55202

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 233e6a56e5)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 1247ca6a89 tinyproxy: patch CVE-2026-54387 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54387

[1]https://security-tracker.debian.org/tracker/CVE-2026-54387

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 33649b0657)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 53ec96a06c tinyproxy: patch CVE-2026-31842 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-31842

[1]https://security-tracker.debian.org/tracker/CVE-2026-31842

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 985acd9e7c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi c829548246 libyang: patch CVE-2026-41401 
Backport patch identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41401

[1]https://security-tracker.debian.org/tracker/CVE-2026-41401

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 6b06704ac1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 25ed071362 miniupnpd: patch CVE-2026-107159 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-107159

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi dc56cbbc02 libssh: ignore CVE-2026-59851 
GSSAPI Key Exchange was introduced in v0.12.0[1].
Debian also confirmed the same[2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59851

[1]https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.12.0
[2]https://security-tracker.debian.org/tracker/CVE-2026-59851

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 26f0474644 libssh: mark CVEs patched 
Changelog[1] also confirms the fix.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59843
https://nvd.nist.gov/vuln/detail/cve-2026-59844
https://nvd.nist.gov/vuln/detail/cve-2026-59845
https://nvd.nist.gov/vuln/detail/cve-2026-59846
https://nvd.nist.gov/vuln/detail/cve-2026-59848
https://nvd.nist.gov/vuln/detail/cve-2026-59850

[1]https://gitlab.com/libssh/libssh-mirror/-/blob/libssh-0.11.5/CHANGELOG?ref_type=tags

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi d1b13ec2ac libssh: ignore CVE-2025-14821 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14821

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 6541aefe60)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00