mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 03:37:15 +00:00
Code Issues Projects Releases Wiki Activity
38,708 Commits 65 Branches 0 Tags
a4b37c2e4d3d64c87826318bbe6174ea86675d5f
Commit Graph
38708 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Peter Marko a4b37c2e4d libwebsockets: patch CVE-2026-114550 
Pick patch mentioned in NVD CVE report.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:39 +05:30
Hetvi Thakar efef6062ef nginx: fix CVE-2026-15176 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/ce1da78900b07e72f37a25f55e6606220ac45902
[2] https://ubuntu.com/security/CVE-2026-15176

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:38 +05:30
Hetvi Thakar 7ad10cb7c3 nginx: fix CVE-2026-97629 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/fdedba031bf1ad6a80c61b1aec1418d1a87ae296
[2] https://ubuntu.com/security/CVE-2026-97629

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:38 +05:30
Hetvi Thakar ba349a44f9 nginx: fix CVE-2026-95101 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/90b30edffea4f427608c36e3849643b6f9841bc4
[2] https://ubuntu.com/security/CVE-2026-95101

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:37 +05:30
Jason Schonberg b2cc77d681 nodejs: 22.23.3 -> 22.23.4 
This is the October 2026 security release.

  4 high severity issues.
  3 medium severity issues.
  3 low severity issue.

High severity issues.
  CVE-2026-105482
  CVE-2026-105483
  CVE-2026-106069
  CVE-2026-111497

Medium severity issues.
  CVE-2026-105481
  CVE-2026-106072
  CVE-2026-106074

Low severity issues.
  CVE-2026-106070 (affects only nodejs v26)
  CVE-2026-106071 (affects only nodejs v26)
  CVE-2026-106073

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Changelog: https://github.com/nodejs/node/releases/tag/v22.23.4

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:37 +05:30
Ankur Tyagi 6397229d31 zchunk: upgrade 1.5.4 -> 1.5.5 
- Fix out-of-bounds read
- Harden multipart download parsing against malicious servers
- Harden chunk decompression and header parsing

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Handle CVE-2026-117556.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:36 +05:30
Wang Mingyu 5ee7fc71d3 zchunk: upgrade 1.5.3 -> 1.5.4 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:36 +05:30
Nate Kent 649d0cf628 nng: correct upstream branch name 
Upstream changed the branch names between the v1.11.0 release and the
v2.0.0 release, which means the old branch is no longer valid and the
fetch will fail.

Signed-off-by: Nate Kent <nate@nkent.net>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:35 +05:30
Khem Raj c734c2cb97 frr: Fix native clippy failing to load libatomic.so.1 
frr's configure links libatomic whenever the toolchain merely has it:

  AC_CHECK_LIB([atomic], [main], [LIBS="$LIBS -latomic"], [], [])

This probe only asks whether -latomic links, never whether frr needs a
symbol from it. On x86-64 the atomics frr uses are inlined, so the
resulting native clippy references no __atomic_* symbol at all, yet
still records a DT_NEEDED on libatomic.so.1.

Nothing prunes it: ASNEEDED is part of TARGET_LDFLAGS only, so native
links get no --as-needed. Nothing can satisfy it either: clippy's
RUNPATH points solely into recipe-sysroot-native, there is no
libatomic-native, and uninative only rewrites the ELF interpreter.

buildtools-extended-tarball ships nativesdk-libatomic, so on hosts using
buildtools (Rocky 8, Alma 8, openSUSE on the autobuilder) the probe
succeeds at link time while the loader cannot find libatomic later, and
the target do_compile dies executing clippy:

  clippy: error while loading shared libraries: libatomic.so.1:
  cannot open shared object file: No such file or directory

Hosts with a system libatomic in the default loader path, such as Ubuntu
with libatomic1 installed, only avoid this by accident.

Link native clippy with --as-needed so the unused libatomic dependency is
dropped, making the frr-native artifact independent of the build host.

Fixes [YOCTO #15590] and [YOCTO #15590]

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 1c1e7a0bc7)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:10 +05:30
Khem Raj b1a1076ed7 pcp: Add readline-native and ncurses-native to pcp-native DEPENDS 
pcp-native compiles the pcp sources src/pmns/lex.l which does
'#include <readline/readline.h>'. The native recipe only depended on
python3/setuptools/flex/bison, so with the header search correctly
limited to the sysroot
0001-configure-Limit-the-header-search-to-sysroot.patch
the build fails on hosts without readline development headers installed:

    lex.l:25:10: fatal error: readline/readline.h: No such file or directory

Depend on readline-native (and ncurses-native, which readline links
against) so the headers and libraries come from the native sysroot
rather than the build host, mirroring the target recipe DEPENDS. This
makes the native build reproducible and host independent.

Verified by building pcp-native from scratch

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 155fd062e2)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:09 +05:30
Leon Anavi 2cdea084dc python3-brotli: Upgrade 1.2.0 -> 1.2.1 
Upgrade to release 1.2.1:

- CVE-2026-111497: out-of-bounds write permits remote code execution

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6a79ef1cfe)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:09 +05:30
Jason Schonberg f9e60cfa13 brotli: upgrade 1.2.0 -> 1.2.1 
This is a security release

CVE-2026-111497: out-of-bounds write permits remote code execution

Changelog: https://github.com/google/brotli/releases/tag/v1.2.1

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit b5d66bf60d)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:08 +05:30
Jason Schonberg 16a64b43a7 php: upgrade 8.5.11 -> 8.5.12 
This is a security update.  Fixes unauthenticated remote code execution.

CVE-2026-109618 CVE-2026-109619

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

Changelog: https://www.php.net/ChangeLog-8.php#8.5.12

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 898ac0ba1c)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:08 +05:30
Jason Schonberg 386cc41749 c-ares: upgrade 1.34.8 -> 1.34.9 
This is a security release.

Memory corruption, buffer overflows, uninitialized memory, use-after-free

Changelog: https://github.com/c-ares/c-ares/releases/tag/v1.34.9

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 556ffbf22a)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:07 +05:30
Primoz Fiser 94fa8a5e9b opencv: rewrite build-tree paths in all CPU-dispatch stub files 
The recipe already rewrote the absolute ${S} path embedded in two
PowerPC VSX3 dispatch stubs (arithm.vsx3.cpp, convert.vsx3.cpp) before
packaging, but OpenCV's cmake ocv_add_dispatched_file() macro generates
one such stub per enabled ISA in every module (avx, avx2, avx512_skx,
sse4_1, sse4_2, neon, ...). On NEON builds this produces further
dispatch stubs under ${B}/modules/dnn/* (layers_common.neon.cpp,
fast_gemm_kernels.neon.cpp, conv_block.neon.cpp) whose #include lines
still embed the raw build-tree path, tripping the buildpaths QA check
once copied verbatim into the opencv-src package.

Generalize the existing sed-based rewrite to find and fix every
generated dispatch stub under ${B}/modules, instead of a hardcoded
two-file list, so any ISA/module combination is covered.

Backport of commit fdfca71954 from the blacksail branch, with the
same fix applied to the still-current 4.13.0 recipe on wrynose.

Signed-off-by: Primoz Fiser <primoz.fiser@norik.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:07 +05:30
Altair Bueno Calvente b5c44ffd58 mdio-tools,mdio-netlink: upgrade 1.3.1 -> 1.3.2 
mdio-tools 1.3.1 fails to link when the lto distro feature is enabled,
because the linker discards the unreferenced command registrations
(wkz/mdio-tools#37). 1.3.2 fixes this by marking them as used and
placing them in a dedicated section kept by a linker script, and also
fixes the VPATH build breakage that change introduced. 1.3.2 also adds
the "mscc" addressing mode for Microchip PHYs.

Backport of master commit 1f465d9d28 ("mdio-tools,mdio-netlink: upgrade
1.3.1 -> 1.3.2,1.3.1 -> 1.3.2").

Fixes: https://github.com/openembedded/meta-openembedded/issues/1075

(cherry picked from commit 1f465d9d28)
AI-Generated: Uses Claude Code
Signed-off-by: Altair Bueno Calvente <abueno@airzonecontrol.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:06 +05:30
Peter Marko 4c10e8346b python3-grpcio: update gRPC repo roots 
See https://emudhra.we-have-a-problem.com/

Use a copy function instead of adding the patch two times becuase there
are two copies of certificates in the sources.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:06 +05:30
Peter Marko 718a3ebe39 grpc: update gRPC repo roots 
See https://emudhra.we-have-a-problem.com/

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:06 +05:30
Peter Marko 38bfc75eab nss: remove compromised eMudhra certificates 
See https://emudhra.we-have-a-problem.com/

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:05 +05:30
Markus Volk 4fac09a43d fwupd: create the fwupd-refresh user 
fwupd-refresh.service runs as fwupd-refresh, which is only declared in
sysusers.d, so do_rootfs warns "User fwupd-refresh has never been
defined". Create it with useradd.

AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c2c8827787)
Signed-off-by: Jose Quaresma <jose.quaresma@oss.qualcomm.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:05 +05:30
Darsh Kelaiya e3603ef765 ntfs-3g-ntfsprogs: fix CVE-2026-40706 
This patch applies the upstream allocation fix shown in [1]. The NVD
record describing the vulnerability is referenced in [3].

The fix in [1] allocates space for the worst-case number of POSIX ACL
entries in ntfs_build_permissions_posix(). The follow-up in [2] is
included to handle allocation failure: check the malloc result, set
errno to ENOMEM, and return NULL before using the descriptor.

[1] https://github.com/tuxera/ntfs-3g/commit/e48e1ef2a1fcff13a590c2224ec21c5bd5d3e92e
[2] https://github.com/tuxera/ntfs-3g/commit/c5413e242309f88ce5a83c0c2538184b19eea1bc
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-40706

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:04 +05:30
Darsh Kelaiya 1e562aaa59 ntfs-3g-ntfsprogs: fix CVE-2026-42616 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [3].

The follow-up in [2] is included to close the opened attribute when
malloc fails and use a common cleanup path for the attribute and
buffer.

[1] https://github.com/tuxera/ntfs-3g/commit/dc1b682e99b6c055b0281ca543a8420b698420d1
[2] https://github.com/tuxera/ntfs-3g/commit/8cd4718cad4941ef49ea5b3af8cd9ec68a46af7a
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-42616

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:04 +05:30
Darsh Kelaiya a0a6069ddc ntfs-3g-ntfsprogs: fix CVE-2026-42618 
This patch applies the upstream fixes shown in [1] and [2]. The NVD
record describing the vulnerability is referenced in [3].

[1] https://github.com/tuxera/ntfs-3g/commit/e021cbe3d7a42963110e4561f2a1327614c20a00
[2] https://github.com/tuxera/ntfs-3g/commit/6aa66d98980ac1d966d7977c7b079f4fe380eb42
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-42618

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:03 +05:30
Darsh Kelaiya 40eac38e56 ntfs-3g-ntfsprogs: fix CVE-2026-46569 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/961ed5c2fa2f36ef6a347f04e1fa586113c97e7c
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46569

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:03 +05:30
Darsh Kelaiya cc1cc98d51 ntfs-3g-ntfsprogs: fix CVE-2026-46570 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/5ab37421ebbcbf33bf96876c7a034393bda05a25
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46570

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:02 +05:30
Darsh Kelaiya bd5043efd3 ntfs-3g-ntfsprogs: fix CVE-2026-46571 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/b912272b30c552b0457e40a0a68b1fac2587aaea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46571

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:02 +05:30
Darsh Kelaiya 1e0b8b62e2 ntfs-3g-ntfsprogs: fix CVE-2026-46572 and CVE-2026-42617 
This patch applies the upstream fixes shown in [1], [2], and [3].
The NVD records describing the vulnerabilities are referenced in
[4] and [5].

[1] https://github.com/tuxera/ntfs-3g/commit/2ead8a3ccf940c0219ffba587fab54e21462b3a5
[2] https://github.com/tuxera/ntfs-3g/commit/dfd1a7c6eb23a22238ec193451fa59c989b4381f
[3] https://github.com/tuxera/ntfs-3g/commit/edf2b892356684ca8f2fc5898943c7a9b90ffb80
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-46572
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-42617

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:01 +05:30
Darsh Kelaiya 4202adbfe6 net-snmp: fix CVE-2026-89147 
This patch applies the upstream fix [1] for CVE-2026-89147
as shown in the advisory identifying the fix [2].

[1] https://github.com/net-snmp/net-snmp/commit/ad843e83da1c229847ae7884dc08311fad680389
[2] https://ubuntu.com/security/CVE-2026-89147

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:01 +05:30
Darsh Kelaiya aa6d99fed0 python3-aiohttp: fix CVE-2026-69244 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1]. The recipe regenerates the C HTTP parser
from the corrected Cython source during configuration.

[1] https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d
[2] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:00 +05:30
Darsh Kelaiya 25f14104c2 python3-aiohttp: fix CVE-2026-69243 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1]. It adapts the Python and C HTTP parser
paths to read a rejected WebSocket upgrade request body before
switching protocols.

[1] https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98
[2] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:00 +05:30
Darsh Kelaiya 70575863c3 python3-aiohttp: fix CVE-2026-59881 
This patch applies the upstream fix as referenced in [2], using
the commit shown in [1]. The 3.13.5 backport passes the negotiated
compression setting to the client WebSocket reader.

[1] https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6
[2] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:00 +05:30
Darsh Kelaiya d193d78617 python3-aiohttp: fix CVE-2026-54273 
This patch applies the upstream 3.14.1 backport for
CVE-2026-54273. The upstream fix commit is referenced in [1], its
required follow-up commit is referenced in [2], and the public
advisory is referenced in [3].

The generated aiohttp/_http_parser.c changes are omitted. The
recipe-time Cython regeneration introduced in this patch
regenerates that file from the patched _http_parser.pyx before the
accelerated parser is compiled.

[1] https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf
[2] https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7
[3] https://github.com/advisories/GHSA-4fvr-rgm6-gqmc

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:18:54 +05:30
Yogita Urade ce6bcd3337 python3-pillow: CVE_STATUS for CVE-2026-55798 
Analysis:
- The vulnerable code is WindowsViewer.get_command() constructing an
  unescaped cmd.exe command from a file path. [1]
- Linux uses UnixViewer, which quotes the path, so this Windows command
  path is not used by the target recipe. [1]
- Hence marking this CVE not applicable for the Linux target.

[1] https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:52 +05:30
Yogita Urade 9129c27a01 python3-pillow: Fix CVE-2026-59205 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:51 +05:30
Yogita Urade 1cec74bf36 python3-pillow: Fix CVE-2026-59203 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:51 +05:30
Yogita Urade 8963cc4576 python3-pillow: Fix CVE-2026-59200 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:50 +05:30
Yogita Urade 1d22c2e3b3 python3-pillow: Fix CVE-2026-59199 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:49 +05:30
Yogita Urade dbf1a37262 python3-pillow: Fix CVE-2026-59198 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:49 +05:30
Yogita Urade 293c0ee6ef python3-pillow: Fix CVE-2026-59197 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:48 +05:30
Yogita Urade 6c5fed0692 python3-pillow: Fix CVE-2026-55380 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:48 +05:30
Yogita Urade c782505854 python3-pillow: Fix CVE-2026-54059 CVE-2026-54060 CVE-2026-55379 
This patch applies the upstream fix as referenced in [2], [3]
and [4], using the commit shown in [1].

[1] https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
[2] https://nvd.nist.gov/vuln/detail/cve-2026-54059
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-54060
[4] https://nvd.nist.gov/vuln/detail/cve-2026-55379

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:47 +05:30
Yogita Urade 11d0cfd949 redis: fix CVE-2026-66373 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/4f62a8bf15c634187d8a87d874f8988032f90b6c
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-66373

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:47 +05:30
Yogita Urade bb81197434 redis: fix CVE-2026-25243 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/b9dde6fc25dec6191b18374335a076a7b31e3d02
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-25243

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:46 +05:30
Yogita Urade 77ca1bfa10 redis: fix CVE-2026-23631 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/0cca172a174642bdae03b871615227896274d9bb
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-23631

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:46 +05:30
Yogita Urade 0d975df7da redis: fix CVE-2026-23479 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/redis/redis/commit/c14e9925e571c3c8ecbeb8632fe834faa32175ea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-23479

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:45 +05:30
Hetvi Thakar 66ad06b673 nginx: Ignore CVE-2026-60005 
Analysis:
- CVE-2026-60005 affects the optional ngx_http_slice_module [1].
- The slice module is not built by default and requires the explicit
  --with-http_slice_module configure option, which neither Wrynose nginx
  recipe enables by default [1][2].
- Mark the CVE not applicable only when that option is absent; report it
  as unpatched when a bbappend enables the module.

Reference:
[1] https://github.com/advisories/GHSA-vxcv-h5wj-jxr5
[2] https://nginx.org/en/docs/configure.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:45 +05:30
Hetvi Thakar 9b332333cd nginx: Ignore CVE-2026-40460 
Analysis:
- CVE-2026-40460 affects nginx only when the HTTP/3
  QUIC module is enabled [1].
- The module requires the explicit --with-http_v3_module configure
  option, which neither Wrynose nginx recipe enables by default [2].
- Mark the CVE not applicable only when that option is absent; report it
  as unpatched when a bbappend enables the module.

Reference:
[1] https://nginx.org/en/security_advisories.html
[2] https://nginx.org/en/docs/configure.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:44 +05:30
Hetvi Thakar 29166e9b7a nginx: fix CVE-2026-56434 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/ddde692db11ab8238e9ca661007f64c9f6d764d2
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:43 +05:30
Hetvi Thakar a34e2f8489 nginx: fix CVE-2026-42533 
These patches apply the upstream fix sequence as referenced in [6],
using the commits shown in [1] through [5].

Use version-specific fourth patches: nginx 1.28.3 lacks
ngx_http_proxy_v2_module, while the nginx 1.29.7 backport retains the
applicable proxy-v2 bounds checks with its older request-body layout.

[1] https://github.com/nginx/nginx/commit/ea47fabf55e2bc9192ddc27f52486b4e58d5e007
[2] https://github.com/nginx/nginx/commit/7ac67898bdfed2140a1bedcda252074cca11f494
[3] https://github.com/nginx/nginx/commit/78950bdcd443830bde00f6844dba3033c18862b1
[4] https://github.com/nginx/nginx/commit/326b17b0038321c29252e79bf4c53d4773fcb8b5
[5] https://github.com/nginx/nginx/commit/97e40e59b7b4ad6aa36f54ce4f1e64d1e98f24cb
[6] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:43 +05:30
Hetvi Thakar a4a3880b71 nginx: fix CVE-2026-48142 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/60c4243eb8775d51662a01def8a7dad5d9fb34a7
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:42 +05:30