mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-08 18:30:16 +00:00
Code Issues Projects Releases Wiki Activity
31,184 Commits 64 Branches 0 Tags
b5874ea07d69919d9b40d59f2c2f0bbd24bc3259
Commit Graph
6834 Commits
Author SHA1 Message Date
Darsh Kelaiya edf29eeda9 python3-aiohttp: fix CVE-2026-34518 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6
[2] https://github.com/aio-libs/aiohttp/commit/6e8f393330f9bd6d7b24a146124ebc42eaa727b9
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34518

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:06 +05:30
Darsh Kelaiya 1108d82e62 python3-aiohttp: fix CVE-2026-34993 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-34993

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:06 +05:30
Darsh Kelaiya b1fdc4d179 python3-aiohttp: fix CVE-2026-34513 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98
[2] https://github.com/aio-libs/aiohttp/commit/8ab84c52fe58ef34794fa9b12f00b06e626adcc0
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34513

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:05 +05:30
Darsh Kelaiya b024b3d0d2 python3-aiohttp: fix CVE-2026-34514 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06
[2] https://github.com/aio-libs/aiohttp/commit/dab9e879be5606682a39b9dd378900eba0afd1a4
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34514

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:05 +05:30
Darsh Kelaiya 334f13cc57 python3-aiohttp: fix CVE-2026-22815 
This patch applies the reviewed upstream fix commits shown in
[1], [2], and [3]. The advisory identifying the fix is referenced in
[4].

The generated aiohttp/_http_parser.c changes are omitted. The
recipe-time Cython regeneration introduced with CVE-2025-69224
regenerates that file from the patched _http_parser.pyx before the
accelerated parser is compiled.

[1] https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36
[2] https://github.com/aio-libs/aiohttp/commit/ed6440ca49ef4907ab9d99ba7e329aab702b7173
[3] https://github.com/aio-libs/aiohttp/commit/30ec25f8a58c5dc3f8fdb3eec31f555eeaabd30a
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-22815

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:04 +05:30
Darsh Kelaiya 12088f5bdd python3-aiohttp: fix CVE-2025-69223 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

The python3-brotli 1.2.0 upgrade commit [4] is omitted because
Scarthgap currently provides python3-brotli 1.1.0. Brotli 1.2.0
adds the bounded decompression API required by the upstream aiohttp
fix. Consequently, this backport disables optional Brotli response
decoding while retaining bounded decompression for the supported
zlib path.

[1] https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
[2] https://github.com/aio-libs/aiohttp/commit/92477c5a74c43dfe0474bd24f8de11875daa2298
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-69223
[4] https://github.com/openembedded/meta-openembedded/commit/382e4de7d8b7d0e980fefcda7a06e5f20f5f26c0

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:04 +05:30
Darsh Kelaiya 10aeacf39f python3-aiohttp: fix CVE-2025-69229 
This patch applies the reviewed upstream fix commits shown in
[1], [2], [3], and [4].
The advisory identifying the fix is referenced in [5].

[1] https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712
[2] https://github.com/aio-libs/aiohttp/commit/271532ea355c65480c8ecc14137dfbb72aec8f6f
[3] https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229
[4] https://github.com/aio-libs/aiohttp/commit/1e4120e87daec963c67f956111e6bca44d7c3dea
[5] https://nvd.nist.gov/vuln/detail/CVE-2025-69229

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:03 +05:30
Darsh Kelaiya 11baed163d python3-aiohttp: fix CVE-2025-69227 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259
[2] https://github.com/aio-libs/aiohttp/commit/d5bf65f15c0c718b6b95e9bc9d0914a92c51e60f
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-69227

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:03 +05:30
Devansh Patel 5891d513a9 python3-web3: add CVE_PRODUCT mapping 
The current inherited "python:web3" mapping does not match the web3.py
identities used by NVD and CVE List V5, so its source-aligned CVE is
missed.

Use "ethereum:web3.py" for the CNA affected-data identity and
"apeworx:web3.py" for the NVD dictionary CPE and NVD configuration
identity.

Backport note: Scarthgap has web3.py 6.17.0 rather than 7.16.0;
CVE-2026-40072 applies to this release and is reported as unpatched.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 19ecb40f50)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:02 +05:30
Darsh Kelaiya f6e53ba11b python3-aiohttp: fix CVE-2025-69224 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

The generated aiohttp/_http_parser.c changes are omitted. Add
python3-cython-native and regenerate the C source from the patched
_http_parser.pyx during do_configure.

[1] https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0
[2] https://github.com/aio-libs/aiohttp/commit/5affd64f86d28a16a8f8e6fea2d217c99bf7831f
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-69224

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:02 +05:30
Darsh Kelaiya 7489d88734 python3-aiohttp: ignore CVE-2026-34515 
Analysis:
- The upstream advisory limits the issue to aiohttp applications running
  on Windows and identifies the affected and fixed versions [1].
- The advisory-selected upstream fix rejects absolute static resource
  paths, explicitly including UNC and Windows drive paths [2].
- NVD independently describes the issue as Windows-specific and records
  the same upstream commit as the patch [3].
- Hence ignoring the CVE for now.

Reference:
[1] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m
[2] https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34515

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:01 +05:30
Devansh Patel c0f1ddc31d python3-cbor2: use exact CVE_PRODUCT mapping 
The inherited "python:cbor2" mapping does not identify the packaged
source. Use "agronholm:cbor2", its NVD dictionary CPE and NVD
configuration identity, restoring the source-aligned records.

Backport note: master replaces a product-only mapping in version 6.1.4;
Scarthgap 5.6.4 has no recipe-local override, so this is an addition.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 7f59d247ee)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:01 +05:30
Devansh Patel b7e7f9cc80 python3-httplib2: correct CVE_PRODUCT mapping 
The inherited "python:httplib2" mapping does not identify the packaged
project. Use "httplib2_project:httplib2" for its exact NVD dictionary
CPE and NVD configuration identity.

Backport note: master replaces a product-only mapping in version 0.32.0;
Scarthgap 0.22.0 has no recipe-local override, so this is an addition.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0a8f71a643)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:00 +05:30
Darsh Kelaiya 8ee24af3c6 python3-django: fix CVE-2026-15830 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/django/django/commit/ba80833fa656dd09660b97c4429331067db1b080
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15830

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:00 +05:30
Darsh Kelaiya e1fadab9dd python3-django: fix CVE-2026-15337 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/django/django/commit/c72a5dbb64d0777f3f471f1be94e8b2ca91e0959
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15337

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:17:59 +05:30
Darsh Kelaiya 3bc6095e25 python3-django: fix CVE-2026-15307 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-15307

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:17:59 +05:30
Devansh Patel b8bd073f05 python3-cbor2: Fix CVE-2026-26209 
Scarthgap already contains 4810cd8c5b [3], which backports
fb4ee161 and e61a5f36 for read-ahead/read-size handling. The
associated submission [4] labels that work as CVE-2026-26209, but
it does not add the max_depth protection required for uncontrolled
recursion [2].

Complete the existing backport with the 5.9.0 max-depth chain:
- bcb6cea4: add the C decoder depth limit [1]
- 94e0d212: add the security-essential pure-Python depth limit
- 53521e7c: apply the required type correction
- a7ac10d5: raise the default depth limit to 400
- d903d62c: synchronize the C function signature default

The 5.9.0 upgrade description [5] also identifies max_depth as the
CVE fix. Full upstream commit links are recorded in the embedded
patch headers.

[1] https://github.com/agronholm/cbor2/commit/bcb6cea4edde1d00ff4f0eece883dea951f66e1b
[2] https://github.com/advisories/GHSA-3c37-wwvx-h642
[3] https://git.openembedded.org/meta-openembedded/commit/?id=4810cd8c5bbc0b4349a78eac85a6a882bc0b03a2
[4] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105607.html
[5] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105418.html

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:25 +05:30
Hetvi Thakar 016908224f python3-web3: Fix CVE-2026-40072 
This patch applies the v7 upstream fix for CVE-2026-40072 shown in [1].
The security advisory [2] references the patch-equivalent v8/main fix [3].
The v7 commit was selected because it is the nearest source baseline to
Scarthgap's web3.py 6.17.0 recipe.

[1] https://github.com/ApeWorX/web3.py/commit/d62e67d3b636bd4c5a929696c0f5c4167c31625b
[2] https://github.com/ApeWorX/web3.py/security/advisories/GHSA-5hr4-253g-cpx2
[3] https://github.com/ApeWorX/web3.py/commit/b1c57bb0a124359c9902daaefab4d8af7c3c4c1e

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:23 +05:30
Darsh Kelaiya 7449480403 python3-httplib2: fix CVE-2026-59939 
This patch applies the upstream fix for CVE-2026-59939 as referenced
in [2], using the upstream commit identified in [1].

[1] https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427
[2] https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:23 +05:30
Hetvi Thakar 6752204aad python3-simpleeval: Fix CVE-2026-32640 
Manually backport the three upstream security fixes for
CVE-2026-32640 to the Scarthgap simpleeval 0.9.13 recipe [1][2][3].

Include the required unhashable-container correction [4], which
prevents the recursive security checks from raising TypeError on
legitimate list and tuple values.

Harden the recursive callback-argument validation to inspect sets,
frozensets, and dictionary keys, and safely handle cyclic containers.
Add regression coverage for each of these cases.

Do not include the separate generator/coroutine hardening or the
optional performance follow-up. Omit the new ModuleWrapper API so this
stable-branch fix adds no unrelated public feature.

[1] https://github.com/danthedeckie/simpleeval/commit/9cb4a7b99498
[2] https://github.com/danthedeckie/simpleeval/commit/1654cbf02193
[3] https://github.com/danthedeckie/simpleeval/commit/cffa9f68cee5
[4] https://github.com/danthedeckie/simpleeval/commit/d1e4569db678

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:22 +05:30
Hetvi Thakar 97131550a8 python3-ujson: Fix CVE-2026-54911 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54911

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:22 +05:30
Hetvi Thakar 50f5a96f22 python3-ujson: Fix CVE-2026-44660 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-44660

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:21 +05:30
Hetvi Thakar f6aab7432b python3-ujson: Fix CVE-2026-32874 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/4baeb950df780092bd3c89fc702a868e99a3a1d2
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-32874

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:21 +05:30
Hetvi Thakar 28aefe0fdb python3-ujson: Fix CVE-2026-32875 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-32875

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Darsh Kelaiya b9534a154d python3-filelock: fix CVE-2026-22701 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-22701

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Darsh Kelaiya ac73fd1e99 python3-filelock: fix CVE-2025-68146 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-68146

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Gyorgy Sarvari d348bf9a61 python3-twisted: set CVE_PRODUCT 
The related CVEs are tracked with twisted:twisted CPE, so the
default python:twisted CPE doesn't match any entries.

See CVE db query:
sqlite> select * from products where PRODUCT = 'twisted';
CVE-2014-7143|twisted|twisted|14.0.0|=||
CVE-2016-1000111|twisted|twisted|||16.3.1|<
CVE-2019-12387|twisted|twisted|||19.2.1|<
CVE-2019-12855|twisted|twisted|||19.2.1|<=
CVE-2020-10108|twisted|twisted|||19.10.0|<=
CVE-2020-10109|twisted|twisted|||19.10.0|<=
CVE-2022-21712|twisted|twisted|11.1.0|>=|22.1.0|<
CVE-2022-21716|twisted|twisted|21.7.0|>=|22.2.0|<
CVE-2022-24801|twisted|twisted|||22.4.0|<
CVE-2022-39348|twisted|twisted|0.9.4|>=|22.10.0|<
CVE-2023-46137|twisted|twisted|||22.8.0|<=
CVE-2024-41810|twisted|twisted|||24.3.0|<=

Set the CVE_PRODUCT accordingly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a89ab32230)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:03 +05:30
Gyorgy Sarvari 9069df0fdb python3-httpx: set CVE_PRODUCT 
The relevant CVEs are tracked in the CVE db with encode:httpx CPE
instead of the default python:httpx. Set CVE_PRODUCT accordingly.

See CVE db query:
sqlite> select * from products where product like '%httpx%';
CVE-2021-41945|encode|httpx|||0.23.0|<

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8627277b50)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:03 +05:30
Hetvi Thakar 35f85f87b8 python3-twisted: Fix CVE-2026-42304 
This patch applies the upstream 26.4.0rc2 backport for
CVE-2026-42304. The upstream fix merge is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch header
because the fix expands to multiple commits.

[1] https://github.com/twisted/twisted/commit/2d196123264efb0027eecfe1b430be4a9babdbd8
[2] https://github.com/advisories/GHSA-grgv-6hw6-v9g4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:12 +05:30
Hetvi Thakar 3c9dd88058 python3-pyjwt: Fix CVE-2026-48526 
Reject JSON Web Key documents passed directly as HMAC secrets. This
prevents public asymmetric JWK data from being reused as an HMAC key
when an application permits mixed symmetric and asymmetric algorithms.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-xgmm-8j9v-c9wx

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:12 +05:30
Hetvi Thakar b9877579dc python3-pyjwt: Fix CVE-2026-48525 
Reject a non-empty compact payload segment for b64=false tokens before
Base64URL decoding. The segment is unused for detached JWS verification,
so decoding it allowed unauthenticated CPU and memory consumption.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-w7vc-732c-9m39

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:11 +05:30
Hetvi Thakar fffe550dfc python3-pyjwt: Fix CVE-2026-48524 
Preserve a valid cached JWK set when a refresh request fails. The
previous finally block stored None on errors, turning a transient JWKS
outage into an authentication failure for otherwise cached keys.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-fhv5-28vv-h8m8

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:11 +05:30
Hetvi Thakar 773e345eca python3-pyjwt: Fix CVE-2026-48522 
Restrict PyJWKClient JWKS retrieval to HTTP and HTTPS. urllib
otherwise accepts schemes such as file, FTP and data, allowing
attacker-influenced URLs to reach unintended resources.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-993g-76c3-p5m4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:10 +05:30
Darsh Kelaiya 49bb7f1369 python3-flask: fix CVE-2026-27205 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/pallets/flask/commit/c17f379390731543eea33a570a47bd4ef76a54fa
[2] https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:10 +05:30
Anuj Mittal 29a0442182 python3-matplotlib: fix build 
Changes in oe-core commit a0151ab56cf3 (setuptools3: clean the build
directory in configure) cause the build directory to be cleared during
configure step. To avoid the downloaded sources from getting cleaned,
pre-fetch them to a separate downloads/ directory and patch source to
look there.

Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-02 15:08:44 +05:30
Sudhir Dumbhare 85aa67fa07 python3-tornado: Fix CVE-2026-31958 
This patch applies the upstream fix as referenced in [2], which addresses a Tornado flaw where
crafted multipart/form-data requests can trigger excessive synchronous parsing and cause
denial of service using the commit shown in [1].

[1] https://github.com/tornadoweb/tornado/commit/119a195e290c43ad2d63a2cf012c29d43d6ed839
[2] https://security-tracker.debian.org/tracker/CVE-2026-31958

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-31958

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-09 11:37:19 +05:30
Sudhir Dumbhare 0cbca3f031 python3-grpcio-tools: set status for CVE-2024-11407 
Analysis:
- CVE-2024-11407 [1] affects gRPC-C++ servers with transmit zero copy enabled.
- The upstream fix modifies gRPC core runtime source
  src/core/lib/event_engine/posix_engine/posix_endpoint.cc [2].
- python3-grpcio-tools does not include or compile this runtime source.
- Hence CVE-2024-11407 is not applicable to python3-grpcio-tools.

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-11407
[2] https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-09 11:37:19 +05:30
Sudhir Dumbhare 90446e0fd3 python3-grpcio-tools: set status for CVE-2024-7246 
Analysis:
- CVE-2024-7246 [4] affects gRPC-C++ CHTTP2 HPACK parser error handling.
- The upstream fix from v1.62.3 [1] modifies gRPC core runtime source
  src/core/ext/transport/chttp2/transport/hpack_parser.cc.
  aligned with the original fix in v1.60.2 [2] as referenced in [3].
- python3-grpcio-tools does not include or compile this runtime source.
- Hence CVE-2024-7246 is not applicable to python3-grpcio-tools.

[1] https://github.com/grpc/grpc/commit/1d172cfca56440889ca32ae516b8c2767321f5b5
[2] https://github.com/grpc/grpc/commit/88b1244fd43e81860baa60cc7fb3945a2cca0d11
[3] https://bugzilla.suse.com/show_bug.cgi?id=1228919
[4] https://nvd.nist.gov/vuln/detail/CVE-2024-7246

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-09 11:37:19 +05:30
Sudhir Dumbhare 483bf9ea00 python3-grpcio-tools: set status for CVE-2026-33186 
The vulnerability only affects the Go implementation of the library,
not the Python one. Ignore this CVE due to this.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-33186
https://github.com/advisories/GHSA-p77j-4mvh-x3m3

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-09 11:37:19 +05:30
Gyorgy Sarvari f686a459c5 python3-supervisor: set CVE_PRODUCT 
This recipe's CVEs are tracked using supervisord:supervisor CPE by nist,
so the default python:supervisor CPE doesn't match relevant CVEs.

See CVE db query (home-assisstant vendor is not relevant):
sqlite> select * from products where PRODUCT like 'supervisor';
CVE-2017-11610|supervisord|supervisor|||3.0|<=
CVE-2017-11610|supervisord|supervisor|3.1.0|=||
CVE-2017-11610|supervisord|supervisor|3.1.1|=||
CVE-2017-11610|supervisord|supervisor|3.1.2|=||
CVE-2017-11610|supervisord|supervisor|3.1.3|=||
CVE-2017-11610|supervisord|supervisor|3.2.0|=||
CVE-2017-11610|supervisord|supervisor|3.2.1|=||
CVE-2017-11610|supervisord|supervisor|3.2.2|=||
CVE-2017-11610|supervisord|supervisor|3.2.3|=||
CVE-2017-11610|supervisord|supervisor|3.3.0|=||
CVE-2017-11610|supervisord|supervisor|3.3.1|=||
CVE-2017-11610|supervisord|supervisor|3.3.2|=||
CVE-2019-12105|supervisord|supervisor|||4.0.2|<=
CVE-2023-27482|home-assistant|supervisor|||2023.03.1|<

Set the CVE_PRODUCT explicitly to match relevant CVEs.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 77ba5f31e2)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-09 11:37:19 +05:30
Gyorgy Sarvari 6011a79bb1 python3-pydantic: set CVE_PRODUCT 
Set correct CVE_PRODUCT - the default ${PN} value doesn't match relevant
CVEs.

See CVE query (n8n vendor is not relevant):
sqlite> select * from products where product like '%pydantic%';
CVE-2021-29510|pydantic|pydantic|||1.6.2|<
CVE-2021-29510|pydantic|pydantic|1.7|>=|1.7.4|<
CVE-2021-29510|pydantic|pydantic|1.8|>=|1.8.2|<
CVE-2024-3772|pydantic|pydantic|||1.10.13|<
CVE-2024-3772|pydantic|pydantic|2.0|>=|2.4.0|<
CVE-2025-55526|n8n|pydantic|2.11.7|=||

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b4fd4a6217)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-09 11:37:19 +05:30
Gyorgy Sarvari 208c434236 python3-paramiko: set CVE_PRODUCT 
Set correct CVE_PRODUCT for paramiko. The default python:paramiko value
doesn't match CVEs, because the product has its own set of CPEs associated
with CVEs.

See CVE db query:
sqlite> select * from products where PRODUCT = 'paramiko';
CVE-2008-0299|python_software_foundation|paramiko|1.7.1|=||
CVE-2018-1000805|paramiko|paramiko|1.17.6|=||
CVE-2018-1000805|paramiko|paramiko|1.18.5|=||
CVE-2018-1000805|paramiko|paramiko|2.0.8|=||
CVE-2018-1000805|paramiko|paramiko|2.1.5|=||
CVE-2018-1000805|paramiko|paramiko|2.2.3|=||
CVE-2018-1000805|paramiko|paramiko|2.3.2|=||
CVE-2018-1000805|paramiko|paramiko|2.4.1|=||
CVE-2018-7750|paramiko|paramiko|||1.17.6|<
CVE-2018-7750|paramiko|paramiko|1.18.0|>=|1.18.5|<
CVE-2018-7750|paramiko|paramiko|2.0.0|>=|2.0.8|<
CVE-2018-7750|paramiko|paramiko|2.1.0|>=|2.1.5|<
CVE-2018-7750|paramiko|paramiko|2.2.0|>=|2.2.3|<
CVE-2018-7750|paramiko|paramiko|2.3.0|>=|2.3.2|<
CVE-2018-7750|paramiko|paramiko|2.4.0|=||
CVE-2022-24302|paramiko|paramiko|||2.10.1|<
CVE-2023-48795|paramiko|paramiko|||3.4.0|<

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e22d2a7ba6)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-09 11:37:19 +05:30
Sudhir Dumbhare a218d02b51 python3-grpcio: set status for CVE-2026-33186 
The vulnerability only affects the Go implementation of the library,
not the Python one. Ignore this CVE due to this.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-33186

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-09 11:37:19 +05:30
Sudhir Dumbhare bc70f00d38 python3-grpcio: Fix CVE-2024-7246 
Apply the nearest upstream fix from v1.62.3 [1] for HPACK parser error
handling to prevent header table desynchronization, aligned with the original
fix in v1.60.2 [2] as referenced in [3].

[1] https://github.com/grpc/grpc/commit/1d172cfca56440889ca32ae516b8c2767321f5b5
[2] https://github.com/grpc/grpc/commit/88b1244fd43e81860baa60cc7fb3945a2cca0d11
[3] https://bugzilla.suse.com/show_bug.cgi?id=1228919

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-7246

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-06-09 11:37:19 +05:30
Jérémie Dautheribes (Schneider Electric ) 91c3393ce0 python3-backports-zstd: add recipe 
This recipe was previously part of the master branch but was removed
because the zstd module was integrated into the Python standard library
starting from Python 3.14.

Since Scarthgap uses Python 3.12, restore and update this recipe for users
on this branch.

Signed-off-by: Jérémie Dautheribes (Schneider Electric) <jeremie.dautheribes@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-05-25 08:05:43 +05:30
Gyorgy Sarvari 3fd10def49 python3-ecdsa: set CVE_PRODUCT 
Set the correct CVE_PRODUCT value, the default python: ecdsa doesn't
match relevant entries.

The correct values were taken from the CVE db, by checking which CVEs
are relevant.

See CVE db query:
sqlite> select * from products where product like '%ecdsa%';
CVE-2019-14853|python-ecdsa_project|python-ecdsa|||0.13.3|<
CVE-2019-14859|python-ecdsa_project|python-ecdsa|||0.13.3|<
CVE-2020-12607|antonkueltz|fastecdsa|||2.1.2|<
CVE-2021-43568|starkbank|elixir_ecdsa|1.0.0|=||
CVE-2021-43569|starkbank|ecdsa-dotnet|1.3.2|=||
CVE-2021-43570|starkbank|ecdsa-java|1.0.0|=||
CVE-2021-43571|starkbank|ecdsa-node|1.1.2|=||
CVE-2021-43572|starkbank|ecdsa-python|||2.0.1|<
CVE-2022-24884|ecdsautils_project|ecdsautils|||0.4.1|<
CVE-2024-21502|antonkueltz|fastecdsa|||2.3.2|<
CVE-2024-23342|tlsfuzzer|ecdsa|||0.18.0|<=

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 7f962ef155)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-05-21 08:57:42 +05:30
Peter Marko 6b76759967 python-grpcio(-tools): add grpc:grpc to cve product 
These grpc python modules contain parts of grpc core.
Each CVE needs to be assessed if the patch applies also to core parts
included in each module.

Note that so far there was never a CVE specific for python module, only
for grpc:grpc and many of those needed to be fixed at leasts in grpcio:

sqlite> select vendor, product, count(*) from products where product like '%grpc%' group by vendor, product;
grpc|grpc|21
grpck|grpck|1
linuxfoundation|grpc_swift|9
microsoft|grpconv|1
opentelemetry|configgrpc|1

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f993cb2ecb)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-05-21 08:57:41 +05:30
Hitendra Prajapati fdf83ebd28 python3-pillow: fix CVE-2026-40192 
Backport commit[1] which fixes this vulnerability as mentioned NVD report in [2].

[1] https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-40192
[3] https://security-tracker.debian.org/tracker/CVE-2026-40192

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-04-29 10:14:29 +05:30
Gyorgy Sarvari 0febf2f87d python3-tornado: set CVE_PRODUCT 
The default "python:tornado" CVE_PRODUCT doesn't match relevant CVEs, because
the project's CPE is "tornadoweb:tornado".

See cve db query (docmosis is an irrelevant vendor):

sqlite> select * from products where PRODUCT = 'tornado';
CVE-2012-2374|tornadoweb|tornado|||2.2|<=
CVE-2012-2374|tornadoweb|tornado|1.0|=||
CVE-2012-2374|tornadoweb|tornado|1.0.1|=||
CVE-2012-2374|tornadoweb|tornado|1.1|=||
CVE-2012-2374|tornadoweb|tornado|1.1.1|=||
CVE-2012-2374|tornadoweb|tornado|1.2|=||
CVE-2012-2374|tornadoweb|tornado|1.2.1|=||
CVE-2012-2374|tornadoweb|tornado|2.0|=||
CVE-2012-2374|tornadoweb|tornado|2.1|=||
CVE-2012-2374|tornadoweb|tornado|2.1.1|=||
CVE-2014-9720|tornadoweb|tornado|||3.2.2|<
CVE-2023-25264|docmosis|tornado|||2.9.5|<
CVE-2023-25265|docmosis|tornado|||2.9.5|<
CVE-2023-25266|docmosis|tornado|||2.9.5|<
CVE-2023-28370|tornadoweb|tornado|||6.3.2|<
CVE-2024-42733|docmosis|tornado|||2.9.7|<=
CVE-2024-52804|tornadoweb|tornado|||6.4.2|<
CVE-2025-47287|tornadoweb|tornado|||6.5.0|<
CVE-2025-67724|tornadoweb|tornado|||6.5.3|<
CVE-2025-67725|tornadoweb|tornado|||6.5.3|<
CVE-2025-67726|tornadoweb|tornado|||6.5.3|<

Set the CVE_PRODUCT accordingly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 139cc15de3)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-04-29 10:14:29 +05:30
Ankur Tyagi a1b14b7a3a python3-werkzeug: ignore CVE-2026-27199 
Vvulnerability affects Windows application and can be ignored.

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-27199

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-04-15 14:12:18 +05:30