mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-14 03:57:15 +00:00
Code Issues Projects Releases Wiki Activity
38,774 Commits 65 Branches 0 Tags
c0fcd7cca3760ef24e087ac4a31b8f357cb204da
Commit Graph
38774 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Wang Mingyu c0fcd7cca3 pgpool2: 4.6.4 -> 4.6.6 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6133cecab2)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 11:17:15 +05:30
Ankur Tyagi e5bf373a23 ncp: ignore CVE-2025-14577 and CVE-2026-35087 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14577
https://nvd.nist.gov/vuln/detail/cve-2026-35087

(cherry picked from commit 1bd5d1a7a69aa04d6339ba7d5ef2cd8b83ec25a4)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 98e04f2bb7)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:42:09 +05:30
Ankur Tyagi b6bef6a20b ndpi: patch CVE-2026-116744 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-116744

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 728a6aeb17)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:42:09 +05:30
Ankur Tyagi 21be55d89e libmspack: patch CVE-2026-110602 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-110602

(cherry picked from commit 94901e4ad41b2d45e1a28e92ceeda8ae74148081)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit ba17174e39)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:42:08 +05:30
Ankur Tyagi 11a3725bec libvncserver: patch CVE-2026-44988 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44988

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 08a5882d96)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:42:08 +05:30
Ankur Tyagi 239e652a04 mtr: patch CVE-2026-14461 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-14461

(cherry picked from commit a5e913980f0107c4fe1ccde6a5e4a10780bd60a9)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 92c0310db4)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:42:07 +05:30
Khem Raj 16b059cabd fftw: Fix planner hang on musl with CLOCK_SGI_CYCLE 
musl defines CLOCK_SGI_CYCLE, so on aarch64 cycle.h uses
clock_gettime(CLOCK_SGI_CYCLE) as its tick counter. Linux returns
EINVAL for that clock, every measurement reads as zero, and
FFTW_MEASURE planning loops forever, which times out the bench ptest.
Skip the SGI clock on Linux.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit cb9e4666b6)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:42:07 +05:30
Khem Raj 477bccfaff clight: Fix build with musl 
log.c uses open() and O_* flags without including <fcntl.h>, which
glibc pulls in indirectly but musl does not, so clang fails with
-Wimplicit-function-declaration.

AI-Generated: Uses Claude Code
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c794b5fe79)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:42:06 +05:30
Markus Volk 3b62f912f5 mpv: fix a file descriptor leak in the render API 
With the OpenGL render API (vo_libmpv) every frame left a fence behind
that nothing cleaned up. On v3d each one holds a sync file, so after about
a minute of video the process ran into the open file limit and the
picture stopped ("MESA: error: Export failed"). Backport the upstream
fix.

AI-Generated: Uses Claude Code (Claude Fable 5.1)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2826f6233d)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:42:06 +05:30
Khem Raj 0bcc7d3267 fwupd-efi: Use the cross linker instead of the host ld.bfd 
fwupd-efi finds the linker with find_program(cc.get_linker_id()),
which looks for a program named ld.bfd. meson.cross only sets ld, so
meson falls back to PATH and picks up ld.bfd from HOSTTOOLS. That breaks
cross builds on an x86-64 host:

  hosttools/ld.bfd: cannot represent machine `aarch64'

and on x86-64 targets it silently links with the host linker.

Set ld.bfd in an additional cross file

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit cfecdc92b3)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:42:05 +05:30
Kris Gavvala 50ddf3aa93 python3-pillow: patch CVE-2026-112393 
This patch applies the upstream fix given by the commit in [1]
to address the issue in [2].

[1] https://github.com/python-pillow/Pillow/commit/78c08bd4d9c08037f77465a61d90633f669013f4
[2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf

Signed-off-by: Kris Gavvala <kris.gavvala@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:51 +05:30
Darsh Kelaiya 9b550e9d81 python3-aiohttp: fix CVE-2026-111064 
Backport the initial idle-connection timeout fix [1] to aiohttp
3.13.5, as identified by [2]. Start the keepalive deadline when the
connection is established so peers that send no request or trickle
incomplete headers cannot keep it open indefinitely.

Retain the existing timeout default and the upstream regressions
for idle peers, trickled headers, disabled deadlines, slow handlers
and WebSocket keepalive cleanup.

[1] https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3
[2] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:50 +05:30
Darsh Kelaiya 70b574354e python3-aiohttp: fix CVE-2026-111063 
Backport the Secure shared-cookie fix [1] to aiohttp 3.13.5, as
identified by [3]. Apply the Secure check before looking up cached
shared morsels so an earlier HTTPS request cannot bypass it.

Include the upstream trusted-origin correction [2] so per-request
cookies retain the session jar's treat_as_secure_origin policy.
The default property keeps existing custom cookie jars compatible.
Include the upstream cookie and client regression tests.

[1] https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5
[2] https://github.com/aio-libs/aiohttp/commit/95081f8a353be2873643ab6dd74904ca413e45e0
[3] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:50 +05:30
Darsh Kelaiya 9244a2e741 python3-aiohttp: fix CVE-2026-111748 
Backport the protocol-scheme fix [1] to aiohttp 3.13.5, as identified
by [3]. Derive Request.scheme from the transport rather than the
untrusted scheme in an absolute-form request target.

Include the authority-validation correction [2] to reject malformed
targets before URL parsing, independently of yarl normalization.
Retain the upstream parser and request regressions, adapted to the
existing transport-test interface. The recipe regenerates the C
parser from the patched Cython source.

[1] https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411
[2] https://github.com/aio-libs/aiohttp/commit/186065caf37d5999e91fd3d4ddfd03b43eb08801
[3] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-f9xw-jh8m-3mwq

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:49 +05:30
Darsh Kelaiya d21774156e python3-aiohttp: fix CVE-2026-111065 
Backport the upstream cookie overflow and response cleanup fix [1]
to aiohttp 3.13.5, as identified by [2]. Clamp positive Max-Age values
before float conversion and expire nonpositive values immediately.

Close a received response if subsequent processing fails so a
malformed cookie cannot exhaust the connection pool. Include the
upstream extreme Max-Age and connection-release regression tests.
Adapt the response annotation and imports to the existing code.

[1] https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805
[2] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6cjc-53gc-5rqm

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:49 +05:30
Darsh Kelaiya e15dc3c90d python3-aiohttp: fix CVE-2026-111749 
Backport the upstream host-only cookie state fix [1] to aiohttp
3.13.5, as identified by [2]. Track host-only state by domain, path
and name so expiring another cookie cannot widen its domain scope.

Preserve this identity during filtering, replacement and JSON
persistence. Adapt regression assertions to the existing private
state because 3.13.5 lacks the newer public inspection property.

[1] https://github.com/aio-libs/aiohttp/commit/6a07c171ef9f3be583e2907dcd1931372efca8d6
[2] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gx76-c99x-2c96

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:48 +05:30
Darsh Kelaiya e04156eb37 python3-aiohttp: fix CVE-2026-111750 
Backport the upstream HEAD request parsing fix [1] to aiohttp 3.13.5,
as identified by [2]. Only responses to HEAD may skip their body;
incoming HEAD requests must consume the declared request body.

Retain the upstream regression that embeds a request in a HEAD body
and verifies that the following request remains correctly framed.
The pure-Python parser remains available with extensions installed.

[1] https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83
[2] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:48 +05:30
Darsh Kelaiya ba8d0af836 python3-aiohttp: fix CVE-2026-111066 
Backport the multipart descriptor-exhaustion fix [1] to aiohttp
3.13.5. Spool small file parts in memory and count raw multipart
bytes, including headers, against client_max_size.

Include the upstream descriptor-test correction [2] so unrelated
file descriptors do not make the regression test unreliable.
Adapt the HTTP 413 constructor and retain the existing read size.
The vulnerability and fixed release are documented in [3].

[1] https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09
[2] https://github.com/aio-libs/aiohttp/commit/011c08204197beba8281911907b59ffcecea1413
[3] https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:47 +05:30
Poornima Lokesh 45251809f1 mariadb: upgrade 11.4.12 -> 11.4.13 
Fixes CVE-2026-107816: an out-of-bounds heap read in the qc_info plugin
when reading information_schema.query_cache_info after caching a query
that contains embedded null bytes, which could disclose adjacent heap
memory or crash the server.

Drop c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch, which is already
included upstream in 11.4.13.

Disable the DuckDB storage engine (new in 11.4.13) via -DPLUGIN_DUCKDB=NO:
it bundles its own CMake subproject that is not cross-compile aware and
fails do_compile in a cross environment.

CVE: CVE-2026-107816
Signed-off-by: Poornima Lokesh <Poornima.Lokesh@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit d2aa0f282c)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:47 +05:30
Ankur Tyagi 0a2b9edf5f python3-django: upgrade 5.2.18 -> 5.2.19 
Changelog:
https://docs.djangoproject.com/en/dev/releases/5.2.19/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:46 +05:30
Ankur Tyagi 59bf4a3413 python3-django: upgrade 6.0.9 -> 6.0.10 
Changelog:
https://docs.djangoproject.com/en/dev/releases/6.0.10/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:46 +05:30
Ankur Tyagi ddc539d94a uriparser: upgrade 1.0.2 -> 1.0.3 
Changelog:
https://github.com/uriparser/uriparser/blob/uriparser-1.0.3/ChangeLog

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:46 +05:30
Ankur Tyagi dc8ef4ec9e valkey: upgrade 9.0.6 -> 9.0.7 
Changelog:
https://github.com/valkey-io/valkey/releases/tag/9.0.7

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:45 +05:30
Ankur Tyagi 7f96df7262 smarty: upgrade 5.8.4 -> 5.8.5 
Changelog:
https://github.com/smarty-php/smarty/releases/tag/v5.8.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 3fe4c22474)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:45 +05:30
Ankur Tyagi 191a178028 libgphoto2: patch CVE-2026-120452 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120452

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:44 +05:30
Ankur Tyagi 9d29072b9c libgphoto2: patch CVE-2026-120451 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120451

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:44 +05:30
Ankur Tyagi 0662b78ffb hdf5: patch CVE-2026-120758 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120758

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:43 +05:30
Ankur Tyagi a7e3f1e3c7 hdf5: patch CVE-2026-120757 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120757

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:43 +05:30
Ankur Tyagi 476ac376fa hdf5: patch CVE-2026-120756 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120756

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:42 +05:30
Ankur Tyagi ba52a2cf9a hdf5: patch CVE-2026-120754 and CVE-2026-120755 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120754
https://nvd.nist.gov/vuln/detail/cve-2026-120755

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:42 +05:30
Ankur Tyagi 72c031d573 hdf5: patch CVE-2026-120689 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120689

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:41 +05:30
Ankur Tyagi c6a5d54405 hdf5: patch CVE-2026-19023 and CVE-2026-19024 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-19023
https://nvd.nist.gov/vuln/detail/cve-2026-19024

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:41 +05:30
Ankur Tyagi 35efa73ce4 hdf5: patch CVE-2026-19026, CVE-2026-19027 and CVE-2026-19028 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-19026
https://nvd.nist.gov/vuln/detail/cve-2026-19027
https://nvd.nist.gov/vuln/detail/cve-2026-19028

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:40 +05:30
Ankur Tyagi 9bcdd198a9 crow: upgrade 1.3.3 -> 1.3.4 
Details:
https://github.com/CrowCpp/Crow/releases/tag/v1.3.4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(From OE-Core rev: 9bf293a9d1)
Resolves CVE-2026-116011
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:40 +05:30
Ankur Tyagi b80b104c0a crow: upgrade 1.3.2 -> 1.3.3 
Changelog:
https://github.com/CrowCpp/Crow/releases/tag/v1.3.3

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(From OE-Core rev: 6034c7f14f)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:40 +05:30
Hetvi Thakar c25089f12e python3-virtualenv: Ignore CVE-2026-113724 
Analysis:
- The advisory [1] describes a deletion-error callback changing the
  permissions of a symlink target.
- In 21.2.1, safe_delete() always passes ignore_errors=True to
  shutil.rmtree(), which disables the supplied error callback.
  This remains true after the existing security backports.
- Upstream enabled that callback later in [2]. The chmod recovery
  path fixed by [3] is therefore unreachable in this recipe.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq
[2] https://github.com/pypa/virtualenv/pull/3222
[3] https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:39 +05:30
Hetvi Thakar c50217eae4 python3-virtualenv: Ignore CVE-2026-113718 
Analysis:
- The advisory [1] limits this issue to Xonsh activation in versions
  21.3.0 through 21.14.8.
- Version 21.2.1 has no Xonsh activator, activate.xsh template or
  registered entry point. None of the existing backports adds them.
- The upstream fix [2] changes the absent Xonsh quoting code, so it
  is not applicable to this recipe.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf
[2] https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:39 +05:30
Hetvi Thakar 45909e98d3 python3-virtualenv: Ignore CVE-2026-102937 
Analysis:
- The advisory [1] describes command injection when Windows cmd.exe
  executes a generated activate.bat file.
- BatchActivator.supports() rejects Linux interpreters, so the Linux
  CLI does not select this activator.
- Limit the status to Linux TARGET_OS values. Leave other platforms,
  including MinGW SDK builds, unexcluded.
- The upstream fix is [2]; no backport is needed for Linux activation.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q
[2] https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:38 +05:30
Hetvi Thakar be26025948 python3-virtualenv: fix CVE-2026-113713 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Always copy seed packages from temporary app-data,
including when environment or configuration values enable symlinks.
This keeps the environment usable after the temporary cache is removed.

Although NVD lists releases from 21.14.8, the project advisory [3]
traces the incomplete guard to 20.0.6. The same unguarded constructor
is present in 21.2.1, where the upstream regression tests reproduce
dangling pip links after temporary-cache cleanup.

[1] https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113713
[3] https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:38 +05:30
Hetvi Thakar 021ed63fde python3-virtualenv: fix CVE-2026-113722 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Preserve interpreter paths as literal data in
POSIX console launchers for both the app-data and pip seeders, and
update the pip launchers' RECORD hashes after rewriting them.

Include the RECORD-writing follow-up from [3] so the new rewrite path
replaces existing links and uses exclusive creation. The required
write_file helper comes from the preceding CVE-2026-113721 fix [4].

Regenerate existing environments to repair their launchers. A later
independent pip install or upgrade can replace the corrected launchers;
this backport does not modify pip's vendored distlib.

[1] https://github.com/pypa/virtualenv/commit/2519941bed33ee0d3ac99277f67913e439e476a9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113722
[3] https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4
[4] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:09:32 +05:30
Hetvi Thakar d54f2315dd python3-virtualenv: fix CVE-2026-113716 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Replace linked output-directory components before
creating interpreter, library and activation files. Reuse ensure_within
from the preceding CVE-2026-113721 backport [3].

[1] https://github.com/pypa/virtualenv/commit/554d9f9d4f7758f5cf53f993031e29787f1f74c5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113716
[3] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:08:23 +05:30
Hetvi Thakar 15567524b8 python3-virtualenv: fix CVE-2026-113721 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Replace existing symbolic and hard links before
writing generated files, and create the replacement files exclusively.
Prepare the stdlib venv executable directory before it writes files.

[1] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113721

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:07:13 +05:30
Hetvi Thakar 90f0e58d3d python3-virtualenv: fix CVE-2026-113719 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Restrict seed-package metadata cleanup to entries
inside the environment, without deleting the environment itself or
directories containing the metadata. Unlink final symlinks without
following their targets.

[1] https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113719

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:04:50 +05:30
Hetvi Thakar f11354004d python3-virtualenv: fix CVE-2026-113720 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Apply the current umask when copying interpreter
and seed-package files instead of inheriting cached permission bits.
Do not grant group or world write access to copied files.

[1] https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:03:45 +05:30
Hetvi Thakar 2d3e0c1b5d python3-virtualenv: fix CVE-2026-113715 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Reject line boundaries in stdlib venv paths and
regenerate pyvenv.cfg from the selected interpreter and options,
instead of merging potentially injected configuration read back from
the intermediate file.

[1] https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:02:16 +05:30
Hetvi Thakar 8d74b1295e python3-virtualenv: fix CVE-2026-113723 
Backport the upstream prompt-handling fix [1] identified by advisory
[3]. Preserve literal prompts across Bash compatibility modes and
leave PS1 unchanged in unsupported POSIX shells.

Include follow-up [2], identified by advisory [4], so later prompt
option changes and child shells cannot execute the stored prompt.
This also fixes CVE-2026-115586, a regression in the initial fix.
Keep only the required Bash/Zsh security changes and regression tests.

[1] https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22
[2] https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4
[3] https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp
[4] https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:00:59 +05:30
Hetvi Thakar e11dc337c9 python3-virtualenv: fix CVE-2026-113725 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Escape the Bash prompt for both its backslash
decoding and expansion passes so backslashes cannot undo quoting.

[1] https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-vxj4-q4g9-crj7

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:59:13 +05:30
Hetvi Thakar 46b8c6fa8f python3-virtualenv: fix CVE-2026-113726 
Backport the upstream Zsh prompt fix [1] identified by advisory [3].
Include prerequisite [2] to provide the prompt-escaping block and
regression-test fixture that the fix uses but 21.2.1 does not contain.

Escape prompt values before Zsh expands PS1, including when
PROMPT_SUBST is enabled after activation, and preserve literal percent
signs in the displayed environment name.

[1] https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2
[2] https://github.com/pypa/virtualenv/commit/a70c1dac43e2ee7e618132b572072395af5d8a9b
[3] https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:57:54 +05:30
Hetvi Thakar 936c732252 python3-virtualenv: fix CVE-2026-113776 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Replace activation-template placeholders in a
single pass so placeholder names inside substituted paths or prompts
cannot be expanded again as script content.

[1] https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:56:42 +05:30
Hetvi Thakar ad862d2df7 python3-virtualenv: fix CVE-2026-113732 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Use Fish-specific quoting so backslashes and
quotes in an environment path or prompt remain literal data.

Include follow-up [3], released in [4], to preserve apostrophes and
backslashes after multibyte text in Fish 3 legacy locales. Keep the
upstream GBK and UTF-8 regression tests.

[1] https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q
[3] https://github.com/pypa/virtualenv/commit/685435d7fb53da12da99e195ee2753f5ca083249
[4] https://github.com/pypa/virtualenv/releases/tag/21.14.9

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:55:34 +05:30