mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 15:47:23 +00:00
Code Issues Projects Releases Wiki Activity
38,738 Commits 65 Branches 0 Tags
c50217eae41f3030469f5ca7bb1e2200135fa3ed
Commit Graph
38738 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Hetvi Thakar c50217eae4 python3-virtualenv: Ignore CVE-2026-113718 
Analysis:
- The advisory [1] limits this issue to Xonsh activation in versions
  21.3.0 through 21.14.8.
- Version 21.2.1 has no Xonsh activator, activate.xsh template or
  registered entry point. None of the existing backports adds them.
- The upstream fix [2] changes the absent Xonsh quoting code, so it
  is not applicable to this recipe.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf
[2] https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:39 +05:30
Hetvi Thakar 45909e98d3 python3-virtualenv: Ignore CVE-2026-102937 
Analysis:
- The advisory [1] describes command injection when Windows cmd.exe
  executes a generated activate.bat file.
- BatchActivator.supports() rejects Linux interpreters, so the Linux
  CLI does not select this activator.
- Limit the status to Linux TARGET_OS values. Leave other platforms,
  including MinGW SDK builds, unexcluded.
- The upstream fix is [2]; no backport is needed for Linux activation.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q
[2] https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:38 +05:30
Hetvi Thakar be26025948 python3-virtualenv: fix CVE-2026-113713 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Always copy seed packages from temporary app-data,
including when environment or configuration values enable symlinks.
This keeps the environment usable after the temporary cache is removed.

Although NVD lists releases from 21.14.8, the project advisory [3]
traces the incomplete guard to 20.0.6. The same unguarded constructor
is present in 21.2.1, where the upstream regression tests reproduce
dangling pip links after temporary-cache cleanup.

[1] https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113713
[3] https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:38 +05:30
Hetvi Thakar 021ed63fde python3-virtualenv: fix CVE-2026-113722 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Preserve interpreter paths as literal data in
POSIX console launchers for both the app-data and pip seeders, and
update the pip launchers' RECORD hashes after rewriting them.

Include the RECORD-writing follow-up from [3] so the new rewrite path
replaces existing links and uses exclusive creation. The required
write_file helper comes from the preceding CVE-2026-113721 fix [4].

Regenerate existing environments to repair their launchers. A later
independent pip install or upgrade can replace the corrected launchers;
this backport does not modify pip's vendored distlib.

[1] https://github.com/pypa/virtualenv/commit/2519941bed33ee0d3ac99277f67913e439e476a9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113722
[3] https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4
[4] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:09:32 +05:30
Hetvi Thakar d54f2315dd python3-virtualenv: fix CVE-2026-113716 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Replace linked output-directory components before
creating interpreter, library and activation files. Reuse ensure_within
from the preceding CVE-2026-113721 backport [3].

[1] https://github.com/pypa/virtualenv/commit/554d9f9d4f7758f5cf53f993031e29787f1f74c5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113716
[3] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:08:23 +05:30
Hetvi Thakar 15567524b8 python3-virtualenv: fix CVE-2026-113721 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Replace existing symbolic and hard links before
writing generated files, and create the replacement files exclusively.
Prepare the stdlib venv executable directory before it writes files.

[1] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113721

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:07:13 +05:30
Hetvi Thakar 90f0e58d3d python3-virtualenv: fix CVE-2026-113719 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Restrict seed-package metadata cleanup to entries
inside the environment, without deleting the environment itself or
directories containing the metadata. Unlink final symlinks without
following their targets.

[1] https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113719

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:04:50 +05:30
Hetvi Thakar f11354004d python3-virtualenv: fix CVE-2026-113720 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Apply the current umask when copying interpreter
and seed-package files instead of inheriting cached permission bits.
Do not grant group or world write access to copied files.

[1] https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:03:45 +05:30
Hetvi Thakar 2d3e0c1b5d python3-virtualenv: fix CVE-2026-113715 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Reject line boundaries in stdlib venv paths and
regenerate pyvenv.cfg from the selected interpreter and options,
instead of merging potentially injected configuration read back from
the intermediate file.

[1] https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:02:16 +05:30
Hetvi Thakar 8d74b1295e python3-virtualenv: fix CVE-2026-113723 
Backport the upstream prompt-handling fix [1] identified by advisory
[3]. Preserve literal prompts across Bash compatibility modes and
leave PS1 unchanged in unsupported POSIX shells.

Include follow-up [2], identified by advisory [4], so later prompt
option changes and child shells cannot execute the stored prompt.
This also fixes CVE-2026-115586, a regression in the initial fix.
Keep only the required Bash/Zsh security changes and regression tests.

[1] https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22
[2] https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4
[3] https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp
[4] https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:00:59 +05:30
Hetvi Thakar e11dc337c9 python3-virtualenv: fix CVE-2026-113725 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Escape the Bash prompt for both its backslash
decoding and expansion passes so backslashes cannot undo quoting.

[1] https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-vxj4-q4g9-crj7

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:59:13 +05:30
Hetvi Thakar 46b8c6fa8f python3-virtualenv: fix CVE-2026-113726 
Backport the upstream Zsh prompt fix [1] identified by advisory [3].
Include prerequisite [2] to provide the prompt-escaping block and
regression-test fixture that the fix uses but 21.2.1 does not contain.

Escape prompt values before Zsh expands PS1, including when
PROMPT_SUBST is enabled after activation, and preserve literal percent
signs in the displayed environment name.

[1] https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2
[2] https://github.com/pypa/virtualenv/commit/a70c1dac43e2ee7e618132b572072395af5d8a9b
[3] https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:57:54 +05:30
Hetvi Thakar 936c732252 python3-virtualenv: fix CVE-2026-113776 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Replace activation-template placeholders in a
single pass so placeholder names inside substituted paths or prompts
cannot be expanded again as script content.

[1] https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:56:42 +05:30
Hetvi Thakar ad862d2df7 python3-virtualenv: fix CVE-2026-113732 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Use Fish-specific quoting so backslashes and
quotes in an environment path or prompt remain literal data.

Include follow-up [3], released in [4], to preserve apostrophes and
backslashes after multibyte text in Fish 3 legacy locales. Keep the
upstream GBK and UTF-8 regression tests.

[1] https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q
[3] https://github.com/pypa/virtualenv/commit/685435d7fb53da12da99e195ee2753f5ca083249
[4] https://github.com/pypa/virtualenv/releases/tag/21.14.9

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:55:34 +05:30
Hetvi Thakar abb85935fe python3-virtualenv: fix CVE-2026-102925 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Remove the extra template quotes around values
that are already quoted for Bash and Fish activation scripts.

[1] https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:53:52 +05:30
Hetvi Thakar 2f89f21927 python3-virtualenv: fix CVE-2026-102930 
Backport the seed-wheel digest check [1], as identified by advisory
[5]. Include prerequisite [2] so the expected digests are obtained
over verified HTTPS, and follow-up [3] so missing digests cannot
silently disable verification.

Include follow-up [4] to verify wheels in private staging before
caching them and to use the same verification for the pip seeder.
This also fixes CVE-2026-113714 and CVE-2026-113717, tracked in [6]
and [7]. Apply the TLS prerequisite before the three wheel fixes.

Add python3-packaging for the upstream wheel-name and version checks.
Keep virtualenv at version 21.2.1 without unrelated feature changes.

[1] https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d
[2] https://github.com/pypa/virtualenv/commit/48f6fdcc14b8654236f9081adbff10a32f536940
[3] https://github.com/pypa/virtualenv/commit/91460add8f53f4654c4aae3898e739c03fb69946
[4] https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96
[5] https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45
[6] https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3
[7] https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:49:43 +05:30
Hetvi Thakar a0db4b52e9 python3-virtualenv: fix CVE-2026-102938 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Keep pyvenv.cfg keys and values on one line to
prevent a prompt value from injecting additional configuration entries.

[1] https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:47:32 +05:30
Darsh Kelaiya 2624b7628e ntfs-3g-ntfsprogs: mark CVE-2026-56136 as fixed 
The three index validation patches already included for CVE-2026-46572
and CVE-2026-42617 also provide the complete CVE-2026-56136 fix [1-3].
Their combined source changes match Tuxera's 2022.10.3 backport linked
from the advisory [4]. Add the missing CVE tag to each patch so
cve-check recognises the existing fix.

[1] https://github.com/tuxera/ntfs-3g/commit/2ead8a3ccf940c0219ffba587fab54e21462b3a5
[2] https://github.com/tuxera/ntfs-3g/commit/dfd1a7c6eb23a22238ec193451fa59c989b4381f
[3] https://github.com/tuxera/ntfs-3g/commit/edf2b892356684ca8f2fc5898943c7a9b90ffb80
[4] https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-r66g-c39x-cw95

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:45 +05:30
Darsh Kelaiya 2e96e418e8 ntfs-3g-ntfsprogs: fix CVE-2026-56135 
Apply the upstream ACL inheritance sizing fix and its validation and
sizing follow-ups [1-3], then limit repeated creator-owner and
creator-group substitutions with [4]. The advisory is referenced in [5].

The sizing helper stops at the declared ACL size, while descriptor
validation and inheritance may process additional ACEs. The follow-up
guard bounds substitutions independently of that sizing walk.

[1] https://github.com/tuxera/ntfs-3g/commit/289ebcf3dfbed422181cbfa524d75e32d9c59bd3
[2] https://github.com/tuxera/ntfs-3g/commit/21f37bb5efa874b4e1212f499ca643d69f024021
[3] https://github.com/tuxera/ntfs-3g/commit/b0b9c32c7ff0fb0eac1eb9272da2ed10ae51a3b9
[4] https://github.com/tuxera/ntfs-3g/commit/98b153894bb3cc75cd13179a108eef9feda35422
[5] https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-c9qg-fh4v-mq8r

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:44 +05:30
Yogita Urade 2332d83cbd python3-pymongo: Fix CVE-2026-106435 
This patch applies the upstream fix as referenced in [3],
using the commit shown in [1] and regression commit from [2].

Follow up the PYTHON-6110 CVE fix: its regex flags scan leaves a
one-byte boundary error after consuming the pattern terminator.
Apply PYTHON-6111's correction and terminator-overlap regression test.

[1] https://github.com/mongodb/mongo-python-driver/commit/bb8d4e195275e75bd94ebeffb53cc747d357fcf4
[2] https://github.com/mongodb/mongo-python-driver/commit/b5a36ccbdb97298fbf9b5b5767affe92c534461f
[3] https://jira.mongodb.org/browse/PYTHON-6110
[4] https://jira.mongodb.org/browse/PYTHON-6111

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:44 +05:30
Yogita Urade a5890d9b37 python3-pymongo: Fix CVE-2026-88029 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/mongodb/mongo-python-driver/commit/fa676586ba4b399168a4d1d41c30dc2166cc44fd
[2] https://jira.mongodb.org/browse/PYTHON-5994

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:43 +05:30
Yogita Urade 96b34e5296 python3-tornado: Fix CVE-2026-116578 
This patch applies the upstream fix as referenced in [4],
using the commit shown in [1], [2] and [3].

[1] https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233
[2] https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035
[3] https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-116578

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:43 +05:30
Yogita Urade bf1ca462d0 python3-tornado: Fix CVE-2026-116577 
This patch applies the upstream fix as referenced in [4],
using the commit shown in [1], [2] and [3].

[1] https://github.com/tornadoweb/tornado/commit/1b7a1dc9f340f52de929852e8125aa12f25297c9
[2] https://github.com/tornadoweb/tornado/commit/09591f65286a600c2196df9c33b792b889a6bccb
[3] https://github.com/tornadoweb/tornado/commit/3ef5ec3fc7a158ecd0ca7bfc5fcee42fa2773094
[4] https://github.com/tornadoweb/tornado/pull/3765
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-116577

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:42 +05:30
Yogita Urade 2248ece66b python3-tornado: Fix CVE-2026-115927 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/tornadoweb/tornado/commit/ceab33581489751a66fba8566ad6d5960d4b01c8
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-115927

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:42 +05:30
Yogita Urade d9af8ff1b7 python3-tornado: Fix CVE-2026-103263 
This patch applies the upstream fix as referenced in [3],
using the commit shown in [1] and dependent commit from [2].

Required companion fix for CVE-2026-103263: The symlink-hardening
backport adds allowed_symlink_directory, but subclasses that
override initialize() without calling the base method do not
set it and fail with AttributeError. Include upstream commit
6bd9c4e0 and its regression tests with the CVE fix.

[1] https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32
[2] https://github.com/tornadoweb/tornado/commit/6bd9c4e0fc10ae743006cd6a97543d15050f9594
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-103263
[4] https://github.com/tornadoweb/tornado/issues/3724

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:41 +05:30
Yogita Urade 0f404d57f0 python3-tornado: Fix CVE-2026-103262 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-103262

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:41 +05:30
Yogita Urade 30603fc2bc python3-tornado: Fix CVE-2026-103261 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-103261

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:40 +05:30
Darsh Kelaiya 131bcf4881 libhtml-parser-perl: fix CVE-2026-8829 
This patch applies the upstream fix [1] for CVE-2026-8829
as shown in the advisory identifying the fix [2].

[1] https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c
[2] https://nvd.nist.gov/vuln/detail/cve-2026-8829

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:40 +05:30
Ashishkumar Parmar a725022e5a nmap: Fix CVE-2026-72712 
This patch applies the upstream nmap master backport for
CVE-2026-72712 to the Wrynose nmap 7.95 recipe. The upstream
fix commit is referenced in [1], and the public CVE advisory
is referenced in [2].

[1] https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a
[2] https://github.com/advisories/GHSA-7j7x-fg87-hwwg

Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:40 +05:30
Ankur Tyagi fffd174aef wireshark: upgrade 4.6.8 -> 4.6.9 
Release Notes:
https://www.wireshark.org/docs/relnotes/wireshark-4.6.9.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 650ced113c)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:39 +05:30
Peter Marko a4b37c2e4d libwebsockets: patch CVE-2026-114550 
Pick patch mentioned in NVD CVE report.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:39 +05:30
Hetvi Thakar efef6062ef nginx: fix CVE-2026-15176 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/ce1da78900b07e72f37a25f55e6606220ac45902
[2] https://ubuntu.com/security/CVE-2026-15176

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:38 +05:30
Hetvi Thakar 7ad10cb7c3 nginx: fix CVE-2026-97629 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/fdedba031bf1ad6a80c61b1aec1418d1a87ae296
[2] https://ubuntu.com/security/CVE-2026-97629

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:38 +05:30
Hetvi Thakar ba349a44f9 nginx: fix CVE-2026-95101 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/90b30edffea4f427608c36e3849643b6f9841bc4
[2] https://ubuntu.com/security/CVE-2026-95101

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:37 +05:30
Jason Schonberg b2cc77d681 nodejs: 22.23.3 -> 22.23.4 
This is the October 2026 security release.

  4 high severity issues.
  3 medium severity issues.
  3 low severity issue.

High severity issues.
  CVE-2026-105482
  CVE-2026-105483
  CVE-2026-106069
  CVE-2026-111497

Medium severity issues.
  CVE-2026-105481
  CVE-2026-106072
  CVE-2026-106074

Low severity issues.
  CVE-2026-106070 (affects only nodejs v26)
  CVE-2026-106071 (affects only nodejs v26)
  CVE-2026-106073

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Changelog: https://github.com/nodejs/node/releases/tag/v22.23.4

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:37 +05:30
Ankur Tyagi 6397229d31 zchunk: upgrade 1.5.4 -> 1.5.5 
- Fix out-of-bounds read
- Harden multipart download parsing against malicious servers
- Harden chunk decompression and header parsing

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Handle CVE-2026-117556.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:36 +05:30
Wang Mingyu 5ee7fc71d3 zchunk: upgrade 1.5.3 -> 1.5.4 
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:36 +05:30
Nate Kent 649d0cf628 nng: correct upstream branch name 
Upstream changed the branch names between the v1.11.0 release and the
v2.0.0 release, which means the old branch is no longer valid and the
fetch will fail.

Signed-off-by: Nate Kent <nate@nkent.net>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:35 +05:30
Khem Raj c734c2cb97 frr: Fix native clippy failing to load libatomic.so.1 
frr's configure links libatomic whenever the toolchain merely has it:

  AC_CHECK_LIB([atomic], [main], [LIBS="$LIBS -latomic"], [], [])

This probe only asks whether -latomic links, never whether frr needs a
symbol from it. On x86-64 the atomics frr uses are inlined, so the
resulting native clippy references no __atomic_* symbol at all, yet
still records a DT_NEEDED on libatomic.so.1.

Nothing prunes it: ASNEEDED is part of TARGET_LDFLAGS only, so native
links get no --as-needed. Nothing can satisfy it either: clippy's
RUNPATH points solely into recipe-sysroot-native, there is no
libatomic-native, and uninative only rewrites the ELF interpreter.

buildtools-extended-tarball ships nativesdk-libatomic, so on hosts using
buildtools (Rocky 8, Alma 8, openSUSE on the autobuilder) the probe
succeeds at link time while the loader cannot find libatomic later, and
the target do_compile dies executing clippy:

  clippy: error while loading shared libraries: libatomic.so.1:
  cannot open shared object file: No such file or directory

Hosts with a system libatomic in the default loader path, such as Ubuntu
with libatomic1 installed, only avoid this by accident.

Link native clippy with --as-needed so the unused libatomic dependency is
dropped, making the frr-native artifact independent of the build host.

Fixes [YOCTO #15590] and [YOCTO #15590]

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 1c1e7a0bc7)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:10 +05:30
Khem Raj b1a1076ed7 pcp: Add readline-native and ncurses-native to pcp-native DEPENDS 
pcp-native compiles the pcp sources src/pmns/lex.l which does
'#include <readline/readline.h>'. The native recipe only depended on
python3/setuptools/flex/bison, so with the header search correctly
limited to the sysroot
0001-configure-Limit-the-header-search-to-sysroot.patch
the build fails on hosts without readline development headers installed:

    lex.l:25:10: fatal error: readline/readline.h: No such file or directory

Depend on readline-native (and ncurses-native, which readline links
against) so the headers and libraries come from the native sysroot
rather than the build host, mirroring the target recipe DEPENDS. This
makes the native build reproducible and host independent.

Verified by building pcp-native from scratch

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 155fd062e2)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:09 +05:30
Leon Anavi 2cdea084dc python3-brotli: Upgrade 1.2.0 -> 1.2.1 
Upgrade to release 1.2.1:

- CVE-2026-111497: out-of-bounds write permits remote code execution

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6a79ef1cfe)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:09 +05:30
Jason Schonberg f9e60cfa13 brotli: upgrade 1.2.0 -> 1.2.1 
This is a security release

CVE-2026-111497: out-of-bounds write permits remote code execution

Changelog: https://github.com/google/brotli/releases/tag/v1.2.1

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit b5d66bf60d)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:08 +05:30
Jason Schonberg 16a64b43a7 php: upgrade 8.5.11 -> 8.5.12 
This is a security update.  Fixes unauthenticated remote code execution.

CVE-2026-109618 CVE-2026-109619

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

Changelog: https://www.php.net/ChangeLog-8.php#8.5.12

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 898ac0ba1c)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:08 +05:30
Jason Schonberg 386cc41749 c-ares: upgrade 1.34.8 -> 1.34.9 
This is a security release.

Memory corruption, buffer overflows, uninitialized memory, use-after-free

Changelog: https://github.com/c-ares/c-ares/releases/tag/v1.34.9

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 556ffbf22a)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:07 +05:30
Primoz Fiser 94fa8a5e9b opencv: rewrite build-tree paths in all CPU-dispatch stub files 
The recipe already rewrote the absolute ${S} path embedded in two
PowerPC VSX3 dispatch stubs (arithm.vsx3.cpp, convert.vsx3.cpp) before
packaging, but OpenCV's cmake ocv_add_dispatched_file() macro generates
one such stub per enabled ISA in every module (avx, avx2, avx512_skx,
sse4_1, sse4_2, neon, ...). On NEON builds this produces further
dispatch stubs under ${B}/modules/dnn/* (layers_common.neon.cpp,
fast_gemm_kernels.neon.cpp, conv_block.neon.cpp) whose #include lines
still embed the raw build-tree path, tripping the buildpaths QA check
once copied verbatim into the opencv-src package.

Generalize the existing sed-based rewrite to find and fix every
generated dispatch stub under ${B}/modules, instead of a hardcoded
two-file list, so any ISA/module combination is covered.

Backport of commit fdfca71954 from the blacksail branch, with the
same fix applied to the still-current 4.13.0 recipe on wrynose.

Signed-off-by: Primoz Fiser <primoz.fiser@norik.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:07 +05:30
Altair Bueno Calvente b5c44ffd58 mdio-tools,mdio-netlink: upgrade 1.3.1 -> 1.3.2 
mdio-tools 1.3.1 fails to link when the lto distro feature is enabled,
because the linker discards the unreferenced command registrations
(wkz/mdio-tools#37). 1.3.2 fixes this by marking them as used and
placing them in a dedicated section kept by a linker script, and also
fixes the VPATH build breakage that change introduced. 1.3.2 also adds
the "mscc" addressing mode for Microchip PHYs.

Backport of master commit 1f465d9d28 ("mdio-tools,mdio-netlink: upgrade
1.3.1 -> 1.3.2,1.3.1 -> 1.3.2").

Fixes: https://github.com/openembedded/meta-openembedded/issues/1075

(cherry picked from commit 1f465d9d28)
AI-Generated: Uses Claude Code
Signed-off-by: Altair Bueno Calvente <abueno@airzonecontrol.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:06 +05:30
Peter Marko 4c10e8346b python3-grpcio: update gRPC repo roots 
See https://emudhra.we-have-a-problem.com/

Use a copy function instead of adding the patch two times becuase there
are two copies of certificates in the sources.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:06 +05:30
Peter Marko 718a3ebe39 grpc: update gRPC repo roots 
See https://emudhra.we-have-a-problem.com/

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:06 +05:30
Peter Marko 38bfc75eab nss: remove compromised eMudhra certificates 
See https://emudhra.we-have-a-problem.com/

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:05 +05:30
Markus Volk 4fac09a43d fwupd: create the fwupd-refresh user 
fwupd-refresh.service runs as fwupd-refresh, which is only declared in
sysusers.d, so do_rootfs warns "User fwupd-refresh has never been
defined". Create it with useradd.

AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c2c8827787)
Signed-off-by: Jose Quaresma <jose.quaresma@oss.qualcomm.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-29 10:19:05 +05:30