The default product-only mapping generates a vendor-wildcard CPE. php:php
is the active NVD dictionary CPE and configuration identity. php_group:php
preserves historical NVD configurations and current authoritative PHP
Security CNA affected data for the same php-src source; it is not an NVD
dictionary CPE.
This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 731-entry CVE report unchanged, with no
current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 4b8eedb7d2)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The product-only "twisted" value emits a wildcard-vendor identity
instead of the active identity assigned to the packaged Twisted source.
Use "twisted:twisted" for its NVD dictionary CPE, NVD configuration,
and CNA affected-data identities. With sbom-cve-check 1.3.3 and the
pinned database snapshots, the generated product identity changes; the
current CVE report is unchanged.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2aa82f4b33)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
Use jq_project:jq for the historical NVD dictionary CPE and configuration
identity carrying two jq 1.5 CVEs, and jqlang:jq for the active NVD
dictionary CPE and configuration identity plus CNA affected-data identity
used by the current upstream.
This changes the generated identities to two exact CPEs, but the frozen
sbom-cve-check database leaves the 26-entry CVE report unchanged, with no
current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 5d23770adc)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The default product-only mapping generates vendor-wildcard CPEs for the
recipe's Simon Kelley source. dnsmasq:dnsmasq is an NVD configuration
identity and CNA affected-data identity; the_kelleys:dnsmasq is an NVD
configuration identity; and thekelleys:dnsmasq is an active NVD
dictionary CPE and configuration identity with CNA affected-data records.
This changes the generated product identities. With the frozen
sbom-cve-check database, the 48-entry CVE report is unchanged, so this is
an identity correction with no CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 8dffafdd1d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The default product-only mapping generates a vendor-wildcard CPE.
nlnetlabs:ldns is the active NVD dictionary CPE and configuration
identity for the packaged NLnet Labs source.
This changes the generated product identity to an exact CPE, but the
frozen sbom-cve-check database leaves the eight-entry CVE report
unchanged, with no current CVE delta.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit fe530d55ef)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upgrade to release 2026.4:
- Canada's Northwest Territories moved to permanent -06 on
2026-08-21.
- Obsolescent settings like TZ="EST5EDT" now conform better to
POSIX.
- Fix security, performance and porting bugs in zic and localtime.
This work was sponsored by GOVCERT.LU.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 76eef1fd48)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
avro-c++'s CMakeLists.txt calls find_package(fmt) and only falls
back to fetching fmt 10.2.1 via FetchContent if fmt isn't found.
The recipe never added fmt to DEPENDS, so find_package fallback
is always triggered. The recipe then had to stage it into
${B}/_deps/fmt-src.
oe-core already provides fmt_12.1.0), and avro-c++ only
uses a small, stable part of its API (fmt::format_string,
fmt::format, fmt::formatter<T>) that is unchanged between 10.x and
12.x.
Add fmt to DEPENDS so find_package(fmt) succeeds and avro-c++ links
oe-core's fmt instead, and drop the fmt SRC_URI, SRCREV_fmt and
do_configure:prepend().
Signed-off-by: Sana Kazi <Kazi.S@bmwtechworks.in>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Pick patches mentioning these CVEs in their commit messages.
Note that patch for CVE-2026-4897 introduces CVE-2026-85498.
Also pick additional patch introduced between these commits which
touches the added code so the final patch applies cleanly.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The product-only "py" mapping generates a wildcard-vendor identity
instead of the exact NVD identity for the packaged pytest-dev py
source. Use "pytest:py" for its NVD dictionary CPE and configuration
matches.
This changes the generated product identity. With sbom-cve-check 1.3.3,
the current CVE report is unchanged using the pinned database snapshots;
both mappings report CVE-2020-29651 and CVE-2022-42969.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 26fa8b053b)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upgrade openvpn from 2.7.0 to 2.7.5.
Changes:
* Drop 0001-tests-skip-test-execution-when-cross-compiling.patch
This release already guards the auth-pam unit test TESTS assignment with
"if !CROSS_COMPILING" in tests/unit_tests/plugins/auth-pam/Makefile.am
* Drop CVE-2026-40215.patch - fixed upstream in 2.7.2.
* Drop CVE-2026-13117.patch - fixed upstream in 2.7.5.
Security fixes included in this upgrade:
Fixed in 2.7.2:
* CVE-2026-40215: race condition in TLS handshake that could leak
packet data from a previous handshake
* CVE-2026-35058: server ASSERT() on a malformed packet with a valid
tls-crypt-v2 key
Fixed in 2.7.5:
* CVE-2026-13379: openvpnserv (Windows) DNS SearchList state pollution
* CVE-2026-12996: use-after-free in ack_write_buf()
* CVE-2026-13117: use-after-free in tls_wrap_reneg()
* CVE-2026-13122: server crash on malformed auth-token
* CVE-2026-12932: memory leak in tls-crypt-v2 client key handling
* CVE-2026-11771: 1-byte buffer overrun on NTLMv2 proxy responses
* CVE-2026-13698: memory leak on tls-crypt-v2 packets
Release notes:
https://github.com/openvpn/openvpn/releases
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Omkar Patil <OmkarAbaji.Patil@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Devansh Patel
Ankur Tyagi
Leon Anavi
Nate Kent
Wang Mingyu
Aravind Bandari
Sana Kazi
Viswanath Kraleti
Peter Marko
Khem Raj
Louis Rannou