Commit Graph
38539 Commits
Author SHA1 Message Date
Ankur Tyagi d4895367f5 flatcc: patch CVE-2026-90786
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-90786

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:59 +05:30
Ankur Tyagi 9998adb090 colord: ignore CVE-2026-85062
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85062

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:57 +05:30
Ankur Tyagi 2b3f5cbbd8 cjson: patch CVE-2026-87933
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-87933

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:56 +05:30
Ankur Tyagi 2cbb8e4840 cjose: mark CVE-2026-53938 and CVE-2026-53939 fixed
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-53938
https://nvd.nist.gov/vuln/detail/cve-2026-53939

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:55 +05:30
Ankur Tyagi a583322516 c-ares: mark CVEs fixed
CVE-2026-33630, CVE-2026-69184 and CVE-2026-69186 were fixed in v1.34.7[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-33630
https://nvd.nist.gov/vuln/detail/cve-2026-69184
https://nvd.nist.gov/vuln/detail/cve-2026-69186

[1]https://github.com/c-ares/c-ares/releases/tag/v1.34.7

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:54 +05:30
Aravind Bandari bd934ab65f python3-pillow: fix CVE-2026-59204
Pillow 8.2.0 through 12.2.0 accumulates total_component_width across
every tile in a JPEG2000 image instead of recomputing it per tile,
allowing a crafted tiled JPEG2000 file to force substantially higher
transient memory usage and trigger out-of-memory failures during
decoding.

Calculate JPEG2000 total_component_width for each tile in isolation.

Backport the patch to fix CVE-2026-59204
https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-59204

Signed-off-by: Aravind Bandari <aravind.bandari@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:53 +05:30
Sana Kazi e4571afb05 avro-c++: Use fmt from oe-core instead of bundling fmt 10.2.1
avro-c++'s CMakeLists.txt calls find_package(fmt) and only falls
back to fetching fmt 10.2.1 via FetchContent if fmt isn't found.
The recipe never added fmt to DEPENDS, so find_package fallback
is always triggered. The recipe then had to stage it into
${B}/_deps/fmt-src.

oe-core already provides fmt_12.1.0), and avro-c++ only
uses a small, stable part of its API (fmt::format_string,
fmt::format, fmt::formatter<T>) that is unchanged between 10.x and
12.x.

Add fmt to DEPENDS so find_package(fmt) succeeds and avro-c++ links
oe-core's fmt instead, and drop the fmt SRC_URI, SRCREV_fmt and
do_configure:prepend().

Signed-off-by: Sana Kazi <Kazi.S@bmwtechworks.in>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:52 +05:30
Viswanath Kraleti 866f1c6284 libfastjson: switch git branch from master to main
Update SRC_URI to use the 'main' branch instead of 'master' since
the upstream GitHub repository has renamed its default branch.

Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 1a742957c1)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:51 +05:30
Aravind Bandari de904fbb90 python3-pillow: fix CVE-2026-54058
Pillow prior to 12.3.0, when loading an uncompressed McIdas AREA image
through the mmap raw codec path, allows an attacker-controlled row stride
smaller than the natural row width, causing pixel access to read beyond the
mapped region and disclose adjacent process memory or fault.

Ensure the map stride is at least one full row of pixels.

Backport the patch to fix CVE-2026-54058
https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-54058

Signed-off-by: Aravind Bandari <aravind.bandari@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:50 +05:30
Ankur Tyagi b48b8d52fe python3-tornado: mark CVEs fixed
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49853
https://nvd.nist.gov/vuln/detail/cve-2026-49854
https://nvd.nist.gov/vuln/detail/cve-2026-49855

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:49 +05:30
Ankur Tyagi c6d34c3765 python3-sqlparse: patch CVE-2026-71491
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-71491

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:48 +05:30
Ankur Tyagi d17a7718d4 python3-sqlparse: patch CVE-2026-59894
Backport commit associated with GitHub advisory.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59894

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:47 +05:30
Ankur Tyagi 2fa32e5e27 python3-sqlparse: patch CVE-2026-59893
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59893

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:46 +05:30
Ankur Tyagi bf592926cd python3-sqlparse: patch CVE-2026-54284
Detais:
https://nvd.nist.gov/vuln/detail/cve-2026-54284

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:45 +05:30
Ankur Tyagi 0bfdd495a4 python3-marshmallow: mark CVE-2025-68480 fixed
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-68480

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:44 +05:30
Ankur Tyagi 47b2ce9cc7 python3-eventlet: mark CVE-2023-29483 fixed
Fix[1] for the CVE is part of the upstream version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-29483

[1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:43 +05:30
Ankur Tyagi e4f07cb75d python3-django: upgrade 6.0.7 -> 6.0.8
Also revert bump in the minimum setuptools version.

Release Notes:
https://docs.djangoproject.com/en/dev/releases/6.0.8/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:42 +05:30
Peter Marko 5f4b6c3c61 polkit: patch CVE-2026-4897 and CVE-2026-85498
Pick patches mentioning these CVEs in their commit messages.
Note that patch for CVE-2026-4897 introduces CVE-2026-85498.
Also pick additional patch introduced between these commits which
touches the added code so the final patch applies cleanly.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:41 +05:30
Peter Marko 46f6e32a2e recipes: correct homepage
Leading space leads to SPDX document validation errors for url in
some tools.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(From meta-oe rev: 64dcb55dc5)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:40 +05:30
Peter Marko 53f2c85097 msgpack-c: patch CVE-2026-72854
Pick patch from [1] linked from [2] mentioned in [3].
Drop version bump related changes.

[1] https://github.com/msgpack/msgpack-c/pull/1182/commits
[2] https://github.com/msgpack/msgpack-c/issues/1181
[3] https://nvd.nist.gov/vuln/detail/cve-2026-72854

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:39 +05:30
Devansh Patel 9ca5620389 python3-py: correct CVE_PRODUCT mapping
The product-only "py" mapping generates a wildcard-vendor identity
instead of the exact NVD identity for the packaged pytest-dev py
source. Use "pytest:py" for its NVD dictionary CPE and configuration
matches.

This changes the generated product identity. With sbom-cve-check 1.3.3,
the current CVE report is unchanged using the pinned database snapshots;
both mappings report CVE-2020-29651 and CVE-2022-42969.

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 26fa8b053b)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:38 +05:30
Khem Raj 4ee9312479 openvpn: upgrade 2.7.0 -> 2.7.5
Upgrade openvpn from 2.7.0 to 2.7.5.

Changes:
* Drop 0001-tests-skip-test-execution-when-cross-compiling.patch
  This release already guards the auth-pam unit test TESTS assignment with
  "if !CROSS_COMPILING" in tests/unit_tests/plugins/auth-pam/Makefile.am
* Drop CVE-2026-40215.patch - fixed upstream in 2.7.2.
* Drop CVE-2026-13117.patch - fixed upstream in 2.7.5.

Security fixes included in this upgrade:

Fixed in 2.7.2:
* CVE-2026-40215: race condition in TLS handshake that could leak
  packet data from a previous handshake
* CVE-2026-35058: server ASSERT() on a malformed packet with a valid
  tls-crypt-v2 key

Fixed in 2.7.5:
* CVE-2026-13379: openvpnserv (Windows) DNS SearchList state pollution
* CVE-2026-12996: use-after-free in ack_write_buf()
* CVE-2026-13117: use-after-free in tls_wrap_reneg()
* CVE-2026-13122: server crash on malformed auth-token
* CVE-2026-12932: memory leak in tls-crypt-v2 client key handling
* CVE-2026-11771: 1-byte buffer overrun on NTLMv2 proxy responses
* CVE-2026-13698: memory leak on tls-crypt-v2 packets

Release notes:
https://github.com/openvpn/openvpn/releases

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Omkar Patil <OmkarAbaji.Patil@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:36 +05:30
Louis Rannou b1740f6665 openvpn: create an extra package for the dns-updown script
The dns-updown script is written in bash which is under the GPLv3
license. As this script is optional, it is preferred to have it in an extra
package.

Signed-off-by: Louis Rannou <louis.rannou@non.se.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Signed-off-by: Omkar Patil <OmkarAbaji.Patil@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-10-05 14:40:35 +05:30
Ankur Tyagi 47d7dbdd10 unbound: patch CVE-2026-56444
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56444

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:05 +05:30
Ankur Tyagi b03acb631b unbound: patch CVE-2026-56416
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56416

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:04 +05:30
Ankur Tyagi 5401a83771 unbound: patch CVE-2026-55991
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55991

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:04 +05:30
Ankur Tyagi b18b97d782 unbound: patch CVE-2026-55990
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55990

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:03 +05:30
Ankur Tyagi 5d932adbde unbound: patch CVE-2026-55973
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55973

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:03 +05:30
Ankur Tyagi 44c0618c07 unbound: patch CVE-2026-55717
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55717

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:02 +05:30
Ankur Tyagi 7f1398a6c4 unbound: patch CVE-2026-55708
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55708

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:02 +05:30
Ankur Tyagi 1cede7d75e unbound: patch CVE-2026-54478
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54478

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:01 +05:30
Ankur Tyagi e88cf8a339 unbound: patch CVE-2026-52863
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-52863

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:01 +05:30
Ankur Tyagi 9cf83c6ad4 unbound: patch CVE-2026-50252
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50252

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:01 +05:30
Ankur Tyagi ad6d182534 unbound: patch CVE-2026-50251
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50251

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:00 +05:30
Ankur Tyagi 252dc099d1 unbound: patch CVE-2026-50248
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50248

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:14:00 +05:30
Ankur Tyagi a20f5dc9d3 unbound: patch CVE-2026-50243
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50243

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:59 +05:30
Ankur Tyagi 394ec2adfb unbound: patch CVE-2026-50046
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50046

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:59 +05:30
Ankur Tyagi 5333e61d4f unbound: patch CVE-2026-50045
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50045

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:58 +05:30
Ankur Tyagi 04efaf8876 unbound: patch CVE-2026-44687
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44687

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:58 +05:30
Ankur Tyagi 83e98ed1a1 unbound: patch CVE-2026-44621
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44621

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:57 +05:30
Ankur Tyagi c805d76db2 unbound: patch CVE-2026-42955
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-42955

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:57 +05:30
Ankur Tyagi 8792c7f818 unbound: patch CVE-2026-32665
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32665

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:56 +05:30
Ankur Tyagi e7aac6e2ec unbound: patch CVE-2026-46582
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-46582

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:56 +05:30
Ankur Tyagi 9af75c4481 unbound: patch CVE-2026-44608
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44608

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:55 +05:30
Ankur Tyagi e9a946d263 unbound: patch CVE-2026-44390
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44390

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:55 +05:30
Ankur Tyagi 1c4d899d2d unbound: patch CVE-2026-42960
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-42960

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:55 +05:30
Ankur Tyagi 5d793b6ca9 unbound: patch CVE-2026-42923
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-42923

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:54 +05:30
Ankur Tyagi 11bc965378 unbound: patch CVE-2026-42534
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-42534

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:54 +05:30
Ankur Tyagi 565166d088 unbound: patch CVE-2026-41292
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41292

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:53 +05:30
Ankur Tyagi 7e47245343 unbound: patch CVE-2026-40622
Also backport TTL_IS_EXPIRED macro introduced by commit:
https://github.com/NLnetLabs/unbound/commit/73e408f1d0792267429e9f5f89537cda61297952

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-40622

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:53 +05:30