mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 15:47:23 +00:00
Code Issues Projects Releases Wiki Activity
31,227 Commits 65 Branches 0 Tags
d51d8d88d80e2da18cca5d1cc98dafae27fdf262
Commit Graph
31227 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Peter Marko d51d8d88d8 squid: patch CVE-2026-61642 
Pick SQUID-2026:6 patch per [1].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-537g-4gfh-w7m6

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:47 +05:30
Peter Marko 6355625b42 squid: patch CVE-2026-50012 
Pick SQUID-2026:5 patch per [1].
Also add compilation error fix per [2].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-5vmx-9x64-9284
[2] https://security-tracker.debian.org/tracker/CVE-2026-50012

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:46 +05:30
Peter Marko 520a186bd7 squid: patch CVE-2026-47729 
Pick SQUID-2026:4 patch per [1].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:46 +05:30
Peter Marko 9c598b5eff squid: patch CVE-2026-32748 
Pick SQUID-2026:2 patch per [1].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-f9p7-3jqg-hhvq

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:45 +05:30
Peter Marko d657b86f28 squid: patch CVE-2026-33515 
Pick SQUID-2026:3 patch per [1].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-84p4-hcx7-jj7c

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:45 +05:30
Peter Marko 4cf01e38f6 squid: patch CVE-2026-33526 
Pick SQUID-2026:1 patch per [1].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-hpfx-h48q-gvwg

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:44 +05:30
Yogita Urade 1c0c901d65 hdf5: Fix CVE-2026-17574 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-17574

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:44 +05:30
Yogita Urade f930afb284 hdf5: Fix CVE-2026-17573 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/HDFGroup/hdf5/commit/dd3080a58cc6bb86f3b34284399915da9e513262
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-17573

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:43 +05:30
Peter Marko a346f23e3a libwebsockets: patch CVE-2026-78161 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-78161

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:43 +05:30
Mehmet Fide 89444b3446 spidev-test: clean the build dir before configure 
The recipe builds out of tree with O=${B}, and the kernel's tools/build
writes fixdep .cmd files into ${B} that list the compiler's own headers
by absolute path, version included. When the toolchain changes (gcc
13.4 -> 13.5 here) do_compile reruns in the same ${B}, make cannot find
the old prerequisite and stops:

  make[1]: *** No rule to make target '.../recipe-sysroot-native/usr/lib/arm-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/13.4.0/include/stddef.h', needed by '.../spidev_test.o'.  Stop.

Empty ${B} before configure, as bpftool does.

Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit bd52d9b479)
Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:42 +05:30
Peter Marko e7165359fb syslog-ng: patch CVE-2026-39879 
Pick patches per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-39879

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:42 +05:30
Peter Marko df6ab201fe cjson: patch CVE-2026-87933 
Pick patch from Github PR mentioned in NVD report.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:41 +05:30
Peter Marko 4e6937fa8f c-ares: patch CVE-2026-69184 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-69184

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:41 +05:30
Peter Marko 9c30658af2 c-ares: patch CVE-2026-69186 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-69184

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:40 +05:30
João Marcos Costa (Schneider Electric) aaeb87a013 ntpsec: add CVE_STATUS for CVE-2016-1548 
This vulnerability was fixed since v0.9.3 (tag name 'NTPsec_0_9_3') [1],
and the version range is not well defined as of today, for instance,
in NVD database [2]. This can lead to false positives in CVE reports.

Mark this CVE as fixed.

[1] https://github.com/ntpsec/ntpsec/blob/master/NEWS.adoc#2016-05-17-093
[2] https://nvd.nist.gov/vuln/detail/cve-2016-1548

Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:40 +05:30
João Marcos Costa (Schneider Electric) d90a138b1a ntp: add CVE-2016-1548 to CVE_STATUS_NTP 
This vulnerability actually affects 4.2.8p4 and earlier [1], and
meta-networking provides as of now 4.2.8p17.

Add it to CVE_STATUS_NTP so this CVE is no longer reported.

[1] https://security-tracker.debian.org/tracker/CVE-2016-1548

Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:39 +05:30
Darsh Kelaiya 0517530717 python3-aiohttp: fix CVE-2026-54273 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [4].

The follow-up from [2] is kept as a separate recipe patch. It adapts
the declined WebSocket-upgrade replay from [3], applies the queue
pause after replay, and includes the corresponding regression tests.

The generated aiohttp/_http_parser.c changes are omitted. The
recipe-time Cython regeneration introduced with CVE-2025-69224
regenerates that file from the patched _http_parser.pyx before the
accelerated parser is compiled.

[1] https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf
[2] https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7
[3] https://github.com/aio-libs/aiohttp/commit/8943d34337c133aa2a33f1fd10a30950d8dcb20e
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-54273

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:39 +05:30
Darsh Kelaiya 9848bb178a python3-aiohttp: fix CVE-2026-54279 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54279

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:39 +05:30
Darsh Kelaiya 1afb67e3c1 python3-aiohttp: fix CVE-2026-54278 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54278

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:38 +05:30
Darsh Kelaiya 49de46b2f3 python3-aiohttp: fix CVE-2026-54277 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

The generated aiohttp/_http_parser.c changes are omitted. The
recipe-time Cython regeneration introduced with CVE-2025-69224
regenerates that file from the patched _http_parser.pyx before the
accelerated parser is compiled.

[1] https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54277

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:38 +05:30
Darsh Kelaiya 8f838e1006 python3-aiohttp: fix CVE-2026-54275 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54275

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:37 +05:30
Darsh Kelaiya bb01c56027 python3-aiohttp: fix CVE-2026-54274 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54274

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:37 +05:30
Darsh Kelaiya 8e776e0477 python3-aiohttp: fix CVE-2026-50269 
This patch applies the reviewed upstream fix shown in [1].
For aiohttp 3.9.5, it also backports the required header
validation from prerequisite commit [2]. The advisory
identifying the fix is referenced in [3].

[1] https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8
[2] https://github.com/aio-libs/aiohttp/commit/1e3ecd48ec423c1fcc729c98adff31172faae1ef
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-50269

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:36 +05:30
Darsh Kelaiya 84c7554df6 python3-aiohttp: fix CVE-2026-47265 
This patch applies the upstream stable-branch fix in [1], which
backports the original upstream commit in [2]. The advisory
identifying the vulnerability is referenced in [3].

[1] https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478
[2] https://github.com/aio-libs/aiohttp/commit/d57efb05f5073071ceb2d3b35d72d9d0bc4512a2
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-47265

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:36 +05:30
Darsh Kelaiya 73aac78272 python3-aiohttp: fix CVE-2026-34525 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349
[2] https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34525

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:35 +05:30
Darsh Kelaiya 807c758926 python3-aiohttp: fix CVE-2026-34520 
This patch applies the reviewed upstream fix shown in [1].
The CVE record is referenced in [2]. It also backports
the C-parser null-byte validation and adapts its
regression test from [3].

[1] https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-34520
[3] https://github.com/aio-libs/aiohttp/commit/db560cfeab32aa35f3d06f7a24238bedc01ffe2b

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:35 +05:30
Darsh Kelaiya 627d177c3e python3-aiohttp: fix CVE-2026-34517 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-34517

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:34 +05:30
Darsh Kelaiya ddec3bbbc6 python3-aiohttp: fix CVE-2026-34516 
This patch applies the upstream stable-branch fix in [1], which
backports the original upstream commit in [2]. The advisory
identifying the fix is referenced in [3].

[1] https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f
[2] https://github.com/aio-libs/aiohttp/commit/5fe9dfb64400a574f5ba3f2d3b49b7db47567c29
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34516

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:34 +05:30
Darsh Kelaiya 1a8597f6cb python3-aiohttp: fix CVE-2026-34519 
This patch applies the upstream stable-branch fix in [1], which
backports the original upstream commit in [2]. The advisory
identifying the fix is referenced in [3].

[1] https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b
[2] https://github.com/aio-libs/aiohttp/commit/18510482de080bf741c560bf2a190fdc54b4eed4
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34519

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:33 +05:30
Anuj Mittal 0f00f8b9a2 vboxguestdrivers: fix vboxvideo build on kernels lacking drm_fb_helper_alloc_info 
Kernel 6.6.151 dropped the drm_fb_helper_alloc_info() declaration as
part of a stable backport, causing vbox_fb.c to fail with:

  vbox_fb.c:329:16: error: implicit declaration of function 'drm_fb_helper_alloc_info'

The existing RTLNX_VER_MIN(6,19,0) check can't express this since the
change landed mid-series in 6.6.y/6.12.y/6.18.y. Backport master
commit b249fbbf1b ("vboxguestdrivers: fix
 vboxvideo build on kernels lacking drm_fb_helper_alloc_info"),
adapted for the 7.0.14 recipe.

Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-29 16:10:23 +05:30
Jason Schonberg c8b0f3d79e php: upgrade 8.2.33 -> 8.2.34 
This is a security release.

CVE-2025-1218 CVE-2025-14181
CVE-2026-91765 CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769
CVE-2026-6103 CVE-2026-17545 CVE-2026-92842 CVE-2026-93682

Changelog: https://www.php.net/ChangeLog-8.php#8.2.34

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:34 +05:30
Benjamin Robin (Schneider Electric) a064adfbd1 libwebsockets: fix CVE-2026-19773 
Backport the fix from v5 branch.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:34 +05:30
Benjamin Robin (Schneider Electric) 307a3bdc40 libwebsockets: update to version 4.3.10 
This version already include the fixes for CVE-2025-11677 and for
CVE-2025-11678. The LICENSE was slightly changed to clarify the license
summary.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:33 +05:30
Himani Ramesh Barde cb7844b35d postfix: fix build on hosts with Linux 7.x kernel 
makedefs only recognizes kernel majors 3-6. Hosts running a 7.x
kernel get "Unknown system type: Linux 7.0.0-..." and the native
build fails. Add 7 to the version match in makedefs and sys_defs.h.

Already fixed in postfix 3.11.

Upstream-Status: Backport [postfix 3.11]
Signed-off-by: Himani Ramesh Barde <HimaniRamesh.Barde@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:33 +05:30
Rohini Sangam e22d8fc3e1 python3-pillow: Security fix for CVE-2026-59204 
Pick patch from [1] also mentioned at NVD report in [2]

[1] https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca
[2] https://nvd.nist.gov/vuln/detail/cve-2026-59204

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:32 +05:30
Rohini Sangam 30683c653d python3-pillow: Security fix for CVE-2026-59198 
Pick patch from [1] also mentioned at NVD report in [2]

[1] https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b
[2] https://nvd.nist.gov/vuln/detail/cve-2026-59198

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:32 +05:30
Viswanath Kraleti be9e8c94e8 libfastjson: switch git branch from master to main 
Update SRC_URI to use the 'main' branch instead of 'master' since
the upstream GitHub repository has renamed its default branch.

Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 1a742957c1)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:31 +05:30
Peter Marko c3984a6ff2 polkit: patch CVE-2026-4897 and CVE-2026-85498 
Pick patches mentioning these CVEs in their commit messages.
Note that patch for CVE-2026-4897 introduces CVE-2026-85498.
Also pick additional patch introduced between these commits which
touches the added code so the final patch applies cleanly.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:31 +05:30
Peter Marko d764db6fb5 recipes: correct homepage 
Leading space leads to SPDX document validation errors for url in
some tools.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(From meta-oe rev: 64dcb55dc5)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:30 +05:30
Peter Marko 6a48592e95 msgpack-c: patch CVE-2026-72854 
Pick patch from [1] linked from [2] mentioned in [3].
Drop version bump related changes.

[1] https://github.com/msgpack/msgpack-c/pull/1182/commits
[2] https://github.com/msgpack/msgpack-c/issues/1181
[3] https://nvd.nist.gov/vuln/detail/cve-2026-72854

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:30 +05:30
Deepak Rathore 4601216546 rsyslog: Fix CVE-2026-19654 
This patch applies the fix backported to rsyslog 8.2402.0 for
CVE-2026-19654. The upstream fix commit is referenced in [1], and
the public CVE advisory is referenced in [2]. The regression-test
commit is included in the same upstream pull request and referenced
in [3] and the individual commit is reference in [4].

[1] https://github.com/rsyslog/rsyslog/commit/07b3c40a5a78c79ed9109251f842ca7e955dd586
[2] https://github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29
[3] https://github.com/rsyslog/rsyslog/pull/7410
[4] https://github.com/rsyslog/rsyslog/commit/8e67ae69539153e4e80547dfb5f07ed17222e292

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:29 +05:30
Hitendra Prajapati 3e40d728ae python3-pillow: fix CVE-2026-42311 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-42311

Pick patch from [1] & [2] also mentioned at Debian report in [3]

[1] https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea
[2] https://github.com/python-pillow/Pillow/commit/3b1f70da
[3] https://security-tracker.debian.org/tracker/CVE-2026-42311

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:29 +05:30
Yogita Urade 90e88f77ab hdf5: Fix CVE-2026-17572 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/HDFGroup/hdf5/commit/20f0b9564bc46154e60f8d35578720a599d41552
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-17572

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-21 09:04:15 +05:30
Hetvi Thakar b5874ea07d libssh: Fix CVE-2026-59850 
The stable-0.11 commit shown in [1] is the upstream fix selected for
this backport. The upstream advisory [2] documents CVE-2026-59850 and
identifies libssh 0.11.5 as the fixed release for the 0.11 series.

[1] https://git.libssh.org/projects/libssh.git/commit/?id=6edfb52b3b364577d2db0334c0514a977efceed2
[2] https://www.libssh.org/security/advisories/CVE-2026-59850.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-02 10:39:59 +05:30
Hetvi Thakar 6e303a0123 libssh: Fix CVE-2026-59848 
The stable-0.11 commit shown in [1] is the primary upstream fix selected
for this backport. Commit [2] corrects the request-queue pointer state
introduced by [1], so it is carried immediately afterward as a regression
fix. The upstream advisory [3] documents CVE-2026-59848 and identifies
libssh 0.11.5 as the fixed release for the 0.11 series.

[1] https://git.libssh.org/projects/libssh.git/commit/?id=a30a51003205744c10ba4439306f555206ae8497
[2] https://git.libssh.org/projects/libssh.git/commit/?id=5309aefd99e1775db40bf20869f1fb1cc6c787be
[3] https://www.libssh.org/security/advisories/CVE-2026-59848.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-02 10:39:59 +05:30
Hetvi Thakar df16e6650d libssh: Fix CVE-2026-59846 
libssh 0.10.6 predates the username-validation helper used by the
stable-0.11 fix, so the upstream commit in [1] cannot be applied as-is.
Adapt the same dangerous-character check directly at the ProxyCommand %r
expansion sink and add focused regression coverage.

The upstream advisory [2] identifies libssh 0.11.5 and 0.12.1 as the
fixed releases.

[1] https://gitlab.com/libssh/libssh-mirror/-/commit/56ce3c193eb06af5bf3b07ec0b4c7308b5c72130
[2] https://www.libssh.org/security/advisories/CVE-2026-59846.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-02 10:39:58 +05:30
Hetvi Thakar 0428dc2fe2 libssh: Fix CVE-2026-59844 
The stable-0.11 commit shown in [1] is the upstream fix selected for
this backport. The upstream advisory [2] documents CVE-2026-59844 and
identifies libssh 0.11.5 as the fixed release for the 0.11 series.

[1] https://git.libssh.org/projects/libssh.git/commit/?id=e31f06e5380be4e714d5ad6965981fbf30738da9
[2] https://www.libssh.org/security/advisories/CVE-2026-59844.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-02 10:39:24 +05:30
Hetvi Thakar f6b642b915 libssh: Fix CVE-2026-59843 
The stable-0.11 commit shown in [1] is the upstream fix selected for
this backport. The upstream advisory [2] documents CVE-2026-59843 and
identifies libssh 0.11.5 as the fixed release for the 0.11 series.

[1] https://git.libssh.org/projects/libssh.git/commit/?id=687ef1c44b646b9db0b1c6e8f987edb7c9e4d919
[2] https://www.libssh.org/security/advisories/CVE-2026-59843.txt

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-02 10:38:54 +05:30
Darsh Kelaiya edf29eeda9 python3-aiohttp: fix CVE-2026-34518 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6
[2] https://github.com/aio-libs/aiohttp/commit/6e8f393330f9bd6d7b24a146124ebc42eaa727b9
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34518

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:06 +05:30
Darsh Kelaiya 1108d82e62 python3-aiohttp: fix CVE-2026-34993 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-34993

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 10:18:06 +05:30