mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-14 03:57:15 +00:00
Code Issues Projects Releases Wiki Activity
38,753 Commits 65 Branches 0 Tags
ddc539d94a6b2f20d6025a2a43fbdd65618524d1
Commit Graph
38753 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ankur Tyagi ddc539d94a uriparser: upgrade 1.0.2 -> 1.0.3 
Changelog:
https://github.com/uriparser/uriparser/blob/uriparser-1.0.3/ChangeLog

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:46 +05:30
Ankur Tyagi dc8ef4ec9e valkey: upgrade 9.0.6 -> 9.0.7 
Changelog:
https://github.com/valkey-io/valkey/releases/tag/9.0.7

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:45 +05:30
Ankur Tyagi 7f96df7262 smarty: upgrade 5.8.4 -> 5.8.5 
Changelog:
https://github.com/smarty-php/smarty/releases/tag/v5.8.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 3fe4c22474)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:45 +05:30
Ankur Tyagi 191a178028 libgphoto2: patch CVE-2026-120452 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120452

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:44 +05:30
Ankur Tyagi 9d29072b9c libgphoto2: patch CVE-2026-120451 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120451

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:44 +05:30
Ankur Tyagi 0662b78ffb hdf5: patch CVE-2026-120758 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120758

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:43 +05:30
Ankur Tyagi a7e3f1e3c7 hdf5: patch CVE-2026-120757 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120757

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:43 +05:30
Ankur Tyagi 476ac376fa hdf5: patch CVE-2026-120756 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120756

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:42 +05:30
Ankur Tyagi ba52a2cf9a hdf5: patch CVE-2026-120754 and CVE-2026-120755 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120754
https://nvd.nist.gov/vuln/detail/cve-2026-120755

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:42 +05:30
Ankur Tyagi 72c031d573 hdf5: patch CVE-2026-120689 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-120689

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:41 +05:30
Ankur Tyagi c6a5d54405 hdf5: patch CVE-2026-19023 and CVE-2026-19024 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-19023
https://nvd.nist.gov/vuln/detail/cve-2026-19024

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:41 +05:30
Ankur Tyagi 35efa73ce4 hdf5: patch CVE-2026-19026, CVE-2026-19027 and CVE-2026-19028 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-19026
https://nvd.nist.gov/vuln/detail/cve-2026-19027
https://nvd.nist.gov/vuln/detail/cve-2026-19028

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:40 +05:30
Ankur Tyagi 9bcdd198a9 crow: upgrade 1.3.3 -> 1.3.4 
Details:
https://github.com/CrowCpp/Crow/releases/tag/v1.3.4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(From OE-Core rev: 9bf293a9d1)
Resolves CVE-2026-116011
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:40 +05:30
Ankur Tyagi b80b104c0a crow: upgrade 1.3.2 -> 1.3.3 
Changelog:
https://github.com/CrowCpp/Crow/releases/tag/v1.3.3

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(From OE-Core rev: 6034c7f14f)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:40 +05:30
Hetvi Thakar c25089f12e python3-virtualenv: Ignore CVE-2026-113724 
Analysis:
- The advisory [1] describes a deletion-error callback changing the
  permissions of a symlink target.
- In 21.2.1, safe_delete() always passes ignore_errors=True to
  shutil.rmtree(), which disables the supplied error callback.
  This remains true after the existing security backports.
- Upstream enabled that callback later in [2]. The chmod recovery
  path fixed by [3] is therefore unreachable in this recipe.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq
[2] https://github.com/pypa/virtualenv/pull/3222
[3] https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:39 +05:30
Hetvi Thakar c50217eae4 python3-virtualenv: Ignore CVE-2026-113718 
Analysis:
- The advisory [1] limits this issue to Xonsh activation in versions
  21.3.0 through 21.14.8.
- Version 21.2.1 has no Xonsh activator, activate.xsh template or
  registered entry point. None of the existing backports adds them.
- The upstream fix [2] changes the absent Xonsh quoting code, so it
  is not applicable to this recipe.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf
[2] https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:39 +05:30
Hetvi Thakar 45909e98d3 python3-virtualenv: Ignore CVE-2026-102937 
Analysis:
- The advisory [1] describes command injection when Windows cmd.exe
  executes a generated activate.bat file.
- BatchActivator.supports() rejects Linux interpreters, so the Linux
  CLI does not select this activator.
- Limit the status to Linux TARGET_OS values. Leave other platforms,
  including MinGW SDK builds, unexcluded.
- The upstream fix is [2]; no backport is needed for Linux activation.

Reference:
[1] https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q
[2] https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:38 +05:30
Hetvi Thakar be26025948 python3-virtualenv: fix CVE-2026-113713 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Always copy seed packages from temporary app-data,
including when environment or configuration values enable symlinks.
This keeps the environment usable after the temporary cache is removed.

Although NVD lists releases from 21.14.8, the project advisory [3]
traces the incomplete guard to 20.0.6. The same unguarded constructor
is present in 21.2.1, where the upstream regression tests reproduce
dangling pip links after temporary-cache cleanup.

[1] https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113713
[3] https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:10:38 +05:30
Hetvi Thakar 021ed63fde python3-virtualenv: fix CVE-2026-113722 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Preserve interpreter paths as literal data in
POSIX console launchers for both the app-data and pip seeders, and
update the pip launchers' RECORD hashes after rewriting them.

Include the RECORD-writing follow-up from [3] so the new rewrite path
replaces existing links and uses exclusive creation. The required
write_file helper comes from the preceding CVE-2026-113721 fix [4].

Regenerate existing environments to repair their launchers. A later
independent pip install or upgrade can replace the corrected launchers;
this backport does not modify pip's vendored distlib.

[1] https://github.com/pypa/virtualenv/commit/2519941bed33ee0d3ac99277f67913e439e476a9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113722
[3] https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4
[4] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:09:32 +05:30
Hetvi Thakar d54f2315dd python3-virtualenv: fix CVE-2026-113716 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Replace linked output-directory components before
creating interpreter, library and activation files. Reuse ensure_within
from the preceding CVE-2026-113721 backport [3].

[1] https://github.com/pypa/virtualenv/commit/554d9f9d4f7758f5cf53f993031e29787f1f74c5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113716
[3] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:08:23 +05:30
Hetvi Thakar 15567524b8 python3-virtualenv: fix CVE-2026-113721 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Replace existing symbolic and hard links before
writing generated files, and create the replacement files exclusively.
Prepare the stdlib venv executable directory before it writes files.

[1] https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113721

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:07:13 +05:30
Hetvi Thakar 90f0e58d3d python3-virtualenv: fix CVE-2026-113719 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Restrict seed-package metadata cleanup to entries
inside the environment, without deleting the environment itself or
directories containing the metadata. Unlink final symlinks without
following their targets.

[1] https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-113719

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:04:50 +05:30
Hetvi Thakar f11354004d python3-virtualenv: fix CVE-2026-113720 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Apply the current umask when copying interpreter
and seed-package files instead of inheriting cached permission bits.
Do not grant group or world write access to copied files.

[1] https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:03:45 +05:30
Hetvi Thakar 2d3e0c1b5d python3-virtualenv: fix CVE-2026-113715 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Reject line boundaries in stdlib venv paths and
regenerate pyvenv.cfg from the selected interpreter and options,
instead of merging potentially injected configuration read back from
the intermediate file.

[1] https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:02:16 +05:30
Hetvi Thakar 8d74b1295e python3-virtualenv: fix CVE-2026-113723 
Backport the upstream prompt-handling fix [1] identified by advisory
[3]. Preserve literal prompts across Bash compatibility modes and
leave PS1 unchanged in unsupported POSIX shells.

Include follow-up [2], identified by advisory [4], so later prompt
option changes and child shells cannot execute the stored prompt.
This also fixes CVE-2026-115586, a regression in the initial fix.
Keep only the required Bash/Zsh security changes and regression tests.

[1] https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22
[2] https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4
[3] https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp
[4] https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 09:00:59 +05:30
Hetvi Thakar e11dc337c9 python3-virtualenv: fix CVE-2026-113725 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Escape the Bash prompt for both its backslash
decoding and expansion passes so backslashes cannot undo quoting.

[1] https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-vxj4-q4g9-crj7

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:59:13 +05:30
Hetvi Thakar 46b8c6fa8f python3-virtualenv: fix CVE-2026-113726 
Backport the upstream Zsh prompt fix [1] identified by advisory [3].
Include prerequisite [2] to provide the prompt-escaping block and
regression-test fixture that the fix uses but 21.2.1 does not contain.

Escape prompt values before Zsh expands PS1, including when
PROMPT_SUBST is enabled after activation, and preserve literal percent
signs in the displayed environment name.

[1] https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2
[2] https://github.com/pypa/virtualenv/commit/a70c1dac43e2ee7e618132b572072395af5d8a9b
[3] https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:57:54 +05:30
Hetvi Thakar 936c732252 python3-virtualenv: fix CVE-2026-113776 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Replace activation-template placeholders in a
single pass so placeholder names inside substituted paths or prompts
cannot be expanded again as script content.

[1] https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:56:42 +05:30
Hetvi Thakar ad862d2df7 python3-virtualenv: fix CVE-2026-113732 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Use Fish-specific quoting so backslashes and
quotes in an environment path or prompt remain literal data.

Include follow-up [3], released in [4], to preserve apostrophes and
backslashes after multibyte text in Fish 3 legacy locales. Keep the
upstream GBK and UTF-8 regression tests.

[1] https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q
[3] https://github.com/pypa/virtualenv/commit/685435d7fb53da12da99e195ee2753f5ca083249
[4] https://github.com/pypa/virtualenv/releases/tag/21.14.9

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:55:34 +05:30
Hetvi Thakar abb85935fe python3-virtualenv: fix CVE-2026-102925 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Remove the extra template quotes around values
that are already quoted for Bash and Fish activation scripts.

[1] https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:53:52 +05:30
Hetvi Thakar 2f89f21927 python3-virtualenv: fix CVE-2026-102930 
Backport the seed-wheel digest check [1], as identified by advisory
[5]. Include prerequisite [2] so the expected digests are obtained
over verified HTTPS, and follow-up [3] so missing digests cannot
silently disable verification.

Include follow-up [4] to verify wheels in private staging before
caching them and to use the same verification for the pip seeder.
This also fixes CVE-2026-113714 and CVE-2026-113717, tracked in [6]
and [7]. Apply the TLS prerequisite before the three wheel fixes.

Add python3-packaging for the upstream wheel-name and version checks.
Keep virtualenv at version 21.2.1 without unrelated feature changes.

[1] https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d
[2] https://github.com/pypa/virtualenv/commit/48f6fdcc14b8654236f9081adbff10a32f536940
[3] https://github.com/pypa/virtualenv/commit/91460add8f53f4654c4aae3898e739c03fb69946
[4] https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96
[5] https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45
[6] https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3
[7] https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:49:43 +05:30
Hetvi Thakar a0db4b52e9 python3-virtualenv: fix CVE-2026-102938 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. Keep pyvenv.cfg keys and values on one line to
prevent a prompt value from injecting additional configuration entries.

[1] https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140
[2] https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:47:32 +05:30
Darsh Kelaiya 2624b7628e ntfs-3g-ntfsprogs: mark CVE-2026-56136 as fixed 
The three index validation patches already included for CVE-2026-46572
and CVE-2026-42617 also provide the complete CVE-2026-56136 fix [1-3].
Their combined source changes match Tuxera's 2022.10.3 backport linked
from the advisory [4]. Add the missing CVE tag to each patch so
cve-check recognises the existing fix.

[1] https://github.com/tuxera/ntfs-3g/commit/2ead8a3ccf940c0219ffba587fab54e21462b3a5
[2] https://github.com/tuxera/ntfs-3g/commit/dfd1a7c6eb23a22238ec193451fa59c989b4381f
[3] https://github.com/tuxera/ntfs-3g/commit/edf2b892356684ca8f2fc5898943c7a9b90ffb80
[4] https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-r66g-c39x-cw95

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:45 +05:30
Darsh Kelaiya 2e96e418e8 ntfs-3g-ntfsprogs: fix CVE-2026-56135 
Apply the upstream ACL inheritance sizing fix and its validation and
sizing follow-ups [1-3], then limit repeated creator-owner and
creator-group substitutions with [4]. The advisory is referenced in [5].

The sizing helper stops at the declared ACL size, while descriptor
validation and inheritance may process additional ACEs. The follow-up
guard bounds substitutions independently of that sizing walk.

[1] https://github.com/tuxera/ntfs-3g/commit/289ebcf3dfbed422181cbfa524d75e32d9c59bd3
[2] https://github.com/tuxera/ntfs-3g/commit/21f37bb5efa874b4e1212f499ca643d69f024021
[3] https://github.com/tuxera/ntfs-3g/commit/b0b9c32c7ff0fb0eac1eb9272da2ed10ae51a3b9
[4] https://github.com/tuxera/ntfs-3g/commit/98b153894bb3cc75cd13179a108eef9feda35422
[5] https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-c9qg-fh4v-mq8r

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:44 +05:30
Yogita Urade 2332d83cbd python3-pymongo: Fix CVE-2026-106435 
This patch applies the upstream fix as referenced in [3],
using the commit shown in [1] and regression commit from [2].

Follow up the PYTHON-6110 CVE fix: its regex flags scan leaves a
one-byte boundary error after consuming the pattern terminator.
Apply PYTHON-6111's correction and terminator-overlap regression test.

[1] https://github.com/mongodb/mongo-python-driver/commit/bb8d4e195275e75bd94ebeffb53cc747d357fcf4
[2] https://github.com/mongodb/mongo-python-driver/commit/b5a36ccbdb97298fbf9b5b5767affe92c534461f
[3] https://jira.mongodb.org/browse/PYTHON-6110
[4] https://jira.mongodb.org/browse/PYTHON-6111

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:44 +05:30
Yogita Urade a5890d9b37 python3-pymongo: Fix CVE-2026-88029 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/mongodb/mongo-python-driver/commit/fa676586ba4b399168a4d1d41c30dc2166cc44fd
[2] https://jira.mongodb.org/browse/PYTHON-5994

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:43 +05:30
Yogita Urade 96b34e5296 python3-tornado: Fix CVE-2026-116578 
This patch applies the upstream fix as referenced in [4],
using the commit shown in [1], [2] and [3].

[1] https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233
[2] https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035
[3] https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-116578

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:43 +05:30
Yogita Urade bf1ca462d0 python3-tornado: Fix CVE-2026-116577 
This patch applies the upstream fix as referenced in [4],
using the commit shown in [1], [2] and [3].

[1] https://github.com/tornadoweb/tornado/commit/1b7a1dc9f340f52de929852e8125aa12f25297c9
[2] https://github.com/tornadoweb/tornado/commit/09591f65286a600c2196df9c33b792b889a6bccb
[3] https://github.com/tornadoweb/tornado/commit/3ef5ec3fc7a158ecd0ca7bfc5fcee42fa2773094
[4] https://github.com/tornadoweb/tornado/pull/3765
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-116577

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:42 +05:30
Yogita Urade 2248ece66b python3-tornado: Fix CVE-2026-115927 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/tornadoweb/tornado/commit/ceab33581489751a66fba8566ad6d5960d4b01c8
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-115927

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:42 +05:30
Yogita Urade d9af8ff1b7 python3-tornado: Fix CVE-2026-103263 
This patch applies the upstream fix as referenced in [3],
using the commit shown in [1] and dependent commit from [2].

Required companion fix for CVE-2026-103263: The symlink-hardening
backport adds allowed_symlink_directory, but subclasses that
override initialize() without calling the base method do not
set it and fail with AttributeError. Include upstream commit
6bd9c4e0 and its regression tests with the CVE fix.

[1] https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32
[2] https://github.com/tornadoweb/tornado/commit/6bd9c4e0fc10ae743006cd6a97543d15050f9594
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-103263
[4] https://github.com/tornadoweb/tornado/issues/3724

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:41 +05:30
Yogita Urade 0f404d57f0 python3-tornado: Fix CVE-2026-103262 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-103262

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:41 +05:30
Yogita Urade 30603fc2bc python3-tornado: Fix CVE-2026-103261 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-103261

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:40 +05:30
Darsh Kelaiya 131bcf4881 libhtml-parser-perl: fix CVE-2026-8829 
This patch applies the upstream fix [1] for CVE-2026-8829
as shown in the advisory identifying the fix [2].

[1] https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c
[2] https://nvd.nist.gov/vuln/detail/cve-2026-8829

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:40 +05:30
Ashishkumar Parmar a725022e5a nmap: Fix CVE-2026-72712 
This patch applies the upstream nmap master backport for
CVE-2026-72712 to the Wrynose nmap 7.95 recipe. The upstream
fix commit is referenced in [1], and the public CVE advisory
is referenced in [2].

[1] https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a
[2] https://github.com/advisories/GHSA-7j7x-fg87-hwwg

Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:40 +05:30
Ankur Tyagi fffd174aef wireshark: upgrade 4.6.8 -> 4.6.9 
Release Notes:
https://www.wireshark.org/docs/relnotes/wireshark-4.6.9.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 650ced113c)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:39 +05:30
Peter Marko a4b37c2e4d libwebsockets: patch CVE-2026-114550 
Pick patch mentioned in NVD CVE report.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:39 +05:30
Hetvi Thakar efef6062ef nginx: fix CVE-2026-15176 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/ce1da78900b07e72f37a25f55e6606220ac45902
[2] https://ubuntu.com/security/CVE-2026-15176

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:38 +05:30
Hetvi Thakar 7ad10cb7c3 nginx: fix CVE-2026-97629 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/fdedba031bf1ad6a80c61b1aec1418d1a87ae296
[2] https://ubuntu.com/security/CVE-2026-97629

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:38 +05:30
Hetvi Thakar ba349a44f9 nginx: fix CVE-2026-95101 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/90b30edffea4f427608c36e3849643b6f9841bc4
[2] https://ubuntu.com/security/CVE-2026-95101

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:37 +05:30
Jason Schonberg b2cc77d681 nodejs: 22.23.3 -> 22.23.4 
This is the October 2026 security release.

  4 high severity issues.
  3 medium severity issues.
  3 low severity issue.

High severity issues.
  CVE-2026-105482
  CVE-2026-105483
  CVE-2026-106069
  CVE-2026-111497

Medium severity issues.
  CVE-2026-105481
  CVE-2026-106072
  CVE-2026-106074

Low severity issues.
  CVE-2026-106070 (affects only nodejs v26)
  CVE-2026-106071 (affects only nodejs v26)
  CVE-2026-106073

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Changelog: https://github.com/nodejs/node/releases/tag/v22.23.4

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-11-09 08:44:37 +05:30