mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-22 11:00:49 +00:00
Code Issues Projects Releases Wiki Activity
31,154 Commits 64 Branches 0 Tags
f6aab7432b7201d7dbd52843f2f5e53d626d10e7
Commit Graph
31154 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Hetvi Thakar f6aab7432b python3-ujson: Fix CVE-2026-32874 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/4baeb950df780092bd3c89fc702a868e99a3a1d2
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-32874

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:21 +05:30
Hetvi Thakar 28aefe0fdb python3-ujson: Fix CVE-2026-32875 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-32875

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Darsh Kelaiya b9534a154d python3-filelock: fix CVE-2026-22701 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-22701

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Darsh Kelaiya ac73fd1e99 python3-filelock: fix CVE-2025-68146 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-68146

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:20 +05:30
Vijay Anusuri 2e49cdb4d2 giflib: Fix CVE-2026-26740 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-26740
[2] https://ubuntu.com/security/CVE-2026-26740

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:07 +05:30
Ankur Tyagi 6bb11ad0c3 jsoncpp: upgrade 1.9.5 -> 1.9.7 
https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.6
https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.7

Also backport patch to fix C++11 ABI breakage when compiled with C++17.

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:06 +05:30
Devansh Patel 6bfefb82b3 hdf5: Fix CVE-2026-26197 
This patch backports the upstream fix first released in HDF5 2.1.0.
The upstream fix commit is referenced in [1], and the public advisory
is referenced in [2].

Although the advisory [2] lists HDF5 2.0.0 as affected, NVD [3]
also marks versions before 2.0.0 as affected, and its CPE
configuration marks versions before 2.1.0 as vulnerable. Scarthgap's
HDF5 1.14.4-3 H5T_ARRAY decoder in src/H5Odtype.c computes the array
element count and decodes the parent datatype without checking for
multiplication overflow or verifying that the stored datatype size
matches the element size multiplied by the element count. The
vulnerable code path is therefore present in 1.14.4-3, so this
backport is applicable.

[1] https://github.com/HDFGroup/hdf5/commit/8cd9f7a7ba6757fbb72e36bbe23e127f8507c8a6
[2] https://github.com/HDFGroup/hdf5/security/advisories/GHSA-gh44-7wpq-622f
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-26197

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:06 +05:30
Devansh Patel 436a33ff4c hdf5: Fix CVE-2026-26199 
This patch backports the upstream fix first released in HDF5 2.1.0.
The upstream fix commit is referenced in [1], and the public advisory
is referenced in [2].

[1] https://github.com/HDFGroup/hdf5/commit/9268b803b742f99c1f8793cae74f19e74976b065
[2] https://github.com/HDFGroup/hdf5/security/advisories/GHSA-5c6x-jmgf-f5vc

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:05 +05:30
Hitendra Prajapati 9e103dc4d0 libssh: fix for CVE-2026-59845, CVE-2026-59847 
Pick patch from [1], [2] & [3] also mentioned at Debian report in [4] & [5]

[1] https://git.libssh.org/projects/libssh.git/commit/?id=53b8152623290c69657a6774d96888b876e6061f
[2] https://git.libssh.org/projects/libssh.git/commit/?id=c483a187354dfd96b16d3309a74f6d1cf82c2074
[3] https://git.libssh.org/projects/libssh.git/commit/?id=d4847509b792d564d1935dbfea4ee1496ad3d3d9
[4] https://security-tracker.debian.org/tracker/CVE-2026-59845
[5] https://security-tracker.debian.org/tracker/CVE-2026-59847

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:05 +05:30
Hitendra Prajapati 085604ac0b libssh: set status for CVE-2026-59842 
Analysis:
  - CVE-2026-59842 affects information disclosure via short GSSAPI Curve25519 public key.
  - This vulnerable code is not present in the current libssh 0.10.6.
  - Hence ignoring the CVE for this version.

Reference:
1. https://www.cve.org/CVERecord?id=CVE-2026-59842
2. https://www.libssh.org/security/advisories/CVE-2026-59842.txt
3. https://security-tracker.debian.org/tracker/CVE-2026-59842

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:04 +05:30
Hitendra Prajapati b8bc579daa libssh: set status for CVE-2026-15370 
Analysis:
  - CVE-2026-15370 affects stack buffer overflow in SFTP server longname construction.
  - This vulnerable code is not present in the current libssh 0.10.6.
  - Hence ignoring the CVE for this version.

Reference:
https://www.cve.org/CVERecord?id=CVE-2026-15370
https://www.libssh.org/security/advisories/CVE-2026-15370.txt

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:04 +05:30
Gyorgy Sarvari d348bf9a61 python3-twisted: set CVE_PRODUCT 
The related CVEs are tracked with twisted:twisted CPE, so the
default python:twisted CPE doesn't match any entries.

See CVE db query:
sqlite> select * from products where PRODUCT = 'twisted';
CVE-2014-7143|twisted|twisted|14.0.0|=||
CVE-2016-1000111|twisted|twisted|||16.3.1|<
CVE-2019-12387|twisted|twisted|||19.2.1|<
CVE-2019-12855|twisted|twisted|||19.2.1|<=
CVE-2020-10108|twisted|twisted|||19.10.0|<=
CVE-2020-10109|twisted|twisted|||19.10.0|<=
CVE-2022-21712|twisted|twisted|11.1.0|>=|22.1.0|<
CVE-2022-21716|twisted|twisted|21.7.0|>=|22.2.0|<
CVE-2022-24801|twisted|twisted|||22.4.0|<
CVE-2022-39348|twisted|twisted|0.9.4|>=|22.10.0|<
CVE-2023-46137|twisted|twisted|||22.8.0|<=
CVE-2024-41810|twisted|twisted|||24.3.0|<=

Set the CVE_PRODUCT accordingly.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a89ab32230)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:03 +05:30
Gyorgy Sarvari 9069df0fdb python3-httpx: set CVE_PRODUCT 
The relevant CVEs are tracked in the CVE db with encode:httpx CPE
instead of the default python:httpx. Set CVE_PRODUCT accordingly.

See CVE db query:
sqlite> select * from products where product like '%httpx%';
CVE-2021-41945|encode|httpx|||0.23.0|<

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8627277b50)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:03 +05:30
Benjamin Bouvier bc6073f183 net-snmp: add CVE_PRODUCT 
Add exact CPE name in CVE_PRODUCT.

Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 5efb5b44e8)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-01 06:57:02 +05:30
Adarsh Jagadish Kamini bec755063a thrift: fix CVE-2026-58389 
Backport patch to fix CVE-2026-58389.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-58389

Upstream fix:
  https://github.com/apache/thrift/commit/0ab16e3a83637711f4e0f788c205f66576fd0a55

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Roland Kovacs 356ce58534 thrift: fix multiple CVEs 
CVE-2026-43868:
  Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.

CVE-2026-43869:
  Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
  This CVE only affects the Java client, which is not built by the recipe. Marked as
  'not-applicable-config'.
  Upstream commit:
    https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66

CVE-2026-43870:
  Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory
  ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers
  ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability
  in Apache Thrift.

Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Tugrul Kukul 6e099da67d jq: fix CVE-2026-44777 
Backport patch to fix CVE-2026-44777.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-44777

Upstream fix:
  https://github.com/jqlang/jq/commit/f58787c41835d9b17795730cb04925fdba25c71c

Tested with ptest:
Before: PASSED: 7, FAILED: 0, SKIPPED: 0
After: PASSED: 7, FAILED: 0, SKIPPED: 0

Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Tugrul Kukul 65604c0d46 jq: fix CVE-2026-39956 
Backport patch to fix CVE-2026-39956.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-39956
  https://www.cve.org/CVERecord?id=CVE-2026-39956
  https://security-tracker.debian.org/tracker/CVE-2026-39956
  https://osv.dev/list?q=CVE-2026-39956

Upstream fix:
  https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03 [nvd]

Tested with ptest:
Before: PASSED: 7, FAILED: 0, SKIPPED: 0
After: PASSED: 7, FAILED: 0, SKIPPED: 0

Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-13 10:01:51 +05:30
Ankur Tyagi 3a6720afef nginx: upgrade 1.26.0 -> 1.26.3 
Made patches for CVE-2024-7347, CVE-2025-23419 specific for v1.24.0 as
these vulnerabilities are fixed in v1.26.3.

Dropped CVE-2025-2341.patch for nginx-1.26.3

Changelog:
https://nginx.org/en/CHANGES-1.26

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:19 +05:30
Ankur Tyagi 24891ee0b9 nginx: upgrade 1.25.5 -> 1.26.0 
Stable branch 1.26.0 is off 1.25.5 and identical
https://github.com/nginx/nginx/compare/release-1.25.5...release-1.26.0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:18 +05:30
Ankur Tyagi 265199312c redis: upgrade 6.2.21 -> 6.2.23 
https://github.com/redis/redis/releases/tag/6.2.22
https://github.com/redis/redis/releases/tag/6.2.23

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:14 +05:30
Ankur Tyagi 1bc6d30b77 redis: upgrade 7.2.12 -> 7.2.15 
Refreshed patches for this version.

https://github.com/redis/redis/releases/tag/7.2.13
https://github.com/redis/redis/releases/tag/7.2.14
https://github.com/redis/redis/releases/tag/7.2.15

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:13 +05:30
Vijay Anusuri 319421fd5b libssh: Remove duplicate CVE_STATUS entry for CVE-2025-14821 
The CVE_STATUS entry for CVE-2025-14821 was added twice in the recipe.
Remove the duplicate entry to keep the recipe clean

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:13 +05:30
Hetvi Thakar 35f85f87b8 python3-twisted: Fix CVE-2026-42304 
This patch applies the upstream 26.4.0rc2 backport for
CVE-2026-42304. The upstream fix merge is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch header
because the fix expands to multiple commits.

[1] https://github.com/twisted/twisted/commit/2d196123264efb0027eecfe1b430be4a9babdbd8
[2] https://github.com/advisories/GHSA-grgv-6hw6-v9g4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:12 +05:30
Hetvi Thakar 3c9dd88058 python3-pyjwt: Fix CVE-2026-48526 
Reject JSON Web Key documents passed directly as HMAC secrets. This
prevents public asymmetric JWK data from being reused as an HMAC key
when an application permits mixed symmetric and asymmetric algorithms.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-xgmm-8j9v-c9wx

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:12 +05:30
Hetvi Thakar b9877579dc python3-pyjwt: Fix CVE-2026-48525 
Reject a non-empty compact payload segment for b64=false tokens before
Base64URL decoding. The segment is unused for detached JWS verification,
so decoding it allowed unauthenticated CPU and memory consumption.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-w7vc-732c-9m39

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:11 +05:30
Hetvi Thakar fffe550dfc python3-pyjwt: Fix CVE-2026-48524 
Preserve a valid cached JWK set when a refresh request fails. The
previous finally block stored None on errors, turning a transient JWKS
outage into an authentication failure for otherwise cached keys.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-fhv5-28vv-h8m8

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:11 +05:30
Hetvi Thakar 773e345eca python3-pyjwt: Fix CVE-2026-48522 
Restrict PyJWKClient JWKS retrieval to HTTP and HTTPS. urllib
otherwise accepts schemes such as file, FTP and data, allowing
attacker-influenced URLs to reach unintended resources.

This patch applies the relevant subset of the upstream 2.13.0 fix.
The upstream commit is referenced in [1], and the public advisory is
referenced in [2].

[1] https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
[2] https://github.com/advisories/GHSA-993g-76c3-p5m4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:10 +05:30
Darsh Kelaiya 49bb7f1369 python3-flask: fix CVE-2026-27205 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/pallets/flask/commit/c17f379390731543eea33a570a47bd4ef76a54fa
[2] https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:10 +05:30
Emanuele Ghidoli 07d8247914 jq: fix build broken by the CVE-2026-43895 backport 
Since da15df26e6 ("jq: Fix CVE-2026-43895") "bitbake jq" fails with:

  cc1: fatal error: src/parser.c: No such file or directory

That patch is the only jq patch touching both src/parser.c and
src/parser.y. git orders the diff alphabetically, so patch(1) writes
parser.y after parser.c and the shipped pre-generated parser looks
outdated. Maintainer mode is disabled, so make runs the no-op '.y.c'
rule; having "rebuilt" the target it stops resolving it through VPATH and
looks for it in ${B}, where it does not exist.

Touch the generated bison/flex sources before configure so they are never
considered stale. This also covers any future patch touching src/parser.y
or src/lexer.l.

With maintainer mode enabled bison will no longer regenerate parser.c,
which is fine: the CVE patches update the .y and the generated .c
consistently.

Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:04 +05:30
Benjamin Bouvier 80956c31c2 tcpdump: add CVE_PRODUCT 
Add exact CPE name in CVE_PRODUCT.

Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 112120131d)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:03 +05:30
Benjamin Bouvier 3a32c083e1 librelp: add CVE_PRODUCT 
Add exact CPE name in CVE_PRODUCT.

Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 09c542c2f4)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:03 +05:30
s-tokumoto bf51775fe9 fuse: Add "fuse:fuse" to CVE_PRODUCT 
Since there are vulnerabilities that cannot be detected by the existing
CVE_PRODUCT, add "fuse:fuse" to CVE_PRODUCT.

https://nvd.nist.gov/vuln/detail/CVE-2010-0789
https://nvd.nist.gov/vuln/detail/CVE-2005-1858

Signed-off-by: Shunsuke Tokumoto <s-tokumoto@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a223dd3557)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:02 +05:30
Adarsh Jagadish Kamini 35cb02fda2 thrift: fix CVE-2026-48144 
Backport patch to fix CVE-2026-48144.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-48144

Upstream fix:
  https://github.com/apache/thrift/commit/2b8baabc9be52807b08825e825bc0cd26568a193

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:02 +05:30
Adarsh Jagadish Kamini 7f5c686d97 thrift: fix CVE-2026-58023 
Backport patch to fix CVE-2026-58023.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-58023

Upstream fix:
  https://github.com/apache/thrift/commit/d68305a7308a11df2c1daef16f55dbc19dfa6ff0

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:01 +05:30
Adarsh Jagadish Kamini c83d3fa4c2 thrift: fix CVE-2026-55971 
Backport patch to fix CVE-2026-55971.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-55971

Upstream fix:
  https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:35:01 +05:30
Jason Schonberg 7e6a93e1ce php: upgrade 8.2.32 -> 8.2.33 
This is a security release.

Changelog: https://www.php.net/ChangeLog-8.php#8.2.33

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-08-12 09:34:58 +05:30
Hetvi Thakar ef3df29f2c libdbi-perl: Fix CVE-2026-14740 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-14740

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-30 07:53:25 +05:30
Hetvi Thakar 3dd0a40ecb libdbi-perl: Fix CVE-2026-14739 
Backport the upstream hard limit for positional placeholders. This is
a follow-up to CVE-2026-10879 and depends on the allocation fix from
the preceding libdbi-perl commit.

Correct the upstream boundary check so that the documented maximum of
99999 placeholders is accepted and values above it are rejected. Add
focused regression coverage for the 99999 and 100000 boundaries.

[1] https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395
[2] https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-14739
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-10879

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-30 07:53:25 +05:30
Hetvi Thakar dacd50f84e libdbi-perl: Fix CVE-2026-14380 
Backport the ordered upstream fix and regression-test chain from DBI
1.650. Add perl-module-load to RDEPENDS to satisfy the runtime
dependency introduced by the primary fix's use of Module::Load.

[1] https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259
[2] https://github.com/perl5-dbi/dbi/commit/d982411aec73b3acfc4e9e465358bca9eb7fede8
[3] https://github.com/perl5-dbi/dbi/commit/f94685f415b08ea4b1f183d48430c4583c1c07d0
[4] https://github.com/perl5-dbi/dbi/commit/7949e551b3c7a8854926b6de84f6cc2ceafb2200
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-14380

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-30 07:53:25 +05:30
Hetvi Thakar 3304a04085 libdbi-perl: Fix CVE-2026-10879 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978
[2] https://security-tracker.debian.org/tracker/CVE-2026-10879

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-30 07:53:25 +05:30
Hetvi Thakar ba75c3486c libdbi-perl: Fix CVE-2026-9698 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-9698

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-30 07:53:25 +05:30
Qliangw 6fe53daabc libuio: fix FILE descriptor leak 
The function uio_line_from_file() fails to close the FILE pointer
when fgets() returns NULL, causing a file descriptor leak.

This can be triggered when reading from /sys files that return
empty content, leading to resource exhaustion over time.

Fix this by using goto-based error handling to ensure fclose()
is called on all exit paths.

Signed-off-by: Qliangw <qili00001@gmail.com>
(cherry picked from commit cd75edf25d)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit d97b5602d7)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 09:45:00 +05:30
Darsh Kelaiya 24202b2e88 dnsmasq: Fix CVE-2026-12969 
This patch applies the upstream fix for CVE-2026-12969 as referenced
in [2], using the upstream commit identified in [1].

[1] https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=14094e88beca519c53151184cc4553656672b54f
[2] https://security-tracker.debian.org/tracker/CVE-2026-12969

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 09:28:54 +05:30
Darsh Kelaiya 1a484a8edd dnsmasq: Fix CVE-2026-12725 
This patch applies the upstream fix for CVE-2026-12725 as referenced
in [2], using the upstream commit identified in [1].

[1] https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=36d081e37477027fd721fea498f3760f529034ad
[2] https://security-tracker.debian.org/tracker/CVE-2026-12725

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 09:28:53 +05:30
Joao Marcos Costa 2bc558d93c nginx: backport fixes for CVE-2026-42533 
The fixes are all part of v1.30.4, as explained in the release notes
[1].

I tested this with the configuration below:

BB_VERSION           = "2.8.1"
BUILD_SYS            = "x86_64-linux"
NATIVELSBSTRING      = "fedora-39"
TARGET_SYS           = "x86_64-oe-linux"
MACHINE              = "qemux86-64"
DISTRO               = "nodistro"
DISTRO_VERSION       = "nodistro.0"
TUNE_FEATURES        = "m64 core2"
TARGET_FPU           = ""
meta                 = "scarthgap:3217490cc554069ae53aa54cf8ad7327ce85fa10"

For more details about the CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-42533

[1] https://github.com/nginx/nginx/releases/tag/release-1.30.4

Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 09:28:53 +05:30
Wang Mingyu f056a64405 monocypher: upgrade 4.0.2 -> 4.0.3 
Changelog:
===========
- Fixed timing leak vulnerability in EdDSA/Ed25519 signatures.
- Various minor documentation fixes.
- Various minor build system fixes.
- Various minor compiler warning fixes.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 25cfd0324c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:27 +05:30
Ankur Tyagi 925aadf07c haveged: upgrade 1.9.22 -> 1.9.23 
Release Notes:
https://github.com/jirka-h/haveged/releases/tag/v1.9.23

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:21 +05:30
Ankur Tyagi 484be66fdf postfix: upgrade 3.8.17 -> 3.8.19 
Release Notes:
https://www.postfix.org/announcements/postfix-3.11.4.html
https://www.postfix.org/announcements/postfix-3.11.5.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:20 +05:30
Khem Raj 6ff79c13bf apache2: upgrade 2.4.67 -> 2.4.68 
This upgrade incorporates the fixes for CVE-2026-49975 CVE-2026-48913
CVE-2026-44631 CVE-2026-44186 CVE-2026-44185 CVE-2026-44119
CVE-2026-43951 CVE-2026-42536 CVE-2026-42535 CVE-2026-34356
CVE-2026-34355 CVE-2026-29170 CVE-2026-29167

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 23cdc4ca43)

Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.68

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-07-29 08:44:08 +05:30