mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-09 18:50:13 +00:00
Darsh Kelaiya
12088f5bdd
This patch applies the reviewed upstream fix commits shown in [1] and [2]. The advisory identifying the fix is referenced in [3]. The python3-brotli 1.2.0 upgrade commit [4] is omitted because Scarthgap currently provides python3-brotli 1.1.0. Brotli 1.2.0 adds the bounded decompression API required by the upstream aiohttp fix. Consequently, this backport disables optional Brotli response decoding while retaining bounded decompression for the supported zlib path. [1] https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a [2] https://github.com/aio-libs/aiohttp/commit/92477c5a74c43dfe0474bd24f8de11875daa2298 [3] https://nvd.nist.gov/vuln/detail/CVE-2025-69223 [4] https://github.com/openembedded/meta-openembedded/commit/382e4de7d8b7d0e980fefcda7a06e5f20f5f26c0 Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>