mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-09 18:50:13 +00:00
Devansh Patel
b8bd073f05
Scarthgap already contains 4810cd8c5b [3], which backports
fb4ee161 and e61a5f36 for read-ahead/read-size handling. The
associated submission [4] labels that work as CVE-2026-26209, but
it does not add the max_depth protection required for uncontrolled
recursion [2].
Complete the existing backport with the 5.9.0 max-depth chain:
- bcb6cea4: add the C decoder depth limit [1]
- 94e0d212: add the security-essential pure-Python depth limit
- 53521e7c: apply the required type correction
- a7ac10d5: raise the default depth limit to 400
- d903d62c: synchronize the C function signature default
The 5.9.0 upgrade description [5] also identifies max_depth as the
CVE fix. Full upstream commit links are recorded in the embedded
patch headers.
[1] https://github.com/agronholm/cbor2/commit/bcb6cea4edde1d00ff4f0eece883dea951f66e1b
[2] https://github.com/advisories/GHSA-3c37-wwvx-h642
[3] https://git.openembedded.org/meta-openembedded/commit/?id=4810cd8c5bbc0b4349a78eac85a6a882bc0b03a2
[4] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105607.html
[5] https://www.mail-archive.com/openembedded-devel%40lists.openembedded.org/msg105418.html
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
43 lines
1.1 KiB
BlitzBasic
43 lines
1.1 KiB
BlitzBasic
DESCRIPTION = "An implementation of RFC 7049 - Concise Binary Object Representation (CBOR)."
|
|
DEPENDS +="python3-setuptools-scm-native"
|
|
|
|
LICENSE = "MIT"
|
|
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=a79e64179819c7ce293372c059f1dbd8"
|
|
|
|
SRC_URI[sha256sum] = "1c533c50dde86bef1c6950602054a0ffa3c376e8b0e20c7b8f5b108793f6983e"
|
|
|
|
inherit pypi python_setuptools_build_meta ptest
|
|
|
|
DEPENDS += "python3-setuptools-scm-native"
|
|
|
|
SRC_URI += " \
|
|
file://run-ptest \
|
|
file://CVE-2025-64076.patch \
|
|
file://CVE-2025-68131.patch \
|
|
file://CVE-2026-26209-pre1.patch \
|
|
file://CVE-2026-26209.patch \
|
|
file://CVE-2026-26209_p1.patch \
|
|
file://CVE-2026-26209_p2.patch \
|
|
file://CVE-2026-26209-dependent.patch \
|
|
file://CVE-2026-26209_p3.patch \
|
|
file://CVE-2026-26209_p4.patch \
|
|
"
|
|
|
|
RDEPENDS:${PN}-ptest += " \
|
|
python3-hypothesis \
|
|
python3-pytest \
|
|
python3-unittest-automake-output \
|
|
python3-unixadmin \
|
|
"
|
|
|
|
do_install_ptest() {
|
|
install -d ${D}${PTEST_PATH}/tests
|
|
cp -rf ${S}/tests/* ${D}${PTEST_PATH}/tests/
|
|
}
|
|
|
|
RDEPENDS:${PN} += " \
|
|
python3-datetime \
|
|
"
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|