CVE-2026-8458 allows a Negotiate-authenticated connection to be
incorrectly reused for a request using a different SASL service name.
Scarthgap uses curl 8.7.1, which is within the affected version range.
The vulnerable code path on Linux requires both Negotiate authentication
and GSSAPI support, represented by the negotiate-auth and krb5
PACKAGECONFIG options.
The upstream fix [1] stores the SASL service name in struct Curl_creds
and includes it in connection-reuse comparisons. However, struct
Curl_creds was introduced by the credential-management rework in [2],
after curl 8.7.1. Therefore, the security fix cannot be cleanly
backported without introducing a substantial credential-management
refactor.
Use a conditional CVE_STATUS as the least invasive solution. Report the
CVE as unpatched when both krb5 and negotiate-auth are enabled. Otherwise,
mark it not-applicable-config because the vulnerable GSSAPI-backed
Negotiate implementation is not built. The default Scarthgap
configuration enables negotiate-auth but does not enable krb5.
References:
[1] https://github.com/curl/curl/commit/5e99b73cf441d9c369768b9cd48b5389b9a2503d
[2] https://github.com/curl/curl/commit/8f71d0fde515aa4c68002477356c35bd79927729
[3] https://curl.se/docs/CVE-2026-8458.html
(From OE-Core rev: e986fa2c8d74c1b943bb9069e47d1a9ae7dee9e0)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The inherited "python:Mako" mapping is not used for the packaged Mako
source and causes its vulnerability records to be missed.
Use "makotemplates:mako" for its historical NVD configuration identity
and "sqlalchemy:mako" for the current NVD dictionary CPE, NVD
configuration, and CNA affected-data identity.
Backport note: this applies the metadata to Scarthgap Mako 1.3.2 rather
than master 1.4.1; the older release exposes applicable unpatched records.
(From OE-Core rev: d419d38614ad7dae149e005ac6183c0290f54b2d)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 76fc2046d3f251af34dd04f8fdcfc0c1d6016380)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
PLY 3.11 contains the picklefile parameter described by
CVE-2025-56005, but exploitation requires an application to
explicitly pass an attacker-controlled pickle file to yacc().
No OE-Core consumer uses this parameter. Ubuntu ignores the issue for
the same reason [1], and NVD records the CVE as disputed [2].
[1] https://ubuntu.com/security/CVE-2025-56005
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-56005
(From OE-Core rev: 9bce52b90a6783e0ba23ff048209ea88922fd1da)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Analysis:
- NVD marks CVE-2018-20225 as disputed. [1]
- pip searches all configured package indexes without priority and selects
the highest matching version. --extra-index-url adds an equal-priority
package source. [2]
- Exploitation requires use of --extra-index-url and an attacker-published,
higher-version package with the name of a private package. [1]
- Upstream closed the related report as not planned, and Red Hat classified
the issue as WONTFIX because this behavior is intentional. [3][4]
- Record the disputed status; no source patch is available.
Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2018-20225
[2] https://pip.pypa.io/en/stable/cli/pip_install/
[3] https://github.com/pypa/pip/issues/12874
[4] https://bugzilla.redhat.com/show_bug.cgi?id=1835736
(From OE-Core rev: 34c0972ffea7dcf4888e3bcfe0ce17206b32e408)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
When qemu test runs only produce suffixed bootlog variants, the base
bootlog path may not exist. os.symlink() creates a dangling symlink
in the oeqa result log directory.
Avoid advertising a boot log in the collected test results when that
path does not exist. Guard the symlink creation and log a note instead.
This is a partial backport of master commit
7a6596925cb0eb8dd48a0362a51875cdd60152bc. Only the symlink guard is
picked here; the bootlog variant globbing from master is not applicable
to scarthgap.
(From OE-Core rev: 6672769e251ab0dd42fc5f5cde99800ed5ba8289)
Signed-off-by: Peter Tatrai <peter.tatrai.ext@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This was introduced as a test for the fix in 6ec70d5d2e330b41b932b0a655b838a5f37df01e
however the way github works has changed in the decade since and this
test is no longer testing what was intended.
The test is failing intermittently on our infrastructure thanks to spam
and IP block throttling restrictions which lead to occasional failures.
At this point it is probably simplest just to drop the url from testing.
(Bitbake rev: 1b619d136c01c97ab1b76a75e8845cddc5e49735)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b59bdcf8134e6f5935e8f7b0ed8033cbb745e0ff)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
We're having issues with github urls, switch many of the test repos to our own
mirror copies. Some mirror copies are modified to reduce their size and improve test
times. More needs to be done in that area!
(Bitbake rev: 931a230a28a0582552f098e97d94299f310fd2eb)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9dbf27b9fd04c40c87f25eb6cbd884db5c7f2160)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This single url takes 100s in each of the two tests it is used in,
compared to the fraction of a second for the other urls. Nobody
should really be using ftp any more anyway, drop this test url.
(Bitbake rev: 4b8695f0708f4da5ed16e97ae7bcfb69fdd1e3ed)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a181827fa0fe6738441b40b5206cc2cadb5f7dce)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The tools-profile feature was introduced in 2007 with eabfa35d7c
("Rewrite IMAGE_FEATURES tools options (people may be to update their
local.conf), split into debug and profiling and add more profiling
tools.") but was not documented. Add the feature to the list.
(From yocto-docs rev: 40952d60ef81203994bf385f4f75b5419e2356cb)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 3c55d1af536c202d585e335bdcc417479d6e1ddc)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The BBFILES is most likely never set by the local.conf file, but the
layer.conf file.
(From yocto-docs rev: ab632c9b814704af730b7f67153ef4124ade0118)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 2f2cb936a285ef48b4f10698d19a3e934d1417f7)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
It's "FILESOVERRIDES" that defines how OE uses FILESPATH, not
"OVERRIDES".
(From yocto-docs rev: 7143ee49cab226d355d5fb8685bfe0456fcdfdd7)
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 77ae9193d5793a92d6fc77db88dddbce54079fd3)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
u-boot-tools builds host utilities from the same source as u-boot, but it
does not inherit the existing CVE_PRODUCT assignment and falls back to its
unrecognized recipe-name identity. Move the mapping to u-boot-common.inc
so both recipes inherit it.
Use "u-boot:u-boot" for the CNA/CVE List V5 affected-data identity and
"denx:u-boot" for the NVD dictionary CPE and configuration identity. The
CNA records are also covered by NVD today, but retaining both authoritative
identities permits direct matching independently of NVD enrichment.
(cherry picked from commit bc30a343627e2d207c38d2262a7b07f506259051)
(From OE-Core rev: 9170fe393c379b9161a8843506420269f5b53e40)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The related CVEs are tracked using pytest:py CPE, so set the CVE_PRODUCT
accordingly instead of the default python:py.
See CVE db query:
sqlite> select * from products where product like 'py';
CVE-2020-29651|pytest|py|||1.9.0|<=
CVE-2022-42969|pytest|py|||1.11.0|<=
(From OE-Core rev: 6a1595b2a8e41186c4120c90ef16a3309e1e2144)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 1fac509459c4e2d970121b66ae33cd53ef1eb8a6)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: This is a cherry-pick from meta-openembedded]
Signed-off-by: Paul Barker <paul@pbarker.dev>
Release information [1]:
OpenSSL 3.5.8 is a security patch release. The most severe CVE fixed in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fixed QUIC server being able to trigger double free when processing INITIAL packet. (CVE-2026-18798)
* Fixed heap buffer overflow in CMS key unwrapping. (CVE-2026-63072)
* Fixed invalid pointer dereference in CMP server via crafted protectionAlg. (CVE-2026-63076)
* Fixed unbounded memory growth in QUIC server incoming channel queue. (CVE-2026-14456)
* Fixed RPK server signature algorithm selection being able to dereference a missing certificate. (CVE-2026-14457)
* Fixed excessive memory use buffering DTLS records for a future epoch. (CVE-2026-54874)
* Fixed untrusted Sender DN being used as a format string in CMP response validation. (CVE-2026-63073)
* Fixed CMP indefinite cache growth of extraCerts. (CVE-2026-63074)
* Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. (CVE-2026-63075)
* Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher(). (CVE-2026-75803)
* Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode.
[1] https://github.com/openssl/openssl/blob/openssl-3.5/NEWS.md#major-changes-between-openssl-357-and-openssl-358-25-aug-2026
(From OE-Core rev: be8ba3d5f91675e390996dbc3bcbce3275052af8)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit db81c1a42a0f552d9a8ec124f004ae2063d58c33)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
We need a reliable mirror of the bitbake repo and github is no longer that. Swap
to use the bitbake-contrib repo which carrys enough bitbake data to work for the
tests we need.
(Bitbake rev: cd50c3481e32afff995a143c3459cfa5ae25abd5)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f311ff38b4bf79675f677f73f1d390723b1c4490)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The grpc repo is 1GB in size and makes a poor choice of test repo. With github
rate limiting, it is proving probematic.
Swap if for our own gitsm test repo which is smaller but can serve the purposes
of the test.
(Bitbake rev: 24b0e0bf27183cfb5ca61984c4d8f4b02242b9f6)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a64b3157d74f883002318cc46c70bfa1c3609110)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
If the gitsm:// url contains a git submodule with a relative "../" path
and the fetcher is configured to use a premirror, it will fail as the
host name encoded in the original url is lost and the correct paths
can't be found.
Save the original url data in the new data so that it can be consulted to
fix this kind of edge case.
The test case change that follows this provides a test of this functionality.
(Bitbake rev: ecfde933b848b5120858b922236f57238a6e1fed)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 58872250f72f5760b4126552bdec5497f5a1a1f4)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
blob.exists() and blob.download_to_filename() can raise
google.api_core.exceptions.GatewayTimeout after the GCS client's own
retries. Uncaught, that escapes as a hard error instead of a normal
fetch/checkstatus failure (and blocks mirror fallback on download).
Catch GatewayTimeout in checkstatus() and download(), log a warning so
the timeout is visible, and raise FetchError.
(cherry-picked from commit 251f01e9afa1dcb9a49f8a31981e698017a43754)
AI-Generated: Cursor with Grok 4.5
(Bitbake rev: c085e5e2a91cda2b10f14b72d6f5fac8b8c209b6)
Signed-off-by: Sebastian Muxel <smuxel@snap.com>
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Daniel Turull
Devansh Patel
Jakub Szczudlo (Nokia)
Hetvi Thakar
Peter Marko
Hitendra Prajapati
Jaipaul Cheernam
Adarsh Jagadish Kamini
Vijay Anusuri
Peter Tatrai
Richard Purdie
Lee Chee Yang
Antonin Godard
Robert P. J. Day
Darsh Kelaiya
Gyorgy Sarvari
Deepak Rathore
Yoann Congal
Sebastian Muxel