Security Fixes (evtag, evrpc):
Fix an out-of-bounds read in decode_tag_internal.
(Found by Brubbish. GHSA-fj29-64w6-73h6)
Fix an integer overflow in evtag_unmarshal_header.
(Found by Brubbish. GHSA-45c6-qx49-89m8)
Security Fixes (evhttp):
Discard HTTP trailers, to prevent header smuggling attacks.
(Found by sebastianosrt. GHSA-2gmv-p5m7-98p6)
Restrict HTTP header parsing to prevent request smuggling.
(Originally reported by xclow3n; and then by kodareef5,
nstaller0490, AsafMeizneer, and yaotushaozhu.
GHSA-q39v-w2g7-gr8j.)
Treat CRLF and %00 more strictly in HTTP headers, to prevent
parser mismatch attacks.
(Reported by xclow3n and AsafMeizner. See GHSA-q39v-w2g7-gr8j,
GHSA-jcwh-pvf2-73p2.)
Fix a heap out-of-bound write that could occur when using
AF_UNIX sockets and compiling libevent with -DNDEBUG.
(Found by mat-mo. GHSA-cvq5-vrvr-j338)
Security fixes (evbuffer, bufferevent):
Fixed a dangling pointer in evbuffer_add_reference.
(Found by DarkaMaul. GHSA-c2pj-cg4r-88c8)
Security fixes (evdns):
Fix an out-of-bounds write in dnsname_to_labels
when building a DNS response of 2^16 bytes.
(Found by sectroyer. GHSA-58rx-7448-jw47)
Security fixes (example code):
Avoid using strcpy() in sample/http-server.c.
(Reported by sectroyer. GHSA-5rgj-2c58-7jrc.)
(From OE-Core rev: e6f3c20b057b809676f1df947fcbd3d6e927e894)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 9ae7030db6f5c415de94b6d85eaac418ae1e0f7b)
Full release notes:
* https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
Removed github style user references.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If libtool builds a binary it's best to use libtool to install it, as
otherwise you might install a wrapper script or need to make assumptions
about where libtool has put the real binary (as this isn't always .libs)
(From OE-Core rev: 9d8cfd0d991cc03afe26983abe16dcb5ca341898)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 1dc0e5e240adf61561c899108d2fb5be71e648e4)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a brief description on the new vex.bbclass that is used to generate
metadata needed by external tools to check for vulnerabilities.
(From yocto-docs rev: a380de04498f1340ad9b7aea15d7a6a90edb703c)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 32cf3414f5ed127f59119e38639bc8dbd57b7891)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
It also includes the upstream follow-up fixes referenced in [3]
and [4]. These correct the trailing whitespace check introduced
by the original fix and add the required <ctype.h> include for
isspace().
[1] 37a40fcb45
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58469
[3] 7b1cdecc49
[4] 82d945ff5d
(From OE-Core rev: 9b76cb0b22f9a0ec2877ac69ab4007f2cd2178e5)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a security release of Python 3.12
Release information: [1]
* drop CVE patches included in this release
* refresh all remaining patches via devtool
* remove some tab style in SRC_URI.
* add CVE_STATUS entries for CVEs fixed in this release but still
reported as Unpatched by cve-check (including 2 fixed already in
previous release)
[1] https://www.python.org/downloads/release/python-31214/
(From OE-Core rev: 57549d561886972b733952a4e4077cd8889d12ed)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The BER decoder shared by the CER and DER codecs parses long-form tags by
accumulating continuation octets without an upper bound on the tag ID size.
A crafted input can force construction of an arbitrarily large integer with
CPU cost growing quadratically, and can trigger unhandled ValueError
exceptions in the Python 3.11+ error formatting paths. Any application
decoding untrusted BER, CER, or DER input is affected.
scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.
Pick the upstream patch [1] as mentioned in [2].
[1] 628e36ecbb
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59884
(From OE-Core rev: 75ff4b187cf1b5e4e874cab8273ea84377b3c873)
Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The univ.Real type converts its mantissa, base, and exponent to a Python
float using exact big-integer exponentiation. A BER, CER, or DER encoded
REAL value only a few bytes long can carry a very large exponent, causing
float conversion through prettyPrint(), str(), comparison, arithmetic,
int(), or an explicit float() call to consume excessive CPU and memory and
hang applications that decode untrusted ASN.1 data and then print, log, or
compare the decoded objects.
scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.
Pick the upstream patch [1] as mentioned in [2].
[1] e60c691cb9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59886
(From OE-Core rev: 24991f7383dbe229a696ad209ae7d58115a051a1)
Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We export GIT_CEILING_DIRECTORIES=WORKDIR to ensure that git calls
inside the builds don't find oe-core when they're meant to be looking
for the git repository of the source code.
However, this breaks for recipes that use work-shared (such as llvm), as
their working directory is outside of WORKDIR.
Solve this by adding TMPDIR to the list as a final catch, but keeping
WORKDIR first so that git will stop sooner in the general case.
This solves reproduciblity problems in LLVM, where for example lld's
version string would contain the URL and commit hash of the poky repo
being built.
(From OE-Core rev: b2258129ecabc6a85fe9dc48f580e881d27a68c0)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f42f0185bd00e68ecc86a930487f21fc86214cfa)
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
[fatho: edit commit message by adding "cherry picked from"]
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The original backport applied upstream's CURLcode return path into
ssize_t ws_enc_write_head(), which uses an undeclared result and is
invalid for curl 8.7.1's API. Builds with --enable-websockets fail.
Adapt Curl_rand() error handling to set *err and return -1.
AI-Generated: Claude Sonnet 4.6
(From OE-Core rev: 152c139de6b1ad00d904b5fd16b4abc9852459a4)
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch applies the upstream glib-2-88 stable backport chain for
CVE-2026-58015. The issue is in the D-Bus SHA-1 authentication
mechanism, where a malicious peer could provide an unchecked cookie
context and cause the client to access unintended files while resolving
the cookie challenge.
Backport the upstream GLib fix chain from the glib-2-88 stable branch:
- db9c8fae398b validates cookie_context before keyring lookup. This is
the primary security fix for CVE-2026-58015 [1].
- c0531125344b tightens cookie ID parsing so empty, negative, and
out-of-range values are rejected. This hardens the same SHA-1 cookie
challenge parser and is covered by the upstream regression test [2].
- 060aea67de75 exposes the private client reject-reason vfunc. This is
test-support plumbing required by the upstream regression test [3].
- 091930196229 adds the upstream regression test for SHA-1 cookie
challenge parsing [4].
Add dbus-native to PACKAGECONFIG[tests] so Meson can find dbus-daemon
when building the new installed D-Bus regression test for ptest. This is
kept as a native-only test dependency to avoid adding a target dbus
dependency to glib.
[1] db9c8fae39
[2] c053112534
[3] 060aea67de
[4] 0919301962
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-58015
(From OE-Core rev: b6b82e3c1442b658bd4c1689e09792c9a3a96947)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
