mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity
76,344 Commits 38 Branches 626 Tags
492fbe84e8fadee727e89df39fcf832c97009db9
Commit Graph

76344 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tim Orling
492fbe84e8 python3-babel: fix CVE_PRODUCT 
Recipe (PV): python3-babel (2.14.0)
Before -> After: python:Babel -> pocoo:babel
Newly caught CVEs: CVE-2021-42771 (locale .dat deserialization RCE)
Status: patched (fixed 2.9.1)

Note: The original commit targeted python3-babel_2.18.0.bb. This is
adjusted for Scarthgap, where the recipe version is 2.14.0.

AI-Generated: Claude Sonnet 5
(From OE-Core rev: 27c524d5c69993338612461831f7aec054eb4d00)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 134175fa92b85e639dc4646d9a88eeaba0fae4d3)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Jakub Szczudlo (Nokia)
35a3f1bb5d gnutls: fix for CVE-2026-42011 
Backport patches to fix CVE-2026-42011 and extend test for it

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-42011

Upstream fix:
  1dead2faec
  24713b8c63

Tested with ptest

(From OE-Core rev: 81e15180ec6df4785d05c52d074fbad859eafb61)

Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Jakub Szczudlo (Nokia)
815238195b gnutls: fix CVE-2026-42010 
Backport patch to fix CVE-2026-42010.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-42010

Upstream fix:
  cb1833afd9

Tested with ptest

(From OE-Core rev: 2b1ed475e021c0eb13014a170911e96b1b0aed28)

Signed-off-by: Jakub Szczudlo <jakub.szczudlo@nokia.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Peter Marko
5f2d0ad996 alsa-lib: patch CVE-2026-56109 
Pick patch listed in NVD CVE report.

(From OE-Core rev: 1f7cd9a1c65bfc1a4dbba3830d7092acf02174fd)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Peter Marko
13d8cd57a7 libevent: set status for CVE-2026-63380 
Per [1] this only affects 2.2.1-alpha.
Also [2] markes their versions as not-affected.

[1] https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34
[2] https://security-tracker.debian.org/tracker/CVE-2026-63380

(From OE-Core rev: 7447b6ffb1ef18cecd7d45d2e397018dfa54c78d)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Ross Burton
1e77c861bc libevent: upgrade 2.1.12 -> 2.1.13 
Security Fixes (evtag, evrpc):

  Fix an out-of-bounds read in decode_tag_internal.
  (Found by Brubbish. GHSA-fj29-64w6-73h6)

  Fix an integer overflow in evtag_unmarshal_header.
  (Found by Brubbish. GHSA-45c6-qx49-89m8)

Security Fixes (evhttp):

  Discard HTTP trailers, to prevent header smuggling attacks.
  (Found by sebastianosrt. GHSA-2gmv-p5m7-98p6)

  Restrict HTTP header parsing to prevent request smuggling.
  (Originally reported by xclow3n; and then by kodareef5,
  nstaller0490, AsafMeizneer, and yaotushaozhu.
  GHSA-q39v-w2g7-gr8j.)

  Treat CRLF and %00 more strictly in HTTP headers, to prevent
  parser mismatch attacks.
  (Reported by xclow3n and AsafMeizner. See GHSA-q39v-w2g7-gr8j,
  GHSA-jcwh-pvf2-73p2.)

  Fix a heap out-of-bound write that could occur when using
  AF_UNIX sockets and compiling libevent with -DNDEBUG.
  (Found by mat-mo. GHSA-cvq5-vrvr-j338)

Security fixes (evbuffer, bufferevent):

  Fixed a dangling pointer in evbuffer_add_reference.
  (Found by DarkaMaul. GHSA-c2pj-cg4r-88c8)

Security fixes (evdns):

  Fix an out-of-bounds write in dnsname_to_labels
  when building a DNS response of 2^16 bytes.
  (Found by sectroyer. GHSA-58rx-7448-jw47)

Security fixes (example code):

  Avoid using strcpy() in sample/http-server.c.
  (Reported by sectroyer. GHSA-5rgj-2c58-7jrc.)

(From OE-Core rev: e6f3c20b057b809676f1df947fcbd3d6e927e894)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

(From OE-Core rev: 9ae7030db6f5c415de94b6d85eaac418ae1e0f7b)
Full release notes:
* https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
Removed github style user references.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Pratik Farkase
235c6f7619 libevent: merge inherit statements 
Merge the separate inherit statements into a single one for
improved readability and consistency with OE style.

No functional change intended.

(From OE-Core rev: d7da98bea1a60b2f31806c9f2dd4f499737b22ad)

Signed-off-by: Pratik Farkase <pratik.farkase@est.tech>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 99792ab6ba188a7623804e587edf8de23690ad3f)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Ross Burton
8cddf22d4d libevent: use libtool to install test binaries 
If libtool builds a binary it's best to use libtool to install it, as
otherwise you might install a wrapper script or need to make assumptions
about where libtool has put the real binary (as this isn't always .libs)

(From OE-Core rev: 9d8cfd0d991cc03afe26983abe16dcb5ca341898)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 1dc0e5e240adf61561c899108d2fb5be71e648e4)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Vijay Anusuri
4e5fdf25e3 libxfont2: Fix CVE-2026-56003 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-56003
[2] https://security-tracker.debian.org/tracker/CVE-2026-56003

(From OE-Core rev: 0590e69f65ec1da5d545faec44fdfa8be8a03631)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Vijay Anusuri
bd2ef0458c libxfont2: Fix CVE-2026-56002 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-56002
[2] https://security-tracker.debian.org/tracker/CVE-2026-56002

(From OE-Core rev: 1b47a4e636bbda15b00379ac7a732ffade7a6274)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Vijay Anusuri
28e31d5c6b libxfont2: Fix CVE-2026-56001 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-56001
[2] https://security-tracker.debian.org/tracker/CVE-2026-56001

(From OE-Core rev: 78e09979d47a03846afa7c52758e6f24ac659627)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Jaipaul Cheernam
04cc7f252d util-linux: Fix CVE-2026-3184 
Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-3184
[2] 8b29aeb081

(From OE-Core rev: 2b3600a80144dcf4ca2632b010c59e8df254a6f9)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Vijay Anusuri
c71dd3cb0d p11-kit: Fix CVE-2026-13757 
Pick patch according to [2]

[1] https://nvd.nist.gov/vuln/detail/cve-2026-13757
[2] https://ubuntu.com/security/CVE-2026-13757

(From OE-Core rev: 1233224dcb13924b1366775a71fdf0ce72e3a589)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Hetvi Thakar
abef4d0701 python3-idna: Fix CVE-2026-45409 
This patch applies the complete upstream fix chain for
CVE-2026-45409. Commit [1] introduces early domain-length rejection
required by [2]. Commit [2] is the v3.14 fix identified by [5], and
commit [3] extends the protection to per-label conversions and codec
support to complete the v3.15 fix described in [4].

[1] https://github.com/kjd/idna/commit/c0dda4501df5
[2] https://github.com/kjd/idna/commit/628fef84d3ed
[3] https://github.com/kjd/idna/commit/e1cb465b6376
[4] https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx
[5] https://security-tracker.debian.org/tracker/CVE-2026-45409

(From OE-Core rev: 09773d9d1b44dfe868913b6bb142a728529f62cb)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Anil Dongare
3ffe50e092 apt: mark CVE-2011-3374 as not-applicable-config 
Details: https://security-tracker.debian.org/tracker/CVE-2011-3374

The vulnerability is a design-level flaw in the legacy apt-key utility regarding
the global trust model of GPG keys.

This is marked as not-applicable-config because apt-key net-update is
disabled by default, and Debian vendor configuration does not define the
archive keyring URI required to use that path. Ignore this CVE in this
recipe due to this configuration.

(From OE-Core rev: fea209d2e34efbd3bc3dc5af0f6df61f6a8a4353)

Signed-off-by: Anil Dongare <adongare@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: made commit title more precise.
net-update is disabled by default here:
  https://salsa.debian.org/apt-team/apt/-/blob/2.6.1/cmdline/apt-key.in?ref_type=tags#L179
]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-11 14:32:08 +01:00
Trevor Woerner
b2c16f1e69 toaster-manual: spell the json code-block language in lower case 
Pygments resolves either spelling, so nothing renders differently. Every
other block in the documentation uses the lower-case form.

AI-Generated: codex/claude opus 5 (xhigh)
(From yocto-docs rev: 728c63c050c22ad1469d9efa5d81e96c42f83c93)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Link: https://patch.msgid.link/20260831021255.4064163-4-twoerner@gmail.com
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 3bc15cadd98b071e16cd4a806f284cbfc94fd408)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 18:01:37 +01:00
Trevor Woerner
4db046100a dev-manual: quote the values in two recipe examples 
Both fail to parse.

AI-Generated: codex/claude opus 5 (xhigh)
(From yocto-docs rev: 8ce3614d2cc4494b1c8bf88452eeed4d3f1e586c)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Link: https://patch.msgid.link/20260831021255.4064163-3-twoerner@gmail.com
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit fc81d055ab85d2d55d440f20f442b552d1374a26)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 18:01:37 +01:00
Trevor Woerner
bab7cf95b3 ref-manual: fix a typo in the QB_SMP description 
AI-Generated: codex/claude opus 5 (xhigh)
(From yocto-docs rev: 476df69c65d09418cd994801eae6cc6b9d141a92)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Link: https://patch.msgid.link/20260831021255.4064163-2-twoerner@gmail.com
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 1c923f5f6f3f9b2df6285d07bef56e95f05daf4f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 18:01:37 +01:00
Trevor Woerner
e8c7805f25 ref-manual: drop the full stop from the QB_SMP example 
The full stop belongs to the sentence, not to the value. BitBake rejects
the line as printed.

AI-Generated: codex/claude opus 5 (xhigh)
(From yocto-docs rev: 320203114a8af9ea9a32b1b23b28c35e4521e15d)

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Link: https://patch.msgid.link/20260831021255.4064163-1-twoerner@gmail.com
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 45ad427bc86566d47ff5213e9826a8e81cef412f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 18:01:37 +01:00
Robert P. J. Day
33f791f326 documentation: use "https" protocol for git.yoctoproject.org 
Since the git protocol is not supported anymore, change all references
to "git.yoctoproject.org" to use https instead. This is a simple
textual substitution across the various manuals.

(From yocto-docs rev: c41b8dae58522bad38a2c65df6cadfbe40a29d4e)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Link: https://patch.msgid.link/a297f905-8632-7861-aff1-cfdf143e7548@crashcourse.ca
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit abf31bc25d542048f4c07504f3363e93eba9bb61)
[ag: fix minor conflicts]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 18:01:37 +01:00
Antonin Godard
1003ae5fab ref-manual: add new vex class 
Add a brief description on the new vex.bbclass that is used to generate
metadata needed by external tools to check for vulnerabilities.

(From yocto-docs rev: a380de04498f1340ad9b7aea15d7a6a90edb703c)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 32cf3414f5ed127f59119e38639bc8dbd57b7891)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 18:01:37 +01:00
Richard Purdie
07c7fba6d0 build-appliance-image: Update to scarthgap head revision 
(From OE-Core rev: 048f2f8e8864ae5861afe95ea52efc0354bfc18c)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 18:01:37 +01:00
Hetvi Thakar
00e6a3df8c patch: Fix CVE-2026-56288 
This patch applies the upstream fix referenced by NVD in [2], using
the commit shown in [1].

[1] https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=e6d6a4e021660679d7fc9150f981d4920f722313
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56288

(From OE-Core rev: 1b1e13055b4eed838e1411d91dea46de08e1d72f)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a30cd69993f9f48d5cf55e57181e49171f0a1b7a)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Hetvi Thakar
f03efa1107 patch: Fix CVE-2026-56289 
This patch applies the upstream fix referenced by NVD in [2], using
the commit shown in [1].

[1] https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=faba04ef4f2b410257f76c1b9dc85e350929c4b9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56289

(From OE-Core rev: b1540647185015c99fbf421d889547a6c10e7e29)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 48c1aa91e829a87c398e8c012cde45cd8c1aab0a)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Siddharth Doshi
dc97ef25ad vim: Security Fix for CVE-2026-57456 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-57456
[2] https://security-tracker.debian.org/tracker/CVE-2026-57456

(From OE-Core rev: 146c6244fdc0647f6c24b92cc8410da02645ee96)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Siddharth Doshi
b3092dd954 vim: Security Fix for CVE-2026-59858 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-59858
[2] https://security-tracker.debian.org/tracker/CVE-2026-59858

(From OE-Core rev: 7a9e6b91121683b4694d11138f148bfdd3e6f97a)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Siddharth Doshi
4d706214f7 vim: Security Fix for CVE-2026-59857 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-59857
[2] https://security-tracker.debian.org/tracker/CVE-2026-59857

(From OE-Core rev: 65c4b003cddf3a2489118a04c3caec37c8256df7)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Siddharth Doshi
7d5a2907dd vim: Security Fix for CVE-2026-59856 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-59856
[2] https://security-tracker.debian.org/tracker/CVE-2026-59856

(From OE-Core rev: fbffe073ee8694f5c69e2f84aee356d5d02238f5)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Siddharth Doshi
7a38ffe737 vim: Security Fix for CVE-2026-57455 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-57455
[2] https://security-tracker.debian.org/tracker/CVE-2026-57455

(From OE-Core rev: 91c8229fe73a22fdd07cec3db56fee2f281f1942)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Siddharth Doshi
d4b6cf3a61 vim: Security Fix for CVE-2026-57452 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-57452
[2] https://security-tracker.debian.org/tracker/CVE-2026-57452

(From OE-Core rev: 140b752df903df36a10ffeb1f2bca7b2e3bb8a06)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Siddharth Doshi
68da6e5e76 vim: Security Fix for CVE-2026-55895 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-55895
[2] https://security-tracker.debian.org/tracker/CVE-2026-55895

(From OE-Core rev: 87b2def5858ea51650b1e0381ed104d5670c50b1)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Siddharth Doshi
ce0d6f7939 vim: Security Fix for CVE-2026-55892 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-55892
[2] https://security-tracker.debian.org/tracker/CVE-2026-55892

(From OE-Core rev: df7fb45b185ad3fd3b339ee25ce9dad041741f25)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Siddharth Doshi
4957a62a52 vim: Security Fix for CVE-2026-55693 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-55693
[2] https://security-tracker.debian.org/tracker/CVE-2026-55693

(From OE-Core rev: f4d6729cf38708effd445aa739bfd34d3adda3d0)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Hetvi Thakar
56161d9fc4 wget: Fix CVE-2026-58472 
Apply the upstream fix referenced in [2] using the commit
listed in [1].
Also include the upstream follow-up commit [3], which fixes
encoded entity length handling and adds regression tests.

[1] dd692d9cea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58472
[3] f76978a51b

(From OE-Core rev: c359e2d4f41b352b26004f3f9590bef29815b3a1)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Hetvi Thakar
23aff30de0 wget: Fix CVE-2026-58471 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] c2640fe517
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58471

(From OE-Core rev: e8a20e6c7f6b2fc06b1ef0fabf63ed5fc349f1ac)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Hetvi Thakar
a3df9d6274 wget: Fix CVE-2026-58469 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

It also includes the upstream follow-up fixes referenced in [3]
and [4]. These correct the trailing whitespace check introduced
by the original fix and add the required <ctype.h> include for
isspace().

[1] 37a40fcb45
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58469
[3] 7b1cdecc49
[4] 82d945ff5d

(From OE-Core rev: 9b76cb0b22f9a0ec2877ac69ab4007f2cd2178e5)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Jaipaul Cheernam
1a7b2e6b68 perl: fix CVE-2025-40909 
This patch applies the upstream fix as referenced in [1], using the
commit shown in [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-40909
[2] 918bfff86c

(From OE-Core rev: 4a210e907972f476c87fbfefe502735abd230dce)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: CVE-2025-40909.patch is not merged on a main branch but was
provided by upstream to facilitate backport (Thanks!)
https://github.com/Perl/perl5/issues/23010#issuecomment-2919448987
]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Jaipaul Cheernam
68cfa8f4db perl: fix CVE-2026-57432 
This patch applies the upstream fix as referenced in [1], using the
commits shown in [2] and [3].

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-57432
[2] 5f7eb6bbbe
[3] 40754edc72

(From OE-Core rev: 93fbbdc19eea157c4c9b040291481c4f778ab6db)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Jaipaul Cheernam
f4fecd5a7b perl: fix CVE-2026-13221 
This patch applies the upstream fix as referenced in [1], using the
commit shown in [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-13221
[2] 03f74bbbd3

(From OE-Core rev: dd5aee19c57a18b1c403496190e832234afc3b4b)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Peter Marko
1045aca106 gnutls: set status for CVE-2026-1584 
Set status per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-1584

(From OE-Core rev: a04716f2209d4d374d7e42388776917fb4179adc)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Peter Marko
bf5d6de552 libarchive: patch CVE-2026-5745 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-5745

(From OE-Core rev: f35b64a303e5c3641a76576e69fe921a4b6166f9)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Peter Marko
fd0ffc6666 libarchive: handle CVE-2026-5121 
Cherry-pick patch for this CVE mentioned in [1].

Since the actual code change is already included in previous patch for
CVE-2026-4426, add reference to CVE-2026-5121 to that patch and keep the
remaining part (test) as CVE-2026-5121-02.patch.

[1] https://security-tracker.debian.org/tracker/CVE-2026-5121

(From OE-Core rev: 608a151948db9652b0e7032863bba1ed022a00aa)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Peter Marko
88843705b1 systemd: upgrade 255.21 -> 255.22 
Full changelog (36 commits):
* https://github.com/systemd/systemd-stable/compare/v255.21...v255.22

(From OE-Core rev: 846292594d7513e0ffbec5e0481084844505b51c)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: fixed changelog URL]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Peter Marko
72055be747 python3: upgrade 3.12.13 -> 3.12.14 
This is a security release of Python 3.12
Release information: [1]

* drop CVE patches included in this release
* refresh all remaining patches via devtool
* remove some tab style in SRC_URI.
* add CVE_STATUS entries for CVEs fixed in this release but still
  reported as Unpatched by cve-check (including 2 fixed already in
  previous release)

[1] https://www.python.org/downloads/release/python-31214/

(From OE-Core rev: 57549d561886972b733952a4e4077cd8889d12ed)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Emily Vekariya
d78b160b6c python3-pyasn1: Fix CVE-2026-59884 
The BER decoder shared by the CER and DER codecs parses long-form tags by
accumulating continuation octets without an upper bound on the tag ID size.
A crafted input can force construction of an arbitrarily large integer with
CPU cost growing quadratically, and can trigger unhandled ValueError
exceptions in the Python 3.11+ error formatting paths. Any application
decoding untrusted BER, CER, or DER input is affected.

scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.

Pick the upstream patch [1] as mentioned in [2].

[1] 628e36ecbb
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59884

(From OE-Core rev: 75ff4b187cf1b5e4e874cab8273ea84377b3c873)

Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Emily Vekariya
a2d922f58f python3-pyasn1: Fix CVE-2026-59886 
The univ.Real type converts its mantissa, base, and exponent to a Python
float using exact big-integer exponentiation. A BER, CER, or DER encoded
REAL value only a few bytes long can carry a very large exponent, causing
float conversion through prettyPrint(), str(), comparison, arithmetic,
int(), or an explicit float() call to consume excessive CPU and memory and
hang applications that decode untrusted ASN.1 data and then print, log, or
compare the decoded objects.

scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.

Pick the upstream patch [1] as mentioned in [2].

[1] e60c691cb9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59886

(From OE-Core rev: 24991f7383dbe229a696ad209ae7d58115a051a1)

Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Jaipaul Cheernam
3dcbd1b54b systemd: Fix CVE-2026-29111 
Backport patches from upstream systemd to fix CVE-2026-29111, where
systemd (as PID 1) hits an assert and freezes execution when an
unprivileged IPC API call is made with spurious data.

Pick patches from [1], [2], [3] and [4] as referenced in [5].

Note: As scarthgap is using 255 version picked fixes from 257

[1] 20021e7686
[2] 7ac3220213
[3] 2116700657
[4] 54588d2ded
[5] https://security-tracker.debian.org/tracker/CVE-2026-29111

(From OE-Core rev: b229b0b6c4004c6588e684d790343df249cedd57)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Hemanth Kumar M D
83b4945732 glibc: fix CVE-2026-5435 
resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)

Specifically, CERT, TKEY, TSIG, OPT.  This removes the buggy
implementations of TSIG, fixing bug 34033, and partially
fixing bug 34069.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-5435
[2] https://sourceware.org/bugzilla/show_bug.cgi?id=34033
[3] https://sourceware.org/git/?p=glibc.git;a=commit;h=ca44a6609c29a683b03575fa035c6d17aa591e72

(From OE-Core rev: 336e429b4d0048964cf883c187438ca7c5aca2ea)

Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: This patch will change output of a debug and deprecated function.
     Upstream chose to remove the vulnerable implementation instead of
     fixing it.
     See: https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0011
]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Martin Jansa
ca1fb3108c socat: fix native build on host with newer glibc 
Fixes:
../socat-1.8.0.0/filan.c: In function ?printtime?:
../socat-1.8.0.0/filan.c:1065:46: error: assignment of read-only location ?*(const char *)strchr(s, 10)?
 1065 |       if (strchr(s, '\n'))  *strchr(s, '\n') = '\0';
      |                                              ^

(From OE-Core rev: 0cd52c822a9929399fe8840955ff451216182f36)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-09-04 10:39:10 +01:00
Richard Purdie
69ae79bf5a build-appliance-image: Update to scarthgap head revision 
(From OE-Core rev: 310eec2cb646d7d1a3ca99bad7e37495bb418a0d)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
 2026-08-28 09:52:43 +01:00