This patch applies the upstream fix as referenced in [2], using
the commit shown in [1].
The backport makes Template URI normalization strip all leading
slashes, preventing a double-slash URI from bypassing the path
traversal check while keeping Mako at version 1.3.2.
[1] e05ac61989
[2] https://github.com/advisories/GHSA-v92g-xgxw-vvmm
(From OE-Core rev: 0c13fdc7798a24dadb60b7dba60049558bf5c021)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The tpm PACKAGECONFIG passed "-D TPM_ENABLE=TRUE/FALSE", but ovmf
renamed that macro to TPM2_ENABLE in edk2 commit 4de8d61bcec0
("OvmfPkg: rework TPM configuration", first released in
edk2-stable202202). Since then TPM_ENABLE has been an unknown macro
that edk2 ignores, so TPM2 support was never compiled in, even for
MACHINEs with 'tpm'/'tpm2' in MACHINE_FEATURES.
Use TPM2_ENABLE (as defined in
OvmfPkg/Include/Dsc/OvmfTpmDefines.dsc.inc and consumed by
OvmfPkgX64.dsc) so the tpm PACKAGECONFIG actually enables TPM2 support.
The same commit also added a separate TPM1_ENABLE macro (TPM 1.2
support, default TRUE), but its dsc.inc snippets are only included
inside OvmfPkgX64.dsc's "!if $(TPM2_ENABLE) == TRUE" block, so it has
no effect unless TPM2_ENABLE is TRUE. No separate PACKAGECONFIG knob is
needed.
(From OE-Core rev: e01b71bd0e69226399902ea4b0c58dae24ab70c3)
Signed-off-by: Eilís 'pidge' Ní Fhlannagáin <pidge@baylibre.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d6b434455544e5922d75ba07a74490e6a6df7a0c)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE-2026-72522 is an out-of-bounds read and infinite loop vulnerability in
Expat's *_toUtf16 functions caused by mis-classifying low surrogates as
high surrogates.
Our Yocto configuration is not affected by this vulnerability:
- Expat is compiled with EXPAT_CHAR_TYPE=char (8-bit character representation).
- Neither XML_UNICODE nor XML_UNICODE_WCHAR_T is defined.
- The vulnerable *_toUtf16 functions are only invoked when Expat's internal
character type is 16-bit (ushort or wchar_t).
- In 8-bit mode, Expat handles conversion using *_toUtf8 functions even when
parsing UTF-16 encoded XML inputs, rendering the vulnerable code path
unreachable.
Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-72522
[2] 8fbfb52fa8
(From OE-Core rev: dbdc9e8d18374a2586c24e1ba41bfa1dcba3ef39)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: EXPAT_CHAR_TYPE=char is the default and we do not change it]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
With this change, 1 Patched CVE is properly reported:
* CVE-2023-52323
(From OE-Core rev: c130a84998e9d22a5a228acc677676620853bb57)
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c2a2ae48add874f41c5b60ca90ba3a26ebb0fe38)
The current pypi default "python:pycryptodomex" has no matching NVD CPE
or configuration identity. Use "pycryptodome:pycryptodomex", the active
NVD dictionary CPE and configuration identity for the packaged
distribution, so CVE-2023-52323 is properly reported as patched.
Note: The original commit targeted python3-pycryptodomex_3.23.0.bb. This
is adjusted for Scarthgap, where the recipe version is 3.20.0.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The proper CVE_PRODUCT is "wheel_project:wheel".
BEFORE: python:wheel -> 1 CVE
AFTER: wheel_project:wheel -> 2 CVEs
* Both are patched at 0.42.0.
- CVE-2022-40898 — DoS in wheel CLI via malicious input. Affects <0.38.1.
- CVE-2026-24049 — malicious wheel file can modify permissions of arbitrary
files. Affects 0.40.0–<0.46.2; covered by the existing
CVE-2026-24049.patch.
Note: The original commit targeted python3-wheel_0.47.0.bb. This is
adjusted for Scarthgap, where the recipe version is 0.42.0.
AI-Generated: Claude Sonnet 5
(From OE-Core rev: 6125825144dac3f5aea440307e4b6b7e76d5333a)
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fe55278e01bbe434452191109278b436bf008ebc)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
With this change, 2 Patched CVEs are properly reported:
* CVE-2018-15560
* CVE-2023-52323
(From OE-Core rev: e33fa15f9e6c73de3d6ca11d0ebd98c600d24d2e)
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f8a88010edc6edbb168cbc31aa5df847a328661c)
The current pypi default "python:pycryptodome" is deprecated and does
not match current NVD configuration criteria. Use
"pycryptodome:pycryptodome", the active NVD dictionary CPE and
configuration identity for the packaged source, so two patched CVE
records are reported.
Note: The original commit targeted python3-pycryptodome_3.23.0.bb. This
is adjusted for Scarthgap, where the recipe version is 3.20.0.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Without this change, 0 CVEs are reported.
With this change, 8 Patched CVEs are reported:
* CVE-2014-1858
* CVE-2014-1859
* CVE-2017-12852
* CVE-2019-6446
* CVE-2021-33430
* CVE-2021-34141
* CVE-2021-41495
* CVE-2021-41496
This can be verified with a query like:
$ cat .../core-image-ptest-python3-numpy-*.rootfs.sbom-cve-check.yocto.json \
| jq '.package[] | select(.name == "python3-numpy") \
| .issue[] | {id: .id, status: .status}'
(From OE-Core rev: 5e73d32ea99d8e909bfb861a9f9c291c39497233)
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ad623e71fadeddcb0b70bba8fbf28c75a976e596)
The current "python3-numpy" mapping has no matching NVD CPE or
configuration identity, so eight source-aligned CVE records are missed.
Use "numpy:numpy", the active NVD dictionary CPE and configuration
identity for the packaged NumPy source.
Note: The original commit targeted python3-numpy_2.5.2.bb. This is
adjusted for Scarthgap, where the recipe version is 1.26.4.
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
No new CVEs are caught, but attrs_project:attrs matches the upstream
NVD dictionary CPE. The pypi.bbclass default "python:attrs" generates
the wrong product identity for the packaged attrs source.
This changes the generated product identity, but the Scarthgap
cve-check database snapshot has no current CVE report delta.
Note: The original commit targeted python3-attrs_26.1.0.bb. This is
adjusted for Scarthgap, where the recipe version is 23.2.0.
AI-Generated: Claude Sonnet 5
(From OE-Core rev: dbed62df037003f1200003c6d7a590574b8f6d33)
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bc07eddb82fe42ecf86e685450ec0b5c9d3a9ce1)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Recipe (PV): python3-dbusmock (0.31.1)
Before -> After: python:python-dbusmock -> python-dbusmock_project:python-dbusmock
Newly caught CVEs: CVE-2015-1326 (.pyc code exec via AddTemplate)
Status: patched (fixed 0.15.1)
Note: The original commit targeted python3-dbusmock_0.38.1.bb. This is
adjusted for Scarthgap, where the recipe version is 0.31.1.
AI-Generated: Claude Sonnet 5
(From OE-Core rev: b64bc962ffe320ff3ceebc62584bf05955cd08ad)
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0405d7d4e476964239e1c27c987ec9c12372e95f)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Recipe (PV): python3-click (8.1.7)
Before -> After python:click -> palletsprojects:click
Newly caught: CVE-2026-7246 (command injection in click.edit())
Status: unpatched (fixed 8.3.3)
Note: The original commit targeted python3-click_8.4.2.bb. This is
adjusted for Scarthgap, where the recipe version is 8.1.7. The unrelated
DESCRIPTION cleanup from the original commit is intentionally omitted.
AI-Generated: Claude Sonnet 5
(From OE-Core rev: 0aa95f67c7e0363b59faa9d9bb60ee7c2d09b137)
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 30357a26d7ce490725d1b0ac3375047d00595a5c)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Recipe (PV): python3-babel (2.14.0)
Before -> After: python:Babel -> pocoo:babel
Newly caught CVEs: CVE-2021-42771 (locale .dat deserialization RCE)
Status: patched (fixed 2.9.1)
Note: The original commit targeted python3-babel_2.18.0.bb. This is
adjusted for Scarthgap, where the recipe version is 2.14.0.
AI-Generated: Claude Sonnet 5
(From OE-Core rev: 27c524d5c69993338612461831f7aec054eb4d00)
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 134175fa92b85e639dc4646d9a88eeaba0fae4d3)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Security Fixes (evtag, evrpc):
Fix an out-of-bounds read in decode_tag_internal.
(Found by Brubbish. GHSA-fj29-64w6-73h6)
Fix an integer overflow in evtag_unmarshal_header.
(Found by Brubbish. GHSA-45c6-qx49-89m8)
Security Fixes (evhttp):
Discard HTTP trailers, to prevent header smuggling attacks.
(Found by sebastianosrt. GHSA-2gmv-p5m7-98p6)
Restrict HTTP header parsing to prevent request smuggling.
(Originally reported by xclow3n; and then by kodareef5,
nstaller0490, AsafMeizneer, and yaotushaozhu.
GHSA-q39v-w2g7-gr8j.)
Treat CRLF and %00 more strictly in HTTP headers, to prevent
parser mismatch attacks.
(Reported by xclow3n and AsafMeizner. See GHSA-q39v-w2g7-gr8j,
GHSA-jcwh-pvf2-73p2.)
Fix a heap out-of-bound write that could occur when using
AF_UNIX sockets and compiling libevent with -DNDEBUG.
(Found by mat-mo. GHSA-cvq5-vrvr-j338)
Security fixes (evbuffer, bufferevent):
Fixed a dangling pointer in evbuffer_add_reference.
(Found by DarkaMaul. GHSA-c2pj-cg4r-88c8)
Security fixes (evdns):
Fix an out-of-bounds write in dnsname_to_labels
when building a DNS response of 2^16 bytes.
(Found by sectroyer. GHSA-58rx-7448-jw47)
Security fixes (example code):
Avoid using strcpy() in sample/http-server.c.
(Reported by sectroyer. GHSA-5rgj-2c58-7jrc.)
(From OE-Core rev: e6f3c20b057b809676f1df947fcbd3d6e927e894)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 9ae7030db6f5c415de94b6d85eaac418ae1e0f7b)
Full release notes:
* https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
Removed github style user references.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If libtool builds a binary it's best to use libtool to install it, as
otherwise you might install a wrapper script or need to make assumptions
about where libtool has put the real binary (as this isn't always .libs)
(From OE-Core rev: 9d8cfd0d991cc03afe26983abe16dcb5ca341898)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 1dc0e5e240adf61561c899108d2fb5be71e648e4)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a brief description on the new vex.bbclass that is used to generate
metadata needed by external tools to check for vulnerabilities.
(From yocto-docs rev: a380de04498f1340ad9b7aea15d7a6a90edb703c)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 32cf3414f5ed127f59119e38639bc8dbd57b7891)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
It also includes the upstream follow-up fixes referenced in [3]
and [4]. These correct the trailing whitespace check introduced
by the original fix and add the required <ctype.h> include for
isspace().
[1] 37a40fcb45
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58469
[3] 7b1cdecc49
[4] 82d945ff5d
(From OE-Core rev: 9b76cb0b22f9a0ec2877ac69ab4007f2cd2178e5)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
