Add a brief description on the new vex.bbclass that is used to generate
metadata needed by external tools to check for vulnerabilities.
(From yocto-docs rev: a380de04498f1340ad9b7aea15d7a6a90edb703c)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 32cf3414f5ed127f59119e38639bc8dbd57b7891)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].
It also includes the upstream follow-up fixes referenced in [3]
and [4]. These correct the trailing whitespace check introduced
by the original fix and add the required <ctype.h> include for
isspace().
[1] 37a40fcb45
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58469
[3] 7b1cdecc49
[4] 82d945ff5d
(From OE-Core rev: 9b76cb0b22f9a0ec2877ac69ab4007f2cd2178e5)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is a security release of Python 3.12
Release information: [1]
* drop CVE patches included in this release
* refresh all remaining patches via devtool
* remove some tab style in SRC_URI.
* add CVE_STATUS entries for CVEs fixed in this release but still
reported as Unpatched by cve-check (including 2 fixed already in
previous release)
[1] https://www.python.org/downloads/release/python-31214/
(From OE-Core rev: 57549d561886972b733952a4e4077cd8889d12ed)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The BER decoder shared by the CER and DER codecs parses long-form tags by
accumulating continuation octets without an upper bound on the tag ID size.
A crafted input can force construction of an arbitrarily large integer with
CPU cost growing quadratically, and can trigger unhandled ValueError
exceptions in the Python 3.11+ error formatting paths. Any application
decoding untrusted BER, CER, or DER input is affected.
scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.
Pick the upstream patch [1] as mentioned in [2].
[1] 628e36ecbb
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59884
(From OE-Core rev: 75ff4b187cf1b5e4e874cab8273ea84377b3c873)
Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The univ.Real type converts its mantissa, base, and exponent to a Python
float using exact big-integer exponentiation. A BER, CER, or DER encoded
REAL value only a few bytes long can carry a very large exponent, causing
float conversion through prettyPrint(), str(), comparison, arithmetic,
int(), or an explicit float() call to consume excessive CPU and memory and
hang applications that decode untrusted ASN.1 data and then print, log, or
compare the decoded objects.
scarthgap ships pyasn1 0.5.1, which is affected as the issue is present in
all versions before 0.6.4.
Pick the upstream patch [1] as mentioned in [2].
[1] e60c691cb9
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59886
(From OE-Core rev: 24991f7383dbe229a696ad209ae7d58115a051a1)
Signed-off-by: Emily Vekariya <evekariy@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
We export GIT_CEILING_DIRECTORIES=WORKDIR to ensure that git calls
inside the builds don't find oe-core when they're meant to be looking
for the git repository of the source code.
However, this breaks for recipes that use work-shared (such as llvm), as
their working directory is outside of WORKDIR.
Solve this by adding TMPDIR to the list as a final catch, but keeping
WORKDIR first so that git will stop sooner in the general case.
This solves reproduciblity problems in LLVM, where for example lld's
version string would contain the URL and commit hash of the poky repo
being built.
(From OE-Core rev: b2258129ecabc6a85fe9dc48f580e881d27a68c0)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f42f0185bd00e68ecc86a930487f21fc86214cfa)
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
[fatho: edit commit message by adding "cherry picked from"]
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The original backport applied upstream's CURLcode return path into
ssize_t ws_enc_write_head(), which uses an undeclared result and is
invalid for curl 8.7.1's API. Builds with --enable-websockets fail.
Adapt Curl_rand() error handling to set *err and return -1.
AI-Generated: Claude Sonnet 4.6
(From OE-Core rev: 152c139de6b1ad00d904b5fd16b4abc9852459a4)
Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This patch applies the upstream glib-2-88 stable backport chain for
CVE-2026-58015. The issue is in the D-Bus SHA-1 authentication
mechanism, where a malicious peer could provide an unchecked cookie
context and cause the client to access unintended files while resolving
the cookie challenge.
Backport the upstream GLib fix chain from the glib-2-88 stable branch:
- db9c8fae398b validates cookie_context before keyring lookup. This is
the primary security fix for CVE-2026-58015 [1].
- c0531125344b tightens cookie ID parsing so empty, negative, and
out-of-range values are rejected. This hardens the same SHA-1 cookie
challenge parser and is covered by the upstream regression test [2].
- 060aea67de75 exposes the private client reject-reason vfunc. This is
test-support plumbing required by the upstream regression test [3].
- 091930196229 adds the upstream regression test for SHA-1 cookie
challenge parsing [4].
Add dbus-native to PACKAGECONFIG[tests] so Meson can find dbus-daemon
when building the new installed D-Bus regression test for ptest. This is
kept as a native-only test dependency to avoid adding a target dbus
dependency to glib.
[1] db9c8fae39
[2] c053112534
[3] 060aea67de
[4] 0919301962
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-58015
(From OE-Core rev: b6b82e3c1442b658bd4c1689e09792c9a3a96947)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE-2026-58055 affects the nghttpx proxy when forwarding HTTP/1.1
Upgrade requests with a Content-Length header and body.
The default recipe does not build nghttpx. Add a conditional
CVE_STATUS entry so the CVE remains unpatched if app support is
enabled, while default builds are marked not-applicable-config.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-58055
(From OE-Core rev: aef685e73f971bd631f67cf88200c7ebf449d21c)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bump b-a SRCREV again to pull in docs changes.
(From OE-Core rev: 70dc15941dd33270a92d1001174efb3093e79bdf)
Signed-off-by: Paul Barker <paul@pbarker.dev>
pip install won't work on recent Debian distros (and Debian-based ones
I'm assuming as well) and will suggest using pipx instead.
In any case, pip and pipx aren't actually that user-friendly to us for
the simple reason the instructions to build the documentation, c.f.
documentation/tools/host_packages_scripts/pip3_docs.sh, make use of a
virtual environment which doesn't have access to the host system's
Python modules (missing --system-site-packages). So you would need to
chose between building the docs and running vale/sphinx-lint but not
both at the same time.
Instead, update the instructions to use pipenv for stylecheck and
sphinx-lint make targets such that there's a setup in which one can
build the docs AND run those commands without doing some back and forth
between venvs or host packages and the venv.
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Closes: https://lore.kernel.org/yocto-docs/959e65b6-e7eb-bcc3-992f-bed7276c8449@crashcourse.ca/
(From yocto-docs rev: fe46d5de41930a2762a9ad2543d50e0f4e10463b)
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/20260821-pipenv-vale-sphinx-lint-v1-1-f108b7e3e739@cherry.de
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 9955b0f099b6b42a9750f0d544944a2d8e5a39b2)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
