This CVE is detailed here: https://curl.se/docs/CVE-2026-10536.html
and the fix essentially consolidates the fact that HTTP2 stream
dependency is deprecated.
While oe-core provides a PACKAGECONFIG to enable HTTP2, it is not
actually used so the affected part of the code is not compiled. For
instance, in the do_configure logs:
"""
(...)
HTTP2: no (--with-nghttp2, --with-hyper)
(...)
"""
Ignore this CVE unless 'nghttp2' is enabled.
(From OE-Core rev: 637ce45a66ff7125b98fc126321b31cb0cf6bf0f)
Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
The default python:pyasn1 does not match the NVD/CNA entries which use
pyasn1 as vendor, so CVEs like CVE-2026-30922 are never reported. Use
the exact pyasn1:pyasn1 pair.
Note: Original commit was for python3-pyasn1_0.6.3.bb. This is adjusted
for scarthgap where recipe version is python3-pyasn1_0.5.1.bb.
Suggested-by: Ross Burton <ross.burton@arm.com>
(From OE-Core rev: 4c2a8f74464cf3b7143bd9e978eef976aea6315e)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4971337840e8855740409e8f5dadb3ab3661f033)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
NVD registers ply as dabeaz:ply, so the default python:ply vendor
prefix never matches and no CVEs are reported. Use the exact
vendor:product pair.
CVE-2025-56005 will then show as unpatched; no fixed release exists.
Suggested-by: Paul Barker <paul@pbarker.dev>
(From OE-Core rev: 069cda2549b0dd841914c5b860f138f6db8b3977)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bb80fef9a76649fb1144408fbc7e2903439cd556)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
NVD lists it as cryptography.io:cryptography and CNA lists it as
pyca:cryptography, so set both vendor:product pairs to match correctly
and precisely.
Suggested-by: Ross Burton <ross.burton@arm.com>
(From OE-Core rev: f4029c635ce3dc1470352d3d3381d9fef19426ed)
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b721019e0b2ccbaa8de267e14b282c48a5a3de8b)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Ensure emit_pkgdata runs after all PACKAGEFUNCS to allow layers to
extend packaging behavior.
Layers can now append custom functions via PACKAGEFUNCS += "func_name"
and they will run before emit_pkgdata generates package metadata.
(From OE-Core rev: 358a847c9dfaf56291f9eb5e2f150cae56044c7c)
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit aa85baff9ebdd3f932811c3b43d1918c38373cb9)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Add trailing space to value field in :prepend assignments, in
order to avoid providing examples which could lead the users to risk
inadvertent string concatenation.
(From yocto-docs rev: 8496602a28b19fec9ee55dc45572b31a32c70443)
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit b2f611f498eb22ca42dc436e3cde0c60ad2ba72f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Running 'devtool modify linux-yocto' with latest version of OE-Core and
linux-yocto did not prompt the error, so remove the note.
(From yocto-docs rev: 6a5efba38c8edf17a28cc0bd9f682df582c71705)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit e8debfba3458618a25d21286581adc22bf78a836)
[AG: conflicts: note had different path, remove anyway]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
According to [1]
As of the current version 1.0.8, bzip2 --version will print version
info but it will also continue compressing stdin:
$ ./bzip2 --version
bzip2, a block-sorting file compressor. Version 1.0.8, 13-Jul-2019.
Copyright (C) 1996-2019 by Julian Seward.
This program is free software; [...]
bzip2: I won't write compressed data to a terminal.
bzip2: For help, type: `bzip2 --help'.
This is a long-standing bug, not new to 1.0.8 -- the same code
(license() followed by break, with no exit) exists in bzip2 1.0.6 and
earlier. The upstream bzip2 master branch on GitLab already includes
this fix.
Debian (and its downstreams like Ubuntu) will patch this out [2],
making the < /dev/null unnecessary, port a part of debian patch
to fix the issue
[1] https://stackoverflow.com/questions/59757176/why-using-dev-null-with-a-program-like-bzip2
[2] https://sources.debian.org/src/bzip2/1.0.8-6/debian/patches/20-legacy.patch/
(From OE-Core rev: 762321beb0260b1411c7f98f13458ec99a118280)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ae4fe4263ba9d372f9b9e80df4ec4697b51c1f9b)
[Jaipaul: backport to scarthgap -- added commit message context that this is a
long-standing bug (not new to 1.0.8), updated Upstream-Status in patch
to actual mailing list URL in the patch file, this patch is already present on master,
wrynose and walnascar branches using the same bzip2 1.0.8]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Backport the upstream fix for CVE-2026-4367, in which the
`xpmNextWord()` function could attempt to read beyond the file's
end due to improper validation of file boundaries.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4367
(From OE-Core rev: b3f8956f38b2f2cb0f260ab8853e9d028831f420)
Signed-off-by: Enoch Ng <enoch.ng@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Pick the upstream fix [1] for CVE-2026-34980 as mentioned in [2], where
the scheduler did not filter control characters from option values.
Also include the upstream regression fixes that followed the CVE fix:
- CVE-2026-34980-regression_p1.patch [3] fixes filter PPD keyword
processing. The CVE fix parsed PPD keywords into a temporary array,
but the loop did not advance the keyword pointer. This regression was
reported in OpenPrinting/cups Issue [4].
- CVE-2026-34980-regression_p2.patch [5] fixes a get_options() regression
where the option-value parser did not advance the input pointer for
whitespace/control-character paths.
[1] 8d0f51cac2
[2] https://security-tracker.debian.org/tracker/CVE-2026-34980
[3] 3f2bdc2932
[4] https://github.com/OpenPrinting/cups/issues/1562
[5] da0ff58c04
(From OE-Core rev: a64f1bfff50bb9e507705ff671391ec2cafdc692)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Pick the upstream backport [1] for CVE-2026-27447 as mentioned in [2], where
the scheduler treated local user and group names as case-insensitive.
Also include the two upstream regression fixes that followed the CVE
fix:
- CVE-2026-27447-regression_p1.patch [3] fixes a cupsd crash when the
referenced user does not exist on the server. This regression was
reported in OpenPrinting/cups Issue [5].
- CVE-2026-27447-regression_p2.patch [4] fixes unauthenticated print
policies for non-local accounts. This regression was reported in
OpenPrinting/cups Issue [6].
[1] a0c62c1e69
[2] https://security-tracker.debian.org/tracker/CVE-2026-27447
[3] 6d97ee39fe
[4] 849fba7d7a
[5] https://github.com/OpenPrinting/cups/issues/1555
[6] https://github.com/OpenPrinting/cups/issues/1557
(From OE-Core rev: f2aac255fcc1c44ed30a191ba18c4ad46ea4c807)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
