mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 03:49:32 +02:00
1d390a4e04
This patch applies the upstream glib-2-88 stable backport chain for CVE-2026-58015. The issue is in the D-Bus SHA-1 authentication mechanism, where a malicious peer could provide an unchecked cookie context and cause the client to access unintended files while resolving the cookie challenge. Backport the upstream GLib fix chain from the glib-2-88 stable branch: - db9c8fae398b validates cookie_context before keyring lookup. This is the primary security fix for CVE-2026-58015 [1]. - c0531125344b tightens cookie ID parsing so empty, negative, and out-of-range values are rejected. This hardens the same SHA-1 cookie challenge parser and is covered by the upstream regression test [2]. - 060aea67de75 exposes the private client reject-reason vfunc. This is test-support plumbing required by the upstream regression test [3]. - 091930196229 adds the upstream regression test for SHA-1 cookie challenge parsing [4]. Add dbus-native to PACKAGECONFIG[tests] so Meson can find dbus-daemon when building the new installed D-Bus regression test for ptest. This is kept as a native-only test dependency to avoid adding a target dbus dependency to glib. [1]db9c8fae39[2]c053112534[3]060aea67de[4]0919301962[5] https://nvd.nist.gov/vuln/detail/CVE-2026-58015 (From OE-Core rev: b6b82e3c1442b658bd4c1689e09792c9a3a96947) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>