All of lore.kernel.org
 help / color / mirror / Atom feed
* [meta-virtualization][wrynose][PATCH 0/1] aardvark-dns: update to v1.17.1
@ 2026-10-16  6:25 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
  2026-10-16  6:25 ` [meta-virtualization][wrynose][PATCH 1/1] " Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
  0 siblings, 1 reply; 3+ messages in thread
From: Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-10-16  6:25 UTC (permalink / raw)
  To: meta-virtualization; +Cc: Darsh Kelaiya

From: Darsh Kelaiya <dkelaiya@cisco.com>

Backport the aardvark-dns v1.17.1 security release to Wrynose. The
release fixes CVE-2026-35406, where a truncated TCP DNS query followed
by a connection reset can leave aardvark-dns in an unrecoverable loop
at 100% CPU usage [1]. Upstream reports that versions 1.16.0 through
1.17.0 are affected and that 1.17.1 contains the fix.

This update follows OE's stable release policy: upstream prepared
v1.17.1 on its v1.17 maintenance branch, and the runtime change is the
security fix. The other commits contain release and CI metadata; the
release introduces no runtime features or API changes [2].

The recipe selects merge commit 880f6903d225,
described by git as v1.17.1-1-g880f690. Its source tree is identical to
the signed v1.17.1 tag at d9d17d4fe9d0a43512f6203042543deb3431a1bb,
so the selected revision contains no post-release source changes.

The crate version changes restore the dependency versions pinned on
upstream's v1.17 maintenance branch. The previous SRCREV,
b36c4cc80b2d15135acf88c5684bcbede48ec5fd, was a main-branch snapshot
whose Cargo package version had already moved to 2.0.0-dev. This
accounts for the dependency version decreases in the recipe update.

Scarthgap carries aardvark-dns 1.10.0 and is outside the affected
version range, so no corresponding Scarthgap backport is required.

Validation completed:
- The submitted patch matches the locally formatted Wrynose commit.
- The pre-change recipe blobs match the current upstream Wrynose
  baseline, and the patch applies without conflicts.
- The selected merge commit and signed v1.17.1 tag have identical
  source trees.

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-35406
[2] https://github.com/containers/aardvark-dns/releases/tag/v1.17.1

Bruce Ashfield (1):
  aardvark-dns: update to v1.17.1

 .../aardvark-dns/aardvark-dns-crates.inc      | 90 ++++++++++---------
 ...k-dns_1.17.0.bb => aardvark-dns_1.17.1.bb  |  2 +-
 2 files changed, 47 insertions(+), 45 deletions(-)
 rename recipes-containers/aardvark-dns/{aardvark-dns_1.17.0.bb => aardvark-dns_1.17.1.bb} (95%)

-- 
2.35.6



^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-22 19:13 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-16  6:25 [meta-virtualization][wrynose][PATCH 0/1] aardvark-dns: update to v1.17.1 Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-16  6:25 ` [meta-virtualization][wrynose][PATCH 1/1] " Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-10-22 19:13   ` Bruce Ashfield

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.