* [OE-core][walnascar 0/6] Patch review
@ 2025-07-24 19:35 Steve Sakoman
0 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-07-24 19:35 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for walnascar and have comments back by
end of day Tuesday, July 29
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/2085
The following changes since commit cfd35327706a0fbebbab8bfffc72af0bfe385758:
linux-yocto/6.12: update CVE exclusions (6.12.38) (2025-07-21 09:43:01 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/walnascar-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/walnascar-nut
Deepesh Varatharajan (1):
glibc: stable 2.41 branch updates
Jinfeng Wang (1):
mtools: upgrade 4.0.48 -> 4.0.49
Peter Marko (2):
orc: set CVE_PRODUCT
go: upgrade 1.24.4 -> 1.24.5
Vijay Anusuri (1):
xserver-xorg: upgrade 21.1.6 -> 21.1.18
Yash Shinde (1):
rust: Fix malformed hunk header in rustix patch
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-devtools/go/{go-1.24.4.inc => go-1.24.5.inc} | 2 +-
...o-binary-native_1.24.4.bb => go-binary-native_1.24.5.bb} | 6 +++---
...cross-canadian_1.24.4.bb => go-cross-canadian_1.24.5.bb} | 0
.../go/{go-cross_1.24.4.bb => go-cross_1.24.5.bb} | 0
.../go/{go-crosssdk_1.24.4.bb => go-crosssdk_1.24.5.bb} | 0
.../go/{go-runtime_1.24.4.bb => go-runtime_1.24.5.bb} | 0
meta/recipes-devtools/go/{go_1.24.4.bb => go_1.24.5.bb} | 0
.../mtools/{mtools_4.0.48.bb => mtools_4.0.49.bb} | 2 +-
meta/recipes-devtools/orc/orc_0.4.41.bb | 3 +++
.../rust/files/rv32-cargo-rustix-0.38.38-fix.patch | 4 ++--
.../{xserver-xorg_21.1.16.bb => xserver-xorg_21.1.18.bb} | 2 +-
12 files changed, 12 insertions(+), 9 deletions(-)
rename meta/recipes-devtools/go/{go-1.24.4.inc => go-1.24.5.inc} (91%)
rename meta/recipes-devtools/go/{go-binary-native_1.24.4.bb => go-binary-native_1.24.5.bb} (79%)
rename meta/recipes-devtools/go/{go-cross-canadian_1.24.4.bb => go-cross-canadian_1.24.5.bb} (100%)
rename meta/recipes-devtools/go/{go-cross_1.24.4.bb => go-cross_1.24.5.bb} (100%)
rename meta/recipes-devtools/go/{go-crosssdk_1.24.4.bb => go-crosssdk_1.24.5.bb} (100%)
rename meta/recipes-devtools/go/{go-runtime_1.24.4.bb => go-runtime_1.24.5.bb} (100%)
rename meta/recipes-devtools/go/{go_1.24.4.bb => go_1.24.5.bb} (100%)
rename meta/recipes-devtools/mtools/{mtools_4.0.48.bb => mtools_4.0.49.bb} (93%)
rename meta/recipes-graphics/xorg-xserver/{xserver-xorg_21.1.16.bb => xserver-xorg_21.1.18.bb} (92%)
--
2.43.0
^ permalink raw reply [flat|nested] 12+ messages in thread
* [OE-core][walnascar 0/6] Patch review
@ 2025-08-09 14:44 Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 1/6] avahi: fix CVE-2024-52615 Steve Sakoman
` (5 more replies)
0 siblings, 6 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-08-09 14:44 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for walnascar and have comments back by
end of day Tuesday, August 12
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2166
The following changes since commit 8bea495b4945e24b43398f40d634d7fdb73e981a:
ltp: Skip semctl08 when __USE_TIME64_REDIRECTS is defined (2025-07-30 09:01:16 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/walnascar-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/walnascar-nut
Gyorgy Sarvari (1):
gnutls: upgrade 3.8.9 -> 3.8.10
Jiaying Song (1):
ca-certificates: correct the SRC_URI
Peter Marko (2):
sqlite3: patch CVE-2025-6965
glibc: stable 2.41 branch updates
Praveen Kumar (1):
python3: fix CVE-2025-8194
Zhang Peng (1):
avahi: fix CVE-2024-52615
meta/recipes-connectivity/avahi/avahi_0.8.bb | 1 +
.../avahi/files/CVE-2024-52615.patch | 228 ++++++++++++++++++
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/glibc/glibc_2.41.bb | 2 +-
.../python/python3/CVE-2025-8194.patch | 224 +++++++++++++++++
.../recipes-devtools/python/python3_3.13.4.bb | 1 +
.../ca-certificates_20241223.bb | 2 +-
meta/recipes-support/gnutls/gnutls/run-ptest | 1 +
.../{gnutls_3.8.9.bb => gnutls_3.8.10.bb} | 2 +-
.../sqlite/sqlite3/CVE-2025-6965.patch | 112 +++++++++
meta/recipes-support/sqlite/sqlite3_3.48.0.bb | 1 +
11 files changed, 572 insertions(+), 4 deletions(-)
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-8194.patch
rename meta/recipes-support/gnutls/{gnutls_3.8.9.bb => gnutls_3.8.10.bb} (97%)
create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2025-6965.patch
--
2.43.0
^ permalink raw reply [flat|nested] 12+ messages in thread
* [OE-core][walnascar 1/6] avahi: fix CVE-2024-52615
2025-08-09 14:44 [OE-core][walnascar 0/6] Patch review Steve Sakoman
@ 2025-08-09 14:44 ` Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 2/6] sqlite3: patch CVE-2025-6965 Steve Sakoman
` (4 subsequent siblings)
5 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-08-09 14:44 UTC (permalink / raw)
To: openembedded-core
From: Zhang Peng <peng.zhang1.cn@windriver.com>
CVE-2024-52615:
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area
DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-52615]
[https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g]
Upstream patches:
[https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-connectivity/avahi/avahi_0.8.bb | 1 +
.../avahi/files/CVE-2024-52615.patch | 228 ++++++++++++++++++
2 files changed, 229 insertions(+)
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
diff --git a/meta/recipes-connectivity/avahi/avahi_0.8.bb b/meta/recipes-connectivity/avahi/avahi_0.8.bb
index 734a73541f..4fe8ba4d28 100644
--- a/meta/recipes-connectivity/avahi/avahi_0.8.bb
+++ b/meta/recipes-connectivity/avahi/avahi_0.8.bb
@@ -36,6 +36,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/avahi-${PV}.tar.gz \
file://CVE-2023-38472.patch \
file://CVE-2023-38473.patch \
file://CVE-2024-52616.patch \
+ file://CVE-2024-52615.patch \
"
GITHUB_BASE_URI = "https://github.com/avahi/avahi/releases/"
diff --git a/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch b/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
new file mode 100644
index 0000000000..9737f52837
--- /dev/null
+++ b/meta/recipes-connectivity/avahi/files/CVE-2024-52615.patch
@@ -0,0 +1,228 @@
+From 4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942 Mon Sep 17 00:00:00 2001
+From: Michal Sekletar <msekleta@redhat.com>
+Date: Wed, 27 Nov 2024 18:07:32 +0100
+Subject: [PATCH] core/wide-area: fix for CVE-2024-52615
+
+CVE: CVE-2024-52615
+Upstream-Status: Backport [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942]
+
+Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
+---
+ avahi-core/wide-area.c | 128 ++++++++++++++++++++++-------------------
+ 1 file changed, 69 insertions(+), 59 deletions(-)
+
+diff --git a/avahi-core/wide-area.c b/avahi-core/wide-area.c
+index 00a15056e..06df7afc6 100644
+--- a/avahi-core/wide-area.c
++++ b/avahi-core/wide-area.c
+@@ -81,6 +81,10 @@ struct AvahiWideAreaLookup {
+
+ AvahiAddress dns_server_used;
+
++ int fd;
++ AvahiWatch *watch;
++ AvahiProtocol proto;
++
+ AVAHI_LLIST_FIELDS(AvahiWideAreaLookup, lookups);
+ AVAHI_LLIST_FIELDS(AvahiWideAreaLookup, by_key);
+ };
+@@ -88,9 +92,6 @@ struct AvahiWideAreaLookup {
+ struct AvahiWideAreaLookupEngine {
+ AvahiServer *server;
+
+- int fd_ipv4, fd_ipv6;
+- AvahiWatch *watch_ipv4, *watch_ipv6;
+-
+ /* Cache */
+ AVAHI_LLIST_HEAD(AvahiWideAreaCacheEntry, cache);
+ AvahiHashmap *cache_by_key;
+@@ -125,35 +126,67 @@ static AvahiWideAreaLookup* find_lookup(AvahiWideAreaLookupEngine *e, uint16_t i
+ return l;
+ }
+
++static void socket_event(AVAHI_GCC_UNUSED AvahiWatch *w, int fd, AVAHI_GCC_UNUSED AvahiWatchEvent events, void *userdata);
++
+ static int send_to_dns_server(AvahiWideAreaLookup *l, AvahiDnsPacket *p) {
++ AvahiWideAreaLookupEngine *e;
+ AvahiAddress *a;
++ AvahiServer *s;
++ AvahiWatch *w;
++ int r;
+
+ assert(l);
+ assert(p);
+
+- if (l->engine->n_dns_servers <= 0)
++ e = l->engine;
++ assert(e);
++
++ s = e->server;
++ assert(s);
++
++ if (e->n_dns_servers <= 0)
+ return -1;
+
+- assert(l->engine->current_dns_server < l->engine->n_dns_servers);
++ assert(e->current_dns_server < e->n_dns_servers);
+
+- a = &l->engine->dns_servers[l->engine->current_dns_server];
++ a = &e->dns_servers[e->current_dns_server];
+ l->dns_server_used = *a;
+
+- if (a->proto == AVAHI_PROTO_INET) {
++ if (l->fd >= 0) {
++ /* We are reusing lookup object and sending packet to another server so let's cleanup before we establish connection to new server. */
++ s->poll_api->watch_free(l->watch);
++ l->watch = NULL;
+
+- if (l->engine->fd_ipv4 < 0)
+- return -1;
++ close(l->fd);
++ l->fd = -EBADF;
++ }
+
+- return avahi_send_dns_packet_ipv4(l->engine->fd_ipv4, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv4, AVAHI_DNS_PORT);
++ assert(a->proto == AVAHI_PROTO_INET || a->proto == AVAHI_PROTO_INET6);
+
+- } else {
+- assert(a->proto == AVAHI_PROTO_INET6);
++ if (a->proto == AVAHI_PROTO_INET)
++ r = s->config.use_ipv4 ? avahi_open_unicast_socket_ipv4() : -1;
++ else
++ r = s->config.use_ipv6 ? avahi_open_unicast_socket_ipv6() : -1;
+
+- if (l->engine->fd_ipv6 < 0)
+- return -1;
++ if (r < 0) {
++ avahi_log_error(__FILE__ ": Failed to create socket for wide area lookup");
++ return -1;
++ }
+
+- return avahi_send_dns_packet_ipv6(l->engine->fd_ipv6, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv6, AVAHI_DNS_PORT);
++ w = s->poll_api->watch_new(s->poll_api, r, AVAHI_WATCH_IN, socket_event, l);
++ if (!w) {
++ close(r);
++ avahi_log_error(__FILE__ ": Failed to create socket watch for wide area lookup");
++ return -1;
+ }
++
++ l->fd = r;
++ l->watch = w;
++ l->proto = a->proto;
++
++ return a->proto == AVAHI_PROTO_INET ?
++ avahi_send_dns_packet_ipv4(l->fd, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv4, AVAHI_DNS_PORT):
++ avahi_send_dns_packet_ipv6(l->fd, AVAHI_IF_UNSPEC, p, NULL, &a->data.ipv6, AVAHI_DNS_PORT);
+ }
+
+ static void next_dns_server(AvahiWideAreaLookupEngine *e) {
+@@ -246,6 +279,9 @@ AvahiWideAreaLookup *avahi_wide_area_lookup_new(
+ l->dead = 0;
+ l->key = avahi_key_ref(key);
+ l->cname_key = avahi_key_new_cname(l->key);
++ l->fd = -EBADF;
++ l->watch = NULL;
++ l->proto = AVAHI_PROTO_UNSPEC;
+ l->callback = callback;
+ l->userdata = userdata;
+
+@@ -314,6 +350,12 @@ static void lookup_destroy(AvahiWideAreaLookup *l) {
+ if (l->cname_key)
+ avahi_key_unref(l->cname_key);
+
++ if (l->watch)
++ l->engine->server->poll_api->watch_free(l->watch);
++
++ if (l->fd >= 0)
++ close(l->fd);
++
+ avahi_free(l);
+ }
+
+@@ -572,14 +614,20 @@ static void handle_packet(AvahiWideAreaLookupEngine *e, AvahiDnsPacket *p) {
+ }
+
+ static void socket_event(AVAHI_GCC_UNUSED AvahiWatch *w, int fd, AVAHI_GCC_UNUSED AvahiWatchEvent events, void *userdata) {
+- AvahiWideAreaLookupEngine *e = userdata;
++ AvahiWideAreaLookup *l = userdata;
++ AvahiWideAreaLookupEngine *e = l->engine;
+ AvahiDnsPacket *p = NULL;
+
+- if (fd == e->fd_ipv4)
+- p = avahi_recv_dns_packet_ipv4(e->fd_ipv4, NULL, NULL, NULL, NULL, NULL);
++ assert(l);
++ assert(e);
++ assert(l->fd == fd);
++
++ if (l->proto == AVAHI_PROTO_INET)
++ p = avahi_recv_dns_packet_ipv4(l->fd, NULL, NULL, NULL, NULL, NULL);
+ else {
+- assert(fd == e->fd_ipv6);
+- p = avahi_recv_dns_packet_ipv6(e->fd_ipv6, NULL, NULL, NULL, NULL, NULL);
++ assert(l->proto == AVAHI_PROTO_INET6);
++
++ p = avahi_recv_dns_packet_ipv6(l->fd, NULL, NULL, NULL, NULL, NULL);
+ }
+
+ if (p) {
+@@ -598,32 +646,6 @@ AvahiWideAreaLookupEngine *avahi_wide_area_engine_new(AvahiServer *s) {
+ e->server = s;
+ e->cleanup_dead = 0;
+
+- /* Create sockets */
+- e->fd_ipv4 = s->config.use_ipv4 ? avahi_open_unicast_socket_ipv4() : -1;
+- e->fd_ipv6 = s->config.use_ipv6 ? avahi_open_unicast_socket_ipv6() : -1;
+-
+- if (e->fd_ipv4 < 0 && e->fd_ipv6 < 0) {
+- avahi_log_error(__FILE__": Failed to create wide area sockets: %s", strerror(errno));
+-
+- if (e->fd_ipv6 >= 0)
+- close(e->fd_ipv6);
+-
+- if (e->fd_ipv4 >= 0)
+- close(e->fd_ipv4);
+-
+- avahi_free(e);
+- return NULL;
+- }
+-
+- /* Create watches */
+-
+- e->watch_ipv4 = e->watch_ipv6 = NULL;
+-
+- if (e->fd_ipv4 >= 0)
+- e->watch_ipv4 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv4, AVAHI_WATCH_IN, socket_event, e);
+- if (e->fd_ipv6 >= 0)
+- e->watch_ipv6 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv6, AVAHI_WATCH_IN, socket_event, e);
+-
+ e->n_dns_servers = e->current_dns_server = 0;
+
+ /* Initialize cache */
+@@ -651,18 +673,6 @@ void avahi_wide_area_engine_free(AvahiWideAreaLookupEngine *e) {
+ avahi_hashmap_free(e->lookups_by_id);
+ avahi_hashmap_free(e->lookups_by_key);
+
+- if (e->watch_ipv4)
+- e->server->poll_api->watch_free(e->watch_ipv4);
+-
+- if (e->watch_ipv6)
+- e->server->poll_api->watch_free(e->watch_ipv6);
+-
+- if (e->fd_ipv6 >= 0)
+- close(e->fd_ipv6);
+-
+- if (e->fd_ipv4 >= 0)
+- close(e->fd_ipv4);
+-
+ avahi_free(e);
+ }
+
+@@ -680,7 +690,7 @@ void avahi_wide_area_set_servers(AvahiWideAreaLookupEngine *e, const AvahiAddres
+
+ if (a) {
+ for (e->n_dns_servers = 0; n > 0 && e->n_dns_servers < AVAHI_WIDE_AREA_SERVERS_MAX; a++, n--)
+- if ((a->proto == AVAHI_PROTO_INET && e->fd_ipv4 >= 0) || (a->proto == AVAHI_PROTO_INET6 && e->fd_ipv6 >= 0))
++ if (a->proto == AVAHI_PROTO_INET || a->proto == AVAHI_PROTO_INET6)
+ e->dns_servers[e->n_dns_servers++] = *a;
+ } else {
+ assert(n == 0);
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 2/6] sqlite3: patch CVE-2025-6965
2025-08-09 14:44 [OE-core][walnascar 0/6] Patch review Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 1/6] avahi: fix CVE-2024-52615 Steve Sakoman
@ 2025-08-09 14:44 ` Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 3/6] python3: fix CVE-2025-8194 Steve Sakoman
` (3 subsequent siblings)
5 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-08-09 14:44 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch [1] mentioned in NVD report [2] from github mirror [3].
[1] https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-6965
[3] https://github.com/sqlite/sqlite/commit/c52e9d97d485a3eb168e3f8f3674a7bc4b419703
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../sqlite/sqlite3/CVE-2025-6965.patch | 112 ++++++++++++++++++
meta/recipes-support/sqlite/sqlite3_3.48.0.bb | 1 +
2 files changed, 113 insertions(+)
create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2025-6965.patch
diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2025-6965.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2025-6965.patch
new file mode 100644
index 0000000000..9b2f4409b3
--- /dev/null
+++ b/meta/recipes-support/sqlite/sqlite3/CVE-2025-6965.patch
@@ -0,0 +1,112 @@
+From c52e9d97d485a3eb168e3f8f3674a7bc4b419703 Mon Sep 17 00:00:00 2001
+From: drh <>
+Date: Fri, 27 Jun 2025 19:02:21 +0000
+Subject: [PATCH] Raise an error right away if the number of aggregate terms in
+ a query exceeds the maximum number of columns.
+
+FossilOrigin-Name: 5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8
+
+CVE: CVE-2025-6965
+Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/c52e9d97d485a3eb168e3f8f3674a7bc4b419703]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ sqlite3.c | 30 ++++++++++++++++++++++++++----
+ 1 file changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index 146047d..c78f58b 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -15257,6 +15257,14 @@ typedef INT16_TYPE LogEst;
+ #define LARGEST_UINT64 (0xffffffff|(((u64)0xffffffff)<<32))
+ #define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64)
+
++/*
++** Macro SMXV(n) return the maximum value that can be held in variable n,
++** assuming n is a signed integer type. UMXV(n) is similar for unsigned
++** integer types.
++*/
++#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1)
++#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1)
++
+ /*
+ ** Round up a number to the next larger multiple of 8. This is used
+ ** to force 8-byte alignment on 64-bit architectures.
+@@ -19046,7 +19054,7 @@ struct AggInfo {
+ ** from source tables rather than from accumulators */
+ u8 useSortingIdx; /* In direct mode, reference the sorting index rather
+ ** than the source table */
+- u16 nSortingColumn; /* Number of columns in the sorting index */
++ u32 nSortingColumn; /* Number of columns in the sorting index */
+ int sortingIdx; /* Cursor number of the sorting index */
+ int sortingIdxPTab; /* Cursor number of pseudo-table */
+ int iFirstReg; /* First register in range for aCol[] and aFunc[] */
+@@ -19055,8 +19063,8 @@ struct AggInfo {
+ Table *pTab; /* Source table */
+ Expr *pCExpr; /* The original expression */
+ int iTable; /* Cursor number of the source table */
+- i16 iColumn; /* Column number within the source table */
+- i16 iSorterColumn; /* Column number in the sorting index */
++ int iColumn; /* Column number within the source table */
++ int iSorterColumn; /* Column number in the sorting index */
+ } *aCol;
+ int nColumn; /* Number of used entries in aCol[] */
+ int nAccumulator; /* Number of columns that show through to the output.
+@@ -116445,7 +116453,9 @@ static void findOrCreateAggInfoColumn(
+ ){
+ struct AggInfo_col *pCol;
+ int k;
++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
+
++ assert( mxTerm <= SMXV(i16) );
+ assert( pAggInfo->iFirstReg==0 );
+ pCol = pAggInfo->aCol;
+ for(k=0; k<pAggInfo->nColumn; k++, pCol++){
+@@ -116463,6 +116473,10 @@ static void findOrCreateAggInfoColumn(
+ assert( pParse->db->mallocFailed );
+ return;
+ }
++ if( k>mxTerm ){
++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
++ k = mxTerm;
++ }
+ pCol = &pAggInfo->aCol[k];
+ assert( ExprUseYTab(pExpr) );
+ pCol->pTab = pExpr->y.pTab;
+@@ -116496,6 +116510,7 @@ fix_up_expr:
+ if( pExpr->op==TK_COLUMN ){
+ pExpr->op = TK_AGG_COLUMN;
+ }
++ assert( k <= SMXV(pExpr->iAgg) );
+ pExpr->iAgg = (i16)k;
+ }
+
+@@ -116580,13 +116595,19 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
+ ** function that is already in the pAggInfo structure
+ */
+ struct AggInfo_func *pItem = pAggInfo->aFunc;
++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
++ assert( mxTerm <= SMXV(i16) );
+ for(i=0; i<pAggInfo->nFunc; i++, pItem++){
+ if( NEVER(pItem->pFExpr==pExpr) ) break;
+ if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){
+ break;
+ }
+ }
+- if( i>=pAggInfo->nFunc ){
++ if( i>mxTerm ){
++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
++ i = mxTerm;
++ assert( i<pAggInfo->nFunc );
++ }else if( i>=pAggInfo->nFunc ){
+ /* pExpr is original. Make a new entry in pAggInfo->aFunc[]
+ */
+ u8 enc = ENC(pParse->db);
+@@ -116640,6 +116661,7 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
+ */
+ assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
+ ExprSetVVAProperty(pExpr, EP_NoReduce);
++ assert( i <= SMXV(pExpr->iAgg) );
+ pExpr->iAgg = (i16)i;
+ pExpr->pAggInfo = pAggInfo;
+ return WRC_Prune;
diff --git a/meta/recipes-support/sqlite/sqlite3_3.48.0.bb b/meta/recipes-support/sqlite/sqlite3_3.48.0.bb
index 11f103dddc..6c9f1ed5d9 100644
--- a/meta/recipes-support/sqlite/sqlite3_3.48.0.bb
+++ b/meta/recipes-support/sqlite/sqlite3_3.48.0.bb
@@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://sqlite3.h;endline=11;md5=786d3dc581eff03f4fd9e4a77ed0
SRC_URI = "http://www.sqlite.org/2025/sqlite-autoconf-${SQLITE_PV}.tar.gz \
file://CVE-2025-3277.patch \
file://CVE-2025-29088.patch \
+ file://CVE-2025-6965.patch \
"
SRC_URI[sha256sum] = "ac992f7fca3989de7ed1fe99c16363f848794c8c32a158dafd4eb927a2e02fd5"
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 3/6] python3: fix CVE-2025-8194
2025-08-09 14:44 [OE-core][walnascar 0/6] Patch review Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 1/6] avahi: fix CVE-2024-52615 Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 2/6] sqlite3: patch CVE-2025-6965 Steve Sakoman
@ 2025-08-09 14:44 ` Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 4/6] glibc: stable 2.41 branch updates Steve Sakoman
` (2 subsequent siblings)
5 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-08-09 14:44 UTC (permalink / raw)
To: openembedded-core
From: Praveen Kumar <praveen.kumar@windriver.com>
There is a defect in the CPython “tarfile” module affecting the
“TarFile” extraction and entry enumeration APIs. The tar implementation
would process tar archives with negative offsets without error,
resulting in an infinite loop and deadlock during the parsing of
maliciously crafted tar archives. This vulnerability can be mitigated
by including the following patch after importing the “tarfile” module:
https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-8194
Upstream-patch:
https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe
Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../python/python3/CVE-2025-8194.patch | 224 ++++++++++++++++++
.../recipes-devtools/python/python3_3.13.4.bb | 1 +
2 files changed, 225 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-8194.patch
diff --git a/meta/recipes-devtools/python/python3/CVE-2025-8194.patch b/meta/recipes-devtools/python/python3/CVE-2025-8194.patch
new file mode 100644
index 0000000000..28653e1843
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2025-8194.patch
@@ -0,0 +1,224 @@
+From cdae923ffe187d6ef916c0f665a31249619193fe Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Mon, 28 Jul 2025 17:59:33 +0200
+Subject: [PATCH] gh-130577: tarfile now validates archives to ensure member
+ offsets are non-negative (GH-137027) (#137170)
+
+gh-130577: tarfile now validates archives to ensure member offsets are non-negative (GH-137027)
+(cherry picked from commit 7040aa54f14676938970e10c5f74ea93cd56aa38)
+
+Co-authored-by: Alexander Urieles <aeurielesn@users.noreply.github.com>
+Co-authored-by: Gregory P. Smith <greg@krypto.org>
+
+CVE: CVE-2025-8194
+
+Upstream-Status: Backport [https://github.com/python/cpython/commit/cdae923ffe187d6ef916c0f665a31249619193fe]
+
+Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
+---
+ Lib/tarfile.py | 3 +
+ Lib/test/test_tarfile.py | 156 ++++++++++++++++++
+ ...-07-23-00-35-29.gh-issue-130577.c7EITy.rst | 3 +
+ 3 files changed, 162 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
+
+diff --git a/Lib/tarfile.py b/Lib/tarfile.py
+index 0980f6a..9ff9df6 100755
+--- a/Lib/tarfile.py
++++ b/Lib/tarfile.py
+@@ -1636,6 +1636,9 @@ class TarInfo(object):
+ """Round up a byte count by BLOCKSIZE and return it,
+ e.g. _block(834) => 1024.
+ """
++ # Only non-negative offsets are allowed
++ if count < 0:
++ raise InvalidHeaderError("invalid offset")
+ blocks, remainder = divmod(count, BLOCKSIZE)
+ if remainder:
+ blocks += 1
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index ac31be0..7024be4 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -50,6 +50,7 @@ bz2name = os.path.join(TEMPDIR, "testtar.tar.bz2")
+ xzname = os.path.join(TEMPDIR, "testtar.tar.xz")
+ tmpname = os.path.join(TEMPDIR, "tmp.tar")
+ dotlessname = os.path.join(TEMPDIR, "testtar")
++SPACE = b" "
+
+ sha256_regtype = (
+ "e09e4bc8b3c9d9177e77256353b36c159f5f040531bbd4b024a8f9b9196c71ce"
+@@ -4578,6 +4579,161 @@ class OverwriteTests(archiver_tests.OverwriteTests, unittest.TestCase):
+ ar.extractall(self.testdir, filter='fully_trusted')
+
+
++class OffsetValidationTests(unittest.TestCase):
++ tarname = tmpname
++ invalid_posix_header = (
++ # name: 100 bytes
++ tarfile.NUL * tarfile.LENGTH_NAME
++ # mode, space, null terminator: 8 bytes
++ + b"000755" + SPACE + tarfile.NUL
++ # uid, space, null terminator: 8 bytes
++ + b"000001" + SPACE + tarfile.NUL
++ # gid, space, null terminator: 8 bytes
++ + b"000001" + SPACE + tarfile.NUL
++ # size, space: 12 bytes
++ + b"\xff" * 11 + SPACE
++ # mtime, space: 12 bytes
++ + tarfile.NUL * 11 + SPACE
++ # chksum: 8 bytes
++ + b"0011407" + tarfile.NUL
++ # type: 1 byte
++ + tarfile.REGTYPE
++ # linkname: 100 bytes
++ + tarfile.NUL * tarfile.LENGTH_LINK
++ # magic: 6 bytes, version: 2 bytes
++ + tarfile.POSIX_MAGIC
++ # uname: 32 bytes
++ + tarfile.NUL * 32
++ # gname: 32 bytes
++ + tarfile.NUL * 32
++ # devmajor, space, null terminator: 8 bytes
++ + tarfile.NUL * 6 + SPACE + tarfile.NUL
++ # devminor, space, null terminator: 8 bytes
++ + tarfile.NUL * 6 + SPACE + tarfile.NUL
++ # prefix: 155 bytes
++ + tarfile.NUL * tarfile.LENGTH_PREFIX
++ # padding: 12 bytes
++ + tarfile.NUL * 12
++ )
++ invalid_gnu_header = (
++ # name: 100 bytes
++ tarfile.NUL * tarfile.LENGTH_NAME
++ # mode, null terminator: 8 bytes
++ + b"0000755" + tarfile.NUL
++ # uid, null terminator: 8 bytes
++ + b"0000001" + tarfile.NUL
++ # gid, space, null terminator: 8 bytes
++ + b"0000001" + tarfile.NUL
++ # size, space: 12 bytes
++ + b"\xff" * 11 + SPACE
++ # mtime, space: 12 bytes
++ + tarfile.NUL * 11 + SPACE
++ # chksum: 8 bytes
++ + b"0011327" + tarfile.NUL
++ # type: 1 byte
++ + tarfile.REGTYPE
++ # linkname: 100 bytes
++ + tarfile.NUL * tarfile.LENGTH_LINK
++ # magic: 8 bytes
++ + tarfile.GNU_MAGIC
++ # uname: 32 bytes
++ + tarfile.NUL * 32
++ # gname: 32 bytes
++ + tarfile.NUL * 32
++ # devmajor, null terminator: 8 bytes
++ + tarfile.NUL * 8
++ # devminor, null terminator: 8 bytes
++ + tarfile.NUL * 8
++ # padding: 167 bytes
++ + tarfile.NUL * 167
++ )
++ invalid_v7_header = (
++ # name: 100 bytes
++ tarfile.NUL * tarfile.LENGTH_NAME
++ # mode, space, null terminator: 8 bytes
++ + b"000755" + SPACE + tarfile.NUL
++ # uid, space, null terminator: 8 bytes
++ + b"000001" + SPACE + tarfile.NUL
++ # gid, space, null terminator: 8 bytes
++ + b"000001" + SPACE + tarfile.NUL
++ # size, space: 12 bytes
++ + b"\xff" * 11 + SPACE
++ # mtime, space: 12 bytes
++ + tarfile.NUL * 11 + SPACE
++ # chksum: 8 bytes
++ + b"0010070" + tarfile.NUL
++ # type: 1 byte
++ + tarfile.REGTYPE
++ # linkname: 100 bytes
++ + tarfile.NUL * tarfile.LENGTH_LINK
++ # padding: 255 bytes
++ + tarfile.NUL * 255
++ )
++ valid_gnu_header = tarfile.TarInfo("filename").tobuf(tarfile.GNU_FORMAT)
++ data_block = b"\xff" * tarfile.BLOCKSIZE
++
++ def _write_buffer(self, buffer):
++ with open(self.tarname, "wb") as f:
++ f.write(buffer)
++
++ def _get_members(self, ignore_zeros=None):
++ with open(self.tarname, "rb") as f:
++ with tarfile.open(
++ mode="r", fileobj=f, ignore_zeros=ignore_zeros
++ ) as tar:
++ return tar.getmembers()
++
++ def _assert_raises_read_error_exception(self):
++ with self.assertRaisesRegex(
++ tarfile.ReadError, "file could not be opened successfully"
++ ):
++ self._get_members()
++
++ def test_invalid_offset_header_validations(self):
++ for tar_format, invalid_header in (
++ ("posix", self.invalid_posix_header),
++ ("gnu", self.invalid_gnu_header),
++ ("v7", self.invalid_v7_header),
++ ):
++ with self.subTest(format=tar_format):
++ self._write_buffer(invalid_header)
++ self._assert_raises_read_error_exception()
++
++ def test_early_stop_at_invalid_offset_header(self):
++ buffer = self.valid_gnu_header + self.invalid_gnu_header + self.valid_gnu_header
++ self._write_buffer(buffer)
++ members = self._get_members()
++ self.assertEqual(len(members), 1)
++ self.assertEqual(members[0].name, "filename")
++ self.assertEqual(members[0].offset, 0)
++
++ def test_ignore_invalid_archive(self):
++ # 3 invalid headers with their respective data
++ buffer = (self.invalid_gnu_header + self.data_block) * 3
++ self._write_buffer(buffer)
++ members = self._get_members(ignore_zeros=True)
++ self.assertEqual(len(members), 0)
++
++ def test_ignore_invalid_offset_headers(self):
++ for first_block, second_block, expected_offset in (
++ (
++ (self.valid_gnu_header),
++ (self.invalid_gnu_header + self.data_block),
++ 0,
++ ),
++ (
++ (self.invalid_gnu_header + self.data_block),
++ (self.valid_gnu_header),
++ 1024,
++ ),
++ ):
++ self._write_buffer(first_block + second_block)
++ members = self._get_members(ignore_zeros=True)
++ self.assertEqual(len(members), 1)
++ self.assertEqual(members[0].name, "filename")
++ self.assertEqual(members[0].offset, expected_offset)
++
++
+ def setUpModule():
+ os_helper.unlink(TEMPDIR)
+ os.makedirs(TEMPDIR)
+diff --git a/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
+new file mode 100644
+index 0000000..342cabb
+--- /dev/null
++++ b/Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
+@@ -0,0 +1,3 @@
++:mod:`tarfile` now validates archives to ensure member offsets are
++non-negative. (Contributed by Alexander Enrique Urieles Nieto in
++:gh:`130577`.)
+--
+2.40.0
diff --git a/meta/recipes-devtools/python/python3_3.13.4.bb b/meta/recipes-devtools/python/python3_3.13.4.bb
index 0a2c41cdce..6823a21cc3 100644
--- a/meta/recipes-devtools/python/python3_3.13.4.bb
+++ b/meta/recipes-devtools/python/python3_3.13.4.bb
@@ -30,6 +30,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://0001-test_active_children-skip-problematic-test.patch \
file://0001-test_readline-skip-limited-history-test.patch \
file://0001-Generate-data-for-OpenSSL-3.4-and-add-it-to-multissl.patch \
+ file://CVE-2025-8194.patch \
"
SRC_URI:append:class-native = " \
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 4/6] glibc: stable 2.41 branch updates
2025-08-09 14:44 [OE-core][walnascar 0/6] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-08-09 14:44 ` [OE-core][walnascar 3/6] python3: fix CVE-2025-8194 Steve Sakoman
@ 2025-08-09 14:44 ` Steve Sakoman
2025-08-09 15:45 ` Khem Raj
2025-08-09 14:44 ` [OE-core][walnascar 5/6] gnutls: upgrade 3.8.9 -> 3.8.10 Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 6/6] ca-certificates: correct the SRC_URI Steve Sakoman
5 siblings, 1 reply; 12+ messages in thread
From: Steve Sakoman @ 2025-08-09 14:44 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
$ git log --oneline 6e489c17f827317bcf8544efefa65f13b5a079dc..e7c419a2957590fb657900fc92a89708f41abd9d
e7c419a295 (origin/release/2.41/master, release/2.41/master) iconv: iconv -o should not create executable files (bug 33164)
1e16d0096d posix: Fix double-free after allocation failure in regcomp (bug 33185)
Add CVE-2025-8058 to CVE ignore list as this is (bug 33185) commit.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/glibc/glibc_2.41.bb | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index a2cfd0f308..881a9cce2c 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
SRCBRANCH ?= "release/2.41/master"
PV = "2.41+git"
-SRCREV_glibc ?= "6e489c17f827317bcf8544efefa65f13b5a079dc"
+SRCREV_glibc ?= "e7c419a2957590fb657900fc92a89708f41abd9d"
SRCREV_localedef ?= "fab74f31b3811df543e24b6de47efdf45b538abc"
GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
diff --git a/meta/recipes-core/glibc/glibc_2.41.bb b/meta/recipes-core/glibc/glibc_2.41.bb
index 7ddf7f9127..8a65e8ce9f 100644
--- a/meta/recipes-core/glibc/glibc_2.41.bb
+++ b/meta/recipes-core/glibc/glibc_2.41.bb
@@ -17,7 +17,7 @@ Allows for ASLR bypass so can bypass some hardening, not an exploit in itself, m
easier access for another. 'ASLR bypass itself is not a vulnerability.'"
CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
-CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-4802 CVE-2025-5702 CVE-2025-5745"
+CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-4802 CVE-2025-5702 CVE-2025-5745 CVE-2025-8058"
CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
DEPENDS += "gperf-native bison-native"
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 5/6] gnutls: upgrade 3.8.9 -> 3.8.10
2025-08-09 14:44 [OE-core][walnascar 0/6] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-08-09 14:44 ` [OE-core][walnascar 4/6] glibc: stable 2.41 branch updates Steve Sakoman
@ 2025-08-09 14:44 ` Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 6/6] ca-certificates: correct the SRC_URI Steve Sakoman
5 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-08-09 14:44 UTC (permalink / raw)
To: openembedded-core
From: Gyorgy Sarvari <skandigraun@gmail.com>
Skip compress-cert-conf test when running ptests, because it requires
gnutls to be compiled with brotli PACKAGECONFIG, however brotli is not
part of oe-core.
Changelog: https://gitlab.com/gnutls/gnutls/-/blob/master/NEWS
(From OE-Core rev: 2ad41436acdc5f37803ade51c98ae0dc06103e45)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/gnutls/gnutls/run-ptest | 1 +
.../gnutls/{gnutls_3.8.9.bb => gnutls_3.8.10.bb} | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
rename meta/recipes-support/gnutls/{gnutls_3.8.9.bb => gnutls_3.8.10.bb} (97%)
diff --git a/meta/recipes-support/gnutls/gnutls/run-ptest b/meta/recipes-support/gnutls/gnutls/run-ptest
index 17e26eae70..b7827e1358 100644
--- a/meta/recipes-support/gnutls/gnutls/run-ptest
+++ b/meta/recipes-support/gnutls/gnutls/run-ptest
@@ -37,6 +37,7 @@ is_disallowed() {
# currently not exported to target.
test_disallowlist=""
+test_disallowlist="${test_disallowlist} compress-cert-conf"
test_disallowlist="${test_disallowlist} dtls-stress"
test_disallowlist="${test_disallowlist} handshake-large-cert"
test_disallowlist="${test_disallowlist} id-on-xmppAddr"
diff --git a/meta/recipes-support/gnutls/gnutls_3.8.9.bb b/meta/recipes-support/gnutls/gnutls_3.8.10.bb
similarity index 97%
rename from meta/recipes-support/gnutls/gnutls_3.8.9.bb
rename to meta/recipes-support/gnutls/gnutls_3.8.10.bb
index f2b7ac7bb8..600f23683e 100644
--- a/meta/recipes-support/gnutls/gnutls_3.8.9.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.8.10.bb
@@ -25,7 +25,7 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://Add-ptest-support.patch \
"
-SRC_URI[sha256sum] = "69e113d802d1670c4d5ac1b99040b1f2d5c7c05daec5003813c049b5184820ed"
+SRC_URI[sha256sum] = "db7fab7cce791e7727ebbef2334301c821d79a550ec55c9ef096b610b03eb6b7"
inherit autotools texinfo pkgconfig gettext lib_package gtk-doc ptest
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [OE-core][walnascar 6/6] ca-certificates: correct the SRC_URI
2025-08-09 14:44 [OE-core][walnascar 0/6] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-08-09 14:44 ` [OE-core][walnascar 5/6] gnutls: upgrade 3.8.9 -> 3.8.10 Steve Sakoman
@ 2025-08-09 14:44 ` Steve Sakoman
5 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-08-09 14:44 UTC (permalink / raw)
To: openembedded-core
From: Jiaying Song <jiaying.song.cn@windriver.com>
The original tarball URL is no longer valid, as it has been moved to an archive
location. This update points to the new location.
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../recipes-support/ca-certificates/ca-certificates_20241223.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb b/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb
index bbdc7dd68d..7977e3ae5c 100644
--- a/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb
+++ b/meta/recipes-support/ca-certificates/ca-certificates_20241223.bb
@@ -15,7 +15,7 @@ DEPENDS:class-nativesdk = "openssl-native"
PACKAGE_WRITE_DEPS += "openssl-native debianutils-native"
SRC_URI[sha256sum] = "dd8286d0a9dd35c756fea5f1df3fed1510fb891f376903891b003cd9b1ad7e03"
-SRC_URI = "${DEBIAN_MIRROR}/main/c/ca-certificates/${BPN}_${PV}.tar.xz \
+SRC_URI = "https://snapshot.debian.org/archive/debian/20241223T143500Z/pool/main/c/${BPN}/${BPN}_${PV}.tar.xz \
file://0002-update-ca-certificates-use-SYSROOT.patch \
file://0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch \
file://default-sysroot.patch \
--
2.43.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [OE-core][walnascar 4/6] glibc: stable 2.41 branch updates
2025-08-09 14:44 ` [OE-core][walnascar 4/6] glibc: stable 2.41 branch updates Steve Sakoman
@ 2025-08-09 15:45 ` Khem Raj
2025-08-09 22:23 ` Marko, Peter
0 siblings, 1 reply; 12+ messages in thread
From: Khem Raj @ 2025-08-09 15:45 UTC (permalink / raw)
To: steve; +Cc: openembedded-core
On Sat, Aug 9, 2025 at 7:44 AM Steve Sakoman via
lists.openembedded.org <steve=sakoman.com@lists.openembedded.org>
wrote:
>
> From: Peter Marko <peter.marko@siemens.com>
>
> $ git log --oneline 6e489c17f827317bcf8544efefa65f13b5a079dc..e7c419a2957590fb657900fc92a89708f41abd9d
> e7c419a295 (origin/release/2.41/master, release/2.41/master) iconv: iconv -o should not create executable files (bug 33164)
> 1e16d0096d posix: Fix double-free after allocation failure in regcomp (bug 33185)
>
> Add CVE-2025-8058 to CVE ignore list as this is (bug 33185) commit.
>
Hi Steve
Should we wait for WRT to report back on glibc regression test results ?
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> Signed-off-by: Steve Sakoman <steve@sakoman.com>
> ---
> meta/recipes-core/glibc/glibc-version.inc | 2 +-
> meta/recipes-core/glibc/glibc_2.41.bb | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
> index a2cfd0f308..881a9cce2c 100644
> --- a/meta/recipes-core/glibc/glibc-version.inc
> +++ b/meta/recipes-core/glibc/glibc-version.inc
> @@ -1,6 +1,6 @@
> SRCBRANCH ?= "release/2.41/master"
> PV = "2.41+git"
> -SRCREV_glibc ?= "6e489c17f827317bcf8544efefa65f13b5a079dc"
> +SRCREV_glibc ?= "e7c419a2957590fb657900fc92a89708f41abd9d"
> SRCREV_localedef ?= "fab74f31b3811df543e24b6de47efdf45b538abc"
>
> GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
> diff --git a/meta/recipes-core/glibc/glibc_2.41.bb b/meta/recipes-core/glibc/glibc_2.41.bb
> index 7ddf7f9127..8a65e8ce9f 100644
> --- a/meta/recipes-core/glibc/glibc_2.41.bb
> +++ b/meta/recipes-core/glibc/glibc_2.41.bb
> @@ -17,7 +17,7 @@ Allows for ASLR bypass so can bypass some hardening, not an exploit in itself, m
> easier access for another. 'ASLR bypass itself is not a vulnerability.'"
>
> CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
> -CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-4802 CVE-2025-5702 CVE-2025-5745"
> +CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-4802 CVE-2025-5702 CVE-2025-5745 CVE-2025-8058"
> CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
>
> DEPENDS += "gperf-native bison-native"
> --
> 2.43.0
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#221679): https://lists.openembedded.org/g/openembedded-core/message/221679
> Mute This Topic: https://lists.openembedded.org/mt/114616374/1997914
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 12+ messages in thread
* RE: [OE-core][walnascar 4/6] glibc: stable 2.41 branch updates
2025-08-09 15:45 ` Khem Raj
@ 2025-08-09 22:23 ` Marko, Peter
2025-08-10 0:37 ` Khem Raj
0 siblings, 1 reply; 12+ messages in thread
From: Marko, Peter @ 2025-08-09 22:23 UTC (permalink / raw)
To: raj.khem@gmail.com, steve@sakoman.com
Cc: openembedded-core@lists.openembedded.org
> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-
> core@lists.openembedded.org> On Behalf Of Khem Raj via
> lists.openembedded.org
> Sent: Saturday, August 9, 2025 17:45
> To: steve@sakoman.com
> Cc: openembedded-core@lists.openembedded.org
> Subject: Re: [OE-core][walnascar 4/6] glibc: stable 2.41 branch updates
>
> On Sat, Aug 9, 2025 at 7:44 AM Steve Sakoman via
> lists.openembedded.org <steve=sakoman.com@lists.openembedded.org>
> wrote:
> >
> > From: Peter Marko <peter.marko@siemens.com>
> >
> > $ git log --oneline
> 6e489c17f827317bcf8544efefa65f13b5a079dc..e7c419a2957590fb657900fc92a897
> 08f41abd9d
> > e7c419a295 (origin/release/2.41/master, release/2.41/master) iconv: iconv -o
> should not create executable files (bug 33164)
> > 1e16d0096d posix: Fix double-free after allocation failure in regcomp (bug
> 33185)
> >
> > Add CVE-2025-8058 to CVE ignore list as this is (bug 33185) commit.
> >
>
> Hi Steve
>
> Should we wait for WRT to report back on glibc regression test results ?
Testresults on my setup:
Before After Diff
PASS 5843 5847 +4
XPASS 4 4 0
FAIL 145 142 -3
XFAIL 16 16 0
UNSUPPORTED 243 243 0
Diff of testcase status:
malloc/tst-free-errno-malloc-hugetlb1 FAIL -> PASS
malloc/tst-free-errno-mcheck FAIL-> PASS
nptl/tst-getpid3 FAIL -> PASS
nptl/tst-mutexpi8 FAIL -> PASS
nptl/tst-mutexpi8-static PASS -> FAIL
tst-regcomp-bracket-free N/A -> PASS (new testcase)
Peter
>
> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
> > Signed-off-by: Steve Sakoman <steve@sakoman.com>
> > ---
> > meta/recipes-core/glibc/glibc-version.inc | 2 +-
> > meta/recipes-core/glibc/glibc_2.41.bb | 2 +-
> > 2 files changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-
> core/glibc/glibc-version.inc
> > index a2cfd0f308..881a9cce2c 100644
> > --- a/meta/recipes-core/glibc/glibc-version.inc
> > +++ b/meta/recipes-core/glibc/glibc-version.inc
> > @@ -1,6 +1,6 @@
> > SRCBRANCH ?= "release/2.41/master"
> > PV = "2.41+git"
> > -SRCREV_glibc ?= "6e489c17f827317bcf8544efefa65f13b5a079dc"
> > +SRCREV_glibc ?= "e7c419a2957590fb657900fc92a89708f41abd9d"
> > SRCREV_localedef ?= "fab74f31b3811df543e24b6de47efdf45b538abc"
> >
> > GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
> > diff --git a/meta/recipes-core/glibc/glibc_2.41.bb b/meta/recipes-
> core/glibc/glibc_2.41.bb
> > index 7ddf7f9127..8a65e8ce9f 100644
> > --- a/meta/recipes-core/glibc/glibc_2.41.bb
> > +++ b/meta/recipes-core/glibc/glibc_2.41.bb
> > @@ -17,7 +17,7 @@ Allows for ASLR bypass so can bypass some hardening,
> not an exploit in itself, m
> > easier access for another. 'ASLR bypass itself is not a vulnerability.'"
> >
> > CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
> > -CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-4802 CVE-2025-5702
> CVE-2025-5745"
> > +CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-4802 CVE-2025-5702
> CVE-2025-5745 CVE-2025-8058"
> > CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix
> available in used git hash"
> >
> > DEPENDS += "gperf-native bison-native"
> > --
> > 2.43.0
> >
> >
> >
> >
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [OE-core][walnascar 4/6] glibc: stable 2.41 branch updates
2025-08-09 22:23 ` Marko, Peter
@ 2025-08-10 0:37 ` Khem Raj
0 siblings, 0 replies; 12+ messages in thread
From: Khem Raj @ 2025-08-10 0:37 UTC (permalink / raw)
To: Marko, Peter; +Cc: steve@sakoman.com, openembedded-core@lists.openembedded.org
[-- Attachment #1: Type: text/plain, Size: 3695 bytes --]
On Sat, Aug 9, 2025 at 3:23 PM Marko, Peter <Peter.Marko@siemens.com> wrote:
>
> > -----Original Message-----
> > From: openembedded-core@lists.openembedded.org <openembedded-
> > core@lists.openembedded.org> On Behalf Of Khem Raj via
> > lists.openembedded.org
> > Sent: Saturday, August 9, 2025 17:45
> > To: steve@sakoman.com
> > Cc: openembedded-core@lists.openembedded.org
> > Subject: Re: [OE-core][walnascar 4/6] glibc: stable 2.41 branch updates
> >
> > On Sat, Aug 9, 2025 at 7:44 AM Steve Sakoman via
> > lists.openembedded.org <steve=sakoman.com@lists.openembedded.org>
> > wrote:
> > >
> > > From: Peter Marko <peter.marko@siemens.com>
> > >
> > > $ git log --oneline
> > 6e489c17f827317bcf8544efefa65f13b5a079dc..e7c419a2957590fb657900fc92a897
> > 08f41abd9d
> > > e7c419a295 (origin/release/2.41/master, release/2.41/master) iconv:
> iconv -o
> > should not create executable files (bug 33164)
> > > 1e16d0096d posix: Fix double-free after allocation failure in regcomp
> (bug
> > 33185)
> > >
> > > Add CVE-2025-8058 to CVE ignore list as this is (bug 33185) commit.
> > >
> >
> > Hi Steve
> >
> > Should we wait for WRT to report back on glibc regression test results ?
>
> Testresults on my setup:
> Before After Diff
> PASS 5843 5847 +4
> XPASS 4 4 0
> FAIL 145 142 -3
> XFAIL 16 16 0
> UNSUPPORTED 243 243 0
>
> Diff of testcase status:
> malloc/tst-free-errno-malloc-hugetlb1 FAIL -> PASS
> malloc/tst-free-errno-mcheck FAIL-> PASS
> nptl/tst-getpid3 FAIL -> PASS
> nptl/tst-mutexpi8 FAIL -> PASS
> nptl/tst-mutexpi8-static PASS -> FAIL
> tst-regcomp-bracket-free N/A -> PASS (new testcase)
Thanks Peter I think this looks good
> Peter
>
> >
> > > Signed-off-by: Peter Marko <peter.marko@siemens.com>
> > > Signed-off-by: Steve Sakoman <steve@sakoman.com>
> > > ---
> > > meta/recipes-core/glibc/glibc-version.inc | 2 +-
> > > meta/recipes-core/glibc/glibc_2.41.bb | 2 +-
> > > 2 files changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-
> > core/glibc/glibc-version.inc
> > > index a2cfd0f308..881a9cce2c 100644
> > > --- a/meta/recipes-core/glibc/glibc-version.inc
> > > +++ b/meta/recipes-core/glibc/glibc-version.inc
> > > @@ -1,6 +1,6 @@
> > > SRCBRANCH ?= "release/2.41/master"
> > > PV = "2.41+git"
> > > -SRCREV_glibc ?= "6e489c17f827317bcf8544efefa65f13b5a079dc"
> > > +SRCREV_glibc ?= "e7c419a2957590fb657900fc92a89708f41abd9d"
> > > SRCREV_localedef ?= "fab74f31b3811df543e24b6de47efdf45b538abc"
> > >
> > > GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
> > > diff --git a/meta/recipes-core/glibc/glibc_2.41.bb b/meta/recipes-
> > core/glibc/glibc_2.41.bb
> > > index 7ddf7f9127..8a65e8ce9f 100644
> > > --- a/meta/recipes-core/glibc/glibc_2.41.bb
> > > +++ b/meta/recipes-core/glibc/glibc_2.41.bb
> > > @@ -17,7 +17,7 @@ Allows for ASLR bypass so can bypass some hardening,
> > not an exploit in itself, m
> > > easier access for another. 'ASLR bypass itself is not a
> vulnerability.'"
> > >
> > > CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
> > > -CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-4802 CVE-2025-5702
> > CVE-2025-5745"
> > > +CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-4802 CVE-2025-5702
> > CVE-2025-5745 CVE-2025-8058"
> > > CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix
> > available in used git hash"
> > >
> > > DEPENDS += "gperf-native bison-native"
> > > --
> > > 2.43.0
> > >
> > >
> > >
> > >
>
[-- Attachment #2: Type: text/html, Size: 6087 bytes --]
^ permalink raw reply [flat|nested] 12+ messages in thread
* [OE-core][walnascar 0/6] Patch review
@ 2025-09-04 15:17 Steve Sakoman
0 siblings, 0 replies; 12+ messages in thread
From: Steve Sakoman @ 2025-09-04 15:17 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for walnascar and have comments back by
end of day Monday, September 9
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2315
The following changes since commit 49f47169953b807d430461ca33f3a2b076119712:
Revert "linux-yocto/6.12: riscv: Enable TUNE_FEATURES based KERNEL_FEATURES" (2025-09-02 09:42:19 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/walnascar-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/walnascar-nut
Deepak Rathore (1):
default-distrovars.inc: Fix CONNECTIVITY_CHECK_URIS redirect issue
Kyungjik Min (1):
pulseaudio: Add audio group explicitly
Per x Johansson (1):
rust-target-config: Add has-thread-local option
Peter Marko (1):
binutils: patch CVE-2025-8225
Siddharth Doshi (1):
tiff: Security fix for CVE-2024-13978, CVE-2025-8176, CVE-2025-8177
Yogita Urade (1):
tiff: fix CVE-2025-8534
meta-selftest/files/static-group | 1 +
.../classes-recipe/rust-target-config.bbclass | 1 +
.../distro/include/default-distrovars.inc | 2 +-
meta/lib/oeqa/sdk/buildtools-cases/https.py | 4 +-
.../binutils/binutils-2.44.inc | 1 +
.../binutils/0019-CVE-2025-8225.patch | 41 ++++++++++
.../libtiff/tiff/CVE-2024-13978_1.patch | 77 +++++++++++++++++++
.../libtiff/tiff/CVE-2024-13978_2.patch | 45 +++++++++++
.../libtiff/tiff/CVE-2025-8176_1.patch | 61 +++++++++++++++
.../libtiff/tiff/CVE-2025-8176_2.patch | 31 ++++++++
.../libtiff/tiff/CVE-2025-8176_3.patch | 28 +++++++
.../libtiff/tiff/CVE-2025-8177_1.patch | 36 +++++++++
.../libtiff/tiff/CVE-2025-8177_2.patch | 29 +++++++
.../libtiff/tiff/CVE-2025-8534.patch | 62 +++++++++++++++
meta/recipes-multimedia/libtiff/tiff_4.7.0.bb | 11 ++-
.../pulseaudio/pulseaudio.inc | 2 +-
16 files changed, 427 insertions(+), 5 deletions(-)
create mode 100644 meta/recipes-devtools/binutils/binutils/0019-CVE-2025-8225.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2024-13978_1.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2024-13978_2.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2025-8176_1.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2025-8176_2.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2025-8176_3.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2025-8177_1.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2025-8177_2.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2025-8534.patch
--
2.43.0
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2025-09-04 15:17 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-09 14:44 [OE-core][walnascar 0/6] Patch review Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 1/6] avahi: fix CVE-2024-52615 Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 2/6] sqlite3: patch CVE-2025-6965 Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 3/6] python3: fix CVE-2025-8194 Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 4/6] glibc: stable 2.41 branch updates Steve Sakoman
2025-08-09 15:45 ` Khem Raj
2025-08-09 22:23 ` Marko, Peter
2025-08-10 0:37 ` Khem Raj
2025-08-09 14:44 ` [OE-core][walnascar 5/6] gnutls: upgrade 3.8.9 -> 3.8.10 Steve Sakoman
2025-08-09 14:44 ` [OE-core][walnascar 6/6] ca-certificates: correct the SRC_URI Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2025-09-04 15:17 [OE-core][walnascar 0/6] Patch review Steve Sakoman
2025-07-24 19:35 Steve Sakoman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.