Re: [OE-core][kirkstone v3 00/19] Patch review

["Yoann Congal" <yoann.congal@smile.fr>]

On Tue Apr 7, 2026 at 8:14 PM CEST, Vijay Anusuri wrote:
> Hi Yoann,
>
>
>
> On Tue, 7 Apr, 2026, 9:46 pm Yoann Congal via lists.openembedded.org,
> <yoann.congal=smile.fr@lists.openembedded.org> wrote:
>
>> Please review this set of changes for kirkstone and have comments back by
>> end of day Wednesday, April 8.
>>
>> Please note:
>> - This will be the last review cycle for kirkstone.
>> - If you expect a patch to get merged and it is not in this series ping
>>   me as soon as possible.
>> - Some patches look OK to me and are included here but will only be
>>   merged if some patches are sent/fixed in more recent branches:
>>   - Pending an equivalent patch sent for scarthgap:
>>     - ncurses: fix for CVE-2025-69720
>>   - Pending an equivalent patch sent for whinlatter:
>>     - libarchive: Fix CVE-2026-4111
>>
> --> Libarchive 3.8.6 upgrade patch submitted for whinlatter. This upgrade
> fixes CVE-2026-4111 .

That's right:
[OE-core][whinlatter][patch] libarchive: upgrade 3.8.5 -> 3.8.6 - Vijay Anusuri
https://lore.kernel.org/openembedded-core/20260406065532.1259890-1-vanusuri@mvista.com/
(I did not make the connection)

Thanks!

>
> Passed a-full on autobuilder:
>> https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/3612
>>
>> v2->v3:
>> - Added ncurses:·fix·for·CVE-2025-69720 to the series
>>
>> v1->v2:
>> - replaced "python3: Fix CVE-2025-15282" with
>>   "python3: upgrade 3.10.19 -> 3.10.20"
>> - Those patches are not held anymore since equivalent patches have been
>>   sent to more recent branches:
>>     - curl: patch CVE-2026-3784
>>     - curl: patch CVE-2026-3783
>>     - curl: patch CVE-2026-1965
>>     - vim: Fix CVE-2026-33412
>>
>> The following changes since commit
>> c4194cadb1180da37514c55cd97827eb0269c8e2:
>>
>>   build-appliance-image: Update to kirkstone head revision (2026-03-20
>> 09:58:53 +0000)
>>
>> are available in the Git repository at:
>>
>>   https://git.openembedded.org/openembedded-core-contrib
>> stable/kirkstone-nut
>>
>> https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
>>
>> for you to fetch changes up to 94df79c304f692b0108155e04905180cdf92b2cd:
>>
>>   scripts/install-buildtools: Update to 4.0.34 (2026-04-07 09:14:47 +0200)
>>
>> ----------------------------------------------------------------
>>
>> Bruce Ashfield (2):
>>   linux-yocto/5.15: update to v5.15.200
>>   linux-yocto/5.15: update to v5.15.201
>>
>> Fabien Thomas (1):
>>   README.OE-Core: update contributor links and add kirkstone prefix
>>
>> Hitendra Prajapati (2):
>>   vim: Fix CVE-2026-33412
>>   ncurses: fix for CVE-2025-69720
>>
>> Jinfeng Wang (1):
>>   tzdata/tzcode-native: upgrade 2025c -> 2026a
>>
>> Paul Barker (1):
>>   create-pull-request: Keep commit hash to be pulled in cover email
>>
>> Peter Marko (1):
>>   libtheora: mark CVE-2024-56431 as not vulnerable yet
>>
>> Vijay Anusuri (10):
>>   tzdata,tzcode-native: Upgrade 2025b -> 2025c
>>   python3: upgrade 3.10.19 -> 3.10.20
>>   python3-pyopenssl: Fix CVE-2026-27448
>>   python3-pyopenssl: Fix CVE-2026-27459
>>   libarchive: Fix CVE-2026-4111
>>   sqlite3: Fix CVE-2025-70873
>>   curl: patch CVE-2025-14524
>>   curl: patch CVE-2026-1965
>>   curl: patch CVE-2026-3783
>>   curl: patch CVE-2026-3784
>>
>> Yoann Congal (1):
>>   scripts/install-buildtools: Update to 4.0.34
>>
>>  README.OE-Core.md                             |  10 +-
>>  .../ncurses/files/CVE-2025-69720.patch        |  42 ++
>>  .../ncurses/ncurses_6.3+20220423.bb           |   1 +
>>  .../python3-pyopenssl/CVE-2026-27448.patch    | 125 ++++++
>>  .../python3-pyopenssl/CVE-2026-27459.patch    | 106 +++++
>>  .../python/python3-pyopenssl_22.0.0.bb        |   5 +
>>  .../python/python3/CVE-2025-12084.patch       | 171 --------
>>  .../python/python3/CVE-2025-13836.patch       | 163 --------
>>  .../python/python3/CVE-2025-13837.patch       | 162 --------
>>  .../python/python3/CVE-2025-6075.patch        | 364 ------------------
>>  ...{python3_3.10.19.bb => python3_3.10.20.bb} |   6 +-
>>  .../libarchive/CVE-2026-4111-1.patch          |  32 ++
>>  .../libarchive/CVE-2026-4111-2.patch          | 308 +++++++++++++++
>>  .../libarchive/libarchive_3.6.2.bb            |   2 +
>>  meta/recipes-extended/timezone/timezone.inc   |   6 +-
>>  .../linux/linux-yocto-rt_5.15.bb              |   6 +-
>>  .../linux/linux-yocto-tiny_5.15.bb            |   6 +-
>>  meta/recipes-kernel/linux/linux-yocto_5.15.bb |  26 +-
>>  .../libtheora/libtheora_1.1.1.bb              |   3 +
>>  .../curl/curl/CVE-2025-14524.patch            |  42 ++
>>  .../curl/curl/CVE-2026-1965-1.patch           |  98 +++++
>>  .../curl/curl/CVE-2026-1965-2.patch           |  29 ++
>>  .../curl/curl/CVE-2026-3783-pre1.patch        |  66 ++++
>>  .../curl/curl/CVE-2026-3783.patch             | 157 ++++++++
>>  .../curl/curl/CVE-2026-3784.patch             |  73 ++++
>>  meta/recipes-support/curl/curl_7.82.0.bb      |   6 +
>>  .../sqlite/files/CVE-2025-70873.patch         |  33 ++
>>  meta/recipes-support/sqlite/sqlite3_3.38.5.bb |   1 +
>>  .../vim/files/CVE-2026-33412.patch            |  61 +++
>>  meta/recipes-support/vim/vim.inc              |   1 +
>>  scripts/create-pull-request                   |   2 +-
>>  scripts/install-buildtools                    |   4 +-
>>  32 files changed, 1224 insertions(+), 893 deletions(-)
>>  create mode 100644 meta/recipes-core/ncurses/files/CVE-2025-69720.patch
>>  create mode 100644
>> meta/recipes-devtools/python/python3-pyopenssl/CVE-2026-27448.patch
>>  create mode 100644
>> meta/recipes-devtools/python/python3-pyopenssl/CVE-2026-27459.patch
>>  delete mode 100644
>> meta/recipes-devtools/python/python3/CVE-2025-12084.patch
>>  delete mode 100644
>> meta/recipes-devtools/python/python3/CVE-2025-13836.patch
>>  delete mode 100644
>> meta/recipes-devtools/python/python3/CVE-2025-13837.patch
>>  delete mode 100644
>> meta/recipes-devtools/python/python3/CVE-2025-6075.patch
>>  rename meta/recipes-devtools/python/{python3_3.10.19.bb =>
>> python3_3.10.20.bb} (98%)
>>  create mode 100644
>> meta/recipes-extended/libarchive/libarchive/CVE-2026-4111-1.patch
>>  create mode 100644
>> meta/recipes-extended/libarchive/libarchive/CVE-2026-4111-2.patch
>>  create mode 100644 meta/recipes-support/curl/curl/CVE-2025-14524.patch
>>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-1965-1.patch
>>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-1965-2.patch
>>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-3783-pre1.patch
>>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-3783.patch
>>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-3784.patch
>>  create mode 100644 meta/recipes-support/sqlite/files/CVE-2025-70873.patch
>>  create mode 100644 meta/recipes-support/vim/files/CVE-2026-33412.patch
>>
>>
>> -=-=-=-=-=-=-=-=-=-=-=-
>> Links: You receive all messages sent to this group.
>> View/Reply Online (#234753):
>> https://lists.openembedded.org/g/openembedded-core/message/234753
>> Mute This Topic: https://lists.openembedded.org/mt/118710539/7301997
>> Group Owner: openembedded-core+owner@lists.openembedded.org
>> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
>> vanusuri@mvista.com]
>> -=-=-=-=-=-=-=-=-=-=-=-
>>
>>


-- 
Yoann Congal
Smile ECS