linux/meta-openembedded.git/meta-networking/recipes-daemons, branch kirkstone

lldpd: fix xml PACKAGECONFIG dependency

2026-03-13T04:57:22+00:00

The xml PACKAGECONFIG entry uses libxm2, which is a typo and not a valid dependency in OE. Replace it with libxml2 so enabling PACKAGECONFIG:xml pulls in the correct provider. Signed-off-by: Aviv Daum Signed-off-by: Gyorgy Sarvari

keepalived: patch CVE-2024-41184

2026-02-27T13:28:50+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2024-41184 Backport the patches referenced by upstream in the bug mentioned by the NVD advisory. Signed-off-by: Gyorgy Sarvari

proftpd: ignore CVE-2021-47865

2026-01-30T17:59:29+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865 This CVE was opened based on a 5 years old Github issue[1], and has been made public recently. The CVE wasn't officially disputed (yet?), but based on the description and the given PoC the application is working as expected. The vulnerability description and the PoC basically configures proftpd to accept maximum x connections, and then when the user tries to open x + 1 concurrent connections, it refuses new connections over the configured limit. See also discussion in the Github issue. I just put it on the ignore list. [1]: https://github.com/proftpd/proftpd/issues/1298 Signed-off-by: Gyorgy Sarvari

squid: upgrade 4.15 -> 4.17

2026-01-20T17:22:02+00:00

These are bugfix releases. Changelogs: 4.17: - WCCP: Validate packets better 4.16: - Regression Fix: --with-valgrind-debug build broken since 4.15 - Bug 5129 pt1: remove Lock use from HttpRequestMethod - Bug 5128: Translation: Fix '% i' typo in es/ERR_FORWARDING_DENIED - Bug 4528: ICAP transactions quit on async DNS lookups Signed-off-by: Gyorgy Sarvari

lldpd: patch CVE-2021-43612

2026-01-08T21:03:03+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2021-43612 Pick the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari

proftpd: set status of CVE-2001-0027

2026-01-08T21:03:03+00:00

This ancient CVE [1] is unversioned ("*") in NVD DB. "mod_sqlpw module in ProFTPD does not reset a cached password..." Looking at history and changelog, the module was removed [2] around the time when this CVE was published, likely as reaction to this CVE. "mod_sqlpw.c, mod_mysql.c and mod_pgsql.c have been REMOVED from the distribution. They are currently unmaintained and have numerous bugs." Note: It was later re-introduced as mod_sql when it got fixed under new maintainer. [1] https://nvd.nist.gov/vuln/detail/CVE-2001-0027 [2] https://github.com/proftpd/proftpd/blob/v1.3.8b/NEWS#L3362 Signed-off-by: Peter Marko Signed-off-by: Khem Raj (cherry picked from commit 03a1b56bc7ce88a3b0ad6790606b0498899cc1e3) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari

proftpd: patch CVE-2024-48651

2025-12-17T14:38:00+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2024-48651 Backport the patch mentioned in the NVD report. Signed-off-by: Gyorgy Sarvari

ncftp: correct SRC_URI

2025-11-17T08:08:27+00:00

The original xz-compressed tarball isn't available at the download location anymore - switch to the gz tarball which is still there. Signed-off-by: Gyorgy Sarvari

keepalived: patch CVE-2021-44225

2025-10-27T17:08:19+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2021-44225 Pick patch mentioned in the nvd report. Signed-off-by: Gyorgy Sarvari

squid: fix esi PACKAGECONFIG

2025-10-27T10:17:33+00:00

libxml has derecated the "xmlSetFeature" call, and hid is behind a special config flag (--with-legacy), which is not used by default in oe-core. This makes compilation fail, when "esi" PACKAGECONFIG is enabled: Libxml2Parser.cc:94:5: error: 'xmlSetFeature' was not declared in this scope; did you mean 'xmlHasFeature'? This backported patch fixes this. Signed-off-by: Gyorgy Sarvari