linux/meta-openembedded.git/meta-networking/recipes-daemons, branch scarthgap

postfix: upgrade 3.8.12 -> 3.8.16

2026-05-21T03:27:47+00:00

3.8.13 http://www.postfix.org/announcements/postfix-3.10.6.html 3.8.14 http://www.postfix.org/announcements/postfix-3.10.7.html 3.8.15 http://www.postfix.org/announcements/postfix-3.10.8.html 3.8.16 http://www.postfix.org/announcements/postfix-3.11.2.html Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

lldpd: fix xml PACKAGECONFIG dependency

2026-03-24T10:18:20+00:00

The xml PACKAGECONFIG entry uses libxm2, which is a typo and not a valid dependency in OE. Replace it with libxml2 so enabling PACKAGECONFIG:xml pulls in the correct provider. Signed-off-by: Aviv Daum Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj (cherry picked from commit cec3e0fd96650a133c6b0d60eb2b52d1aa7cd742) Signed-off-by: Anuj Mittal

keepalived: patch CVE-2024-41184

2026-03-24T03:22:01+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2024-41184 Backport the patches referenced by upstream in the bug mentioned by the NVD advisory. Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

proftpd: ignore CVE-2021-47865

2026-02-12T08:08:12+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865 This CVE was opened based on a 5 years old Github issue[1], and has been made public recently. The CVE wasn't officially disputed (yet?), but based on the description and the given PoC the application is working as expected. The vulnerability description and the PoC basically configures proftpd to accept maximum x connections, and then when the user tries to open x + 1 concurrent connections, it refuses new connections over the configured limit. See also discussion in the Github issue. It seems that it won't be fixed, because there is nothing to fix. [1]: https://github.com/proftpd/proftpd/issues/1298 Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

proftpd: patch CVE-2024-48651

2026-01-12T02:22:00+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2024-48651 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

proftpd: Fix CVE-2023-48795

2025-12-11T02:32:03+00:00

Upstream-Status: Backport from https://github.com/proftpd/proftpd/commit/bcec15efe6c53dac40420731013f1cd2fd54123b Signed-off-by: Vijay Anusuri Signed-off-by: Gyorgy Sarvari (cherry picked from commit 6c8ae54fc345fb6249f1cc92ed769d451ddc12b5) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

squid: patch CVE-2025-62168

2025-11-17T06:20:20+00:00

Pick commit mentioned in NVD CVE report. Conflict in src/errorpage.cc resolved per patch from Debian bookworm. Signed-off-by: Peter Marko Signed-off-by: Anuj Mittal

proftpd: set status of CVE-2001-0027

2025-11-17T06:20:20+00:00

This ancient CVE [1] is unversioned ("*") in NVD DB. "mod_sqlpw module in ProFTPD does not reset a cached password..." Looking at history and changelog, the module was removed [2] around the time when this CVE was published, likely as reaction to this CVE. "mod_sqlpw.c, mod_mysql.c and mod_pgsql.c have been REMOVED from the distribution. They are currently unmaintained and have numerous bugs." Note: It was later re-introduced as mod_sql when it got fixed under new maintainer. [1] https://nvd.nist.gov/vuln/detail/CVE-2001-0027 [2] https://github.com/proftpd/proftpd/blob/v1.3.8b/NEWS#L3362 Signed-off-by: Peter Marko Signed-off-by: Khem Raj (cherry picked from commit 03a1b56bc7ce88a3b0ad6790606b0498899cc1e3) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

ncftp: fix SRC_URI

2025-11-12T06:02:47+00:00

The downloaded tarball was moved to a new folder, causing fetching failures. Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

squid: upgrade 6.12 -> 6.14

2025-11-12T05:58:45+00:00

License-Update: copyright years updated Changelog: https://github.com/squid-cache/squid/releases/tag/SQUID_6_13 https://github.com/squid-cache/squid/releases/tag/SQUID_6_14 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal