linux/meta-openembedded.git/meta-webserver/recipes-httpd, branch whinlatter

monkey: patch CVEs

2026-04-24T15:43:20+00:00

These patches are about a number of CVEs files against the application: CVE-2025-63649, CVE-2025-63650, CVE-2025-63651, CVE-2025-63652, CVE-2025-63653, CVE-2025-63655, CVE-2025-63656, CVE-2025-63657 and CVE-2025-63658. These patches are taken from a pull request[1] that is referenced in the relevant bug report[2]. The patches don't target specific CVEs on separately, but they fix a number of CVEs altogether. Based on upstream analysis (in the linked issue) a number of these CVEs are duplicates of each other and/or not exploitable. The valid CVEs are fixed by these patches. I haven't added specific CVE info to the patches, one hand because of the above, it is hard to separate the patches by CVE, and secondarily because NVD tracks these CVEs with incorrect version info: NVD considers 1.8.6 fully fixed, even though the patches are only in the master branch, untagged at this time. After updating the recipe to 1.8.6+, the vulnerabilites will disappear from the CVE report due to this. [1]: https://github.com/monkey/monkey/pull/434 [2]: https://github.com/monkey/monkey/issues/426 Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit d31f07340fad43120f5e2ee4aee98cdec6f2717d) Signed-off-by: Anuj Mittal

monkey: upgrade 1.8.4 -> 1.8.7

2026-04-24T15:43:20+00:00

Shortlog: https://github.com/monkey/monkey/compare/v1.8.4...v1.8.7 Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit 22277ca3a34083c27b5053bde58237e48b0e8799) Signed-off-by: Anuj Mittal

hiawatha: upgrade 11.7 -> 11.8

2026-04-24T15:43:20+00:00

Drop patches that are included in this release. Changes: * mbed TLS updated to 3.6.4. * Small bugfixes. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit d92fa873e5616ee7a7b25683ddfdb6849ef72d29) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

nginx: upgrade 1.28.2 -> 1.28.3

2026-04-21T03:27:47+00:00

Changes: *) Security: a buffer overflow might occur while handling a COPY or MOVE request in a location with "alias", allowing an attacker to modify the source or destination path outside of the document root (CVE-2026-27654). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module on 32-bit platforms might cause a worker process crash, or might have potential other impact (CVE-2026-27784). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash, or might have potential other impact (CVE-2026-32647). *) Security: a segmentation fault might occur in a worker process if the CRAM-MD5 or APOP authentication methods were used and authentication retry was enabled (CVE-2026-27651). *) Security: an attacker might use PTR DNS records to inject data in auth_http requests, as well as in the XCLIENT command in the backend SMTP connection (CVE-2026-28753). *) Security: SSL handshake might succeed despite OCSP rejecting a client certificate in the stream module (CVE-2026-28755). *) Change: now nginx limits the size and rate of QUIC stateless reset packets. *) Bugfix: receiving a QUIC packet by a wrong worker process could cause the connection to terminate. *) Bugfix: in the ngx_http_mp4_module. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit 34b3d0f4917169c5cd568cdb13796a2d75f1fbf1) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

nginx: upgrade 1.29.1 -> 1.29.2

2026-04-21T03:27:47+00:00

Changes with nginx 1.29.2 *) Feature: now nginx can be built with AWS-LC. *) Bugfix: now the "ssl_protocols" directive works in a virtual server different from the default server when using OpenSSL 1.1.1 or newer. *) Bugfix: SSL handshake always failed when using TLSv1.3 with OpenSSL and client certificates and resuming a session with a different SNI value; the bug had appeared in 1.27.4. *) Bugfix: the "ignoring stale global SSL error" alerts might appear in logs when using QUIC and the "ssl_reject_handshake" directive; the bug had appeared in 1.29.0. *) Bugfix: in delta-seconds processing in the "Cache-Control" backend response header line. *) Bugfix: an XCLIENT command didn't use the xtext encoding. *) Bugfix: in SSL certificate caching during reconfiguration. https://nginx.org/en/CHANGES Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

hiawatha: fix SRC_URI

2026-03-26T04:59:23+00:00

The tarball was moved to a new folder on the source server. Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

nginx: patch CVE-2026-1642

2026-03-06T04:39:06+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-1642 Note: this is only for v1.29.1. v1.28.x recipe contains this fix already. Pick the commit that was identified by the reporter on the oss-sec mailing list[1] [1]: https://www.openwall.com/lists/oss-security/2026/02/05/1 Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

nginx: upgrade 1.28.1 -> 1.28.2

2026-02-19T03:06:46+00:00

Changelog: - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642). - Bugfix: use-after-free might occur after switching to the next gRPC or HTTP/2 backend. - Bugfix: fixed warning when compiling with MSVC 2022 x86. Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

nginx: ignore CVE-2025-53859 for 1.28.1

2026-01-20T04:47:24+00:00

Fix is included via commit [1]. [1] https://github.com/nginx/nginx/commit/fbbbf189dadf3bd59c2462af68c16f2c2874d4ee Signed-off-by: Peter Marko Signed-off-by: Khem Raj (cherry picked from commit 5d3936d5dd0489a984e37cc00b59e6a05d9541ac) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

nginx: set CVE_PRODUCT

2026-01-20T04:47:24+00:00

nginx has a long history, and has used multiple CPEs over time. Set CVE_PRODUCT to reflect current and historic vendor:product pairs. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit d25aadbbb53d54382b4b82b1f78a69d4d117fd28) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal