linux/meta-openembedded.git/meta-webserver, branch kirkstone

nginx: fix CVE-2026-32647

2026-04-23T18:22:41+00:00

As per the advisory[1] mentioned in NVD[2], version 1.28.3 contains the fix. Backport the commit[3] from 1.28.3 changelog matching the description. [1] https://my.f5.com/manage/s/article/K000160366 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-32647 [3] https://github.com/nginx/nginx/commit/a172c880cb51f882a5dc999437e8b3a4f87630cc Signed-off-by: Hitendra Prajapati Signed-off-by: Gyorgy Sarvari

nginx: fix multiple CVEs

2026-04-23T18:20:04+00:00

Pick up patch from NVD report. More details : [1]: https://nvd.nist.gov/vuln/detail/CVE-2026-27651 [2]: https://nvd.nist.gov/vuln/detail/CVE-2026-27654 [3]: https://nvd.nist.gov/vuln/detail/CVE-2026-28753 Signed-off-by: Hitendra Prajapati Debian links, referencing these commits: https://security-tracker.debian.org/tracker/CVE-2026-27651 https://security-tracker.debian.org/tracker/CVE-2026-27654 https://security-tracker.debian.org/tracker/CVE-2026-28753 Signed-off-by: Gyorgy Sarvari

nginx: set CVE_PRODUCT

2026-04-17T04:36:47+00:00

nginx has a long history, and has used multiple CPEs over time. Set CVE_PRODUCT to reflect current and historic vendor:product pairs. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit d25aadbbb53d54382b4b82b1f78a69d4d117fd28) Signed-off-by: Colin Pinnell McAllister Signed-off-by: Gyorgy Sarvari

nginx: fix CVE-2026-27784, CVE-2026-28755

2026-04-07T08:36:44+00:00

Pick up patch [1] and [2] from Debian report. [1] https://security-tracker.debian.org/tracker/CVE-2026-27784 [2] https://security-tracker.debian.org/tracker/CVE-2026-28755 More details : [1]: https://nvd.nist.gov/vuln/detail/CVE-2026-27784 [2]: https://nvd.nist.gov/vuln/detail/CVE-2026-28755 Signed-off-by: Hitendra Prajapati Signed-off-by: Gyorgy Sarvari

hiawatha: fix SRC_URI

2026-03-13T04:54:22+00:00

The tarball was moved to a new folder on the source server. Signed-off-by: Gyorgy Sarvari

netdata: patch CVE-2023-22497

2026-03-07T20:05:37+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2023-22497 This patch was selected based on its description, and based on the associated PR. The description matches the issue described in the NVD advisory, and the PR credits the same reported that is also credited with the CVE ID (in the release notes of the application). Signed-off-by: Gyorgy Sarvari

webmin: patch CVE-2025-67738

2026-02-27T13:28:50+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-67738 Backport the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari

nginx: apply patchs for CVE-2025-23419 and CVE-2026-1642 to all versions

2026-02-26T12:36:35+00:00

There is no reason to apply them only to single version when they apply properly to all versions. Signed-off-by: Peter Marko Signed-off-by: Gyorgy Sarvari

fcgi: add follow-up patch for CVE-2025-23016

2026-02-26T12:36:35+00:00

New release [1] added additional fir for this CVE. [1] https://github.com/FastCGI-Archives/fcgi2/releases/tag/2.4.7 Signed-off-by: Peter Marko Signed-off-by: Gyorgy Sarvari

nginx: patch CVE-2026-1642

2026-02-26T12:36:34+00:00

Pick patch accorting to [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-1642 Signed-off-by: Peter Marko Signed-off-by: Gyorgy Sarvari