summaryrefslogtreecommitdiffstats
path: root/meta-networking
Commit message (Collapse)AuthorAgeFilesLines
* networkmanager-openvpn: upgrade 1.12.3 -> 1.12.5Liu Yiding2026-03-091-1/+3
| | | | | | | | | | | | Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit fcebca61e5cec25f4e34aefa8967cf71a07704ec) Release Notes: https://github.com/NetworkManager/NetworkManager-openvpn/blob/1.12.5/NEWS Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* networkmanager: upgrade 1.52.0 -> 1.52.2Liu Yiding2026-03-091-2/+2
| | | | | | | | | | | | Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 14c9d10173aa57ab780bdcf83dbc8859f90291e4) Release Notes: https://github.com/NetworkManager/NetworkManager/blob/1.52.2/NEWS Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nopoll: upgrade 0.4.7.b429 -> 0.4.9.b462Ankur Tyagi2026-03-091-1/+1
| | | | | | | | | | | | | | | 0.4.9 ----- Stable release with bug fixing, support for Debian Buster, Debian Bullseye and Ubuntu Focal https://github.com/ASPLes/nopoll/blob/master/doc/release-notes/nopoll-0.4.9.txt 0.4.8 ----- Stable release with bug fixing, support for Debian Buster, Debian Bullseye and Ubuntu Focal https://github.com/ASPLes/nopoll/blob/master/doc/release-notes/nopoll-0.4.8.txt Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nopoll: Upgrade to 0.4.7.b429Jason Schonberg2026-03-091-2/+1
| | | | | | | | | | | | | | Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5f7c5c664162f0e08363783acb7756e9cbfb2cc5) Stable release with bug fixing, support for Debian Stretch and Ubuntu Bionic Release Notes: https://github.com/ASPLes/nopoll/blob/master/doc/release-notes/nopoll-0.4.7.txt Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* frr: upgrade 10.4.2 -> 10.4.3Ankur Tyagi2026-03-091-1/+1
| | | | | | | | Release Notes: https://github.com/FRRouting/frr/releases/tag/frr-10.4.3 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* unbound: patch CVE-2025-5994Gyorgy Sarvari2026-03-092-0/+280
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-5994 Backport the patch[1] provided by upstream, which is linked in the upstream advisory[2] referenced by the NVD report. Tests passed successfully in a locally prepared ptest image. [1]: https://nlnetlabs.nl/downloads/unbound/patch_CVE-2025-5994_2.diff [1]: https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2025-7394Ankur Tyagi2026-03-067-0/+632
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-7394 Backport patches from the PR[1][2][3] mentioned in the changelog[4]. [1] https://github.com/wolfSSL/wolfssl/pull/8849 [2] https://github.com/wolfSSL/wolfssl/pull/8867 [3] https://github.com/wolfSSL/wolfssl/pull/8898 [4] https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-582-july-17-2025 Dropped changes to github workflow and tests during backport. Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2025-7395Ankur Tyagi2026-03-065-0/+170
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-7395 Backport patches from the PR[1] mentioned in the changelog[2] [1] github.com/wolfSSL/wolfssl/pull/8833 [2] https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-582-july-17-2025 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wolfssl: patch CVE-2025-13912Ankur Tyagi2026-03-062-0/+440
| | | | | | | | | | Backport changes from PR[1] mentioned in nvd[2] [1] https://github.com/wolfSSL/wolfssl/pull/9148 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-13912 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wireshark: patch CVE-2026-0962Gyorgy Sarvari2026-02-192-0/+132
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-0962 Backport the commit that is referenced in the related gitlab issue[1]. [1]: https://gitlab.com/wireshark/wireshark/-/issues/20945 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* linux-atm: fix SRC_URIGyorgy Sarvari2026-02-031-1/+1
| | | | | | | | | The original SRC_URI's certificate has expired - change it to a working URL. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a1baa1c027cba6ba86d92b4ad5c2db0b7bba0d1f) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* proftpd: ignore CVE-2021-47865Gyorgy Sarvari2026-02-031-0/+1
| | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865 This CVE was opened based on a 5 years old Github issue[1], and has been made public recently. The CVE wasn't officially disputed (yet?), but based on the description and the given PoC the application is working as expected. The vulnerability description and the PoC basically configures proftpd to accept maximum x connections, and then when the user tries to open x + 1 concurrent connections, it refuses new connections over the configured limit. See also discussion in the Github issue. It seems that it won't be fixed, because there is nothing to fix. [1]: https://github.com/proftpd/proftpd/issues/1298 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* ez-ipupdate: patch CVE-2003-0887Gyorgy Sarvari2026-02-032-0/+165
| | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2003-0887 The vulnerability is about the default (example) configurations, which place cache files into the /tmp folder, that is world-writeable. The recommendation would be to place them to a more secure folder. The recipe however does not install these example configurations, and as such it is not vulnerable either. Just to make sure, patch these folders to a non-tmp folder (and also install that folder, empty). Some more discussion about the vulnerability: https://bugzilla.suse.com/show_bug.cgi?id=48161 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* ndpi: ignore CVE-2025-25066Gyorgy Sarvari2026-02-031-1/+2
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-25066 The vulnerable code was introduced in version 4.12[1], and the recipe version is not vulnerable yet. Due to this, ignore this CVE. [1]: https://github.com/ntop/nDPI/commit/b9348e9d6e0e754c4b17661c643ca258f1540ca1 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* frr: patch CVE-2025-61099..61107Gyorgy Sarvari2026-02-024-0/+416
| | | | | | | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61099 https://nvd.nist.gov/vuln/detail/CVE-2025-61100 https://nvd.nist.gov/vuln/detail/CVE-2025-61101 https://nvd.nist.gov/vuln/detail/CVE-2025-61102 https://nvd.nist.gov/vuln/detail/CVE-2025-61103 https://nvd.nist.gov/vuln/detail/CVE-2025-61104 https://nvd.nist.gov/vuln/detail/CVE-2025-61105 https://nvd.nist.gov/vuln/detail/CVE-2025-61106 https://nvd.nist.gov/vuln/detail/CVE-2025-61107 The NVD advisory refernces a PR[1] that contains only an unfinished, and ultimately unmerged attempt at the fixes. The actual solution comes from a different PR[2]. These patches are 3 commits from that PR. The last commit wasn't backported, because it is just code formatting. [1]: https://github.com/FRRouting/frr/pull/19480 [2]: https://github.com/FRRouting/frr/pull/19983 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3cd47f72ad8d3889e2ef44c63ce6414cb1a9964d) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libowfat: update SRC_URIGyorgy Sarvari2026-01-211-1/+1
| | | | | | | | | | The https link does not work anymore, it just refuses the connection. http still works though. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8cab2b2977f7cfbbf7bf1aa617070163e2eaf002) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* ncp: update SRC_URIGyorgy Sarvari2026-01-211-1/+1
| | | | | | | | | | The https link does not work anymore, it just refuses the connection. http still works though. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8da9f2fea2e4c2f525e9357814f21b70669b8d8b) Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-scapy: set CVE_PRODUCTGyorgy Sarvari2026-01-201-0/+2
| | | | | | | | | | | | | | | | | The default ${PN} (python3-scapy) CVE fails to match relevant CVEs, because they are tracked under the scapy:scapy CPE. Set CVE_PRODUCT to the correct value. See CVE db query: sqlite> select * from products where product like '%scapy%'; CVE-2019-1010142|scapy|scapy|2.4.0|=|| Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 6f68f5fce766096b9d086093ca0435bc5904b8e7) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* tinyproxy: patch CVE-2025-63938Gyorgy Sarvari2026-01-202-0/+44
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-63938 Pick the patch referenced by the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 7981f52062d444aed1759c674bd3ec024a4f232c) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* dante: Add _GNU_SOURCE for musl buildsKhem Raj2026-01-201-0/+2
| | | | | | | | | | This helps build fixes e.g. cpuset_t definitions etc. glibc builds have _GNU_SOURCE defined inherently. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 848bac20ea27afddc3843c41ad105843ad167177) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* dante: upgrade 1.4.3 -> 1.4.4Gyorgy Sarvari2026-01-201-2/+2
| | | | | | | | | | | | | | | | | | | | License-Update: copyright year bump Changelog: - Fix potential security issue CVE-2024-54662, related to "socksmethod" use in client/hostid-rules. - Add a missing call to setgroups(2). - Patch to fix compilation with libminiupnp 2.2.8. - Client connectchild optimizations. - Client SIGIO handling improvements. - Various configure/build fixes. - Updated to support TCP_EXP1 version of TCP hostid format. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9f12c5fbc63143c33d6c68139cccac770817b4eb) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* frr: upgrade 10.4.1 -> 10.4.2Ankur Tyagi2026-01-201-1/+1
| | | | | | | | Release Notes: https://github.com/FRRouting/frr/releases/tag/frr-10.4.2 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libcoap: set CVE version suffixPeter Marko2026-01-201-0/+2
| | | | | | | | | CVE metrics currently report CVE-2025-34468 as open. CPE is <=4.3.5, while recipe version is 4.3.5a which is a higher version, however by default cve-check only compares numbers. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* net-snmp: patch CVE-2025-68615Peter Marko2026-01-202-0/+34
| | | | | | | | | Pick patch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-68615 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* openvpn: upgrade 2.6.16 -> 2.6.17Gyorgy Sarvari2026-01-061-1/+1
| | | | | | | Contains fix for CVE-2025-13751 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libcoap: ignore CVE-2025-50518Gyorgy Sarvari2026-01-061-0/+2
| | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-50518 The vulnerability is disputed by upstream, because the vulnerability requires a user error, incorrect library usage. See also an upstream discussion in a related (rejected) PR: https://github.com/obgm/libcoap/pull/1726 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 598176e1cb6c928e322e26d358e8d01ba9d5af0a) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* fetchmail: patch CVE-2025-61962Ankur Tyagi2026-01-062-0/+52
| | | | | | | | | | Details https://nvd.nist.gov/vuln/detail/CVE-2025-61962 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit 0d9da1105276f04cb23046de5f31fc75f09e2e89) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* civetweb: ignore CVE-2025-9648Gyorgy Sarvari2026-01-061-1/+2
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-9648 It is already fixed in the currently used version. Also, update CVE-2025-55763's status to "fixed-version" (so it will be marked as "Patched" in the CVE report instead of "Ignored") Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bfb76da63bd141173aeb71ce91c336b8aa557a5f) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* dovecot: patch CVE-2025-30189Gyorgy Sarvari2026-01-068-0/+489
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-30189 Pick the patches referenced by the advisory[1] from the Full Disclosure list. [1]: https://seclists.org/fulldisclosure/2025/Oct/29 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* cifs-utils: patch CVE-2025-2312Gyorgy Sarvari2026-01-062-1/+138
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-2312 Pick the patch that is referenced by the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* openipmi: Pass BUILD_CFLAGS to BUILD_CCMingli Yu2025-12-172-0/+36
| | | | | | | | | | | | | | | | | | | | * The option -fcanon-prefix-map is added to CFLAGS after the commit [1] introduced and result in the below build error. Making all in sdrcomp make[3]: Entering directory '/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/sources/OpenIPMI-2.0.37/lanserv/sdrcomp' aarch64-wrs-linux-gcc -mcpu=cortex-a57+crc -mbranch-protection=standard -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security --sysroot=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/recipe-sysroot -DHAVE_CONFIG_H -I. -I../.. -DSTATEDIR='"/var"' -Wall -Wsign-compare -I../../include -I../../lanserv -I../../utils -O2 -g -fcanon-prefix-map -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/sources/OpenIPMI-2.0.37=/usr/src/debug/openipmi/2.0.37 -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/sources/OpenIPMI-2.0.37=/usr/src/debug/openipmi/2.0.37 -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/recipe-sysroot= -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/recipe-sysroot-native= -pipe -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -c -o sdrcomp.o sdrcomp.c gcc -o sdrcomp_build ../../lanserv/sdrcomp/sdrcomp.c -O2 -g -fcanon-prefix-map -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/sources/OpenIPMI-2.0.37=/usr/src/debug/openipmi/2.0.37 -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/sources/OpenIPMI-2.0.37=/usr/src/debug/openipmi/2.0.37 -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/recipe-sysroot= -ffile-prefix-map=/tmp/work/cortexa57-wrs-linux/openipmi/2.0.37/recipe-sysroot-native= -pipe -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Wall -Wsign-compare -I../../include -I../../lanserv -I../../utils -lm gcc: error: unrecognized command-line option ‘-fcanon-prefix-map’; did you mean ‘-fmacro-prefix-map=’? * Pass BUILD_CFLAGS for BUILD_CC to fix the above build issue. [1] https://git.openembedded.org/openembedded-core/commit/?id=3dbc4a79f01ebfc54da024c1460c06772659088d Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c41fb791faaebf9e86b021d039d860ccf5ff45f1) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libcoap: upgrade 4.3.5 -> 4.3.5aPeter Marko2025-12-171-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog [1]: * Fixes the following CVEs CVE-2025-59391 CVE-2025-65494 CVE-2025-65495 CVE-2025-65496 CVE-2025-65497 CVE-2025-65498 CVE-2025-65499 CVE-2025-65500 CVE-2025-65501 * CVE-2025-50518 not fixed as user application error. * Support for Mbed TLS 3.6.3. * Support for RIOT update changes. * Fixes for later CI environment builds. * Critical reported bugs fixed. Add tag to SRC_URI for hash verification. License-Update: copyright years refreshed [2] [1] https://github.com/obgm/libcoap/blob/v4.3.5a/ChangeLog [2] https://github.com/obgm/libcoap/commit/993c12ac92ce6a24a409924fe78a5c0fe7246699 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 6a9cc44a92a1fb817d68de3190219626dcf96d2d) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* postfix: upgrade 3.10.5 -> 3.10.6Wang Mingyu2025-12-171-1/+1
| | | | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit cde1da5ec1cc7d5edfab7f65d95dfb9afff09682) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libdaq: upgrade 3.0.22 -> 3.0.23Wang Mingyu2025-12-171-1/+1
| | | | | | | | | | | Changelog: api: add tcp flag in DAQ flow stats Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8c3baf61d0394c8698c935d43bd8267f41392590) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* pgpool2: 4.6.3 -> 4.6.4Liu Yiding2025-12-173-379/+1
| | | | | | | | | | | Drop 0001-snprintf-Add-math.h-to-ensure-isnan-and-isinf-are-de.patch and v1-0001-Make-time-calculations-always-long-long.patch as those were merged upstream. Signed-off-by: Liu Yiding <liuyd.fnst@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 7fb4910ccb6a156bf67eb773ff1b421b30536b58) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* openvpn: upgrade 2.6.15 -> 2.6.16Wang Mingyu2025-12-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Code maintenance / Compat changes --------------------------------- - adapt to new "encrypt-then-mac" cipher suites in OpenSSL 3.6.0 - these need special handling which we don't do, so the t_lpback self-test failed on them. Exclude from list of allowed ciphers, as there is no strong reason today to make OpenVPN use these. - fix various compile-time warnings Documentation updates --------------------- - fix outdated and non-HTTPS URLs throughout the tree (doxygen, warnings, manpage, ...) Bugfixes -------- - Fix memcmp check for the hmac verification in the 3way handshake. This bug renders the HMAC based protection against state exhaustion on receiving spoofed TLS handshake packets in the OpenVPN server inefficient. CVE: 2025-13086 - fix invalid pointer creation in tls_pre_decrypt() - technically this is a memory over-read issue, in practice, the compilers optimize it away so no negative effects could be observed. - Windows: in the interactive service, fix the "undo DNS config" handling. - Windows: in the interactive service, disallow using of "stdin" for the config file, unless the caller is authorized OpenVPN Administrator - Windows: in the interactive service, change all netsh calls to use interface index and not interface name - sidesteps all possible attack avenues with special characters in interface names. - Windows: in the interactive service, improve error handling in some "unlikely to happen" paths. - auth plugin/script handling: properly check for errors in creation on $auth_failed_reason_file (arf). - for incoming TCP connections, close-on-exec option was applied to the wrong socket fd, leaking socket FDs to child processes. - sitnl: set close-on-exec flag on netlink socket - ssl_mbedtls: fix missing perf_pop() call (optional performance profiling) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 351ac662131944f4c40ea8410a0077cc715053a2) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* open-vm-tools: Avoid GLib g_free macro redefinition errorKhem Raj2025-11-212-0/+32
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* vsomeip: upgrade 3.5.10 -> 3.5.11Yi Zhao2025-11-204-15/+99
| | | | | | | | | | | ChangeLog: https://github.com/COVESA/vsomeip/releases/tag/3.5.11 * Refresh local patches * Fix build with boost 1.89 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* python-scapy: Ignore failing ptestsKhem Raj2025-11-203-1/+52
| | | | | | These tests fail in OE qemu environment and is sensitive to ISP provider Signed-off-by: Khem Raj <raj.khem@gmail.com>
* lkcp-tools: Fix test_1_to_1_recvfrom ptest failureKhem Raj2025-11-192-0/+48
| | | | | | | Build it with fortify disabled to get the intended behavior of the test Signed-off-by: Khem Raj <raj.khem@gmail.com>
* python3-scapy: Upgrade to 2.6.1Khem Raj2025-11-191-3/+2
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* openipmi: upgrade 2.0.36 -> 2.0.37Wang Mingyu2025-11-181-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nbdkit: upgrade 1.45.12 -> 1.45.14Wang Mingyu2025-11-181-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* libcpr: upgrade 1.12.0 -> 1.13.0Wang Mingyu2025-11-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== - Implement support for CURLOPT_CAINFO_BLOB - Added support for CURLOPT_SSLCERT_BLOB - Refactor: Pass std::string_view by value instead of by const reference - Add connection pool option (V3) - fix: Calling empty callbacks - fix: callback function pointer type mismatch in writeFunction - 1.12.0 CI Fixes - fix: Cmake config file - fix: make is_same_v check constexpr in set_option_internal - cpr::MultiPerform fixes - #1047 and #1186 - Bump actions/setup-python from 5 to 6 - Bump actions/checkout from 3 to 5 - Allow disabling PSL - Make curl dependency management optional - curl_container: allow calling GetContent without CurlHolder - Bump stefanzweifel/git-auto-commit-action from 6 to 7 - Bump actions/upload-artifact from 4 to 5 - Bump actions/setup-python from 1 to 5 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* corosync: upgrade 3.1.9 -> 3.1.10Wang Mingyu2025-11-182-72/+2
| | | | | | | | CVE-2025-30472.patch removed since it's included in 3.1.10 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* samba: Backport fixes to build with glibc 2.43Khem Raj2025-11-135-0/+902
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* chrony: remove buildtime installation of /var/lib/chronyVishwas Udupa2025-11-131-6/+8
| | | | | | | | | | | | | Since commit 3200122d68 (chrony: create /var/lib/chrony by systemd-tmpfiles) tmpfiles.d mechanism already ensures populating /var/lib/chrony at runtime. Introduce volatiles mechanism to make sure the directory is created at runtime for sysvinit as well. Since /var/lib/chrony is populated at runtime, stop packaging at build time. this helps to align towards stateless system expectations or when updates are done via meta-updater. Signed-off-by: Vishwas Udupa <vudupa@qti.qualcomm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* dhcp-relay: update UPSTREAM_CHECK_REGEXYi Zhao2025-11-131-1/+1
| | | | | | | | | | | | | | | | | Update UPSTREAM_CHECK_REGEX to check the correct latest stable verison. Before the patch: $ devtool latest-version dhcp-relay INFO: Current version: 4.4.3p1 INFO: Latest version: 4.4.3 After the patch: $ devtool latest-version dhcp-relay INFO: Current version: 4.4.3p1 INFO: Latest version: 4.4.3-P1 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* ntp: add UPSTREAM_CHECK_URIYi Zhao2025-11-131-0/+1
| | | | | | | | | | | | | | | | | Add UPSTREAM_CHECK_URI to check the correct latest stable verison. Before the patch: $ devtool latest-version ntp INFO: Current version: 4.2.8p18 INFO: Latest version: After the patch: $ devtool latest-version ntp INFO: Current version: 4.2.8p18 INFO: Latest version: 4.2.8p18 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* libdaq: upgrade 3.0.21 -> 3.0.22Wang Mingyu2025-11-111-1/+1
| | | | | | | | Changelog: api: add drop reason in daq flow stats Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-24 17:54:05 +0000