linux/poky.git/meta/recipes-connectivity, branch yocto-5.0.14

wpa-supplicant: patch CVE-2025-24912

2025-11-07T14:54:40+00:00

Pick patches as listed in NVD CVE report. Note that Debian lists one of the patches as introducing the vulnerability. This is against what the original report [1] says. Also the commit messages provide hints that the first patch fixes this issue and second is fixing problem with the first patch. [1] https://jvn.jp/en/jp/JVN19358384/ (From OE-Core rev: a157719ab349d9393d5a640bb2e45fc2489d5338) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

bind: upgrade 9.18.33 -> 9.18.41

2025-11-03T15:17:02+00:00

This upgrade fixes CVE-2025-8677,CVE-2025-40778 and CVE-2025-40780. Changelog ========== https://downloads.isc.org/isc/bind9/9.18.41/doc/arm/html/changelog.html (From OE-Core rev: 4cb834388759540ea5bf7265389b9f1b2e15333a) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

openssh: fix CVE-2025-61984

2025-10-24T13:23:40+00:00

ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. Note: openssh does not support variable expansion until 10.0, so backport adapts for this. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-61984 Upstream patch: https://github.com/openssh/openssh-portable/commit/35d5917652106aede47621bb3f64044604164043 (From OE-Core rev: 717d4c7609cdce2cc3a65b7ba69c316fa86a9333) Signed-off-by: David Nyström Signed-off-by: Steve Sakoman

openssh: fix CVE-2025-61985

2025-10-24T13:23:40+00:00

ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-61985 Upstream patch: https://github.com/openssh/openssh-portable/commit/43b3bff47bb029f2299bacb6a36057981b39fdb0 (From OE-Core rev: 52d925423b826383d12a97b834475ab5699fd492) Signed-off-by: David Nyström Signed-off-by: Steve Sakoman

openssl: upgrade 3.2.4 -> 3.2.6

2025-10-13T19:42:58+00:00

3.2.6 has fixed 3.2.5 regression which broke python3 ptests so we can upgrade now. We can also drop CVE-2025-27587 patch which was taken instead of 3.2.5 upgrade under: https://github.com/openssl/openssl/pull/28198 Release information: https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3017-and-openssl-3018-30-sep-2025 OpenSSL 3.2.6 is a security patch release. The most severe CVE fixed in this release is Moderate. This release incorporates the following bug fixes and mitigations: * Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230) * Fix Timing side-channel in SM2 algorithm on 64 bit ARM. (CVE-2025-9231) * Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232) Release information: https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-324-and-openssl-325-1-jul-2025 OpenSSL 3.2.5 is a bug fix release. This release incorporates the following bug fixes and mitigations: * Miscellaneous minor bug fixes. (From OE-Core rev: ef6bbf39c10ff7bd8ad36d5d2f59ddd0756e0141) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

buildtools-tarball: fix unbound variable issues under 'set -u'

2025-09-22T20:17:52+00:00

When Bash runs with 'set -u' (nounset), accessing an unset variable directly (e.g. [ -z "$SSL_CERT_FILE" ]) causes a fatal "unbound variable" error. As a result, the fallback logic to set SSL_CERT_FILE/SSL_CERT_DIR is never triggered and the script aborts. The current code assumes these variables may be unset or empty, but does not guard against 'set -u'. This breaks builds in stricter shell environments or when users explicitly enable 'set -u'. Fix this by using parameter expansion with a default value, e.g. "${SSL_CERT_FILE:-}", so that unset variables are treated as empty strings. This preserves the intended logic (respect host env first, then CAFILE/CAPATH, then buildtools defaults) and makes the script robust under 'set -u'. (From OE-Core rev: 4cf131ebd157b79226533b5a5074691dd0e1a4ab) Signed-off-by: Haixiao Yan Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 4d880c2eccd534133a2a4e6579d955605c0956ec) Signed-off-by: Steve Sakoman

wpa-supplicant: fix CVE-2022-37660

2025-09-22T20:17:52+00:00

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association. CVE-2022-37660-0001, CVE-2022-37660-0002, CVE-2022-37660-0003 and CVE-2022-37660-0004 are dependent commits while CVE-2022-37660-0005 is actual CVE fix. Reference: https://security-tracker.debian.org/tracker/CVE-2022-37660 Upstream-patches: https://git.w1.fi/cgit/hostap/commit/?id=9d3f347a2b14652e767d51142600206a32676b62 https://git.w1.fi/cgit/hostap/commit/?id=80213629981a21825e4688fde1b590e4c4d4bcea https://git.w1.fi/cgit/hostap/commit/?id=bdcccbc2755dd1a75731496782e02b5435fb9534 https://git.w1.fi/cgit/hostap/commit/?id=d7be749335f2585658cf98c4f0e7d6cd5ac06865 https://git.w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4 (From OE-Core rev: 91848ac13ec18f98469f7f8ed68c6153fea31607) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

avahi: fix CVE-2024-52615

2025-08-20T14:37:19+00:00

CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52615] [https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g] Upstream patches: [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942] (From OE-Core rev: ec22ec26b3f40ed5e0d84d60c29d8c315cf72e23) Signed-off-by: Zhang Peng Signed-off-by: Steve Sakoman

openssl: patch CVE-2025-27587

2025-07-29T14:59:52+00:00

Pick commits for Minerva fix between 3.2.4 and 3.2.5 release. Update to 3.2.5 is blocked due to problem with python ptest errors, so use patch instead of upgrade for now. (From OE-Core rev: 57c04a32997c1b045121aff045f3ffaa7bb0b5f5) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

openssl: CVE-2024-41996

2025-07-29T14:59:52+00:00

As discussed in [1], this commit fixes CVE-2024-41996. Although openssl project does not consider this a vulnerability, it got CVE number assigned so it deserves attention. [1] https://github.com/openssl/openssl/pull/25088 (From OE-Core rev: cb49b9e49b4561ccea4c231cac591af557b9749c) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman