Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=kirkstone 2026-04-10T10:53:18+00:00 2026-04-10T10:53:18+00:00 Vijay Anusuri vanusuri@mvista.com 2026-03-25T07:24:54+00:00 urn:sha1:80f07f41878e7b68e08f9bb6d20fe4193a1775e4 Pick patch mentioned in NVD [1] https://nvd.nist.gov/vuln/detail/CVE-2026-27459 [2] https://ubuntu.com/security/CVE-2026-27459 (From OE-Core rev: b46b806b2ef773d7061923e7bab9184fb758a6b4) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> 2026-04-10T10:53:18+00:00 Vijay Anusuri vanusuri@mvista.com 2026-03-25T07:24:53+00:00 urn:sha1:631b2c9ded69c37ac7c3b7e824ee58c6afafcb64 Pick patch mentioned in NVD [1] https://nvd.nist.gov/vuln/detail/CVE-2026-27448 [2] https://ubuntu.com/security/CVE-2026-27448 (From OE-Core rev: c95d2068281fd88427a2e0a996d69c3898473e63) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> 2026-04-10T10:53:18+00:00 Vijay Anusuri vanusuri@mvista.com 2026-04-06T13:46:27+00:00 urn:sha1:3c9199cfd854ac7c375beed30466aeabacad32bc Drop upstreamed patches. Release information: * https://www.python.org/downloads/release/python-31020/ * The release you're looking at is Python 3.10.20, a security bugfix release for the legacy 3.10 series. Handles CVE-2024-6923 CVE-2025-6075 CVE-2025-12084 CVE-2025-13836 CVE-2025-13837 CVE-2025-15282 CVE-2025-59375 CVE-2026-0865 CVE-2026-24515 CVE-2026-25210 (From OE-Core rev: 51e1581d337b674272c1a71dfc366387577bc5df) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> [YC: rebased on top of kirkstone] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> 2026-03-20T09:55:33+00:00 Vijay Anusuri vanusuri@mvista.com 2026-03-11T11:01:01+00:00 urn:sha1:b0c2d6dfec39564100120dbb9e0eeab1d99a81ba Pick patch according to [1] [1] https://security-tracker.debian.org/tracker/CVE-2026-1703 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-1703 [3] https://github.com/pypa/pip/pull/13777 (From OE-Core rev: 0535436a9ceedcf690001cd705be753de4e4915f) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> 2026-02-27T15:54:01+00:00 Peter Marko peter.marko@siemens.com 2026-01-25T23:56:27+00:00 urn:sha1:e7b549ecaa945a5b9f755316b80d515312d0bf2b Pick patch for this CVE merged into 3.10 branch. (From OE-Core rev: 8888cd14eb102574d530b6c683ce5beaad1aaa39) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> 2026-02-27T15:54:01+00:00 Peter Marko peter.marko@siemens.com 2026-01-18T21:17:56+00:00 urn:sha1:4ad238e9c1bda40c67f86dbeb24483d7deef9ae1 Pick patch from 3.12 branch per NVD report. (From OE-Core rev: cfbac1d5edae4b0204ec4c01b5f710d100ceb2ad) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> 2026-01-26T09:49:25+00:00 Hitendra Prajapati hprajapati@mvista.com 2026-01-07T05:47:40+00:00 urn:sha1:cfb6825c353084ae183a29214aad755ed6e0e5a3 Upstream-Status: Backport from https://github.com/python/cpython/commit/289f29b0fe38baf2d7cb5854f4bb573cc34a6a15 (From OE-Core rev: d3bcb5ded27003612ad591764f648e83e91c27ca) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2026-01-26T09:49:25+00:00 Peter Marko peter.marko@siemens.com 2026-01-20T13:52:43+00:00 urn:sha1:4c8419bebefe1b686166ab08d891cdc4d29257d5 Pick patch per [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-66418 (From OE-Core rev: 469fcdd5f07635fa9e308c968126807c1ca09647) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2025-12-01T14:50:49+00:00 Praveen Kumar praveen.kumar@windriver.com 2025-11-21T11:26:42+00:00 urn:sha1:c6234dce6342e9ba582f643e53ac348b5cdb0dab If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-6075 Upstream-patch: https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca (From OE-Core rev: 9a7f33d85355ffbe382aa175c04c64541e77b441) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-12-01T14:50:49+00:00 Vijay Anusuri vanusuri@mvista.com 2025-11-20T09:07:59+00:00 urn:sha1:cdc78fd36f440024c36f92c0170961c96f6d096b import patch from debian to fix CVE-2024-3651 Upstream-Status: Backport [import from debian 3.3-1+deb12u1 Upstream commit https://github.com/kjd/idna/commit/5beb28b9dd77912c0dd656d8b0fdba3eb80222e7] (From OE-Core rev: 7359d3cdf2210e81a26d8712769f7e23bfbc1bb7) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>