https://github.com/openssl/openssl/releases/tag/openssl-3.6.5
This release incorporates the following bug fixes and mitigations:
Fixed DTLS retransmissions of handshake messages from a stale buffer offset.
(CVE-2026-84782)
Fixed excessive memory allocation in relative CRLDP processing.
(CVE-2026-35189)
Fixed QUIC unvalidated amplification credit may be over-accounted.
(CVE-2026-35191)
Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC.
(CVE-2026-42772)
Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves.
(CVE-2026-54872)
Fixed QUIC STREAM fragment metadata DoS.
(CVE-2026-54873)
Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V.
(CVE-2026-54875)
Fixed out-of-bounds access after SSL_set_SSL_CTX() during a handshake.
(CVE-2026-72897)
Fixed QUIC connection-level flow control was not enforced for streams.
(CVE-2026-75804)
Fixed a NULL pointer dereference in CMP client revocation response handling.
(CVE-2026-75805)
Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS.
(CVE-2026-75806)
Fixed a timing side-channel in SM2 signature generation.
(CVE-2026-77696)
Fixed an unbounded RETIRE_CONNECTION_ID backlog in QUIC stack
implementation.
(CVE-2026-84784)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 97a94e01ef)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
util-linux-libs was introduced as an intermediate package to help break
circular dependencies with util-linux, and therefor only exists to provide
more basic versions of the libraries util-linux provide, to break these
dependency chains.
There is no need to install these to target as they will never be used
there.
Under all circumstances the libraries are built and installed by the main
util-linux package.
This only solves the confict for target, the conflict will remain for
staging as that conflict is much harder to solve.
Cc: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: John Ernberg <j@j-ernberg.se>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 8b57f2f421)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since version 4.4.0 of wireshark, support for Lua 5.3 and 5.4 has been
added, and support for Lua 5.1 and 5.2 has been removed. See
https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html
This fixes an infinite loop during the build, as for some reason when
Lua 5.1 is available, the CMake check for Lua 5.3 or 5.4 loops
indefinitely, with cmake taking up 100% of one CPU core.
Fixes: 49fa20e667 ("package/wireshark: bump to latest upstream stable v4.4.9")
Signed-off-by: Francois Perrad <francois.perrad.86@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c4c6ad81bf)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Patch was committed upstream in a slightly different version
0984041283
and was first released in version 3.0 which was added to buildroot with
commit 3c66f65a6a.
Added Upstream: tag to patch 0001.
Renumbered patch 0003 and updated Upstream: tag.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7dab0537a0)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit 7f48325de6 bumped the
asterisk package from 22.9.0 to 22.10.1.
This bump includes upstream commit
5d543ad80c
which bumped the bundled pjsip package to 2.17.
To allow offline builds we download the pjsip tarball so we need to keep
the version numbers in sync.
The autobuilders logs show a download process:
https://autobuild.buildroot.net/results/400/400e53158f11926446c11d22681eb8a9430caf1d/build-end.log
checking for embedded pjproject (may have to download)... configuring
[pjproject] Downloading https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.17/pjproject-2.17.tar.bz2 to
/home/autobuild/autobuild/instance-3/dl/asterisk/pjproject-2.17.tar.bz2
[pjproject] Verifying /home/autobuild/autobuild/instance-3/dl/asterisk/pjproject-2.17.tar.bz2
where the tarball was once stored in the configured download directory:
--with-download-cache=$(ASTERISK_DL_DIR)
to be used during later autobuilder runs.
Fixes: 7f48325de6 ("package/asterisk: security bump to 22.10.1")
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Thomas: add comment in .mk file]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 96a2337bd4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Fixes: CVE-2026-18321:
https://nvd.nist.gov/vuln/detail/cve-2026-18321
- bump version to 1.2.5 (for details see [1])
- rebased 0001-wscript-remove-checks-for-bsd-string.h-fixes-host-co.patch
- rebased 0002-disable-PIE-support.patch
- removed 0003-ntpd-refclock_gpsd.c-Add-missing-time.h-for-strptim.patch
(from upstream [2])
- moved 0004-refclock_gpsd-add-build-fix-for-gcc-14.x.patch to
0003-refclock_gpsd-add-build-fix-for-gcc-14.x.patch, rebased and enhanced
as the original conflicts with upstream commit 5505260c ("Fix redefined
_XOPEN_SOURCE warning in refclock_gpsd.c") [3] and leads to the following
compile failure:
../../ntpd/refclock_gpsd.c:113:21: error: operator ‘<’ has no left operand
113 | #if _XOPEN_SOURCE < 700
| ^
[1] https://lists.ntpsec.org/pipermail/devel/2026-July/011029.html
[2] 5137c155d8
[3] 5505260cd1
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[Julien: mark commit as "security bump"]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1caeb632a6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit [1] (package/mrouted: fix invalid daemon path in
S41mrouted) removed script execution permission but forgot to remove
the corresponding .checkpackage entry.
check-package is reporting the error:
package/mrouted/S41mrouted:0: NotExecutable was expected to fail, did you fix the file and forget to update /builds/buildroot.org/buildroot/.checkpackageignore?
This commit fixes the issue by removing the entry.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16661195972
[1] d8f408b1f1
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e2b81003a4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
S41mrouted hard-coded /sbin/mrouted, but mrouted has always installed
to /usr/sbin/mrouted. This went unnoticed with BR2_ROOTFS_MERGED_USR=y,
but the daemon fails to start without it.
Also drop the script's executable bit to match other sysv init
scripts that do not set it.
Introduced in c25115daf2
(package/mrouted: add sysv init script).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d8f408b1f1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
stunnel's configure unconditionally probes -fstack-clash-protection
using AX_APPEND_COMPILE_FLAGS. The probe compiles a trivial conftest.c,
which succeeds, so the flag ends up in CFLAGS. However, on ARM Thumb-1
gcc implements stack clash protection through -fstack-check=specific,
which it refuses for any real function body, so every source file fails
to build:
stunnel.c:1003:1: sorry, unimplemented: '-fstack-check=specific' for Thumb-1
Force the corresponding autoconf cache variable to "no" on Thumb-1, in
the same way cmocka already works around this gcc limitation, and
consistently with the existing -fstack-protector-strong override.
Fixes:
https://autobuild.buildroot.org/results/3d691184ba83ba4d881632f2b2bb4da5aa50f491/
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 15ccf339c9)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Remove -Werror from CFLAGS to prevent build errors due to warnings of
deprecated functions:
futility/cmd_create.c: In function ‘vb1_make_keypair’:
futility/cmd_create.c:96:9: error: ‘PEM_read_RSAPrivateKey’ is deprecated:
Since OpenSSL 3.0 [-Werror=deprecated-declarations]
96 | rsa_key = PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL);
futility/cmd_create.c:155:9: error: ‘RSA_free’ is deprecated:
Since OpenSSL 3.0 [-Werror=deprecated-declarations]
155 | RSA_free(rsa_key);
futility/cmd_create.c:191:17: error: ‘PEM_read_RSA_PUBKEY’ is deprecated:
Since OpenSSL 3.0 [-Werror=deprecated-declarations]
191 | rsa_key = PEM_read_RSA_PUBKEY(fp, NULL, NULL, NULL);
futility/cmd_create.c:199:9: error: ‘RSA_get0_key’ is deprecated:
Since OpenSSL 3.0 [-Werror=deprecated-declarations]
199 | RSA_get0_key(rsa_key, NULL, NULL, &rsa_d);
cc1: all warnings being treated as errors
The oldest build error dates back to 2024 so a backport to LTS branches
should be considered.
Fixes:
https://autobuild.buildroot.net/results/375/37554c5ce784835a36f0068d9a0c1cd931212b44/https://autobuild.buildroot.net/results/1fa/1fabca11c7839d2d7ed809f30482595719a29c92/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4463009364)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Boost.DateTime is header-only since 1.77.0
The Boost Release Notes[0] didn't mention it but it was introduced in
the documentation of DateTime in this commit: [1]
This was bumped in buildroot in d39d8f7cee
So analog to the "header-only" move of Boost.System we have now to
gradually phase out the dependencies on this library. Ideally before
the stub is removed as it now happened for Boost.System in 1.89.0.
[0] https://www.boost.org/releases/1.77.0/
[1] 33dc6136f1
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a235a33cfe)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
pkg-stats columns are sorted either alphabetically or numerically. This
does not make much sense for the "Latest version" column.
This commit orders the column by whether the package is up-to-date or
not.
Signed-off-by: Franciszek Stachura <fbstachura@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 95b1e8676c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Add basic tests for openscap, ensuring that it builds and runs a minimal
command with different cryptographic backends:
- libgcrypt
- libnss
- no crypto backend
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a304c7bf12)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
When enabling the openscap package and the libnss library _but not_
libgcrypt, the build can fail on the following error:
../src/libopenscap.so.33.1.3: undefined reference to `crapi_init'
The issue is due to the fact that the corresponding Makefile
systematically forces -DWITH_CRYPTO=gcrypt: openscap CMake
instrumentation then searches only this backend, fails to find it,
assumes that no crypto backend is available, and so does not include the
crapi_object in the final link step.
Commit 7c85f3adf4 ("package/openscap: new package") took into account
the fact that openscap isn't currently able to build if no crypto backend
is provided (see [0]), and so made sure to force libgcrypt inclusion if
libnss is not included. Since then, two fixes ([1] and [2]) have been
integrated upstream to allow building openscap with any backend.
Do not systematically enforce libgcrypt anymore through WITH_CRYPTO:
rather than testing nss presence, and falling back to libgcrypt, allow
both to be absent, and so relax the libgcrypt dependency to make it
optional as well. Bring the two upstream patches allowing openscap build
without any crypto backend. Those patches can be dropped once openscap
v1.4.5 is released.
[0] https://github.com/OpenSCAP/openscap/issues/2310
[1] d12d820a94
[2] 5b858d1786
Fixes: https://autobuild.buildroot.org/results/4c905c1b0ee384149c3d85e8f2ebf0af3a12c2ad/
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c24ae7f2f1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The comment about the toolchain requirements to have Python support in
gnuradio is always displayed, even if architecture requirements are
not met and if Python is not enabled. For the latter: the option
BR2_PACKAGE_GNURADIO_PYTHON also depends on python, so it makes sense
for the Config.in comment to also depend on it.
Fixes: 7a546b87d5 ("package/python-numpy: add reverse dependency on packages using python-numpy")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fbb9739dd8)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_GNURADIO_PYTHON selects BR2_PACKAGE_PYTHON_NUMPY, so it
should inherit its dependencies, but BR2_TOOLCHAIN_GCC_AT_LEAST_9 was
forgotten in commit 8b3993178d, when
python-numpy got this gcc >= 9 dependency added.
Note that the existing BR2_HOST_GCC_AT_LEAST_9 dependency is correct:
it is there because gnuradio needs host-python-numpy at build time.
Fixes: 8b3993178d ("package/python-numpy: needs gcc >= 9")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c6986e6d2e)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This commit fixes 3 issues in the Config.in comment:
- It is displayed even on unsupported CPU architectures, so we add a
"depends on BR2_PACKAGE_TENSORFLOW_LITE_ARCH_SUPPORTS"
- It doesn't mention the need for a glibc toolchain even though that's
part of the dependencies
- The requirement for dynamic lib support should be part of the same
comment as the other dependencies
Fixes: fd29fee3a3 ("package/tensorflow-lite: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 101d543e38)
[raphael: resolve conflicts]
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_TENSORFLOW_LITE selects BR2_PACKAGE_LIBABSEIL_CPP without
propagating its depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS,
which this commit fixes.
Note that this doesn't create any functional change: tensorflow-lite
is anyway limited to ARM, ARM64, x86 32-bit and x86 64-bit, all of
which are supported by libabseil-cpp.
Fixes: fd29fee3a3 ("package/tensorflow-lite: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f5a2b35531)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_RPI_RGB_LED_MATRIX_VIDEO_VIEWER selects
BR2_PACKAGE_FFMPEG, but without propagating its depends on, and most
notably BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS.
Fixes: e821078031 ("package/rpi-rgb-led-matrix: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0fbbe6b681)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
libgtk3 selects at-spi2-core, so it should inherit its
!BR2_STATIC_LIBS, which this commit does.
This has been an issue since libgtk3 started using at-spi2-core
instead of atk in commit 2c3ca7bea1.
Fixes: 2c3ca7bea1 ("package/atk: remove package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 93282f76a5)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
