Commit e8c54ffb3d ("utils/generate-cyclonedx: generate vcs
externalReferences for source repos") added externalReferences to the source
code of packages.
This unfortunately causes issues with packages (in br2-external) fetching
from git using the scp-like syntax, E.G.:
FOO_SITE_METHOD = git
FOO_SITE = git@github.com:<project>/<repo>.git
Which ends up in the SBOM as:
[
{
"type": "vcs",
"url": "git@github.com:<project>/<repo>.git",
"comment": "git repository"
}
]
This (correctly) causes Dependency track to reject the SBOM import with:
{
"status": 400,
"title": "The uploaded BOM is invalid",
"detail": "Schema validation failed",
"errors": [
"$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
"$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
"$.components[2].externalReferences[0].url: does not match the regex pattern ^urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*$",
]
}
The CycloneDX spec indeed requires a URI:
The URI (URL or URN) to the external reference. External references are
URIs and therefore can accept any URL scheme including https (RFC-7230),
mailto (RFC-2368), tel (RFC-3966), and dns (RFC-4501)
https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_externalReferences_items_url
The user@host:project/repo.git is a git-specific shorthand for a git-over-ssh URL. From man git-clone:
Git supports ssh, git, http, and https protocols (in addition, ftp and ftps
can be used for fetching, but this is inefficient and deprecated; do not use
them).
The native transport (i.e. git:// URL) does no authentication and should
be used with caution on unsecured networks.
The following syntaxes may be used with them:
• ssh://[user@]host.xz[:port]/path/to/repo.git/
• git://host.xz[:port]/path/to/repo.git/
• http[s]://host.xz[:port]/path/to/repo.git/
• ftp[s]://host.xz[:port]/path/to/repo.git/
An alternative scp-like syntax may also be used with the ssh protocol:
• [user@]host.xz:path/to/repo.git/
So convert the scp-like syntax to ssh:// URLs in parse_uris() for spec
compliance.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ebcfdb8b0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
There are a number of runtime tests that checks that a command fails as
expected, so add an assertRunNotOk() similar to the existing assertRunOk()
to handle that instead of open coding it everywhere.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 03783de150)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Security fixes:
CVE-2026-53613 - mount(8) TOCTOU race on target path.
The SUID mount does not pin the mount target directory, allowing a
race between path resolution and the actual mount syscall. A local
attacker can swap an ancestor directory component between these
steps to redirect a mount to an arbitrary location.
Reported-by: Xinyao Hu
CVE-2026-53612 - mount(8) TOCTOU race on post-mount owner/mode change.
The X-mount.owner, X-mount.group, and X-mount.mode options use
path-based lchown()/chmod() after mounting. An attacker can swap
the target between mount and the ownership/mode change to gain
control of arbitrary files.
Reported-by: Xinyao Hu
CVE-2026-53614 - mount(8) SUID bypass via LIBMOUNT_FORCE_MOUNT2.
The environment variable LIBMOUNT_FORCE_MOUNT2 is not filtered
via safe_getenv() in SUID context. A local attacker can force
the legacy mount(2) code path, which uses a two-step bind+remount
or propagation sequence with a window where security flags (nosuid,
noexec, ...) are not yet applied.
Reported-by: Xinyao Hu
Full release notes: https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.5-ReleaseNotes
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 40ce6355c9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
* Explicitly set shell type. Shellcheck doesn't know OpenRC, but the
script as such is POSIX shell.
* Override warnings not applicable in context.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 3e2cc4e46f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
With the action function as the last command in the script its return
code automatically becomes that of the script, and without explicit
exit shellcheck does not complain about unused functions.
Also wait for the process to stop in "stop", and simplify restart.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit b4884a2937)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
If sending the stop signal failed for whatever reason, waiting for an
existing PID file to disappear is likely to block indefinitely.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit b2d84525f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The exit status of the last command automatically becomes the exit
status of the script. And if there is no explicit exit shellcheck
accepts unused functions (here: start/stop/... called via variable).
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 118ffb20b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Upstream commit
a00a3cce3c
added the code of gli & glm in-tree and removed the usage as external
packages.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8bcb156d33)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes build error not caught by the autobuilders with this defconfig:
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_FORCE_HOST_BUILD=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_KODI_SCREENSAVER_RSXS=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y
BR2_PACKAGE_LIBUDEV_ZERO=y
Raised minimum version for all addons as requested by upstream.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 09fcae1588)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Our docker image was finally updated to Debian 12 and now provide Qemu
7.2.15 [1]. We can safely revert this workaround for older Qemu version.
[1] e5bbe020ca
This reverts commit 37e23e0dd7.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4834f18c69)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The NVD database schema has the following entry
```
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.2.8",
},
```
Which make every patch revision of the package ntp match to the
CVE-2015-7977.
This commit ignore this entry.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 00e4a03348)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See the release notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.6/
This fixes the following vulnerabilities:
- CVE-2026-6873 : Signed cookie salt namespace collision
- CVE-2026-7666 : Potential unencrypted email transmission via STARTTLS
in the SMTP backend
- CVE-2026-8404 : Potential exposure of private data via case-sensitive
Cache-Control directives
- CVE-2026-35193: Potential exposure of private data via missing
Vary: Authorization
- CVE-2026-48587: Potential exposure of private data via whitespace padding
in Vary header
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 00b9069f46)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following security issues:
Fixed heap use-after-free in PKCS7_verify().
(CVE-2026-45447)
Fixed CMS AuthEnvelopedData processing may accept forged messages.
(CVE-2026-34182)
Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler.
(CVE-2026-34183)
Fixed double-free when checking OCSP stapled response.
(CVE-2026-35188)
Fixed NULL pointer dereference in QUIC server initial packet handling.
(CVE-2026-42764)
Fixed AES-OCB IV ignored on EVP_Cipher() path.
(CVE-2026-45445)
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion.
(CVE-2026-7383)
Fixed out-of-bounds read in CMS password-based decryption.
(CVE-2026-9076)
Fixed heap buffer over-read in ASN.1 content parsing.
(CVE-2026-34180)
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys.
(CVE-2026-34181)
Fixed NULL dereference in certificate verification with OCSP Checking.
(CVE-2026-42765)
Fixed possible NULL dereference in password-dased CMS decryption.
(CVE-2026-42766)
Fixed NULL pointer dereference in CRMF EncryptedValue decryption.
(CVE-2026-42767)
Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()
and PKCS7_decrypt().
(CVE-2026-42768)
Fixed trust anchor substitution via cert/issuer typo in CMP
rootCaKeyUpdate.
(CVE-2026-42769)
Fixed FFC-DH peer validation uses attacker-supplied q.
(CVE-2026-42770)
Fixed incorrect tag processing for empty messages in AES-GCM-SIV
and AES-SIV modes.
(CVE-2026-45446)
For more details, see the release notes and advisory:
https://github.com/openssl/openssl/releases/tag/openssl-3.6.3https://openssl-library.org/news/secadv/20260609.txt
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b0ea6e310f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following security issues:
*) SECURITY: CVE-2026-49975: mod_http2 denial of service
(cve.mitre.org)
Memory Allocation with Excessive Size Value vulnerability in
Apache HTTP Server's mod_http leads to denial of service via
malicious HTTP requests.
This issue affects Apache HTTP Server: from 2.4.17 through
2.4.67.
Credits: Quang Luong of Calif.IO in collaboration with OpenAI
Codex
*) SECURITY: CVE-2026-48913: mod_http2 memory corruption when file
handles exhausted (cve.mitre.org)
Use After Free vulnerability in Apache HTTP Server module
mod_http2 when file handles are already exhausted.
This issue affects Apache HTTP Server: from 2.4.55 through
2.4.67.
Credits: Sam Lovejoy, IBM X-Force Offensive Research (XOR)
*) SECURITY: CVE-2026-44631: Heap Underflow in `ap_regname` via
Signed Char Overflow (cve.mitre.org)
Buffer Underwrite vulnerability in Apache HTTP Server on crafted
regular expressions in the configuration.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44186: Loop in `proxy_ftp_handler` in
mod_proxy_ftp (cve.mitre.org)
Loop with Unreachable Exit Condition ('Infinite Loop')
vulnerability in the mod_proxy_ftp module in Apache HTTP Server
with an attacker controlled backend FTP server.
This issue affects undefined: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP
`send_request` (cve.mitre.org)
Buffer Over-read vulnerability in Apache HTTP Server via
outbound OCSP requests to an attacker controlled OCSP server
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44119: escalation of privilege through
expressions in .htaccess in multiple modules (cve.mitre.org)
Improper Privilege Management vulnerability in Apache HTTP
Server 2.4.67 and earlier allows local .htaccess authors to read
files with the privileges of the httpd user.
This issue affects Apache HTTP Server: from through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Lucian Nitescu
*) SECURITY: CVE-2026-43951: OOB Read in `merge_response_headers`
can cause crash (cve.mitre.org)
Out-of-bounds Read vulnerability in Apache HTTP Server with
mod_headers and mod_mime and multiple response languages.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-42536: mod_xml2enc heap overflow
(cve.mitre.org)
Heap-based Buffer Overflow vulnerability in Apache HTTP Server
with mod_xml2enc, xml2StartParse, and untrusted content
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-42535: mod_dav_fs protected directory access
(cve.mitre.org)
A path handling issue in mod_dav_fs in Apache 2.4.67 and
earlier allows a WebDAV content author to directly manipulate
trusted DAV property databases, potentially causing child
process crashes.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-34356: ProxyPassReverseCookieMap buffer
overflow (cve.mitre.org)
Heap-based Buffer Overflow vulnerability in Apache HTTP Server
with malicious backend servers and ProxyPassReverseCookie*
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Arkadi Vainbrand
*) SECURITY: CVE-2026-34355: mod_proxy_html buffer overflow
(cve.mitre.org)
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67
and earlier allows an attack by an untrusted backend.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Elhanan Haenel
*) SECURITY: CVE-2026-29170: mod_proxy_ftp XSS (cve.mitre.org)
A cross-site scripting vulnerability exists in mod_proxy_ftp's
HTML directory list generation in Apache HTTP Server 2.4.67 and
earlier when listing FTP directory contents either via forward
or reverse proxy configuration.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Pavel Kohout, Aisle Research, Aisle.com
*) SECURITY: CVE-2026-29167: mod_ldap per-dir use-after-free
(cve.mitre.org)
Use After Free vulnerability in Apache HTTP Server with mod_ldap
in per-directory configuration
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Pavel Kohout, Aisle Research, Aisle.com
For more details, see the CHANGES file:
https://downloads.apache.org/httpd/CHANGES_2.4.68
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 07a690f00b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
