summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-networking/recipes-protocols/frr/frr/CVE-2024-55553.patch304
-rw-r--r--meta-networking/recipes-protocols/frr/frr_8.2.2.bb1
-rw-r--r--meta-networking/recipes-protocols/net-snmp/net-snmp/0001-unload_all_mibs-fix-memory-leak-by-freeing-tclist.patch32
-rw-r--r--meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb1
-rw-r--r--meta-oe/recipes-support/poppler/poppler/CVE-2025-32364.patch28
-rw-r--r--meta-oe/recipes-support/poppler/poppler/CVE-2025-32365.patch41
-rw-r--r--meta-oe/recipes-support/poppler/poppler/CVE-2025-43903.patch54
-rw-r--r--meta-oe/recipes-support/poppler/poppler_22.04.0.bb3
-rw-r--r--meta-python/recipes-devtools/python/python3-twisted/CVE-2024-41671-0001.patch33
-rw-r--r--meta-python/recipes-devtools/python/python3-twisted/CVE-2024-41671-0002.patch196
-rw-r--r--meta-python/recipes-devtools/python/python3-twisted_22.2.0.bb3
11 files changed, 696 insertions, 0 deletions
diff --git a/meta-networking/recipes-protocols/frr/frr/CVE-2024-55553.patch b/meta-networking/recipes-protocols/frr/frr/CVE-2024-55553.patch
new file mode 100644
index 0000000000..1183b1e58b
--- /dev/null
+++ b/meta-networking/recipes-protocols/frr/frr/CVE-2024-55553.patch
@@ -0,0 +1,304 @@
1From fc6837ad68e9724d7c15db6cb01bf9bb5beea8e5 Mon Sep 17 00:00:00 2001
2From: Donatas Abraitis <donatas@opensourcerouting.org>
3Date: Tue, 21 Jan 2025 16:07:10 +0200
4Subject: [PATCH] bgpd: Validate only affected RPKI prefixes instead of a full
5 RIB
6
7This is backport of https://github.com/FRRouting/frr/commit/b0800bfdf04b4fcf48504737ebfe4ba7f05268d3 for 8.4.
8
9Signed-off-by: Donatas Abraitis <donatas@opensourcerouting.org>
10
11CVE: CVE-2024-55553
12Upstream-Status: Backport [https://github.com/opensourcerouting/frr/commit/cc1c66a7e8dd31c681f396f6635192c0d60a543c]
13
14The original patch is adjusted to fit for the current version.(8.2.2)
15
16Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
17---
18 bgpd/bgp_rpki.c | 184 +++++++++++++++++++++---------------------------
19 bgpd/bgpd.c | 4 ++
20 bgpd/bgpd.h | 1 +
21 3 files changed, 87 insertions(+), 102 deletions(-)
22
23diff --git a/bgpd/bgp_rpki.c b/bgpd/bgp_rpki.c
24index 0a51269d9b..69c5f44fac 100644
25--- a/bgpd/bgp_rpki.c
26+++ b/bgpd/bgp_rpki.c
27@@ -67,6 +67,12 @@ static struct thread *t_rpki;
28
29 DEFINE_MTYPE_STATIC(BGPD, BGP_RPKI_CACHE, "BGP RPKI Cache server");
30 DEFINE_MTYPE_STATIC(BGPD, BGP_RPKI_CACHE_GROUP, "BGP RPKI Cache server group");
31+
32+DEFINE_MTYPE_STATIC(BGPD, BGP_RPKI_REVALIDATE, "BGP RPKI Revalidation");
33+
34+#define RPKI_VALID 1
35+#define RPKI_NOTFOUND 2
36+#define RPKI_INVALID 3
37
38 #define POLLING_PERIOD_DEFAULT 3600
39 #define EXPIRE_INTERVAL_DEFAULT 7200
40@@ -129,7 +135,6 @@ static enum route_map_cmd_result_t route_match(void *rule,
41 void *object);
42 static void *route_match_compile(const char *arg);
43 static void revalidate_bgp_node(struct bgp_dest *dest, afi_t afi, safi_t safi);
44-static void revalidate_all_routes(void);
45
46 static struct rtr_mgr_config *rtr_config;
47 static struct list *cache_list;
48@@ -339,10 +344,9 @@ inline int is_running(void)
49 return rtr_is_running;
50 }
51
52-static struct prefix *pfx_record_to_prefix(struct pfx_record *record)
53+static void pfx_record_to_prefix(struct pfx_record *record,
54+ struct prefix *prefix)
55 {
56- struct prefix *prefix = prefix_new();
57-
58 prefix->prefixlen = record->min_len;
59
60 if (record->prefix.ver == LRTR_IPV4) {
61@@ -353,75 +357,102 @@ static struct prefix *pfx_record_to_prefix(struct pfx_record *record)
62 ipv6_addr_to_network_byte_order(record->prefix.u.addr6.addr,
63 prefix->u.prefix6.s6_addr32);
64 }
65-
66- return prefix;
67 }
68
69-static int bgpd_sync_callback(struct thread *thread)
70-{
71+struct rpki_revalidate_prefix {
72 struct bgp *bgp;
73- struct listnode *node;
74- struct prefix *prefix;
75- struct pfx_record rec;
76- int retval;
77- int socket = THREAD_FD(thread);
78+ struct prefix prefix;
79+ afi_t afi;
80+ safi_t safi;
81+};
82
83- thread_add_read(bm->master, bgpd_sync_callback, NULL, socket, &t_rpki);
84+static void rpki_revalidate_prefix(struct thread *thread)
85+{
86+ struct rpki_revalidate_prefix *rrp = THREAD_ARG(thread);
87+ struct bgp_dest *match, *node;
88
89- if (atomic_load_explicit(&rtr_update_overflow, memory_order_seq_cst)) {
90- while (read(socket, &rec, sizeof(struct pfx_record)) != -1)
91- ;
92+ match = bgp_table_subtree_lookup(rrp->bgp->rib[rrp->afi][rrp->safi],
93+ &rrp->prefix);
94
95- atomic_store_explicit(&rtr_update_overflow, 0,
96- memory_order_seq_cst);
97- revalidate_all_routes();
98- return 0;
99- }
100+ node = match;
101
102- retval = read(socket, &rec, sizeof(struct pfx_record));
103- if (retval != sizeof(struct pfx_record)) {
104- RPKI_DEBUG("Could not read from socket");
105- return retval;
106- }
107+ while (node) {
108+ if (bgp_dest_has_bgp_path_info_data(node)) {
109+ revalidate_bgp_node(node, rrp->afi, rrp->safi);
110+ }
111
112- /* RTR-Server crashed/terminated, let's handle and switch
113- * to the second available RTR-Server according to preference.
114- */
115- if (rec.socket && rec.socket->state == RTR_ERROR_FATAL) {
116- reset(true);
117- return 0;
118+ node = bgp_route_next_until(node, match);
119 }
120
121- prefix = pfx_record_to_prefix(&rec);
122+ XFREE(MTYPE_BGP_RPKI_REVALIDATE, rrp);
123+}
124
125- afi_t afi = (rec.prefix.ver == LRTR_IPV4) ? AFI_IP : AFI_IP6;
126+static void revalidate_single_prefix(struct prefix prefix, afi_t afi)
127+{
128+ struct bgp *bgp;
129+ struct listnode *node;
130
131 for (ALL_LIST_ELEMENTS_RO(bm->bgp, node, bgp)) {
132 safi_t safi;
133
134 for (safi = SAFI_UNICAST; safi < SAFI_MAX; safi++) {
135- if (!bgp->rib[afi][safi])
136+ struct bgp_table *table = bgp->rib[afi][safi];
137+ struct rpki_revalidate_prefix *rrp;
138+
139+ if (!table)
140 continue;
141
142- struct bgp_dest *match;
143- struct bgp_dest *node;
144+ rrp = XCALLOC(MTYPE_BGP_RPKI_REVALIDATE, sizeof(*rrp));
145+ rrp->bgp = bgp;
146+ rrp->prefix = prefix;
147+ rrp->afi = afi;
148+ rrp->safi = safi;
149+ thread_add_event(bm->master, rpki_revalidate_prefix,
150+ rrp, 0, &bgp->t_revalidate[afi][safi]);
151+ }
152+ }
153+}
154+
155+static void bgpd_sync_callback(struct thread *thread)
156+{
157+ struct prefix prefix;
158+ struct pfx_record rec;
159+ afi_t afi;
160+ int retval;
161+
162+ if (atomic_load_explicit(&rtr_update_overflow, memory_order_seq_cst)) {
163+ ssize_t size = 0;
164
165- match = bgp_table_subtree_lookup(bgp->rib[afi][safi],
166- prefix);
167- node = match;
168+ retval = read(rpki_sync_socket_bgpd, &rec,
169+ sizeof(struct pfx_record));
170+ while (retval != -1) {
171+ if (retval != sizeof(struct pfx_record))
172+ break;
173
174- while (node) {
175- if (bgp_dest_has_bgp_path_info_data(node)) {
176- revalidate_bgp_node(node, afi, safi);
177- }
178+ size += retval;
179+ pfx_record_to_prefix(&rec, &prefix);
180+ afi = (rec.prefix.ver == LRTR_IPV4) ? AFI_IP : AFI_IP6;
181+ revalidate_single_prefix(prefix, afi);
182
183- node = bgp_route_next_until(node, match);
184- }
185+ retval = read(rpki_sync_socket_bgpd, &rec,
186+ sizeof(struct pfx_record));
187 }
188+
189+ atomic_store_explicit(&rtr_update_overflow, 0,
190+ memory_order_seq_cst);
191+ return;
192 }
193
194- prefix_free(&prefix);
195- return 0;
196+ retval = read(rpki_sync_socket_bgpd, &rec, sizeof(struct pfx_record));
197+ if (retval != sizeof(struct pfx_record)) {
198+ RPKI_DEBUG("Could not read from rpki_sync_socket_bgpd");
199+ return;
200+ }
201+ pfx_record_to_prefix(&rec, &prefix);
202+
203+ afi = (rec.prefix.ver == LRTR_IPV4) ? AFI_IP : AFI_IP6;
204+
205+ revalidate_single_prefix(prefix, afi);
206 }
207
208 static void revalidate_bgp_node(struct bgp_dest *bgp_dest, afi_t afi,
209@@ -446,63 +477,12 @@ static void revalidate_bgp_node(struct bgp_dest *bgp_dest, afi_t afi,
210 }
211 }
212
213-static void revalidate_all_routes(void)
214-{
215- struct bgp *bgp;
216- struct listnode *node;
217- afi_t afi;
218- safi_t safi;
219-
220- for (ALL_LIST_ELEMENTS_RO(bm->bgp, node, bgp)) {
221- struct peer *peer;
222- struct listnode *peer_listnode;
223-
224- for (ALL_LIST_ELEMENTS_RO(bgp->peer, peer_listnode, peer)) {
225- FOREACH_AFI_SAFI (afi, safi) {
226- if (!peer->afc_nego[afi][safi])
227- continue;
228-
229- if (!peer->bgp->rib[afi][safi])
230- continue;
231-
232- bgp_soft_reconfig_in(peer, afi, safi);
233- }
234- }
235- }
236-}
237-
238-static void rpki_connection_status_cb(const struct rtr_mgr_group *group
239- __attribute__((unused)),
240- enum rtr_mgr_status status,
241- const struct rtr_socket *socket
242- __attribute__((unused)),
243- void *data __attribute__((unused)))
244-{
245- struct pfx_record rec = {0};
246- int retval;
247-
248- if (rtr_is_stopping ||
249- atomic_load_explicit(&rtr_update_overflow, memory_order_seq_cst))
250- return;
251-
252- if (status == RTR_MGR_ERROR)
253- rec.socket = socket;
254-
255- retval = write(rpki_sync_socket_rtr, &rec, sizeof(rec));
256- if (retval == -1 && (errno == EAGAIN || errno == EWOULDBLOCK))
257- atomic_store_explicit(&rtr_update_overflow, 1,
258- memory_order_seq_cst);
259-
260- else if (retval != sizeof(rec))
261- RPKI_DEBUG("Could not write to rpki_sync_socket_rtr");
262-}
263-
264 static void rpki_update_cb_sync_rtr(struct pfx_table *p __attribute__((unused)),
265 const struct pfx_record rec,
266 const bool added __attribute__((unused)))
267 {
268- if (rtr_is_stopping
269- || atomic_load_explicit(&rtr_update_overflow, memory_order_seq_cst))
270+ if (rtr_is_stopping ||
271+ atomic_load_explicit(&rtr_update_overflow, memory_order_seq_cst))
272 return;
273
274 int retval =
275diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
276index 7e528b2191..bfe96f0f01 100644
277--- a/bgpd/bgpd.c
278+++ b/bgpd/bgpd.c
279@@ -3579,6 +3579,10 @@ int bgp_delete(struct bgp *bgp)
280
281 hook_call(bgp_inst_delete, bgp);
282
283+ THREAD_OFF(bgp->t_condition_check);
284+ FOREACH_AFI_SAFI (afi, safi)
285+ THREAD_OFF(bgp->t_revalidate[afi][safi]);
286+
287 THREAD_OFF(bgp->t_startup);
288 THREAD_OFF(bgp->t_maxmed_onstartup);
289 THREAD_OFF(bgp->t_update_delay);
290diff --git a/bgpd/bgpd.h b/bgpd/bgpd.h
291index 8b93c450e8..45db4752f4 100644
292--- a/bgpd/bgpd.h
293+++ b/bgpd/bgpd.h
294@@ -426,6 +426,7 @@ struct bgp {
295 /* BGP update delay on startup */
296 struct thread *t_update_delay;
297 struct thread *t_establish_wait;
298+ struct thread *t_revalidate[AFI_MAX][SAFI_MAX];
299 uint8_t update_delay_over;
300 uint8_t main_zebra_update_hold;
301 uint8_t main_peers_update_hold;
302--
3032.35.5
304
diff --git a/meta-networking/recipes-protocols/frr/frr_8.2.2.bb b/meta-networking/recipes-protocols/frr/frr_8.2.2.bb
index facc655e29..975607f5af 100644
--- a/meta-networking/recipes-protocols/frr/frr_8.2.2.bb
+++ b/meta-networking/recipes-protocols/frr/frr_8.2.2.bb
@@ -34,6 +34,7 @@ SRC_URI = "git://github.com/FRRouting/frr.git;protocol=https;branch=stable/8.2 \
34 file://CVE-2024-31950.patch \ 34 file://CVE-2024-31950.patch \
35 file://CVE-2024-31951.patch \ 35 file://CVE-2024-31951.patch \
36 file://CVE-2024-31948.patch \ 36 file://CVE-2024-31948.patch \
37 file://CVE-2024-55553.patch \
37 " 38 "
38 39
39SRCREV = "79188bf710e92acf42fb5b9b0a2e9593a5ee9b05" 40SRCREV = "79188bf710e92acf42fb5b9b0a2e9593a5ee9b05"
diff --git a/meta-networking/recipes-protocols/net-snmp/net-snmp/0001-unload_all_mibs-fix-memory-leak-by-freeing-tclist.patch b/meta-networking/recipes-protocols/net-snmp/net-snmp/0001-unload_all_mibs-fix-memory-leak-by-freeing-tclist.patch
new file mode 100644
index 0000000000..4e1d09e15a
--- /dev/null
+++ b/meta-networking/recipes-protocols/net-snmp/net-snmp/0001-unload_all_mibs-fix-memory-leak-by-freeing-tclist.patch
@@ -0,0 +1,32 @@
1From 606e2cbb2d607820345aa20d4095613b1f563a08 Mon Sep 17 00:00:00 2001
2From: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
3Date: Wed, 9 Apr 2025 09:24:45 +0800
4Subject: [PATCH] unload_all_mibs: fix memory leak by freeing tclist
5
6tclist is always allocated in netsnmp_init_mib_internals, when doing multiple init_snmp("")/snmp_shutdown("") this memory is never free'd.
7Remove the special character in the origin commit.
8
9Upstream-Status: Backport [https://github.com/net-snmp/net-snmp/commit/4bd0d9a8a2860c2c46307aef5ee1ccc69f7e3b62]
10
11Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
12---
13 snmplib/parse.c | 3 ++-
14 1 file changed, 2 insertions(+), 1 deletion(-)
15
16diff --git a/snmplib/parse.c b/snmplib/parse.c
17index 9406f4f88..2f9a20175 100644
18--- a/snmplib/parse.c
19+++ b/snmplib/parse.c
20@@ -4225,7 +4225,8 @@ unload_all_mibs(void)
21 if (ptc->description)
22 free(ptc->description);
23 }
24- memset(tclist, 0, tc_alloc * sizeof(struct tc));
25+ SNMP_FREE(tclist);
26+ tc_alloc = 0;
27
28 memset(buckets, 0, sizeof(buckets));
29 memset(nbuckets, 0, sizeof(nbuckets));
30--
312.34.1
32
diff --git a/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb b/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb
index eb8e1599fb..88466c94b4 100644
--- a/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb
+++ b/meta-networking/recipes-protocols/net-snmp/net-snmp_5.9.3.bb
@@ -27,6 +27,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/net-snmp/net-snmp-${PV}.tar.gz \
27 file://reproducibility-have-printcap.patch \ 27 file://reproducibility-have-printcap.patch \
28 file://0001-ac_add_search_path.m4-keep-consistent-between-32bit.patch \ 28 file://0001-ac_add_search_path.m4-keep-consistent-between-32bit.patch \
29 file://CVE-2022-44792-CVE-2022-44793.patch \ 29 file://CVE-2022-44792-CVE-2022-44793.patch \
30 file://0001-unload_all_mibs-fix-memory-leak-by-freeing-tclist.patch \
30 " 31 "
31SRC_URI[sha256sum] = "2097f29b7e1bf3f1300b4bae52fa2308d0bb8d5d3998dbe02f9462a413a2ef0a" 32SRC_URI[sha256sum] = "2097f29b7e1bf3f1300b4bae52fa2308d0bb8d5d3998dbe02f9462a413a2ef0a"
32 33
diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2025-32364.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2025-32364.patch
new file mode 100644
index 0000000000..fa4310e6af
--- /dev/null
+++ b/meta-oe/recipes-support/poppler/poppler/CVE-2025-32364.patch
@@ -0,0 +1,28 @@
1From d87bc726c7cc98f8c26b60ece5f20236e9de1bc3 Mon Sep 17 00:00:00 2001
2From: Albert Astals Cid <aacid@kde.org>
3Date: Mon, 24 Mar 2025 00:44:54 +0100
4Subject: [PATCH] PSStack::roll: Protect against doing int = -INT_MIN
5
6CVE: CVE-2025-32364
7Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/d87bc726c7cc98f8c26b60ece5f20236e9de1bc3]
8
9Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
10---
11 poppler/Function.cc | 2 +-
12 1 file changed, 1 insertion(+), 1 deletion(-)
13
14diff --git a/poppler/Function.cc b/poppler/Function.cc
15index b97ad71..3ee99d6 100644
16--- a/poppler/Function.cc
17+++ b/poppler/Function.cc
18@@ -1066,7 +1066,7 @@ void PSStack::roll(int n, int j)
19 PSObject obj;
20 int i, k;
21
22- if (unlikely(n == 0)) {
23+ if (unlikely(n == 0 || j == INT_MIN)) {
24 return;
25 }
26 if (j >= 0) {
27--
282.40.0
diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2025-32365.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2025-32365.patch
new file mode 100644
index 0000000000..d8cda9c1c3
--- /dev/null
+++ b/meta-oe/recipes-support/poppler/poppler/CVE-2025-32365.patch
@@ -0,0 +1,41 @@
1From 1f151565bbca5be7449ba8eea6833051cc1baa41 Mon Sep 17 00:00:00 2001
2From: Albert Astals Cid <aacid@kde.org>
3Date: Mon, 31 Mar 2025 14:35:49 +0200
4Subject: [PATCH] Move isOk check to inside JBIG2Bitmap::combine
5
6CVE: CVE-2025-32365
7Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/1f151565bbca5be7449ba8eea6833051cc1baa41]
8
9Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
10---
11 poppler/JBIG2Stream.cc | 8 +++++---
12 1 file changed, 5 insertions(+), 3 deletions(-)
13
14diff --git a/poppler/JBIG2Stream.cc b/poppler/JBIG2Stream.cc
15index b9a62e1..9cc3b82 100644
16--- a/poppler/JBIG2Stream.cc
17+++ b/poppler/JBIG2Stream.cc
18@@ -767,6 +767,10 @@ void JBIG2Bitmap::combine(JBIG2Bitmap *bitmap, int x, int y, unsigned int combOp
19 unsigned int src0, src1, src, dest, s1, s2, m1, m2, m3;
20 bool oneByte;
21
22+ if (unlikely(!isOk())) {
23+ return;
24+ }
25+
26 // check for the pathological case where y = -2^31
27 if (y < -0x7fffffff) {
28 return;
29@@ -2198,9 +2202,7 @@ void JBIG2Stream::readTextRegionSeg(unsigned int segNum, bool imm, bool lossless
30 if (pageH == 0xffffffff && y + h > curPageH) {
31 pageBitmap->expand(y + h, pageDefPixel);
32 }
33- if (pageBitmap->isOk()) {
34- pageBitmap->combine(bitmap.get(), x, y, extCombOp);
35- }
36+ pageBitmap->combine(bitmap.get(), x, y, extCombOp);
37
38 // store the region bitmap
39 } else {
40--
412.40.0
diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2025-43903.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2025-43903.patch
new file mode 100644
index 0000000000..e5acf7492b
--- /dev/null
+++ b/meta-oe/recipes-support/poppler/poppler/CVE-2025-43903.patch
@@ -0,0 +1,54 @@
1From f1b9c830f145a0042e853d6462b2f9ca4016c669 Mon Sep 17 00:00:00 2001
2From: Juraj sarinay <juraj@sarinay.com>
3Date: Thu, 6 Mar 2025 02:02:56 +0100
4Subject: [PATCH] Properly verify adbe.pkcs7.sha1 signatures.
5
6For signatures with non-empty encapsulated content
7(typically adbe.pkcs7.sha1), we only compared hash values and
8never actually checked SignatureValue within SignerInfo.
9The bug introduced by c7c0207b
10made trivial signature forgeries possible. Fix this by calling
11NSS_CMSSignerInfo_Verify() after the hash values compare equal.
12
13CVE: CVE-2025-43903
14Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669]
15
16Changes:
17- Refresh patch context as per the source code.
18
19Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
20---
21 poppler/SignatureHandler.cc | 13 ++++++++-----
22 1 file changed, 8 insertions(+), 5 deletions(-)
23
24diff --git a/poppler/SignatureHandler.cc b/poppler/SignatureHandler.cc
25index 6538239..4008b2c 100644
26--- a/poppler/SignatureHandler.cc
27+++ b/poppler/SignatureHandler.cc
28@@ -969,16 +969,19 @@ SignatureValidationStatus SignatureHandler::validateSignature()
29 This means it's not a detached type signature
30 so the digest is contained in SignedData->contentInfo
31 */
32- if (memcmp(digest.data, content_info_data->data, hash_length) == 0 && digest.len == content_info_data->len) {
33- PORT_Free(digest_buffer);
34- return SIGNATURE_VALID;
35- } else {
36+ if (digest.len != content_info_data->len || memcmp(digest.data, content_info_data->data, digest.len) != 0) {
37 PORT_Free(digest_buffer);
38 return SIGNATURE_DIGEST_MISMATCH;
39 }
40
41- } else if (NSS_CMSSignerInfo_Verify(CMSSignerInfo, &digest, nullptr) != SECSuccess) {
42+ auto innerHashContext = HASH_Create(getHashAlgorithm());
43+ HASH_Update(innerHashContext, content_info_data->data, content_info_data->len);
44+ HASH_End(innerHashContext, digest_buffer, &result_len, hash_length);
45+ digest.data = digest_buffer;
46+ digest.len = hash_length;
47+ }
48
49+ if (NSS_CMSSignerInfo_Verify(CMSSignerInfo, &digest, nullptr) != SECSuccess) {
50 PORT_Free(digest_buffer);
51 return NSS_SigTranslate(CMSSignerInfo->verificationStatus);
52 } else {
53--
542.40.0
diff --git a/meta-oe/recipes-support/poppler/poppler_22.04.0.bb b/meta-oe/recipes-support/poppler/poppler_22.04.0.bb
index af6ee67496..bb6e64d657 100644
--- a/meta-oe/recipes-support/poppler/poppler_22.04.0.bb
+++ b/meta-oe/recipes-support/poppler/poppler_22.04.0.bb
@@ -11,6 +11,9 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \
11 file://CVE-2024-6239-0001.patch \ 11 file://CVE-2024-6239-0001.patch \
12 file://CVE-2024-6239-0002.patch \ 12 file://CVE-2024-6239-0002.patch \
13 file://CVE-2024-56378.patch \ 13 file://CVE-2024-56378.patch \
14 file://CVE-2025-32364.patch \
15 file://CVE-2025-32365.patch \
16 file://CVE-2025-43903.patch \
14 " 17 "
15SRC_URI[sha256sum] = "813fb4b90e7bda63df53205c548602bae728887a60f4048aae4dbd9b1927deff" 18SRC_URI[sha256sum] = "813fb4b90e7bda63df53205c548602bae728887a60f4048aae4dbd9b1927deff"
16 19
diff --git a/meta-python/recipes-devtools/python/python3-twisted/CVE-2024-41671-0001.patch b/meta-python/recipes-devtools/python/python3-twisted/CVE-2024-41671-0001.patch
new file mode 100644
index 0000000000..a5bffbd5a5
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-twisted/CVE-2024-41671-0001.patch
@@ -0,0 +1,33 @@
1From f1cb4e616e9f23b4dd044a6db44365060950c64f Mon Sep 17 00:00:00 2001
2From: Tom Most <twm@freecog.net>
3Date: Mon, 22 Jul 2024 22:21:10 -0700
4Subject: [PATCH] Use chunking in the pipelining tests
5
6CVE: CVE-2024-41671
7
8Upstream-Status: Backport [https://github.com/twisted/twisted/commit/f1cb4e616e9f23b4dd044a6db44365060950c64f]
9
10Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
11---
12 src/twisted/web/test/test_http.py | 4 +++-
13 1 file changed, 3 insertions(+), 1 deletion(-)
14
15diff --git a/src/twisted/web/test/test_http.py b/src/twisted/web/test/test_http.py
16index 7ffea4e..5d88ff1 100644
17--- a/src/twisted/web/test/test_http.py
18+++ b/src/twisted/web/test/test_http.py
19@@ -575,9 +575,11 @@ class PipeliningBodyTests(unittest.TestCase, ResponseTestMixin):
20 b"Content-Length: 10\r\n"
21 b"\r\n"
22 b"0123456789POST / HTTP/1.1\r\n"
23- b"Content-Length: 10\r\n"
24+ b"Transfer-Encoding: chunked\r\n"
25 b"\r\n"
26+ b"a\r\n"
27 b"0123456789"
28+ b"0\r\n"
29 )
30
31 expectedResponses = [
32--
332.40.0
diff --git a/meta-python/recipes-devtools/python/python3-twisted/CVE-2024-41671-0002.patch b/meta-python/recipes-devtools/python/python3-twisted/CVE-2024-41671-0002.patch
new file mode 100644
index 0000000000..4775f1c55c
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-twisted/CVE-2024-41671-0002.patch
@@ -0,0 +1,196 @@
1From ef2c755e9e9d57d58132af790bd2fd2b957b3fb1 Mon Sep 17 00:00:00 2001
2From: Tom Most <twm@freecog.net>
3Date: Mon, 22 Jul 2024 23:21:49 -0700
4Subject: [PATCH] Tests and partial fix
5
6CVE: CVE-2024-41671
7
8Upstream-Status: Backport [https://github.com/twisted/twisted/commit/ef2c755e9e9d57d58132af790bd2fd2b957b3fb1]
9
10Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
11---
12 src/twisted/web/http.py | 2 +-
13 src/twisted/web/test/test_http.py | 112 +++++++++++++++++++++++++++---
14 2 files changed, 102 insertions(+), 12 deletions(-)
15
16diff --git a/src/twisted/web/http.py b/src/twisted/web/http.py
17index a53ebc2..96a1335 100644
18--- a/src/twisted/web/http.py
19+++ b/src/twisted/web/http.py
20@@ -2256,8 +2256,8 @@ class HTTPChannel(basic.LineReceiver, policies.TimeoutMixin):
21 self.__header = line
22
23 def _finishRequestBody(self, data):
24- self.allContentReceived()
25 self._dataBuffer.append(data)
26+ self.allContentReceived()
27
28 def _maybeChooseTransferDecoder(self, header, data):
29 """
30diff --git a/src/twisted/web/test/test_http.py b/src/twisted/web/test/test_http.py
31index 5d88ff1..86c85d2 100644
32--- a/src/twisted/web/test/test_http.py
33+++ b/src/twisted/web/test/test_http.py
34@@ -136,7 +136,7 @@ class DummyHTTPHandler(http.Request):
35 data = self.content.read()
36 length = self.getHeader(b"content-length")
37 if length is None:
38- length = networkString(str(length))
39+ length = str(length).encode()
40 request = b"'''\n" + length + b"\n" + data + b"'''\n"
41 self.setResponseCode(200)
42 self.setHeader(b"Request", self.uri)
43@@ -567,7 +567,8 @@ class HTTP0_9Tests(HTTP1_0Tests):
44
45 class PipeliningBodyTests(unittest.TestCase, ResponseTestMixin):
46 """
47- Tests that multiple pipelined requests with bodies are correctly buffered.
48+ Pipelined requests get buffered and executed in the order received,
49+ not processed in parallel.
50 """
51
52 requests = (
53@@ -578,8 +579,9 @@ class PipeliningBodyTests(unittest.TestCase, ResponseTestMixin):
54 b"Transfer-Encoding: chunked\r\n"
55 b"\r\n"
56 b"a\r\n"
57- b"0123456789"
58+ b"0123456789\r\n"
59 b"0\r\n"
60+ b"\r\n"
61 )
62
63 expectedResponses = [
64@@ -596,14 +598,16 @@ class PipeliningBodyTests(unittest.TestCase, ResponseTestMixin):
65 b"Request: /",
66 b"Command: POST",
67 b"Version: HTTP/1.1",
68- b"Content-Length: 21",
69- b"'''\n10\n0123456789'''\n",
70+ b"Content-Length: 23",
71+ b"'''\nNone\n0123456789'''\n",
72 ),
73 ]
74
75- def test_noPipelining(self):
76+ def test_stepwiseTinyTube(self):
77 """
78- Test that pipelined requests get buffered, not processed in parallel.
79+ Imitate a slow connection that delivers one byte at a time.
80+ The request handler (L{DelayedHTTPHandler}) is puppeted to
81+ step through the handling of each request.
82 """
83 b = StringTransport()
84 a = http.HTTPChannel()
85@@ -612,10 +616,9 @@ class PipeliningBodyTests(unittest.TestCase, ResponseTestMixin):
86 # one byte at a time, to stress it.
87 for byte in iterbytes(self.requests):
88 a.dataReceived(byte)
89- value = b.value()
90
91 # So far only one request should have been dispatched.
92- self.assertEqual(value, b"")
93+ self.assertEqual(b.value(), b"")
94 self.assertEqual(1, len(a.requests))
95
96 # Now, process each request one at a time.
97@@ -624,8 +627,95 @@ class PipeliningBodyTests(unittest.TestCase, ResponseTestMixin):
98 request = a.requests[0].original
99 request.delayedProcess()
100
101- value = b.value()
102- self.assertResponseEquals(value, self.expectedResponses)
103+ self.assertResponseEquals(b.value(), self.expectedResponses)
104+
105+ def test_stepwiseDumpTruck(self):
106+ """
107+ Imitate a fast connection where several pipelined
108+ requests arrive in a single read. The request handler
109+ (L{DelayedHTTPHandler}) is puppeted to step through the
110+ handling of each request.
111+ """
112+ b = StringTransport()
113+ a = http.HTTPChannel()
114+ a.requestFactory = DelayedHTTPHandlerProxy
115+ a.makeConnection(b)
116+
117+ a.dataReceived(self.requests)
118+
119+ # So far only one request should have been dispatched.
120+ self.assertEqual(b.value(), b"")
121+ self.assertEqual(1, len(a.requests))
122+
123+ # Now, process each request one at a time.
124+ while a.requests:
125+ self.assertEqual(1, len(a.requests))
126+ request = a.requests[0].original
127+ request.delayedProcess()
128+
129+ self.assertResponseEquals(b.value(), self.expectedResponses)
130+
131+ def test_immediateTinyTube(self):
132+ """
133+ Imitate a slow connection that delivers one byte at a time.
134+
135+ (L{DummyHTTPHandler}) immediately responds, but no more
136+ than one
137+ """
138+ b = StringTransport()
139+ a = http.HTTPChannel()
140+ a.requestFactory = DummyHTTPHandlerProxy # "sync"
141+ a.makeConnection(b)
142+
143+ # one byte at a time, to stress it.
144+ for byte in iterbytes(self.requests):
145+ a.dataReceived(byte)
146+ # There is never more than one request dispatched at a time:
147+ self.assertLessEqual(len(a.requests), 1)
148+
149+ self.assertResponseEquals(b.value(), self.expectedResponses)
150+
151+ def test_immediateDumpTruck(self):
152+ """
153+ Imitate a fast connection where several pipelined
154+ requests arrive in a single read. The request handler
155+ (L{DummyHTTPHandler}) immediately responds.
156+
157+ This doesn't check the at-most-one pending request
158+ invariant but exercises otherwise uncovered code paths.
159+ See GHSA-c8m8-j448-xjx7.
160+ """
161+ b = StringTransport()
162+ a = http.HTTPChannel()
163+ a.requestFactory = DummyHTTPHandlerProxy
164+ a.makeConnection(b)
165+
166+ # All bytes at once to ensure there's stuff to buffer.
167+ a.dataReceived(self.requests)
168+
169+ self.assertResponseEquals(b.value(), self.expectedResponses)
170+
171+ def test_immediateABiggerTruck(self):
172+ """
173+ Imitate a fast connection where a so many pipelined
174+ requests arrive in a single read that backpressure is indicated.
175+ The request handler (L{DummyHTTPHandler}) immediately responds.
176+
177+ This doesn't check the at-most-one pending request
178+ invariant but exercises otherwise uncovered code paths.
179+ See GHSA-c8m8-j448-xjx7.
180+
181+ @see: L{http.HTTPChannel._optimisticEagerReadSize}
182+ """
183+ b = StringTransport()
184+ a = http.HTTPChannel()
185+ a.requestFactory = DummyHTTPHandlerProxy
186+ a.makeConnection(b)
187+
188+ overLimitCount = a._optimisticEagerReadSize // len(self.requests) * 10
189+ a.dataReceived(self.requests * overLimitCount)
190+
191+ self.assertResponseEquals(b.value(), self.expectedResponses * overLimitCount)
192
193 def test_pipeliningReadLimit(self):
194 """
195--
1962.40.0
diff --git a/meta-python/recipes-devtools/python/python3-twisted_22.2.0.bb b/meta-python/recipes-devtools/python/python3-twisted_22.2.0.bb
index c55c86ea50..da83f0123a 100644
--- a/meta-python/recipes-devtools/python/python3-twisted_22.2.0.bb
+++ b/meta-python/recipes-devtools/python/python3-twisted_22.2.0.bb
@@ -11,6 +11,9 @@ SRC_URI[sha256sum] = "57f32b1f6838facb8c004c89467840367ad38e9e535f8252091345dba5
11 11
12PYPI_PACKAGE = "Twisted" 12PYPI_PACKAGE = "Twisted"
13 13
14SRC_URI += "file://CVE-2024-41671-0001.patch \
15 file://CVE-2024-41671-0002.patch"
16
14inherit pypi python_setuptools_build_meta 17inherit pypi python_setuptools_build_meta
15 18
16do_install:append() { 19do_install:append() {
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-05 16:16:19 +0000