On Thu Jul 9, 2026 at 2:50 PM CEST, Pritam Srichandan Sahoo wrote: > Backport upstream fixes for DTLS handshake fragment reassembly > vulnerability (CVE-2026-33846). > > Includes: > - 4f94e5cfe1f2: add basic DTLS fragment reassembly test > - 9deffca528c2: shorten merge_handshake_packet using recv_buf > - 65ab33fa54e3: add validation checks for DTLS fragment length and bounds > - cf3f1955e58c: add reproducer for DTLS fragment reassembly bug (#1816) > - bb427ff74dba: add fragmented ClientHello test coverage > - 092c65d004e2: match DTLS datagrams by handshake sequence number > - a2b41be83a1a: add test for mismatched message_seq handling (#1839) > - 68b2fb63c8df: link mini-dtls-fragments test to gnulib > > These commits are included in gnutls 3.8.13 and are backported by > both Debian (gnutls28_3.8.9-3+deb13u4) and CentOS 10-stream > (gnutls-3.8.10-4.el10) using identical commit selection. > > Signed-off-by: Pritam Srichandan Sahoo <[email protected]> > --- > .../gnutls/gnutls/CVE-2026-33846.patch | 864 ++++++++++++++++++ > meta/recipes-support/gnutls/gnutls_3.8.12.bb | 1 + > 2 files changed, 865 insertions(+) > create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-33846.patch > > diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-33846.patch > b/meta/recipes-support/gnutls/gnutls/CVE-2026-33846.patch > new file mode 100644 > index 0000000000..86e62afded > --- /dev/null > +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-33846.patch > @@ -0,0 +1,864 @@ > +From 4f94e5cfe1f252a431e41642b0752e7e0daf43b9 Mon Sep 17 00:00:00 2001 > +From: Alexander Sosedkin <[email protected]> > +Date: Fri, 20 Mar 2026 16:09:40 +0100 > +Subject: [PATCH] tests/mini-dtls-fragments: implement a basic DTLS test > + > +Upstream-Status: Backport > +[1] > https://gitlab.com/gnutls/gnutls/-/commit/4f94e5cfe1f252a431e41642b0752e7e0daf43b9 > +[2] > https://gitlab.com/gnutls/gnutls/-/commit/9deffca528c23bbb218f5ec3bd4bb1bf4cbd1fc0 > +[3] > https://gitlab.com/gnutls/gnutls/-/commit/65ab33fa54e34fba69d793735b7df3d383d1ff78 > +[4] > https://gitlab.com/gnutls/gnutls/-/commit/cf3f1955e58cbcc10373b841bb101fb058565d87 > +[5] > https://gitlab.com/gnutls/gnutls/-/commit/bb427ff74dba849d40753ed9c8511e873f762743 > +[6] > https://gitlab.com/gnutls/gnutls/-/commit/092c65d004e2f125f2fea3db84d801ac49a09f78 > +[7] > https://gitlab.com/gnutls/gnutls/-/commit/a2b41be83a1a3529c551ccf54958da91a656550e > +[8] > https://github.com/gnutls/gnutls/commit/68b2fb63c8df61d1480121a859f8c955f4910c01 > + > +CVE: CVE-2026-33846 > +Signed-off-by: Alexander Sosedkin <[email protected]> > +Signed-off-by: Pritam Srichandan Sahoo <[email protected]>
Hello, I'm sorry but this is not what I meant by "squashing the commits together". What I want is: * You send 1 patch to the oe-core ML * this patch adds multiple patches files in meta/recipes-support/gnutls/gnutls/ * One patch file per upstream commit * In each patches, Use the syntax Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/XXX] Is that clear for you? I'd like to avoid wasting your work. Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240579): https://lists.openembedded.org/g/openembedded-core/message/240579 Mute This Topic: https://lists.openembedded.org/mt/120189149/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
