Hi Yoann Congal, I am working with Sudhir Dumbhare on these fixes. As Sudhir is currently unavailable due to a personal matter, I have taken over the follow-up and rebased the gnutls patches on top of the latest changes recently merged into the wrynose branch, as requested. The updated patches have been submitted to the upstream mailing list:
1. [email protected] | [wrynose][PATCH 1/2] gnutls: Fix CVE-2026-3832<https://lists.openembedded.org/g/openembedded-core/topic/120356870> 2. [email protected] | [wrynose][PATCH 2/2] gnutls: Fix CVE-2026-42009<https://lists.openembedded.org/g/openembedded-core/topic/120356873> Thank you for pointing out the issue and reviewing the updates. Best regards, Deepak Rathore ________________________________ From: [email protected] <[email protected]> on behalf of Yoann Congal via lists.openembedded.org <[email protected]> Sent: Friday, July 17, 2026 8:07 PM To: Sudhir Dumbhare -X (sudumbha - E INFOCHIPS PRIVATE LIMITED at Cisco) <[email protected]>; [email protected] <[email protected]> Subject: Re: [OE-core][wrynose][PATCH 2/2] gnutls: Fix CVE-2026-42009 On Fri Jul 10, 2026 at 11:54 AM CEST, Sudhir Dumbhare via lists.openembedded.org wrote: > From: Sudhir Dumbhare <[email protected]> > > This patch applies the upstream fix [1] and [2], as referenced in [3], > to address a DTLS packet reordering flaw where duplicate sequence numbers > could lead to unstable ordering or undefined behavior. > > [1] > https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d > [2] > https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f > [3] https://security-tracker.debian.org/tracker/CVE-2026-42009 > > Reference: > https://nvd.nist.gov/vuln/detail/CVE-2026-42009 > > Signed-off-by: Sudhir Dumbhare <[email protected]> Hello, I guess a recent gnutls patch broke this series: ERROR: gnutls-3.8.12-r0 do_patch: Applying patch '.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch' on target directory '.../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/gnutls/3.8.12/sources/gnutls-3.8.12' CmdError('quilt --quiltrc .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/gnutls/3.8.12/recipe-sysroot-native/etc/quiltrc push', 0, 'stdout: Applying patch CVE-2026-42009_p1.patch patching file lib/buffers.c Hunk #1 FAILED at 968. 1 out of 1 hunk FAILED -- rejects in file lib/buffers.c Patch CVE-2026-42009_p1.patch does not apply (enforce with -f) stderr: ') ERROR: Logfile of failure stored in: .../wrynose/bitbake-builds/poky-wrynose/build/tmp/work/x86-64-v3-poky-linux/gnutls/3.8.12/temp/log.do_patch.2529206 ERROR: Task (.../wrynose/bitbake-builds/poky-wrynose/layers/openembedded-core/meta/recipes-support/gnutls/gnutls_3.8.12.bb:do_patch) failed with exit code '1' Can you rebase on the recently merged wrynose and resend? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241361): https://lists.openembedded.org/g/openembedded-core/message/241361 Mute This Topic: https://lists.openembedded.org/mt/120204097/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
