On Mon Jul 20, 2026 at 8:56 AM CEST, Hitendra Prajapati via lists.openembedded.org wrote: > Pick patch from [1] & [2] also mentioned at Debian report in [3] > > [1] > https://gitlab.com/gnutls/gnutls/-/commit/1dead2faec6320aaba321eb56f20d442df192b83 > [2] > https://gitlab.com/gnutls/gnutls/-/commit/24713b8c63137ce0665b495d22ccce4f5ce05c84 > [3] https://security-tracker.debian.org/tracker/CVE-2026-42011 > [4] https://gitlab.com/gnutls/gnutls/-/work_items/1824 > > Signed-off-by: Hitendra Prajapati <[email protected]> > --- > .../gnutls/gnutls/CVE-2026-42011.patch | 167 ++++++++++++++++++ > meta/recipes-support/gnutls/gnutls_3.8.12.bb | 1 + > 2 files changed, 168 insertions(+) > create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42011.patch > > diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42011.patch > b/meta/recipes-support/gnutls/gnutls/CVE-2026-42011.patch > new file mode 100644 > index 0000000000..0c56b2805a > --- /dev/null > +++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42011.patch > @@ -0,0 +1,167 @@ > +From 1dead2faec6320aaba321eb56f20d442df192b83 Mon Sep 17 00:00:00 2001 > +From: Alexander Sosedkin <[email protected]> > +Date: Tue, 14 Apr 2026 17:41:30 +0200 > +Subject: [PATCH] x509/name_constraints: fix intersecting empty constraints > + > +Permitted name constraints were wrongfully ignored > +when prior CAs only had excluded name constraints, > +resulting in a name constraint bypass. > + > +With this change, they are taken into account and propagate. > + > +Reported-by: Haruto Kimura (Stella) > +Fixes: #1824 > +Fixes: CVE-2026-42011 > +Fixes: GNUTLS-SA-2026-04-29-6 > +CVSS: 4.8 Medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N > +Signed-off-by: Alexander Sosedkin <[email protected]> > + > +CVE: CVE-2026-42011 > +Upstream-Status: Backport > [https://gitlab.com/gnutls/gnutls/-/commit/1dead2faec6320aaba321eb56f20d442df192b83 > & > https://gitlab.com/gnutls/gnutls/-/commit/24713b8c63137ce0665b495d22ccce4f5ce05c84]
Please don't squash commits. Can you send a v2 of this patch with each commit into a separate patch? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241517): https://lists.openembedded.org/g/openembedded-core/message/241517 Mute This Topic: https://lists.openembedded.org/mt/120355258/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
