On Thu Sep 17, 2026 at 12:55 PM CEST, Vijay Anusuri via lists.openembedded.org wrote: > Backport the security fixes from the upstream v3.4.1-sec-patches3 > branch to address the known rsync security vulnerabilities. > > The v3.4.1-sec-patches3 branch contains 239 commits. The GitHub > workflow commits (037, 038, and 160), which only modify > .github/workflows files, and the testsuite-only commits (238 and > 239) are excluded because they are not applicable to the Yocto > build. > > The remaining 237 security fixes are combined into a single patch > series and applied on top of the rsync 3.4.1 source. > > SUSE has also backported these security fixes to rsync-3.4.1-160000.6.1 > to address the corresponding CVEs. > > References: > > https://rsync.samba.org/security.html > https://github.com/RsyncProject/rsync/tree/v3.4.1-sec-patches3 > https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-53802 > > This fix handles CVE-2025-10158 CVE-2026-29518 CVE-2026-43617 CVE-2026-43618 > CVE-2026-43619 CVE-2026-43620 CVE-2026-45232 CVE-2026-44507 CVE-2026-44508 > CVE-2026-44509 CVE-2026-44510 CVE-2026-53783 CVE-2026-53784 CVE-2026-53785 > CVE-2026-53786 CVE-2026-53788 CVE-2026-53789 CVE-2026-53790 CVE-2026-53791 > CVE-2026-53792 CVE-2026-53793 CVE-2026-53794 CVE-2026-53795 CVE-2026-53796 > CVE-2026-53797 CVE-2026-53798 CVE-2026-53799 CVE-2026-53800 CVE-2026-53801 > CVE-2026-53802 CVE-2026-53803 CVE-2026-70452 CVE-2026-70453 CVE-2026-70454 > CVE-2026-70455 CVE-2026-70456 CVE-2026-70457 CVE-2026-70458 CVE-2026-70459 > CVE-2026-70460 CVE-2026-70461 CVE-2026-70462 CVE-2026-70463 CVE-2026-70464 > > Dropped CVE-2025-10158.patch > Refreshed the patch 0001-Add-missing-prototypes-to-function-declarations.patch > > Signed-off-by: Vijay Anusuri <[email protected]> > --- > ...-prototypes-to-function-declarations.patch | 81 +- > .../rsync/files/CVE-2025-10158.patch | 36 - > .../files/rsync-3.4.1-sec-patches3.patch | 34052 ++++++++++++++++ > meta/recipes-devtools/rsync/rsync_3.4.1.bb | 2 +- > 4 files changed, 34071 insertions(+), 100 deletions(-) > delete mode 100644 meta/recipes-devtools/rsync/files/CVE-2025-10158.patch > create mode 100644 > meta/recipes-devtools/rsync/files/rsync-3.4.1-sec-patches3.patch
Hello, I don't think I want to carry a 34000 lines patch. Does the rsync project released a v3.4.1-sec-patches3 archive? If not, can we try to switch the recipe to git and point SRCREV to the "rsync-3.4.1-sec-patches" branch? Since the recipe is not git-based now, we'll need to switch to git first, then upgrade. Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246056): https://lists.openembedded.org/g/openembedded-core/message/246056 Mute This Topic: https://lists.openembedded.org/mt/121293944/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
