changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/master/debian/changelog
* Remove ca-certificates-local example (closes: #988912, #1127101).
* Update Mozilla certificate authority bundle to version 2.86
The following certificate authority was added (+):
+ e-Szigno TLS Root CA 2023
The following certificate authorities were removed (-):
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
- certSIGN ROOT CA
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- TeliaSonera Root CA v1
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- GLOBALTRUST 2020
- GTS Root R2
- FIRMAPROFESIONAL CA ROOT-A WEB
The following certificate authority was renamed (~):
~ "OISTE Server Root RSA G1" (removed leading space)
Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23675
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
(cherry picked from commit 8aaa8d401308d32806c080aab458c3f08208cbf0)
(cherry picked from commit 8b29bf400569335f27e6ebac22f68c5b3254238f)
This fixes multiple bugs, some might be security relevant.
Link: https://github.com/openwrt/openwrt/pull/24330
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit b421c63071dc56dd9a2aab2b26dee23bc7eb677f)
Enable the busybox feature to save shell command history.
(.apk size increase 0.5 kB)
To prevent flash wear,
* save history only at the exit from a shell session, and
* set /tmp as the default location for the history file. The history
is kept on ramdisk until a reboot, when the history is then lost.
If the user wants to save history onto flash, he can change the location
definition in /etc/profile.d/busybox-history-file.sh
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Link: https://github.com/openwrt/openwrt/pull/17179
cherry picked from commit e23b37b2d9a2e766b1ad151f59a04eb68b6a3341)
[ fix conflict error ]
Signed-off-by: Andrey Zotikov <andrey.zotikov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23634
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 26471f32b5b8a3f5d9ccd432083eaf42a0f04cef)
This fixes multiple bugs, some might be security relevant.
Link: https://github.com/openwrt/openwrt/pull/24258
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit b9ad54db42ddf79335f5224a5ad612cb8389028a)
This cherry picks the following changes:
- Security: server: Fix ability to bypass an authorized_keys "forced_command"
option by an authenticated user, if Dropbear is running with "-t" option.
("-t" is require both password and public key).
c60db64081
Reported by Jeremy Brown
- Security: server: Open authorized_keys non-blocking. This avoids getting stuck
with special files, could allow denial of service from local users.
8b579571b5
Reported by Turistu
- Security: scp: Add missed patch to fix CVE-2019-6111 allowing a malicious server
to overwrite unexpected files.
143291baca
Patch from OpenSSH, reported missing by Asim Viladi Oglu Manizada @manizada
Note breaking change: "-r" is now disallowed when the target directory exists
(an additional change in Dropbear's version). If that's required an alternative
such as rsync could be used.
61bd0e3e65
- Security: scp: Clear setuid/setgid bits on received files.
443ccc1fd1
Patch from OpenSSH, tracked as CVE-2026-35385
- Security: client/server: Fix close() of a file descriptor from an out-of-bounds
read. This seems difficult to exploit but may have unforeseen effects.
067fd3846c
Reported by Ankit Singh and @j499261162
Link: https://github.com/openwrt/openwrt/pull/23980
(cherry picked from commit 2218cb19494609076776ae8c13254de60c5f40f3)
Link: https://github.com/openwrt/openwrt/pull/24296
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 262c09368fda76c85c519b7554f33bb98fb3263f)
This fixes the following security isseus with CVE numbers:
CVE-2026-55614: GHSA-mcfg-c4r7-pjpf — case-sensitive Transfer-Encoding matching
CVE-2026-55612: GHSA-p55c-rmhc-qfm5 — invalid chunk-length state reset
CVE-2026-55613: GHSA-wgwp-64hh-f52p — ubus POST body parse-error desync
The branch also carries hardening with no CVE: one-byte overflow in
uh_urldecode, off-by-one OOB read in uh_b64decode, constant-time
password compare, $p$ crypt-hash handling.
Link: https://github.com/openwrt/openwrt/pull/24259
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit f68fa732873c280f290f16aef32b3240c790b390)
Cherry pick the patches recommended in the hostapd security advisory
2026-1:
https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
Vulnerability
Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE
802.11be/Wi-Fi 7) information has been identified in hostapd and
wpa_supplicant. These issues show up in various cases where frames
including information on affiliated links are parsed and processed in
both AP and STA modes. The issues can result in process termination due
to buffer read overflow checks and memory corruption.
The issues for AP mode (hostapd or wpa_supplicant) can result in
denial-of-service attacks due to process termination and small memory
corruption that could theoretically cause other issues, but it does not
seem likely that those could be exploiting in practice. Affected areas
can be reached by sending invalid Management frames without needing
authentication or user action on the target device.
Link: https://github.com/openwrt/openwrt/pull/24043
(cherry picked from commit 8614a2ba6885d0bec345a1010a0d59c64abe403c)
[Removed 004, 0005 and 008 which do not apply and fix some others]
Link: https://github.com/openwrt/openwrt/pull/24295
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 452bc24984b7df0ab12e73372d3fbb3930d404fe)
Change-log since version 2026.03.18, retrieved from the wireless-regdb mailing lists:
wireless-regdb: update regulatory database based on preceding changes
wireless-regdb: Update regulatory info for Brunei Darussalam (BN) for 2022
wireless-regdb: allow 320MHz channel width for Russia
wireless-regdb: Update 6 GHz rules for Hong Kong (HK)
wireless-regdb: Update 5/6 GHz power rules for Russia (RU)
wireless-regdb: Fix 60 GHz power unit for Ukraine (UA)
wireless-regdb: Update 6 GHz rules for South Africa (ZA)
wireless-regdb: Update 6 GHz rules for South Korea (KR)
wireless-regdb: Update regulatory rules for Sri Lanka (LK)
wireless-regdb: Add regulatory info for CEPT countries FO, GI, IM, SM and VA listed by WiFi Alliance
Signed-off-by: Hafiz Zafran <hfzz7@duck.com>
Link: https://github.com/openwrt/openwrt/pull/23594
(cherry picked from commit 848c54b5f42904d4afaae077efd5180cb6752b9c)
Link: https://github.com/openwrt/openwrt/pull/24301
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 9f11fa9de18de615bf0a34822600fbe5399879c0)
Indicate that there are some changes. This should make sure that the
package gets updated.
Fixes: 63c0767f3d02 ("ead: fix integer underflow in handle_send_a()")
(cherry picked from commit 75fad162df8e88d0b535cca83453b0ad05267349)
Link: https://github.com/openwrt/openwrt/pull/24298
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 58264cce83b0837fabf94021b5677dd3209b2655)
handle_send_a() computed the SRP "A" parameter length as
len = ntohl(msg->len) - sizeof(struct ead_msg_number);
sizeof(struct ead_msg_number) is 1, and the subtraction is evaluated in
unsigned arithmetic. A packet with msg->len == 0 therefore wraps the
result to a huge value which, assigned to the signed int len, becomes -1.
The following bounds check is signed:
if (len > MAXPARAMLEN + 1)
return false;
so -1 passes, and memcpy(A.data, number->data, len) runs with len cast to
size_t (~SIZE_MAX) against the 257-byte abuf, crashing the daemon.
Neither parse_message() nor handle_packet() validate msg->len (only the
captured packet length), so an unauthenticated attacker on the local
segment can reach this path and crash ead with a single crafted packet.
Validate the claimed length in unsigned arithmetic before the subtraction
and bound it on both sides. Doing the upper-bound check unsigned as well
also closes a 32-bit-only variant where sizeof(ead_packet) + msg->len
overflows in handle_packet(), letting a large msg->len reach the same
negative-len path.
Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
(cherry picked from commit 63c0767f3d02f7b10b0f0b5293366bd059a08ca5)
Link: https://github.com/openwrt/openwrt/pull/24298
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3944c026aa7cd27222ce334df72d2bcb6be86b9c)
OpenSSL 3.0.21 is a security patch release. The most severe CVE fixed in
this release is High.
This release incorporates the following bug fixes and mitigations:
* Fixed heap use-after-free in PKCS7_verify(). (CVE-2026-45447)
* Fixed CMS AuthEnvelopedData processing may accept forged messages.
(CVE-2026-34182)
* Fixed AES-OCB IV ignored on EVP_Cipher() path. (CVE-2026-45445)
* Fixed possible heap buffer overflow in ASN.1 multibyte string
conversion. (CVE-2026-7383)
* Fixed out-of-bounds read in CMS password-based decryption.
(CVE-2026-9076)
* Fixed heap buffer over-read in ASN.1 content parsing.
(CVE-2026-34180)
* Fixed possible NULL dereference in password-dased CMS decryption.
(CVE-2026-42766)
* Fixed FFC-DH peer validation uses attacker-supplied q.
(CVE-2026-42770)
* Fixed incorrect tag processing for empty messages in AES-GCM-SIV and
AES-SIV modes. (CVE-2026-45446)
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Link: https://github.com/openwrt/openwrt/pull/23843
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 95d0ca014c4ce5e225579f859c066dc74a20763b)
Debian changelog:
* Update Mozilla certificate authority bundle to version 2.82
The following certificate authorities were added (+):
+ TrustAsia TLS ECC Root CA
+ TrustAsia TLS RSA Root CA
+ SwissSign RSA TLS Root CA 2022 - 1
+ OISTE Server Root ECC G1
+ OISTE Server Root RSA G1
The following certificate authorities were removed (-):
- GlobalSign Root CA
- Entrust.net Premium 2048 Secure Server CA
- Baltimore CyberTrust Root (closes: #1121936)
- Comodo AAA Services root
- XRamp Global CA Root
- Go Daddy Class 2 CA
- Starfield Class 2 CA
- CommScope Public Trust ECC Root-01
- CommScope Public Trust ECC Root-02
- CommScope Public Trust RSA Root-01
- CommScope Public Trust RSA Root-02
* Use dh_usrlocal to create /usr/local/share/ca-certificates
(closes: #1127100)
Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23155
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 403c52db37c74246469e1cdf532aa576235d69fb)
(cherry picked from commit db8cbe9de8864cd4a362db8e39142ed13149da18)
Changes:
update regulatory database based on preceding
Update regulatory rules for India (IN) on 6GHz
Replace M2Crypto with cryptography package
Fix regulatory.bin signing with new
Signed-off-by: xiao bo <peterwillcn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23101
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit ce7bc7ac22a73df0ab58f325806eff4dfc332a40)
(cherry picked from commit 4d7129790fd6f740618e5cbb584e5a1964742a56)
This version fixes multiple security problems:
CVE-2025-7395: Problem in certificate verification on Apple devices
CVE-2025-7394: Predictable results from RAND_bytes() after fork call in OpenSSL compatibility layer
CVE-2025-7396: Activate Curve25519 blinding support
See Release notes:
https://github.com/wolfSSL/wolfssl/releases/tag/v5.8.0-stablehttps://github.com/wolfSSL/wolfssl/releases/tag/v5.8.2-stable
wolfSSL is now GPLv3 instead of GPLv2, see:
629c5b4cf6
The file size increased a bit:
```
546060 bin/packages/mipsel_24kc/base/libwolfssl5.7.6.e624513f-5.7.6-r1.apk
560684 bin/packages/mipsel_24kc/base/libwolfssl5.8.2.e624513f-5.8.2-r1.apk
```
Link: https://github.com/openwrt/openwrt/pull/20547
(cherry picked from commit 92f07864c1f29b39df73b0f3858c500a8d8fa931)
Link: https://github.com/openwrt/openwrt/pull/23363
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 4c472ca84d9e3ce18fbe052762b2bd235fa35cc7)
This version fixes some security problems:
* Client impersonation while resuming a TLS 1.3 session
(CVE-2026-34873)
* Entropy on Linux can fall back to /dev/urandom (CVE-2026-34871)
* PSA random generator cloning (CVE-2026-25835)
* Compiler-induced constant-time violations (CVE-2025-66442)
* Null pointer dereference when setting a distinguished name
(CVE-2026-34874)
* Buffer overflow in FFDH public key export (CVE-2026-34875)
* FFDH: lack of contributory behaviour due to improper input validation
(CVE-2026-34872)
* Signature Algorithm Injection (CVE-2026-25834)
* CCM multipart finish tag-length validation bypass (CVE-2026-34876)
* Risk of insufficient protection of serialized session or context data
leading to potential memory safety issues (CVE-2026-34877)
* Buffer underflow in x509_inet_pton_ipv6() (CVE-2026-25833)
Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.6
Size increases by 470 bytes on aarch64:
343995 bin/packages/aarch64_generic/base/libmbedtls21-3.6.5-r1.apk
344465 bin/packages/aarch64_generic/base/libmbedtls21-3.6.6-r1.apk
Link: https://github.com/openwrt/openwrt/pull/22787
(cherry picked from commit f48ef0040b7e4a80283d0775d397b8a3c66b7275)
Link: https://github.com/openwrt/openwrt/pull/23362
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit c334b9a9d59f2d572da006469976f29989eb2565)
OpenSSL 3.0.20 is a security patch release. The most severe CVE fixed in
this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fixed incorrect failure handling in RSA KEM RSASVE encapsulation.
(CVE-2026-31790)
* Fixed potential use-after-free in DANE client code.
(CVE-2026-28387)
* Fixed NULL pointer dereference when processing a delta CRL.
(CVE-2026-28388)
* Fixed possible NULL dereference when processing CMS
KeyAgreeRecipientInfo.
(CVE-2026-28389)
* Fixed possible NULL dereference when processing CMS
KeyTransportRecipientInfo.
(CVE-2026-28390)
* Fixed heap buffer overflow in hexadecimal conversion.
(CVE-2026-31789)
Signed-off-by: Jan Kardell <jan.kardell@telliq.com>
Link: https://github.com/openwrt/openwrt/pull/23346
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 44d98eec231534487cbec4ba8f852c1acf67a32d)
This fixes a simple logic error in the macaddr existence check in mac80211.uc.
Signed-off-by: Harin Lee <me@harin.net>
Link: https://github.com/openwrt/openwrt/pull/21277
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 2ebcda1ea6b757864c4700e543a9767752ca766e)
Link: https://github.com/openwrt/openwrt/pull/23100
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit b76c38f9e2316e3ad125f6f2e4c7e27d025fad6e)
Drop HIDDEN option from U-Boot default for Airoha while support for ATF
gets pushed.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit cce81ed05bf944bb8188875757f2ab2ddfbfa4a8)
(cherry picked from commit c5de245171de11c694bb7720f5d30ab4467829ca)
Introduce support for U-Boot for Airoha EN7581/AN7583. For EN7581
initial patch are already in U-Boot mainline and doesn't require
backport, for AN7583 some patch are still pending but already posted
upstream.
Also add for now, precompiled binary for ATF BL2 and BL31. Support for
ATF is planned and will come later.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 04f6769a4a87ed6de4c8a875d35743ca1783e947)
(cherry picked from commit 507bd4c77520af2bf68406654b4b9e146c27b4a6)
Swig 4.3.0 has changed SWIG_Python_AppendOutput, which now requires an
additional parameter `is_void`. SWIG_AppendOutput remains unchanged.
This was fixed upstream in u-boot/u-boot@a63456b
```
scripts/dtc/pylibfdt/libfdt_wrap.c: In function '_wrap_fdt_next_node':
scripts/dtc/pylibfdt/libfdt_wrap.c:5581:17: error: too few arguments to function 'SWIG_Python_AppendOutput'
5581 | resultobj = SWIG_Python_AppendOutput(resultobj, val);
| ^~~~~~~~~~~~~~~~~~~~~~~~
```
This is the same fix as applied in 363e07d.
Signed-off-by: Trix Taiclet <git@trix.moe>
Link: https://github.com/openwrt/openwrt/pull/22870
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 9d0bafca525d8309b836e7fa1780f9decb3a0c20)
Swig 4.3.0 has changed SWIG_Python_AppendOutput, which now requires an
additional parameter `is_void`. SWIG_AppendOutput remains unchanged.
This was fixed upstream in u-boot/u-boot@a63456b
```
scripts/dtc/pylibfdt/libfdt_wrap.c: In function '_wrap_fdt_next_node':
scripts/dtc/pylibfdt/libfdt_wrap.c:5581:17: error: too few arguments to function 'SWIG_Python_AppendOutput'
5581 | resultobj = SWIG_Python_AppendOutput(resultobj, val);
| ^~~~~~~~~~~~~~~~~~~~~~~~
```
This is the same fix as applied in 363e07d.
Signed-off-by: Trix Taiclet <git@trix.moe>
Link: https://github.com/openwrt/openwrt/pull/22870
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 1e61a54d7224eaa5c5067ca9d0edd3c8374fe75f)
Cherry pick an upstream patch to fix a memory leak.
Fixed in OpenWrt main branch in commit
2c2cea8864db ("package: update jsonfilter to latest HEAD 2026-03-12")
Link: e086664e6a
Link: https://github.com/openwrt/openwrt/pull/22440
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 77d54cca84ffbb7754d592712ee96b0fcbff0d92)
Update procd cherry-picking fixes from main branch to dedicated
openwrt-24.10 backport branch.
c59f2d8 instance: don't print error in case cgroups are disabled
196291a instance: use positive error numbers for strerror()
d23ddec rcS, ubus: constify char * arguments and variables where appropriate
aeeef20 instance: use mkdir_p helper
d033b7c signal: handle SIGUSR1 as halt
8bc8377 cgroups: fix syntax error
909d02b instance: check length of names when creating cgroups
5ec782f procd: jail/cgroups: fix OOB write in cgroups_apply()
8581313 hotplug-dispatch: fix filter disallowing setting PATH
6265463 service instance: Improve handling of watchdog config changes
45bef92 service instance: Fix overwriting of watchdog linked list members
8294471 coldplug: fix missing header include
fb1c92b hotplug-dispatch: fix missing header include
6dafa86 initd/coldplug: create /dev/null before running udevtrigger
c268f13 hotplug-dispatch: redirect output to /dev/null
b8c4f86 hotplug-dispatch: use stat if d_type is DT_UNKNOWN
1f2aa1a system: fix arguments validation in ubus handler
7e5e049 service: fix use-after-free on service data update
3f48d76 instance: convert jail feature flags to bitmap
2c7c0d2 rcS: avoid duplicate pending "running" calls
5a9b16d service: re-run init script "running" command after instance restart
d5a45ff jail: fix NULL-pointer dereference when connection to ubus failed
8de8cdf jail: always handle mkdir() return value
fa594db jail: seccomp-oci: fix uninitialized pointer read in error path
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 3e77f8c7abdefa321f2fbc97a27e9d482789a183)
a52cdb354d13 dns: validate IPv4 record addresses
b798c24205b5 dns: validate IPv6 record addresses
a3dcb4adc635 dns: validate reverse dns query name lengths
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
(cherry picked from commit 8a7eb57ab8366045d7e1470c003827391e37684b)
(cherry picked from commit 68befe26ac033d7817014ff014e8eedc4c701360)
75bedc5 wireless-regdb: Update regulatory info for Australia (AU) for 2025
a6e5195 wireless-regdb: Update broken link in regulatory.bin(5) manpage
9e8c67f wireless-regdb: Update regulatory info for Malaysia (MY) for 2024
61a4637 wireless-regdb: Update regulatory info for Malaysia (MY) for 2025
5cefe55 wireless-regdb: Update regulatory info for Tunisia (TN) on 6GHz for 2025
1a729ae wireless-regdb: Update regulatory info for Canada (CA) for 2025
ea20dfa wireless-regdb: update regulatory database based on preceding changes
Link: https://github.com/openwrt/openwrt/pull/22150
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 7c5e329b541066613c09aafd89f7bb6cd8b3bc67)
(cherry picked from commit fb624926e3ed1165a40f07e9a47b6ea5ebacb487)
The shared reset procedure of MT7610 and MT7612 stop all queues before
starting the reset sequence.
They however never restart these like other supported mt76 chips
do in the reconfig_complete call. This leads to TX not continuing
after the reset.
Restart queues in the reconfig_complete callback to restore
functionality after the reset.
Signed-off-by: David Bauer <mail@david-bauer.net>
Link: https://patchwork.kernel.org/project/linux-wireless/patch/20251129023904.288484-1-mail@david-bauer.net/
(cherry picked from commit a89e40993bd2bbd79d5dcc70900f2eed7767e79d)
The Motorcomm YT8821 2.5G PHY is being used in some devices as an
alternative to devices like the RTL8221B. Package it as a kmod
so it can be used as a device package rather than requiring changes
to the target kernel config.
Signed-off-by: Andrew MacIntyre <andymac@pcug.org.au>
Link: https://github.com/openwrt/openwrt/pull/21399
(cherry picked from commit 96a133737433eca069e26b1730ea5a895b8f2fd8)
Signed-off-by: Jakub Vaněk <linuxtardis@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21531
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 194275c6f308ede252720c3ef7d3f485d997b15e)
Add a module for tpm-tis-spi for TCG TIS 1.3 TPM security chips
connected to a regular non-tcg SPI master.
Add imx target compatibility for kmod-tpm.
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Link: https://github.com/openwrt/openwrt/pull/21726
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 92a94dc9b0df12111e4c81ff1a280e32deb5eba3)
Link: https://github.com/openwrt/openwrt/pull/21781
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 7c22ba7b333eeea4725603a5d55d9dbef2860959)
OpenSSL 3.0.19 is a security patch release. The most severe CVE fixed
in this release is High.
This release incorporates the following bug fixes and mitigations:
* Fixed Stack buffer overflow in CMS AuthEnvelopedData parsing.
(CVE-2025-15467)
* Fixed Heap out-of-bounds write in BIO_f_linebuffer on short writes.
(CVE-2025-68160)
* Fixed Unauthenticated/unencrypted trailing bytes with low-level OCB
function calls. (CVE-2025-69418)
* Fixed Out of bounds write in PKCS12_get_friendlyname() UTF-8
conversion. (CVE-2025-69419)
* Fixed Missing ASN1_TYPE validation in TS_RESP_verify_response()
function. (CVE-2025-69420)
* Fixed NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex()
function. (CVE-2025-69421)
* Fixed Missing ASN1_TYPE validation in PKCS#12 parsing.
(CVE-2026-22795)
* Fixed ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes()
function. (CVE-2026-22796)
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Link: https://github.com/openwrt/openwrt/pull/21831
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 9237dea49e8f868b6c0408973c05e1acc4df4296)
Swig 4.3.0 has changed SWIG_Python_AppendOutput, which now requires an
additional parameter `is_void`. SWIG_AppendOutput remains unchanged.
This was fixed upstream in u-boot/u-boot@a63456b
```
scripts/dtc/pylibfdt/libfdt_wrap.c: In function ‘_wrap_fdt_next_node’:
scripts/dtc/pylibfdt/libfdt_wrap.c:5581:17: error: too few arguments to function ‘SWIG_Python_AppendOutput’
5581 | resultobj = SWIG_Python_AppendOutput(resultobj, val);
| ^~~~~~~~~~~~~~~~~~~~~~~~
```
This is the same fix as applied in 363e07d and 71b5de6.
This commit is not part of the main branch, as the main branch has
already bumped past 2025.01, removing the need for this patch.
uboot-rockchip had the patch removed as part of 92814fe, which was the
bump to 2025.01.
Signed-off-by: Trix Taiclet <git@trix.moe>
Link: https://github.com/openwrt/openwrt/pull/21415
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 94a54a1e03dd8ae03c7626f15939350fe2f2cf0c)
Swig 4.3.0 has changed SWIG_Python_AppendOutput, which now requires an
additional parameter `is_void`. SWIG_AppendOutput remains unchanged.
This was fixed upstream in u-boot/u-boot@a63456b
```
scripts/dtc/pylibfdt/libfdt_wrap.c: In function ‘_wrap_fdt_next_node’:
scripts/dtc/pylibfdt/libfdt_wrap.c:5581:17: error: too few arguments to function ‘SWIG_Python_AppendOutput’
5581 | resultobj = SWIG_Python_AppendOutput(resultobj, val);
| ^~~~~~~~~~~~~~~~~~~~~~~~
```
This is the same fix as applied in 363e07d.
Fixes: #20619
Link: #20620
Signed-off-by: Trix Taiclet <trix@c3l.lu>
Link: https://github.com/openwrt/openwrt/pull/20620
(cherry picked from commit 71b5de61aecf49ca1522b3f549631417c67e73d0)
Signed-off-by: Trix Taiclet <git@trix.moe>
Link: https://github.com/openwrt/openwrt/pull/21415
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 4327b82a7b4fd39f540169a20a364f572abfc35c)
Fixes the following error by backporting upstream update:
```
scripts/dtc/pylibfdt/libfdt_wrap.c: In function ‘_wrap_fdt_next_node’:
scripts/dtc/pylibfdt/libfdt_wrap.c:5581:17: error: too few arguments to function ‘SWIG_Python_AppendOutput’
5581 | resultobj = SWIG_Python_AppendOutput(resultobj, val);
| ^~~~~~~~~~~~~~~~~~~~~~~~
```
This is the same fix as applied in 4e68103c4eb9 ("uboot-rockchip: fix build with swig 4.3.0")
Link: https://github.com/openwrt/openwrt/pull/20538
(cherry picked from commit 363e07dfa2ec39756dad3ef9c955bc83b9e920c9)
Signed-off-by: Trix Taiclet <git@trix.moe>
Link: https://github.com/openwrt/openwrt/pull/21415
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 23180fbfaad6e202f2745e811175ec1625ea17d9)
