summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* opensc: Fix CVE-2023-40661virendra thakur2024-02-078-0/+245
| | | | | | | | | Add patch file to fix CVE Upstream-Status: Backport[https://salsa.debian.org/opensc-team/opensc/-/commit/8026fb4ca0ed53d970c6c497252eb264d4192d50] Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opensc: Fix CVE-2023-40660virendra thakur2024-02-072-0/+56
| | | | | | | | | Add patch file to fix CVE Upstream-Status: Backport [https://salsa.debian.org/opensc-team/opensc/-/commit/940e8bc764047c873f88bb1396933a5368d03533] Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* zabbix: fix CVE-2023-32726 and CVE-2023-32727Yogita Urade2024-02-074-0/+405
| | | | | | | | | | | | | | | | | | | | | | CVE-2023-32726: The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. CVE-2023-32727: An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server. Refernces: https://nvd.nist.gov/vuln/detail/CVE-2023-32726 https://security-tracker.debian.org/tracker/CVE-2023-32726 https://nvd.nist.gov/vuln/detail/CVE-2023-32727 https://security-tracker.debian.org/tracker/CVE-2023-32727 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: upgrade 3.8.5 -> 3.8.6Narpat Mali2024-02-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 3.8.5 & 3.8.6 contains the CVE-2023-47627 fix and other bugfixes. https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg Changelog: ---------- https://docs.aiohttp.org/en/stable/changes.html#id72 The git log --oneline v3.8.5..v3.8.6 shows: 996de262 (tag: v3.8.6) Release v3.8.6 (#7668) 8c128d4f [PR #7651/45f98b7d backport][3.8] Fix BadStatusLine message (#7666) 89b7df15 Allow lax response parsing on Py parser (#7663) (#7664) d5c12ba8 [PR #7661/85713a48 backport][3.8] Update Python parser for RFCs 9110/9112 (#7662) 8a3977ac [PR #7272/b2a7983a backport][3.8] Fix Read The Docs config (#7650) bcc416e5 [PR #7647/1303350e backport][3.8] Upgrade to llhttp 9.1.3 (#7648) b30c0cd2 Remove chardet/charset-normalizer. (#7589) 5946c743 CookieJar - return 'best-match' and not LIFO (#7577) (#7588) 8c4ec62f [PR #7518/8bd42e74 backport][3.8] Fix GunicornWebWorker max_requests_jitter not work (#7519) a0d234df Use lenient headers for response parser (#7490) (#7492) f92b27b0 Update to LLHTTP 9 (#7485) (#7487) 8129d26f [PR #7480/1fb06bbc backport][3.8] Fix error pointer on linebreaks (#7482) 8d701c3d Fix PermissionError when loading .netrc (#7237) (#7378) (#7395) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: fix CVE-2024-0208 GVCP dissector crashHitendra Prajapati2024-02-072-0/+43
| | | | | | | Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/a8586fde3a6512466afb2a660538ef3fe712076b Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* squid: Backport fix for CVE-2023-49285Vivek Kumbhar2024-02-072-0/+38
| | | | | | | Upstream-Status: Backport [https://github.com/squid-cache/squid/commit/77b3fb4df0f126784d5fd4967c28ed40eb8d521b] Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: Add libdevmapper-native PREFERRED_RPROVIDERJose Quaresma2024-02-071-0/+1
| | | | | | | | | | | | | | | | The libdevmapper recipe don't provide any package and is only there to resolve circular dependencies [1]. We already have the libdevmapper PREFERRED_RPROVIDER but the native it's missing. Fixes: | NOTE: Multiple providers are available for runtime libdevmapper-native (libdevmapper-native, lvm2-native) | Consider defining a PREFERRED_RPROVIDER entry to match libdevmapper-native [1] https://git.openembedded.org/meta-openembedded/commit/meta-oe/recipes-support/lvm2?id=3f64779eae2d8312f569bee863f90ec4f8176e6c Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* p7zip: fix CVE-2018-5996 & CVE-2016-9296Zahir Hussain2024-02-073-0/+260
| | | | | | | | | | | | | | References: https://nvd.nist.gov/vuln/detail/CVE-2018-5996 https://nvd.nist.gov/vuln/detail/CVE-2016-9296 Upstream patches: https://sources.debian.org/data/non-free/p/p7zip-rar/16.02-3/debian/patches/06-CVE-2018-5996.patch https://snapshot.debian.org/archive/debian-debug/20180205T215659Z/pool/main/p/p7zip/p7zip_16.02%2Bdfsg-6.debian.tar.xz Signed-off-by: Zahir Hussain <zahir.basha@kpit.com> Signed-off-by: aszh07 <mail2szahir@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* strongswan: upgrade 5.9.12 -> 5.9.13Wang Mingyu2024-02-051-1/+1
| | | | | | | | | | | | | | | Changelog: - Fixes a regression with handling OCSP error responses and adds a new option to specify the length of nonces in OCSP requests. Also adds some other improvements for OCSP handling and fuzzers for OCSP requests/responses. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5be2e20157f3025f9e2370933267a56fd526c58e) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit b135007c8ff43c18dd0593b5115d46dc6362675f) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* proftpd: Fix CVE-2023-51713 Out-of-bounds buffer readHitendra Prajapati2024-01-122-0/+278
| | | | | | | Upstream-Status: Backport from https://github.com/proftpd/proftpd/commit/97bbe68363ccf2de0c07f67170ec64a8b4d62592 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: upgrade 2.4.57 -> 2.4.58Narpat Mali2024-01-122-33/+1
| | | | | | | | | | | | | | | | | | | | This upgrade incorporates the CVE-2023-31122, CVE-2023-43622 & CVE-2023-45802 fixes and other bugfixes. The "0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch" is no longer needed as it's included in this upgrade. Changelog: https://downloads.apache.org/httpd/CHANGES_2.4.58 References: https://httpd.apache.org/security/vulnerabilities_24.html https://security-tracker.debian.org/tracker/CVE-2023-31122 https://security-tracker.debian.org/tracker/CVE-2023-43622 https://security-tracker.debian.org/tracker/CVE-2023-45802 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: add vendor to product name used for CVE checkingJeffrey Pautler2024-01-121-1/+1
| | | | | | | | | | | | | | This recipe sets the product name used for CVE checking to "http_server". However, the cve-check logic matches that name to all products in the CVE database regardless of vendor. Currently, it is matching to products from vendors other than apache. As a result, CVE checking incorrectly reports CVEs for those vendors' products for this package. Signed-off-by: Jeffrey Pautler <jeffrey.pautler@ni.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 51f70eaaa5973e385645f574093ee860f5648f88) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: fix CVE-2023-42669Archana Polampalli2024-01-122-0/+95
| | | | | | | | | | | | | | | | | | | | A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task. References: https://nvd.nist.gov/vuln/detail/CVE-2023-42669 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cjson: upgrade 1.7.15 -> 1.7.17Archana Polampalli2024-01-121-1/+1
| | | | | | | | | | | The following CVEs are addressed in this release. CVE-2023-50471 CVE-2023-50472 https://github.com/DaveGamble/cJSON/releases/tag/v1.7.17 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pillow: Fix CVE-2023-44271dnyandev2024-01-122-0/+157
| | | | | | | | | | Add patch to fix CVE-2023-44271 Reference: https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7 Signed-off-by: Dnyandev Padalkar <padalkards17082001@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* strongswan: upgrade 5.9.6 -> 5.9.12Archana Polampalli2024-01-121-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | * Drop backport patch 0001-enum-Fix-compiler-warning.patch. * Drop backport patch CVE-2022-40617.patch * Update RDEPENDS to fix strongswan startup failures: plugin 'mgf1': failed to load - mgf1_plugin_create not found and no plugin file available plugin 'fips-prf': failed to load - fips_prf_plugin_create not found and no plugin file available plugin 'kdf': failed to load - kdf_plugin_create not found and no plugin file available plugin 'drbg': failed to load - drbg_plugin_create not found and no plugin file available * Drop PACKAGECONFIG[scep] as scepclient has been removed. * Add plugin-gcm to RDEPENDS as gcm plugin has been added to the default plugins. ChangeLog: https://github.com/strongswan/strongswan/releases/tag/5.9.7 https://github.com/strongswan/strongswan/releases/tag/5.9.8 https://github.com/strongswan/strongswan/releases/tag/5.9.9 https://github.com/strongswan/strongswan/releases/tag/5.9.10 https://github.com/strongswan/strongswan/releases/tag/5.9.11 https://github.com/strongswan/strongswan/releases/tag/5.9.12 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: fix CVE-2022-4345 multiple (BPv6, OpenFlow, and Kafka protocol) ↵vkumbhar2024-01-122-0/+53
| | | | | | | | | dissector infinite loops Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/39db474f80af87449ce0f034522dccc80ed4153f Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: fix CVE-2023-1992 RPCoRDMA dissector crashvkumbhar2024-01-122-0/+62
| | | | | | | Upstream-Status: Backport from https://gitlab.com/colin.mcinnes/wireshark/-/commit/3c8be14c827f1587da3c2b3bb0d9c04faff5741 Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip3: Add py_ssize_t_clean argumentRob Woolley2024-01-122-0/+17681
| | | | | | | | | | | | | | An unintentional breakage was made upstream in sip4 which results in builds reporting: QtCoremod.sip:23: syntax error This was reported in Debian, but not resolved: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998605 A backport of a fix from the upstream project fixes the parser to prevent it from complaining about the syntax error. Signed-off-by: Rob Woolley <rob.woolley@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip3: Add sipconfig.pyRob Woolley2024-01-121-1/+18
| | | | | | | | | | | | Add the destdir option to ensure that sipconfig.py gets installed to the site-packages directory and included in python3-sip3. Remove references to the build paths from sipconfig.py as part of the install stage. One may then prepend STAGING_DIR_NATIVE to sip_bin and STAGING_DIR_TARGET to *_dir in any recipe that uses sipconfig.py. Signed-off-by: Rob Woolley <rob.woolley@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.5 -> 4.2.7Narpat Mali2024-01-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 4.2.5 and 4.2.7 contains the fixes for CVE-2023-43665, CVE-2023-46695 and other bugfixes. git log --oneline 4.2.5..4.2.7 shows: d254a54e7f (tag: 4.2.7) [4.2.x] Bumped version for 4.2.7 release. 048a9ebb6e [4.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows. 3fae5d92da [4.2.x] Refs #30601 -- Fixed typos in docs/topics/db/transactions.txt. a8aa94062b [4.2.x] Refs #15578 -- Made cosmetic edits to fixtures docs. 109f39a38b [4.2.x] Fixed #34932 -- Restored varchar_pattern_ops/text_pattern_ops index creation when deterministic collaction is set. 61612990d8 [4.2.x] Fixed typos in docs/ref/models/expressions.txt. 696fbc32d6 [4.2.x] Fixed #30601 -- Doc'd the need to manually revert all app state on transaction rollbacks. ffba63180c [4.2.x] Fixed typo in docs/ref/contrib/gis/geos.txt. 43a3646070 [4.2.x] Fixed #15578 -- Stated the processing order of fixtures in the fixtures docs. 0cd8b867a0 [4.2.x] Added stub release notes and release date for 4.2.7, 4.1.13, and 3.2.23. 510a512119 [4.2.x] Fixed typo in docs/releases/4.2.txt. b644f8bc1f [4.2.x] Corrected note about using accents in writing documentation contributing guide. a576ef98ae [4.2.x] Refs #34900, Refs #34118 -- Updated assertion in test_skip_class_unless_db_feature() test on Python 3.12.1+. 803caec60b [4.2.x] Fixed #34798 -- Fixed QuerySet.aggregate() crash when referencing expressions containing subqueries. caec4f4a6f [4.2.x] Refs #34840 -- Improved release note describing index regression. b6bb2f8099 [4.2.x] Refs #34840 -- Fixed test_validate_nullable_textfield_with_isnull_true() on databases that don's support table check constraints. e8fe48d3a0 [4.2.x] Fixed #34808 -- Doc'd aggregate function's default argument. 830990fa6c [4.2.x] Reorganized tutorial's part 4 to better understand changes needed in URLConf. 0cbc92bc3a [4.2.x] Refs #26029 -- Improved get_storage_class() deprecation warning with stacklevel=2. 9c7627da30 [4.2.x] Refs #34043 -- Clarified how to test UI changes. 0bd53ab86a [4.2.x] Added backticks to setuptools in docs. 99dcba90b4 [4.2.x] Refs #32275 -- Added scrypt password hasher to PASSWORD_HASHERS setting docs. 6697880219 [4.2.x] Refs #31435 -- Doc'd potential infinite recursion when accessing model fields in __init__. a9a3317a95 [4.2.x] Corrected wrap_socket() reference in docs/ref/settings.txt. 9962f94a97 [4.2.x] Added CVE-2023-43665 to security archive. b2d95bb301 [4.2.x] Added stub release notes for 4.2.7. 08d54f83a9 [4.2.x] Post release version bump. c22017bd1d (tag: 4.2.6) [4.2.x] Bumped version for 4.2.6 release. be9c27c4d1 [4.2.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in django.utils.text.Truncator when truncating HTML text. 39fc3f46a8 [4.2.x] Added stub release notes and release date for 4.2.6, 4.1.12, and 3.2.22. dd0bf63d3e [4.2.x] Added warning about flatpages and untrusted users. fec4ed0a25 [4.2.x] Refs #34320 -- Skipped SchemaTests.test_rename_field_with_check_to_truncated_name on MariaBD 10.5.2+. a148461f1f [4.2.x] Fixed #34840 -- Avoided casting string base fields on PostgreSQL. b08f53ff46 [4.2.x] Refs #34808 -- Doc'd that aggregation functions on empty groups can return None. c70f08c4aa [4.2.x] Added updating the Django release process on Trac to release steps. d485aa2732 [4.2.x] Fixed typo in docs/howto/custom-file-storage.txt. ff26e6ad84 [4.2.x] Corrected QuerySet.prefetch_related() note about GenericRelation(). 866122690d [4.2.x] Doc'd HttpResponse.cookies. 97e8a2afb1 [4.2.x] Fixed #34821 -- Prevented DEFAULT_FILE_STORAGE/STATICFILES_STORAGE settings from mutating the main STORAGES. 39cb3b08bc [4.2.x] Bumped checkout version in Github actions configuration. 592ebd8920 [4.2.x] Added stub release notes for 4.2.6. a1dd785139 [4.2.x] Added CVE-2023-41164 to security archive. a9686cb871 [4.2.x] Post-release version bump. Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.7/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 3.2.21 -> 3.2.23Narpat Mali2024-01-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | The delta between 3.2.21 and 3.2.23 contains the fixes for CVE-2023-43665, CVE-2023-46695 and other bugfixes. git log --oneline 3.2.21..3.2.23 shows: 60e648a7ae (tag: 3.2.23) [3.2.x] Bumped version for 3.2.23 release. f9a7fb8466 [3.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows. e6d2591d9e [3.2.x] Added stub release notes for 3.2.23. 3c04b74293 [3.2.x] Added CVE-2023-43665 to security archive. 86a14d653f [3.2.x] Post release version bump. 3106e94e52 (tag: 3.2.22) [3.2.x] Bumped version for 3.2.22 release. ccdade1a02 [3.2.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in django.utils.text.Truncator when truncating HTML text. 6caf7b313d [3.2.x] Added stub release notes for 3.2.22. 9e814c3a5e [3.2.x] Added CVE-2023-41164 to security archive. 4b439dcd05 [3.2.x] Post-release version bump. Release Notes: https://docs.djangoproject.com/en/dev/releases/3.2.23/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix for CVE-2023-43665 and CVE-2023-46695Narpat Mali2024-01-123-0/+291
| | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-43665: In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. CVE-2023-46695: An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. References: https://www.djangoproject.com/weblog/2023/oct/04/security-releases/ https://www.djangoproject.com/weblog/2023/nov/01/security-releases/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* glmark2: inherit python3native to fix build with python-3.12 on build hostMartin Jansa2024-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fixes: | WARNING: Unable to execute waf --version, exit code 1. Assuming waf version without bindir/libdir support. | DEBUG: Python function waf_preconfigure finished | DEBUG: Executing shell function do_configure | Traceback (most recent call last): | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/./waf", line 163, in <module> | from waflib import Scripting | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Scripting.py", line 6, in <module> | from waflib import Utils,Configure,Logs,Options,ConfigSet,Context,Errors,Build,Node | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Configure.py", line 6, in <module> | from waflib import ConfigSet,Utils,Options,Logs,Context,Build,Errors | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Options.py", line 6, in <module> | from waflib import Logs,Utils,Context,Errors | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Context.py", line 5, in <module> | import os,re,imp,sys | ModuleNotFoundError: No module named 'imp' | WARNING: /OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/temp/run.do_configure.1263276:146 exit 1 from 'waf_do_configure' * this first issue can be fixed easily by backporting: https://gitlab.com/ita1024/waf/-/commit/d2060dfd8af4edb5824153ff24e207b39ecd67a2 * but then it still fails a bit later, because of SyntaxWarning in waf --version output: ERROR: glmark2-2021.12-r0 do_configure: Error executing a python function in exec_func_python() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_func_python() autogenerated', lineno: 2, function: <module> 0001: *** 0002:waf_preconfigure(d) 0003: File: '/OE/build/luneos-kirkstone/openembedded-core/meta/classes/waf.bbclass', lineno: 52, function: waf_preconfigure 0048: wafbin = os.path.join(subsrcdir, 'waf') 0049: try: 0050: result = subprocess.check_output([python, wafbin, '--version'], cwd=subsrcdir, stderr=subprocess.STDOUT) 0051: version = result.decode('utf-8').split()[1] *** 0052: if bb.utils.vercmp_string_op(version, "1.8.7", ">="): 0053: d.setVar("WAF_EXTRA_CONF", "--bindir=${bindir} --libdir=${libdir}") 0054: except subprocess.CalledProcessError as e: 0055: bb.warn("Unable to execute waf --version, exit code %d. Assuming waf version without bindir/libdir support." % e.returncode) 0056: except FileNotFoundError: File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 148, function: vercmp_string_op 0144: Compare two versions and check if the specified comparison operator matches the result of the comparison. 0145: This function is fairly liberal about what operators it will accept since there are a variety of styles 0146: depending on the context. 0147: """ *** 0148: res = vercmp_string(a, b) 0149: if op in ('=', '=='): 0150: return res == 0 0151: elif op == '<=': 0152: return res <= 0 File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 138, function: vercmp_string 0134: return r 0135: 0136:def vercmp_string(a, b): 0137: """ Split version strings and compare them """ *** 0138: ta = split_version(a) 0139: tb = split_version(b) 0140: return vercmp(ta, tb) 0141: 0142:def vercmp_string_op(a, b, op): File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 89, function: split_version 0085: """Split a version string into its constituent parts (PE, PV, PR)""" 0086: s = s.strip(" <>=") 0087: e = 0 0088: if s.count(':'): *** 0089: e = int(s.split(":")[0]) 0090: s = s.split(":")[1] 0091: r = "" 0092: if s.count('-'): 0093: r = s.rsplit("-", 1)[1] Exception: ValueError: invalid literal for int() with base 10: 'SyntaxWarning' ERROR: Logfile of failure stored in: /OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/temp/log.do_configure.1264918 so it's safer to just use python3-native everywhere, instead of more patches for waf Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libbytesize: update github branch to 'main'Wentao Zhang2024-01-121-1/+1
| | | | | | | | | the repo of libbytesize doesn't have a branch named master. Change the branch from master to main. Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> Signed-off-by: Wentao Zhang <wentao.zhang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* yasm: fix CVE-2023-37732Soumya2024-01-122-0/+42
| | | | | | | | | | | | | | | Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attacker to cause a denial of service via a crafted file. References: https://github.com/yasm/yasm/issues/233 https://nvd.nist.gov/vuln/detail/CVE-2023-37732 Signed-off-by: Soumya <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 41fffef6b044b2722aa13f7e7648a3f848231851) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* squid: fix CVE-2023-46847 Denial of Service in HTTP Digest Authenticationvkumbhar2023-12-132-0/+48
| | | | | Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: fix CVE-2023-5868 CVE-2023-5869 CVE-2023-5870Yogita Urade2023-12-134-0/+530
| | | | | | | | | | | | | | | | | | | | | | CVE-2023-5868: postgresql: Compute aggregate argument types correctly in transformAggregateCall() CVE-2023-5869: postgresql: Detect integer overflow while computing new array dimensions CVE-2023-5870: postgresql: Ban role pg_signal_backend from more superuser backend types. References: https://nvd.nist.gov/vuln/detail/CVE-2023-5868 https://nvd.nist.gov/vuln/detail/CVE-2023-5869 https://nvd.nist.gov/vuln/detail/CVE-2023-5870 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: Mitigate HTTP/2 Stream Resets Flood impactJasper Orschulko2023-12-133-0/+95
| | | | | | | | | | | | | | | | Reduces the impact of HTTP/2 Stream Reset flooding in the nginx product (CVE-2023-44487). See: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ This patch only reduces the impact and does not completely mitigate the CVE in question, the latter being due to a design flaw in the HTTP/2 protocol itself. For transparancy reasons I therefore opted to not mark the CVE as resolved, so that integrators can decide for themselves, wheither to enable HTTP/2 support or allow HTTP/1.1 connections only. Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-gcovr: switch to main branchChristian Eggers2023-12-131-1/+1
| | | | | | | Branch "master" has been renamed to "main". Signed-off-by: Christian Eggers <ceggers@arri.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: fix CVE-2023-4091Archana Polampalli2023-12-133-0/+254
| | | | | | | | | | | | | | | | | | | | | | | | | A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions. References: https://nvd.nist.gov/vuln/detail/CVE-2023-4091 Fix is patched to the function call smbd_check_access_rights_fsp() of open_file(), But in samba_4.14.14 smbd_check_access_rights() is used, from samba_4.15.0 onwards smbd_check_access_rights() was replaced with smbd_check_access_rights_fsp() and samba_4.14.14 is still vulnerable through smbd_check_access_rights(). Ref: https://github.com/samba-team/samba/commit/3f61369d153419158c0f223e6f81c0bb07275833 https://github.com/samba-team/samba/commit/26dc10bdb2cff3eece4a2874931b4058f9f87d68 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sdbus-c++: Update ptest pathPoonam Jadhav2023-12-131-1/+6
| | | | | | | Update ptest path to run sdbus-c++ ptest Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* frr: Fix for multiple CVE'sNarpat Mali2023-12-137-0/+569
| | | | | | | | | | | | | Backport the below CVE fixes. CVE-2023-38406: https://security-tracker.debian.org/tracker/CVE-2023-38406 CVE-2023-38407: https://security-tracker.debian.org/tracker/CVE-2023-38407 CVE-2023-46752: https://security-tracker.debian.org/tracker/CVE-2023-46752 CVE-2023-46753: https://security-tracker.debian.org/tracker/CVE-2023-46753 CVE-2023-47234: https://security-tracker.debian.org/tracker/CVE-2023-47234 CVE-2023-47235: https://security-tracker.debian.org/tracker/CVE-2023-47235 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: upgrade to 1.24.0 releaseMichael Haener2023-11-181-0/+6
| | | | | | | | | | According to http://nginx.org/en/CHANGES nginx supports the openssl 3.x component only from version 1.21.2. In Kirstone openssl 3.x is included but all provided versions of nginx are older, so there is currently an incompatibility. With this patch this incompatibility get removed. Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-python: Drop broken BBCLASSEXTEND variantsRichard Purdie2023-11-187-13/+1
| | | | | | | | | | | | | | | | | | | | | | | | The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d4aa17dc436beb96a804860bc6d18cf72283709e) Backport: * Adapted paths to follow PV changes * Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-cson: fix run-time dependenciesBartosz Golaszewski2023-11-181-2/+1
| | | | | | | | | | | Add the missing run-time dependency on python3-json. As a result we no longer need to pull python3 native and can drop other *DEPENDS. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 40b4cf5a83098a5f1be873be5c29f26380bc7993) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-oe: Drop broken BBCLASSEXTEND variantsRichard Purdie2023-11-177-11/+2
| | | | | | | | | | | | | | | | | | | | | | | | The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9962d57f7c235873de0a0bb192b5f56747762fc7) Backport: * Updated paths to follow PV changes * Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libwebsockets: Support building for nativePeter Kjellerstedt2023-11-171-0/+3
| | | | | | | | | | | | | | | | | This is needed to be able to build mosquitto-native. The dependency on libcap when building for native is needed because cmake will pick up the existence of libcap from the host, but then the build fails if it is not available in the sysroot. Unfortunately, there does not seem to be any way to explicitly tell cmake to not build with libcap. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c083e0569ad80d11b4f5cfdfa89acdd4264d8152) Backported: Updated paths to follow PV changes. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-meta-oe-extended: RDEPENDS on an existing mozjs-91 packageYoann Congal2023-11-171-1/+1
| | | | | | | "mozjs" does not exist but "mozjs-91" does. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-networking: Drop broken BBCLASSEXTEND variantsRichard Purdie2023-11-172-2/+2
| | | | | | | | | | | | | | | | | | | | | | The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e1b332f2eff7df2336ff87917cd48249edf763a2) Backport: Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-perl: Drop broken BBCLASSEXTEND variantsRichard Purdie2023-11-175-9/+1
| | | | | | | | | | | | | | | | | | | | | | | | The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 79e0a9d237343ad0af0a40128494155ccaa131ec) Backported: * Adapted paths to follow PV changes * Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-soupsieve: Break circular dependency with beautifulsoup4Yoann Congal2023-11-171-4/+0
| | | | | | | | python3-beautifulsoup4 does depend on python3-soupsieve but python3-soupsieve does not depend on python3-beautifulsoup4. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nlohmann-json: Add ptest supportMingli Yu2023-11-152-3/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Fetch the test data during do_fetch phase to avoid internet access during test as some tests need test data. # ./run-ptest PASS: test-algorithms PASS: test-allocator PASS: test-alt-string PASS: test-assert_macro PASS: test-bson PASS: test-byte_container_with_subtype PASS: test-capacity PASS: test-cbor PASS: test-class_const_iterator PASS: test-class_iterator PASS: test-class_lexer PASS: test-class_parser PASS: test-comparison PASS: test-concepts PASS: test-constructor1 PASS: test-constructor2 PASS: test-convenience PASS: test-conversions PASS: test-conversions_cpp17 PASS: test-deserialization PASS: test-diagnostics PASS: test-disabled_exceptions PASS: test-element_access1 PASS: test-element_access2 PASS: test-hash PASS: test-inspection PASS: test-items PASS: test-items_cpp17 PASS: test-iterators1 PASS: test-iterators2 PASS: test-json_patch PASS: test-json_pointer PASS: test-large_json PASS: test-merge_patch PASS: test-meta PASS: test-modifiers PASS: test-msgpack PASS: test-noexcept PASS: test-ordered_json PASS: test-ordered_map PASS: test-pointer_access PASS: test-readme PASS: test-reference_access PASS: test-regression1 PASS: test-regression1_cpp17 PASS: test-regression2 PASS: test-regression2_cpp17 PASS: test-serialization PASS: test-testsuites PASS: test-to_chars PASS: test-ubjson PASS: test-udt PASS: test-udt_macro PASS: test-unicode1 PASS: test-unicode2 PASS: test-unicode3 PASS: test-unicode4 PASS: test-unicode5 PASS: test-user_defined_input PASS: test-wstring Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* traceroute: upgrade 2.1.0 -> 2.1.3Narpat Mali2023-11-141-2/+1
| | | | | | | | | | | | | | | | | | This upgrade incorporates the CVE-2023-46316 fix and other bug fixes. Changelog: ---------- - Interpret ipv4-mapped ipv6 addresses (::ffff:A.B.C.D) as true ipv4. - Return back more robast poll(2) loop handling. - Fix unprivileged ICMP tracerouting with Linux kernel >= 6.1 (Eric Dumazet, SF bug #14) - Fix command line parsing in wrappers. References: https://security-tracker.debian.org/tracker/CVE-2023-46316 https://sourceforge.net/projects/traceroute/files/traceroute/traceroute-2.1.3/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* emlog: ignore CVE-2022-3968 & CVE-2023-43291Yoann Congal2023-11-141-0/+2
| | | | | | | | CVE-2022-3968 & CVE-2023-43291 apply to the other "emlog" and can be safely ignored. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* emlog: Add PVKhem Raj2023-11-141-1/+1
| | | | | | | | | This is 0.70 release with few more commits on top. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 08edc0b6ace0d04688a5617cf05546a7b8ba6cca) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* open-vm-tools: fix CVE-2023-34058Archana Polampalli2023-11-142-0/+242
| | | | | | | | | | | | | | A flaw was found in open-vm-tools. This flaw allows a malicious actor that has been granted Guest Operation Privileges in a target virtual machine to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-34058 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> [minor fixup] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* open-vm-tools: fix CVE-2023-20900Narpat Mali2023-11-142-0/+37
| | | | | | | | | | | | | | | | | | A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID -6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download. vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31 e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . References: https://nvd.nist.gov/vuln/detail/CVE-2023-20900 https://security-tracker.debian.org/tracker/CVE-2023-20900 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> [Minor fixup] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* indent: fix CVE-2023-40305stable/kirkstone-nutYogita Urade2023-11-033-0/+8452
| | | | | | | | | | | GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file. Reference: https://savannah.gnu.org/bugs/index.php?64503 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-meta-multimedia: restore x11 restriction for projucerMartin Jansa2023-11-031-1/+1
| | | | | | | | | | | | | * it was removed in: https://git.openembedded.org/meta-openembedded/commit/?id=deb11a823c32d4090b3724a589641810e06df6bc * but still needed as shown in world build without x11 in DISTRO_FEATURES: ERROR: Nothing RPROVIDES 'projucer' (but /OE/build/luneos-nanbield/meta-openembedded/meta-multimedia/recipes-multimedia/packagegroups/packagegroup-meta-multimedia.bb RDEPENDS on or otherwise requires it) projucer was skipped: missing required distro feature 'x11' (not in DISTRO_FEATURES) NOTE: Runtime target 'projucer' is unbuildable, removing... Missing or unbuildable dependency chain was: ['projucer'] Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-10 09:28:06 +0000