summaryrefslogtreecommitdiffstats
path: root/meta-webserver
Commit message (Collapse)AuthorAgeFilesLines
* apache2: ignore CVE-1999-1237Peter Marko2024-12-241-0/+1
| | | | | | | | | | | | | | | This vulnerability is for Apache-AuthenSmb module. Fixed in 0.9, current version is 0.72. In any case, not part of Apache2 sources. [1] points to [2], which is archived under [3] [1] https://nvd.nist.gov/vuln/detail/CVE-1999-1237 [2] http://www.securityfocus.com/archive/1/14384 [3] https://web.archive.org/web/20020618143426/http://online.securityfocus.com/archive/1/14384 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: mark CVE-2016-1000229 as fixedPeter Marko2024-12-191-0/+2
| | | | | | | | as per https://github.com/swagger-api/swagger-ui/issues/1865 NVD tracks this CVE as version-less. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore disputed CVE CVE-2007-0086Peter Marko2024-12-191-0/+1
| | | | | | | | | | | | | | | | This CVE is officially disputed by Redhat with official statement in https://nvd.nist.gov/vuln/detail/CVE-2007-0086 Red Hat does not consider this issue to be a security vulnerability. The pottential attacker has to send acknowledgement packets periodically to make server generate traffic. Exactly the same effect could be achieved by simply downloading the file. The statement that setting the TCP window size to arbitrarily high value would permit the attacker to disconnect and stop sending ACKs is false, because Red Hat Enterprise Linux limits the size of the TCP send buffer to 4MB by default. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* monkey: ignore CVE-2013-1771Peter Marko2024-12-191-0/+1
| | | | | | | | This is gentoo specific CVE. NVD tracks this as version-less CVE. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: remove old version references from CVEsPeter Marko2024-12-191-7/+7
| | | | | | | | These were not updated on recipe upgrade. To make maintenance easier, remove exact versions. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: ignore CVE-1999-0678 and CVE-1999-1412Peter Marko2024-12-191-0/+2
| | | | | | | These CVEs are specific to Debian and MAC OS X respectively. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Upgrade mainline release version 1.27.1 -> 1.27.3Derek Straka2024-12-101-2/+2
| | | | | | | License-Update: License file negative and empty space changes Signed-off-by: Derek Straka <derek@asterius.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* meta: Add SECURITY.md file to all layersKhem Raj2024-11-231-0/+20
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: upgrade 5.17.14 -> 5.18.2Wang Mingyu2024-11-191-1/+1
| | | | | | | | | | | Changelog: ============= - update Scarf.js to v1.4.0 to avoid breaking Vitest - docker: return explicit Node.js installation - analytics: use Scarf.js to provide anonymized installation analytics Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: WebUI choice between all (default), v0, v1 or v2Jan Vermaete2024-11-051-0/+20
| | | | | | | | | | | | | Added a PACKAGECONFIG to select the version of the WebUI to be installed. When not set, all versions (v0, v1 and v2) will be installed. What is the default of Netdata. Enabling only the v1 version makes the package 25% smaller. More info: https://github.com/netdata/netdata/issues/15640#issuecomment-1946041083 Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: Upgrade from 1.47.3 to 1.47.5 releaseJan Vermaete2024-11-023-71/+13
| | | | | | | | | | | | * 0001-Add-check-for-64bit-builtin-atomics.patch applied upstream * removed not longer used systemd service file The service of the netdata is used in previous commit(s) * oelint_adv issues solved Changlog: https://github.com/netdata/netdata/blob/master/CHANGELOG.md#v1475-2024-10-24 Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* swagger-ui: OpenAPI (aka swagger) website (v5.17.14)Jan Vermaete2024-10-301-0/+22
| | | | | | | | | | | | | | | | | | | | New recipe with the static version of the Swagger UI. This is *not* a NPM version of the website (swagger-ui, swagger-ui-dist, swagger-ui-react). But the static release. Plain old HTML/CSS/JS (Standalone) The folder /dist includes all the HTML, CSS and JS files needed to run SwaggerUI on a static website or CMS, without requiring NPM. Download the latest release. Copy the contents of the /dist folder to your server. Open swagger-initializer.js in your text editor and replace "https://petstore.swagger.io/v2/swagger.json" with the URL for your OpenAPI 3.0 spec. -- https://github.com/swagger-api/swagger-ui/blob/HEAD/docs/usage/installation.md#plain-old-htmlcssjs-standalone Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: add RDEPENDS to the docker PACKAGECONFIGTanguy Raufflet2024-10-241-1/+1
| | | | | | | | Add the runtime dependency Virtual/docker need when the package config Docker is enabled. This avoids do_rootfs installs issues. Signed-off-by: Tanguy Raufflet <tanguy.raufflet@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: add setuid to the xenstat plugin fileTanguy Raufflet2024-10-241-0/+6
| | | | | | | | | | | | As mentioned in the Netdata documentation [1], The xenstat plugin requires elevated privileges to be executed. The xenstat.plugin permissions are modified to only allow users belonging to the netdata group to execute the plugin with root privileges. [1] https://learn.netdata.cloud/docs/collecting-metrics/containers-and-vms/xen-xcp-ng Signed-off-by: Tanguy Raufflet <tanguy.raufflet@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: modify apps.plugin permissionsTanguy Raufflet2024-10-241-1/+2
| | | | | | | | | | | Modification of the group for the apps.plugin file (from root to netdata) and removal of execution authorization for the “others”. This modification improves security by limiting the netdata group to execute the plugin as root. Signed-off-by: Tanguy Raufflet <tanguy.raufflet@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: do not depend on zlib header and libs from hostValeria Petrov2024-10-091-1/+1
| | | | | | | | | | | | | | | | | This commit modifies the PACKAGECONFIG entry for zlib to ensure that the mod_deflate module is enabled with the appropriate zlib configuration. By adding the --with-zlib=${STAGING_LIBDIR}/../ option, we direct the configure script to use the zlib library from the staging directory instead of relying on the host system's zlib installation. Without that configure will search the host for zlib headers and lib. This change resolves build failures related to zlib dependency when mod_deflate is enabled and ensures a consistent build environment across different host configurations. Signed-off-by: Valeria Petrov <valeria.petrov@spinetix.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: Upgrade to 1.47.3 releaseKhem Raj2024-10-043-24/+22
| | | | | | Update the atomics patch to v2 of upstream submission Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: add go plugin PACKAGECONFIGEnguerrand de Ribaucourt2024-10-022-2/+27
| | | | | | | | Many netdata plugins are written in go, add a PACKAGECONFIG to enable them. Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: refresh netdata.confEnguerrand de Ribaucourt2024-10-022-5034/+645
| | | | | | | | | | | | | Our provided netdata.conf contained a lot of keys which are no longer supported by netdata. Netdata allows to regenerate the configuration file and present all possible keys with their default values. This refreshed file will be more easy to configure by our users. To generate this file, I basically ran the documented command and replaced the file paths with our variables when applicable. Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: use builtin packaging service filesEnguerrand de Ribaucourt2024-10-022-9/+49
| | | | | | | | | | | | Netdata now provides its own systemd service files. They provide better hardening than the one we were defining in the recipe. Unfortunately, the CMakeLists.txt file wants to install them into /lib rather than /usr/lib. I added mv commands to put them in the expected location depending on usrmerge. Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: add docker PACKAGECONFIGEnguerrand de Ribaucourt2024-10-021-1/+3
| | | | | | | | Some netdata plugins like cgroups or docker require permissions to access the docker socket in order to label data properly. Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* layer.conf: Update to walnascar (5.2) layer/release seriesKhem Raj2024-10-011-1/+1
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* cherokee: Remove obsolete recipeNiko Mauno2024-09-308-268/+0
| | | | | | | | | | | | | | | | | | | | This recipe depends on meta-python2, master branch of which has not been updated sine February 2022, see https://git.openembedded.org/meta-python2/log/?h=master Also, https://cherokee-project.com/doc/basics_requirements.html states The main Python releases targeted by our developers are 2.4, 2.5 and 2.6. Anything other than that is not guaranteed to work at the moment. Also, master branch of cherokee has not been updated since January 2023, see https://github.com/cherokee/webserver/commits/master/ Thus, remove the obsolete recipe and the associated packagegroup reference. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Upgrade mainline 1.25.3 -> 1.27.1Peter Marko2024-09-172-10/+10
| | | | | | | | | | | | | | | | Solves: * CVE-2024-7347 * CVE-2024-24989 * CVE-2024-24990 * CVE-2024-31079 * CVE-2024-32760 * CVE-2024-34161 * CVE-2024-35200 License-Update: copyright year refreshed Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Upgrade stable 1.26.0 -> 1.26.2Peter Marko2024-09-171-1/+1
| | | | | | | | | | | | Solves: * CVE-2024-7347 * CVE-2024-31079 * CVE-2024-32760 * CVE-2024-34161 * CVE-2024-35200 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: Add checks for 64-bit atomic builtinsKhem Raj2024-09-172-0/+52
| | | | | | This helps in passing correct flags to h2o module compilation Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: version bump 1.47.0 -> 1.47.1Jan Vermaete2024-09-141-1/+1
| | | | | Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* netdata: Upgrade to 1.47.0Khem Raj2024-09-092-9/+25
| | | | | | | Disable go plugins as we need some work to enable them. Convert to cmake build system Signed-off-by: Khem Raj <raj.khem@gmail.com>
* webmin: upgrade 2.111 -> 2.202J. S.2024-08-212-2/+2
| | | | | | | | | | | | | | | | commit f6d27810b4f48562a06ce5006b1559378f30c99c Author: Jason Schonberg <schonm@gmail.com> Date: Mon Aug 19 00:26:48 2024 -0400 Changelog: https://webmin.com/changelog/webmin-2.202-released/ Modified net-generic.patch to update a hardcoded version number to avoid patch fuzz. webmin: upgrade 2.111 -> 2.202 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: upgrade 2.4.61 -> 2.4.62Wang Mingyu2024-08-094-19/+11
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: add PACKAGECONFIG knobs for fastcgi, scgi and uwsgiMaxin John2024-07-231-5/+19
| | | | | | | | fastcgi, scgi and uwsgi are enabled by default in nginx. Provide an option to disable these features (that reduces binary size by 8%). Signed-off-by: Maxin John <maxin.john@gehealthcare.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: use update-alternatives for httpdTrevor Woerner2024-07-181-0/+4
| | | | | | | | | | | | | | | | | Busybox can optionally provide an httpd server, but by default The Yocto Project defconfig for busybox does not enable it. If it is enabled, busybox puts the resulting /usr/sbin/httpd object under the control of update-alternatives. apache2, on the other hand, does not put /usr/sbin/httpd under the control of update-alternatives. Therefore, in the off chance a user enables the busybox httpd server, it does not play well with apache2. Add update-alternatives information to apache2 so that it plays nicely with busybox which can optionally provide an httpd server at /usr/sbin/httpd. Signed-off-by: Trevor Woerner <twoerner@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: Upgrade 2.4.60 -> 2.4.61Archana Polampalli2024-07-161-1/+1
| | | | | | | | | | | | Security fixes: CVE-2024-39884 Apache HTTP Server: source code disclosure with handlers configured via AddType Changelog: https://github.com/apache/httpd/blob/2.4.61/CHANGES https://httpd.apache.org/security/vulnerabilities_24.html Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* webmin: Upgrade to 2.111 releaseKhem Raj2024-07-147-106/+51
| | | | | | | | Drop remove-python2.3.patch since corresponding script is gone License-Update: Formatting changes Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2:apache2-native: sort CVE statusalba@thehoodiefirm.com2024-07-041-2/+2
| | | | | Signed-off-by: Alba Herrerías <alba@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: Update CVE statusNinette Adhikari2024-07-031-0/+3
| | | | | | | | | Update CVE status for: CVE-1999-0289, CVE-2007-0450, CVE-2010-0425 The current version (2.4.6) is not affected. It only applies for Windows. Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* monkey: Update status for CVE-2013-2183Ninette Adhikari2024-07-031-0/+1
| | | | | | | Current version (1.6.9) is not affected. Issue was addressed in version 1.3.0 Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: Upgrade 2.4.59 -> 2.4.60Siddharth Doshi2024-07-021-1/+1
| | | | | | | | | | | | | | | | | | | CVE's Fixed by upgrade: CVE-2024-36387 apache2/httpd: DoS by null pointer in websocket over HTTP/2 CVE-2024-38472 apache2/httpd: UNC SSRF on WIndows CVE-2024-38473 apache2/httpd: Encoding problem in mod_proxy CVE-2024-38474 apache2/httpd: Substitution encoding issue in mod_rewrite CVE-2024-38475 apache2/httpd: Improper escaping of output in mod_rewrite CVE-2024-38476 apache2/httpd: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect CVE-2024-38477 apache2/httpd: null pointer dereference in mod_proxy CVE-2024-39573 apache2/httpd: Potential SSRF in mod_rewrite Other Changes between 2.4.59 -> 2.4.60 ====================================== https://github.com/apache/httpd/blob/2.4.60/CHANGES Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2:apache2-native: CVE status updateNinette Adhikari2024-06-281-0/+5
| | | | | | | | | | Update status for: CVE-2007-6421, CVE-2007-6422, CVE-2007-6423, CVE-2008-2168 CPE is incorrect, the current version (2.4.59) is not affected. Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* layers: stop declaring compatibility with scarthgapDmitry Baryshkov2024-05-281-1/+1
| | | | | | | | | With the UNPACKDIR changes in place the layers are no longer compatible with the scarthgap release. Drop it from LAYERSERIES_COMPAT and limit compatibility to styhead only. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: fix multilib file conflictsKai Kang2024-05-231-14/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are file conflicts of apache2 when multilib enabled: Error: Transaction test error: file /usr/share/apache2/build/config.nice conflicts between attempted installs of apache2-dev-2.4.58-r0.cortexa57 and lib32-apache2-dev-2.4.58-r0.armv7vet2hf_vfp file /usr/share/apache2/build/config_vars.mk conflicts between attempted installs of apache2-dev-2.4.58-r0.cortexa57 and lib32-apache2-dev-2.4.58-r0.armv7vet2hf_vfp Install the 'build' directory to ${libexecdir} by setting 'installbuilddir' to fix the conflicts. ${libexecdir} is not populated to sysroot by default, but command apxs requires these files, then add the dir to SYSROOT_DIRS to populate them. And inherit bbclasses multilib_script and multilib_header to fix follow-up conflicts: file /usr/bin/apxs conflicts between attempted installs of apache2-dev-2.4.58-r0.cortexa57 and lib32-apache2-dev-2.4.58-r0.armv7vet2hf_vfp file /usr/include/apache2/ap_config_layout.h conflicts between attempted installs of apache2-dev-2.4.58-r0.cortexa57 and lib32-apache2-dev-2.4.58-r0.armv7vet2hf_vfp Since multilib_script inherits update-alternatives, remove it from inherit line for beautification. Fix buildpaths warning as well: WARNING: lib32-apache2-2.4.58-r0 do_package_qa: QA Issue: File /usr/share/apache2/build/config.nice in package lib32-apache2-dev contains reference to TMPDIR [buildpaths] Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* recipes: Start WORKDIR -> UNPACKDIR transitionKhem Raj2024-05-2310-26/+26
| | | | | | | Replace references of WORKDIR with UNPACKDIR where it makes sense to do so in preparation for changing the default value of UNPACKDIR. Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Upgrade stable 1.24.0 -> 1.26.0Peter Marko2024-04-303-86/+6
| | | | | | | | | | | | | nginx-1.26.0 stable version has been released, incorporating new features and bug fixes from the 1.25.x mainline branch - including experimental HTTP/3 support, HTTP/2 on a per-server basis virtual servers in the stream module, passing stream connections to listen sockets, and more. License-Update: copyright years refreshed Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* sthttpd: Update status for CVE-2017-10671Ninette Adhikari2024-04-291-0/+2
| | | | | | | | Current version 2.27.1 is not affected by the issue. Affected versions: Up to (excl.) 2.27.1 Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* reproducibility: move repro excludes from AB config.json to meta-oeYoann Congal2024-04-291-0/+7
| | | | | | | | | | | | | | For now, the known non-reproducible packages list is stored inside the autobuilder config.json file. This is not ideal. Let's move this list into each layers of meta-openembedded. These lists can be used with, in local.conf: include conf/include/non-repro-meta-oe.inc OEQA_REPRODUCIBLE_EXCLUDED_PACKAGES = "${KNOWN_NON_REPRO_META_OE}" Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Acked-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* layers: Add styhead to compatible release seriesKhem Raj2024-04-281-1/+1
| | | | | | styhead is codename for upcoming 5.1 release Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: Upgrade v2.4.58 -> v2.4.59Soumya Sambu2024-04-193-14/+15
| | | | | | | | | | | | | | | This upgrade incorporates the fixes for CVE-2024-27316, CVE-2024-24795,CVE-2023-38709 and other bugfixes. Adjusted 0004-apache2-log-the-SELinux-context-at-startup.patch and 0007-apache2-allow-to-disable-selinux-support.patch to align with upgraded version. Changelog: https://downloads.apache.org/httpd/CHANGES_2.4.59 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nginx: Disable login for www userMaxim Perevozchikov2024-04-111-0/+1
| | | | | Signed-off-by: Maxim Perevozchikov <m.perevozchikov@yadro.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* gnome-user-share: add recipeMarkus Volk2024-03-281-0/+20
| | | | | | | | | | | | | | | | - add it as runtime dependency to gnome-control-center because without it, the file sharing options are hidden. - configure the paths to fit to openembedded env - add mod_dnssd runtime dependency for apache2 as this is a requirement To enable the feature, PACKAGECONFIG httpd needs to be added. This is not done by default to avoid apache2 runtime dependency just by including this recipe. NOTE: Apache2 httpd doesn't need to be running. It'll get started and stopped on demand by systemd. Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* apache2: preset mpm=prefork by defaultMarkus Volk2024-03-281-0/+1
| | | | | | | currently this is chosen depending on machine at do_configure Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-11 06:22:21 +0000