summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
Commit message (Collapse)AuthorAgeFilesLines
* build-appliance-image: Update to dunfell head revisionyocto-3.1.33dunfell-23.0.33dunfellSteve Sakoman2024-04-151-1/+1
| | | | | | (From OE-Core rev: c4fb7d1f0f157ffafd9f907f49ea74b93b2c1d40) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionSteve Sakoman2024-04-131-1/+1
| | | | | | (From OE-Core rev: 2f8f7f417936af7d965ac13bd878d09b3029e69d) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ncurses: Backport fix for CVE-2023-50495Vijay Anusuri2024-04-132-0/+80
| | | | | | | | | | | Upstream-Status: Backport from https://github.com/ThomasDickey/ncurses-snapshots/commit/efe9674ee14b14b788f9618941f97d31742f0adc Reference: https://invisible-island.net/archives/ncurses/6.4/ncurses-6.4-20230424.patch.gz (From OE-Core rev: 530314b699a7ad53e6dcd96658873cef7014e483) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: Remove rejected CVE from databaseYoann Congal2024-03-251-0/+4
| | | | | | | | | | | | | | When a CVE is updated to be rejected, matching database entries must be removed. Otherwise: * an incremental update is not equivalent the to an initial download. * rejected CVEs might still appear as Unpatched in cve-check. (From OE-Core rev: 4eb0074be76c9bd3d6d25cae4f1b9f398ff89bf5) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f276a980b8930b98e6c8f0e1a865d77dfcfe5085) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: Fix CVE configuration updateYoann Congal2024-03-251-0/+4
| | | | | | | | | | | | | | When a CVE is created, it often has no precise version information and this is stored as "-" (matching any version). After an update, version information is added. The previous "-" must be removed, otherwise, the CVE is still "Unpatched" for cve-check. (From OE-Core rev: 80946fbe8c95169b871d816f2b71ee001a2a3d75) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 641ae3f36e09af9932dc33043a0a5fbfce62122e) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: nvd_request_next: Improve commentYoann Congal2024-03-251-1/+2
| | | | | | | | | | | | Add a URL to the doc of the API used in the function. ... and fix a small typo dabase -> database (From OE-Core rev: 9ba959475d84b2e87e14ceba11787b10afca45ba) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e0157b3b81333a24abd31dbb23a6abebca3e7ba7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: Remove duplicated CVE_CHECK_DB_FILE definitionYoann Congal2024-03-251-2/+0
| | | | | | | | | | | | | | | CVE_CHECK_DB_FILE is already defined in cve-check.bbclass which is always inherited in cve-update-nvd2-native (There is a check line 40). Remove it to avoid confusion. Otherwise, this should not change anything. (From OE-Core rev: 4268128167386298c8a7777ce3d3b5e7517bb366) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e5f3f223885c17b7007c310273fc7c80b90a4105) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: Add an age threshold for incremental updateYoann Congal2024-03-251-4/+16
| | | | | | | | | | | | | | | Add a new variable "CVE_DB_INCR_UPDATE_AGE_THRES", which can be used to specify the maximum age of the database for doing an incremental update For older databases, a full re-download is done. With a value of "0", this forces a full-redownload. (From OE-Core rev: c9a3e5a4ca297249f8fd7380a824dce0c407280b) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 74c1765111b6610348eae4b7e41d7045ce58ef86) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: Fix typo in commentYoann Congal2024-03-251-1/+1
| | | | | | | | | | | attmepts -> attempts (From OE-Core rev: 3ce55e2a1e680de1cd9be735fb766a1366e88a98) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dc18aaeda8e810f9082a0ceac08e5e4275bbd0f7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: Backport fix for CVE-2024-25062Vijay Anusuri2024-03-253-0/+73
| | | | | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/31c6ce3b63f8a494ad9e31ca65187a73d8ad3508 & https://gitlab.gnome.org/GNOME/libxml2/-/commit/2b0aac140d739905c7848a42efc60bfe783a39b7] (From OE-Core rev: e4e621dc42be5dd158393fcadf5200f9eae613cb) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.32dunfell-23.0.32Steve Sakoman2024-03-011-1/+1
| | | | | | (From OE-Core rev: b49b0a3dd74c24f3a011c9c0b5cf8f6530956cfa) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ncurses: Fix CVE-2023-29491virendra thakur2024-02-162-1/+47
| | | | | | | | | | | | | | | | | | | | | | | | memory corruption when processing malformed terminfo data entries loaded by setuid/setgid programs CVE-2023-29491.patch change the --disable-root-environ configure option behavior. set --disable-root-environ in configuration options. --disable-root-environ option with a few additional changes to the code allows us to mitigate CVE-2023-29491 and avoid other issues that involve the possibility of malicious use of environment variables through setuid applications, and, therefore, it was the fix chosen in order to resolve this vulnerability. Reference: https://ubuntu.com/security/CVE-2023-29491 https://launchpad.net/ubuntu/+source/ncurses/6.2-0ubuntu2.1 (From OE-Core rev: 041433f0767ae9112f6a74a7d7c93ce9b411792c) Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.31dunfell-23.0.31Steve Sakoman2024-01-221-1/+1
| | | | | | (From OE-Core rev: 82e67bd9c77f0c5cbb652ca91071b9e57bdcfb33) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* zlib: ignore CVE-2023-6992Peter Marko2024-01-211-0/+3
| | | | | | | | | | | | | This CVE is for iCPE cloudflare:zlib. Alternative to ignoring would be to limit CVE_PRODUCT, but historic CVEs already have two - gnu:zlib and zlib:zlib. So limiting it could miss future CVEs. (From OE-Core rev: 5dc87309639e78195eb1283afc193f6eac63b044) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: Fix for CVE-2023-45322Vijay Anusuri2024-01-213-0/+132
| | | | | | | | | | | | | | | | | | | | | Backport patch for gitlab issue mentioned in NVD CVE report. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/583 Backport also one of 14 patches for older issue with similar errors to have clean cherry-pick without patch fuzz. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/344 The CVE is disputed because the maintainer does not think that errors after memory allocation failures are not critical enough to warrant a CVE ID. This patch will formally fix reported error case, trying to backport another 13 patches and resolve conflicts would be probably overkill due to disputed state. This CVE was ignored on master branch (as diputed). (From OE-Core rev: 03b766e42beb42a2085285308acbcf941f346b06) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: increase the delay between subsequent request failuresDhairya Nagodra2024-01-101-4/+9
| | | | | | | | | | | | | | | | | | | | Sometimes NVD servers are unstable and return too many errors. There is an option to have higher fetch attempts to increase the chances of successfully fetching the CVE data. Additionally, it also makes sense to progressively increase the delay after a failed request to an already unstable or busy server. The increase in delay is reset after every successful request and the maximum delay is limited to 30 seconds. Also, the logs are improved to give more clarity. (From OE-Core rev: 9e03b7a9879fd16e32f4eccb78b438f6fa9db74d) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7101d654635b707e56b0dbae8c2146b312d211ea) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: faster requests with API keysDhairya Nagodra2024-01-101-1/+6
| | | | | | | | | | | | | | | | | | | As per NVD, the public rate limit is 5 requests in 30s (6s delay). Using an API key increases the limit to 50 requests in 30s (0.6s delay). However, NVD still recommends sleeping for several seconds so that the other legitimate requests are serviced without denial or interruption. Keeping the default sleep at 6 seconds and 2 seconds with an API key. For failures, the wait time is unchanged (6 seconds). Reference: https://nvd.nist.gov/developers/start-here#RateLimits (From OE-Core rev: eb5ab00be33a503205401541e88c32ba9da1d75c) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 5c32e2941d1dc3d04a799a1b7cbd275c1ccc9e79) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: make number of fetch attemtps configurablePeter Marko2024-01-101-3/+7
| | | | | | | | | | | | | | | | | | Sometimes NVD servers are unstable and return too many errors. Last time we increased number of attempts from 3 to 5, but further increasing is not reasonable as in normal case too many retries is just abusive. Keep retries low as default and allow to increase as needed. (From OE-Core rev: ee2a6ade703317d09f7df60ef7ce300d8f868f54) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6b6fd8043d83b99000054ab6ad2c745d07c6bcc1) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: remove unused variable CVE_SOCKET_TIMEOUTPeter Marko2024-01-101-3/+0
| | | | | | | | | | | | This variable is not referenced in oe-core anymore. (From OE-Core rev: 70676801f1f8fe498ff34fc1db72b6a3bf438d4a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 905b45a814cb33327503b793741c19b44c8550b3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: Backport fix for CVE-2021-3516Vijay Anusuri2023-12-212-0/+36
| | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539] (From OE-Core rev: 29c182375d91806d1e802b026f84b24e7c5d4b35) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: Fix CVE-2023-4813Bhabu Bindu2023-12-212-0/+987
| | | | | | | | | | | | Add patch to fix CVE-2023-4813 Link: https://security-tracker.debian.org/tracker/CVE-2023-4813 (From OE-Core rev: d735b2a94091f9a4a91917c73bd73d9ce4a31e3e) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Poonam Jadhav <ppjadhav456@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.30dunfell-23.0.30Steve Sakoman2023-12-111-1/+1
| | | | | | (From OE-Core rev: 55157aa2f8b157b1cc63e1134d9eba6db0cf16da) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionSteve Sakoman2023-12-101-1/+1
| | | | | | (From OE-Core rev: 7e65b351fa8eda4ee7b9f1f2a8dbfe14e0ef697a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionSteve Sakoman2023-12-081-1/+1
| | | | | | (From OE-Core rev: 0abf394b12c7cd5c24da1eb6ab24bec30658998a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* zlib: Backport fix for CVE-2023-45853Ashish Sharma2023-11-172-0/+41
| | | | | | | | | Upstream-Status: Backport from [https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c] (From OE-Core rev: bbe5e13c2ff981d7defd14f9e2d91ebbe107bb4b) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: ignore CVE-2023-4527Peter Marko2023-11-171-0/+7
| | | | | | | | | This vulnerability was introduced in 2.36, so 2.31 is not vulnerable. (From OE-Core rev: 3471922461627c0f0487feb09cfdc4cfeeb3f3ca) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.29dunfell-23.0.29Steve Sakoman2023-10-271-1/+1
| | | | | | (From OE-Core rev: 0dbf3a15321b8033ff8ed86c6aa261fdb9c3d5bb) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: Backport systemd-resolved: use hostname for certificate validation ↵Marek Vasut2023-10-202-0/+121
| | | | | | | | | | | | | | | | | | in DoT Widely accepted certificates for IP addresses are expensive and only affordable for larger organizations. Therefore if the user provides the hostname in the DNS= option, we should use it instead of the IP address. This fixes https://nvd.nist.gov/vuln/detail/CVE-2018-21029 per suggestion https://github.com/systemd/systemd-stable/issues/72 . CVE: CVE-2018-21029 (From OE-Core rev: 6b4a583169ae40a8d51e7ffa33785409b5111a81) Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: Fix multiple vulnerabilitiesSiddharth Doshi2023-10-2015-0/+2710
| | | | | | | | | | | | | | CVE's Fixed: CVE-2023-29499: glib: GVariant offset table entry size is not checked in is_normal() CVE-2023-32611: glib: g_variant_byteswap() can take a long time with some non-normal inputs CVE-2023-32636: glib: Timeout in fuzz_variant_text CVE-2023-32643: glib: Heap-buffer-overflow in g_variant_serialised_get_child CVE-2023-32665: glib: GVariant deserialisation does not match spec for non-normal data (From OE-Core rev: b576beba80d44e67762d46bf3bc2f14c05bc0f6b) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* busybox: Backport CVE-2022-48174 fixMarek Vasut2023-10-132-0/+83
| | | | | | | | | | | | | | There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. https://nvd.nist.gov/vuln/detail/CVE-2022-48174 CVE: CVE-2022-48174 (From OE-Core rev: 634daf953e4bd8c6df3ee341b5e93cc81e1a620d) Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dbus: Add missing CVE_PRODUCTJulian Haller2023-10-131-0/+2
| | | | | | | | | | | The current dunfell CVE scans report 0 CVEs for our dbus version. This is not correct, though, as we use the wrong product name to query it. Fix this to get a proper CVE list. (From OE-Core rev: 922872c85d417a5a319aa4beef57ffa4d05faf27) Signed-off-by: Julian Haller <julian.haller@philips.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dbus: Backport fix for CVE-2023-34969Julian Haller2023-10-132-0/+97
| | | | | | | | | Upstream commit https://gitlab.freedesktop.org/dbus/dbus/-/commit/37a4dc5835731a1f7a81f1b67c45b8dfb556dd1c (From OE-Core rev: 42bf7fee204890b15f80bf0749431aefb33efd99) Signed-off-by: Julian Haller <julian.haller@philips.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: Fix CVE-2023-4911 "Looney Tunables"Mike Crowe2023-10-062-0/+64
| | | | | | | | | | | | | | | | | | | Take the patch from the source for Debian's glibc 2.31-13+deb11u7 package, the changelog for which starts with: glibc (2.31-13+deb11u7) bullseye-security; urgency=medium * debian/patches/any/local-CVE-2023-4911.patch: Fix a buffer overflow in the dynamic loader's processing of the GLIBC_TUNABLES environment variable (CVE-2023-4911). This addresses the "Looney Tunables" vulnerability described at https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt (From OE-Core rev: 9a800a2e2c2b14eab8c1f83cb4ac3b94a70dd23c) Signed-off-by: Mike Crowe <mac@mcrowe.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: Fix CVE-2023-39615Siddharth Doshi2023-09-294-0/+154
| | | | | | | | | Upstream-Status: Backport from [https://gitlab.gnome.org/GNOME/libxml2/-/commit/d0c3f01e110d54415611c5fa0040cdf4a56053f9, https://gitlab.gnome.org/GNOME/libxml2/-/commit/235b15a590eecf97b09e87bdb7e4f8333e9de129] CVE: CVE-2023-39615 (From OE-Core rev: d8a585a8c3712cdce9d9a5241ae7e620bc014ed9) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.28dunfell-23.0.28Steve Sakoman2023-09-161-1/+1
| | | | | | (From OE-Core rev: 8b91c463fb3546836789e1890b3c68acf69c162a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionSteve Sakoman2023-09-151-1/+1
| | | | | | (From OE-Core rev: a6dde75a3cbd99cb346a8ab8183e96752d005a6b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc/check-test-wrapper: don't emit warnings from sshAnuj Mittal2023-09-151-1/+1
| | | | | | | | | | | | | | | Dont fill up the test log with ssh warning about having added the host to list of known hosts. Also helps fix a test case failure where stderr log was being compared to a known value. (From OE-Core rev: 781c52bb8f9ffe6aeb456fb0c0d628917641fb22) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 63b31ff7e54a171c4c02fca2e6b07aec64a410af) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd-systemctl: fix errors in instance name expansionYuta Hayama2023-08-161-1/+1
| | | | | | | | | | | | | | | If the instance name indicated by %i begins with a number, the meaning of the replacement string "\\1{}".format(instance) is ambiguous. To indicate group number 1 regardless of the instance name, use "\g<1>". (From OE-Core rev: d18b939fb08b37380ce95934da38e6522392621c) (From OE-Core rev: 682e094e6af67e67873f7f08dd8d52b40fcdbded) Signed-off-by: Yuta Hayama <hayama@lineo.co.jp> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: always pass str for json.loads()Yuta Hayama2023-08-161-1/+1
| | | | | | | | | | | | | Currently json.loads() accepts one of the types str, bytes, or bytearray as an argument, but bytes and bytearrays have only been allowed since python 3.6. The version of Python3 provided by default on Ubuntu 16.04 and Debian 9.x is 3.5, so make raw_data type str to work correctly on these build hosts. (From OE-Core rev: 4efdf7a93254056b9ac47de470740ac113b031f2) Signed-off-by: Yuta Hayama <hayama@lineo.co.jp> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.27dunfell-23.0.27Steve Sakoman2023-08-041-1/+1
| | | | | | (From OE-Core rev: 6dd64ca2d726d0b222a7608c65eb0a20454c3f99) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionSteve Sakoman2023-07-221-1/+1
| | | | | | (From OE-Core rev: ab6a0d053d910c3d50fcb06e9c2ca98430b673a4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.31 branch updates.Deepthi Hemraj2023-07-221-1/+1
| | | | | | | | | | Below commits on glibc-2.31 stable branch are updated. 2d4f26e5cf x86: Fix wcsnlen-avx2 page cross length comparison (From OE-Core rev: d89f5692514c68050349f37315e1dea14cbcfa24) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: actually use API keysRoss Burton2023-07-131-11/+12
| | | | | | | | | | | | | | | There were vestigal remains of API key support which could be removed, but as using an API key - in theory - gives the user larger rate limits it's probably wise to expose it. If the user has an API key, then set NVDCVE_API_KEY. (From OE-Core rev: b3fc8ef9aba822b3d485242c8ebd0e0bff0ebfc8) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a542de684282bfec79f24ae2f1a2027ffde319d8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: log a little moreRoss Burton2023-07-131-5/+7
| | | | | | | | | | | | | Add a note of what range we're fetching, and use bb.note() instead of debug() as messages about retrying shouldn't really be considered debug logging. (From OE-Core rev: f6c3ee35ae9950aec4b3dc15062b1c1fb5610011) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b64a869b9c5e1d504f1011da16b5c5ff721afbf0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: increase retry countPeter Marko2023-07-131-1/+1
| | | | | | | | | | | | | | | | | Current 503 errors seem to last several seconds. In most cases there are two errors and third request succeeds. However sometimes the outage takes more than time needed for two retries and third one also fails. Extend retry count from 3 to 5 to improve the probablity that the fetcher succeeds. (From OE-Core rev: 46286a641f1113e22d39a427a5dc0a11321d434e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f4d118af2360cff7f234102fd5e4b65a6f4146a6) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: retry all errors and sleep between retriesPeter Marko2023-07-131-7/+4
| | | | | | | | | | | | | | | | | | | | Last couple days it is not possible to update NVD DB as servers are returning lot of errors. Mostly "HTTP Error 503: Service Unavailable" is observed but sporadially also some others. Retrying helps in most cases, so extend retries to all errors. Additionally add sleep which is recommended by NVD between requests. These retries are already implemented between successful requests, but giving servers time between failed ones is important, too. (From OE-Core rev: 8bba9342f641e9aa51ccaebc02bc5d51354e1c72) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 88dad8f198baa80af5ab576498f4df6ed639d551) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: fix cvssV3 metricsPeter Marko2023-07-131-4/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After upgrade to soon-to-be-released kirkstone 4.0.11 CVE annotations got broken. Anything which has only cvssV3 does not resolve properly. Fix the API fields used to extract it. i0.0 score is now at level of NVD DB 1.1. All CVEs with UNKNOWN vector are not present in NVD DB 1.1. NVD API 1.1: sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|4776 LOCAL|32146 NETWORK|167746 PHYSICAL|185 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|73331 1.8|7 1.9|3 ... NVD API 2.0 (broken): sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|4587 LOCAL|26273 NETWORK|150421 UNKNOWN|24644 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|205925 NVD API 2.0 (fixed): sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|5090 LOCAL|32322 NETWORK|168004 PHYSICAL|213 UNKNOWN|511 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|73841 1.8|7 1.9|3 ... (From OE-Core rev: 2233a187dc0da833401297667c1e2ed6bf5627fd) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 61a5857efdcc0f49c69c0deb24fce99007aeef19) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: use exact times, don't truncateRoss Burton2023-07-131-2/+2
| | | | | | | | | | | | | | | When requesting updates in a specific range, use the actual current time and database mtime instead of truncating to midnight, and explicitly set the timezone to UTC so that NIST don't treat the timestamps as _their_ local time when they're _our_ local time. (From OE-Core rev: e12b81ede54c92e372f0d80373bb91254d0a889f) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9aa0ec37f5f74252588d2494a71c71a7d8e68df9) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: handle all configuration nodes, not just firstRoss Burton2023-07-131-4/+5
| | | | | | | | | | | | | | | | | Some CVEs, such as CVE-2013-6629, list multiple configurations which are vulnerable. The current JSON parser only considers the first configuration. Instead, consider every configuration. We don't yet handle the AND/OR logical operators, but this is a step in the right direction. (From OE-Core rev: e521d6ce48d3b04eb2d53c710bba18593a908fe3) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e1bf4f6dd686055fe9a8bdcc3f739eac2807bae0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd-systemctl: support instance expansion in WantedByIan Ray2023-06-271-7/+2
| | | | | | | | | | | | | | | | | | | | | | Refactor _process_deps to expand systemd instance specifier "%i" to the template instance. This change expands on prior commit e510222b57 ("systemd-systemctl: fix instance template WantedBy symlink construction") by substituting every "%i" pattern-match with the instance name. The regexp handles the following cases: * svc-wants@%i.service * sys-subsystem-net-devices-%i.device (From OE-Core rev: 2aa82324d43467e7c8bfbbb59570ee3306264b75) Signed-off-by: Ian Ray <ian.ray@ge.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 9356276137267a29ae2289d796a2940918375308) Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-20 17:00:29 +0000