summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/subversion/subversion
Commit message (Collapse)AuthorAgeFilesLines
* subversion: fix CVE-2017-9800Wenzong Fan2017-09-111-0/+136
| | | | | | | | | | | | | | | | | | | | | | | | A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server(to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://. Backport patch from: http://svn.apache.org/viewvc?view=revision&amp;sortby=rev&amp;revision=1804691 Reference: http://subversion.apache.org/security/CVE-2017-9800-advisory.txt (From OE-Core rev: 6e1f8001a0f3c26cce9c692d25987a3c47ff2f74) Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "subversion: fix "svnadmin create" fail on x86"Dengke Du2016-12-221-56/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit cfe6f3e251240c9d9a70354be0501600357f0b87. This is because the apr configure wrong, when the apr configure meets the cross compiling, it pass 8 bytes to "off_t", in apr source code configure.in, it was hardcoded: APR_CHECK_SIZEOF_EXTENDED([#include <sys/types.h>], off_t, 8) The macro "APR_CHECK_SIZEOF_EXTENDED" was defined in build/apr_common.m4, it use the "AC_TRY_RUN" macro, this macro let the off_t to 8, when cross compiling enable. But in glibc on the x86 or multilib target the "off_t" was 4 bytes, so this cases dismatch for softwares which use the apr.h, such as subversion, run this: svnadmin create test It failed because the "APR_OFF_T_FMT" was "lld" in apr.h when apr configure, but the "apr_off_t" was 4 bytes, in the apr source code: apr_snprintf.c i_quad = va_arg(ap, apr_int64_t); When the function apr_vformatter meets "lld", it would use the above to parse, but the above read 8 bytes, so the follow-up data go to wrong. So we should configure the apr correct when cross compiling. I do this on the following patchs. (From OE-Core rev: fbdfb39c011676fe61a4d58b62226126e0e9ec62) Signed-off-by: Dengke Du <dengke.du@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: Fix issues in LDFLAGS sed manipulationRichard Purdie2016-12-081-0/+22
| | | | | | | | | | | | | The existing sed expression can match expressions like --sysroot=/some/path/xxx-linux/ which clearly isn't intended and injects incorrect paths into LDFLAGS. Fix this in the same way we address the problem in CFLAGS. This fixes corrupt build paths and incorrect paths in .la files amongst other issues. (From OE-Core rev: 9a8382422ddbb0972dc25b752204f4908bb9857c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: fix "svnadmin create" fail on x86Dengke Du2016-11-061-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When run the following command on x86: svnadmin create /var/test_repo It cause segmentation fault error like the following: [16499.751837] svnadmin[21117]: segfault at 83 ip 00000000f74bf7f6 sp 00000000ffdd9b34 error 4 in libc-2.24.so[f7441000+1af000] Segmentation fault (core dumped) This is because in source code ./subversion/libsvn_fs_fs/low_level.c, function svn_fs_fs__unparse_footer, when: target arch: x86 apr_off_t: 4 bytes if the "APR_OFF_T_FMT" is "lld", it still use type "apr_off_t" to pass data to apr, but in apr source code file apr_snprintf.c the function apr_vformatter meet "lld", it would use the: i_quad = va_arg(ap, apr_int64_t); It uses the apr_int64_t to deal data, it read 8 bytes, so the follow-up data may be error. (From OE-Core rev: 7ea7e3db7801b58495b89a95ec2751d618d3a29f) Signed-off-by: Dengke Du <dengke.du@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: update to 1.9.2Alexander Kanavin2015-12-123-0/+129
| | | | | | | | | | | | | Drop backported CVE fix patches libtool2.patch has been rebased and renamed to 0001-Fix-libtool-name-in-configure.ac.patch LICENSE checksum has been updated because more 3rd party attributions have been added to it, it's otherwise still Apache 2. (From OE-Core rev: b57f57ea092f93bd7e1268b04c7d3c4af2149a77) Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: remove 1.6.X recipesRoy Li2015-04-3010-957/+0
| | | | | | | | | | | Removing the 1.6.X recipes, since there is a new version 1.8.X recipes, and hope that all projects already upgraded their premirror caches to use new format (From OE-Core rev: 65c4dcbefbe118eb1b04335d7d6171236a1315c2) Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: Security Advisory - subversion - CVE-2014-3528Yue Tao2014-11-041-0/+29
| | | | | | | | | | | | | | | | Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3528 (From OE-Core rev: e0dc0432b13f38d16f642bdadf8ebc78b7a74806) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: Security Advisory - subversion - CVE-2014-3522Yue Tao2014-11-041-0/+439
| | | | | | | | | | | | | | | | | | | The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.<a href=http://cwe.mitre.org/data/definitions/297.html target=_blank>CWE-297: Improper Validation of Certificate with Host Mismatch</a> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3522 (From OE-Core rev: 06a33cd00ea11abec1ebe9d5883e44778075ccc6) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: fix for Security Advisory CVE-2013-4277Yue Tao2014-05-211-0/+15
| | | | | | | | | | | | | | | | Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4277 (From OE-Core rev: e0e483c5b2f481240e590ebb7d6189a211450a7e) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: fix for Security Advisory CVE-2013-1847 and CVE-2013-1846Yue Tao2014-05-211-0/+53
| | | | | | | | | | | | | | | | | | | | The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1846 The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1847 (From OE-Core rev: 3962b76185194fa56be7f1689204a1188ea44737) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: fix for Security Advisory CVE-2013-1845Yue Tao2014-05-211-0/+171
| | | | | | | | | | | | | | | | The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1845 (From OE-Core rev: 432666b84b80f8b0d13672aa94855369f577c56d) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: fix for Security Advisory CVE-2013-4505Yue Tao2014-05-211-0/+127
| | | | | | | | | | | | | | | | The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4505 (From OE-Core rev: 02314673619f44e5838ddb65bbe22f9342ee6167) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: fix for Security Advisory CVE-2013-1849Yue Tao2014-05-211-0/+25
| | | | | | | | | | | | Reject operations on getcontentlength and getcontenttype properties if the resource is an activity. (From OE-Core rev: 94e8b503e8a5ae476037d4aa86f8e27d4a8c23ea) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: do_install failed (parallel issue)Robert Yang2012-07-101-0/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | install-neon-lib needs libsvn_delta-1.la which will be regenerated during libsvn_delta-1.la's installation, if libsvn_delta-1.la is in regenerating and at the same time install-neon-lib links it, the error willl happen. The error message is: /bin/ld: cannot find -lsvn_delta-1 collect2: error: ld returned 1 exit status This is a parallel issue, so it doesn't happen often. Note: The autoreconf doesn't generate build-outputs.mk, it would be generated by autogen.sh (use build.conf as the input), but autogen.sh isn't suitable for cross compiling, so both modified build-outputs.mk and build.conf. [YOCTO #2727] (From OE-Core rev: ce37c45abb4cf43e5009867f695982de2eb33450) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: remove neon-detection.patch and --with-neon optionMartin Jansa2011-09-161-15/+0
| | | | | | | | | | | | | | * upstream detection seems to be doing its job right now * I don't see how this is supposed to work -- neon_config="$withval/bin/neon-config" -+ neon_config="env env PKG_CONFIG_PATH=${withval}:${PKG_CONFIG_PATH} pkg-config neon" when neon_config should be sysroots/nokia900/usr/bin/crossscripts/neon-config " (From OE-Core rev: 6466de31048260089b8988280f77efdb14ac2f21) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes: Fix the Upstream-Status formatNitin A Kamble2011-05-113-3/+3
| | | | | | | (From OE-Core rev: d7237140554ad076be12edf915d6d15206c9b8c7) Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: update upstream status for patchesNitin A Kamble2011-05-093-0/+6
| | | | | | | (From OE-Core rev: 634649e150af01e303553295d0fbdab48efecae7) Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* subversion: upgrade from 1.6.13 to 1.6 15Nitin A Kamble2011-02-021-6/+18
| | | | | | | Rebased this patch to the newer code modified: subversion/disable-revision-install.patch Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
* subversion: upgrade from 1.5.5 to 1.6.13Nitin A Kamble2010-12-063-0/+50
And update recipe checksums rebased neon-detection.patch: upstream code has some of the changes similar to the changes in the patch. Removing the duplicate changes from the patch file. subversion: update LIC_CHKSUM_FILES field Noticed this change in the COPYING file: $ diff -u COPYING /tmp/COPYING --- COPYING 2006-05-28 07:41:18.000000000 -0700 +++ /tmp/COPYING 2010-12-03 11:16:15.000000000 -0800 @@ -10,7 +10,7 @@ on), you may use a newer version instead, at your option. ================================================================ -Copyright (c) 2000-2006 CollabNet. All rights reserved. +Copyright (c) 2000-2009 CollabNet. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-25 23:14:45 +0000