summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
Commit message (Collapse)AuthorAgeFilesLines
* gcc-shared-source: whitelist CVE-2023-4039Peter Marko2024-02-271-0/+3
| | | | | | | | | | | | | | | | | Concept of gcc-source prevents cve-check to detect existing CVE patch file. So whitelist this CVE in all recipes using gcc-source via this include file. (From OE-Core rev: 04511734c6dc8c7dda3a943b385cd273d012d8c7) (From OE-Core rev: 037f640b9272ba055ee41eeb1e6e9b002faefe36) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit d803ca653139aa2d6acb4f99469c76a9d232b307) Signed-off-by: Dnyandev Padalkar <padalkards17082001@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cmake: Unset CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIESZahir Hussain2024-02-161-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | As discussion in [YOCTO #14717] cmake contains a OEToolchainConfig.cmake file to configure the toolchain correctly in cross-compile build for recipes using cmake. The variable CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES value updates incorrectly during do_compile the code. Due to this getting sporadic error like below, fatal error: stdlib.h: No such file or directory | 75 | #include_next <stdlib.h> | | ^~~~~~~~~~ | compilation terminated. | ninja: build stopped: subcommand failed. | WARNING: exit code 1 from a shell command. As cmake already correctly initializes the variable from environment, So we have to unset it in the toolchain file to avoid overwriting the variable definition again. (From OE-Core rev: 7ab6087536bc67c63094f08f863dcd3d5e35b8e7) Signed-off-by: aszh07 <mail2szahir@gmail.com> Signed-off-by: Zahir Hussain <zahir.basha@kpit.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5aeada5793af53e8c93940952d4f314474dca4c2) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: Fix rsync hanging when used with --relativeMatthias Schmitz2024-02-162-0/+32
| | | | | | | | | | | | | | | Fixes [YOCTO #15383] This bug was introduced into upstream when fixing CVE-2022-29154. It was later discovered and fixed upstream but this fix didn't make it into poky yet. The added patch is taken from upstreams git repository: https://github.com/WayneD/rsync/commit/fabef23bea6e9963c06e218586fda1a823e3c6bf (From OE-Core rev: fb448f87c0b3906b91d453451083dc003ac94ebe) Signed-off-by: Matthias Schmitz <matthias.schmitz@port4949.net> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: add a complementary fix for CVE-2023-29406Ming Liu2024-02-163-1/+116
| | | | | | | | | | The original CVE-2023-29406.patch is not complete, causing docker failures at runtime, backport a complementary fix from golang upstream. (From OE-Core rev: bff621d5399e5ff2930d21f403bb2f274febd2e4) Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* perl: Whitelist CVE-2023-47039virendra thakur2024-02-161-0/+4
| | | | | | | | | | | This CVE is related to Windows. Link: https://nvd.nist.gov/vuln/detail/CVE-2023-47039 (From OE-Core rev: 970a0a64ce147970c7743411584c9bd1dc1ce414) Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* opkg: Fix bad memory access error observe in file_read_line_allocvirendra thakur2024-01-312-0/+51
| | | | | | | | | | | | | | | | In the case of a zero length string being returned by fgets(), the condition checking for a trailing new line would perform a bad memory access outside of `buf`. This might happen when line with a leading null byte is read. Avoid this case by checking that the string has a length of at least one byte. Link: https://github.com/ndmsystems/opkg/commit/8b45a3c4cab95382beea1ecdddeb2e4a9ed14aba (From OE-Core rev: 32e3618891295cec1ee5d4195998aa97f93b2207) Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Backport fix for CVE-2023-2861Vijay Anusuri2024-01-214-3/+249
| | | | | | | | | | | | | | | Updated 0012-fix-libcap-header-issue-on-some-distro.patch to resolve patch fuzz caused by the CVE-2023-2861 patch Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/a5804fcf7b22fc7d1f9ec794dd284c7d504bd16b & https://gitlab.com/qemu-project/qemu/-/commit/f6b0de53fb87ddefed348a39284c8e2f28dc4eda] (From OE-Core rev: cede843cdd1d1a83b2d616086aa69a2b584f9442) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Backport fix for CVE-2023-45287Vijay Anusuri2024-01-215-0/+2581
| | | | | | | | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/9baafabac9a84813a336f068862207d2bb06d255 & https://github.com/golang/go/commit/c9d5f60eaa4450ccf1ce878d55b4c6a12843f2f3 & https://github.com/golang/go/commit/8f676144ad7b7c91adb0c6e1ec89aaa6283c6807 & https://github.com/golang/go/commit/8a81fdf165facdcefa06531de5af98a4db343035] (From OE-Core rev: 20e1d10a3ebefc8c5237c065c25eba4182d22efd) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Fix CVE-2023-5088Vijay Anusuri2024-01-052-0/+115
| | | | | | | | | | | | | | | A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This change is to fix CVE-2023-5088. Link: https://gitlab.com/qemu-project/qemu/-/commit/7d7512019fc40c577e2bdd61f114f31a9eb84a8e (From OE-Core rev: df9e2d40c52b752940de61388997e485da56de0c) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2023-39326Vijay Anusuri2024-01-052-0/+182
| | | | | | | | | | | | | | | | | | | | | | | | A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. References: https://nvd.nist.gov/vuln/detail/CVE-2023-39326 https://security-tracker.debian.org/tracker/CVE-2023-39326 (From OE-Core rev: 5b55648f3142762c9563289c1b19aa3b7de27164) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: fix multiple cveVirendra Thakur2023-12-297-0/+273
| | | | | | | | | | | | | | | Fix below CVE's CVE-2022-47007 CVE-2022-47008 CVE-2022-47010 CVE-2022-47011 CVE-2022-48063 CVE-2022-47695 (From OE-Core rev: 873163936937a583278e3cd97c6226935f2faa0c) Signed-off-by: Virendra Thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2023-25584Lee Chee Yang2023-12-212-0/+531
| | | | | | | | | | | | | import patch from ubuntu to fix CVE-2023-25584 http://archive.ubuntu.com/ubuntu/pool/main/b/binutils/binutils_2.34-6ubuntu1.7.debian.tar.xz upstream patch : https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=77c225bdeb410cf60da804879ad41622f5f1aa44 (From OE-Core rev: 8eff0e0ce44c60efcf6bec083d5794313f3ac4ad) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* perl: fix CVE-2023-31484/47038/47100Lee Chee Yang2023-12-213-0/+150
| | | | | | | | | | | | | | | | | | | | | import patch from ubuntu http://archive.ubuntu.com/ubuntu/pool/main/p/perl/perl_5.30.0-9ubuntu0.5.debian.tar.xz fix: CVE-2023-31484 CVE-2023-47038 CVE-2023-47100 as per https://ubuntu.com/security/CVE-2023-47100 , CVE-2023-47100 is duplicate of CVE-2023-47038. perl import entire CPAN in single commit, hence backport fix from their upstream cpan instead. (From OE-Core rev: 74861848ba0d3ba920ef54f016240807ba42682a) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: ignore CVE-2021-20295 CVE-2023-2680Lee Chee Yang2023-12-081-0/+7
| | | | | | | | | Ignore RHEL specific CVE-2021-20295 CVE-2023-2680. (From OE-Core rev: 2c0822d9e7b8e7d013ef89c7e82e19fff39228a9) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Mark CVE-2022-47696 as patchedpoojitha adireddy2023-12-081-0/+3
| | | | | | | | | | | | | | CVE-2022-47696 and CVE-2023-25588 are representing similar kind of vulnerability. Reference: https://ubuntu.com/security/CVE-2022-47696 https://sourceware.org/bugzilla/show_bug.cgi?id=29677 (From OE-Core rev: a2af1a2b05e3046995f48e4d823c9dfc97b95529) Signed-off-by: poojitha adireddy <pooadire@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils 2.34: Fix CVE-2021-46174poojitha adireddy2023-12-082-0/+36
| | | | | | | | | | | | | | | Upstream Repository: https://sourceware.org/git/binutils-gdb.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2021-46174 Type: Security Fix CVE: CVE-2021-46174 Score: 7.5 Patch: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=cad4d6b91e97 (From OE-Core rev: 94f2468de191f8c1dd236efb91f3094a76ddffc9) Signed-off-by: poojitha adireddy <pooadire@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-setuptools: fix CVE-2022-40897Lee Chee Yang2023-12-012-0/+31
| | | | | | | | | import patch from ubuntu setuptools_45.2.0-1ubuntu0.1 . (From OE-Core rev: a939696d7c70c42e404ec30a9d75e5ea4f742c78) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "qemu: Backport fix for CVE-2023-0330"Steve Sakoman2023-11-173-137/+1
| | | | | | | | | | | | | | | This reverts commit 45ce9885351a2344737170e6e810dc67ab3e7ea9. Unfortunately this backport results in qemuarmv5 failing to boot with a qemu lsi hw error. [YOCTO #15274] See discussion: https://bugzilla.yoctoproject.org/show_bug.cgi?id=15274 (From OE-Core rev: 14aa11aecf503cef08e43c90cf0bd574721ca965) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Backport fix CVE-2023-25588Ashish Sharma2023-10-272-0/+147
| | | | | | | | | Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=d12f8998d2d086f0a6606589e5aedb7147e6f2f1] CVE: CVE-2023-25588 (From OE-Core rev: 6ffbb78f63e5adaadfaa9f5d5e9871ce3cfe7abf) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Update fix for CVE-2023-24538 & CVE-2023-39318Shubham Kulkarni2023-10-138-20/+2124
| | | | | | | | | | | | | Add missing files in fix for CVE-2023-24538 & CVE-2023-39318 Upstream Link - CVE-2023-24538: https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b CVE-2023-39318: https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c (From OE-Core rev: cc6f7a8e8805058aababb65e10da7ed2e3d77461) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* nasm: update 2.15.03 -> 2.15.05Alexander Kanavin2023-10-042-24/+22
| | | | | | | | | | | | | | | Use autotools-brokensep as new version needs that. upgrade include fix for CVE-2020-21686 and CVE-2022-29654 (cherry picked from commit c9c724ffa36757b56e70bc8d7b880c0c5777b153) (From OE-Core rev: ed262f94b81cbf78e6a335912875bee8a65ca7c6) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: update to 3.8.18Lee Chee Yang2023-10-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | https://docs.python.org/release/3.8.18/whatsnew/changelog.html#changelog Release date: 2023-08-24 Security gh-108310: Fixed an issue where instances of ssl.SSLSocket were vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and treating sent unencrypted data as if it were post-handshake TLS encrypted data. Security issue reported as CVE-2023-40217 by Aapo Oksman. Patch by Gregory P. Smith. Library gh-107845: tarfile.data_filter() now takes the location of symlinks into account when determining their target, so it will no longer reject some valid tarballs with LinkOutsideDestinationError. Tools/Demos gh-107565: Update multissltests and GitHub CI workflows to use OpenSSL 1.1.1v, 3.0.10, and 3.1.2. (From OE-Core rev: 9205496344bede4a16372ca7a02c2819a976640b) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2023-39318 and CVE-2023-39319Siddharth Doshi2023-10-043-0/+470
| | | | | | | | | | | Upstream-Status: Backport from [https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c] CVE: CVE-2023-39318 Upstream-Status: Backport from [https://github.com/golang/go/commit/2070531d2f53df88e312edace6c8dfc9686ab2f5] CVE: CVE-2023-39319 (From OE-Core rev: 8de380d765d8f47a961c6e45eba1cfa4d2feb68f) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2020-24165Lee Chee Yang2023-10-042-0/+95
| | | | | | | (From OE-Core rev: 93efa56fb87217035275dcb04c4a19b79b95ccaf) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* nasm: fix CVE-2022-44370Archana Polampalli2023-10-042-0/+105
| | | | | | | | | | | | | | | | | | | | NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856 References: https://nvd.nist.gov/vuln/detail/CVE-2022-44370 Upstream patches: https://github.com/netwide-assembler/nasm/commit/2d4e6952417ec6f08b6f135d2b5d0e19b7dae30d ( cherry picked from commit 1568df72136f46f0767bba56c10c48bf2a1ec259 ) (From OE-Core rev: 91e716b75861f2a4acee58a0c3f95e511058f1dc) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: Fix -fstack-protector issue on aarch64Ross Burton2023-09-292-0/+1507
| | | | | | | | | | | | | | | | This series of patches fixes deficiencies in GCC's -fstack-protector implementation for AArch64 when using dynamically allocated stack space. This is CVE-2023-4039. See: https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64 https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf for more details. (From OE-Core rev: d411ef9f660c443c00eee9bfbbc8c60c3cd0e92d) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Backport fix for CVE-2022-41725 and CVE-2023-24536Vijay Anusuri2023-09-298-0/+1614
| | | | | | | | | | | | | | | | | | | | | | Upstream-commit: https://github.com/golang/go/commit/874b3132a84cf76da6a48978826c04c380a37a50 & https://github.com/golang/go/commit/4e5a313524da62600eb59dbf98624cfe946456f8 & https://github.com/golang/go/commit/5246fa5e75b129a7dbd9722aa4de0cbaf7ceae43 & https://github.com/golang/go/commit/5c55ac9bf1e5f779220294c843526536605f42ab & https://github.com/golang/go/commit/ef41a4e2face45e580c5836eaebd51629fc23f15 & https://github.com/golang/go/commit/7a359a651c7ebdb29e0a1c03102fce793e9f58f0 & https://github.com/golang/go/commit/7917b5f31204528ea72e0629f0b7d52b35b27538 (From OE-Core rev: 532eb2c57fb1817999a857fc71db4438717ccadb) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gdb: Fix CVE-2023-39128Siddharth Doshi2023-09-292-0/+76
| | | | | | | | | | | | Note: The Fix needs to be pushed in gdb rather than bintuils-gdb as we are disabling gdb in binutils configure. Upstream-Status: Backport from [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=033bc52bb6190393c8eed80925fa78cc35b40c6d] CVE: CVE-2023-39128 (From OE-Core rev: c991fdbb63a6de754399ac4fe04288ea66d34c4d) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Backport fix for CVE-2023-0330Vijay Anusuri2023-09-153-1/+137
| | | | | | | | | | | | | | | | | | | | | | | A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free. Summary of the problem from Peter Maydell: https://lore.kernel.org/qemu-devel/CAFEAcA_23vc7hE3iaM-JVA6W38LK4hJoWae5KcknhPRD5fPBZA@mail.gmail.com Reference: https://gitlab.com/qemu-project/qemu/-/issues/556 qemu.git$ git log --no-merges --oneline --grep CVE-2023-0330 b987718bbb hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330) a2e1753b80 memory: prevent dma-reentracy issues Included second commit as well as commit log of a2e1753b80 says it resolves CVE-2023-0330 (From OE-Core rev: 45ce9885351a2344737170e6e810dc67ab3e7ea9) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Backport fix CVE-2023-3180Ashish Sharma2023-09-152-0/+50
| | | | | | | | | Upstream-Status: Backport from [https://gitlab.com/qemu-project/qemu/-/commit/9d38a8434721a6479fe03fb5afb150ca793d3980] CVE: CVE-2023-3180 (From OE-Core rev: edbc17315927a711aa9fae7c6cfba61cbf8ab5ad) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Backport fix for CVE-2023-29409Vijay Anusuri2023-09-072-0/+176
| | | | | | | | | Upstream-commit: https://github.com/golang/go/commit/2300f7ef07718f6be4d8aa8486c7de99836e233f (From OE-Core rev: 37212694b9a610b1086ef574673dd24095585f4a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Backport fix for CVE-2021-33294Vijay Anusuri2023-08-272-0/+73
| | | | | | | | | | | | | Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=480b6fa3662ba8ffeee274bf0d37423413c01e55 Reference https://nvd.nist.gov/vuln/detail/CVE-2021-33294 https://sourceware.org/bugzilla/show_bug.cgi?id=27501 (From OE-Core rev: 9cd6fea32edf8e4da0c33547e1df6d1ec81b350d) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu:fix CVE-2023-3354 VNC: improper I/O watch removal in TLS handshake can ↵Vivek Kumbhar2023-08-162-0/+88
| | | | | | | | | lead to remote unauthenticated denial of service (From OE-Core rev: 447bab76f9ac465ad36540e3bfb9a2a3cdbfa6b6) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: CVE-ID correction for CVE-2020-35505Emily Vekariya2023-08-161-4/+7
| | | | | | | | | | | | | - The commit [https://github.com/qemu/qemu/commit/995457517340] ("esp: ensure cmdfifo is not empty and current_dev is non-NULL") fixes CVE-2020-35505 instead of CVE-2020-35504. - Hence, corrected the CVE-ID in CVE-2020-35505.patch. - Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1909769 (From OE-Core rev: 9d54930a0c37e2878bbbe221341ebbd2bdd78a22) Signed-off-by: Emily Vekariya <emily.vekariya@einfochips.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dmidecode 3.2: Fix CVE-2023-30630Dhairya Nagodra2023-08-164-0/+499
| | | | | | | | | | | | | | | Upstream Repository: https://git.savannah.gnu.org/git/dmidecode.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2023-30630 Type: Security Fix CVE: CVE-2023-30630 Score: 7.8 Patch: https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=6ca381c1247c (From OE-Core rev: f3def5af120355a2454c088724e147bbce785d1b) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29406 net/http: insufficient sanitization of Host headerVivek Kumbhar2023-08-162-0/+213
| | | | | | | (From OE-Core rev: 07e03175de91739064ae5530b3df093b4d05510b) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: ignore CVE-2023-36632Peter Marko2023-08-161-0/+2
| | | | | | | | | | | | | | This CVE shouldn't have been filed as the "exploit" is described in the documentation as how the library behaves. (From OE-Core rev: b66a677b76c7f15eb5c426f8dc7ac42e1e2e3f40) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c652f094d86c4efb7ff99accba63b8169493ab18) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby/cgi-gem: CVE-2021-33621 HTTP response splitting in CGIHitendra Prajapati2023-08-162-0/+140
| | | | | | | | | Upstream-Status: Backport from https://github.com/ruby/cgi/commit/64c5045c0a6b84fdb938a8465a0890e5f7162708 (From OE-Core rev: dfe4a2b601e094e2922b671f6cf73ff6a91f061f) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: fix runpath errors in cc1 binarySteve Sakoman2023-08-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The runpath in the cc1 binary is: Library runpath: [$ORIGIN/../../../recipe-sysroot-native/usr/lib:$ORIGIN/../../../recipe-sysroot-native/lib] This does not match the actual location of the libraries, which would require: Library runpath: [$ORIGIN/../../recipe-sysroot-native/usr/lib:$ORIGIN/../../recipe-sysroot-native/lib] Prior to gcc 9.1 the recipe set B explicity with: B = "${WORKDIR}/gcc-${PV}/build.${HOST_SYS}.${TARGET_SYS}" and this build directory structure matches the runpath in cc1, so there is no issue. This line was commented out in versions 9.1 through 11.3. The upgrade to 12.1 once again uncommented this line. As a result the runpath is incorrect in version 9.1 through 11.3 and cc1 defaults to using host libraries. This patch restores setting B as done in master and versions prior to 9.1 (From OE-Core rev: 43d5ebde6d609898064ea70c89a7eba002e5fd74) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cmake: Fix CMAKE_SYSTEM_PROCESSOR setting for SDKTom Hochstein2023-07-221-4/+1
| | | | | | | | | | | | | | | | When building using an SDK, cmake complains that the target architecture 'cortexa53-crypto' is unknown. The same build in bitbake uses the target architecture 'aarch64'. Set CMAKE_SYSTEM_PROCESSOR the same as for bitbake. (From OE-Core rev: 7a7ef9d73affc23fa14712d56f1a40d0c46569cb) Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d32a6225eefce2073a1cd401034b5b4c68351bfe) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: backport Debian patch to fix CVE-2023-0330Vijay Anusuri2023-07-222-0/+78
| | | | | | | | | | | | | | import patch from ubuntu to fix CVE-2023-0330 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/qemu/tree/debian/patches?h=ubuntu/focal-security Upstream commit https://gitlab.com/qemu-project/qemu/-/commit/b987718bbb1d0eabf95499b976212dd5f0120d75] (From OE-Core rev: 559327579bcee685c6dc22b7ad5595960aa896c0) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: fix CVE-2023-24329 urllib.parse url blocklisting bypassVivek Kumbhar2023-07-222-0/+81
| | | | | | | (From OE-Core rev: 307f23e066e06793ec60f0cddf8ff1c64c02d834) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2023-29400Ashish Sharma2023-07-222-0/+95
| | | | | | | | | | emit filterFailsafe for empty unquoted attr value (From OE-Core rev: 02a0e76e04ddbbbb381202d61cbb084333336f38) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: upgrade to 3.8.17Chee Yang Lee2023-07-123-210/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | License-Update: update year to 2023 https://github.com/python/cpython/commit/30afa75ad8deca57a2bd0218f8fd6b3437c89507 Release Notes for 3.8.15: Security content in this release CVE-2022-40674: bundled libexpat was upgraded from 2.4.7 to 2.4.9 which fixes a heap use-after-free vulnerability in function doContent gh-97616: a fix for a possible buffer overflow in list *= int gh-97612: a fix for possible shell injection in the example script get-remote-certificate.py (this issue originally had a CVE assigned to it, which its author withdrew) gh-96577: a fix for a potential buffer overrun in msilib https://www.python.org/downloads/release/python-3815/ Release Notes for 3.8.16: Security content in this release gh-98739: Updated bundled libexpat to 2.5.0 to fix CVE-2022-43680 (heap use-after-free). gh-98517: Port XKCP’s fix for the buffer overflows in SHA-3 to fix CVE-2022-37454. gh-98433: The IDNA codec decoder used on DNS hostnames by socket or asyncio related name resolution functions no longer involves a quadratic algorithm to fix CVE-2022-45061. This prevents a potential CPU denial of service if an out-of-spec excessive length hostname involving bidirectional characters were decoded. Some protocols such as urllib http 3xx redirects potentially allow for an attacker to supply such a name. gh-68966: The deprecated mailcap module now refuses to inject unsafe text (filenames, MIME types, parameters) into shell commands to address CVE-2015-20107. Instead of using such text, it will warn and act as if a match was not found (or for test commands, as if the test failed). gh-100001: python -m http.server no longer allows terminal control characters sent within a garbage request to be printed to the stderr server log. gh-87604: Avoid publishing list of active per-interpreter audit hooks via the gc module. https://www.python.org/downloads/release/python-3816/ Release Notes for 3.8.17: Security content in this release gh-103142: The version of OpenSSL used in Windows and Mac installers has been upgraded to 1.1.1u to address CVE-2023-2650, CVE-2023-0465, CVE-2023-0466, CVE-2023-0464, as well as CVE-2023-0286, CVE-2022-4303, and CVE-2022-4303 fixed previously in 1.1.1t (gh-101727). gh-102153: urllib.parse.urlsplit() now strips leading C0 control and space characters following the specification for URLs defined by WHATWG in response to CVE-2023-24329. gh-99889: Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no out_file was specified. gh-104049: Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler. gh-103935: trace.__main__ now uses io.open_code() for files to be executed instead of raw open(). gh-101283: subprocess.Popen now uses a safer approach to find cmd.exe when launching with shell=True. gh-102953: The extraction methods in tarfile, and shutil.unpack_archive(), have a new filter argument that allows limiting tar features than may be surprising or dangerous, such as creating files outside the destination directory. See Extraction filters for details. https://www.python.org/downloads/release/python-3817/ (From OE-Core rev: 01a1f016a6558566a36098a993adaf4b40e30c78) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29402 & CVE-2023-29404Hitendra Prajapati2023-07-043-0/+287
| | | | | | | | | | | Backport fixes for: * CVE-2023-29402 - Upstream-Status: Backport from https://github.com/golang/go/commit/c160b49b6d328c86bd76ca2fff9009a71347333f * CVE-2023-29404 - Upstream-Status: Backport from https://github.com/golang/go/commit/bf3c8ce03e175e870763901a3850bca01381a828 (From OE-Core rev: a4a989605d8cab3278d6c6e32eb882815ff36a28) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Backport fix CVE-2023-29405Ashish Sharma2023-07-043-0/+152
| | | | | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/fa60c381ed06c12f9c27a7b50ca44c5f84f7f0f4 & https://github.com/golang/go/commit/1008486a9ff979dbd21c7466eeb6abf378f9c637] (From OE-Core rev: ce213403b4e82f1b191fed4ef6494e9dee55c4f8) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ninja: Whitelist CVE-2021-4336, wrong ninjaRoss Burton2023-07-041-0/+3
| | | | | | | | | | | | (From OE-Core rev: c2dd2c13ff26c3f046e35a2f6b8afeb099ef422a) (From OE-Core rev: a056017d8383686651de6a72b50d95213bacf226) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9a106486ad7900924a87c5869702903204a35b54) Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* e2fsprogs: fix ptest bug for second runningQiu Tingting2023-06-172-0/+4
| | | | | | | | | | | | | | | At second running, there are four new failed case: d_loaddump f_bigalloc_badinode f_bigalloc_orphan_list f_dup_resize The test_data.tmp is necessary, but it is deleted by run-ptest. So it should be restored after testing. (From OE-Core rev: 496dc586446d09a77923bc191e5305ba06c8f59e) Signed-off-by: Qiu Tingting <qiutt@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit d0d08dd9a8a179e25b9cfcbac696c1d212a1910c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Security fix CVE-2023-24540Vijay Anusuri2023-06-132-0/+91
| | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/ce7bd33345416e6d8cac901792060591cafc2797] (From OE-Core rev: e569586ac9095d344967c5b9c4bfb07f70948936) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* golang: Fix CVE-2023-24539Ashish Sharma2023-06-132-0/+61
| | | | | | | | | Improper sanitization of CSS values in html/template (From OE-Core rev: 737333d41d245154eb4b26ec8db79a2f9823c873) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-26 08:45:02 +0000