summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended/tar/tar_1.32.bb
Commit message (Collapse)AuthorAgeFilesLines
* tar: bump PR to deal with sstate corruption on autobuilderSteve Sakoman2024-04-051-0/+2
| | | | | | | | Testing of an SPDX patch corrupted sstate, so bump PR to work around the issue (From OE-Core rev: cbce426763592e82e6e0ed20f18cedfa4d01f61e) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tar: Fix for CVE-2023-39804Vijay Anusuri2024-04-051-0/+1
| | | | | | | | | Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4 (From OE-Core rev: 082c31db387957963952c485a436dc38a64498d0) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tar: CVE-2022-48303Rodolfo Quesada Zumbado2023-03-141-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes CVE-2022-48303 by checking Base-256 encoding is at least 2 bytes long. GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-48303 Upstream patch: https://savannah.gnu.org/bugs/?62387 https://git.savannah.gnu.org/cgit/tar.git/patch/src/list.c?id=3da78400eafcccb97e2f2fd4b227ea40d794ede8 (From OE-Core rev: 231360a55bf1b96d6bb1cf94820b08788677c58b) (From OE-Core rev: af77a413db59863a898c32dc7536b680473ae9c5) Signed-off-by: Rodolfo Quesada Zumbado <rodolfo.zumbado@windriver.com> Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2a00f15354084cee6b2183fcdbfdfc7826c365da) Signed-off-by: Riyaz Khan <Riyaz.Khan@kpit.com> Signed-off-by: Riyaz Khan <rak3033@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tar: filter CVEs using vendor nameRalph Siemsen2021-10-231-3/+3
| | | | | | | | | | | | | | | | | | | | Recently a number of CVEs have been logged against a nodejs project called "node-tar". These appear as false positives against the GNU tar being built by Yocto. Some of these have been manually excluded using CVE_CHECK_WHITELIST. To avoid this problem, use the vendor name (in addition to package name) for filtering CVEs. The syntax for this is: CVE_PRODUCT = "vendor:package" When not specified, the vendor defaults to "%" which matches anything. (From OE-Core rev: 4d0ad4962bd3c69800f70770dc9123a694e16c26) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 45d1a0bea0c628f84a00d641a4d323491988106f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tar: ignore node-tar CVEsArmin Kuster2021-09-301-0/+1
| | | | | | | | | | | | | | These three CVEs are specific to the Node package node-tar. exclude: CVE-2021-37701 CVE-2021-37712 CVE-2021-37713 (From OE-Core rev: 8653ed5bc02c794944372be5c4ba785a7739f6d0) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9f9317a02d73c1e5aea026683a037e52c996c7bb) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tar: ignore node-tar CVEsRoss Burton2021-08-261-0/+3
| | | | | | | | | | | | These two CVEs are specific to the Node package node-tar. (From OE-Core rev: d1b09f81ad80e5099ae670c965dcf7d39ad09ac1) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bc7216e8148d0dee7b56e6851da6615e93647a0a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tar: Fix CVE-2021-20193Anatol Belski2021-05-131-0/+1
| | | | | | | | (From OE-Core rev: c8f48471bea67cbf0f12a35639b764f90acae854) Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tar: Fix build determinism, disable rshRichard Purdie2020-02-061-0/+2
| | | | | | | | | | | rsh is insecure and obsolete but tar will enable support if the binary is on the host system. Some systems point it at ssh. Lets explictly disable it for now unless someone actually needs/uses this at which point it could become a packageconfig. (From OE-Core rev: d14a4b0db92a9a7d1ff72a2e0faca7f1a23a0b68) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* m4/tar: Remove remove-gets.patchAdrian Bunk2019-05-271-1/+0
| | | | | | | | | | When the original problem was fixed in gnulib the patches were rebased on top of the upstream fix... (From OE-Core rev: d93ad85d94ea99e3fad7e4c2f6be999088e2f9f9) Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cpio/tar/native.bbclass: move rmt to sbindir and add a prefix to avoid ↵Hongxu Jia2019-05-081-3/+3
| | | | | | | | | | | | | | | | | | native clashing The rmt in cpio-native and tar-native is clashing, since tar-native has set var-NATIVE_PACKAGE_PATH_SUFFIX, we move rmt to sbindir, and add suffix NATIVE_PACKAGE_PATH_SUFFIX to sbindir could avoid the clashing. And in Ubuntu, rmt is in sbindir $ which rmt /usr/sbin/rmt (From OE-Core rev: e9ac5ac2f4d135734f549d17cce3ebc52132b7d0) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tar: update to 1.32Oleksandr Kravchuk2019-04-121-0/+65
(From OE-Core rev: 472258c7bf25672d6b8922061e8ea382d7be478a) Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-09-21 12:06:09 +0000