summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
Commit message (Collapse)AuthorAgeFilesLines
* vim: Update to 8.2.4524 for further CVE fixesRichard Purdie2022-03-221-2/+2
| | | | | | | | | | | Includes CVE-2022-0696, CVE-2022-0714, CVE-2022-0729. (From OE-Core rev: cbbe79e55169ebd83bd7c6d66acab6287367408c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0d29988958e48534a0076307bb2393a3c1309e03) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgcrypt: Upgrade 1.9.3 -> 1.9.4Richard Purdie2022-03-101-1/+1
| | | | | | | | | | | | | Includes a fix for CVE-2021-40528. (From OE-Core rev: 24664297abd3844902fa40c21e4e975d89f40383) (From OE-Core rev: 11b20e30251f11d5a35be548be51c937565260f8) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 8.2.4314 -> 8.2.4424Richard Purdie2022-03-021-3/+3
| | | | | | | | | | | | | License file had some grammar fixes. Includes CVE-2022-0554. (From OE-Core rev: 6a262ad3afb672f1976633118ecc390bf4de1ae1) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a8d0a4026359c2c8a445dba9456f8a05470293c1) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 4269 -> 4134Richard Purdie2022-03-021-3/+4
| | | | | | | | | | | | | | | License text underwent changes on how to submit Uganda donations, switch from http to https urls and an update date change but the license itself is unchanged. Also, add an entry for the top level license file. This is also the vim license so LICENSE is unchanged but we should monitor it too. (From OE-Core rev: 140247e499b85ef2d5c48f9723ed2e2ec9108fb1) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d195005e415b0b2d7c8b0b65c0aef888d4d6fc8e) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade to patch 4269Ross Burton2022-02-201-2/+2
| | | | | | | | | | | | | | | | Upgrade to the latest patch release to fix the following CVEs: - CVE-2022-0261 - CVE-2022-0318 - CVE-2022-0319 (From OE-Core rev: e6fe342dd578ca37beeb9dfc991b67dc72c60d06) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 96442e681c3acd82b09e3becd78e902709945f1f) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: update to include latest CVE fixesRoss Burton2022-02-201-2/+2
| | | | | | | | | | | | | | | | | | | | | Update the version to 4.2.4118, which incorporates the following CVE fixes: - CVE-2021-4187 - CVE-2022-0128 - CVE-2022-0156 - CVE-2022-0158 Also remove the explicit whitelisting of CVE-2021-3968 as this is now handled with an accurate CPE specifying the fixed version. (From OE-Core rev: 1ef8e3ec21b32d6d3654319561b24b8b1ce63243) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 764519ad0da6b881918667ca272fcc273b56168a) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libusb1: correct SRC_URIAlexander Kanavin2022-02-101-2/+4
| | | | | | | | | | | | (From OE-Core rev: da945043aef07a77be8d6663d419b5c690997688) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d4c37ca1f1e97d53045521e9894dc9ed5b1c22a1) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> (cherry picked from commit 0fccab0724769a862e31e635ffa1db3ba2f37312) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Backport CVE fixesRobert Joslyn2022-01-254-0/+733
| | | | | | | | | | | | | | | | | | | | | | | | | Backport fixes for CVE-2021-22922, CVE-2021-22923, CVE-2021-22945, CVE-2021-22946, and CVE-2021-22947. * https://curl.se/docs/CVE-2021-22922.html * https://curl.se/docs/CVE-2021-22923.html * https://curl.se/docs/CVE-2021-22945.html * https://curl.se/docs/CVE-2021-22946.html * https://curl.se/docs/CVE-2021-22947.html 22922 and 22923 were fixed by upstream by simply removing metalink support in newer versions. These are mitigated in older versions by disabling metalink support, which was already done by the recipe, so whitelist these CVEs. 22945, 22946, and 22947 are backported with only trivial patch fuzz modifications. (From OE-Core rev: 705718cfe243e05e0975bad3b822666363ef55df) Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade to 8.2 patch 3752Ross Burton2022-01-079-339/+28
| | | | | | | | | | | | | | | | | There's a fairly constant flow of CVEs being fixed in Vim, which are getting increasing non-trivial to backport. Instead of trying to backport (and potentially introduce more bugs), or just ignoring them entirely, upgrade vim to the latest patch. (From OE-Core rev: a264cf6b5a16343a66d9e88115ec9f30e832b0c4) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 78a4796de27d710f97c336d288d797557a58694e) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libpcre/libpcre2: correct SRC_URIAlexander Kanavin2021-12-152-2/+4
| | | | | | | | | | | | | http://ftp.pcre.org is down, take sources according to links on http://www.pcre.org (From OE-Core rev: f6791df317e66b2d3fa88d3a038d888d4512305a) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 81ba0ba3e8d9c08b8dc69c24fb1d91446739229b) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gmp: fix CVE-2021-43618Ross Burton2021-12-052-0/+28
| | | | | | | | | | (From OE-Core rev: ebf1a7c42a9bd5a9d583248af95e0a30fa241465) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit fb3b9a7f668a6ffd56a99e1e8b83cdbad2a4bc66) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: fix CVE-2021-3927 and CVE-2021-3928Mingli Yu2021-11-243-0/+68
| | | | | | | | | | Backport patches to fix CVE-2021-3927 and CVE-2021-3928. (From OE-Core rev: 41ba5054fc4d014ab3a2af0cc7673e275aaecee0) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: fix CVE-2021-3875Mingli Yu2021-11-242-0/+38
| | | | | | | | | | Backport a patch to fix CVE-2021-3875. (From OE-Core rev: de2493aac4f8ea9d8e4e59efa1359567fa186319) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: fix CVE-2021-3872 and CVE-2021-3903Mingli Yu2021-11-243-0/+97
| | | | | | | | | | | | Backport 2 patches to fix below CVEs: - CVE-2021-3872 - CVE-2021-3903 (From OE-Core rev: baa351293ed036e63d0e3253f58ad4f2e448852c) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: add explicit branch and protocol to SRC_URIAnuj Mittal2021-11-2115-15/+15
| | | | | | | | | | | | Add branch name explicitly to SRC_URI where it's not defined and switch to using https protocol for Github projects. The change was made using convert-srcuri script in scripts/contrib. (From OE-Core rev: ab781d4e3fa7425d96ea770ddfd0f01f62018c5b) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linunistring: Add missing gperf-native dependencyRichard Purdie2021-11-211-0/+1
| | | | | | | | | (From OE-Core rev: 3a467c35588cc60c80049758d4bfd57ff4a7678c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 73d3efbaeb2f412ab8d3491d2da3f3124fc009f3) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: bump HASHEQUIV_HASH_VERSION after RPM fixAnuj Mittal2021-11-031-0/+4
| | | | | | | | | | | | | | ef37fca2f4 fixes issues where PLATFORM tag in RPMs generated n aarch and x86 hosts are different for noarch RPMs. But, we'd still need to bump hashequiv version for allarch recipes to avoid issues because of the RPMs that were incorrectly generated so reproducibility tests don't fail. Also bump PR to force rebuilds. (From OE-Core rev: 2c41e766219032dca953eb7c0b18e812a8d0b8f2) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ca-certificates: update 20210119 -> 20211016Alexander Kanavin2021-11-034-62/+82
| | | | | | | | | | | (From OE-Core rev: 9c351e7a0b6e4e1cc58e3855d8b711d64764a7e3) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c479b8a810d966d7267af1b4dac38a46f55fc547) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gpgme: Use glibc provided closefrom API when availableKhem Raj2021-10-292-1/+26
| | | | | | | | | | | | | glibc 2.34+ has added this API new (From OE-Core rev: f03762543ad8f05c2b5aea2c33f86d5eeef2e8bc) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a2b2479d20d029f5a11dba8cf7f7ca3e4a5bbbe2) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* rng-tools: add systemd-udev-settle wants to serviceClaudius Heine2021-10-291-0/+1
| | | | | | | | | | | | | | | | | | | | rngd needs to start after `systemd-udev-settle` in order for the kernel modules of the random source hardware to be loaded before it is started. However, since the `rngd.service` does not require or want `systemd-udev-settle.service` it might not be scheduled for start and the `After=systemd-udev-settle.service` there has no effect. Adding `Wants=systemd-udev-settle.service` provides a weak requirement to it, so that the `rngd` is started after it, if possible. (From OE-Core rev: 8d57589389f029fc4df85211254204966a94f007) Signed-off-by: Claudius Heine <ch@denx.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e9715d4234eb7b45dee8b323799014646f0a1b07) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnupg: Be deterministic about sendmailRichard Purdie2021-10-291-0/+1
| | | | | | | | | | | | | Set a path to where sendmail would exist making the output deterministic as it no longer depends on the build host and the presense of sendmail there. (From OE-Core rev: 62b85d5a00dfdd5db0dd2ba3c9e51a87b370742f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 32e03a430f13960fe07f08c04eaa58017d977f6c) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* recipes-support/ptest-runner: Bump to v2.4.2Anibal Limon2021-10-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Changes, bcb8280 utils.c: add system data collection when a test gets stuck. c29240c utils.c: handle test timeouts directly with poll() d6f509f tests/utils.c: fix a memory corruption in find_word c10e747 main: Do not return number of failed tests when calling ptest-runner 4958988 utils.c: fix memory leak in run_ptests() fcfa6a1 clang: clean-ups to avoid -Weverything warnings. 215e52d Makefile: allow using CC env var to pick compiler fdd233d mem: Simplify memory management e5e218a mem: Fix memleak for ptest_opts 0dc42eb git: Extend the gitignore (From OE-Core rev: c0993e6c4108ae65537ad6e70de90387dacc5495) Signed-off-by: Aníbal Limón <anibal.limon@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 710fa373375beb977af704e17a925ed41c9a858d) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Backport fix for CVE-2021-3770Richard Purdie2021-10-072-0/+209
| | | | | | | | | (From OE-Core rev: 27c7e46bc4dbabdcd8c5c1a9de2906c5bc8a48c4) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 54d3d023ce55ba4a7160ed25a283f0918e7d8e2e) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: fix CVEsMingli Yu2021-10-023-0/+86
| | | | | | | | | | Backport patches to fix CVE-2021-3778 and CVE-2021-3796. (From OE-Core rev: 48a9709f955c1523918c891ca5c94f7bf5c71c54) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr: Security fix for CVE-2021-35940Armin Kuster2021-09-172-0/+59
| | | | | | | | | | | | | | | An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue. (From OE-Core rev: 2b1a8731359d990b3a8eec6403d689144a516207) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d52b78c75323fb254b5d0216f9183573b353abd3) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sqlite3: fix CVE-2021-36690Changqing Li2021-09-172-1/+65
| | | | | | | | | | | | | refer: https://nvd.nist.gov/vuln/detail/CVE-2021-36690 https://www.sqlite.org/forum/forumpost/718c0a8d17 https://sqlite.org/src/info/b1e0c22ec981cf5f (From OE-Core rev: b0c311d784e939342c4bfa771790a0113fc7a704) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: add option to disable NLS supportAndrej Valek2021-09-091-1/+3
| | | | | | | | | | | | | - Some distributions with UTF-8 locale have problem when National Language Support is enabled. Add there an option to disable it. (From OE-Core rev: 79aef159411df59f4bbdb3d3dcc87be9a7b5010e) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit da630d6d81a396c3e1635fbd7b8103df47ed2732) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lz4: Security Fix for CVE-2021-3520Armin Kuster2021-09-092-0/+28
| | | | | | | | | | | | | | | | | Source: https://github.com/lz4/lz4 MR: 111604 Type: Security Fix Disposition: Backport from https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7#diff-7055e9cf14c488aea9837aaf9f528b58ee3c22988d7d0d81d172ec62d94a88a7 ChangeID: 58492f950164e75954a97cf084df6f9af3d88244 Description: (From OE-Core rev: d7d278286d4dea215f3e8fbff59a9e95056cb7f4) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6d6a089a2f637051333e0137d2e748c823e2aa98) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* icu: increase pkgdata command buffer sizeJoe Slater2021-09-012-0/+47
| | | | | | | | | | | Mitigate pathname truncation when installing in a project with a very long pathname. (From OE-Core rev: 6cb98cbd789d53768c5d26729f10655762114e6e) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lzo: add CVE_PRODUCTMarta Rybczynska2021-08-261-0/+2
| | | | | | | | | | | | | lzo was missing CVE_PRODUCT and related CVEs (at least CVE-2014-4607) were not reported. (From OE-Core rev: 1a9addac9b78eac9a0183145792f4f293d4143bb) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 366cf8201e36df1ac836e49de04ccda1f763ca9e) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: upgrade 3.7.1 -> 3.7.2wangmy2021-08-181-1/+1
| | | | | | | | | | | (From OE-Core rev: 01321ed982a8553672808afe2d9c1bee6628055d) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3593a4c47d5e8faccb27c7cd975f18f90b9cd86f) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: Point to staging area for finding seccomp libs and includesKhem Raj2021-08-181-1/+1
| | | | | | | | | | | | | | | | | | | This ensures that if libseccomp is installed on build host then it does not resort to use it. Fixes checking for libseccomp... (cached) yes checking how to link with libseccomp... /usr/lib/libseccomp.so (From OE-Core rev: 49dc5bde2d7ad5f965984daa1298a995e8261af3) Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3751ac58720a500e3b749b2296922d7c82db49a1) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: Enable seccomp if FEATURE is setArmin Kuster2021-08-181-1/+1
| | | | | | | | | | | (From OE-Core rev: f6046bc92c2e86f3cfa4bcb42091b4407aa31a09) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f2527b5567252c7da4fbd863e119c8114e6debcd) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nettle: update 3.7.2 -> 3.7.3Alexander Kanavin2021-08-141-1/+1
| | | | | | | | | | | | | | fix CVE-2021-3580 (From OE-Core rev: 219c89310264f99c2c43bb80e437a8a1e8e3217a) (From OE-Core rev: 49868162a1a1d088fbaabeffcc2debcbfc17b026) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix CVESMingli Yu2021-08-144-0/+833
| | | | | | | | | | | | | Backport patches to fix below CVEs: CVE-2021-22901 CVE-2021-22924 CVE-2021-22926 (From OE-Core rev: 8a01fe853c151ba787802b8d5895273c6da8bc78) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix CVE-2021-22925Mingli Yu2021-08-142-0/+51
| | | | | | | | | | | | | CVE-2021-22925 Reported-by: Red Hat Product Security Bug: https://curl.se/docs/CVE-2021-22925.html (From OE-Core rev: ee0340c35f811dd1c0926480673a7fec7bbb985b) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* aspell: fix CVE-2019-25051Lee Chee Yang2021-08-142-1/+104
| | | | | | | | | | (From OE-Core rev: b415b0bc39dfae329e845569a122bcd301c326cc) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 297f8c4eb4ff209b5ea69910902d216d86dbe2bf) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE-2021-22897Khairul Rohaizzat Jamaluddin2021-07-202-0/+73
| | | | | | | | | | | CVE: CVE-2021-22897 (From OE-Core rev: 718d6ca70b99fa4bef4c88114c1bd511b6df121e) Signed-off-by: Khairul Rohaizzat Jamaluddin <khairul.rohaizzat.jamaluddin@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE-2021-22898Khairul Rohaizzat Jamaluddin2021-07-202-0/+33
| | | | | | | | | | | CVE: CVE-2021-22898 (From OE-Core rev: 4d703dd86c6b27790e1e34d3127652657243d20d) Signed-off-by: Khairul Rohaizzat Jamaluddin <khairul.rohaizzat.jamaluddin@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* boost-build-native: workaround one rarely hang problem on fedora34Changqing Li2021-07-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reproduce scenes: * On fedora34 * autofs.service is started * test is nis user, which mounted at /nis by autofs * under /nis/test, there are symlinks point to another nis mount point /nis/yan Result: task boost-build-native:do_install hang forever NOTE: recipe ovmf-edk2-stable202102-r0: task do_package_write_rpm: Succeeded NOTE: Running noexec task 8124 of 8152 (/layers/oe-core/meta/recipes-core/ovmf/ovmf_git.bb:do_build) Bitbake still alive (5000s) Bitbake still alive (10000s) Bitbake still alive (15000s) Bitbake still alive (20000s) Bitbake still alive (25000s) Bitbake still alive (30000s) Bitbake still alive (35000s) Bitbake still alive (40000s) Bitbake still alive (45000s) Bitbake still alive (50000s) $ps aux | grep b2 test 2773444 0.0 0.0 13532 2748 ? D Jul01 0:00 ./b2 install --prefix=/build/tmp-glibc/work/x86_64-linux/boost-build-native/4.4.1-r0/recipe-sysroot-native/usr staging-prefix=/build/tmp-glibc/work/x86_64-linux/boost-build-native/4.4.1-r0/image/build/tmp-glibc/work/x86_64-linux/boost-build-native/4.4.1-r0/recipe-sysroot-native/usr $ sudo cat /proc/2773444/stack [<0>] autofs_wait+0x257/0x720 [<0>] autofs_mount_wait+0x49/0xf0 [<0>] autofs_d_manage+0x76/0x1a0 [<0>] __traverse_mounts+0xd9/0x220 [<0>] step_into+0x3ad/0x6d0 [<0>] walk_component+0x62/0x190 [<0>] link_path_walk.part.0.constprop.0+0x20d/0x350 [<0>] path_lookupat+0x3a/0x1b0 [<0>] filename_lookup+0x9b/0x180 [<0>] vfs_statx+0x64/0x100 [<0>] __do_sys_newfstatat+0x1e/0x40 [<0>] do_syscall_64+0x33/0x40 [<0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 $ dmesg [1559743.424610] autofs4:pid:2773444:autofs_mount_wait: waiting for mount name=yan [1559743.424621] autofs4:pid:2773444:autofs_wait: existing wait id = 0x00000056, name = yan, nfy=1 [1560001.400440] autofs4:pid:2774530:autofs_mount_wait: waiting for mount name=yan [1560001.400452] autofs4:pid:2774530:autofs_wait: existing wait id = 0x00000056, name = yan, nfy=1 [1560022.493282] autofs4:pid:2774537:autofs_mount_wait: waiting for mount name=yan [1560022.493292] autofs4:pid:2774537:autofs_wait: existing wait id = 0x00000056, name = yan, nfy=1 [1560122.076589] autofs4:pid:3979116:autofs_mount_wait: mount wait done status=-4 [1560162.222374] autofs4:pid:2774530:autofs_mount_wait: mount wait done status=-4 [1560167.116188] autofs4:pid:2774537:autofs_mount_wait: mount wait done status=-4 [1560188.140532] autofs4:pid:2774671:autofs_mount_wait: waiting for mount name=yan [1560188.140540] autofs4:pid:2774671:autofs_wait: existing wait id = 0x00000056, name = yan, nfy=1 [1560189.651905] autofs4:pid:2774671:autofs_mount_wait: mount wait done status=-4 Analyzation: b2 will walk the HOME dir, when access the symlink point to /nis/yan, autofs hang at autofs_wait. the process stay at D stat forever. This maybe caused by abnormal status of autofs.service. The problem cannot reproduce after restart autofs.service. There should be an autofs bug. and there is an autofs hang problem bug on fedora34 on it's bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1953390 Workaround: Since b2 don't actually write something to HOME dir, change HOME dir to /var/run, a dir not mounted by autofs. (From OE-Core rev: 760b7b6a031c9dcc9a44e086e1d2dbb2171b3c97) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7ff692d2e9787bb5b36929a208597595473db0c7) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix build when proxy is not enabled in PACKAGECONFIGAnuj Mittal2021-07-063-0/+73
| | | | | | | | | | | | | | | | | | Backport upstream patches to fix issues introduced by a backported CVE patch. Fixes: | ../../curl-7.75.0/lib/vtls/vtls.c: In function ‘Curl_ssl_addsessionid’: | ../../curl-7.75.0/lib/vtls/vtls.c:508:14: error: ‘isProxy’ redeclared as different kind of symbol | 508 | const bool isProxy = FALSE; | | ^~~~~~~ | ../../curl-7.75.0/lib/vtls/vtls.c:488:37: note: previous definition of ‘isProxy’ with type ‘_Bool’ | 488 | bool isProxy, | | ^ (From OE-Core rev: e900a44e76dc2bb20ff725f24333c1c2b330bf41) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgcrypt: upgrade 1.9.2 -> 1.9.3Alexander Kanavin2021-07-061-2/+2
| | | | | | | | | | | | | | License-Update: added terms for cipher/cipher-gcm-ppc.c, still under GPL (From OE-Core rev: d28c1f67c447f99313890e68083da61adcc66f74 ) (From OE-Core rev: 8cb77273abd6985242cf45100b2fb732db74e909) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: cleanup CVE patches for hardknottTrevor Gamblin2021-06-262-9/+12
| | | | | | | | | | | | | | | | The patch backported to address CVE-2021-22890 was missing a bracket to properly close out the logic in lib/vtls/wolfssl.c. Fix this so to avoid any surprise failures when using curl with hardknott. Also fix the CVE designation in the patch descriptions for CVEs CVE-2021-22890 and CVE-2021-22876 so that CVE checks run with bitbake correctly detect that they are patched. (From OE-Core rev: 456ba1717fc3ebb9d10cc6a3c916b07f7c4e8a22) Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix CVE-2021-22876Trevor Gamblin2021-06-032-0/+153
| | | | | | | | | | | | Backport and modify the patch for CVE-2021-22876 from curl 7.76 to make it apply cleanly on 7.75. CVE: CVE-2021-22876 (From OE-Core rev: 7c39b71b78ffc64a456872769b341cfc662e747d) Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix CVE-2021-22890Trevor Gamblin2021-06-032-0/+518
| | | | | | | | | | | | Backport and modify the patch for CVE-2021-22890 from curl 7.76 to make it apply cleanly on 7.75. CVE: CVE-2021-22890 (From OE-Core rev: b11dc35cce0449623182ecf044c4a49664119b9c) Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* boost: fix do_fetch failureStefan Ghinea2021-05-301-1/+1
| | | | | | | | | | | | | Bintray service has been discontinued causing boost do_fetch to fail: WARNING: boost-1.76.0-r0 do_fetch: Failed to fetch URL https://dl.bintray.com/boostorg/release/1.75.0/source/boost_1_75_0.tar.bz2, attempting MIRRORS if available RP: Backport to 1.75.0 (From OE-Core rev: 146f04f9d38f781767a52884f4870570c0d817e0) Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libcap: Configure Make variables correctly without a horrible hackPeter Kjellerstedt2021-05-151-13/+8
| | | | | | | | | | | | | | | | | | | | | Occasionally, the build would fail with: make[2]: execvp: mkdir: Argument list too long This turned out to be due to a hacky solution used in the recipe to modify the Makefile, which resulted in one more $(BUILD_CFLAGS) being added to the immediately expanded BUILD_CFLAGS Make variable each time do_configure was executed. After a couple of times, this lead to an environment with a 140 kB BUILD_CFLAGS when mkdir should execute, which resulted in the E2BIG. (From OE-Core rev: 44900610bea76ab8983a899599f78790f6c5f659) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 116e6b61c585c6f0f7ae6f010bd490bb39914348) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* db: update CVE_PRODUCTChen Qi2021-05-151-1/+1
| | | | | | | | | | | | | Update CVE_PRODUCT to also include 'berkeley_db'. For example, CVE-2020-2981 uses 'berkeley_db'. (From OE-Core rev: b5004de05327c734d63cfac153ebf1542f9177c9) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ad799b109716ccd2f44dcf7a6a4cfcbd622ea661) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libevent: Increase ptest timing tolerance 50 ms -> 100 msYi Fan Yu2021-05-112-0/+34
| | | | | | | | | | | | | | | | Adjusting the tolerance to a more reasonable time given the load on the AB and given the high amount(100) of events some of the tests like `common_timeout` generates. [YOCTO #14163] (From OE-Core rev: d5d88c2293e8ebc958d1bce9af8f796024443be9) Signed-off-by: Yi Fan Yu <yifan.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 38b36d2b90d570149e63816e68f457aea28a5092) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* diffoscope: add native libraries to LD_LIBRARY_PATHAlexander Kanavin2021-05-111-0/+1
| | | | | | | | | | | | | | | | | Reversal of global setting in previous commit necessitates a local fix, otherwise, this happens: File "/home/pokybuild/yocto-worker/reproducible-debian/build/build-st-52142/tmp/work/x86_64-linux/diffoscope-native/172-r0/recipe-sysroot-native/usr/lib/python3.9/ctypes/__init__.py", line 392, in __getitem__ func = self._FuncPtr((name_or_ordinal, self)) AttributeError: nativepython3: undefined symbol: archive_errno (From OE-Core rev: 73edf1b88f0997f7368bfdb59d3076f085c5da4e) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 87884d9938829d5ae5d250f483c749e00cd83322) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-18 14:13:14 +0000