linux/meta-openembedded.git, branch kraj/dunfell

dovecot: add CVE-2016-4983 to allowlist

2021-07-06T14:50:13+00:00

CVE-2016-4983 affects only postinstall script on specific distribution, so add it to allowlist. Signed-off-by: Yuichi Ito Signed-off-by: Khem Raj (cherry picked from commit 3613b50a84559ce771866cd1eef1141fa3e6d238) [mkcert.sh does mask 077 first] Signed-off-by: Armin Kuster (cherry picked from commit d1fb027f894921ea02c984eb581ee1500c613470) Signed-off-by: Armin Kuster

cyrus-sasl: add CVE-2020-8032 to allowlist

2021-07-05T22:27:25+00:00

This affects only openSUSE, so add it to allowlist. Signed-off-by: Yuichi Ito Signed-off-by: Khem Raj (cherry picked from commit 711e932b14de57a5f341124470b2f3f131615a25) Signed-off-by: Armin Kuster (cherry picked from commit 26819375448077265cd4c9dbb88b6be08b899e3f) Signed-off-by: Armin Kuster

add CVE-2011-2411 to allowlist

2021-07-05T22:26:43+00:00

This affects only on HP NonStop Server, so add it to allowlist. Signed-off-by: Sekine Shigeki Signed-off-by: Khem Raj (cherry picked from commit bb4a4f0ff8d9926137cb152fd3f2808bd9f961ce) Signed-off-by: Armin Kuster (cherry picked from commit d614d160a10b3c5ac36702fbd433f98925a9aa8e) Signed-off-by: Armin Kuster

python3-django: upgrade 2.2.23 -> 2.2.24

2021-07-05T22:25:06+00:00

Version 2.2.24 contains a fix for CVE-2021-33571 and is the latest LTS release. Signed-off-by: Trevor Gamblin Signed-off-by: Khem Raj (cherry picked from commit fa2d3338fb87a38a66d11735b876ce2320045b0d) Signed-off-by: Armin Kuster (cherry picked from commit c51e79dd854460c6f6949a187970d05362152e84) Signed-off-by: Armin Kuster

python3-django: upgrade 2.2.22 -> 2.2.23

2021-07-05T21:54:58+00:00

2.2.23 is a bugfix release: - Fixed a regression in Django 2.2.21 where saving FileField would raise a SuspiciousFileOperation even when a custom upload_to returns a valid file path (#32718). Signed-off-by: Trevor Gamblin Signed-off-by: Khem Raj Signed-off-by: Trevor Gamblin (cherry picked from commit f07a8c1376fe9f5eb4fc0ddff8ca1a1b3c3f173b) Signed-off-by: Armin Kuster (cherry picked from commit b2716ef06a76854497de80c642bf7f63b07f7a6c) Signed-off-by: Armin Kuster

python3-django: upgrade 2.2.20 -> 2.2.22

2021-07-05T21:54:49+00:00

Version 2.2.22 includes a fix for CVE-2021-32052. Signed-off-by: Trevor Gamblin Signed-off-by: Khem Raj Signed-off-by: Trevor Gamblin (cherry picked from commit b26099fc156961ba252c3b6281f09799e91347ba) Signed-off-by: Armin Kuster (cherry picked from commit f3758cb44486ce87c96b803efb2b5417a8e90708) Signed-off-by: Armin Kuster

python3-django: upgrade to 2.2.20

2021-07-05T21:54:40+00:00

2.2.x is LTS, so upgrade to latest release 2.2.20. This upgrade fixes several CVEs such as CVE-2021-3281. Also, CVE-2021-28658.patch is dropped as it's already in 2.2.20. Signed-off-by: Chen Qi Signed-off-by: Khem Raj Signed-off-by: Trevor Gamblin Signed-off-by: Armin Kuster (cherry picked from commit e705d4932a57d0dc3a961fed73ae5ad2e0313429) Signed-off-by: Armin Kuster

python3-django: fix CVE-2021-28658

2021-07-05T21:54:38+00:00

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability. References: https://nvd.nist.gov/vuln/detail/CVE-2021-28658 Upstream patches: https://github.com/django/django/commit/4036d62bda0e9e9f6172943794b744a454ca49c2 Signed-off-by: Stefan Ghinea Signed-off-by: Khem Raj Signed-off-by: Trevor Gamblin Signed-off-by: Armin Kuster (cherry picked from commit aef354a0c29a4c6aad4ace53190b5573c78d881b) Signed-off-by: Armin Kuster

python3-django: upgrade 2.2.13 -> 2.2.16

2021-07-05T21:53:48+00:00

Summary of release notes from https://docs.djangoproject.com/en/2.2/releases/ 2.2.14 release notes: - Fixed messages of InvalidCacheKey exceptions and CacheKeyWarning warnings raised by cache key validation (#31654). 2.2.15 release notes: - Allowed setting the SameSite cookie flag in HttpResponse.delete_cookie() (#31790). - Fixed crash when sending emails to addresses with display names longer than 75 chars on Python 3.6.11+, 3.7.8+, and 3.8.4+ (#31784). 2.2.16 release notes: - Fixed CVE-2020-24583: Incorrect permissions on intermediate-level directories on Python 3.7+ - Fixed CVE-2020-24584: Permission escalation in intermediate-level directories of the file system cache on Python 3.7+ - Fixed a data loss possibility in the select_for_update(). When using related fields pointing to a proxy model in the of argument, the corresponding model was not locked (#31866). - Fixed a data loss possibility, following a regression in Django 2.0, when copying model instances with a cached fields value (#31863). Signed-off-by: Trevor Gamblin Signed-off-by: Khem Raj (cherry picked from commit eb69aad33fc06f06544589ec483f9b76464f6c5f) Signed-off-by: Armin Kuster

python3-django: upgrade 2.2.7 -> 2.2.13

2021-07-05T21:53:33+00:00

Upgrade from 2.2.7 for: - Bugfixes, including CVE-2020-13254, CVE-2020-13596, many others; - Official support for Python 3.8 (as of Django 2.2.8) Signed-off-by: Trevor Gamblin Signed-off-by: Khem Raj (cherry picked from commit 8c4e201c6288e5fee7eef8f6eba576d4c426109c) Signed-off-by: Armin Kuster