linux/meta-openembedded.git/meta-networking/recipes-connectivity, branch kirkstone-next

netplan: Fix CVE-2022-4968

2025-04-20T17:43:06+00:00

Backport patch[1] to fix CVE-2022-4968. [1] https://github.com/canonical/netplan/commit/4c39b75b5c6ae7d976bda6da68da60d9a7f085ee Signed-off-by: Jinfeng Wang

mbedtls: fix CVE-2024-28755 and CVE-2024-28836

2025-02-09T15:58:36+00:00

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2. fix indent issue in mbedtls_3.5.2.bb file. Reference: https://security-tracker.debian.org/tracker/CVE-2024-28755 https://security-tracker.debian.org/tracker/CVE-2024-28836 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

mosquitto: upgrade 2.0.19 -> 2.0.20

2024-12-31T13:59:59+00:00

Changelog: ========== Broker: - Fix QoS 1 / QoS 2 publish incorrectly returning "no subscribers". Closes #3128. - Open files with appropriate access on Windows. - Don't allow invalid response topic values. - Fix some strict protocol compliance issues. Client library: - Fix cmake build on OS X. Build: - Fix build on NetBSD Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj Signed-off-by: Peter Marko

mosquitto: upgrade 2.0.18 -> 2.0.19

2024-12-31T13:59:56+00:00

- Solves CVE-2024-8376 - removed 1571.patch and 2894.patch, already applied in v2.0.19 https://github.com/eclipse/mosquitto/blob/v2.0.19/ChangeLog.txt Signed-off-by: Fabrice Aeschbacher Reviewed-by: Peter Marko Signed-off-by: Khem Raj Signed-off-by: Peter Marko

freeradius: upgrade 3.0.21 -> 3.0.27

2024-12-08T19:54:19+00:00

ChangeLog: https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_27 Configuration changes: BlastRADIUS mitigations have been added to the "security" section. See require_message_authenticator and also limit_proxy_state. BlastRADIUS mitigations have been added to radclient. See man radclient, and the -b option. Security fixes: CVE-2024-3596: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-3596 https://www.freeradius.org/security/ https://www.blastradius.fail/ https://www.inkbridgenetworks.com/web/content/2557?unique=47be02c8aed46c53b0765db185320249ad873d95 Signed-off-by: Haixiao Yan [Drop CVE-2024-3596 patch backported early] Signed-off-by: Armin Kuster

mbedtls: Upgrade 2.28.8 -> 2.28.9

2024-12-08T19:39:17+00:00

The mbedtls 2.28.9 includes the security fix for CVE-2024-45157, bug fixes and minor enhancements [1]. [1] https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.9 Signed-off-by: Mingli Yu Signed-off-by: Armin Kuster

freeradius: Security fix for CVE-2024-3596

2024-12-08T19:39:17+00:00

CVE fixed: - CVE-2024-3596 freeradius: forgery attack Upstream-Status: Backport from v3.0.x branch, commit range 3a00a6ecc188629b0441fd45ad61ca8986de156e..da643f1edc267ce95260dc36069e6f1a7a4d66f8 Signed-off-by: Rohini Sangam Signed-off-by: Siddharth Doshi Signed-off-by: Armin Kuster

mbedtls: upgrade 2.28.7->2.28.8

2024-05-26T19:22:08+00:00

Includes security fixes for: CVE-2024-28960 - Insecure handling of shared memory in PSA Crypto APIs Release notes: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.8 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

mbedtls: Upgrade 3.5.0 -> 3.5.2

2024-02-28T13:18:18+00:00

* Includes security fix for CVE-2024-23170 - Timing side channel in private key RSA operations * Includes security fix for CVE-2024-23775 - Buffer overflow in mbedtls_x509_set_extension() Use canonical URL, add UPSTREAM_CHECK_GITTAGREGEX. License-update: Upstream clarified licensing as dual Apache-2.0 or GPL-2.0 or later Changelog: https://github.com/Mbed-TLS/mbedtls/blob/v3.5.2/ChangeLog Signed-off-by: Soumya Sambu Signed-off-by: Armin Kuster

mbedtls: upgrade 2.28.5 -> 2.28.7

2024-02-28T13:18:18+00:00

Includes security fixes for: CVE-2024-23170 - Timing side channel in private key RSA operations CVE-2024-23775 - Buffer overflow in mbedtls_x509_set_extension() License updated to dual Apache-2.0 OR GPL-2.0-or-later. Changelog: https://github.com/Mbed-TLS/mbedtls/blob/v2.28.7/ChangeLog Signed-off-by: Soumya Sambu Signed-off-by: Armin Kuster