Mirror of git.openembedded.org/meta-openembedded https://git.enea.com/cgit/linux/meta-openembedded.git/atom?h=mickledore 2022-01-25T18:56:04+00:00 2022-01-25T18:56:04+00:00 wangmy wangmy@fujitsu.com 2022-01-25T13:19:02+00:00 urn:sha1:16bda7854217d4665e98a736476c117ad2d26802 0001-Prepare-for-CVE-2021-30004.patch.patch CVE-2019-16275.patch CVE-2019-5061.patch CVE-2021-0326.patch CVE-2021-27803.patch CVE-2021-30004.patch removed since they're included in 2.10 License-Update: year updated to 2022. Changelog: ========= * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added option send SAE Confirm immediately (sae_config_immediate=1) after SAE Commit - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2) - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed WPS UPnP SUBSCRIBE handling of invalid operations [https://w1.fi/security/2020-1/] * fixed PMF disconnection protection bypass [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * fixed various issues in experimental support for EAP-TEAP server * added configuration (max_auth_rounds, max_auth_rounds_short) to increase the maximum number of EAP message exchanges (mainly to support cases with very large certificates) for the EAP server * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * extended HE (IEEE 802.11ax) support, including 6 GHz support * removed obsolete IAPP functionality * fixed EAP-FAST server with TLS GCM/CCM ciphers * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible; owe_ptk_workaround=1 can be used to enabled a a workaround for the group 20/21 backwards compatibility * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * added support for PASN * added EAP-TLS server support for TLS 1.3 (disabled by default for now) * a large number of other fixes, cleanup, and extensions Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2021-08-03T17:21:25+00:00 Martin Jansa Martin.Jansa@gmail.com 2021-07-29T15:04:53+00:00 urn:sha1:c61dc077bbd81260e4f167fa2251643ba0ba6974 This is the result of automated script (0.9.1) conversion: oe-core/scripts/contrib/convert-overrides.py . converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> 2021-05-17T16:15:23+00:00 Alexander Vickberg wickbergster@gmail.com 2021-05-17T16:03:48+00:00 urn:sha1:d6ef4170747d6668fa940328334055eef3e1e1d6 The patch recently added for CVE-2021-30004 broke compilation with CONFIG_TLS=internal. This adds the necessary function to let it compile again. Signed-off-by: Alexander Vickberg <wickbergster@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2021-04-13T15:09:17+00:00 Stefan Ghinea stefan.ghinea@windriver.com 2021-04-09T13:12:08+00:00 urn:sha1:e2bd6a52bf689b77b237eaee3067d2b0b6eee3d5 In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c. References: https://nvd.nist.gov/vuln/detail/CVE-2021-30004 Upstream patches: https://w1.fi/cgit/hostap/commit/?id=a0541334a6394f8237a4393b7372693cd7e96f15 Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2021-04-08T16:25:54+00:00 Mingli Yu mingli.yu@windriver.com 2021-04-08T06:33:17+00:00 urn:sha1:5a085c588adaf79bb2bca7921c82d893877b28a1 Backport 2 patches to fix two CVEs. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2021-03-22T16:25:16+00:00 Mingli Yu mingli.yu@windriver.com 2021-03-22T08:23:20+00:00 urn:sha1:f422ff618009e6899d2475349ffeb57e97779cb2 Backport a patch to fix CVE-2019-5061. Reference: https://security-tracker.debian.org/tracker/CVE-2019-5061 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2020-04-21T14:14:06+00:00 Wang Mingyu wangmy@cn.fujitsu.com 2020-04-21T03:09:00+00:00 urn:sha1:0acf2e26e9fbf3c28bcb209ccb2ad73e0d16b1e5 security Advisory References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16275 Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2019-11-22T01:51:37+00:00 Denys Dmytriyenko denys@ti.com 2019-11-21T05:31:49+00:00 urn:sha1:4c00e5fed9532fe6ee71ce96b0124fc234b44d4e Avoid warning due to the class rename in OE-Core. Signed-off-by: Denys Dmytriyenko <denys@ti.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2019-08-09T15:09:28+00:00 Yuan Chao yuanc.fnst@cn.fujitsu.com 2019-08-09T00:57:54+00:00 urn:sha1:cb036c84043af376f6b1e0a902e281ae25f908b7 Signed-off-by: Yuan Chao <yuanc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2019-04-29T17:13:56+00:00 Mingli Yu mingli.yu@windriver.com 2019-04-23T04:33:18+00:00 urn:sha1:f0a1045515860d9c681ab07f68e1c6d2bec79296 License-Update: Copyright year updated to 2019. Remove 8 backported patches. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Acked-by: Philip Balister <philip@balister.org> Signed-off-by: Khem Raj <raj.khem@gmail.com>