linux/meta-openembedded.git/meta-oe/recipes-dbs, branch kirkstone-next

mariadb: fix CVE-2024-21096

2025-07-03T00:38:53+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Confidentiality, Integrity and Availability impacts). CVE-2024-21096-0001, CVE-2024-21096-0002 are CVE fixes and rest are regression fixes. References: https://nvd.nist.gov/vuln/detail/CVE-2024-21096 https://security-tracker.debian.org/tracker/CVE-2024-21096 Upstream patches: https://github.com/MariaDB/server/commit/13663cb5c4558383e9dab96e501d72ceb7a0a158 https://github.com/MariaDB/server/commit/1c425a8d854061d1987ad4ea352c7270652e31c4 https://github.com/MariaDB/server/commit/77c4c0f256f3c268d3f72625b04240d24a70513c https://github.com/MariaDB/server/commit/d60f5c11ea9008fa57444327526e3d2c8633ba06 https://github.com/MariaDB/server/commit/d20518168aff435a4843eebb108e5b9df24c19fb Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

mariadb: fix CVE-2023-52969 and CVE-2023-52970

2025-07-03T00:38:49+00:00

CVE-2023-52969: MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. can sometimes crash with an empty backtrace log. This may be related to make_aggr_tables_info and optimize_stage2. CVE-2023-52970: MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11.4.* crashes in Item_direct_view_ref::derived_field_transformer_for_where. CVE-2023-52969-CVE-20230-52970-0001 and CVE-2023-52969-CVE-20230-52970-0002 are dependent commits while CVE-2023-52969-CVE-20230-52970-0003 and CVE-2023-52969-CVE-20230-52970-0004 are actual CVE fixes. References: https://nvd.nist.gov/vuln/detail/CVE-2023-52969 https://nvd.nist.gov/vuln/detail/CVE-2023-52970 Upstream patches: https://github.com/MariaDB/server/commit/e6403733897483bed249875f0f3e5e9937ca2b38 https://github.com/MariaDB/server/commit/d98ac8511e39770ef3d8b42937c84e876d1459e https://github.com/MariaDB/server/commit/9b313d2de1df65626abb3b1d6c973f74addb12fb https://github.com/MariaDB/server/commit/4fc9dc84b017cf9f30585bcdef0663f9425fe460 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

mariadb: fix CVE-2023-52968

2025-07-03T00:38:46+00:00

MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-52968 Upstream patch: https://github.com/MariaDB/server/commit/74883f5e2f4c0e09f4f4e9e272a8e5bfd91a9489 Fix indent issue in mariadb.inc file. Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

postgresql: upgrade 14.17 -> 14.18

2025-07-03T00:31:21+00:00

Upgrade includes fix for CVE-2025-4207 Release notes: https://www.postgresql.org/docs/release/14.18/ 0001-configure.ac-bypass-autoconf-2.69-version-check.patch refreshed for 14.18 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

postgresql: upgrade 14.14 -> 14.17

2025-03-06T14:45:52+00:00

License-Update: Update license year to 2025 Includes fix for CVE-2025-1094 Changelog: https://www.postgresql.org/docs/release/14.17/ Refreshed 0003-configure.ac-bypass-autoconf-2.69-version-check.patch for 14.17 Signed-off-by: Vijay Anusuri Signed-off-by: Armin Kuster

postgresql: upgrade 14.13 -> 14.14

2024-12-31T14:00:05+00:00

Includes fix for CVE-2024-10976, CVE-2024-10977, CVE-2024-10978 and CVE-2024-10979 Changelog: https://www.postgresql.org/docs/release/14.14/ 0001-configure.ac-bypass-autoconf-2.69-version-check.patch refreshed for 14.14 Signed-off-by: Yogita Urade

rocksdb: Add ptest support

2024-10-13T15:19:42+00:00

# ./run-ptest PASS: arena_test PASS: cache_test PASS: db_basic_test PASS: env_basic_test PASS: testutil_test Signed-off-by: Mingli Yu Signed-off-by: Armin Kuster

postgresql: upgrade 14.11 -> 14.13

2024-08-25T22:11:33+00:00

Addresses CVEs CVE-2024-4317 & CVE-2024-7348 and other bug fixes. Release notes are available at: https://www.postgresql.org/docs/release/14.13/ https://www.postgresql.org/docs/release/14.12/ 0001-configure.ac-bypass-autoconf-2.69-version-check.patch refreshed for new version. Signed-off-by: Vijay Anusuri Signed-off-by: Armin Kuster

postgresql: Upgrade to 14.11

2024-03-25T11:11:05+00:00

Addresses CVEs and other bug fixes. Remove patches that are fixed in this release. Release notes are available at: https://www.postgresql.org/docs/release/14.10/ https://www.postgresql.org/docs/release/14.11/ 0001-configure.ac-bypass-autoconf-2.69-version-check.patch refreshed for new version. License-Update: Copyright year updated Signed-off-by: Soumya Sambu Signed-off-by: Armin Kuster

mariadb: fix CVE-2023-22084

2024-02-28T13:18:18+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). References: https://nvd.nist.gov/vuln/detail/CVE-2023-22084 https://security-tracker.debian.org/tracker/CVE-2023-22084 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster