summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* dnsmasq: Upgrade 2.87 -> 2.90Soumya Sambu2024-03-255-87/+3
| | | | | | | | | | | | | | Fixes CVE-2023-50387 and CVE-2023-50868 Remove backported CVE patch. Remove patch for lua as hardcoding lua version was removed. Changelog: =========== https://thekelleys.org.uk/dnsmasq/CHANGELOG Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* unixodbc: Fix CVE-2024-1013Soumya Sambu2024-03-252-0/+54
| | | | | | | | | | | | | An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken. References: https://nvd.nist.gov/vuln/detail/CVE-2024-1013 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openjpeg: Backport fix CVE-2021-3575Vivek Kumbhar2024-03-252-0/+46
| | | | | | | Upstream-Status: Backport from https://github.com/uclouvain/openjpeg/commit/7bd884f8750892de4f50bf4642fcfbe7011c6bdf Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* c-ares: fix CVE-2024-25629Yogita Urade2024-03-252-0/+35
| | | | | | | | | | | | | | | | | | | | | c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist. References: https://nvd.nist.gov/vuln/detail/CVE-2024-25629 https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q https://security-tracker.debian.org/tracker/CVE-2024-25629 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opencv: fix reproducibility issuesAnuj Mittal2024-03-251-17/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Download and unpack contrib modules and other repositories in S instead of WORKDIR so they don't escape file-prefix-map substitutions. Fixes a number of reproducibility problems because of OpenCV check macros that were embedding path to files in contrib/. MJ: this is backport from langdale and fixes not only reproducibility issues but also pseudo aborts in do_install when do_install is executed again after do_package (in incremental builds): | DEBUG: Executing shell function do_install | NOTE: DESTDIR=opencv/4.5.5-r0/image VERBOSE=1 cmake --build opencv/4.5.5-r0/build --target install -- | abort()ing pseudo client by server request. See https://wiki.yoctoproject.org/wiki/Pseudo_Abort for more details on this. | Check logfile: opencv/4.5.5-r0/pseudo//pseudo.log | Subprocess aborted and pseudo.log file shows: path mismatch [3 links]: ino 214373575 db 'opencv/4.5.5-r0/package/usr/src/debug/lib32-opencv/4.5.5-r0/contrib/modules/intensity_transform/src/bimef.cpp' req 'opencv/4.5.5-r0/contrib/modules/intensity_transform/src/bimef.cpp'. easily reproducible with: bitbake -c cleansstate opencv; bitbake -c package opencv; bitbake -c install -f opencv unlike ${S} ${WORKDIR}/contrib isn't in default PSEUDO_IGNORE_PATHS Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: Upgrade to 14.11Soumya Sambu2024-03-255-535/+5
| | | | | | | | | | | | | | | | Addresses CVEs and other bug fixes. Remove patches that are fixed in this release. Release notes are available at: https://www.postgresql.org/docs/release/14.10/ https://www.postgresql.org/docs/release/14.11/ 0001-configure.ac-bypass-autoconf-2.69-version-check.patch refreshed for new version. License-Update: Copyright year updated Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openvpn: ignore CVE-2023-7235Soumya Sambu2024-03-251-0/+3
| | | | | | | | | | | This CVE is related to OpenVPN 2.x GUI on Windows. References: https://community.openvpn.net/openvpn/wiki/CVE-2023-7235 https://security-tracker.debian.org/tracker/CVE-2023-7235 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mbedtls: Upgrade 3.5.0 -> 3.5.2Soumya Sambu2024-02-281-3/+4
| | | | | | | | | | | | | | | * Includes security fix for CVE-2024-23170 - Timing side channel in private key RSA operations * Includes security fix for CVE-2024-23775 - Buffer overflow in mbedtls_x509_set_extension() Use canonical URL, add UPSTREAM_CHECK_GITTAGREGEX. License-update: Upstream clarified licensing as dual Apache-2.0 or GPL-2.0 or later Changelog: https://github.com/Mbed-TLS/mbedtls/blob/v3.5.2/ChangeLog Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mbedtls: upgrade 2.28.5 -> 2.28.7Soumya Sambu2024-02-281-3/+3
| | | | | | | | | | | | | | Includes security fixes for: CVE-2024-23170 - Timing side channel in private key RSA operations CVE-2024-23775 - Buffer overflow in mbedtls_x509_set_extension() License updated to dual Apache-2.0 OR GPL-2.0-or-later. Changelog: https://github.com/Mbed-TLS/mbedtls/blob/v2.28.7/ChangeLog Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade from 4.2.7 to 4.2.10Fathi Boudra2024-02-281-1/+1
| | | | | | | | | | Upgrade to the latest 4.x LTS release. Bugs fixes only. Fix CVE: CVE-2024-24680: Potential denial-of-service in intcomma template filter Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* graphviz: fix CVE-2023-46045Meenali Gupta2024-02-284-0/+111
| | | | | | | | Graphviz 2.36 before 10.0.0 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root. Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* squid: Backport fix for CVE-2023-49286 and CVE-2023-50269Vijay Anusuri2024-02-283-0/+151
| | | | | | | | | | | | | | | import patches from ubuntu to fix CVE-2023-49286 CVE-2023-50269 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/squid/tree/debian/patches?h=ubuntu/focal-security&id=9ccd217ca9428c9a6597e9310a99552026b245fa Upstream commit https://github.com/squid-cache/squid/commit/6014c6648a2a54a4ecb7f952ea1163e0798f9264 & https://github.com/squid-cache/squid/commit/9f7136105bff920413042a8806cc5de3f6086d6d] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mariadb: fix CVE-2023-22084Yogita Urade2024-02-282-0/+92
| | | | | | | | | | | | | | | | | | | | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). References: https://nvd.nist.gov/vuln/detail/CVE-2023-22084 https://security-tracker.debian.org/tracker/CVE-2023-22084 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: Set CVE_PRODUCT to "node.js"virendra thakur2024-02-281-0/+2
| | | | | | | Set CVE_PRODUCT to 'node.js' for nodjs recipe Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* Revert "libcroco: Add fix for CVE-2020-12825"Martin Jansa2024-02-072-212/+0
| | | | | | | | | | This reverts commit 522603beb6d88ad6ea443806bb986096d5b766e6. This change was for oe-core not meta-oe repository, creating unused directory "meta" which doesn't belong here. Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postfix: Backport fix for CVE-2023-51764Ashish Sharma2024-02-073-0/+1357
| | | | | | | | Import patches from ubuntu launchpad fix CVE-2023-51764 Upstream-Status: Backport from [https://launchpad.net/ubuntu/+source/postfix/3.6.4-1ubuntu1.3] Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* squid: backport Debian patch for CVE-2023-46728 and CVE-2023-46846Vijay Anusuri2024-02-074-0/+1934
| | | | | | | | | | | | | | | | | import patches from ubuntu to fix CVE-2023-46728 CVE-2023-46846 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/squid/tree/debian/patches?h=ubuntu/focal-security&id=9ccd217ca9428c9a6597e9310a99552026b245fa Upstream commit https://github.com/squid-cache/squid/commit/6ea12e8fb590ac6959e9356a81aa3370576568c3 & https://github.com/squid-cache/squid/commit/417da4006cf5c97d44e74431b816fc58fec9e270 & https://github.com/squid-cache/squid/commit/05f6af2f4c85cc99323cfff6149c3d74af661b6d] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: Fix for CVE-2023-4511Vijay Anusuri2024-02-072-0/+82
| | | | | | | Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/ef9c79ae81b00a63aa8638076ec81dc9482972e9 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* radvd: add '--shell /sbin/nologin' to /etc/passwdLi Wang2024-02-071-1/+1
| | | | | | | | | | | | | the default setting USERADD_PARAM of yocto: -s /bin/sh follow redhat policy: radvd/redhat/systemd/radvd.spec useradd ... -s /sbin/nologin ... Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: fix CVE-2023-0922Archana Polampalli2024-02-072-0/+112
| | | | | | | | | | | | | | The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection. References: https://nvd.nist.gov/vuln/detail/CVE-2023-0922 Upstream patches: https://github.com/samba-team/samba/commit/04e5a7eb03a Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linuxptp: fix do_compile errorChangqing Li2024-02-072-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | with make 4.4, linuxptp do_compile will failed with error: In file included from clock.c:35: missing.h:61:9: error: redeclaration of enumerator 'HWTSTAMP_TX_ONESTEP_P2P' 61 | HWTSTAMP_TX_ONESTEP_P2P = 3, | ^~~~~~~~~~~~~~~~~~~~~~~ In file included from clock.c:21: /buildarea2/WRLCD_Regression/Rerun/build_dir/11201532-build_scp_world_Feature_Test/qemux86-64-standard-std-OE/build/tmp-glibc/work/core2-64-wrs-linux/linuxptp/3.1.1-r0/recipe-sysroot/usr/include/linux/net_tstamp.h:128:9: note: previous definition of 'HWTSTAMP_TX_ONESTEP_P2P' with type 'enum hwtstamp_tx_types' 128 | HWTSTAMP_TX_ONESTEP_P2P, | Following change of make 4.4 changes behavior of shell function: * WARNING: Backward-incompatibility! Previously makefile variables marked as export were not exported to commands started by the $(shell ...) function. Now, all exported variables are exported to $(shell ...). Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Backport of commit 05c1003c4 ("linuxptp: fix do_compile error"). This is present in dunfell/kirkstone as well. If net_tstamp.h of the build host disagrees with net_tstamp.h of the OE kernel or I remove the build host's net_tstamp.h do_compile fails. Changed Upstream Status to Backport with the git sha as the commit is now applied upstream. Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libssh: Backport fix for CVE-2023-48795Vijay Anusuri2024-02-074-0/+561
| | | | | | | | | | | | Upstream-Status: Backport [https://gitlab.com/libssh/libssh-mirror/-/commit/4cef5e965a46e9271aed62631b152e4bd23c1e3c & https://gitlab.com/libssh/libssh-mirror/-/commit/0870c8db28be9eb457ee3d4f9a168959d9507efd & https://gitlab.com/libssh/libssh-mirror/-/commit/5846e57538c750c5ce67df887d09fa99861c79c6] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: fix CVE-2018-14628Archana Polampalli2024-02-077-0/+544
| | | | | | | | | | An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store. Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* xscreensaver: Add osuosl backup MIRRORJoao Marcos Costa2024-02-071-0/+2
| | | | | | | | | | | | | old tarballs disappear from main location, use a backup location to fetch it in such cases. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Joao Marcos Costa <joaomarcos.costa@bootlin.com> Backported from Nanbield (cherry-picked from commit 8d34444c749a466f35445fd4c2212b3fbdb8d844) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opensc: Fix CVE-2023-40661virendra thakur2024-02-078-0/+245
| | | | | | | | | Add patch file to fix CVE Upstream-Status: Backport[https://salsa.debian.org/opensc-team/opensc/-/commit/8026fb4ca0ed53d970c6c497252eb264d4192d50] Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opensc: Fix CVE-2023-40660virendra thakur2024-02-072-0/+56
| | | | | | | | | Add patch file to fix CVE Upstream-Status: Backport [https://salsa.debian.org/opensc-team/opensc/-/commit/940e8bc764047c873f88bb1396933a5368d03533] Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* zabbix: fix CVE-2023-32726 and CVE-2023-32727Yogita Urade2024-02-074-0/+405
| | | | | | | | | | | | | | | | | | | | | | CVE-2023-32726: The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. CVE-2023-32727: An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server. Refernces: https://nvd.nist.gov/vuln/detail/CVE-2023-32726 https://security-tracker.debian.org/tracker/CVE-2023-32726 https://nvd.nist.gov/vuln/detail/CVE-2023-32727 https://security-tracker.debian.org/tracker/CVE-2023-32727 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: upgrade 3.8.5 -> 3.8.6Narpat Mali2024-02-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 3.8.5 & 3.8.6 contains the CVE-2023-47627 fix and other bugfixes. https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg Changelog: ---------- https://docs.aiohttp.org/en/stable/changes.html#id72 The git log --oneline v3.8.5..v3.8.6 shows: 996de262 (tag: v3.8.6) Release v3.8.6 (#7668) 8c128d4f [PR #7651/45f98b7d backport][3.8] Fix BadStatusLine message (#7666) 89b7df15 Allow lax response parsing on Py parser (#7663) (#7664) d5c12ba8 [PR #7661/85713a48 backport][3.8] Update Python parser for RFCs 9110/9112 (#7662) 8a3977ac [PR #7272/b2a7983a backport][3.8] Fix Read The Docs config (#7650) bcc416e5 [PR #7647/1303350e backport][3.8] Upgrade to llhttp 9.1.3 (#7648) b30c0cd2 Remove chardet/charset-normalizer. (#7589) 5946c743 CookieJar - return 'best-match' and not LIFO (#7577) (#7588) 8c4ec62f [PR #7518/8bd42e74 backport][3.8] Fix GunicornWebWorker max_requests_jitter not work (#7519) a0d234df Use lenient headers for response parser (#7490) (#7492) f92b27b0 Update to LLHTTP 9 (#7485) (#7487) 8129d26f [PR #7480/1fb06bbc backport][3.8] Fix error pointer on linebreaks (#7482) 8d701c3d Fix PermissionError when loading .netrc (#7237) (#7378) (#7395) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: fix CVE-2024-0208 GVCP dissector crashHitendra Prajapati2024-02-072-0/+43
| | | | | | | Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/a8586fde3a6512466afb2a660538ef3fe712076b Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* squid: Backport fix for CVE-2023-49285Vivek Kumbhar2024-02-072-0/+38
| | | | | | | Upstream-Status: Backport [https://github.com/squid-cache/squid/commit/77b3fb4df0f126784d5fd4967c28ed40eb8d521b] Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: Add libdevmapper-native PREFERRED_RPROVIDERJose Quaresma2024-02-071-0/+1
| | | | | | | | | | | | | | | | The libdevmapper recipe don't provide any package and is only there to resolve circular dependencies [1]. We already have the libdevmapper PREFERRED_RPROVIDER but the native it's missing. Fixes: | NOTE: Multiple providers are available for runtime libdevmapper-native (libdevmapper-native, lvm2-native) | Consider defining a PREFERRED_RPROVIDER entry to match libdevmapper-native [1] https://git.openembedded.org/meta-openembedded/commit/meta-oe/recipes-support/lvm2?id=3f64779eae2d8312f569bee863f90ec4f8176e6c Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* p7zip: fix CVE-2018-5996 & CVE-2016-9296Zahir Hussain2024-02-073-0/+260
| | | | | | | | | | | | | | References: https://nvd.nist.gov/vuln/detail/CVE-2018-5996 https://nvd.nist.gov/vuln/detail/CVE-2016-9296 Upstream patches: https://sources.debian.org/data/non-free/p/p7zip-rar/16.02-3/debian/patches/06-CVE-2018-5996.patch https://snapshot.debian.org/archive/debian-debug/20180205T215659Z/pool/main/p/p7zip/p7zip_16.02%2Bdfsg-6.debian.tar.xz Signed-off-by: Zahir Hussain <zahir.basha@kpit.com> Signed-off-by: aszh07 <mail2szahir@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* strongswan: upgrade 5.9.12 -> 5.9.13Wang Mingyu2024-02-051-1/+1
| | | | | | | | | | | | | | | Changelog: - Fixes a regression with handling OCSP error responses and adds a new option to specify the length of nonces in OCSP requests. Also adds some other improvements for OCSP handling and fuzzers for OCSP requests/responses. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5be2e20157f3025f9e2370933267a56fd526c58e) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit b135007c8ff43c18dd0593b5115d46dc6362675f) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* proftpd: Fix CVE-2023-51713 Out-of-bounds buffer readHitendra Prajapati2024-01-122-0/+278
| | | | | | | Upstream-Status: Backport from https://github.com/proftpd/proftpd/commit/97bbe68363ccf2de0c07f67170ec64a8b4d62592 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: upgrade 2.4.57 -> 2.4.58Narpat Mali2024-01-122-33/+1
| | | | | | | | | | | | | | | | | | | | This upgrade incorporates the CVE-2023-31122, CVE-2023-43622 & CVE-2023-45802 fixes and other bugfixes. The "0011-modules-mappers-config9.m4-Add-server-directory-to-i.patch" is no longer needed as it's included in this upgrade. Changelog: https://downloads.apache.org/httpd/CHANGES_2.4.58 References: https://httpd.apache.org/security/vulnerabilities_24.html https://security-tracker.debian.org/tracker/CVE-2023-31122 https://security-tracker.debian.org/tracker/CVE-2023-43622 https://security-tracker.debian.org/tracker/CVE-2023-45802 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: add vendor to product name used for CVE checkingJeffrey Pautler2024-01-121-1/+1
| | | | | | | | | | | | | | This recipe sets the product name used for CVE checking to "http_server". However, the cve-check logic matches that name to all products in the CVE database regardless of vendor. Currently, it is matching to products from vendors other than apache. As a result, CVE checking incorrectly reports CVEs for those vendors' products for this package. Signed-off-by: Jeffrey Pautler <jeffrey.pautler@ni.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 51f70eaaa5973e385645f574093ee860f5648f88) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: fix CVE-2023-42669Archana Polampalli2024-01-122-0/+95
| | | | | | | | | | | | | | | | | | | | A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task. References: https://nvd.nist.gov/vuln/detail/CVE-2023-42669 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cjson: upgrade 1.7.15 -> 1.7.17Archana Polampalli2024-01-121-1/+1
| | | | | | | | | | | The following CVEs are addressed in this release. CVE-2023-50471 CVE-2023-50472 https://github.com/DaveGamble/cJSON/releases/tag/v1.7.17 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pillow: Fix CVE-2023-44271dnyandev2024-01-122-0/+157
| | | | | | | | | | Add patch to fix CVE-2023-44271 Reference: https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7 Signed-off-by: Dnyandev Padalkar <padalkards17082001@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* strongswan: upgrade 5.9.6 -> 5.9.12Archana Polampalli2024-01-121-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | * Drop backport patch 0001-enum-Fix-compiler-warning.patch. * Drop backport patch CVE-2022-40617.patch * Update RDEPENDS to fix strongswan startup failures: plugin 'mgf1': failed to load - mgf1_plugin_create not found and no plugin file available plugin 'fips-prf': failed to load - fips_prf_plugin_create not found and no plugin file available plugin 'kdf': failed to load - kdf_plugin_create not found and no plugin file available plugin 'drbg': failed to load - drbg_plugin_create not found and no plugin file available * Drop PACKAGECONFIG[scep] as scepclient has been removed. * Add plugin-gcm to RDEPENDS as gcm plugin has been added to the default plugins. ChangeLog: https://github.com/strongswan/strongswan/releases/tag/5.9.7 https://github.com/strongswan/strongswan/releases/tag/5.9.8 https://github.com/strongswan/strongswan/releases/tag/5.9.9 https://github.com/strongswan/strongswan/releases/tag/5.9.10 https://github.com/strongswan/strongswan/releases/tag/5.9.11 https://github.com/strongswan/strongswan/releases/tag/5.9.12 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: fix CVE-2022-4345 multiple (BPv6, OpenFlow, and Kafka protocol) ↵vkumbhar2024-01-122-0/+53
| | | | | | | | | dissector infinite loops Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/39db474f80af87449ce0f034522dccc80ed4153f Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: fix CVE-2023-1992 RPCoRDMA dissector crashvkumbhar2024-01-122-0/+62
| | | | | | | Upstream-Status: Backport from https://gitlab.com/colin.mcinnes/wireshark/-/commit/3c8be14c827f1587da3c2b3bb0d9c04faff5741 Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip3: Add py_ssize_t_clean argumentRob Woolley2024-01-122-0/+17681
| | | | | | | | | | | | | | An unintentional breakage was made upstream in sip4 which results in builds reporting: QtCoremod.sip:23: syntax error This was reported in Debian, but not resolved: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998605 A backport of a fix from the upstream project fixes the parser to prevent it from complaining about the syntax error. Signed-off-by: Rob Woolley <rob.woolley@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip3: Add sipconfig.pyRob Woolley2024-01-121-1/+18
| | | | | | | | | | | | Add the destdir option to ensure that sipconfig.py gets installed to the site-packages directory and included in python3-sip3. Remove references to the build paths from sipconfig.py as part of the install stage. One may then prepend STAGING_DIR_NATIVE to sip_bin and STAGING_DIR_TARGET to *_dir in any recipe that uses sipconfig.py. Signed-off-by: Rob Woolley <rob.woolley@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.5 -> 4.2.7Narpat Mali2024-01-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 4.2.5 and 4.2.7 contains the fixes for CVE-2023-43665, CVE-2023-46695 and other bugfixes. git log --oneline 4.2.5..4.2.7 shows: d254a54e7f (tag: 4.2.7) [4.2.x] Bumped version for 4.2.7 release. 048a9ebb6e [4.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows. 3fae5d92da [4.2.x] Refs #30601 -- Fixed typos in docs/topics/db/transactions.txt. a8aa94062b [4.2.x] Refs #15578 -- Made cosmetic edits to fixtures docs. 109f39a38b [4.2.x] Fixed #34932 -- Restored varchar_pattern_ops/text_pattern_ops index creation when deterministic collaction is set. 61612990d8 [4.2.x] Fixed typos in docs/ref/models/expressions.txt. 696fbc32d6 [4.2.x] Fixed #30601 -- Doc'd the need to manually revert all app state on transaction rollbacks. ffba63180c [4.2.x] Fixed typo in docs/ref/contrib/gis/geos.txt. 43a3646070 [4.2.x] Fixed #15578 -- Stated the processing order of fixtures in the fixtures docs. 0cd8b867a0 [4.2.x] Added stub release notes and release date for 4.2.7, 4.1.13, and 3.2.23. 510a512119 [4.2.x] Fixed typo in docs/releases/4.2.txt. b644f8bc1f [4.2.x] Corrected note about using accents in writing documentation contributing guide. a576ef98ae [4.2.x] Refs #34900, Refs #34118 -- Updated assertion in test_skip_class_unless_db_feature() test on Python 3.12.1+. 803caec60b [4.2.x] Fixed #34798 -- Fixed QuerySet.aggregate() crash when referencing expressions containing subqueries. caec4f4a6f [4.2.x] Refs #34840 -- Improved release note describing index regression. b6bb2f8099 [4.2.x] Refs #34840 -- Fixed test_validate_nullable_textfield_with_isnull_true() on databases that don's support table check constraints. e8fe48d3a0 [4.2.x] Fixed #34808 -- Doc'd aggregate function's default argument. 830990fa6c [4.2.x] Reorganized tutorial's part 4 to better understand changes needed in URLConf. 0cbc92bc3a [4.2.x] Refs #26029 -- Improved get_storage_class() deprecation warning with stacklevel=2. 9c7627da30 [4.2.x] Refs #34043 -- Clarified how to test UI changes. 0bd53ab86a [4.2.x] Added backticks to setuptools in docs. 99dcba90b4 [4.2.x] Refs #32275 -- Added scrypt password hasher to PASSWORD_HASHERS setting docs. 6697880219 [4.2.x] Refs #31435 -- Doc'd potential infinite recursion when accessing model fields in __init__. a9a3317a95 [4.2.x] Corrected wrap_socket() reference in docs/ref/settings.txt. 9962f94a97 [4.2.x] Added CVE-2023-43665 to security archive. b2d95bb301 [4.2.x] Added stub release notes for 4.2.7. 08d54f83a9 [4.2.x] Post release version bump. c22017bd1d (tag: 4.2.6) [4.2.x] Bumped version for 4.2.6 release. be9c27c4d1 [4.2.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in django.utils.text.Truncator when truncating HTML text. 39fc3f46a8 [4.2.x] Added stub release notes and release date for 4.2.6, 4.1.12, and 3.2.22. dd0bf63d3e [4.2.x] Added warning about flatpages and untrusted users. fec4ed0a25 [4.2.x] Refs #34320 -- Skipped SchemaTests.test_rename_field_with_check_to_truncated_name on MariaBD 10.5.2+. a148461f1f [4.2.x] Fixed #34840 -- Avoided casting string base fields on PostgreSQL. b08f53ff46 [4.2.x] Refs #34808 -- Doc'd that aggregation functions on empty groups can return None. c70f08c4aa [4.2.x] Added updating the Django release process on Trac to release steps. d485aa2732 [4.2.x] Fixed typo in docs/howto/custom-file-storage.txt. ff26e6ad84 [4.2.x] Corrected QuerySet.prefetch_related() note about GenericRelation(). 866122690d [4.2.x] Doc'd HttpResponse.cookies. 97e8a2afb1 [4.2.x] Fixed #34821 -- Prevented DEFAULT_FILE_STORAGE/STATICFILES_STORAGE settings from mutating the main STORAGES. 39cb3b08bc [4.2.x] Bumped checkout version in Github actions configuration. 592ebd8920 [4.2.x] Added stub release notes for 4.2.6. a1dd785139 [4.2.x] Added CVE-2023-41164 to security archive. a9686cb871 [4.2.x] Post-release version bump. Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.7/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 3.2.21 -> 3.2.23Narpat Mali2024-01-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | The delta between 3.2.21 and 3.2.23 contains the fixes for CVE-2023-43665, CVE-2023-46695 and other bugfixes. git log --oneline 3.2.21..3.2.23 shows: 60e648a7ae (tag: 3.2.23) [3.2.x] Bumped version for 3.2.23 release. f9a7fb8466 [3.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows. e6d2591d9e [3.2.x] Added stub release notes for 3.2.23. 3c04b74293 [3.2.x] Added CVE-2023-43665 to security archive. 86a14d653f [3.2.x] Post release version bump. 3106e94e52 (tag: 3.2.22) [3.2.x] Bumped version for 3.2.22 release. ccdade1a02 [3.2.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in django.utils.text.Truncator when truncating HTML text. 6caf7b313d [3.2.x] Added stub release notes for 3.2.22. 9e814c3a5e [3.2.x] Added CVE-2023-41164 to security archive. 4b439dcd05 [3.2.x] Post-release version bump. Release Notes: https://docs.djangoproject.com/en/dev/releases/3.2.23/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix for CVE-2023-43665 and CVE-2023-46695Narpat Mali2024-01-123-0/+291
| | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-43665: In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. CVE-2023-46695: An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. References: https://www.djangoproject.com/weblog/2023/oct/04/security-releases/ https://www.djangoproject.com/weblog/2023/nov/01/security-releases/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* glmark2: inherit python3native to fix build with python-3.12 on build hostMartin Jansa2024-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fixes: | WARNING: Unable to execute waf --version, exit code 1. Assuming waf version without bindir/libdir support. | DEBUG: Python function waf_preconfigure finished | DEBUG: Executing shell function do_configure | Traceback (most recent call last): | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/./waf", line 163, in <module> | from waflib import Scripting | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Scripting.py", line 6, in <module> | from waflib import Utils,Configure,Logs,Options,ConfigSet,Context,Errors,Build,Node | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Configure.py", line 6, in <module> | from waflib import ConfigSet,Utils,Options,Logs,Context,Build,Errors | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Options.py", line 6, in <module> | from waflib import Logs,Utils,Context,Errors | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Context.py", line 5, in <module> | import os,re,imp,sys | ModuleNotFoundError: No module named 'imp' | WARNING: /OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/temp/run.do_configure.1263276:146 exit 1 from 'waf_do_configure' * this first issue can be fixed easily by backporting: https://gitlab.com/ita1024/waf/-/commit/d2060dfd8af4edb5824153ff24e207b39ecd67a2 * but then it still fails a bit later, because of SyntaxWarning in waf --version output: ERROR: glmark2-2021.12-r0 do_configure: Error executing a python function in exec_func_python() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_func_python() autogenerated', lineno: 2, function: <module> 0001: *** 0002:waf_preconfigure(d) 0003: File: '/OE/build/luneos-kirkstone/openembedded-core/meta/classes/waf.bbclass', lineno: 52, function: waf_preconfigure 0048: wafbin = os.path.join(subsrcdir, 'waf') 0049: try: 0050: result = subprocess.check_output([python, wafbin, '--version'], cwd=subsrcdir, stderr=subprocess.STDOUT) 0051: version = result.decode('utf-8').split()[1] *** 0052: if bb.utils.vercmp_string_op(version, "1.8.7", ">="): 0053: d.setVar("WAF_EXTRA_CONF", "--bindir=${bindir} --libdir=${libdir}") 0054: except subprocess.CalledProcessError as e: 0055: bb.warn("Unable to execute waf --version, exit code %d. Assuming waf version without bindir/libdir support." % e.returncode) 0056: except FileNotFoundError: File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 148, function: vercmp_string_op 0144: Compare two versions and check if the specified comparison operator matches the result of the comparison. 0145: This function is fairly liberal about what operators it will accept since there are a variety of styles 0146: depending on the context. 0147: """ *** 0148: res = vercmp_string(a, b) 0149: if op in ('=', '=='): 0150: return res == 0 0151: elif op == '<=': 0152: return res <= 0 File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 138, function: vercmp_string 0134: return r 0135: 0136:def vercmp_string(a, b): 0137: """ Split version strings and compare them """ *** 0138: ta = split_version(a) 0139: tb = split_version(b) 0140: return vercmp(ta, tb) 0141: 0142:def vercmp_string_op(a, b, op): File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 89, function: split_version 0085: """Split a version string into its constituent parts (PE, PV, PR)""" 0086: s = s.strip(" <>=") 0087: e = 0 0088: if s.count(':'): *** 0089: e = int(s.split(":")[0]) 0090: s = s.split(":")[1] 0091: r = "" 0092: if s.count('-'): 0093: r = s.rsplit("-", 1)[1] Exception: ValueError: invalid literal for int() with base 10: 'SyntaxWarning' ERROR: Logfile of failure stored in: /OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/temp/log.do_configure.1264918 so it's safer to just use python3-native everywhere, instead of more patches for waf Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libbytesize: update github branch to 'main'Wentao Zhang2024-01-121-1/+1
| | | | | | | | | the repo of libbytesize doesn't have a branch named master. Change the branch from master to main. Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> Signed-off-by: Wentao Zhang <wentao.zhang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* yasm: fix CVE-2023-37732Soumya2024-01-122-0/+42
| | | | | | | | | | | | | | | Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attacker to cause a denial of service via a crafted file. References: https://github.com/yasm/yasm/issues/233 https://nvd.nist.gov/vuln/detail/CVE-2023-37732 Signed-off-by: Soumya <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 41fffef6b044b2722aa13f7e7648a3f848231851) Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-21 23:19:41 +0000