linux/meta-security.git, branch kirkstone

clamav: Fix for CVE-2024-20328

2026-01-15T16:46:30+00:00

Upstream-Status: Backport [https://github.com/Cisco-Talos/clamav/commit/fe7638287bb11419474ea314652404e7e9b314b2] Signed-off-by: Vijay Anusuri Signed-off-by: Scott Murray

sssd: Fix for CVE-2025-11561

2026-01-15T16:46:30+00:00

Upstream-Status: Backport [https://github.com/SSSD/sssd/commit/a0336f4cd69c25b3d501a3d361d3d286c00da4d2] Signed-off-by: Vijay Anusuri Signed-off-by: Scott Murray

meta-security-compliance: Update lynis

2026-01-15T16:46:30+00:00

Update lynis SRC_URI to fix building, and while at it bump to 3.0.9 which hopefully be a transparent upgrade for anyone still on kirkstone. Signed-off-by: Scott Murray

checksecurity: update the debian package

2026-01-15T16:46:30+00:00

The previously used package (nmu1) is not longer available, use the latest current one (nmu3). The changelog between the two: checksecurity (2.0.16+nmu3) unstable; urgency=medium * Non-maintainer upload. * Fix "missing required debian/rules targets build-arch and/or build- indep": Add targets to debian/rules. (Closes: #999082) * Fix "Removal of obsolete debhelper compat 5 and 6 in bookworm": Bump to 7 in debian/{compat,control}. (Closes: #965448) * Fix some grave packaging errors: - move debhelper from Build-Depends-Indep to Build-Depends - remove temporary files debian/postrm.debhelper and debian/substvars from source package -- gregor herrmann Sun, 26 Dec 2021 01:56:10 +0100 checksecurity (2.0.16+nmu2) unstable; urgency=medium * Non maintainer upload by the Reproducible Builds team. * No source change upload to rebuild on buildd with .buildinfo files. -- Holger Levsen Fri, 01 Jan 2021 19:17:53 +0100 Signed-off-by: Marta Rybczynska (adapted from 828a78314f51b919baf638d64e8e12c0c0a408ad) Signed-off-by: Scott Murray

checksecurity: update to 2.0.16

2026-01-15T16:46:30+00:00

Drop setuid-log-folder.patch, using sed instead. Refresh patch check-setuid-use-more-portable-find-args.patch Signed-off-by: Armin Kuster Signed-off-by: Scott Murray

chkrootkit: update SRC_URI

2026-01-15T16:46:30+00:00

0.55 no longer hosted from main source. Use Ubuntu archive Signed-off-by: Armin Kuster Signed-off-by: Scott Murray

kas: update configuration

2026-01-15T16:46:30+00:00

Update based on latest master configuration. Changes: - switch to kirkstone - add required usrmerge feature to kas-security-alt configuration - add whitespaces around assignement - add common dldir/sstate - don't build apparmor in musl configs - only enable ptest for the test image - Update the kas configuration file versions to 19 to match kas 4.8.x. - Change refspec to branch to remove deprecation warnings. - Add quoting around URLs to match upstream examples. Signed-off-by: Scott Murray

CI: update build for new CI

2026-01-15T16:46:10+00:00

Update for Ubuntu 24.04 runners: - use venv for installing kas - add missing directories - assume that python3 and pip are installed. Other changes: - add logging of jobs to files Signed-off-by: Marta Rybczynska (reworked for kirkstone branch) Signed-off-by: Scott Murray

Update maintainers

2026-01-14T21:32:43+00:00

Add Marta and myself as maintainers for meta-security and the other embedded layers that Armin had been maintaining. To avoid Armin getting bugged about individual recipes, set the RECIPE_MAINTAINER variables to myself. (backport from master) Signed-off-by: Scott Murray Signed-off-by: Richard Purdie

clamav: Security fix for CVE-2024-20505 and CVE-2024-20506

2024-09-15T14:58:59+00:00

CVES fixed: - CVE-2024-20505 clamav: out-of-bounds read bug in the PDF file parser - CVE-2024-20506 clamav: ClamD process writes to log file while privileged without checking if its been replaced with a symlink Upstream-Status: Backport from https://github.com/Cisco-Talos/clamav/commit/8915bd22570ee608907f1b88a68e587d17813812, https://github.com/Cisco-Talos/clamav/commit/88efeda2a4cb93a69cf0994c02a8987f06fa204d Signed-off-by: Rohini Sangam Signed-off-by: Siddharth Doshi Signed-off-by: Armin Kuster