linux/meta-security.git, branch morty

CVE-2018-11652 nikto: arbitray OS command injection via http server field.

2018-07-03T22:35:25+00:00

CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report. Signed-off-by: Nagalakshmi Veeramallu Reviewed-by: Jagadeesh Krishnanjanappa Signed-off-by: Armin Kuster

tpm2.0-tss: Fix build issue with tpm2-abrmd recipe

2017-05-19T14:40:49+00:00

It solves tpm2-abrmd recipe build failure (as mentioned below) as none of the tpm2.0-tss header files define MAX_LOADED_OBJECTS1 macro. The macro name should be MAX_LOADED_OBJECTS. -- snip -- | from ../tpm2-abrmd/src/include/tabrmd.h:31, | from ../tpm2-abrmd/src/access-broker.c:31: | ../tpm2-abrmd/src/access-broker.c: In function 'access_broker_get_trans_object_count': | ../tpm2-abrmd/src/access-broker.c:549:34: error: 'MAX_LOADED_OBJECTS1' undeclared (first use in this function) -- snip -- Signed-off-by: Jagadeesh Krishnanjanappa Signed-off-by: Armin Kuster

suricata: update package to 3.1.3

2016-11-02T16:06:39+00:00

*Changes* Bug #1861: Suricata with multi tenancy does not start in 3.1/3.1.1 Bug #1889: Suricata doesn't error on missing semicolon Bug #1910: libhtp 0.5.23 (3.1.x) Bug #1912: http.memcap reached condition can lead to dead lock Bug #1913: af-packet fanout detection broken on Debian Jessie Bug #1933: unix-command socket created with last character missing (3.1.x) Bug #1934: make install-full does not install tls-events.rules (3.1.x) Bug #1941: Can't set fast_pattern on tls_sni content (3.1.x) Bug #1942: dns - back to back requests results in loss of response (3.1.x) Bug #1943: Check redis reply in non pipeline mode (3.1.x) Signed-off-by: Armin Kuster

samhain: update to 4.2.0

2016-11-02T16:06:39+00:00

* Changes: - New option 'SetAuditdFlags = r|w|x|a' to (re-)define the flags supplied to auditd. - New option 'PortCheckDevice = device' for the port check module, to monitor a device regardless of the address assigned to it. - Fix for the case sensitivity of the arguments to the Severity/Class options. - Compiler warnings with gcc 6.2 and a few minor bugs have been fixed. Signed-off-by: Armin Kuster

nmap: Upgrade package to 7.31

2016-11-02T16:06:39+00:00

LIC_FILES_CHKSUM change do to yr going from 2015 to 2016 in file. Added "no update" config option. Signed-off-by: Armin Kuster

smack: Add new package

2016-11-02T16:06:39+00:00

V2: Fix typo and add LDFLAG to makefile Signed-off-by: Armin Kuster

smack kernel: add smack kernel config fragments

2016-11-02T16:06:39+00:00

Signed-off-by: Armin Kuster

python-pycrypto: simplify to use pypi class

2016-11-01T16:03:15+00:00

Signed-off-by: Armin Kuster

suricata: update package to 3.1.2

2016-11-01T16:03:15+00:00

v2: rebased against master-next which has 3.1 Signed-off-by: Armin Kuster

libnetaddr-ip-perl: remove package. not used by anyone in this layer

2016-11-01T16:03:15+00:00

latest version does not build either Signed-off-by: Armin Kuster