summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* kubernetes: Fix for CVE-2024-10220kirkstoneVijay Anusuri2025-11-192-0/+58
| | | | | | | | | Upstream-Status: Backport from https://github.com/kubernetes/kubernetes/commit/6622b002f70a153100d1c286fbcea721160da192 Reference: https://github.com/kubernetes/kubernetes/issues/128885 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cloud-init: Fix CVE-2024-11584Vijay Anusuri2025-11-192-0/+96
| | | | | | | | | | | | import patch from debian to fix CVE-2024-11584 Upstream-Status: Backport [import from debian 22.4.2-1+deb12u3 Upstream commit https://github.com/canonical/cloud-init/commit/8b45006c4765fd75f20ce244571b563dbc49d4f2] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* containerd-opencontainers: fix CVE-2025-64329Vijay Anusuri2025-11-192-0/+81
| | | | | | | Upstream-Status: Backport from https://github.com/containerd/containerd/commit/c575d1b5f4011f33b32f71ace75367a92b08c750 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* containerd-opencontainers: fix CVE-2024-25621Vijay Anusuri2025-11-192-0/+104
| | | | | | | Upstream-Status: Backport from https://github.com/containerd/containerd/commit/0450f046e6942e513d0ebf1ef5c2aff13daa187f Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* kubernetes: Fix for CVE-2025-5187Vijay Anusuri2025-11-052-0/+95
| | | | | | | | | | Upstream-commit: https://github.com/kubernetes/kubernetes/commit/2e6eaa1fbedd776ea9357b4f472c66dec01955b5 Reference: https://github.com/kubernetes/kubernetes/pull/133467 https://github.com/aks-lts/kubernetes/pull/62/commits/152330ef541b23a027c779597496b62c287fb363 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* containerd-opencontainers: fix CVE-2024-40635Theo GAIGE2025-10-132-0/+181
| | | | | | | Upstream-Status: Backport from https://github.com/containerd/containerd/commit/9639b9625554183d0c4d8d072dccb84fedd2320f Signed-off-by: Theo GAIGE <tgaige.opensource@witekio.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cloud-init: fix for CVE-2024-6174Hitendra Prajapati2025-09-032-0/+104
| | | | | | | Upstream-Status: Backport from https://github.com/canonical/cloud-init/commit/f43937f0b462734eb9c76700491c18fe4133c8e1 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cri-o: fix CVE-2023-6476Archana Polampalli2025-07-162-0/+62
| | | | | | | | | | A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node. Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* python3-docker: Fix for requests 2.32.0: CVE-2024-35195 backportChristian Ege2025-04-192-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After backporting the CVE-2024-35195 in poky, parts of python3-requests got updated to 2.32.0 which is incompatible with the current docker-compose command. This patch will fix the following error message: During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/bin/docker-compose", line 8, in <module> sys.exit(main()) File "/usr/lib/python3.10/site-packages/compose/cli/main.py", line 81, in main command_func() File "/usr/lib/python3.10/site-packages/compose/cli/main.py", line 200, in perform_command project = project_from_options('.', options) File "/usr/lib/python3.10/site-packages/compose/cli/command.py", line 60, in project_from_options return get_project( File "/usr/lib/python3.10/site-packages/compose/cli/command.py", line 152, in get_project client = get_client( File "/usr/lib/python3.10/site-packages/compose/cli/docker_client.py", line 41, in get_client client = docker_client( File "/usr/lib/python3.10/site-packages/compose/cli/docker_client.py", line 170, in docker_client client = APIClient(use_ssh_client=not use_paramiko_ssh, **kwargs) File "/usr/lib/python3.10/site-packages/docker/api/client.py", line 197, in __init__ self._version = self._retrieve_server_version() File "/usr/lib/python3.10/site-packages/docker/api/client.py", line 221, in _retrieve_server_version raise DockerException( docker.errors.DockerException: Error while fetching server API version: Not supported URL scheme http+docker Signed-off-by: Christian Ege <christian.ege@ifm.com> Reference: https://github.com/graugans/meta-virtualization/commit/4149812ca9581a313de27c45a0f2dfa7bd8f53df Signed-off-by: Libo Chen <libo.chen.cn@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* ceph: fix CVE-2023-43040Yogita Urade2025-04-092-0/+57
| | | | | | | | | | | | | | | IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-43040 Upstream patch: https://github.com/ceph/ceph/commit/98bfb71cb38899333deb58dd2562037450fd7fa8 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* buildah: upgrade 1.26.8 -> 1.26.9Praveen Kumar2025-04-021-2/+2
| | | | | | | | | | | | | | | | | | | This upgrade fixes: CVE-2024-11218 Changes in this Upgrade: ========================= This upgrade from Buildah 1.26.8 to 1.26.9 includes important security and stability fixes: - Fixes CVE-2024-11218 - Resolves TOCTOU error when bind and cache mounts use "src" values - Fixes cache locks with multiple mounts - Enhances volume handling and mount label options For full details, refer to: https://github.com/containers/buildah/releases/tag/v1.26.9 Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* criu: Adjust to glibc __rseq_size semantic changeGuocai He2025-03-242-1/+101
| | | | | | | | | | | On criu version 3.17: When use "criu restore -d -D checkpoint" to restore, the error is: 1272: Error (criu/cr-restore.c:1498): 1295 killed by signal 11: Segmentation fault The root casue is that the glibc updated and criu should adjust to glibc __rseq_size semantic change. Signed-off-by: Guocai He <guocai.he.cn@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* docker-distribution: fix CVE-2025-24976Chen Qi2025-03-062-0/+50
| | | | | | | Backport patch to fix CVE-2025-24976. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* Revert "runc-docker: upgrade 1.1.4 -> 1.1.12"Bruce Ashfield2025-02-054-45/+35
| | | | This reverts commit 76f2999987fa3ea30a823de3bd79d0cc0e0c287f.
* runc-docker: upgrade 1.1.4 -> 1.1.12Divya Chellam2025-01-304-35/+45
| | | | | | | | | | | | | | | | | This upgrade fixes a few CVEs: - CVE-2023-27561 - CVE-2023-25809 - CVE-2023-28642 - CVE-2024-21626 and other bug fixes Changelog: ========== https://github.com/opencontainers/runc/blob/v1.1.12/CHANGELOG.md Adjusted existing patches to align with v1.1.12 Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* podman: fix CVE-2024-9676Chen Qi2025-01-302-0/+192
| | | | | | | Backport patch to fix CVE-2024-9676. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cri-o: fix CVE-2024-9676Chen Qi2025-01-302-0/+192
| | | | | | | Backport patch to fix CVE-2024-9676. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* buildah: fix CVE-2024-9676Chen Qi2025-01-302-0/+192
| | | | | | | Backport patch to fix CVE-2024-9676. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* buildah: add seccomp and ipv6 to REQUIRED_DISTRO_FEATURESMartin Jansa2025-01-302-1/+5
| | | | | | | | | | | | | | | | | | * because it rdepends on podman with the same restriction * BTW: .gitignore has: build*/ which gets triggered for buildah as well: meta-virtualization $ git add ./recipes-containers/buildah/buildah_git.bb The following paths are ignored by one of your .gitignore files: recipes-containers/buildah I've adjusted it to /build*/ only. Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* buildah: update to 1.26.8Chen Qi2025-01-301-4/+3
| | | | | Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* CVE-2023-37154:Changqing Li2024-12-102-0/+70
| | | | | | | | | | | | check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with \${IFS}. This has been categorized both as fixed in e8810de, and as intended behavior. Refer: https://nvd.nist.gov/vuln/detail/CVE-2023-37154 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* Revert "nagios-plugins: fix CVE-2023-37154"Bruce Ashfield2024-12-101-1/+0
| | | | This reverts commit 460ea78d7f8d5d16799d0b7334b95d8170c9e338.
* nagios-plugins: fix CVE-2023-37154Changqing Li2024-12-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-37154: check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution"x$with_unrestricted_ssh_options" = xyes ; then ++ AC_DEFINE(HAVE_UNRESTRICTED_SSH_OPTIONS,[1],[Allow SSH to use options that run local commands.]) ++fi ++ + AC_ARG_WITH([ipv6], + [AS_HELP_STRING([--with-ipv6], [support IPv6 @<:@default@check>@])], + [], [with_ipv6=check]) +diff --git a/plugins/check_by_ssh.c b/plugins/check_by_ssh.c +index b6f3130..6cc6c7a 100644 +--- a/plugins/check_by_ssh.c ++++ b/plugins/check_by_ssh.c +@@ -27,7 +27,7 @@ + *****************************************************************************/ + + const char *progname = "check_by_ssh"; +-const char *copyright = "2000-2014"; ++const char *copyright = "2000-"; + const char *email = "devel@nagios-plugins.org"; + + #include "common.h" +@@ -299,6 +299,16 @@ process_arguments (int argc, char **argv) + skip_stderr = atoi (optarg); + break; + case 'o': /* Extra options for the ssh command */ ++ ++ /* Don't allow the user to run commands local to the nagios server, unless they decide otherwise at compile time. */ ++#ifndef HAVE_UNRESTRICTED_SSH_OPTIONS ++ if ( strcasestr(optarg, "ProxyCommand") != NULL ++ || strcasestr(optarg, "PermitLocalCommand") != NULL ++ || strcasestr(optarg, "LocalCommand") != NULL) { ++ break; ++ } ++#endif ++ + comm_append("-o"); + comm_append(optarg); + break; +-- +2.23.0 + Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* go-cli: use main branchMartin Jansa2024-11-121-1/+1
| | | | | | | * master was renamed to main long time ago Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* python3-colorama: drop recipeBruce Ashfield2024-10-101-9/+0
| | | | | | | We no longer need our own pinned version of this recipe, and it causes us issues with meta-python. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* kubernetes: Security fix for CVE-2023-3676 and CVE-2023-3955Vijay Anusuri2024-09-053-0/+127
| | | | | | | | | | | | Upstream-commit: https://github.com/kubernetes/kubernetes/commit/7da6d72c05dffb3b87e62e2bc8c3228ea12ba1b9 & https://github.com/kubernetes/kubernetes/commit/a53faf5e17ed0b0771a605c6401ba4cbf297b59a Reference: https://github.com/kubernetes/kubernetes/issues/119339 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* docker-distribution: Use dup3 for riscv64Mingli Yu2024-07-222-0/+43
| | | | | | | | | Use dup3 instead for riscv64 as there is no dup2 on riscv64 linux to fix the below build failure: vendor/github.com/bugsnag/panicwrap/dup2.go:10:9: undefined: syscall.Dup2 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* podman-compose: switch to main branchBruce Ashfield2024-07-101-1/+1
| | | | | | | | | | | | | The upstream project has made the "interesting" decision to delete the stable branch and move to "main" for recent releases. So rather than being able to simply switch for our updates, we have to switch to main on all releases that had podman-compose recipes using the stable branch. Luckily, the commit hashes haven't changed, so we only have to modify the branch in the SRC_URI. Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* libvirt: Fix CVE-2024-1441 and CVE-2024-2496Ashish Sharma2024-07-103-0/+157
| | | | | | | | | | Upstream-Status: Backport from [https://launchpad.net/ubuntu/+source/libvirt/8.0.0-1ubuntu7.10] import Ubuntu patches to fix CVE-2024-1441 CVE-2024-2496 Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* kubernetes: fix do_patch failureMartin Jansa2024-05-281-1/+1
| | | | | | | | * introduced in: https://lists.yoctoproject.org/g/meta-virtualization/message/8715 Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* libvirt: Backport fix for CVE-2024-2494Ashish Sharma2024-05-282-0/+221
| | | | | | | Upstream-Status: Backport [https://gitlab.com/libvirt/libvirt/-/commit/8a3f8d957507c1f8223fdcf25a3ff885b15557f2] Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* kubernetes: Backport fix for CVE-2024-3177Ashish Sharma2024-05-132-0/+238
| | | | | | | Upstream-Status: Backport [https://github.com/kubernetes/kubernetes/pull/124325/commits/3f0922513d235d8bdebe79f0d07da769c04211b8] Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* openvswitch: Upgrade 2.17.6 -> 2.17.9Yogita Urade2024-03-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Includes security fixes for - CVE-2023-3966 and CVE-2023-5366 commits short logs: 0bea06d99 (tag: v2.17.9) Set release date for 2.17.9. b8657dada netdev-offload-tc: Check geneve metadata length. e235a421f odp: ND: Follow Open Flow spec converting from OF to DP. 002cba9f1 dpdk: Use DPDK 21.11.6 release for OVS 2.17. ee889659d github: Update versions of action dependencies (Node.js 20). bf717d0f3 ovs-atomic: Fix inclusion of Clang header by GCC 14. 9bbc2cf8a ovsdb-idl.at: Test IDL behavior during database conversion. 049189584 tests: Use _DAEMONIZE macro's to start tcpdump. 30099c5d9 tests-ovsdb: Switch OVSDB_START_IDLTEST to macro. f4b4d650a python: idl: Handle monitor_canceled. d6caa6ed0 vconn: Count vconn_sent regardless of log level. b0eb66a69 backtrace: Fix error in log_backtrace() documentation. bb89735b2 ovsdb: trigger: Do not allow conversion in read-only mode. a79ee883a ovsdb: jsonrpc-server: Fix the DSCP value in default options. 4f01f2f7d jsonrpc: Sort JSON objects while printing debug messages. 3cae42bc5 tests: ovsdb: Use diff -up format for replay test. a7036f6a1 ovsdb-server.at: Enbale debug logs in active-backup tests. c944a30fe ovsdb: transaction: Don't try to diff unchanged columns. 5c0dc9602 ovsdb: transaction: Avoid diffs for different type references. eabd4cb2f ci: Update the GitHub Ubuntu runner image to Ubuntu 22.04. c462aabb3 netdev-afxdp: Disable -Wfree-nonheap-object on receive. b3f8c32ed ovsdb-idl: Preserve change_seqno when deleting rows. d254aedad tunnel: Do not carry source port from a previous tunnel. 1857c569e netdev-offload-tc: Fix offload of tunnel key tp_src. 0a0c500d7 cirrus: Update from FreeBSD 12 to 14. 74633888d dpdk: Use DPDK 21.11.5 release for OVS 2.17. b5e54aa16 ovs-ofctl: Correctly mark the CT flush commands. 1d3609a48 mcast-snooping: Flush flood and report ports when deleting interfaces. df101fe1e mcast-snooping: Test per port explicit flooding. 8313ebbb3 flake8: Fix E721 check failures. f73208151 build-aux: Enable flake8 checks for python extraction scripts. 8b6a8fcb0 build-aux/extract-ofp-msgs: Fix flake8 and syntax errors. 80e922644 build-aux/extract-ofp-fields: Fix flake8 and syntax errors. 1508e7abc build-aux/extract-ofp-errors: Fix flake8 and syntax errors. 98fc48e4d build-aux/extract-ofp-actions: Fix flake8 and syntax errors. d52231171 automake: Move build-aux EXTRA_DIST updates to their own file. 8868756b8 netdev-offload: Fix Clang's static analyzer 'Division by zero' warnings. 46e9cacaa ofp-table: Fix count_common_prefix_run() function. 8e6d1cd04 vswitch.xml: Add entry for dpdkvhostuser userspace-tso. 7838778ad vswitch.xml: Add dpdkvhostuser group status. a3a039507 tests: Use ping timeout instead of deadline. 3351b149c tests/system-traffic: Ensure no name resolution for tcpdump. bce17b0bb tc: Improve logging of mismatched actions. af934924f ofproto-dpif-upcall: Pause revalidators when purging. 48fa54747 db-ctl-base: Fix memory leak of db commands. 7fb2197e1 Prepare for 2.17.9. 275be1eb9 (tag: v2.17.8) Set release date for 2.17.8. be1a8f7ec conntrack: Remove nat_conn introducing key directionality. f179c7c07 conntrack: simplify cleanup path fac770a0a netdev-dpdk: Document status options for VF MAC address. 79ab2eeb1 netdev-offload-dpdk: Fix flushing of a physdev. 4ced485f8 connmgr: Fix ofconn configuration on vswitchd startup. 3c39cfe03 python: idl: Fix last-id update from a monitor reply. a6207b2bc ofproto-dpif-xlate: Fix recirculation with patch port and controller. a141b62c2 ofproto-dpif-xlate: Don't reinstall removed XC_LEARN rule. 586e73dac configure: Avoid deprecated AC_PROG_CC_C99 if possible. bd95fe3d7 tests: Fix time dependency in overlapping flows modification test. 123b7aaa7 python: Use build to generate PEP517 compatible archives. 41d2e7e9a python: Use twine to upload sdist package to pypi.org. 66d5562e3 python: Rename build related code to ovs_build_helpers. c880faea8 dpif-netdev: Fix length calculation of netdet_flow_key. 8c7aa5f58 doc: Fix description of max_len for controller action. 34ff03c3c docs: Fix rendering of VLAN Comparison Chart. 93412e00e docs: Run tbl preprocessor in manpage-check rule. 6929485d3 docs: Add `nowarn` region option to tables. 08b6b83a3 tests: Add clang-analyzer-results to gitignore. c252b1f8a ci: Add jobs to test -std=c99 builds. 242bb2624 tests: Fix order of includes in barrier/id-fpool/mpsc-queue tests. 292eca58c sflow: Always enable _BSD_SOURCE. 82aa3fb01 compiler.h: Don't use asm and typeof with non-GNU compilers. a45b3afbf ovs.tmac: Fix troff warning in versions above groff-1.23. a336ef712 connmgr: Count unsent async messages. a74b7dfb9 dpif-netdev: Fix dpif_netdev_flow_put. f04bfd5e4 ofproto-dpif-xlate: Reduce stack usage in recursive xlate functions. 29990edbc cirrus: Update to FreeBSD 13.2. 65bb82369 ci: Fix OPTS not being passed to OSX builds. fe98b0c1f ovsdb-tool: Fix json leak while showing clustered log. 44722bbda ovsdb-server: Fix excessive memory usage on DB open. 9db221fcd tests: Add ovsdb execution cases for set size constraints. 3cfe388cb ovsdb: relay: Fix handling of XOR updates with size constraints. f4d15497f ovsdb: file: Fix diff application to a default column value. 7864ed557 ovsdb: file: Fix inability to read diffs that violate type size. 97d91ad2d ovs-tcpdump: Clear auto-assigned ipv6 address of mirror port. dba7482e0 ofproto-dpif: Fix removal of renamed datapath ports. a1ca9e589 ofproto-dpif-upcall: Mirror packets that are modified. 5d976536b vswitchd: Wait for a bridge exit before replying to exit unixctl. e206df08d Prepare for 2.17.8. f15de6508 (tag: v2.17.7) Set release date for 2.17.7. 4b10b0b87 fatal-signal: Don't share signal fds/handles with forked process. e01ea8e7e cpu: Fix cpuid check for some AMD processors. 111c7be31 tc: Fix crash on malformed reply from kernel. 75152d3d6 netdev-dpdk: Fix warning with gcc 13. 5285dad18 utilities/bashcomp: Fix PS1 generation on new bash. ebe7bd7b6 netdev-offload-dpdk: Fix crash in debug log. 4937a5341 stream-ssl: Disable alerts on unexpected EOF. fe99e6b97 tests: layer3-tunnels: Skip bareudp tests if not supported by kernel. a375055f2 ovs-fields: Modify the width of tpa and spa. 749769be3 netdev-vport: RCU-fy tunnel config. c423fa5f6 smap: Make argument of smap_add_ipv6 constant. 2db06ee6f netdev-vport: Fix unsafe handling of GRE sequence number. 51d804aa4 dpctl: Fix dereferencing null pointer in parse_ct_limit_zones(). 80b15d142 netdev-offload: Fix deadlock/recursive use of the netdev_hmap_rwlock rwlock. 0d3c27e90 ofproto-dpif-xlate: Fix use-after-free when xlate_actions(). 8eb24943c tc: Fix cleaning chains. cbe5852d7 python-stream: Handle SSL error in do_handshake. be3caf455 dpif-netlink: Fix memory leak dpif_netlink_open(). b7e1593f4 ofp-parse: Check ranges on string to uint32_t conversion. 70cb45c66 learning-switch: Fix coredump of OpenFlow15 learning-switch. b08224194 ovsdb: Allow conversion records with no data in a clustered storage. efcdf6c0d ovsdb: Check for ephemeral columns before writing a new schema. bf39ea3c7 ovsdb-tool: Fix cluster-to-standalone for DB conversion records. 4f82f8903 ovs-tcpdump: Stdout is shutdown before ovs-tcpdump exit. 77116d990 Prepare for 2.17.7. Reference: https://www.openvswitch.org/releases/NEWS-2.17.9.txt Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* upx: bump to 4.2.2 release - fixes various CVEsFathi Boudra2024-02-221-36/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update upx recipe from 3.96 to 4.2.2 release: * Use the gitsm fetcher to get the source code. * Add a note to keep using the git repository. * Update the homepage. * Drop the build dependencies as they're useless. UPX builds using the vendor subdirectory, statically linking the libraries. Fixes CVEs: * https://www.cve.org/CVERecord?id=CVE-2023-23456 A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file. * https://www.cve.org/CVERecord?id=CVE-2023-23457 A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service. * https://www.cve.org/CVERecord?id=CVE-2021-46179 Reachable Assertion vulnerability in upx before 4.0.0 allows attackers to cause a denial of service via crafted file passed to the the readx function. * https://www.cve.org/CVERecord?id=CVE-2021-43317 A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf64::elf_lookup() at p_lx_elf.cpp:5404 * https://www.cve.org/CVERecord?id=CVE-2021-43316 A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le64(). * https://www.cve.org/CVERecord?id=CVE-2021-43315 A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5349 * https://www.cve.org/CVERecord?id=CVE-2021-43314 A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5368 * https://www.cve.org/CVERecord?id=CVE-2021-43313 A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf32::invert_pt_dynamic at p_lx_elf.cpp:1688. * https://www.cve.org/CVERecord?id=CVE-2021-43312 A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf64::invert_pt_dynamic at p_lx_elf.cpp:5239. * https://www.cve.org/CVERecord?id=CVE-2021-43311 A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5382. * https://www.cve.org/CVERecord?id=CVE-2021-30501 An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file. * https://www.cve.org/CVERecord?id=CVE-2021-30500 Null pointer dereference was found in upx PackLinuxElf::canUnpack() in p_lx_elf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file. * https://www.cve.org/CVERecord?id=CVE-2021-20285 A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (SEGV or buffer overflow and application crash) or possibly have unspecified other impacts via a crafted ELF. The highest threat from this vulnerability is to system availability. * https://www.cve.org/CVERecord?id=CVE-2020-27802 An floating point exception was discovered in the elf_lookup function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file. * https://www.cve.org/CVERecord?id=CVE-2020-27801 A heap-based buffer over-read was discovered in the get_le64 function in bele.h in UPX 4.0.0 via a crafted Mach-O file. * https://www.cve.org/CVERecord?id=CVE-2020-27800 A heap-based buffer over-read was discovered in the get_le32 function in bele.h in UPX 4.0.0 via a crafted Mach-O file. * https://www.cve.org/CVERecord?id=CVE-2020-27799 A heap-based buffer over-read was discovered in the acc_ua_get_be32 function in miniacc.h in UPX 4.0.0 via a crafted Mach-O file. * https://www.cve.org/CVERecord?id=CVE-2020-27798 An invalid memory address reference was discovered in the adjABS function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file. * https://www.cve.org/CVERecord?id=CVE-2020-27797 An invalid memory address reference was discovered in the elf_lookup function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file. * https://www.cve.org/CVERecord?id=CVE-2020-27796 A heap-based buffer over-read was discovered in the invert_pt_dynamic function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file. Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cni: clean dir ${B}/plugins before do_compileChangqing Li2023-12-141-0/+2
| | | | | | | | | | | | | | | | | | | | | | | Clean dir ${B}/plugins before do_compile to avoid cni generated binaries like /usr/libexec/cni/bridge has wrong dynamic linker path and reports error like: /usr/libexec/cni/bridge: no such file or directory". Reproduce steps: 1. bitbake cni 2. enable usrmerge feature in local.conf 3. bitbake cni After step 2, GOBUILDFLAGS changed, "-I /lib64/ld-linux-aarch64.so.1" -> "/usr/lib/ld-linux-aarch64.so.1" But "go build" seems only check if the cached packagefile changed, since all not changed, the dynamic linker still use the old one, maybe go build should improve this. Clean dir ${B}/plugins to trigger rebuild of the binaries here. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cni: fix textrel QA issueChen Qi2023-12-141-3/+3
| | | | | | | | | | | | | | | When building cni, we get textrel QA issue like below: cni: ELF binary /usr/libexec/cni/macvlan has relocations in .text The problem could be solved by adding '-buildmode=pie' to ${GO}. In go.bbclass, this flag is added to GOBUILDFLAGS conditionally, that is, if the arch is not mips nor riscv32, this '-buildmode=pie' is added to GOBUILDFLAGS. So make use of that. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* cni: reproducible builds: pass -trimpathBruce Ashfield2023-12-141-3/+3
| | | | Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* kubernetes: Fix CVE-2023-2727, CVE-2023-2728Soumya Sambu2023-11-212-0/+560
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers, Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account's secrets field. Kuberenetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountab'le-secrets` annotation are used teogether with ephemeralcontainers. CVE: CVE-2023-2727, CVE-2023-2728 Affected Versions 1.27.0 - v1.27.2 v1.26.0 - v1.26.5 v1.25.0 - v1.25.10 <= v1.24.14 master branch(kubernetes v1.28.2) is not impacted mickledore branch(kubernetes v1.27.5) is not impacted References: https://nvd.nist.gov/vuln/detail/CVE-2023-2727 https://nvd.nist.gov/vuln/detail/CVE-2023-2728 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* kubernetes: Fix CVE-2023-2431Soumya Sambu2023-11-212-0/+864
| | | | | | | | | | | | | | | | | | | | | | | | A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. CVE: CVE-2023-2431 Affected Versions v1.27.0 - v1.27.1 v1.26.0 - v1.26.4 v1.25.0 - v1.25.9 <= v1.24.13 master branch(kubernetes v1.28.2) is not impacted mickledore branch(kubernetes v1.27.5) is not impacted References: https://nvd.nist.gov/vuln/detail/CVE-2023-2431 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* kubernetes: Adjust patches to resolve error that occur with devtoolSoumya Sambu2023-11-215-29/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | Adjust patches and .bb to fix below error which occurs with devtool modify command - ERROR: Applying patch '0001-hack-lib-golang.sh-use-CC-from-environment.patch' on target directory CmdError('sh -c \'PATCHFILE="0001-hack-lib-golang.sh-use-CC-from-environment.patch" git -c user.name="OpenEmbedded" -c user.email="oe.patch@oe" commit -F /tmp/tmp_ptvioq3 --author="Koen Kooi <koen.kooi@linaro.org>" --date="Mon, 23 Jul 2018 15:28:02 +0200"\'', 0, 'stdout: On branch devtool Changes not staged for commit: (use "git add <file>..." to update what will be committed) (use "git restore <file>..." to discard changes in working directory) (commit or discard the untracked or modified content in submodules) \tmodified: src/import (modified content) no changes added to commit (use "git add" and/or "git commit -a") stderr: ') This error is not seen on master branch, fixed with below commit - [https://git.yoctoproject.org/meta-virtualization/commit/?id=d9af46db9aa9060c1ec10118b2cccabfc8264904] Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* packagegroup-container: require ipv6 for podmanJörg Sommer2023-11-081-1/+1
| | | | | | | | | | | | | | | | The recipe *podman* requires the distro feature *ipv6*. Using a distro without it causes the build of *packagegroup-container* fails, even if *packagegroup-podman* is not used: ERROR: Nothing RPROVIDES 'podman' (but /build/../work/layers-3rdparty/meta-virtualization/recipes-core/packagegroups/packagegroup-container.bb RDEPENDS on or otherwise requires it) podman was skipped: missing required distro feature 'ipv6' (not in DISTRO_FEATURES) NOTE: Runtime target 'podman' is unbuildable, removing... Missing or unbuildable dependency chain was: ['podman'] NOTE: Runtime target 'packagegroup-docker' is unbuildable, removing... Missing or unbuildable dependency chain was: ['packagegroup-docker', 'podman'] Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* nerdctl: fix installed-vs-shipped with usrmergeMartin Jansa2023-09-131-2/+2
| | | | | | | | | | | | * fixes: ERROR: nerdctl-v1.3.0-r0 do_package: QA Issue: nerdctl: Files/directories were installed but not shipped in any package: /bin /bin/nerdctl Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install. nerdctl: 2 installed and not shipped files. [installed-vs-shipped] Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* nerdctl: update branch to mainBruce Ashfield2023-09-131-1/+1
| | | | Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* go-mux: Switch to main branchMingli Yu2023-09-121-1/+1
| | | | | | | The project has renamed the master branch to main. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* go-context: Switch to main branchMingli Yu2023-09-121-1/+1
| | | | | | | The project has renamed the master branch to main. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* docker-ce: bump SRCREV_dockerMartin Jansa2023-08-161-3/+3
| | | | | | | | | | | * fix my prevous commit where I've missed this update corresponding to SRCREV_moby change in docker-moby recipe. * also re-order the patches in SRC_URI to match docker-moby, so that they are easier to compare Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* docker: update to v20.10.25 + 58 commits to fix compatibility with go ↵Martin Jansa2023-08-155-49/+218
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | currently in kirkstone * since this backport: https://lists.openembedded.org/g/openembedded-core/message/185082 landed in kirkstone: https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=5dc74138649ab7a2c0158a43225dc7a8fd732355 docker cannot access network and fails with: "http: invalid Host header" update to latest commit in 20.10 branch, because latest tag v20.10.25 have the fix yet: https://github.com/moby/moby/compare/v20.10.21...v20.10.25 so we need couple more commits from upstream: https://github.com/moby/moby/compare/v20.10.25...791d8ab87747169b4cbfcdf2fd57c81952bae6d5 Adjust the go version revert which was here since the upgrade to v20.10.21: https://git.yoctoproject.org/meta-virtualization/commit/?h=kirkstone&id=927537108bcf2b98859512ce3eae59a73439994d and add another revert for the go upgrades from upstream for this older patch to apply. * update cli to latest in 20.10 branch as well: https://github.com/docker/cli/compare/baeda1f82a10204ec5708d5fbba130ad76cfee49..911449ca245308472a3d34a7f1a98b918e65c8c3 Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* docker-distribution: fix for CVE-2023-2253Narpat Mali2023-07-252-0/+670
| | | | | | | | | | | | | | | A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n,` causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory. References: https://github.com/distribution/distribution/security/advisories/GHSA-hqxw-f8mx-cpmw https://github.com/distribution/distribution/commit/521ea3d973cb0c7089ebbcdd4ccadc34be941f54 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* libvirt: CVE-2023-2700 Memory leak in virPCIVirtualFunctionList cleanupHitendra Prajapati2023-06-072-0/+55
| | | | | | | Upstream-Status: Backport from https://gitlab.com/libvirt/libvirt/-/commit/6425a311b8ad19d6f9c0b315bf1d722551ea3585 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
* xtf: chang the old override syntaxXiangyu Chen2023-05-171-1/+1
| | | | | Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-30 09:06:08 +0000