linux/poky.git, branch dunfell-23.0.20

build-appliance-image: Update to dunfell head revision

2022-10-09T18:34:46+00:00

(From OE-Core rev: dbad46a0079843b380cf3dda6008b12ab9526688) Signed-off-by: Richard Purdie

poky.conf: bump version for 3.1.20 release

2022-10-05T07:40:31+00:00

(From meta-yocto rev: 56e2baf3d5d51a0491fb295b8a0bcacacdd1e2f9) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

documentation: update for 3.1.20

2022-10-05T07:40:31+00:00

(From yocto-docs rev: d2abea88ce793d2a31836cbffae096190dd54563) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

licenses: Handle newer SPDX license names

2022-10-05T07:39:19+00:00

License names were updated in commit 2456f523cfbb (after the dunfell release) to match the current SPDX license list. We don't want to do any wholesale renaming on the dunfell stable branch but we should add mappings for the newer '*-only' names to allow for layers which support both dunfell and newer releases. (From OE-Core rev: 2a646cbdaca914e6f2c76ccb75065a811a9f94de) Signed-off-by: Paul Barker Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bind: Fix CVEs 2022-2795, 2022-38177, 2022-38178

2022-10-05T07:39:19+00:00

(From OE-Core rev: 9632481dc14868c0f92572472834a2a0c4f46e2e) Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

create-pull-request: don't switch the git remote protocol to git://

2022-09-30T15:34:52+00:00

Many git repos prefer https:// nowadays and many removed support for git://. This breaks the script when using github.com even when selected remote is ssh (git@github.com:openembedded/...), it will re-write it to git:// before calling git pull-request causing: openembedded-core $ scripts/create-pull-request -u github -b jansa/artifacts -o pull-kernel NOTE: Assuming local branch HEAD, use -l to override. fatal: unable to connect to github.com: github.com[0: 140.82.121.3]: errno=Connection timed out warn: No match for commit ea003bd026aa24bb4c8b7562f44ed6512e921259 found at git://github.com/shr-distribution/oe-core warn: Are you sure you pushed 'jansa/artifacts' there? ERROR: git request-pull reported an error (From OE-Core rev: 7a08f2ae1c12e3511b409c4535d2eab83a27b64a) Signed-off-by: Martin Jansa Signed-off-by: Richard Purdie (cherry picked from commit 64c466920b808c35d1ac87b47cf438bc79becea7) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

go: Add fix for CVE-2022-32190

2022-09-30T15:34:52+00:00

Link: https://github.com/golang/go/commit/28335508913a46e05ef0c04a18e8a1a6beb775ec (From OE-Core rev: 3362bbb1a1ce599418dc8377043f7549f9327315) Signed-off-by: Shubham Kulkarni Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

golang: CVE-2022-27664 net/http: handle server errors after sending GOAWAY

2022-09-30T15:34:52+00:00

Source: https://github.com/golang/go MR: 121912 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/5bc9106458fc07851ac324a4157132a91b1f3479 ChangeID: 0b76a92a774279d7bffc9d6fa05564dfd8371e8c Description: CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY. (From OE-Core rev: 4e2f723a4288ad4839fac2769e487612252b1d40) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

vim: Upgrade 9.0.0541 -> 9.0.0598

2022-09-30T15:34:52+00:00

Includes a fix for CVE-2022-3278. (From OE-Core rev: bc13c16bec7a898ae3246e2a9ab586e8241af28e) Signed-off-by: Richard Purdie Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 98c40271692147873a622e168e8b2e90a9fcc54c) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bluez: CVE-2022-39176 BlueZ allows physically proximate attackers

2022-09-30T15:34:52+00:00

Source: https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/1977968 MR: 122140 Type: Security Fix Disposition: Backport from https://launchpad.net/ubuntu/+source/bluez/5.53-0ubuntu3.6 ChangeID: b989c7670a9b2bd1d11221e981eab0d162f3271c Description: CVE-2022-39176 bluez: BlueZ allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len. Affects "bluez < 5.59" (From OE-Core rev: 3750b576035d87633c69c0a5fc6de4854179f9b0) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie