linux/poky.git, branch kirkstone-4.0.20

build-appliance-image: Update to kirkstone head revision

2024-07-15T17:35:04+00:00

(From OE-Core rev: 5d97b0576e98a2cf402abab1a1edcab223545d87) Signed-off-by: Steve Sakoman

poky.conf: bump version for 4.0.20

2024-07-15T17:30:10+00:00

(From meta-yocto rev: c4c74d1e575217ddc4b74759cd83186a70940ef9) Signed-off-by: Steve Sakoman

glibc-tests: Add missing bash ptest dependency

2024-07-09T13:06:09+00:00

The script has a bashism and needs bash to execute correctly. Mark it as such and add the missing bash dependency so it executes in minimal images. (From OE-Core rev: a1b5afac108d9c94e8fc2ad8cfebfee16f6f243b) (From OE-Core rev: 8e650506885bc4465f9569b3ccdc327eb83d90db) Signed-off-by: Richard Purdie (cherry picked from commit 28b8d57a88849f7f024d13c5c901f3621f5166c7) Signed-off-by: Poonam Jadhav Signed-off-by: Steve Sakoman

glibc-tests: correctly pull in the actual tests when installing -ptest package

2024-07-09T13:06:09+00:00

The tests are packaged into the main glibc-tests package which is fine, but then glibc-tests-ptest package needs to depend on that. Which is what this commit addresses. (From OE-Core rev: d37c2d428b09b9d0cbb875f083c6a1e9883a7fed) (From OE-Core rev: c09335a23025ff78a6d3eb41c483b5a479b1c3be) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 644914efa83a289da154c888b5661b9d16eaa35b) Signed-off-by: Poonam Jadhav Signed-off-by: Steve Sakoman

linuxloader: add -armhf on arm only for TARGET_FPU 'hard'

2024-07-09T13:06:09+00:00

There are two types of soft FPU options for arm, soft and softfp, and if using the latter the wrong dynamic loader will be used. E.g. go will link against ld-linux-armhf.so.3, but libc6 will only ship a ld-linux.so.3, so go programs will fail to start. Fix this by instead checking for TARGET_FPU being 'hard' and then applying the suffix. (From OE-Core rev: c7426629245db2ea8d9f3cf25b575ac31b5a83b0) Signed-off-by: Jonas Gorski Signed-off-by: Richard Purdie (cherry picked from commit 07b4c7a2bd23f8645810e13439e814caaaf9cd94) Signed-off-by: Steve Sakoman

openssh: fix CVE-2024-6387

2024-07-09T13:06:09+00:00

sshd(8) in Portable OpenSSH versions 8.5p1 to 9.7p1 (inclusive). Race condition resulting in potential remote code execution. A race condition in sshd(8) could allow remote code execution as root on non-OpenBSD systems. This attack could be prevented by disabling the login grace timeout (LoginGraceTime=0 in sshd_config) though this makes denial-of service against sshd(8) considerably easier. For more information, please refer to the release notes [1] and the report from the Qualys Security Advisory Team [2] who discovered the bug. [1] https://www.openssh.com/txt/release-9.8 [2] https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt References: https://www.openssh.com/security.html (From OE-Core rev: ddb998d16fd869acb00a1cd8038ada20fd32aa8b) Signed-off-by: Jose Quaresma v2: include the missing cve tag: CVE: CVE-2024-6387 v3: add the Signed-off-by on the CVE-2024-6387.patch Signed-off-by: Steve Sakoman

OpenSSL: Security fix for CVE-2024-5535

2024-07-09T13:06:09+00:00

Upstream-Status: Backport from [https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c] CVE's Fixed: CVE-2024-5535 openssl: SSL_select_next_proto buffer overread (From OE-Core rev: 2f4ac382a76e093a3eac6e74fbe2d136094cedf1) Signed-off-by: Siddharth Doshi Signed-off-by: Steve Sakoman

gstreamer1.0-plugins-base: fix CVE-2024-4453

2024-07-09T13:06:09+00:00

GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-23896. (From OE-Core rev: 6708631c89d1cb0d7e0e1b888c51826b3939f8af) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

wget: Fix for CVE-2024-38428

2024-07-09T13:06:09+00:00

Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace] (From OE-Core rev: 4f7fb1cf937b0cefa5b0079417859b56c3171c0a) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

man-pages: remove conflict pages

2024-06-26T12:04:39+00:00

Remove the pages which libxcrypt and shadow already have to avoid following conflicts during install man-pages and libxcrypt/shadow at the same time. Error: Transaction test error: file /usr/share/man/man3/crypt.3 from install of libcrypt-doc-4.4.33-r0.x86_64 conflicts with file from package man-pages-6.04-r0.x86_64 (From OE-Core rev: fbc8f5381e8e1da0d06f7f8e5b8c63a49b1858c2) Signed-off-by: Changqing Li Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 605b4a91dc44d33bd4742841e71645275bc039e8) Signed-off-by: Jonas Gorski Signed-off-by: Steve Sakoman