linux/poky.git, branch sumo-next

git: set CVE vendor to git-scm

2019-11-07T19:47:27+00:00

There's a Jenkins plugin for Git. (From OE-Core rev: f2adf5e4d3e9afc6d45665bbe728c69d195a46ef) (From OE-Core rev: a28d17187dd4c7ac6aa7e5d28f3cfc0c9060bd94) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

subversion: set CVE vendor to Apache

2019-11-07T19:47:27+00:00

There's a Jenkins plugin for Subversion. (From OE-Core rev: ac115c3b5f1dcb95fb7d39537693fe0dcd330451) (From OE-Core rev: 457d52c1a86bad074e174e2004c54ac5be1728bd) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Conflicts: meta/recipes-devtools/subversion/subversion_1.12.0.bb

boost: set CVE vendor to Boost

2019-11-07T19:47:27+00:00

There's a Boost module for Drupal. (From OE-Core rev: 30ff8bb6502d45549c698be052a1caf4cb5c611f) (From OE-Core rev: 44c521f7cb04e0cd308489ae2ba05349ab1d3987) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ed: set CVE vendor to avoid false positives

2019-11-07T19:47:27+00:00

(From OE-Core rev: 2c3d689e4f78d8ea00b1bd2239af80c8fe038074) (From OE-Core rev: 6faf4f340ea8c2b11d609584897a7f5447abc2a0) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Conflicts: meta/recipes-extended/ed/ed_1.15.bb

rsync: fix CVEs for included zlib

2019-11-07T19:47:27+00:00

rsync includes its own copy of zlib and doesn't recommend linking with the system version [1]. Import CVE fixes that impact zlib version 1.2.8 [2] that is currently used by rsync. [1] https://git.samba.org/rsync.git/?p=rsync.git;a=blob;f=zlib/README.rsync [2] https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3agnu%3azlib%3a1.2.8 (From OE-Core rev: a55fbb4cb489853dfb0b4553f6e187c3f3633f48) (From OE-Core rev: 1ce0a922853b6136a019763b64e58194bb0df00f) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie Conflicts: meta/recipes-devtools/rsync/rsync_3.1.3.bb

openssl: set CVE vendor to openssl

2019-11-07T19:47:27+00:00

Differentiate it from openssl gem for Ruby. (From OE-Core rev: 2ec481b19d6c9c20ce6573de77ae89e576d6b8cb) (From OE-Core rev: a879a194aae0f1e97f3683f5ce01eaa8b5c0dd15) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie Conflicts: meta/recipes-connectivity/openssl/openssl_1.1.1c.bb

libpng: whitelist CVE-2019-17371

2019-11-07T19:47:27+00:00

This is actually a memory leak in gif2png 2.x, so whitelist it in the libpng recipe. (From OE-Core rev: 341e43ebd935daeb592cb073bf00f80c49a8ec2d) (From OE-Core rev: 581fa36d300fda00ae50c07b038fe847887f7ed3) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Conflicts: meta/recipes-multimedia/libpng/libpng_1.6.37.bb

procps: whitelist CVE-2018-1121

2019-11-07T19:47:27+00:00

This CVE is about race conditions in 'ps' which make it unsuitable for security audits. As these race conditions are unavoidable ps shouldn't be used for security auditing, so this isn't a valid CVE. (From OE-Core rev: b3fa0654abf9ac32f683ac174e453ea5e64b6cb8) (From OE-Core rev: 618a3203d53d33e6403386f1204bcaf327b68f37) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Conflicts: meta/recipes-extended/procps/procps_3.3.15.bb

libpam: set CVE_PRODUCT

2019-11-07T19:47:27+00:00

(From OE-Core rev: f1d5273d53d66b217f3d4975f5cb5eb367b1aab1) (From OE-Core rev: 2395ae4a332928de3f5fcb840ef196e7a7d77386) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Conflicts: meta/recipes-extended/pam/libpam_1.3.1.bb

webkitgtk: set CVE_PRODUCT

2019-11-07T19:47:27+00:00

(From OE-Core rev: 43aaa117386490c822b824974fb095bd0d3ce1a3) (From OE-Core rev: 76b3996974de8ca8729d7d262b1c90cd2def02d5) Signed-off-by: Chen Qi Signed-off-by: Richard Purdie Conflicts: meta/recipes-sato/webkit/webkitgtk_2.24.0.bb