linux/poky.git, branch yocto-2.7.2

poky.conf: Bump version for 2.7.2 warrior release

2019-10-30T13:55:49+00:00

(From meta-yocto rev: a6f2b72a6044dc8c48a331e21afe7a83a113e038) Signed-off-by: Richard Purdie

qemu: update to 3.1.1.1

2019-10-30T13:47:55+00:00

bug fix only update. Drop patches included in update. For full set of changes, see: https://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/tags/v3.1.1.1 (From OE-Core rev: 14f04e6b6c1fa40a1c39cd186627b4b8442f2d5e) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

go: fix CVE-2019-16276

2019-10-30T13:47:55+00:00

(From OE-Core rev: 5fc9b154754e67553296a00a39ed16ab6a1d59de) Signed-off-by: Chen Qi Signed-off-by: Richard Purdie (cherry picked from commit e31f87e289dfd3bbca961e927447a9c7ba816d3f) Signed-off-by: Armin Kuster (cherry picked from commit e02e8fa2e82cceaaa6a433466f52f97b0984762a) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

sudo: fix CVE-2019-14287

2019-10-30T13:47:54+00:00

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command. (From OE-Core rev: 650dd9486d6e5410665d5376be30732c7625396d) Signed-off-by: Changqing Li Signed-off-by: Richard Purdie (cherry picked from commit 4e11cd561f2bdaa6807cf02ee7c9870881826308) Signed-off-by: Armin Kuster (cherry picked from commit b1e0149c41e3c344a0496e64ab3b0c9dd4685ea4) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

libgcrypt: fix CVE-2019-12904

2019-10-30T13:47:54+00:00

In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-12904 Patches from: https://github.com/gpg/libgcrypt/commit/1374254c2904ab5b18ba4a890856824a102d4705 https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762 https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020 (From OE-Core rev: a981d9b753a13e100af1f654fb3384f0bcda0b65) Signed-off-by: Yi Zhao Signed-off-by: Ross Burton (cherry picked from commit 37e390ff05b6a4509019db358ed496731d80cc51) Signed-off-by: Armin Kuster (cherry picked from commit 4c207cb1ad46c0d2005ab3eae70d78c937e084b5) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssl: make OPENSSL_ENGINES match install path

2019-10-30T13:47:54+00:00

Set OPENSSL_ENGINES to the path where engines are actually installed. (From OE-Core rev: 041fb2743a94d7fb065b073efbe5fe5cf46cde53) Signed-off-by: George McCollister Signed-off-by: Ross Burton (cherry picked from commit 59565fec0b3f3e24eb01c03b671913599cd3134d) Signed-off-by: Armin Kuster (cherry picked from commit 578f41124565a7cda738c7fe3d25702ee41b08ed) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python: Fix CVE-2019-10160

2019-10-30T13:47:54+00:00

(From OE-Core rev: 23d48f2bea2d358bd8d7d4efd07792bc1f3666bd) Signed-off-by: Changqing Li Signed-off-by: Ross Burton (cherry picked from commit b4240b585d7fcac2fdbf33a8e72d48cb732eb696) Signed-off-by: Armin Kuster (cherry picked from commit 10d87a3085665a959a5fda64ae3895cb27ddf343) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python: CVE-2019-16056

2019-10-30T13:47:54+00:00

(From OE-Core rev: 49ff6c7ef1d366007c49083f4e5faaf5a9eb086f) Signed-off-by: Chen Qi Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster (cherry picked from commit 27be9cf71a6fe906a23e81b56f1cc18a6fc9ef97) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python: add tk-lib as runtime dependency for python-tkinter

2019-10-30T13:47:54+00:00

Fixes: ERROR: python-2.7.16-r0 do_package_qa: QA Issue: /usr/lib/python2.7/lib-dynload/_tkinter.so contained in package python-tkinter requires libtk8.6.so, but no providers found in RDEPENDS_python-tkinter? [file-rdeps] (From OE-Core rev: f83ecbabb911c46de77708ede759a0b768928ea2) Signed-off-by: Yi Zhao Signed-off-by: Ross Burton (cherry picked from commit f78248a2380bbbbf271b5bb02c762f5bc7a3a92e) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

python: include CVE patches for python-native as well

2019-10-30T13:47:54+00:00

Also avoids maintaining a different set of patches for both. (From OE-Core rev: e73d5bb4a21497ed645e2a0a4b88c2eeaf65080a) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie (cherry picked from commit b3b1c00cc46b33ddbf7e008267032220e1e298af) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie