linux/poky.git, branch yocto-3.1.17

openssl: Backport fix for ptest cert expiry

2022-06-07T10:33:52+00:00

ptests in in openssl have started failing as one of the test certificates has expired. Backport a fix for this from upstream, replacing the test certificate to allow the ptests to pass again. (From OE-Core rev: 4051d1a3aa5f70da96c381f9dea5f52cd9306939) Signed-off-by: Richard Purdie (cherry picked from commit f26f0b34f12bbca2beed153da402a3594d127374) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

poky.conf: bump version for 3.1.17 release

2022-06-06T14:54:36+00:00

(From meta-yocto rev: 215cfdaeb88bbfdb995d0a09685271d586558af6) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

documentation: update for 3.1.17 release

2022-06-06T14:54:35+00:00

(From yocto-docs rev: 8dd19c901813263554ac2bc6bda2cf9a1c3c1e58) Signed-off-by: Steve Sakoman Reviewed-by: Michael Opdenacker Signed-off-by: Richard Purdie

cve-check: Allow warnings to be disabled

2022-06-04T11:16:59+00:00

When running CVE checks in CI we're usually not interested in warnings on the console for any CVEs present. Add a configuration option CVE_CHECK_SHOW_WARNINGS to allow this to be disabled (it is left enabled by default). (From OE-Core rev: d009233f36fb866f6bdaa12fb6deedf5e253e9c9) Signed-off-by: Richard Purdie (cherry picked from commit 1054d3366ba528f2ad52585cf951e508958c5c68) Signed-off-by: Steve Sakoman (cherry picked from commit 8fd6a9f521ea6b1e10c80fe33968943db30991ba) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: Only include installed packages for rootfs manifest

2022-06-04T11:16:59+00:00

Before this the rootfs manifest and the summary were identical. We should separate the summary and rootfs manifest more clearly, now the summary is for all CVEs and the rootfs manifest is only for things in that image. This is even more useful if you build multiple images. (From OE-Core rev: 2bacd7cc67b2f624885ce9c9c9e48950b359387d) Signed-off-by: Ernst Sjöstrand Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 3b8cc6fc45f0ea5677729ee2b1819bdc7a441ab1) Signed-off-by: Steve Sakoman (cherry picked from commit 65498411d73e8008d5550c2d0a1148f990717587) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check: Add helper for symlink handling

2022-06-04T11:16:59+00:00

(From OE-Core rev: 8a178a728f2318c55d5ecaef0ef9e0fd8ebc333b) Signed-off-by: Ernst Sjöstrand Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 5046d54df2c3057be2afa4143a2833183fca0d67) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cve-check.bbclass: Added do_populate_sdk[recrdeptask].

2022-06-04T11:16:59+00:00

As product, sdk should do cve check as well as rootfs. (From OE-Core rev: df09cd71b4cd3f830fced9ce91aa202c1609bfc5) Signed-off-by: Lei Maohui Signed-off-by: Luca Ceresoli (cherry picked from commit cc17753935c5f9e08aaa6c5886f059303147c07b) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

vim: Upgrade 8.2.4912 -> 8.2.5034 to fix 9 CVEs

2022-06-04T11:16:59+00:00

Address CVE-2022-1621, CVE-2022-1629, CVE-2022-1674, CVE-2022-1733, CVE-2022-1735 CVE-2022-1769, CVE-2022-1771, CVE-2022-1785, CVE-2022-1796 (From OE-Core rev: cd259a00503af360524f58c9cea51aa142dee250) Signed-off-by: Richard Purdie (cherry picked from commit fafce97bd440150ac5c586b53b887ee70a5b66bd) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libxml2: Fix CVE-2022-29824 for libxml2

2022-06-04T11:16:59+00:00

Add patch for CVE issue: CVE-2022-29824 CVE-2022-29824 Link: [https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab] Dependent patch: [https://gitlab.gnome.org/GNOME/libxml2/-/commit/b07251215ef48c70c6e56f7351406c47cfca4d5b] (From OE-Core rev: 096ca5fa8cc4672e5e9b25dffe81b176b252d570) Signed-off-by: Riyaz Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ncurses: Fix CVE-2022-29458

2022-06-04T11:16:59+00:00

ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. Backported from the link below, extracting only the relevant changes. https://github.com/ThomasDickey/ncurses-snapshots/commit/9d1d651878d4bf0695872a64cc65ba0acb825f36 (From OE-Core rev: 2287d591cf32f5580ea6679805d04c3a5146ecd5) Signed-off-by: Gustavo Lima Chaves Signed-off-by: Dan Tran Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie