linux/poky.git/meta/recipes-connectivity, branch dunfell

openssl: Fix CVE-2024-0727

2024-04-05T13:34:42+00:00

PKCS12 structures contain PKCS7 ContentInfo fields. These fields are optional and can be NULL even if the "type" is a valid value. OpenSSL was not properly accounting for this and a NULL dereference can occur causing a crash. (From OE-Core rev: 18eb56925878a67ca1d7ce3eb9092f611023bc23) Signed-off-by: virendra thakur Signed-off-by: Steve Sakoman

openssh: Fix CVE-2023-51385

2024-01-31T13:51:10+00:00

OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name. This patch fixes the above issue Link: http://archive.ubuntu.com/ubuntu/pool/main/o/openssh/openssh_8.2p1-4ubuntu0.11.debian.tar.xz Link: https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a (From OE-Core rev: a0561ca36bd3be8f44d11908caaf8c9ce5f69032) Signed-off-by: Ranjitsinh Rathod Signed-off-by: Ranjitsinh Rathod Signed-off-by: Steve Sakoman

bluez5: fix CVE-2023-45866

2023-12-29T15:29:14+00:00

Upstream-Status: Backport from https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=25a471a83e02e1effb15d5a488b3f0085eaeb675 (From OE-Core rev: 1df2bdf370346dac70451159adf1ae85d1a2dacd) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman

openssh: backport Debian patch for CVE-2023-48795

2023-12-29T15:29:14+00:00

import patches from ubuntu to fix CVE-2023-48795 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/openssh/tree/debian/patches?h=ubuntu%2Ffocal-security Upstream commit https://github.com/openssh/openssh-portable/commit/1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5] Reference: https://ubuntu.com/security/CVE-2023-48795 (From OE-Core rev: 4026a1cc3aa242a80c306b34b030f05d41b55dda) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

avahi: backport Debian patches to fix multiple CVE's

2023-12-01T14:14:19+00:00

import patches from ubuntu to fix CVE-2023-1981 CVE-2023-38469 CVE-2023-38470 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches?h=ubuntu/focal-security Upstream commit https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f & https://github.com/lathiat/avahi/commit/a337a1ba7d15853fb56deef1f464529af6e3a1cf & https://github.com/lathiat/avahi/commit/c6cab87df290448a63323c8ca759baa516166237 & https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c & https://github.com/lathiat/avahi/commit/20dec84b2480821704258bc908e7b2bd2e883b24 & https://github.com/lathiat/avahi/commit/894f085f402e023a98cbb6f5a3d117bd88d93b09 & https://github.com/lathiat/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460 & https://github.com/lathiat/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40 & https://github.com/lathiat/avahi/commit/b448c9f771bada14ae8de175695a9729f8646797] (From OE-Core rev: 4771e335cd4d95e734d7f07a718319f4543ce2f1) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

bind: Backport fix for CVE-2023-3341

2023-12-01T14:14:19+00:00

Upstream-Status: Backport [https://gitlab.isc.org/isc-projects/bind9/-/commit/c4fac5ca98efd02fbaef43601627c7a3a09f5a71] (From OE-Core rev: e0fbe202981c9074547881dbeb7eb58670808fc3) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

resolvconf: Fix fetch error

2023-11-17T16:00:32+00:00

Branch 'master' renamed to 'unstable', which causing following failure. Error: Fetcher failure: Unable to find revision cb19bbfbe7e52174332f68bf2f295b39d119fad3 in branch master even from upstream Switch to 'unstanble' branch. (From OE-Core rev: d4b96dc1e457b4e68c5bad685ffcfd2f250162e7) Signed-off-by: Naveen Saini Signed-off-by: Steve Sakoman

openssl: Upgrade 1.1.1v -> 1.1.1w

2023-10-13T15:47:07+00:00

https://www.openssl.org/news/openssl-1.1.1-notes.html Major changes between OpenSSL 1.1.1v and OpenSSL 1.1.1w [11 Sep 2023] * Fix POLY1305 MAC implementation corrupting XMM registers on Windows (CVE-2023-4807) (From OE-Core rev: 79b29a5f77efab978f6a2918d02ee611638aef85) Signed-off-by: Sourav Kumar Pramanik Signed-off-by: Steve Sakoman

openssh: Securiry fix for CVE-2023-38408

2023-09-15T13:47:11+00:00

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. References: https://nvd.nist.gov/vuln/detail/CVE-2023-38408 Upstream patches: https://github.com/openssh/openssh-portable/commit/dee22129, https://github.com/openssh/openssh-portable/commit/099cdf59, https://github.com/openssh/openssh-portable/commit/29ef8a04, https://github.com/openssh/openssh-portable/commit/892506b1, https://github.com/openssh/openssh-portable/commit/0c111eb8, https://github.com/openssh/openssh-portable/commit/52a03e9f, https://github.com/openssh/openssh-portable/commit/1fe16fd6, https://github.com/openssh/openssh-portable/commit/e0e8bee8, https://github.com/openssh/openssh-portable/commit/8afaa7d7, https://github.com/openssh/openssh-portable/commit/1a4b9275, https://github.com/openssh/openssh-portable/commit/4c1e3ce8, https://github.com/openssh/openssh-portable/commit/1f2731f5. (From OE-Core rev: 9242b8218858d2bebb3235929fea7e7235cd40f3) Signed-off-by: Shubham Kulkarni Signed-off-by: Steve Sakoman

bind: Backport fix for CVE-2023-2828

2023-09-15T13:47:11+00:00

Upstream Patch: https://downloads.isc.org/isc/bind9/9.16.42/patches/0001-CVE-2023-2828.patch LINK: https://security-tracker.debian.org/tracker/CVE-2023-2828 (From OE-Core rev: 1b9d661a82211d6ffdd56e366cfbc3f3c247fd1c) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman