linux/poky.git/meta/recipes-connectivity, branch hardknott-3.3.5

socat: update SRC_URI

2022-01-31T21:56:01+00:00

The orginal one is unaccessible now. (From OE-Core rev: 88edb7031149992e12f668201f0a22af6d666867) Signed-off-by: Mingli Yu Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

openssl: Add reproducibility fix

2022-01-07T23:21:34+00:00

When the date rolled from one year to another, it highlighted a reproducibility issue in openssl. Patch a workaround for this to avoid autobuilder failures. Help submitting upstream welcome. (From OE-Core rev: 8502242b5caa24fe1aeffa8bd5f048ebdb5f6610) Signed-off-by: Richard Purdie (cherry picked from commit f8281e290737dba16a46d7ae937c66b3266e0fe8) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

bind: fix CVE-2021-25219

2021-11-24T21:12:46+00:00

Backport patches to fix CVE-2021-25219. (From OE-Core rev: 918660a2d4bc89a763a5934765ff6a1647709fcc) Signed-off-by: Mingli Yu Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

inetutils: fix CVE-2021-40491

2021-11-24T21:12:46+00:00

CVE-2021-40491: The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl. References: https://nvd.nist.gov/vuln/detail/CVE-2021-40491 Patch from: https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=58cb043b190fd04effdaea7c9403416b436e50dd (From OE-Core rev: 1b857807f1cf8fee3175f8479a0c7cb1850bd9a9) drop changes to NEWS (From OE-Core rev: 217e5f0857e0a542c4e02bbead4e91edc6eb9ecc) Signed-off-by: Yi Zhao Signed-off-by: Richard Purdie Signed-off-by: Chee Yang Lee Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

meta: add explicit branch and protocol to SRC_URI

2021-11-21T11:40:35+00:00

Add branch name explicitly to SRC_URI where it's not defined and switch to using https protocol for Github projects. The change was made using convert-srcuri script in scripts/contrib. (From OE-Core rev: ab781d4e3fa7425d96ea770ddfd0f01f62018c5b) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

avahi: update CVE id fixed by local-ping.patch

2021-11-21T11:40:35+00:00

CVE-2021-36217 is treated as a duplicate of CVE-2021-3502. Update the local-ping.patch to mark it resolve both. (From OE-Core rev: ba37cbbf83a51178dffc19fbc2bb5234cb795c0e) Signed-off-by: Chen Qi Signed-off-by: Richard Purdie (cherry picked from commit 4d75d6c39f1faeb38191b55f1fa9311b63fcfb29) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

openssh: fix CVE-2021-41617

2021-11-03T11:19:04+00:00

(From OE-Core rev: b2c329641f91630ecbb225e8cd0cdcaf461d7ef6) Signed-off-by: Changqing Li Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

bind: Exclude CVE-2019-6470 from cve-check

2021-10-07T14:10:40+00:00

Issue only affects dhcpd with recent bind versions. We don't ship dhcpd anymore so the issue doesn't affect us. (From OE-Core rev: 09898a99b42e048e7085a3df4504e887811b2349) Signed-off-by: Richard Purdie (cherry picked from commit 30106ae676124ba3c0e496a4f19c919c8418b59b) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

connman: add CVE_PRODUCT

2021-10-02T08:53:15+00:00

Upstream database uses both "connman" and "connection_manager" to report CVEs (From OE-Core rev: f0789ed2f4b49f8c63dedd770e5c78bac6cae456) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie (cherry picked from commit eadf7bb17289731be9747822e3d4084ab69cf109) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

bluez5: fix CVE-2021-0129

2021-09-17T20:31:37+00:00

Backport a fix from version 5.57 rather than doing an uprev, since there appear to be some minor functional changes between our current version and that version, despite the changelog only listing fixes. (From OE-Core rev: be18e566413efef12dc2488ab186f397d1dacda9) Signed-off-by: Trevor Gamblin Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie