linux/poky.git/meta/recipes-connectivity, branch langdale

openssl: Security fix for CVE-2023-0464, CVE-2023-0465, CVE-2023-0466

2023-04-04T16:46:24+00:00

Upstream-Status: - CVE-2023-0464: Backport from [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1] - CVE-2023-0465: Backport from [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb] - CVE-2023-0466: Backport from [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908] (From OE-Core rev: c650340c11567ae145151683a65ee54afdcf08e8) Signed-off-by: Siddharth Doshi Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

dhcpcd: Fix install conflict when enable multilib.

2023-03-21T14:26:31+00:00

Error: Transaction test error: file /usr/share/man/man8/dhcpcd.8 conflicts between attempted installs of dhcpcd-doc-9.4.1-r0.cortexa57 and lib32-dhcpcd-doc-9.4.1-r0.armv7ahf_neon The differences between the two files are as follows: @@ -821,7 +821,7 @@ If you always use the same options, put them here. .It Pa /usr/libexec/dhcpcd-run-hooks Bourne shell script that is run to configure or de-configure an interface. -.It Pa /usr/lib64/dhcpcd/dev +.It Pa /usr/lib/dhcpcd/dev Linux .Pa /dev management modules. (From OE-Core rev: ae3aa0ded86ae13060989d19e64795b00946cd2e) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni (cherry picked from commit 65ca2c4b7349a4f7dcfcc580d926a99c673deb60) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

dhcpcd: fix dhcpcd start failure on qemuppc64

2023-03-06T15:09:42+00:00

Backport patch to fix dhcpcd start failed on qemuppc64. (From OE-Core rev: add5856e9a2d0646869756abf1a6b1d7d9629176) Signed-off-by: Xiangyu Chen Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit a31d658198566de12cdd1aad18776b8da8065787) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

openssl: Upgrade 3.0.7 -> 3.0.8

2023-03-06T15:09:42+00:00

OpenSSL 3.0.8 fixes 1 HIGH level security vulnerability and 7 MODERATE level security vulnerability [1]. Upgrade the recipe to point to 3.0.8. CVE-2022-3996 is reported fixed in 3.0.8, so drop the patch for that as well. [1] https://www.openssl.org/news/vulnerabilities.html CVEs Fixed: https://www.openssl.org/news/secadv/20230207.txt (From OE-Core rev: f5dce7274bfd65c05df932f36a5e43cfc884fd41) Signed-off-by: Siddharth Doshi Signed-off-by: Martin Jansa Signed-off-by: Richard Purdie (cherry picked from commit 8461466f63200a0b1c9c247b70fdf5819651544c) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bind: upgrade 9.18.10 -> 9.18.11

2023-02-24T16:41:51+00:00

Stable branch update License-update: copyright years (From OE-Core rev: 3aea7767cc0c3eceb748699ecead324fab4284a3) Signed-off-by: Alexander Kanavin Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 63e8a8952c3d1b3b5c481be6bba52a3f4d65648e) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

ppp: backport fix for CVE-2022-4603

2023-02-04T23:32:27+00:00

(From OE-Core rev: 4af92cb7c94a26fae56ae3915ce5b3070a5eadfd) Signed-off-by: Ross Burton Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit d5d787b44b102e3a69e28948326e39f83fc1d98d) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

openssl: fix CVE-2022-3996 double locking leads to denial of service

2023-02-04T23:32:27+00:00

(From OE-Core rev: 7007673bcdb606dbe78c71f72aceda6483485fb6) Signed-off-by: Vivek Kumbhar Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

dhcpcd: backport two patches to fix runtime error

2023-01-26T23:39:06+00:00

In case of nodistro, dhcpcd gives us 'Bad system call' error and exits. This is because there are syscalls that should be allowed but not in privsep. Backport two patches to fix this issue. (From OE-Core rev: 82b7967721db08f925193a1c36232cafd0dab506) Signed-off-by: Chen Qi Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit f1e6a0c16d6685096ec9313301aa431e73d02c07) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bind: upgrade 9.18.9 -> 9.18.10

2023-01-15T11:05:19+00:00

Changelog: ========== The key file IO locks objects would never get deleted from the hashtable due to off-by-one error. ANY responses could sometimes have the wrong TTL. Speed up the named shutdown time by explicitly canceling all recursing ns_client objects for Removing a catalog zone from catalog-zones without also removing the referenced zone could leave a dangling pointer. [GL #3683] nslookup and host were not honoring the selected port in TCP mode. [GL #3721] Deprecate alt-transfer-source, alt-transfer-source-v6 and use-alt-transfer-source. [GL #3694] Move the "final reference detached" log message from dns_zone unit to the DEBUG(1) log level. Fix assertion failure in isc_http API used by statschannel if the read callback would be called on HTTP request that has been already closed. Deduplicate time unit conversion factors. Copy TLS identifier when setting up primaries for catalog member zones. Deprecate 'auto-dnssec'. [GL #3667] The decompression implementation in dns_name_fromwire() is now smaller and faster. [GL #3655] Use the current domain name when checking answers from a dual-stack-server. Ensure 'named-checkconf -z' respects the check-wildcard option when loading a zone. [GL #1905] Deprecate 'coresize', 'datasize', 'files', and 'stacksize' named.conf options. The view's zone table was not locked when it should have been leading to race conditions when external extensions that manipulate the zone table where in use. Some browsers (Firefox) send more than 10 HTTP headers. Bump the number of allowed HTTP headers to 100. [GL #3670] NXDOMAIN cache records are no longer retained in the cache after expiry, even when serve-stale is in use. [GL #3386] (From OE-Core rev: 6c2b904f22a629880681a26550022764c170541a) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie (cherry picked from commit 1c093c38e247b522f279f616d16373795a4cdf89) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

openssh: remove RRECOMMENDS to rng-tools for sshd package

2023-01-06T17:33:19+00:00

It appears that rngd is not needed as of linux-5.6 and later[1] and should not be installed by default since the purpose of rngd is to provide additional trusted sources of entropy. We did some testing on real hardware, the result seems to support that we no longer need rngd by default on kernel v5.6 and later. Testing result as below: 1. observing the crng init stage. the "random: crng init done" always available before fs being mounted. 2. generating random number without rngd. testing command: dd if=/dev/random of=/dev/null status=progress on Marvell CN96xx RDB board, speed almost 20.4 MB/s without block on NXP i.mx6q board, speed almost 31.9 MB/s without block on qemu x86-64, speed almost 2.6MB/s without block 3. using rngtest command without rngd testing command: rngtest -c 1000 Signed-off-by: Alexandre Belloni (cherry picked from commit 868dfb46d96a27ec9041cb902fb769330277257d) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie