linux/poky.git/meta/recipes-connectivity, branch styhead-5.1.4

openssh: patch CVE-2025-26465

2025-03-22T14:06:30+00:00

Pick commit: https://github.com/openssh/openssh-portable/commit/0832aac79517611dd4de93ad0a83577994d9c907 (From OE-Core rev: 0d77609f814dec344535c5674f71a043a4e718e5) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

openssh: patch CVE-2025-26466

2025-03-22T14:06:30+00:00

Pick commit: https://github.com/openssh/openssh-portable/commit/6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2 (From OE-Core rev: ec3912dcaaab85f1ac8907aa5b0b536c32540ff1) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

socat: patch CVE-2024-54661

2025-01-29T14:20:43+00:00

Picked upstream commit https://repo.or.cz/socat.git/commitdiff/4ee1f31cf80019c5907876576d6dfd49368d660f Since this was the only commit in 1.8.0.2 it also contained release changes which were dropped. (From OE-Core rev: 624b91c23559d7d1bc51ec221331513529853cd2) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

connman: Fix restart script

2025-01-13T13:49:08+00:00

The script does not work if the connman service is already stopped. The start-stop-daemon checks for the existence of a specified process. If such a process exists, start-stop-daemon sends it the signal specified by --signal, and exits with error status 0. If such a process does not exist, start-stop-daemon exits with error status 1 (0 if --oknodo is specified). The script uses set -e so we need to add --oknodo option to stop (From OE-Core rev: f32ab69b4caef5ac2f61bb53102d8b08b94d54d5) Signed-off-by: Michael Trimarchi Signed-off-by: Richard Purdie (cherry picked from commit b1c1b67166049181136d5eb68740f3bf98bf670d) Signed-off-by: Steve Sakoman

openssl: Fix SDK environment script to avoid unbound variable

2024-11-30T13:41:59+00:00

Avoid errors like: buildtools/sysroots/x86_64-pokysdk-linux/environment-setup.d/openssl.sh: line 6: BB_ENV_PASSTHROUGH_ADDITIONS: unbound variable by setting an explicit empty default value. (From OE-Core rev: a57192131cbcb65e17b11f47aa0f90ef63258280) Signed-off-by: Richard Purdie (cherry picked from commit 5a2a4910a22668f25679a47deaa9e2ed28665efa) Signed-off-by: Steve Sakoman

bluez: Fix mesh builds on musl

2024-10-29T12:51:03+00:00

When mesh is enabled on musl the build fails with conflicting basename calls. (From OE-Core rev: bab3e883cb770ef9fc28c002a98efd0ca5cbf60d) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie (cherry picked from commit 2db90c6508e350d35782db973291bbf5ffdfd3a5) Signed-off-by: Steve Sakoman

wpa-supplicant: Ignore CVE-2024-5290

2024-10-29T12:51:03+00:00

NVD CVE report [1] links Ubuntu bug [2] which has a very good description/discussion about this issue. It applies only to distros patching wpa-supplicant to allow non-root users (e.g. via netdev group) to load modules. This is not the case of Yocto. Quote: So upstream isn't vulnerable as they only expose the dbus interface to root. Downstreams like Ubuntu and Chromium added a patch that grants access to the netdev group. The patch is the problem, not the upstream code IMHO. There is also a commit [3] associated with this CVE, however that only provides build-time configuration to limit paths which can be accessed but it acts only as a mitigation for distros which allow non-root users to load crafted modules. The patch is included in version 2.11, however NVD has this CVE version-less, so explicit ignore is necessary. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-5290 [2] https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613 [3] https://w1.fi/cgit/hostap/commit/?id=c84388ee4c66bcd310db57489eac4a75fc600747 (From OE-Core rev: 617cf25b0f49b732f961f1fa4d1390e8e883f12b) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (cherry picked from commit 6cb794d44a8624784ec0f76dca764616d81ffbf5) Signed-off-by: Steve Sakoman

wpa-supplicant: add patch to check for kernel header version when compiling macsec

2024-09-17T11:16:01+00:00

When using Arm binary toolchain, version 2.11 of wpa-supplicant is failing to compile with the following error: | ../src/drivers/driver_macsec_linux.c:81:29: error: field ‘offload’ has incomplete type | 81 | enum macsec_offload offload; | | Backport a recent patch that corrects the issue by adding a check for the version of kernel headers being used in compilation and disabling that enum if too old a version is being used (or is used by the binary toolchain). (From OE-Core rev: 373d8d4f5316416d70eb2c0733d9838e57419ac3) Signed-off-by: Jon Mason Signed-off-by: Richard Purdie

bluez5: remove redundant patch for MAX_INPUT

2024-09-17T11:16:01+00:00

The solution to the problem upstream was fixed by the following commit: https://github.com/bluez/bluez/commit/ca6546fe521360fcf905bc115b893f322e706cb2 Now MAX_INPUT is defined for non-glibc systems such as musl. This fix was added in BlueZ 5.67. (From OE-Core rev: fea1bb917ebb1f99c83dbbc87a6f0ffc3627879a) Signed-off-by: Guðni Már Gilbert Signed-off-by: Richard Purdie

bind: Fix build with the `httpstats` package config enabled

2024-09-12T15:15:09+00:00

------C65ED3E1A5DE826CA595746785F6AF6F To: openembedded-core@lists.openembedded.org CC: Alban Bedel Subject: [PATCH] bind: Fix build with the `httpstats` package config enabled Date: Wed, 11 Sep 2024 08:26:47 +0200 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain MIME-Version: 1.0 When the `httpstats` package config is enabled configure fails with the error: > configure: error: Specifying libxml2 installation path is not > supported, adjust PKG_CONFIG_PATH instead Drop the explicit path from `--with-libxml2` to solve this issue. (From OE-Core rev: 9b076fa51f5e6fd685066fb817c47239960778e6) Signed-off-by: Alban Bedel Signed-off-by: Richard Purdie