linux/poky.git/meta/recipes-connectivity, branch yocto-3.1.20

bind: Fix CVEs 2022-2795, 2022-38177, 2022-38178

2022-10-05T07:39:19+00:00

(From OE-Core rev: 9632481dc14868c0f92572472834a2a0c4f46e2e) Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bluez: CVE-2022-39176 BlueZ allows physically proximate attackers

2022-09-30T15:34:52+00:00

Source: https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/1977968 MR: 122140 Type: Security Fix Disposition: Backport from https://launchpad.net/ubuntu/+source/bluez/5.53-0ubuntu3.6 ChangeID: b989c7670a9b2bd1d11221e981eab0d162f3271c Description: CVE-2022-39176 bluez: BlueZ allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len. Affects "bluez < 5.59" (From OE-Core rev: 3750b576035d87633c69c0a5fc6de4854179f9b0) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

inetutils: CVE-2022-39028 - fix remote DoS vulnerability in inetutils-telnetd

2022-09-30T15:34:52+00:00

Fix telnetd crash if the first two bytes of a new connection are 0xff 0xf7 (IAC EC) or 0xff 0xf8 (IAC EL). CVE: CVE-2022-39028 (From OE-Core rev: 1c385e70d4bfab2334361ba82f29988bb11d6902) Signed-off-by:Minjae Kim Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

connman: CVE-2022-32293 man-in-the-middle attack against a WISPR HTTP

2022-09-23T15:22:59+00:00

Source: https://git.kernel.org/pub/scm/network/connman/connman.git/ MR: 120508 Type: Security Fix Disposition: Backport from https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=72343929836de80727a27d6744c869dff045757c && https://git.kernel.org/pub/scm/network/connman/connman.git/commit/src/wispr.c?id=416bfaff988882c553c672e5bfc2d4f648d29e8a ChangeID: 1583badc6de6bb8a7f63c06749b90b97caab5cdf Description: CVE-2022-32293 connman: man-in-the-middle attack against a WISPR HTTP. (From OE-Core rev: 86334559e3dcf30e07e2a10a58bbe40a2e8cc887) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

connman: fix CVE-2022-32292

2022-09-16T16:53:28+00:00

(From OE-Core rev: 380b6fb2583f875aad0cb28c91b1531e63eb2eeb) Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

mobile-broadband-provider-info: upgrade 20220511 -> 20220725

2022-09-03T12:10:37+00:00

(From OE-Core rev: 5dd5130f9b13212a4f5e8b075ae1ecda868c5f28) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 96185dac787e14fa9eb77d009653a2fd4d926e3f) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

openssh: Add openssh-sftp-server to openssh RDEPENDS

2022-08-18T16:52:23+00:00

OpenSSH 9.0 uses sftp by default as the transport for scp, add in sftp-server so that this works as expected for users, rather than being left with a confusing "scp: Connection closed" message. (From OE-Core rev: 788e2c6bccc58e5a88b33fa91ea3c3ffec7611ca) Signed-off-by: Alex Kiernan Signed-off-by: Alex Kiernan Signed-off-by: Richard Purdie (cherry picked from commit be61b9dac78f0d85c870a0d8304fb4b536ec4bc8) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

openssl: security upgrade 1.1.1p to 1.1.1q

2022-07-16T05:52:48+00:00

Fixed AES OCB failure to encrypt some bytes on 32-bit x86 platforms (CVE-2022-2097) (From OE-Core rev: 6031eecee8ac8bed1c43a04ecf06ed08014346f2) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

openssh: break dependency on base package for -dev package

2022-07-15T11:29:17+00:00

Otherwise the SDK fails to build as the main openssh and dropbear packages conflict with each other (From OE-Core rev: e863fc060940d11cd6fd58f0f314333ed419cf54) Signed-off-by: Steve Sakoman (cherry picked from commit f90647e9dd95cfd29b5bdb8d7dcd688a10fc060c) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

openssl: Minor security upgrade 1.1.1o to 1.1.1p

2022-07-15T11:29:17+00:00

This security upgrade fixes CVE-2022-2068 as per below link Link: https://www.openssl.org/news/cl111.txt Also, remove 73db5d82489b3ec09ccc772dfcee14fef0e8e908.patch and b7ce611887cfac633aacc052b2e71a7f195418b8.patch as these two are part 1.1.1p now (From OE-Core rev: a8283f9251f59d86f93f9d7cfd4c7e29c61e4631) Signed-off-by: Ranjitsinh Rathod Signed-off-by: Ranjitsinh Rathod Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie