linux/poky.git/meta/recipes-connectivity, branch yocto-3.1.31

bluez5: fix CVE-2023-45866

2023-12-29T15:29:14+00:00

Upstream-Status: Backport from https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=25a471a83e02e1effb15d5a488b3f0085eaeb675 (From OE-Core rev: 1df2bdf370346dac70451159adf1ae85d1a2dacd) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman

openssh: backport Debian patch for CVE-2023-48795

2023-12-29T15:29:14+00:00

import patches from ubuntu to fix CVE-2023-48795 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/openssh/tree/debian/patches?h=ubuntu%2Ffocal-security Upstream commit https://github.com/openssh/openssh-portable/commit/1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5] Reference: https://ubuntu.com/security/CVE-2023-48795 (From OE-Core rev: 4026a1cc3aa242a80c306b34b030f05d41b55dda) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

avahi: backport Debian patches to fix multiple CVE's

2023-12-01T14:14:19+00:00

import patches from ubuntu to fix CVE-2023-1981 CVE-2023-38469 CVE-2023-38470 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches?h=ubuntu/focal-security Upstream commit https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f & https://github.com/lathiat/avahi/commit/a337a1ba7d15853fb56deef1f464529af6e3a1cf & https://github.com/lathiat/avahi/commit/c6cab87df290448a63323c8ca759baa516166237 & https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c & https://github.com/lathiat/avahi/commit/20dec84b2480821704258bc908e7b2bd2e883b24 & https://github.com/lathiat/avahi/commit/894f085f402e023a98cbb6f5a3d117bd88d93b09 & https://github.com/lathiat/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460 & https://github.com/lathiat/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40 & https://github.com/lathiat/avahi/commit/b448c9f771bada14ae8de175695a9729f8646797] (From OE-Core rev: 4771e335cd4d95e734d7f07a718319f4543ce2f1) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

bind: Backport fix for CVE-2023-3341

2023-12-01T14:14:19+00:00

Upstream-Status: Backport [https://gitlab.isc.org/isc-projects/bind9/-/commit/c4fac5ca98efd02fbaef43601627c7a3a09f5a71] (From OE-Core rev: e0fbe202981c9074547881dbeb7eb58670808fc3) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

resolvconf: Fix fetch error

2023-11-17T16:00:32+00:00

Branch 'master' renamed to 'unstable', which causing following failure. Error: Fetcher failure: Unable to find revision cb19bbfbe7e52174332f68bf2f295b39d119fad3 in branch master even from upstream Switch to 'unstanble' branch. (From OE-Core rev: d4b96dc1e457b4e68c5bad685ffcfd2f250162e7) Signed-off-by: Naveen Saini Signed-off-by: Steve Sakoman

openssl: Upgrade 1.1.1v -> 1.1.1w

2023-10-13T15:47:07+00:00

https://www.openssl.org/news/openssl-1.1.1-notes.html Major changes between OpenSSL 1.1.1v and OpenSSL 1.1.1w [11 Sep 2023] * Fix POLY1305 MAC implementation corrupting XMM registers on Windows (CVE-2023-4807) (From OE-Core rev: 79b29a5f77efab978f6a2918d02ee611638aef85) Signed-off-by: Sourav Kumar Pramanik Signed-off-by: Steve Sakoman

openssh: Securiry fix for CVE-2023-38408

2023-09-15T13:47:11+00:00

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. References: https://nvd.nist.gov/vuln/detail/CVE-2023-38408 Upstream patches: https://github.com/openssh/openssh-portable/commit/dee22129, https://github.com/openssh/openssh-portable/commit/099cdf59, https://github.com/openssh/openssh-portable/commit/29ef8a04, https://github.com/openssh/openssh-portable/commit/892506b1, https://github.com/openssh/openssh-portable/commit/0c111eb8, https://github.com/openssh/openssh-portable/commit/52a03e9f, https://github.com/openssh/openssh-portable/commit/1fe16fd6, https://github.com/openssh/openssh-portable/commit/e0e8bee8, https://github.com/openssh/openssh-portable/commit/8afaa7d7, https://github.com/openssh/openssh-portable/commit/1a4b9275, https://github.com/openssh/openssh-portable/commit/4c1e3ce8, https://github.com/openssh/openssh-portable/commit/1f2731f5. (From OE-Core rev: 9242b8218858d2bebb3235929fea7e7235cd40f3) Signed-off-by: Shubham Kulkarni Signed-off-by: Steve Sakoman

bind: Backport fix for CVE-2023-2828

2023-09-15T13:47:11+00:00

Upstream Patch: https://downloads.isc.org/isc/bind9/9.16.42/patches/0001-CVE-2023-2828.patch LINK: https://security-tracker.debian.org/tracker/CVE-2023-2828 (From OE-Core rev: 1b9d661a82211d6ffdd56e366cfbc3f3c247fd1c) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

inetutils: Backport fix for CVE-2023-40303

2023-09-07T14:57:25+00:00

Upstream-commit: https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=e4e65c03f4c11292a3e40ef72ca3f194c8bffdd6 & https://git.savannah.gnu.org/cgit/inetutils.git/commit/?id=9122999252c7e21eb7774de11d539748e7bdf46d (From OE-Core rev: 57f6d8548e778712eb11507e889f3eadf3732041) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

openssl: Upgrade 1.1.1t -> 1.1.1v

2023-08-16T13:55:13+00:00

https://www.openssl.org/news/openssl-1.1.1-notes.html Major changes between OpenSSL 1.1.1u and OpenSSL 1.1.1v [1 Aug 2023] * Fix excessive time spent checking DH q parameter value (CVE-2023-3817) * Fix DH_check() excessive time with over sized modulus (CVE-2023-3446) Major changes between OpenSSL 1.1.1t and OpenSSL 1.1.1u [30 May 2023] * Mitigate for very slow `OBJ_obj2txt()` performance with gigantic OBJECT IDENTIFIER sub-identities. (CVE-2023-2650) * Fixed documentation of X509_VERIFY_PARAM_add0_policy() (CVE-2023-0466) * Fixed handling of invalid certificate policies in leaf certificates (CVE-2023-0465) * Limited the number of nodes created in a policy tree ([CVE-2023-0464]) All CVEs for upgrade to 1.1.1u were already patched, so effectively this will apply patches for CVE-2023-3446 and CVE-2023-3817 plus several non-CVE fixes. Because of mips build changes were backported to openssl 1.1.1 branch, backport of a patch from kirkstone is necessary. (From OE-Core rev: be5d49d86553769deaf4754969d2cf6931d6ac34) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman