linux/poky.git/meta/recipes-devtools/git, branch dunfell-23.0.24

git: Security fix for CVE-2022-41903

2023-03-14T14:59:10+00:00

Upstream-Status: Backport from https://github.com/git/git/commit/a244dc5b & https://github.com/git/git/commit/81dc898d & https://github.com/git/git/commit/b49f309a & https://github.com/git/git/commit/f6e0b9f3 & https://github.com/git/git/commit/1de69c0c & https://github.com/git/git/commit/48050c42 & https://github.com/git/git/commit/522cc87f & https://github.com/git/git/commit/17d23e8a & https://github.com/git/git/commit/937b71cc & https://github.com/git/git/commit/81c2d4c3 & https://github.com/git/git/commit/f930a239 & https://github.com/git/git/commit/304a50ad (From OE-Core rev: d591ac4dfeff7b69086a47c7e88a8127f1d31299) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: ignore CVE-2022-41953

2023-02-24T16:41:42+00:00

This is specific to Git-for-Windows. (From OE-Core rev: dfb042a6159d128aa4ee8d899c447cf33a2be7ae) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit c8849af809e0213d43e18e5d01067eeeb61b330d) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: CVE-2022-23521 gitattributes parsing integer overflow

2023-02-24T16:41:42+00:00

Backport from: https://github.com/git/git/commit/eb22e7dfa23da6bd9aed9bd1dad69e1e8e167d24 https://github.com/git/git/commit/8d0d48cf2157cfb914db1f53b3fe40785b86f3aa https://github.com/git/git/commit/24557209500e6ed618f04a8795a111a0c491a29c https://github.com/git/git/commit/34ace8bad02bb14ecc5b631f7e3daaa7a9bba7d9 https://github.com/git/git/commit/447ac906e189535e77dcb1f4bbe3f1bc917d4c12 https://github.com/git/git/commit/e1e12e97ac73ded85f7d000da1063a774b3cc14f https://github.com/git/git/commit/a60a66e409c265b2944f18bf43581c146812586d https://github.com/git/git/commit/d74b1fd54fdbc45966d12ea907dece11e072fb2b https://github.com/git/git/commit/dfa6b32b5e599d97448337ed4fc18dd50c90758f https://github.com/git/git/commit/3c50032ff5289cc45659f21949c8d09e52164579 (From OE-Core rev: 4f4baa56656291b259b9474a3637cf31f6569ff3) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: Use CVE_CHECK_WHITELIST instead of CVE_CHECK_IGNORE

2022-05-20T09:08:01+00:00

Use CVE_CHECK_WHITELIST as CVE_CHECK_IGNORE is not valid on dunfell branch (From OE-Core rev: 970743af349e21a399da6241587b849b14933bc5) Signed-off-by: Ranjitsinh Rathod Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git update from 2.24.3 to 2.24.4

2022-04-22T22:39:12+00:00

Security release, fixes CVE-2021-21300, so remove that patch. 22539ec3b5 unpack_trees(): start with a fresh lstat cache 0d58fef58a run-command: invalidate lstat cache after a command finished 684dd4c2b4 checkout: fix bug that makes checkout follow symlinks in leading path (From OE-Core rev: 8606d99041c3c1a002b2300c59afc116050c73cc) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: Ignore CVE-2022-24975

2022-04-21T20:26:01+00:00

Everyone I've talked to doesn't see this as a major issue. The CVE asks for a documentation improvement on the --mirror option to git clone as deleted content could be leaked into a mirror. For OE's general users/use cases, we wouldn't build or ship docs so this wouldn't affect us. (From OE-Core rev: f35500a442d6a4564d52e23f9602a3f90a4ceee5) Signed-off-by: Richard Purdie (cherry picked from commit 5dfe2dd5482c9a446f8e722fe51903d205e6770d) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: fix CVE-2021-40330

2021-12-02T16:53:07+00:00

git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring. Upstream-Status: Backport [https://github.com/git/git/commit/a02ea577174ab8ed18f847cf1693f213e0b9c473] CVE: CVE-2021-40330 (From OE-Core rev: ea0d7ef4a8c9bba94bd603ebd19e502faa86293b) Signed-off-by: Minjae Kim Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: Fix determinism issue

2021-11-03T11:18:56+00:00

(From OE-Core rev: 3b517d9e05d95c4a2ceb50f4bc07205f1b8f1e14) Signed-off-by: Richard Purdie (cherry picked from commit 9ae740939f8315c64fe7571f912404127a29dc89) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: fix CVE-2021-21300

2021-04-06T21:45:36+00:00

checkout: fix bug that makes checkout follow symlinks in leading path Upstream-Status: Acepted [https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592] CVE: CVE-2021-21300 (From OE-Core rev: 8293d5d1529629bd13028bdde1fa99da30313bac) Signed-off-by: Minjae Kim Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

meta/recipes-devtools: Add HOMEPAGE / DESCRIPTION

2021-03-10T00:22:51+00:00

Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage [YOCTO #13471] (From OE-Core rev: bd3352880322598b0ba6dc439ff08c2e4c592e36) Signed-off-by: Dorinda Bassey Signed-off-by: Richard Purdie (cherry picked from commit bb05814335e7101bfd8df0a11dc18a044e867bed) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie