Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=kirkstone-4.0.28 2024-03-25T14:11:25+00:00 2024-03-25T14:11:25+00:00 Vijay Anusuri vanusuri@mvista.com 2024-03-19T12:32:09+00:00 urn:sha1:6269fbcd4fa38b2e81f695cf84d8ae2b19afad58 Upstream-Status: Backport from https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55 (From OE-Core rev: 7864c4605cde4851df644dd1d2867bd28d155710) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-12-12T14:20:34+00:00 Narpat Mali narpat.mali@windriver.com 2023-12-06T08:59:00+00:00 urn:sha1:31507dd07a36234b888759bab256644446b85ff3 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49083 https://security-tracker.debian.org/tracker/CVE-2023-49083 (From OE-Core rev: 2d104f78cd13a10640bc284c7fc8358bf305279c) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-05-10T14:19:56+00:00 Narpat Mali narpat.mali@windriver.com 2023-05-05T16:53:53+00:00 urn:sha1:1367249c996394668eaf97404874d7d13225a53d cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8. (From OE-Core rev: 368e450c2d800790a05924519f34c579e28e9cbb) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2022-04-10T07:31:17+00:00 Ross Burton ross@burtonini.com 2022-04-08T13:38:21+00:00 urn:sha1:8b4a654641761298db1f47a8203fe12604382d13 The leaking test case has been fixed upstream, so backport the patch. (From OE-Core rev: 4705b8a724fe288a20f1a080e2796ea90f46c9fb) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-03-18T23:32:46+00:00 Ross Burton ross@burtonini.com 2022-03-17T16:44:34+00:00 urn:sha1:74d783fd799bc9070d2d9d0e479361b25ba5634d python3-cryptography and python3-cryptography-vectors are actually the same project but are on Pypi as two separate modules. The test suite validates that they're the same version and fails if they are not: FAIL: tests/test_utils.py::test_vector_version def test_vector_version(): > assert cryptography.__version__ == cryptography_vectors.__version__ E AssertionError: assert '36.0.2' == '36.0.1' Catch this slightly earlier by mandating that python3-cryptography-ptest pulls in an identically versioned python3-cryptography-vectors. (From OE-Core rev: 7c098aac08faf5da01aafec5c5d87f563d913744) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-03-18T23:32:46+00:00 Khem Raj raj.khem@gmail.com 2022-03-16T22:25:26+00:00 urn:sha1:69b4cbdf05f0c965adc65c89e24f229966e839a1 (From OE-Core rev: 3acf088edec6e328f4e25ddd741f967368ae5ae0) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>