Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=yocto-4.0.10 2023-01-26T23:37:05+00:00 2023-01-26T23:37:05+00:00 Narpat Mali narpat.mali@windriver.com 2023-01-12T14:58:37+00:00 urn:sha1:07213601fd865e698b4f7f6bd61d824e9d8181d2 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. CVE: CVE-2022-24439 Upstream-Status: Backport Reference: https://github.com/gitpython-developers/GitPython/discussions/1529 https://github.com/gitpython-developers/GitPython/pull/1518 https://github.com/gitpython-developers/GitPython/pull/1521 (From OE-Core rev: 55f93e3786290dfa5ac72b5969bb2793f6a98bde) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-03-20T00:02:22+00:00 Ross Burton ross@burtonini.com 2022-03-18T14:30:33+00:00 urn:sha1:e5ab3817aa98846c0a1c6d23feb47ff9404b0b90 Rename this class to be python-prefixed to match the other new Python build system classes. (From OE-Core rev: 25d6bf8079797906bde7c0cf63a0466c981ba5bb) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-02-27T12:34:40+00:00 wangmy wangmy@fujitsu.com 2022-02-23T07:44:55+00:00 urn:sha1:f74327157c1c86778da28d3bdf0447cbcd98f354 Changelog: ========= -Reduced startup time due to optimized imports. -Fix a vulenerability that could cause great slowdowns when encountering long remote path names when pulling/fetching. (From OE-Core rev: 3cb7f09392f1e43fec1c490cdee8bcdf581b1489) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>