Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=yocto-4.0.7 2023-01-26T23:37:05+00:00 2023-01-26T23:37:05+00:00 Narpat Mali narpat.mali@windriver.com 2023-01-12T14:58:37+00:00 urn:sha1:07213601fd865e698b4f7f6bd61d824e9d8181d2 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. CVE: CVE-2022-24439 Upstream-Status: Backport Reference: https://github.com/gitpython-developers/GitPython/discussions/1529 https://github.com/gitpython-developers/GitPython/pull/1518 https://github.com/gitpython-developers/GitPython/pull/1521 (From OE-Core rev: 55f93e3786290dfa5ac72b5969bb2793f6a98bde) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-01-26T23:37:05+00:00 Narpat Mali narpat.mali@windriver.com 2023-01-12T14:55:32+00:00 urn:sha1:fd36d262b86192bbc547f9a1e7aada5e94dccb8d An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. CVE: CVE-2022-40898 Upstream-Status: Backport [https://github.com/pypa/wheel/commit/88f02bc335d5404991e532e7f3b0fc80437bf4e0] (From OE-Core rev: 0974291e545aec68755dfb634c75dca37cca1ea9) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-01-26T23:37:05+00:00 Narpat Mali narpat.mali@windriver.com 2023-01-10T08:18:05+00:00 urn:sha1:92b150b9f3f006542c869543b95ceb46986e5416 Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. CVE: CVE-2022-40897 Upstream-Status: Backport [https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be] (From OE-Core rev: f574d8d57ff3fbc38e350e7a90913993081c4fdf) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-12-23T23:05:50+00:00 Florin Diaconescu florin.diaconescu009@gmail.com 2022-12-15T11:42:55+00:00 urn:sha1:c4bbc6d9c5077b26d6d8e48aa47927b3cbb023e0 Security and bug fixes. Drop patch for CVE-2022-42919 and CVE-2022-37454 which were merged in 3.10.9 Fixes: * CVE-2022-45061 (gh-98433) https://nvd.nist.gov/vuln/detail/CVE-2022-45061 List of changes: https://docs.python.org/3.10/whatsnew/changelog.html#python-3-10-9-final (From OE-Core rev: f98b9c71686eb5ce5115ee73155a7d0389831ef0) Signed-off-by: Florin Diaconescu <florin.diaconescu009@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-12-13T15:23:34+00:00 Joe Slater joe.slater@windriver.com 2022-12-07T22:55:03+00:00 urn:sha1:eea9ca003fdc971dc13b545c4b7949f06e1beae8 Fixes CVE-2022-37460. Also add patch to fix CVE-2022-37454. (From OE-Core rev: b446dd69b79783ea232514e1c5212595ec28e553) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-12-01T19:35:04+00:00 Vivek Kumbhar vkumbhar@mvista.com 2022-11-24T12:28:13+00:00 urn:sha1:9510218414f822d1d5fd4b8417137d8ef1de81ff Upstream-Status: Backport from https://github.com/python/cpython/commit/eae692eed18892309bcc25a2c0f8980038305ea2 (From OE-Core rev: 9ed7184930707c98afabca8c6b712df874ad659f) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-11-24T15:30:01+00:00 Leon Anavi leon.anavi@konsulko.com 2022-11-02T19:18:00+00:00 urn:sha1:f9679ac9f89d371c1934ccb319eb3c3eae33d61d Check if the module object has attribute '__file__' to fix and avoid errors like: AttributeError: module '_abc' has no attribute '__file__'. Did you mean: '__name__'? (From OE-Core rev: 1684457df9fb7029a276df4438c8fc4a17e3e1e9) Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 8acce12c1a4cf37ac312c92d62a6ae93a349dddf) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-11-20T08:19:17+00:00 Narpat Mali narpat.mali@windriver.com 2022-11-10T14:18:06+00:00 urn:sha1:848be11a4390bd39323c9feaf2fe880e2b41f99c Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin. Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-40023 Reference to Upstream Patch: https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c (From OE-Core rev: 34727812b54fd52f85806f4f95702286d551b5fd) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-10-20T14:36:02+00:00 Tim Orling ticotimo@gmail.com 2022-10-11T19:56:01+00:00 urn:sha1:6a3c3653323309c3a0cd4747bbc01227718bd1c9 Security and bug fixes. Drop patch for gh-92036 which was merged in 3.10.5 Refresh 0017-setup.py-do-not-report-missing-dependencies-for-disa.pathc Fixes: * CVE-2020-10735 https://nvd.nist.gov/vuln/detail/CVE-2020-10735 * CVE-2021-28861 https://nvd.nist.gov/vuln/detail/CVE-2021-28861 * CVE-2018-25032 https://nvd.nist.gov/vuln/detail/CVE-2018-25032 For a list of changes see: https://docs.python.org/3.10/whatsnew/changelog.html#python-3-10-7-final https://docs.python.org/3.10/whatsnew/changelog.html#python-3-10-6-final https://docs.python.org/3.10/whatsnew/changelog.html#python-3-10-6-final (From OE-Core rev: 3efae85283b19fa1b30af7fed7fa89d7a50337db) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-09-28T07:02:11+00:00 Mikko Rapeli mikko.rapeli@linaro.org 2022-09-19T14:23:07+00:00 urn:sha1:3842e222e9b6b653d298b8cdcbbc6a61e69ffc8e The :append can not be removed via bbappends if needed. Thus it's better for open source layers to use += append if possible. (From OE-Core rev: 1e09be9455fb054b3f74f088b355116828cb4626) (From OE-Core rev: 15ac2f4f2873a3c7b9f5bd0385d570e7b64fc643) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4546b5186e5aa2808be6c1616eca15219c4fcb5d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>