Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=yocto-4.0.8 2023-02-15T21:46:55+00:00 2023-02-15T21:46:55+00:00 Arnout Vandecappelle arnout@mind.be 2023-02-02T12:49:53+00:00 urn:sha1:ad8526235122634fa48beee847bc6a5f93b92970 Since version 7.0.0 [1], pytest switched from the toml package to the tomli package for parsing pyproject.toml configuration files [2]. This change is not immediately noticable during tests, because the toml/tomli module is only important if a pyproject.toml is actually present in a project. [1] https://docs.pytest.org/en/latest/changelog.html#pytest-7-0-0rc1-2021-12-06 [2] https://github.com/pytest-dev/pytest/issues/8789 (From OE-Core rev: e5e590ed9e118283ad67bcfb059b3375cf847b33) Signed-off-by: Arnout Vandecappelle <arnout@mind.be> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-02-15T21:46:55+00:00 Narpat Mali narpat.mali@windriver.com 2023-02-02T18:05:19+00:00 urn:sha1:8809530bb0da750ae5e63505931eb2aa0543123b Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion. Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-23491 (From OE-Core rev: 8ee4adb8675c690962e5820669098a95f74c07c7) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-01-26T23:37:05+00:00 Narpat Mali narpat.mali@windriver.com 2023-01-12T14:58:37+00:00 urn:sha1:07213601fd865e698b4f7f6bd61d824e9d8181d2 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. CVE: CVE-2022-24439 Upstream-Status: Backport Reference: https://github.com/gitpython-developers/GitPython/discussions/1529 https://github.com/gitpython-developers/GitPython/pull/1518 https://github.com/gitpython-developers/GitPython/pull/1521 (From OE-Core rev: 55f93e3786290dfa5ac72b5969bb2793f6a98bde) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-01-26T23:37:05+00:00 Narpat Mali narpat.mali@windriver.com 2023-01-12T14:55:32+00:00 urn:sha1:fd36d262b86192bbc547f9a1e7aada5e94dccb8d An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. CVE: CVE-2022-40898 Upstream-Status: Backport [https://github.com/pypa/wheel/commit/88f02bc335d5404991e532e7f3b0fc80437bf4e0] (From OE-Core rev: 0974291e545aec68755dfb634c75dca37cca1ea9) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-01-26T23:37:05+00:00 Narpat Mali narpat.mali@windriver.com 2023-01-10T08:18:05+00:00 urn:sha1:92b150b9f3f006542c869543b95ceb46986e5416 Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. CVE: CVE-2022-40897 Upstream-Status: Backport [https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be] (From OE-Core rev: f574d8d57ff3fbc38e350e7a90913993081c4fdf) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-12-23T23:05:50+00:00 Florin Diaconescu florin.diaconescu009@gmail.com 2022-12-15T11:42:55+00:00 urn:sha1:c4bbc6d9c5077b26d6d8e48aa47927b3cbb023e0 Security and bug fixes. Drop patch for CVE-2022-42919 and CVE-2022-37454 which were merged in 3.10.9 Fixes: * CVE-2022-45061 (gh-98433) https://nvd.nist.gov/vuln/detail/CVE-2022-45061 List of changes: https://docs.python.org/3.10/whatsnew/changelog.html#python-3-10-9-final (From OE-Core rev: f98b9c71686eb5ce5115ee73155a7d0389831ef0) Signed-off-by: Florin Diaconescu <florin.diaconescu009@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-12-13T15:23:34+00:00 Joe Slater joe.slater@windriver.com 2022-12-07T22:55:03+00:00 urn:sha1:eea9ca003fdc971dc13b545c4b7949f06e1beae8 Fixes CVE-2022-37460. Also add patch to fix CVE-2022-37454. (From OE-Core rev: b446dd69b79783ea232514e1c5212595ec28e553) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-12-01T19:35:04+00:00 Vivek Kumbhar vkumbhar@mvista.com 2022-11-24T12:28:13+00:00 urn:sha1:9510218414f822d1d5fd4b8417137d8ef1de81ff Upstream-Status: Backport from https://github.com/python/cpython/commit/eae692eed18892309bcc25a2c0f8980038305ea2 (From OE-Core rev: 9ed7184930707c98afabca8c6b712df874ad659f) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-11-24T15:30:01+00:00 Leon Anavi leon.anavi@konsulko.com 2022-11-02T19:18:00+00:00 urn:sha1:f9679ac9f89d371c1934ccb319eb3c3eae33d61d Check if the module object has attribute '__file__' to fix and avoid errors like: AttributeError: module '_abc' has no attribute '__file__'. Did you mean: '__name__'? (From OE-Core rev: 1684457df9fb7029a276df4438c8fc4a17e3e1e9) Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 8acce12c1a4cf37ac312c92d62a6ae93a349dddf) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2022-11-20T08:19:17+00:00 Narpat Mali narpat.mali@windriver.com 2022-11-10T14:18:06+00:00 urn:sha1:848be11a4390bd39323c9feaf2fe880e2b41f99c Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin. Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-40023 Reference to Upstream Patch: https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c (From OE-Core rev: 34727812b54fd52f85806f4f95702286d551b5fd) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>