Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=mickledore 2023-08-01T16:17:27+00:00 2023-08-01T16:17:27+00:00 Mingli Yu mingli.yu@windriver.com 2023-07-27T08:25:41+00:00 urn:sha1:452cc7b484b80df5bb88171d1c59aeb7c8b4dc49 Backport two patches [1] [2] to fix CVE-2023-36617 [3]. [1] https://github.com/ruby/uri/commit/9010ee2536adda10a0555ae1ed6fe2f5808e6bf1 [2] https://github.com/ruby/uri/commit/9d7bcef1e6ad23c9c6e4932f297fb737888144c8 [3] https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/ (From OE-Core rev: 403a24f02600e2462e8ccfbb42651e15e002bd2e) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-05-10T14:16:51+00:00 Wang Mingyu wangmy@fujitsu.com 2023-04-10T09:01:54+00:00 urn:sha1:e37179d270dd8afab8eeb610871d13a00d7949f5 Ruby 3.1.2 CVE-2022-28738: Double free in Regexp compilation.. CVE-2022-28739: Buffer overrun in String-to-Float conversion.. (From OE-Core rev: f1741f1b2fe10d62331a11df6bbd312ae71bffa5) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit b261bc704839b12769118f6f1c4207f3d19fe4fd) Signed-off-by: Steve Sakoman <steve@sakoman.com>