linux/poky.git/meta/recipes-devtools/subversion, branch fido

subversion: fix CVE-2015-3187

2016-02-07T17:23:04+00:00

The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path. Patch is from: http://subversion.apache.org/security/CVE-2015-3187-advisory.txt (From OE-Core master rev: 6da25614edcad30fdb4bea8ff47b81ff81cdaed2) (From OE-Core rev: e1e277bf51c6f00268358f6bf8623261b1b9bc22) (From OE-Core rev: b45dcbadc1a51188ac6dead855e14a181a7bccd9) Signed-off-by: Wenzong Fan Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Robert Yang Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

subversion: fix CVE-2015-3184

2016-02-07T17:23:04+00:00

mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name. Patch is from: http://subversion.apache.org/security/CVE-2015-3184-advisory.txt (From OE-Core master rev: 29eb921ed074d86fa8d5b205a313eb3177473a63) (From OE-Core rev: 7af7a3e692a6cd0d92768024efe32bfa7d83bc8f) (From OE-Core rev: e4a1caecc5ae6b8488ec8ed7d303296af99146c0) Signed-off-by: Wenzong Fan Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Robert Yang Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

subversion: Fix subversion-native on Fedora22

2015-06-28T08:45:42+00:00

Similarly to: http://git.yoctoproject.org/cgit.cgi/poky/commit/?id=9b19d6548a345009a6de79a6820c07a72054d961 we also need to fix the subversion-native case with gcc5 by using the same fix to the BUILD_CPPFLAGS. (From OE-Core rev: a5e7a1e597e7bbe3bbc547f43a89d00a8a9a9924) (From OE-Core rev: 7d445547df528aa9e5bfb85568a7270e27f633ef) Signed-off-by: Richard Purdie

subversion: Add -P to CPPFLAGS

2015-06-28T08:45:42+00:00

see https://gcc.gnu.org/gcc-5/porting_to.html we need to stop the preprocessor from generating the #line directives or we run into issues like | checking for apr_int64_t Python/C API format string... | configure: error: failed to recognize APR_INT64_T_FMT on this platform | Configure failed. The contents of all config.log files follows to aid debugging | ERROR: oe_runconf failed Rightly subversion should be fixed but lets leave that to subversion folks Change-Id: I02a89798ff949f79967ab0a73adcddaa4218662d (From OE-Core rev: 7793b1c425077ed6ed11a9bc2a8b1b96612b1c96) (From OE-Core rev: a240d28492f05c22198dd4b20c11c0d510f0c897) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

subversion: 1.8.10 -> 1.8.11

2015-02-15T21:58:24+00:00

(From OE-Core rev: 6218b590e02afc346b473e62ee4e4624b677cacf) Signed-off-by: Richard Purdie

subversion 1.6.15: fix unknown-configure-option

2015-02-08T08:00:28+00:00

WARNING: QA Issue: subversion: configure was passed unrecognised options: --without-apache [unknown-configure-option] (From OE-Core rev: 49ad2ba8c2ffe57300b37e6bd0d9d25eb30a5449) Signed-off-by: Robert Yang Signed-off-by: Richard Purdie

subversion: 1.8.9 -> 1.8.10

2014-11-06T16:45:18+00:00

(From OE-Core rev: aa3aa6fff5b5e5b36b76665846e8b7f0408f7e81) Signed-off-by: Richard Purdie

subversion: Security Advisory - subversion - CVE-2014-3528

2014-11-04T10:27:08+00:00

Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3528 (From OE-Core rev: e0dc0432b13f38d16f642bdadf8ebc78b7a74806) Signed-off-by: Yue Tao Signed-off-by: Jackie Huang Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

subversion: Security Advisory - subversion - CVE-2014-3522

2014-11-04T10:27:07+00:00

The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.CWE-297: Improper Validation of Certificate with Host Mismatch http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3522 (From OE-Core rev: 06a33cd00ea11abec1ebe9d5883e44778075ccc6) Signed-off-by: Yue Tao Signed-off-by: Jackie Huang Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

subversion: Disable make install parallelism

2014-07-18T23:08:58+00:00

The Makefile generation for subversion is horrible, I can't figure out where the dependencies are missing, it looks like they might be missing everywhere. Give up and disable parallel make install. (From OE-Core rev: f5569d30b98418b201766ad07b177aac5fae4a41) Signed-off-by: Richard Purdie