linux/poky.git/meta/recipes-devtools, branch scarthgap-5.0.10

binutils: set CVE_STATUS for CVE-2025-1180

2025-06-02T14:12:34+00:00

CVE-2025-1180 is fixed with patch from CVE-2025-1176. More details about CVE is here: https://nvd.nist.gov/vuln/detail/CVE-2025-1179 (From OE-Core rev: 9c63f1c73426532a94f01fbbe26c9f52a3c4fdf7) Signed-off-by: Harish Sadineni Signed-off-by: Steve Sakoman

ruby: fix CVE-2025-27221

2025-06-02T14:12:34+00:00

In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. Reference: https://security-tracker.debian.org/tracker/CVE-2025-27221 Upstream-patches: https://github.com/ruby/uri/commit/3675494839112b64d5f082a9068237b277ed1495 https://github.com/ruby/uri/commit/2789182478f42ccbb62197f952eb730e4f02bfc5 (From OE-Core rev: 421d7011269f4750f5942b815d68f77fa4559d69) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

binutils: Fix CVE-2025-1179

2025-06-02T14:12:34+00:00

CVE-2025-1179-pre.patch is dependency patch for CVE-2025-1179.patch Upstream-Status: Submitted [https://sourceware.org/pipermail/binutils/2025-May/141322.html && https://sourceware.org/pipermail/binutils/2025-May/141321.html] CVE: CVE-2025-1179 cherry picked from upstream commit: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=67e30b15212adc1502b898a1ca224fdf65dc110d https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1d68a49ac5d71b648304f69af978fce0f4413800 (From OE-Core rev: 8f54548f784ef60eaf7fb6b3f539d48b0f7192a3) Signed-off-by: Harish Sadineni Signed-off-by: Steve Sakoman

binutils: Fix CVE-2025-1153

2025-05-27T16:38:57+00:00

PR 32603 [https://sourceware.org/bugzilla/show_bug.cgi?id=32603] Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=0b7f992b78fe0984fc7d84cc748d0794e4a400e3 && https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=31e9e2e8d1090da0c1da97a70005d8841fff8ddd && https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=fe459e33c676883b5f28cc96c00e242973d906a9] (From OE-Core rev: c8cb463ccee514935fe14544173c85001d66e60b) Signed-off-by: Sunil Dora Signed-off-by: Steve Sakoman

binutils: stable 2.42 branch updates

2025-05-08T20:37:30+00:00

Below commit on binutils-2.42 stable branch is updated. 6558f9f5f0c s390: Add support for z17 as CPU name Testing was done and there were no regressions found (From OE-Core rev: 08d6ca500e6dd571f5882f82f6ad804bd2eec8c8) Signed-off-by: Deepesh Varatharajan Signed-off-by: Steve Sakoman

elfutils: Fix CVE-2025-1371

2025-05-08T20:37:29+00:00

A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1371 https://ubuntu.com/security/CVE-2025-1371 Upstream patch: https://sourceware.org/cgit/elfutils/commit/?id=b38e562a4c907e08171c76b8b2def8464d5a104a (From OE-Core rev: 11c44bde4f3d9e63506ece2f9b27114914aacc4b) Signed-off-by: Soumya Sambu Signed-off-by: Steve Sakoman

buildtools-tarball: Make buildtools respects host CA certificates

2025-05-02T15:20:12+00:00

To adapt user network enviroment, buildtools should first try to use the user configured envs like SSL_CERT_FILE/CURL_CA_BUNDLE/..., if these envs is not set, then use the auto-detected ca file and ca path, and finally use the CA certificates in buildtools. nativesdk-openssl set OPENSSLDIR as "/not/builtin", need set SSL_CERT_FILE/SSL_CERT_DIR to work nativesdk-curl don't set default ca file, need SSL_CERT_FILE/SSL_CERT_DIR or CURL_CA_BUNDLE/CURL_CA_PATH to work nativesdk-git actually use libcurl, and GIT_SSL_CAPATH/GIT_SSL_CAINFO also works nativesdk-python3-requests will use cacert.pem under python module certifi by default, need to set REQUESTS_CA_BUNDLE (From OE-Core rev: 0653b96bac6d0800dc5154557706a323418808be) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

buildtools-tarball: add envvars into BB_ENV_PASSTHROUGH_ADDITIONS

2025-05-02T15:20:12+00:00

Here is one testcase: For recipe tensorflow-lite-host-tools_2.18.0.bb, refer [1], do_configure[network] = "1" and it will git clone some repos in CMakeLists.txt When buildtools is used and nativesdk-git is installed into sdk, do_configure failed with error: [1/9] Performing download step (git clone) for 'protobuf-populate' Cloning into 'protobuf'... fatal: unable to access 'https://github.com/protocolbuffers/protobuf/': error setting certificate file: /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-wrlinuxsdk-linux/etc/ssl/certs/ca-certificates.crt Fix by adding GIT_SSL_CAINFO in BB_ENV_PASSTHROUGH_ADDITIONS, so that user can export GIT_SSL_CAINFO=${GIT_SSL_CAINFO} in their do_configure:prepend() to fix above do_configure failure CURL_CA_BUNDLE and REQUESTS_CA_BUNDLE is similar envvars, so all add into BB_ENV_PASSTHROUGH_ADDITIONS [1] https://github.com/nxp-imx/meta-imx/blob/styhead-6.12.3-1.0.0/meta-imx-ml/recipes-libraries/tensorflow-lite/tensorflow-lite-host-tools_2.18.0.bb (From OE-Core rev: 27f018d8e8ace97d0b1cdfb8782a2a7a0a319816) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

buildtools-tarball: move setting of envvars to respective envfile

2025-05-02T15:20:12+00:00

* make git,curl,python3-requests align with openssl, move the setting of envvars into respective envfile * for environment.d-openssl.sh, also check if ca-certificates.crt exist before export envvars (From OE-Core rev: 5f4fd544d3df7365224599c9efdce4e545f51d5e) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

perl: upgrade 5.38.2 -> 5.38.4

2025-05-02T15:20:12+00:00

update include fix for CVE-2024-56406 https://perldoc.perl.org/5.38.4/perl5384delta (From OE-Core rev: a9edffbd3c129966d4028505940ae6286273f399) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman