linux/poky.git/meta/recipes-devtools, branch yocto-3.1.11

go: Several Security fixes

2021-09-14T16:27:42+00:00

Source: golang.org MR: 111958, 112390, 112393 Type: Security Fix Disposition: Backport from https://github.com/golang/go.git ChangeID: 662d021814f025b3d768a04864498486f94819a7 Description: Affects < 1.16.5 Fixes: CVE-2021-33196 CVE-2021-33197 CVE-2021-34558 (From OE-Core rev: 1eaac89b0384cc39ea489a3b7ea58eab6b23240b) Signed-off-by: Armin Kuster Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

go: Exclude CVE-2021-29923 from report list

2021-09-14T16:27:42+00:00

Upstream don't believe it is a signifiant real world issue and will only fix in 1.17 onwards. Therefore exclude it from our reports. https://github.com/golang/go/issues/30999#issuecomment-910470358 (From OE-Core rev: 9dfc6abbb83f8792fbfa1acb9c0fe4ab23872d8f) Signed-off-by: Richard Purdie (cherry picked from commit 5bd5faf0c34b47b2443975d66b71482d2380a01a) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

flex: Add CVE-2019-6293 to exclusions for checks

2021-09-14T16:27:42+00:00

CVE is effectively disputed - yes there is stack exhaustion but no bug and it is building the parser, not running it, effectively similar to a compiler ICE. Upstream no plans to address and there is no security issue. https://github.com/westes/flex/issues/414 (From OE-Core rev: b939b005b06be58a276d565f755ee2d8f3e5dfc1) Signed-off-by: Richard Purdie (cherry picked from commit 0cae5d7a24bedf6784781b62cbb3795a44bab4d1) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

mklibs-native: drop deprecated cpp17 exceptions

2021-09-01T15:27:09+00:00

gcc11 has -std=gnu++17 as default. Remove deprecated C++17 exceptions based on http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2016/p0003r5.html. (From OE-Core rev: ef8b7946b4793db653ef7dd716e1d3f919a84725) Signed-off-by: Andrej Valek Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

tcf-agent: fetching over git:// no longer works

2021-09-01T15:27:09+00:00

(From OE-Core rev: 419503134b76abeb57727259f846a2394dc73ea5) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie (cherry picked from commit 44a6cd03721b51cbb4e05870375fa347527b0db5) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

binutils: Security fix for CVE-2020-16593

2021-09-01T15:27:09+00:00

Source: https://sourceware.org/git/binutils-gdb.git MR: 112801 Type: Security Fix Disposition: Backport from https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=aec72fda3b320c36eb99fc1c4cf95b10fc026729 ChangeID: 470b309f4859eecdcc837add2bf756484ad94ee5 Description: Fixed up for 2.34 context (From OE-Core rev: bcaa13d8888416b01f0f590d9dab2bd736d1e8a8) Signed-off-by: Armin Kuster Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

binutils: Security fix for CVE-2021-3549

2021-09-01T15:27:09+00:00

Source: git://sourceware.org/binutils-gdb.git MR: 111523 Type: Security Fix Disposition: Backport from https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1cfcf3004e1830f8fe9112cfcd15285508d2c2b7 ChangeID: 2d3161f601852eb8f9a9ca982c6b0cd44e036bc6 Description: Affects <= 2.36 Fixup Changelog to apply to dunfel context. (From OE-Core rev: 3cb2e144f8b74f9d78d93ba15e2d66e432462860) Signed-off-by: Armin Kuster Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

rpm: Add fix for CVE-2021-20266

2021-09-01T15:27:09+00:00

Adding fix for CVE-2021-20266 Upstream-Status: Backport [https://github.com/rpm-software-management/rpm/pull/1587/commits/9646711891df851dfbf7ef54cc171574a0914b15] Note: Hunk#2 and Hunk#3 refreshed to apply patch and match value of dl_max variable to make it with current version All Hunks are refreshed to solve patch-fuzz (From OE-Core rev: 6c16aad7167eb98bc9995486f967431c39f9df15) Signed-off-by: Ranjitsinh Rathod Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

qemu: fix CVE-2021-3608

2021-09-01T15:27:09+00:00

Source: http://git.yoctoproject.org/cgit/poky.git MR: 112749 Type: Security Fix Disposition: Backport from http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/meta/recipes-devtools/qemu?h=hardknott&id=f5e77d70e2eb35751f5bad5572b6eb8a3ab14422 ChangeID: 4496341da3af9126c9c67170e1a2cce929c29828 Description: (From OE-Core rev: 5e05ee8ff363eac84edec568039b86bcd716c6ce) (From OE-Core rev: f8d34ef74dafcf14e07f9322254465d03490bd60) Signed-off-by: Sakib Sajal Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie (cherry picked from commit f5e77d70e2eb35751f5bad5572b6eb8a3ab14422) [Refreshed patch] Signed-off-by: Armin Kuster Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

qemu: fix CVE-2021-3607

2021-09-01T15:27:09+00:00

Source: http://git.yoctoproject.org/cgit/poky.git MR: 112749 Type: Security Fix Disposition: Backport from http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/meta/recipes-devtools/qemu?h=hardknott&id=460485d774480cd89cadf3b068f5197f44d86f25 ChangeID: 4e40dee2e6ce0b5b4de971f2c2b336929e7f22c3 Description: (From OE-Core rev: 764bca67650da9df439527796879dda767c8c008) (From OE-Core rev: cc541da4d67a9afa86a6ac37d5470d4dc77ea922) Signed-off-by: Sakib Sajal Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie (cherry picked from commit 460485d774480cd89cadf3b068f5197f44d86f25) Signed-off-by: Armin Kuster Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie