linux/poky.git/meta/recipes-devtools, branch yocto-4.0.28

go: fix CVE-2025-4673

2025-06-27T15:09:27+00:00

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-4673 Upstream-patch: https://github.com/golang/go/commit/b897e97c36cb62629a458bc681723ca733404e32 (From OE-Core rev: c07547c19e5372ed5eaac8530b2dd651302542a8) Signed-off-by: Praveen Kumar Signed-off-by: Steve Sakoman

cmake: Correctly handle cost data of tests with arbitrary chars in name

2025-06-25T15:11:58+00:00

ctest automatically optimizes the order of (parallel) test execution based on historic test case runtime via the COST property (see [0]), which can have a significant impact on overall test run times. Sadly this feature is broken in CMake < 4.0.0 for test cases that have spaces in their name (see [1]). This commit is a backport of f24178f3 (which itself backports the upstream fix). the patch was adapted slightly to apply cleanly to the older CMake version in kirkstone. As repeated test runs are expected to mainly take place inside the SDK, the patch is only applied to 'nativesdk' builds. [0]: https://cmake.org/cmake/help/latest/prop_test/COST.html [1]: https://gitlab.kitware.com/cmake/cmake/-/issues/26594 Reported-By: John Drouhard (From OE-Core rev: f6a160f7ea57af6dfeca003e6c05aa42419fb755) Signed-off-by: Moritz Haase Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

go: ignore CVE-2024-3566

2025-06-25T15:11:58+00:00

NVD ([1]) tracks this as: cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Running on/with cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Yocto cve-check ignores the "Running on/with", so it needs to be ignored explicitly. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-3566 (From OE-Core rev: 571fd82e29fe809c63a5743e534ed7816d787963) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

e2fsprogs: removed 'sed -u' option

2025-06-20T15:06:30+00:00

In embedded box, sed might be provided another providers like Busybox, hence use generic options whenever possible. /bin/sed -> /etc/alternatives/sed /etc/alternatives/sed -> /bin/busybox.nosuid Here used 'sed -u' option is not necessary, hence removed it. Fixes below error: sed: invalid option -- 'u' Also added 'set -eux' option which halts execution of the script on any failures. (From OE-Core rev: 5b3b290baa0a83f493b7ca25d5ffa5ff279bcc69) (From OE-Core rev: fe7fa1ec7d005d858ccbdd81eb6f7bfab04b7e46) Signed-off-by: Aditya Tayade Signed-off-by: Pawan Badganchi Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit 07caee1829d2a61bc018fe0e37ecd482922179ee) Signed-off-by: Steve Sakoman (cherry picked from commit d2da6b5c5668dbc84b905ba2fe4c9b57b580fd82) Signed-off-by: Steve Sakoman

python3-requests: fix CVE-2024-47081

2025-06-20T15:06:29+00:00

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-47081 Upstream patch: https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef (From OE-Core rev: 37d746033710509ffabc244e0130d20fd81d9673) Signed-off-by: Jiaying Song Signed-off-by: Steve Sakoman

python3: upgrade 3.10.16 -> 3.10.18

2025-06-13T15:42:35+00:00

Drop upstreamed patch and refresh remaining patches. * https://www.python.org/downloads/release/python-31017/ Security content in this release * gh-131809: Upgrade vendored expat to 2.7.1 * gh-80222: Folding of quoted string in display_name violates RFC * gh-121284: Invalid RFC 2047 address header after refolding with email.policy.default * gh-131261: Update libexpat to 2.7.0 * gh-105704: CVE-2025-0938 urlparse does not flag hostname containing [ or ] as incorrect * gh-119511: OOM vulnerability in the imaplib module * https://www.python.org/downloads/release/python-31018/ Security content in this release * gh-135034: [CVE 2024-12718] [CVE 2025-4138] [CVE 2025-4330] [CVE 2025-4435] [CVE 2025-4517] Fixes multiple issues that allowed tarfile extraction filters (filter="data" and filter="tar") to be bypassed using crafted symlinks and hard links. * gh-133767: Fix use-after-free in the “unicode-escape” decoder with a non-“strict” error handler. * gh-128840: Short-circuit the processing of long IPv6 addresses early in ipaddress to prevent excessive memory consumption and a minor denial-of-service. gh-133767 got meawhile CVE-2025-4516 assigned. (From OE-Core rev: 838a8b5ca148dfa6c6c2c76f1705d1e358a31648) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

git: Fix CVE-2024-50349 and CVE-2024-52006

2025-06-13T15:42:35+00:00

Upstream-Status: Backport from https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577 & https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8 & https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060 (From OE-Core rev: ed112b58ad0d40bfa36e53a370e964e6a20d694e) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

binutils: Fix CVE-2025-5244 & CVE-2025-5245

2025-06-13T15:42:35+00:00

PR32858 ld segfault on fuzzed object We missed one place where it is necessary to check for empty groups. PR32829, SEGV on objdump function debug_type_samep u.kenum is always non-NULL, see debug_make_enum_type. Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=d1458933830456e54223d9fc61f0d9b3a19256f5] && [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=6c3458a8b7ee7d39f070c7b2350851cb2110c65a] (From OE-Core rev: 7eb29f802b272dec19c5bfdce93155d99bac918d) Signed-off-by: Deepesh Varatharajan Signed-off-by: Steve Sakoman

python3-setuptools: Fix CVE-2025-47273

2025-06-13T15:42:35+00:00

Upstream-Status: Backport from https://github.com/pypa/setuptools/commit/d8390feaa99091d1ba9626bec0e4ba7072fc507a & https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b (From OE-Core rev: 6b6e556a226100205427c85e8064f7640a9da25e) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

binutils: add CVE-2025-1182 patch file to SRC_URI

2025-06-13T15:42:35+00:00

Forgot to add CVE-2025-1182 patch file to SRC_URI in the following commit https://lists.openembedded.org/g/openembedded-core/message/217350 After rebasing the CVE-2025-1180.patch, we encountered hunk errors while applying the CVE-2025-1182.patch, so I have modified the patch accordingly. (From OE-Core rev: 131f93b8efcddac984965a250b5391c43ca54ac8) Signed-off-by: Harish Sadineni Signed-off-by: Steve Sakoman