linux/poky.git/meta/recipes-support, branch yocto-4.0.8

libgit2: upgrade 1.4.4 -> 1.4.5

2023-02-24T16:41:46+00:00

Fixes: libgit2, when compiled using the optional, included libssh2 backend, fails to verify SSH keys by default. Description When using an SSH remote with the optional, included libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificate_check field of libgit2's git_remote_callbacks structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Beginning in libgit2 v1.4.5 and v1.5.1, libgit2 will now perform host key checking by default. Users can still override the default behavior using the certificate_check function. The libgit2 security team would like to thank the Julia and Rust security teams for responsibly disclosing this vulnerability and assisting with fixing the vulnerability. (From OE-Core rev: 6c64dc88b5dac910f3760e9cd1003cc83df3ffad) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libgit2: uprade 1.4.3 -> 1.4.4

2023-02-24T16:41:46+00:00

This is a security release with multiple changes. This provides compatibility with git's changes to address CVE 2022-29187. As a follow up to CVE 2022-24765, now not only is the working directory of a non-bare repository examined for its ownership, but the .git directory and the .git file (if present) are also examined for their ownership. A fix for compatibility with git's (new) behavior for CVE 2022-24765 allows users on POSIX systems to access a git repository that is owned by them when they are running in sudo. A fix for further compatibility with git's (existing) behavior for CVE 2022-24765 allows users on Windows to access a git repository that is owned by the Administrator when running with escalated privileges (using runas Administrator). The bundled zlib is updated to v1.2.12, as prior versions had memory corruption bugs. It is not known that there is a security vulnerability in libgit2 based on these bugs, but we are updating to be cautious. (From OE-Core rev: 4bc31ac89eb0562bae37e2246e8001b4286f61da) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

apr-util: update 1.6.1 -> 1.6.3

2023-02-24T16:41:46+00:00

Changes with APR-util 1.6.3 *) Correct a packaging issue in 1.6.2. The contents of the release were correct, but the top level directory was misnamed. Changes with APR-util 1.6.2 *) SECURITY: CVE-2022-25147 (cve.mitre.org) Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. *) Teach configure how to find and build against MariaDB 10.2. PR 61517 [Kris Karas ] *) apr_crypto_commoncrypto: Remove stray reference to -lcrypto that prevented commoncrypto being enabled. [Graham Leggett] *) Add --tag=CC to libtool invocations. PR 62640. [Michael Osipov] *) apr_dbm_gdbm: Fix handling of error codes. This makes gdbm 1.14 work. apr_dbm_gdbm will now also return error codes starting with APR_OS_START_USEERR, as apr_dbm_berkleydb does, instead of always returning APR_EGENERAL. [Stefan Fritsch] Drop backport. (From OE-Core rev: e24b38a14b3520648ec418783fb74fcf61df7ff2) Signed-off-by: Alexander Kanavin Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit dca707f9fecc805503e17f6db3e4c88069ac0125) Signed-off-by: Steve Sakoman (cherry picked from commit 43cd36b178ebb602edd5919c26f8b8642736a3a8) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

apr: update 1.7.0 -> 1.7.2

2023-02-24T16:41:46+00:00

Changes for APR 1.7.2 *) Correct a packaging issue in 1.7.1. The contents of the release were correct, but the top level directory was misnamed. Changes for APR 1.7.1 *) SECURITY: CVE-2022-24963 (cve.mitre.org) Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. *) SECURITY: CVE-2022-28331 (cve.mitre.org) On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow. *) SECURITY: CVE-2021-35940 (cve.mitre.org) Restore fix for out-of-bounds array dereference in apr_time_exp*() functions. (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and later 1.6.x releases, but was missing in 1.7.0.) [Stefan Sperling] *) configure: Fix various build issues for compilers enforcing strict C99 compliance. PR 66396, 66408, 66426. [Florian Weimer , Sam James ] *) apr_atomic_read64(): Fix non-atomic read on 32-bit Windows [Ivan Zhakov] *) configure: Prefer posix name-based shared memory over SysV IPC. [Jim Jagielski] *) configure: Add --disable-sctp argument to forcibly disable SCTP support, or --enable-sctp which fails if SCTP support is not detected. [Lubos Uhliarik , Joe Orton] *) Fix handle leak in the Win32 apr_uid_current implementation. PR 61165. [Ivan Zhakov] *) Add error handling for lseek() failures in apr_file_write() and apr_file_writev(). [Joe Orton] *) Don't silently set APR_FOPEN_NOCLEANUP for apr_file_mktemp() created file to avoid a fd and inode leak when/if later passed to apr_file_setaside(). [Yann Ylavic] *) APR's configure script uses AC_TRY_RUN to detect whether the return type of strerror_r is int. When cross-compiling this defaults to no. This commit adds an AC_CACHE_CHECK so users who cross-compile APR may influence the outcome with a configure variable. [Sebastian Kemper ] *) Add a cache check with which users who cross-compile APR can influence the outcome of the /dev/zero test by setting the variable ac_cv_mmap__dev_zero=yes [Sebastian Kemper ] *) Trick autoconf into printing the correct default prefix in the help. [Stefan Fritsch] *) Don't try to use PROC_PTHREAD by default when cross compiling. [Yann Ylavic] *) Add the ability to cross compile APR. [Graham Leggett] *) While cross-compiling, the tools/gen_test_char could not be executed at build time, use AX_PROG_CC_FOR_BUILD to build native tools/gen_test_char Support explicit libtool by variable assigning before buildcheck.sh, it is helpful for cross-compiling (such as libtool=aarch64-linux-libtool) [Hongxu Jia ] *) Avoid an overflow on 32 bit platforms. [René Hjortskov Nielsen ] *) Use AC_CHECK_SIZEOF, so as to support cross compiling. PR 56053. [Mike Frysinger ] *) Add --tag=CC to libtool invocations. PR 62640. [Michael Osipov] *) apr_pools: Fix pool debugging output so that creation events are always emitted before allocation events and subpool destruction events are emitted on pool clear/destroy for proper accounting. [Brane Čibej] *) apr_socket_listen: Allow larger listen backlog values on Windows 8+. [Evgeny Kotkov ] *) Fixed: apr_get_oslevel() was returning APR_WIN_XP on Windows 10 *) Fix attempt to free invalid memory on exit when apr_app is used on Windows. [Ivan Zhakov] *) Fix double free on exit when apr_app is used on Windows. [Ivan Zhakov] *) Fix a regression in apr_stat() for root path on Windows. [Ivan Zhakov] Dropped patches have all been merged, addressed separately or are backports. (From OE-Core rev: c291aefb531431b9a256740766dcb03cbdf84481) Signed-off-by: Alexander Kanavin Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 3ffae93f24bb1e3954b232099153fd059cfd7daf) Signed-off-by: Steve Sakoman (cherry picked from commit e5326ea0ac7e55b2d671a27c1e035c43b8bbc70d) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libusb1: Strip trailing whitespaces

2023-02-04T23:32:20+00:00

(From OE-Core rev: 6e981dc8df59ce0e2e85b25f240b6c5767ce22f6) Signed-off-by: Khem Raj Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 2b24ffade16fc23ddb77e26d8967c26d62f4ed6d) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libusb1: Link with latomic only if compiler has no atomic builtins

2023-02-04T23:32:20+00:00

This makes build use compiler to decide from where to get atomics instead of assuming that it should always come from libatomic, helps sharing build artifacts with OSes which may not have libatomic installed because it is not required on those hosts. (From OE-Core rev: c660d75211352a47797c3d400dd504759675a0f6) Signed-off-by: Khem Raj Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit a026d9afcbe07a8324ca951ba3439373dcb3771c) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

numactl: skip test case when target platform doesn't have 2 CPU node

2023-02-04T23:32:20+00:00

when current test platform doesn't have 2 or more CPU node, the test case would report FAIL, according to numa test script and numademo code, when return code=77 should be skip test, so using SKIP instead of FAIL in test script. (From OE-Core rev: 218cf38bd3879df009e70f516c0dcb484376bf2e) Signed-off-by: Xiangyu Chen Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit fd0a82400d419bce8605a9445db9b20b8ddc01a7) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libseccomp: fix typo in DESCRIPTION

2023-01-26T23:37:05+00:00

Fix typo in DESCRIPTION: and -> an. (From OE-Core rev: 44f59f5d8414cbe935addb57bd1ea9ffaf734fba) Signed-off-by: Chen Qi Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 349e63045298054f9454025d793c67284fce750b) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

vim: upgrade 9.0.0947 -> 9.0.1211

2023-01-26T23:37:05+00:00

Includes fixes for: https://nvd.nist.gov/vuln/detail/CVE-2023-0049 https://nvd.nist.gov/vuln/detail/CVE-2023-0051 https://nvd.nist.gov/vuln/detail/CVE-2023-0054 https://nvd.nist.gov/vuln/detail/CVE-2023-0288 (From OE-Core rev: d4887e2e43e3d66e0f64299a8189b26d5aff31ef) Signed-off-by: Randy MacLeod Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 1c51068c78d12ee02789a6dbecf5e7e91d141af5) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libksba: update 1.6.2 -> 1.6.3

2023-01-26T23:37:05+00:00

Noteworthy changes in version 1.6.3 (2022-12-06) Fix another integer overflow in the CRL parser. [T6284,CVE-2022-47629] (From OE-Core rev: 0c1829b0e7e085ba8aef0d47852abf520ef9d635) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 83f3f21b1b84ab9e7b461ac966691c80f4ed4e97) Signed-off-by: Steve Sakoman (cherry picked from commit f098cb5073051eb371f4142678b4b3d5e7b52426) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie