linux/poky.git/meta, branch dunfell-23.0.31

build-appliance-image: Update to dunfell head revision

2024-01-22T13:37:47+00:00

(From OE-Core rev: 82e67bd9c77f0c5cbb652ca91071b9e57bdcfb33) Signed-off-by: Steve Sakoman

libtiff: Fix for CVE-2023-6228

2024-01-21T18:33:19+00:00

Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/1e7d217a323eac701b134afc4ae39b6bdfdbc96a] (From OE-Core rev: ff66998ef81dbc35465e30eec96ee9be51f5da80) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

qemu: Backport fix for CVE-2023-2861

2024-01-21T18:33:19+00:00

Updated 0012-fix-libcap-header-issue-on-some-distro.patch to resolve patch fuzz caused by the CVE-2023-2861 patch Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/a5804fcf7b22fc7d1f9ec794dd284c7d504bd16b & https://gitlab.com/qemu-project/qemu/-/commit/f6b0de53fb87ddefed348a39284c8e2f28dc4eda] (From OE-Core rev: cede843cdd1d1a83b2d616086aa69a2b584f9442) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

zlib: ignore CVE-2023-6992

2024-01-21T18:33:19+00:00

This CVE is for iCPE cloudflare:zlib. Alternative to ignoring would be to limit CVE_PRODUCT, but historic CVEs already have two - gnu:zlib and zlib:zlib. So limiting it could miss future CVEs. (From OE-Core rev: 5dc87309639e78195eb1283afc193f6eac63b044) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libxml2: Fix for CVE-2023-45322

2024-01-21T18:33:19+00:00

Backport patch for gitlab issue mentioned in NVD CVE report. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/583 Backport also one of 14 patches for older issue with similar errors to have clean cherry-pick without patch fuzz. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/344 The CVE is disputed because the maintainer does not think that errors after memory allocation failures are not critical enough to warrant a CVE ID. This patch will formally fix reported error case, trying to backport another 13 patches and resolve conflicts would be probably overkill due to disputed state. This CVE was ignored on master branch (as diputed). (From OE-Core rev: 03b766e42beb42a2085285308acbcf941f346b06) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

xserver-xorg: Fix for CVE-2023-6377 and CVE-2023-6478

2024-01-21T18:33:19+00:00

Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd & https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632] (From OE-Core rev: f5eff24d386215e5b5aee5c3261f5602b47c7f02) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

go: Backport fix for CVE-2023-45287

2024-01-21T18:33:18+00:00

Upstream-Status: Backport [https://github.com/golang/go/commit/9baafabac9a84813a336f068862207d2bb06d255 & https://github.com/golang/go/commit/c9d5f60eaa4450ccf1ce878d55b4c6a12843f2f3 & https://github.com/golang/go/commit/8f676144ad7b7c91adb0c6e1ec89aaa6283c6807 & https://github.com/golang/go/commit/8a81fdf165facdcefa06531de5af98a4db343035] (From OE-Core rev: 20e1d10a3ebefc8c5237c065c25eba4182d22efd) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

linux-firmware: upgrade 20230804 -> 20231030

2024-01-10T13:57:03+00:00

License-Update: additional firmwares (From OE-Core rev: b3dd6852c0d6b8aa9b36377d7024ac95062e8098) Signed-off-by: Dmitry Baryshkov Signed-off-by: Alexandre Belloni (cherry picked from commit 7c725d1f2ed9a271d39d899ac2534558c2d103fc) Signed-off-by: Steve Sakoman

cve-update-nvd2-native: increase the delay between subsequent request failures

2024-01-10T13:57:03+00:00

Sometimes NVD servers are unstable and return too many errors. There is an option to have higher fetch attempts to increase the chances of successfully fetching the CVE data. Additionally, it also makes sense to progressively increase the delay after a failed request to an already unstable or busy server. The increase in delay is reset after every successful request and the maximum delay is limited to 30 seconds. Also, the logs are improved to give more clarity. (From OE-Core rev: 9e03b7a9879fd16e32f4eccb78b438f6fa9db74d) Signed-off-by: Dhairya Nagodra Signed-off-by: Alexandre Belloni (cherry picked from commit 7101d654635b707e56b0dbae8c2146b312d211ea) Signed-off-by: Steve Sakoman

cve-update-nvd2-native: faster requests with API keys

2024-01-10T13:57:03+00:00

As per NVD, the public rate limit is 5 requests in 30s (6s delay). Using an API key increases the limit to 50 requests in 30s (0.6s delay). However, NVD still recommends sleeping for several seconds so that the other legitimate requests are serviced without denial or interruption. Keeping the default sleep at 6 seconds and 2 seconds with an API key. For failures, the wait time is unchanged (6 seconds). Reference: https://nvd.nist.gov/developers/start-here#RateLimits (From OE-Core rev: eb5ab00be33a503205401541e88c32ba9da1d75c) Signed-off-by: Dhairya Nagodra Signed-off-by: Alexandre Belloni (cherry picked from commit 5c32e2941d1dc3d04a799a1b7cbd275c1ccc9e79) Signed-off-by: Steve Sakoman