aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2022-07-21libplist: ignore patched CVEsDavide Gardenal
CVE-2017-5834, CVE-2017-5835 and CVE-2017-5836 are patched in our version of libplist but they don't have a vulnerable version range in the NVD database, that's why they need to be ignored. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 261465eb6e2bd8f83e6841f8e42e1fb1be6d1499) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-18openflow: ignore unrelated CVEsDavide Gardenal
CVE-2015-1611 and CVE-2015-1612 are not referred to our implementation of openflow as specified by the NVD database, ignore them. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
2022-07-18freeradius: ignore patched CVEsDavide Gardenal
CVE-2002-0318 and CVE-2011-4966 are both patched in our version of freeradius. The CPE in the NVD database doesn't reflect correctly the vulnerable versions that's why they are incorrectly picked up. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
2022-07-18quagga: ignore CVE-2016-4049Davide Gardenal
CVE-2016-4049 is not affecting our version, so we can ignore it. This is caused because the CPE in the NVD database doesn't specify a vulnerable version range. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
2022-07-18spice: ignore patched CVEsDavide Gardenal
The following CVEs are already patched so we can ignore them: - CVE-2016-0749 - CVE-2016-2150 - CVE-2018-10893 This is caused by inaccurate CPE in the NVD database. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
2022-07-18thrift: add CVE_PRODUCT to fix CVE reportingDavide Gardenal
Without CVE_PRODUCT set to apache:thrift cve-check was catching CVEs form facebook:thrift that are not related with this product. Now the report is correct. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
2022-07-18wireshark: upgrade 3.4.11 -> 3.4.12Davide Gardenal
This upgrade includes the following CVE fixes: - CVE-2021-4190 - CVE-2022-0581 - CVE-2022-0582 - CVE-2022-0583 - CVE-2022-0585 - CVE-2022-0586 Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
2022-07-18ntp: ignore many CVEsDavide Gardenal
cve-check is not able to correctly identify many of the patched CVEs because of the non standard version number. All the ignored CVEs were manually checked with the NVD database and deemed not applicable to the current version. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
2022-07-18openflow: ignore CVE-2018-1078Davide Gardenal
CVE-2018-1078 is not for openflow but in the NVD database the CVE is for a specific implementation that we don't have so we can ignore it. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
2022-07-18usrsctp: add CVE_VERSION to correctly check for CVEsDavide Gardenal
The current version of usrsctp is not a release so cve-check is not able to find the product version. CVE_VERSION is now set to 0.9.3.0 that is the nearest version in the past starting from the revision we have. This is done because we don't have the complete 0.9.4.0 release. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
2022-07-18zabbix: upgrade 5.2.6 -> 5.4.12Changqing Li
This upgrade CVE fix: CVE-2022-24349 CVE-2022-24917 CVE-2022-24918 CVE-2022-24919 Signed-off-by: Changqing Li <changqing.li@windriver.com>
2022-07-18apache2: upgrade 2.4.53 -> 2.4.54Changqing Li
This upgrade include CVE fixes: CVE-2022-30522 CVE-2022-31813 CVE-2022-28615 CVE-2022-30556 CVE-2022-29404 CVE-2022-26377 CVE-2022-28614 CVE-2022-28330 Signed-off-by: Changqing Li <changqing.li@windriver.com>
2022-07-18redis: upgrade 7.0-rc3 -> 7.0.2Changqing Li
This upgrade include CVE fix: CVE-2022-24735 CVE-2022-24736 Signed-off-by: Changqing Li <changqing.li@windriver.com>
2022-07-18redis: upgrade 6.2.6 -> 6.2.7Changqing Li
This upgrade include CVE fix: CVE-2022-24735 CVE-2022-24736 Signed-off-by: Changqing Li <changqing.li@windriver.com>
2022-07-14protobuf-c: update to 1.4.1 fix CVE-2022-33070Wentao Zhang
Signed-off-by: Wentao Zhang <wzhang4@ala-lpd-susbld2.wrs.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 95904cca4a23de395069b01f1518d98fa8502afc) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-09modemmanager: update to 1.18.8Adrian Freihofer
* A new connection status dispatcher setup is provided, where users can provide custom scripts that will be called on bearer connect/disconnect events. This dispatcher will make the netifd integration in openwrt work much better, as we'll be able to report network-initiated disconnections cleanly to netifd. There are no default connection status dispatcher scripts installed, but it's suggested distributions make sure the following directories exist: - ${sysconfdir}/ModemManager/connection.d/ - ${libdir}/ModemManager/connection.d/ * API: ** Add missing Simple interface definitions in ModemManager-names.h. * Build: ** meson: fix daemon enums dependencies. ** meson: fix port enums includes. ** meson: fix 'export_packages' in GIR setup. ** meson: fix simtech plugin module name. ** systemd: don't run ModemManager in containers. * Core: ** serial: ensure the port object is valid after BUFFER_FULL handling. ** netlink: use unaligned netlink attribute length. ** netlink: only change IFF_UP flag. ** bearer: match unknown auth to chap in loose comparisons. ** charsets: return error if UTF-8 validation fails. ** fcc-unlock: make scripts POSIX shell compatible. ** modem-helpers: consider minimum ID when choosing best profile. ** modem-helpers: fix reading <Act> given in COPS=? responses. ** sms: prevent crash if date is out of range. ** profile-manager: fix copy-paste error on tags for quarks. * QMI: ** Ignore slot status indications until initial status is known. ** Return error when loading capabilities if none is found. * MBIM: ** Default initial EPS bearer's auth to chap when unknown. ** Update default error when network error is out of range. * mmcli: ** Fix key length when printing list of items. * Plugins: ** linktop: new port type hints. ** cinterion: add support for PLSx3w modems ** huawei: disable +CPOL based features in Huawei E226 * Several other minor improvements and fixes. Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-09imagemagick: upgrade 7.0.10-25 -> 7.0.10-62Davide Gardenal
This upgrade includes patches for the following CVEs: - CVE-2020-13902 - CVE-2020-27829 - CVE-2020-29599 - CVE-2021-20176 - CVE-2021-20241 - CVE-2021-20243 - CVE-2021-20244 - CVE-2021-20245 - CVE-2021-20246 - CVE-2021-3596 Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-09ntfs-3g-ntfsprogs: upgrade to 2022.5.17Chen Qi
Upgrade from 2021.8.22 to 2022.5.17. This upgrade mainly include CVE fixes. According to https://github.com/tuxera/ntfs-3g/releases: """ Changelog: * Improved defence against maliciously tampered NTFS partitions * Improved defence against improper use of options * Updated the documentation """ Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-09php: upgrade 8.1.6 -> 8.1.7wangmy
Changelog: ========== https://www.php.net/ChangeLog-8.php#8.1.7 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 75749fa360f32ed0b5c2e09c359e245e58cc7131) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-09cyrus-sasl: CVE-2022-24407 failure to properly escape SQL input allows an ↵Hitendra Prajapati
attacker to execute arbitrary SQL commands Source: https://github.com/cyrusimap/cyrus-sasl MR: 118497 Type: Security Fix Disposition: Backport from https://github.com/cyrusimap/cyrus-sasl/commit/9eff746c9daecbcc0041b09a5a51ba30738cdcbc ChangeID: 4736aae2b7d8986787b1666cfd6eecd590915120 Description: CVE-2022-24407 cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-09dlt-daemon: upgrade to commit 6a3bd901d8 to fix CVE-2022-31291Yue Tao
The upstream commit fcb676a79d introduced new option WITH_DLT_ADAPTOR_UDP to select dlt-adaptor-udp.service instread of WITH_DLT_ADAPTOR, so update the PACKAGECONFIG. Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-09emlog: ignore unrelated CVEsDavide Gardenal
This product is not present in the NVD database but another one with exactly the same name is in fact present. For that reason cve-check is outputting CVEs that are unrelated so they can be ignored. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-09freeradius: mutlilib fixesJeremy Puhlman
Define raddbdir based on multilib Add multilib headers and scripts for conflicting content Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8687d488f7352fa0c5c7dbc919aa14e577ce153e) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-04fix(syslog-ng): warning about conf versionAurélien Bertron
The service warned on startup about running in compatibility mode since the configuration version was "3.31" instead of "3.36". Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e80ce510e187c00d6932027ac495a1d06f6a702f) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-04strongswan: upgrade 5.9.5 -> 5.9.6Yi Zhao
* Drop backport patch 0001-openssl-Don-t-unload-providers.patch * Backport a patch to fix the build error: src/libstrongswan/utils/enum.c: In function 'enum_flags_to_string': src/libstrongswan/utils/enum.c:100:9: error: format not a string literal and no format arguments [-Werror=format-security] 100 | if (snprintf(buf, len, e->names[0]) >= len) | ^~ Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 689e8422b836d804d9ab102cb3de0a4f6e1f24c8) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-04postgresql: upgrade 14.3 -> 14.4wangmy
0001-configure.ac-bypass-autoconf-2.69-version-check.patch refreshed for new version. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a9db38fa9a1fc50eca653816a7bfeda0251f0b6b) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-04exo: upgrade 4.16.3 -> 4.16.4Yue Tao
To fix CVE-2022-32278 Upstream fix is: https://gitlab.xfce.org/xfce/exo/-/commit/c71c04ff5882b2866a0d8506fb460d4ef796de9f Signed-off-by: Yue Tao <yue.tao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-01networkmanager: fix build with enabled pppJavier Viguera
If 'ppp' packageconfig option is enabled, but the build system does NOT have pppd binary installed, the build fails with: | Has header "pppd/pppd.h" : YES | Program pppd /sbin/pppd /usr/sbin/pppd found: NO | | ../NetworkManager-1.36.2/meson.build:570:4: ERROR: Assert failed: pppd required but not found, please provide a valid pppd path or use -Dppp=false to disable it This is due to meson trying to look for the 'pppd' binary in the build system when it should not. If the build system does not contain pppd, the build fails. Signed-off-by: Javier Viguera <javier.viguera@digi.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-22chrony: create /var/lib/chrony by systemd-tmpfilesChangqing Li
Ensure /var/lib/chrony exist to avoid error like: chronyd.service: Failed to set up mount namespacing: /run/systemd/unit-root/var/lib/chrony: No such> chronyd.service: Failed at step NAMESPACE spawning /usr/sbin/chronyd: No such file or directory Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-22dnsmasq: Security fix CVE-2022-0934Yi Zhao
CVE-2022-0934: Heap use after free in dhcp6_no_relay Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-0934 Patch from: https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=03345ecefe Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-22libgpiod: move test dependencies to ptest packagePeter Marko
This reverts and reworks commit e75cc87c4f944dff766c426fafafd48c378544fe These tools are needed by test-suites, not the package itself. I do not want bash (gpl3) or python (big/lot of dependencies) in my release image when I have ptest enabled in my distro for sdk/testing image. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-22python3-pybluez: fix a runtime issue with python 3.10Bartosz Golaszewski
Add an upstream patch that's not part of any release yet that addresses an issue with python 3.10 (related to a missing macro). Link: https://github.com/pybluez/pybluez/issues/426 Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15iperf: Set CVE_PRODUCT to "iperf_project:iperf"Akash Hadke
Set CVE_PRODUCT as 'iperf_project:iperf' for iperf2 and iperf3 recipes, cve-check class is setting default CVE_PRODUCT to 'iperf2' and 'iperf3' respectively which ignores the iperf CVEs from NVD Database. Reference: CVE-2016-4303 Link: https://nvd.nist.gov/vuln/detail/CVE-2016-4303 Signed-off-by: Akash Hadke <akash.hadke@kpit.com> Signed-off-by: Akash Hadke <hadkeakash4@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15ntfs-3g-ntfsprogs: Set CVE_PRODUCT to "tuxera:ntfs-3g"Akash Hadke
Set CVE_PRODUCT to 'tuxera:ntfs-3g' for ntfs-3g-ntfsprogs recipe, cve-check class is setting default CVE_PRODUCT to 'ntfs-3g-ntfsprogs' which ignores the ntfs-3g-ntfsprogs CVEs from NVD Database. Reference: CVE-2019-9755 Link: https://nvd.nist.gov/vuln/detail/CVE-2019-9755 Signed-off-by: Akash Hadke <akash.hadke@kpit.com> Signed-off-by: Akash Hadke <hadkeakash4@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15tesseract-lang: switch from master branch to mainMartin Jansa
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15netserver: don't change permissions on /dev/nullAshish Sharma
Source: MontaVista Software, LLC MR: 117141 Type: Defect Fix Disposition: Backport from [https://github.com/HewlettPackard/netperf/pull/27/commits/78c9ae7d9a6735575bc72dd28a19b2bc3a251981] ChangeID: 199f8618971de15d177dab9651f82f5696ff1aa1 Description: the (now default) suppress_debug=1 changes permissions on /dev/null to 0644. Don't do this. Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15leveldb: switch from master branch to mainMartin Jansa
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03python3-matplotlib: add missing dependencyAdrian Fiergolski
In order to fix the dependency issue on PIL module, python3-pillow is required. Signed-off-by: Adrian Fiergolski <adrian.fiergolski@fastree3d.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d4e70a19600bee178d81b467dd9e118cbf057f65) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03devmem2: the source and patches moved to github repoDenys Dmytriyenko
To cleanup metadata and improve source code management, github repo was created here with all patches integrated: https://github.com/denix0/devmem2 Update recipe accordingly, bump the version while at it to distinguish from the original. Signed-off-by: Denys Dmytriyenko <denis@denix.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 356b488fb06bcacb0aa553518442b2d9574f16af) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03python3-speedtest-cli: fix RDEPENDSBartosz Golaszewski
There are packages missing in RDEPENDS needed to run speedtest-cli. Add them and use += for the assignment as we don't know what inherited classes may have added. Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3413265185dd199da0f54ef6d83abca2c8ec9b50) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03sdbus-c++-libsystemd: Fix patch fuzzKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 397f4f054fd3600f7305055c724607973f5f5511) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03sdbus-c++: Link with libatomic for rv32Khem Raj
Fixes libsdbus-c++.so.1.1.0: undefined reference to `__atomic_load_8' Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5029571d689f80bfa5c3a391f088d1484c61d583) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03sdbus-c++: Link with libatomic on mips/ppc32Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Gianfranco Costamagna <locutusofborg@debian.org> (cherry picked from commit 366663527aa5efd4e43a62919edcdf9caf14e77c) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03conntrack-tools: fix postinst scriptAdrian Freihofer
Fix error caused by postinst script of conntrack-tools: do_rootfs: Postinstall scriptlets of ['conntrack-tools'] have failed... Configuring ... rootfs//var/lib/opkg/info/conntrack-tools.postinst: line 2: setcap: command not found conntrack-tools.postinst returned 127, marking as unpacked only... Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 55fd9844830bc835c2bf8def9406edc9e2df0e16) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03graphviz: rrecommends on liberation-fontsKai Kang
There will be tofos in output pictures without any font, so make graphviz rrecommends on liberation-fonts. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0e036cb1bc0c272b27cbd7e42eacbae48edc685e) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03libportal: add distro features checkKai Kang
Add distro features check for libportal because it depends on gtk+3 which requires one of ${GTK3DISTROFEATURES}. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0baa7793e0df81a21a130e6f0513f27b322cd4ad) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03unattended-upgrades: Disable auto-detecting modulesKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e7193af6c94436a577ebd472c6294eaef7c7cd15) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03mariadb: Fix i386 Clang buildsArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmial.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d59578a8170266d0d7e62c132495c0e06a17e0c9) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03mariadb: update to 10.7.4Armin Kuster
LTS version, bugfix only update. Drop clang-64bit-atomics.patch as the patched code was removed in this update. https://github.com/MariaDB/server/commit/cf483a7766d0730872232fdedd727d30a493fe29 Includes these CVES: CVE-2022-27458 CVE-2022-27457 CVE-2022-27456 CVE-2022-27455 CVE-2022-27452 CVE-2022-27451 CVE-2022-27449 CVE-2022-27448 CVE-2022-27447 CVE-2022-27446 CVE-2022-27445 CVE-2022-27444 CVE-2022-27387 CVE-2022-27386 CVE-2022-27384 CVE-2022-27383 CVE-2022-27382 CVE-2022-27381 CVE-2022-27380 CVE-2022-27379 CVE-2022-27378 CVE-2022-27377 CVE-2022-27376 Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c1720935bd80fa6023f2fcec7c252c0fea183029) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-30libmtp: Add doxygen-native dependency in case documentation build is enabled ↵Gianfranco
in PACKAGECONFIG. This fixes a FTBFS due to missing dependency. Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@yahoo.it> Signed-off-by: Gianfranco Costamagna <locutusofborg@debian.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a9e6d16e6640d105ecf3470ab891598034c9ef33) Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-23 05:45:47 +0000