aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2023-11-18nginx: upgrade to 1.24.0 releasestable/kirkstone-nut2Michael Haener
According to http://nginx.org/en/CHANGES nginx supports the openssl 3.x component only from version 1.21.2. In Kirstone openssl 3.x is included but all provided versions of nginx are older, so there is currently an incompatibility. With this patch this incompatibility get removed. Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-18meta-python: Drop broken BBCLASSEXTEND variantsRichard Purdie
The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d4aa17dc436beb96a804860bc6d18cf72283709e) Backport: * Adapted paths to follow PV changes * Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-18python3-cson: fix run-time dependenciesBartosz Golaszewski
Add the missing run-time dependency on python3-json. As a result we no longer need to pull python3 native and can drop other *DEPENDS. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 40b4cf5a83098a5f1be873be5c29f26380bc7993) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-17meta-oe: Drop broken BBCLASSEXTEND variantsRichard Purdie
The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9962d57f7c235873de0a0bb192b5f56747762fc7) Backport: * Updated paths to follow PV changes * Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-17libwebsockets: Support building for nativePeter Kjellerstedt
This is needed to be able to build mosquitto-native. The dependency on libcap when building for native is needed because cmake will pick up the existence of libcap from the host, but then the build fails if it is not available in the sysroot. Unfortunately, there does not seem to be any way to explicitly tell cmake to not build with libcap. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c083e0569ad80d11b4f5cfdfa89acdd4264d8152) Backported: Updated paths to follow PV changes. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-17packagegroup-meta-oe-extended: RDEPENDS on an existing mozjs-91 packageYoann Congal
"mozjs" does not exist but "mozjs-91" does. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-17meta-networking: Drop broken BBCLASSEXTEND variantsRichard Purdie
The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e1b332f2eff7df2336ff87917cd48249edf763a2) Backport: Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-17meta-perl: Drop broken BBCLASSEXTEND variantsRichard Purdie
The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 79e0a9d237343ad0af0a40128494155ccaa131ec) Backported: * Adapted paths to follow PV changes * Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-17python3-soupsieve: Break circular dependency with beautifulsoup4Yoann Congal
python3-beautifulsoup4 does depend on python3-soupsieve but python3-soupsieve does not depend on python3-beautifulsoup4. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-15nlohmann-json: Add ptest supportMingli Yu
* Fetch the test data during do_fetch phase to avoid internet access during test as some tests need test data. # ./run-ptest PASS: test-algorithms PASS: test-allocator PASS: test-alt-string PASS: test-assert_macro PASS: test-bson PASS: test-byte_container_with_subtype PASS: test-capacity PASS: test-cbor PASS: test-class_const_iterator PASS: test-class_iterator PASS: test-class_lexer PASS: test-class_parser PASS: test-comparison PASS: test-concepts PASS: test-constructor1 PASS: test-constructor2 PASS: test-convenience PASS: test-conversions PASS: test-conversions_cpp17 PASS: test-deserialization PASS: test-diagnostics PASS: test-disabled_exceptions PASS: test-element_access1 PASS: test-element_access2 PASS: test-hash PASS: test-inspection PASS: test-items PASS: test-items_cpp17 PASS: test-iterators1 PASS: test-iterators2 PASS: test-json_patch PASS: test-json_pointer PASS: test-large_json PASS: test-merge_patch PASS: test-meta PASS: test-modifiers PASS: test-msgpack PASS: test-noexcept PASS: test-ordered_json PASS: test-ordered_map PASS: test-pointer_access PASS: test-readme PASS: test-reference_access PASS: test-regression1 PASS: test-regression1_cpp17 PASS: test-regression2 PASS: test-regression2_cpp17 PASS: test-serialization PASS: test-testsuites PASS: test-to_chars PASS: test-ubjson PASS: test-udt PASS: test-udt_macro PASS: test-unicode1 PASS: test-unicode2 PASS: test-unicode3 PASS: test-unicode4 PASS: test-unicode5 PASS: test-user_defined_input PASS: test-wstring Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-14traceroute: upgrade 2.1.0 -> 2.1.3Narpat Mali
This upgrade incorporates the CVE-2023-46316 fix and other bug fixes. Changelog: ---------- - Interpret ipv4-mapped ipv6 addresses (::ffff:A.B.C.D) as true ipv4. - Return back more robast poll(2) loop handling. - Fix unprivileged ICMP tracerouting with Linux kernel >= 6.1 (Eric Dumazet, SF bug #14) - Fix command line parsing in wrappers. References: https://security-tracker.debian.org/tracker/CVE-2023-46316 https://sourceforge.net/projects/traceroute/files/traceroute/traceroute-2.1.3/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-14emlog: ignore CVE-2022-3968 & CVE-2023-43291Yoann Congal
CVE-2022-3968 & CVE-2023-43291 apply to the other "emlog" and can be safely ignored. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-14emlog: Add PVKhem Raj
This is 0.70 release with few more commits on top. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 08edc0b6ace0d04688a5617cf05546a7b8ba6cca) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-14open-vm-tools: fix CVE-2023-34058Archana Polampalli
A flaw was found in open-vm-tools. This flaw allows a malicious actor that has been granted Guest Operation Privileges in a target virtual machine to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-34058 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> [minor fixup] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-14open-vm-tools: fix CVE-2023-20900Narpat Mali
A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID -6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download. vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31 e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . References: https://nvd.nist.gov/vuln/detail/CVE-2023-20900 https://security-tracker.debian.org/tracker/CVE-2023-20900 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> [Minor fixup] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-03indent: fix CVE-2023-40305Yogita Urade
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file. Reference: https://savannah.gnu.org/bugs/index.php?64503 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-03packagegroup-meta-multimedia: restore x11 restriction for projucerMartin Jansa
* it was removed in: https://git.openembedded.org/meta-openembedded/commit/?id=deb11a823c32d4090b3724a589641810e06df6bc * but still needed as shown in world build without x11 in DISTRO_FEATURES: ERROR: Nothing RPROVIDES 'projucer' (but /OE/build/luneos-nanbield/meta-openembedded/meta-multimedia/recipes-multimedia/packagegroups/packagegroup-meta-multimedia.bb RDEPENDS on or otherwise requires it) projucer was skipped: missing required distro feature 'x11' (not in DISTRO_FEATURES) NOTE: Runtime target 'projucer' is unbuildable, removing... Missing or unbuildable dependency chain was: ['projucer'] Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-03mbedtls: upgrade 3.4.0 -> 3.5.0Beniamin Sandu
* Includes security fix for CVE-2023-43615 - Buffer overread in TLS stream cipher suites * Includes security fix for CVE-2023-45199 - Buffer overflow in TLS handshake parsing with ECDH * Includes aesce compilation fixes Full changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.5.0 The extra patch fixes x86 32-bit builds. Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-03suiteparse: Adapt to upstream branch name changesRichard Purdie
meta-oe master branch already made this change. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-03python-blivet: Adapt to upstream branch name changesRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-03grubby: Update branchname to match upstreamRichard Purdie
meta-oe master already made this change along with others. Update the branchname to match upstream repository changes to allow fetching to continue to work. Drop unneeded duplicate semicolon too. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-03ntfs-3g-ntfsprogs: Upgrade 2022.5.17 to 2022.10.3Omkar Patil
Changes: Rejected zero-sized runs Avoided merging runlists with no runs Fix CVE-2022-40284 Dunfell and master both have latest version of ntfs-3g-ntfsprogs 2022.10.3. Therefore, upgrade the version on kirkstone too. Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5d5e8854718dab02c2737e3faf288f830a514841) Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17mbedtls: upgrade 2.28.2 -> 2.28.5kirkstone-nextYi Zhao
This release includes security fix for CVE-2023-43615. Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.5 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> [Minor tweak to get it to apply] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17nginx: add configure optionJoe Slater
Support --with-http_xslt_module configure option via a PACKAGECONFIG option. The option is not added to the defaults. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e0ac8eec48ddddc93751cfcdef2557998bfe91c8) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17mbedtls: set up /usr/bin/hello as alternativeDenys Dmytriyenko
As mbedtls installs this rather generically-named /usr/bin/hello binary, it conflicts with the one provided by lmbench, hence set it up as an alternative to avoid conflicts when both are installed to rootfs or SDK. Signed-off-by: Denys Dmytriyenko <denis@denix.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17mosquitto: add missing Upstream-StatusMartin Jansa
Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17mosquitto: upgrade 2.0.17 -> 2.0.18Gianfranco Costamagna
Add two patches from Debian, pull requests proposed upstream as 2894 and 2895 to make it start only when board is online, and to fix dynamic websockets link failure Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17mosquitto: upgrade 2.0.15 -> 2.0.17Gianfranco Costamagna
Fix for CVE-2023-28366, CVE-2023-0809, CVE-2023-3592 Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@yahoo.it> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17mosquitto: do not automatically depend on dlt-daemon, it's a non-mandatory ↵Gianfranco Costamagna
logging system Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17mosquitto: upgrade 2.0.14 -> 2.0.15Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17python3-gevent: fix CVE-2023-41419Narpat Mali
An issue in Gevent Gevent before version 23.9.1 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component. References: https://nvd.nist.gov/vuln/detail/CVE-2023-41419 https://github.com/advisories/GHSA-x7m3-jprg-wc5g Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17open-vm-tools: fix CVE-2023-20867Meenali Gupta
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17samba: fix CVE-2023-34968Polampalli, Archana
A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path. Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17samba:fix CVE-2023-34967Polampalli, Archana
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17samba: fix CVE-2022-2127Polampalli, Archana
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-17samba: fix CVE-2023-34966Polampalli, Archana
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-27python3-django: upgrade 4.2.3 -> 4.2.5Narpat Mali
The delta between 4.2.3 and 4.2.5 contains the CVE-2023-41164 fix and other bugfixes. git log --oneline 4.2.3..4.2.5 shows: b8b2f74512 (tag: 4.2.5) [4.2.x] Bumped version for 4.2.5 release. 9c51b4dcfa [4.2.x] Fixed CVE-2023-41164 -- Fixed potential DoS in django.utils.encoding.uri_to_iri(). acfb427522 [4.2.x] Fixed #34803 -- Fixed queryset crash when filtering againts deeply nested OuterRef annotations. 55a0b9c32e [4.2.x] Added stub release notes and release date for 4.2.5, 4.1.11, and 3.2.21. 8e8c318449 [4.2.x] Avoided counting exceptions in AsyncClient docs. dcb9d7a0e4 [4.2.x] Improved formset docs by using a set instead of a list in the custom validation example. f55b420277 [4.2.x] Fixed #34781 -- Updated logging ref docs for django.server's request extra context value. 46b2b08e45 [4.2.x] Fixed #34779 -- Avoided unnecessary selection of non-nullable m2m fields without natural keys during serialization. d34db6602e [4.2.x] Fixed #34773 -- Fixed syncing DEFAULT_FILE_STORAGE/STATICFILES_STORAGE settings with STORAGES. a22aeef555 [4.2.x] Fixed #15799 -- Doc'd that Storage._open() should raise FileNotFoundError when file doesn't exist. 936afc2deb [4.2.x] Refs #34754 -- Added missing FullResultSet import. 3a1863319c [4.2.x] Fixed #34754 -- Fixed JSONField check constraints validation on NULL values. 951dcbb2e6 [4.2.x] Fixed #34756 -- Fixed docs HTML build on Sphinx 7.1+. a750fd0d7f [4.2.x] Added stub release notes for 4.2.5. a56c46642d [4.2.x] Post-release version bump. 6f4c7c124a (tag: 4.2.4) [4.2.x] Bumped version for 4.2.4 release. e53d6239df [4.2.x] Added release date for 4.2.4. 8808d9da6b [4.2.x] Fixed #34750 -- Fixed QuerySet.count() when grouping by unused multi-valued annotations. 2ef2b2ffc0 [4.2.x] Corrected pycon formatting in some docs. 8db9a0b5a0 [4.2.x] Fixed warnings per flake8 6.1.0. 739da73164 [4.2.x] Fixed #34748 -- Fixed queryset crash when grouping by a reference in a subquery. a52a2b6678 [4.2.x] Fixed #34749 -- Corrected QuerySet.acreate() signature in docs. 12ebd9a1ac [4.2.x] Refs #34712 -- Doc'd that defining STORAGES overrides the default configuration. 1f9d00ef9f [4.2.x] Added missing backticks in docs. c99d935600 [4.2.x] Fixed typo in docs/ref/models/querysets.txt. da92a971a0 [4.2.x] Refs #30052 -- Clarified that defer() and only() do not work with aggregated fields. 7a67b065d7 [4.2.x] Fixed #34717 -- Fixed QuerySet.aggregate() crash when referencing window functions. c646412a75 Added reference to TypedChoiceField in ChoiceField docs. f474ba4cb5 [4.2.x] Fixed #34309 -- Doc'd how to fully delete an app. e54f711d42 [4.2.x] Fixed #33405, Refs #7177 -- Clarified docs for filter escapejs regarding safe and unsafe usages. 047844270b [4.2.x] Added stub release notes for 4.2.4. Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.5/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-27python3-django: upgrade 3.2.20 -> 3.2.21Narpat Mali
The delta between 3.2.20 and 3.2.21 contains the CVE-2023-41164 fix and other bugfixes. git log --oneline 3.2.20..3.2.21 shows: fd0ccd7fb3 (tag: 3.2.21) [3.2.x] Bumped version for 3.2.21 release. 6f030b1149 [3.2.x] Fixed CVE-2023-41164 -- Fixed potential DoS in django.utils.encoding.uri_to_iri(). 73350a6369 [3.2.x] Added stub release notes for 3.2.21. 75418f8c0e [3.2.x] Fixed #34756 -- Fixed docs HTML build on Sphinx 7.1+. 848fe70f3e [3.2.x] Added CVE-2023-36053 to security archive. 4012a87a58 [3.2.x] Post-release version bump. Release Notes: https://docs.djangoproject.com/en/dev/releases/3.2.21/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-27python3-django: fix CVE-2023-41164Narpat Mali
In Django 3.2 before 3.2.21, 4 before 4.1.11, and 4.2 before 4.2.5, ``django.utils.encoding.uri_to_iri()`` was subject to potential denial of service attack via certain inputs with a very large number of Unicode characters. Since, there is no ptest available for python3-django so have not tested the patch changes at runtime. References: https://security-tracker.debian.org/tracker/CVE-2023-41164 https://www.djangoproject.com/weblog/2023/sep/04/security-releases/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-27c-ares: CVE-ID correction for CVE-2022-4904Shinu Chandran
- The c-ares commit https://github.com/c-ares/c-ares/commit/9903253c347f (Add str len check in config_sortlist to avoid stack overflow), fixes the CVE-2022-4904 instead of CVE-2022-4415 https://security-tracker.debian.org/tracker/CVE-2022-4904 - CVE-ID inside the CVE-2022-4904.patch is wrong in the OE commit[092e125f44f6] - Hence corrected the CVE-ID in CVE-2022-4904.patch Signed-off-by: Shinu Chandran <shinucha@cisco.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-27openldap: update to 2.5.16Armin Kuster
2.5.x is an LTS version per the project. Drop patch now included. Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-23frr: Fix CVE-2023-41909Armin Kuster
An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference. References: https://nvd.nist.gov/vuln/detail/CVE-2023-41909 https://security-tracker.debian.org/tracker/CVE-2023-41909 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> [Minor fixup ] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-23freeglut: Add packageconfigs for x11/wayland/glesKhem Raj
helps it compiling on on different openGL implementations which may not implement fulll openGL specs Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a9212722c1b1a2ab29215651063ca94fb114c39b) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-23wireshark: Fix CVE-2023-2906Hitendra Prajapati
Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/44dc70cc5aadca91cb8ba3710c59c3651b7b0d4d Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2023-09-23redis: upgrade 7.0.12 -> 7.0.13Polampalli, Archana
This release has only security and bug fixes. ChangeLog: https://github.com/redis/redis/releases/tag/7.0.13 Security Fixes: https://nvd.nist.gov/vuln/detail/CVE-2023-41053 $ git log --oneline 7.0.12..7.0.13 49dbedb1d (tag: 7.0.13, origin/7.0) Redis 7.0.13 0f14d3279 Fix sort_ro get-keys function return wrong key number (#12522) 4d67bb6af do not call handleClientsBlockedOnKeys inside yielding command (#12459) 37599fe75 Ensure that the function load timeout is disabled during loading from RDB/AOF and on replicas. (#12451) ea1bc6f62 Process loss of slot ownership in cluster bus (#12344) 646069a90 Skip test for sdsRemoveFreeSpace when mem_allocator is not jemalloc (#11878) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2023-09-23rabbitmq-c: Fix CVE-2023-35789Soumya Sambu
An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., for amqp-publish or amqp-consume) and are thus visible to local attackers by listing a process and its arguments. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-35789 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
2023-09-19opensc: ignore CVE-2021-34193Jose Quaresma
The CVE-2021-34193 is a duplicate CVE covering the 5 individual already fixed. https://github.com/OpenSC/OpenSC/pull/2855 Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-19hdf5: Fix CVE-2021-37501Mingli Yu
Backport a patch [1] to fix CVE-2021-37501. [1] https://github.com/HDFGroup/hdf5/commit/b16ec83d4bd79f9ffaad85de16056419f3532887 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-06hwloc: fix CVE-2022-47022Soumya Sambu
An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. References: https://nvd.nist.gov/vuln/detail/CVE-2022-47022 https://github.com/open-mpi/hwloc/issues/544 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-06iperf3: upgrade 3.11 -> 3.14Soumya Sambu
Upgrade iperf3 to 3.14 Fix CVE-2023-38403 and other bugs. The iperf3 release notes are available at: https://github.com/esnet/iperf/blob/99d738f496c96fd4fb50f45142e0bbc96bf71698/RELNOTES.md The only change in the LICENSE file was the year update: https://github.com/esnet/iperf/commit/6bfe27d82a3f74ad1239aba987a4fb75c1005078 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-19 02:29:45 +0000