aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2021-01-10php: CVE-2020-7070Zheng Ruoqin
Security Advisory References https://nvd.nist.gov/vuln/detail/CVE-2020-7070 https://bugs.php.net/patch-display.php?bug=79699&patch=fix-urldecode&revision=1600650364 https://github.com/php/php-src/blob/master/main/php_variables.c Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit aff8a1fefb9a1a311e5ba14ad69871514270803a) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10samba: CVE-2020-14383 Security AdvisoryZheng Ruoqin
References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14383 Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit baee1ebeafce5d6a99dafc30b91e6fb760197686) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10samba: CVE-2020-14318 Security AdvisoryZheng Ruoqin
References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14318 Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 1d44b4c03d51e91ce01cf5fd0b33155ce36f1862) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10zabbix: CVE-2020-15803 Security AdvisoryWang Mingyu
References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15803 Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d259144422bb44af9dbc7397fc4077d0bf3fc83f) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10mcpp: Normalize the patch format of CVEZang Ruochen
Because CVE-2019-14274.patch is included in ice-mcpp.patch, the cve-check-tool fails to correctly judge the CVE of the OSS. CVE-2019-14274.patch is separated from ice-mcpp.patch to fix the problem. Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9301b77e3266160ffb7e9bfd69d445f0392076c8) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-12-20Revert "gnome-calendar: update to 3.38.1, add libhandy 1.x support"Armin Kuster
This change causes build failure: Found CMake: NO | Run-time dependency libhandy-1 found: NO (tried pkgconfig) | | ../gnome-calendar-3.38.1/meson.build:166:0: ERROR: Dependency "libhandy-1" not found, tried pkgconfig Gategarth Core version of libandy is 0.0.13 so this patch is puzzling This reverts commit 46ac17595bbd74a3dbcfbc7b5e1456ff78f5dca7. Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-12-14pcsc-lite: provide pcsc-lite-lib-native explicitly for native buildRoland Hieber
Commits e2180b00b3b8fcf776c3 and 8edd760e66b48e411d2a added support for native builds for the opensc and pcsc-lite recipes, but building opensc-native fails after commit 40b3a5123120da0e4586 (2019-12-04, "opensc: fix RDEPENDS in pcsc PACKAGECONFIG") with: ERROR: Required build target 'opensc-native' has no buildable providers. Missing or unbuildable dependency chain was: ['opensc-native', 'pcsc-lite-lib-native'] The commit in question is correct for target builds, but native builds don't have packages, therefore there is no pcsc-lite-lib-native package to depend on – the -lib part is also provided in pcsc-lite-native. Ideally we would fix this in the opensc recipe. However, using syntax like "PACKAGECONFIG_class-native[pcsc]" in the opensc recipe is apparently not possible to overwrite the dependency for a native build, and using RDEPENDS_remove has no effect either – apparently dependencies from PACKAGECONFIG are added after RDEPENDS_remove is evaluated. Therefore let pcsc-lite provide the missing package name for native builds, even if fixing this unrelated package is not the most elegant solution. Fixes: 40b3a5123120da0e4586 (2019-12-04, "opensc: fix RDEPENDS in pcsc PACKAGECONFIG") Signed-off-by: Roland Hieber <rhi@pengutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-12-14dlt-daemon: add upstream patch to fix CVE-2020-29394Gianfranco
More information on: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976228 | A buffer overflow in the dlt_filter_load function in dlt_common.c in | dlt-daemon 2.8.5 (GENIVI Diagnostic Log and Trace) allows arbitrary | code execution because fscanf is misused (no limit on the number of | characters to be read in a format argument). Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@yahoo.it> Signed-off-by: Gianfranco Costamagna <locutusofborg@debian.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-12-14tcpdump: Patch for CVE-2020-8037viatsk
Signed-off-by: Stacy Gaikovaia <stacy.gaikovaia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-12-14php: remove the failing ${D}/${TMPDIR} codeMax Kellermann
Appending ${TMPDIR} to ${D} doesn't make any sense, because both are absolute paths. And additionally, the code fails: rmdir: failed to remove '/usr/src/oe/tmp-musl/work/core2-64-oe-linux-musl/php/7.1.9-r0/image//usr': Directory not empty Signed-off-by: Max Kellermann <max.kellermann@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-12-14minifi-cpp: depend on nettle and lz4Yi Zhao
Add nettle and lz4 to DEPENDS to make the minifi extension archive support crypto and lz4. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-12-09lvm2.inc: switch branch master to mainHongxu Jia
Keep sync with upstream Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-05Revert "numactl: Remove the recipe"Martin Jansa
This reverts commit e5d9133800f5c37172a6315d42a99464f9fe1902. It exists in oe-core/master, but not in oe-core/gatesgarth, so this shouldn't be included in meta-oe/gatesgarth. Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04README: updated Maintainers list for GatesgarthArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-ipython: Upgrade 7.18.1 -> 7.19.0Leon Anavi
Upgrade to release 7.19.0: - Fix to restore the ability to specify more than one extension using command line flags when using traitlets 5.0 - Docs docs formatting that make the install commands work on zsh - Always display the last frame in tracebacks even if hidden with __traceback_hide__ - Avoid an issue where a callback can be registered multiple times. - Avoid an issue in debugger mode where frames changes could be lost. - Never hide the frames that invoke a debugger, even if marked as hidden by __traceback_hide__ - Fix calling the debugger in a recursive manner Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-tornado: Upgrade 6.0.4 -> 6.1Leon Anavi
Upgrade to release 6.1: - Windows support has been improved. Tornado is now compatible with the proactor event loop (which became the default in Python 3.8) by automatically falling back to running a selector in a second thread. This means that it is no longer necessary to explicitly configure a selector event loop, although doing so may improve performance. This does not change the fact that Tornado is significantly less scalable on Windows than on other platforms. - Binary wheels are now provided for Windows, MacOS, and Linux (amd64 and arm64). - This is the last release of Tornado to support Python 3.5. Future versions will require Python 3.6 or newer License-Update: Checksum change, lisense remains "Apache-2.0" Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-kiwisolver: Upgrade 1.3.0 -> 1.3.1Leon Anavi
Upgrade to release 1.3.1: - allow to avoid linking against VC2014_1 on windows - do not mark move constructor / assignment operator of expression as noexcept. This is to circumvent a suspected bug in the GCC compiler in the manylinux1 image. Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-pyinotify: Add missing ctypes dependencyMark Jonas
pyinotify 0.9.6 has a runtime dependency on ctypes. See https://github.com/seb-m/pyinotify/blob/0.9.6/python3/pyinotify.py#L82 pyinotify prefers ctypes to inotify_syscalls. The latter is only a fallback. See https://github.com/seb-m/pyinotify/blob/0.9.6/python3/pyinotify.py#L129 Signed-off-by: Mark Jonas <toertel@gmail.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-langtable: Upgrade 0.0.53 -> 0.0.54Leon Anavi
Upgrade to release 0.0.54: - Add list_common_languages derived from gnome-control-center Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-dateparser: Upgrade 0.7.6 -> 1.0.0Leon Anavi
Upgrade to release 1.0.0: - Drop support for Python 2.7 and pypy - Now DateDataParser.get_date_data() returns a DateData object instead of a dict - From now wrong settings are not silenced and raise SettingValidationError - Now dateparser.parse() is deterministic and doesn't try previous locales. Also, DateDataParser.get_date_data() doesn't try the previous locales by default - Remove the 'base-formats' parser - Extract the 'no-spaces-time' parser from the 'absolute-time' parser and make it an optional parser - Remove numeral_translation_data - Remove the undocumented SKIP_TOKENS_PARSER and FUZZY settings - Remove support for using strings in date_formats - The undocumented ExactLanguageSearch class has been moved to the private scope and some internal methods have changed - Changes in dateparser.utils: normalize_unicode() doesn't accept bytes as input and convert_to_unicode has been deprecated - Add Python 3.9 support - Detect hours separated with a period/dot - Add support for "decade" - Add support for the hijri calendar in Python ≥ 3.6 - New logo! - Improve the README and docs - Fix the "calendars" extra - Fix leap years when PREFER_DATES_FROM is set - Fix STRICT_PARSING setting in no-spaces-time parser - Consider RETURN_AS_TIME_PERIOD setting for relative-time parser - Parse the 24hr time format with meridian info - Other small improvements Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-regex: Upgrade 2020.10.23 -> 2020.10.28Leon Anavi
Upgrade to release 2020.10.28: - Added Apache 2.0 licence file to the files in the git repository Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-aiofiles: Upgrade 0.5.0 -> 0.6.0Leon Anavi
Upgrade to release 0.6.0: - aiofiles is now tested on ppc64le. - Added name and mode properties to async file objects. - Fixed a DeprecationWarning internally. - Python 3.9 support and tests. Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-aiohttp: Upgrade 3.7.1 -> 3.7.2Leon Anavi
Upgrade to release 3.7.2: - Fixed static files handling for loops without .sendfile() support Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-kiwisolver: Upgrade 1.2.0 -> 1.3.0Leon Anavi
Upgrade to release 1.3.0: - add c++ benchmarks and run them on CIs - modernize the c++ code by using more c++11 features - introduce move semantic in some c++ constructors to improve performances - add support for Python 3.9 Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-sh: Upgrade 1.14.0 -> 1.14.1Leon Anavi
Upgrade to release 1.14.1: - bugfix where setting _ok_code to not include 0, but 0 was the exit code Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-markdown: Upgrade 3.3.2 -> 3.3.3Leon Anavi
Upgrade to release 3.3.3: - Unify all block-level tags - Fix issue where some empty elements would have text rendered as None when using md_in_html - Avoid catastrophic backtracking in hr regex - Fix hr HTML handling Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-pyexpect: Upgrade 1.0.20 -> 1.0.21Leon Anavi
Upgrade to release 1.0.21: - Ensure .includes() handles a generator correcly - Also check python 3.8 and 3.9 - Ignore tox directory Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-cryptography-vectors: Upgrade 3.1.1 -> 3.2Leon Anavi
Upgrade to release 3.2: - SECURITY ISSUE: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability and a future release will contain a new API which is designed to be resilient to these for contexts where it is required. Credit to Hubert Kario for reporting the issue. CVE-2020-25659 - Support for OpenSSL 1.0.2 has been removed. Users on older version of OpenSSL will need to upgrade. - Added basic support for PKCS7 signing (including SMIME) via :class:`~cryptography.hazmat.primitives.serialization.pkcs7.PKCS7SignatureBuilder`. Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04python3-luma-oled: Upgrade 3.6.0 -> 3.7.0Leon Anavi
Upgrade to release 3.7.0: - Drop support for Python 3.5, only 3.6 or newer is supported now - Add support for SSD1351 128x96 display - Pin luma.core to 1.x.y line only, in anticipation of performance improvements in upcoming major release Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Acked-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-04kernel-selftest: Disable vm packageconfig for riscvKhem Raj
it now needs libhugetlbfs which is not ported to riscv yet Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03geoclue: Use git fetcherKhem Raj
gitlab archives are not consistent and can be regenerated as well like github, its therefore better to use git fetcher directly Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03networkd-dispatcher: Upgrade to 2.1Khem Raj
Drop gitlab archives and use git fetcher directly instead Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03ibus: Update to 1.5.3 plus fix for vala 0.50Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03mdbus2: Fix build with vala 0.50Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03remmina: Update to 1.4.8Khem Raj
Use git fetcher instead of gitlab archives Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03musl-nscd: Update to latestKhem Raj
Get fix https://github.com/pikhq/musl-nscd/commit/ce81a80e30c2041d8260115fac86831ff64c354a Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03quagga: unify volatiles file nameYi Zhao
Make the volatiles file name starts with digital. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03upgrade and de-blacklist nanopb recipeJasper Orschulko
The current nanopb recipe is blacklisted due to python2 dependencies. However, newer releases of nanopb use python3 by default. This commit updates the used nanopb version to 0.4.3 and removes the recipe from the blacklist. Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03numactl: Remove the recipeRandy Witt
The numactl recipe now exists in openembedded-core, as of commit dda815792b0939b2f233aa3ec7c140fc114a37d1 to oe-core. It was moved to facilitate the requirement rt-tests now has on libnuma. Signed-off-by: Randy Witt <randy.e.witt@linux.intel.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03libssh2: fix ptestSakib Sajal
One of the ptest was failing as it was missing an RDEPENDS for its test on documentation. Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03mbedtls: Fix typo in PACKAGECONFIGMark Jonas
Signed-off-by: Mark Jonas <toertel@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-03graphviz: Upgrade to 2.44.1 releaseKhem Raj
- Refresh patches to apply on new sources - Switch away from gitlab archives - Bypass pdf documentation generation Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-02minifi-cpp: Fix build with riscv64/clangKhem Raj
Do not use lld linker on risc64, since it errors out riscv64-yoe-linux-ld.lld: error: init.c:(.text+0x0): relocation R_RISCV_ALIGN requires unimplemented linker relaxation; recompile with -mno-relax Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-02libgpiod: update v1.4.4 -> v1.4.5Bartosz Golaszewski
This bugfix release contains a couple fixes for C++ and Python bindings. Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-02gperftools: Fix build with new musl updatesKhem Raj
Latest musl shows build failures e.g. ../git/src/profile-handler.cc:275:8: error: no member named '_sigev_un' in 'sigevent' sevp._sigev_un._tid = sys_gettid(); ~~~~ ^ Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-02wireguard-tools: upgrade 1.0.20200513 -> 1.0.20200827Ricardo Salveti
Changelog: - 7a321ce version: bump - 91fbeb4 Revert "wg-quick: wait on process substitutions" - 9a0d65e wg-quick: android: use iproute2 to bring up interface instead of ndc - fbca033 version: bump - 26683f6 wg-quick: wait on process substitutions - 13fac76 ctype: use non-locale-specific ctype.h - cf2bf09 pubkey: isblank is a subset of isspace - b4a8a18 man: wg-quick: use syncconf instead of addconf for strip example - a66219f systemd: add reload target to systemd unit - eb4665e wincompat: fold random into genkey - 197995d ipc: split into separate files per-platform Signed-off-by: Ricardo Salveti <ricardo@foundries.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-02wireguard-module: upgrade 1.0.20200712 -> 1.0.20200908Ricardo Salveti
Changelog: - d97b575 version: bump - 482d020 peerlookup: take lock before checking hash in replace operation - dace9d0 compat: backport NLA policy macros - a28032f netlink: consistently use NLA_POLICY_MIN_LEN() - 515d544 netlink: consistently use NLA_POLICY_EXACT_LEN() - 1a41e32 compat: backport kfree_sensitive and switch to it - 90a9e82 compat: drop support for SUSE 15.1 - a567b4c version: bump - 4213ef0 compat: add missing headers for ip_tunnel_parse_protocol - 5a45add compat: ipv6_dst_lookup_flow was ported to rhel 7.9 beta - 372427a compat: allow override of depmod basedir - f04dae1 compat: rhel 8.3 beta removed nf_nat_core.h Signed-off-by: Ricardo Salveti <ricardo@foundries.io> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-02redis: Fix build on 32bit targets and clangKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-02spirv-tools: moved into OE-core, delete from meta-oeJose Quaresma
https://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=5f6470eb2c1e5b5aa578031830f057d63d4ae230 Signed-off-by: Jose Quaresma <quaresma.jose@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-11-02chrony: Patch CVE-2020-14367Anatol Belski
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-11-12 11:43:20 +0000