summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* mosquitto: upgrade 2.0.19 -> 2.0.20Wang Mingyu2024-12-311-1/+1
| | | | | | | | | | | | | | | | | | | | | Changelog: ========== Broker: - Fix QoS 1 / QoS 2 publish incorrectly returning "no subscribers". Closes #3128. - Open files with appropriate access on Windows. - Don't allow invalid response topic values. - Fix some strict protocol compliance issues. Client library: - Fix cmake build on OS X. Build: - Fix build on NetBSD Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com>
* mosquitto: upgrade 2.0.18 -> 2.0.19Fabrice Aeschbacher2024-12-313-50/+1
| | | | | | | | | | | | - Solves CVE-2024-8376 - removed 1571.patch and 2894.patch, already applied in v2.0.19 https://github.com/eclipse/mosquitto/blob/v2.0.19/ChangeLog.txt Signed-off-by: Fabrice Aeschbacher <fabrice.aeschbacher@siemens.com> Reviewed-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com>
* nspr: Fix build with clang16Khem Raj2024-12-312-0/+40
| | | | | | | * also needed for nspr-native build with gcc-14 on host Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
* hostapd: Patch security advisory 2024-2Peter Marko2024-12-313-0/+92
| | | | | | | | | | | | Pick patches according to http://w1.fi/security/2024-2/sae-h2h-and-incomplete-downgrade-protection-for-group-negotiation.txt SAE H2E and incomplete downgrade protection for group negotiation Patch 0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch was removed as it only patched wpa_supplicant. The patch names were not changed so it is comparable with wpa_supplicant recipe. Signed-off-by: Peter Marko <peter.marko@siemens.com>
* hostapd: Patch CVE-2024-3596Peter Marko2024-12-319-0/+618
| | | | | | | | | | | | | Picked patches according to http://w1.fi/security/2024-1/hostapd-and-radius-protocol-forgery-attacks.txt First patch is style commit picked to have a clean cherry-pick of all mentioned commits without any conflict. Patch CVE-2024-3596_03.patch was removed as it only patched wpa_supplicant. The patch names were not changed so it is comparable with wpa_supplicant recipe. Signed-off-by: Peter Marko <peter.marko@siemens.com>
* libgsf: Upgrade 1.14.49 -> 1.14.53Zhang Peng2024-12-081-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: libgsf 1.14.53 * Compilation fixes for libxml 2.13 * Fix ABR in gsf-vba-dump. * Teach gsf (the tool) to handle odf properties. * Fix integer overflows affecting memory allocation. * Add missing "DocumentStatus" ole2 property. * Avoid some undefined C behaviour in overflow checks. libgsf 1.14.51 * Fix thumbnailer crash. * Fix leaks. libgsf 1.14.50 * Fix error handling problem when writing ole files. License changed to LGPL-2.1-only from 1.14.51 [https://gitlab.gnome.org/GNOME/libgsf/-/commit/037c913eb631349c410ef45e49697bf5c46dac8a] remove obsolete DEPENDS from upstream [103f49b5fc987e7bb8765700d16bd387a33b62ca] Security fixes: CVE-2024-42415 An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. CVE-2024-36474 An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Reference: [https://gitlab.gnome.org/GNOME/libgsf/-/issues/34] (master rev: 6ed5891c18fc78a69764af0a29ad9b5feefb1aa8) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: fix ↵Jiaying Song2024-12-086-0/+855
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-49081/CVE-2024-30251/CVE-2024-52304/CVE-2023-49082/CVE-2024-27306 CVE-2023-49081: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49081 Upstream patches: https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b CVE-2024-30251: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions. References: https://nvd.nist.gov/vuln/detail/CVE-2024-30251 Upstream patches: https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19 https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597 https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866 CVE-2024-52304: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue. References: https://nvd.nist.gov/vuln/detail/CVE-2024-52304 Upstream patches: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71 CVE-2023-49082: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49082 Upstream patches: https://github.com/aio-libs/aiohttp/pull/7806/commits/a43bc1779892e7014b7723c59d08fb37a000955e CVE-2024-27306: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade. References: https://nvd.nist.gov/vuln/detail/CVE-2024-27306 Upstream patches: https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397 Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* protobuf: fix CVE-2024-7254Chen Qi2024-12-082-0/+796
| | | | | | | | Backport patch with tweaks for the current version to fix CVE-2024-7254. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* php: upgrade 8.1.29 -> 8.1.30Yogita Urade2024-12-081-1/+1
| | | | | | | | | | | Includes fix for CVE-2024-8925, CVE-2024-8926, CVE-2024-8927 and CVE-2024-9026 Changelog: https://www.php.net/ChangeLog-8.php#8.1.30 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* p7zip: Fix CVE-2023-52169 and CVE-2023-52168hongxu2024-12-082-0/+456
| | | | | | | | | | | | | According to [1][2], Igor Pavlov, the author of 7-Zip, refused to provide an advisory or any related change log entries. Have to backport a part of ./CPP/7zip/Archive/NtfsHandler.cpp from upstream big commit https://github.com/ip7z/7zip/commit/fc662341e6f85da78ada0e443f6116b978f79f22 [1] https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/ [2] https://dfir.ru/wp-content/uploads/2024/07/screenshot-2024-07-03-at-02-13-40-7-zip-_-bugs-_-2402-two-vulnerabilities-in-the-ntfs-handler.png Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* hostapd: Security fix for CVE-2023-52160Yi Zhao2024-12-082-0/+199
| | | | | | | | | | | | | | | | | | | | CVE-2023-52160: The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-52160 Patch from: https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baffdea9e55255a81270b768439c Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ntfs-3g-ntfsprogs: fix CVE-2023-52890hongxu2024-12-082-0/+43
| | | | | | | | | Backport fix from upstream https://github.com/tuxera/ntfs-3g/commit/75dcdc2cf37478fad6c0e3427403d198b554951d Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* indent: fix CVE-2024-0911hongxu2024-12-082-0/+124
| | | | | | | | | Backport a fix from upstream to resolve CVE-2024-0911 https://git.savannah.gnu.org/git/indent.git feb2b646e6c3a05018e132515c5eda98ca13d50d Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* frr: fix multiple CVEsZhang Peng2024-12-086-1/+443
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2024-27913: ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OSPF LSA packet, because of an attempted access to a missing attribute field. CVE-2024-34088: In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling functions do not handle the returned NULL value, the OSPF daemon crashes, leading to denial of service. CVE-2024-31950: In FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets during an attempt to read Segment Routing subTLVs (their size is not validated). CVE-2024-31951: In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated). CVE-2024-31948: In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-27913] [https://nvd.nist.gov/vuln/detail/CVE-2024-34088] [https://nvd.nist.gov/vuln/detail/CVE-2024-31951] [https://nvd.nist.gov/vuln/detail/CVE-2024-31950] [https://nvd.nist.gov/vuln/detail/CVE-2024-31948] Upstream patches: [https://github.com/FRRouting/frr/commit/a73e66d07329d721f26f3f336f7735de420b0183] [https://github.com/FRRouting/frr/commit/8c177d69e32b91b45bda5fc5da6511fa03dc11ca] [https://github.com/FRRouting/frr/commit/5557a289acdaeec8cc63ffc97b5c2abf6dee7b3a] [https://github.com/FRRouting/frr/commit/f69d1313b19047d3d83fc2b36a518355b861dfc4] [https://github.com/FRRouting/frr/commit/babb23b74855e23c987a63f8256d24e28c044d07] [https://github.com/FRRouting/frr/commit/ba6a8f1a31e1a88df2de69ea46068e8bd9b97138] Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* freeradius: upgrade 3.0.21 -> 3.0.27Haixiao Yan2024-12-0820-1823/+192
| | | | | | | | | | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_27 Configuration changes: BlastRADIUS mitigations have been added to the "security" section. See require_message_authenticator and also limit_proxy_state. BlastRADIUS mitigations have been added to radclient. See man radclient, and the -b option. Security fixes: CVE-2024-3596: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-3596 https://www.freeradius.org/security/ https://www.blastradius.fail/ https://www.inkbridgenetworks.com/web/content/2557?unique=47be02c8aed46c53b0765db185320249ad873d95 Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> [Drop CVE-2024-3596 patch backported early] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openvpn: upgrade 2.5.6 -> 2.5.11Haixiao Yan2024-12-084-272/+2
| | | | | | | | | | | | | | | | | | License-Update: Add Apache2 linking for new commits [1] ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.5.11/Changes.rst Security fixes: CVE-2024-5594: control channel: refuse control channel messages with nonprintable characters in them. Security scope: a malicious openvpn peer can send garbage to openvpn log, or cause high CPU load. [1] https://github.com/OpenVPN/openvpn/commit/4a89a55b8a9d6193957711bef74228796a185179 Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: Upgrade 2.4.60 -> 2.4.62Archana Polampalli2024-12-081-1/+1
| | | | | | | | | | | | | CVE's Fixed by upgrade: CVE-2024-39884 CVE-2024-40725 Other Changes between 2.4.60 -> 2.4.62 ====================================== https://github.com/apache/httpd/blob/2.4.62/CHANGES Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nss: patch CVE-2024-6609Peter Marko2024-12-082-0/+31
| | | | | | | | | | | | | | | | | | | Pick the same patch as Debian took for bullseye. There is no direct backport to version prior 3.102 because commit NSS_3_101_BETA2-12-g8d94c529b [1] rewrote this code. Applied patch was proposed for old versions in [2] and already applied in Debian bullseye. I could not find suitable upstream status, inappropriate is the best I could pick from offered possibilities. [1] https://github.com/nss-dev/nss/commit/8d94c529b333194d080c4885ddd3a40e6c296ae9< [2] https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/t9JmsYkujWM/m/HjKuk-ngBAAJ Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nss: patch CVE-2024-6602Peter Marko2024-12-082-0/+66
| | | | | | | Pick the same patch as Debian took for bullseye. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* open-vm-tools: Security fixes CVE-2023-34059Yi Zhao2024-12-082-0/+189
| | | | | | | | | | | | | | | | | | CVE-2023-34059: open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-34059 Patch from: https://github.com/vmware/open-vm-tools/blob/CVE-2023-34059.patch/CVE-2023-34059.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mbedtls: Upgrade 2.28.8 -> 2.28.9Mingli Yu2024-12-081-1/+1
| | | | | | | | | | The mbedtls 2.28.9 includes the security fix for CVE-2024-45157, bug fixes and minor enhancements [1]. [1] https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.9 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* freeradius: Security fix for CVE-2024-3596Rohini Sangam2024-12-082-0/+1507
| | | | | | | | | | CVE fixed: - CVE-2024-3596 freeradius: forgery attack Upstream-Status: Backport from v3.0.x branch, commit range 3a00a6ecc188629b0441fd45ad61ca8986de156e..da643f1edc267ce95260dc36069e6f1a7a4d66f8 Signed-off-by: Rohini Sangam <rsangam@mvista.com> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* squid: conditionally set status of CVE-2024-45802Peter Marko2024-12-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | According to [1] the ESI feature implementation in squid is vulnerable without any fix available. NVD says it's fixed in 6.10, however the change in this release only disables ESI by default (which we always did via PACKAGECONFIG). Commit in master branch related to this CVE is [2]. Title is "Remove Edge Side Include (ESI) protocol" and it's also what it does. So there will never be a fix for these ESI vulnerabilities. We should not break features in LTS branch and cannot fix this problem. So ignrore this CVE based on set PACKAGECONFIG which should remove it from reports for most users. Thos who need ESI need to assess the risk themselves. [1] https://github.com/squid-cache/squid/security/advisories/GHSA-f975-v7qw-q7hj [2] https://github.com/squid-cache/squid/commit/5eb89ef3d828caa5fc43cd8064f958010dbc8158 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openipmi: upgrade 2.0.32->2.0.36Jiaying Song2024-12-084-103/+13
| | | | | | | | | | | | | | 2c4ab4a6c openipmi: fix do_configure error when using dash 03dd014eb openipmi: update 2.0.32 -> 2.0.34 Merge the above commits related to the upgrade, and then upgrade the version of openipmi from 2.0.34 to 2.0.36. Full changelog for openipmi:: https://sourceforge.net/p/openipmi/news/ Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-geomet: fix branch parameterMartin Jansa2024-12-081-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * drop unused SRC_URI[sha256sum] as this recipe uses git fetcher * release-0.3.0 branch doesn't exist, but the SRCREV is in master branch: geomet $ git branch -a --contains 73ec5ec96cca32f2e2461d3964fc3d4ab80248f9 * master remotes/origin/HEAD -> origin/master remotes/origin/master remotes/origin/release-1.0 remotes/origin/release-1.1.0 * release-0.3.0 branch doesn't exist even the tarball on MIRROR: https://sources.yoctoproject.org/mirror/sources/git2_github.com.geomet.geomet.git.tar.gz not sure when it was removed from upstream git repo, but it was removed: Pruning origin URL: https://github.com/geomet/geomet.git * [pruned] refs/heads/issue_esri_srid * [pruned] refs/pull/74/merge * [pruned] refs/pull/76/merge * [pruned] refs/pull/77/merge * [pruned] refs/heads/release-0.3.0 * master branch is used since mickledore upgrade to 1.0.0 in: https://git.openembedded.org/meta-openembedded/commit/?h=mickledore&id=382f7d51e3b92b8b7a23cd98f9bfc63c51a33dfd Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* poco: use main instead of master branchMartin Jansa2024-12-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Branches used in langdale, mickledore, nanbield were re-written in upstream :(, fixes were sent to meta-oe: langdale: https://lists.openembedded.org/g/openembedded-devel/message/107533 mickledore: https://lists.openembedded.org/g/openembedded-devel/message/107531 merged in: https://git.openembedded.org/meta-openembedded/commit/?h=mickledore&id=b0d67900ae9e8911f734c25c0674fe55df8cd188 nanbield: https://lists.openembedded.org/g/openembedded-devel/message/107532 merged in: https://git.openembedded.org/meta-openembedded/commit/?h=nanbield&id=2da6e1b0e43a8993fd422fee3f83940100b59f4c fix for langdale wasn't ever fixed because it was sent after langdale was already EOL, but looks like the version used in kirkstone got broken recently as well, because master branch was removed: poco/1.11.2-r0/git $ git branch -a --contains 9d1c428c861f2e5ccf09149bbe8d2149720c5896 * master ... remotes/origin/dev-task-test-diag remotes/origin/devel remotes/origin/feat/acceptor-service-handler-args remotes/origin/fix/posix-sleep remotes/origin/issue-templates remotes/origin/master remotes/origin/poco-1.12.0 remotes/origin/poco-1.12.1 remotes/origin/poco-1.12.2 remotes/origin/poco-1.12.3 remotes/origin/poco-1.12.4 remotes/origin/poco-1.12.5 remotes/origin/poco-1.12.6 remotes/origin/poco-1.9.5-not-released remotes/origin/poll-closed-server-test remotes/origin/upgrade-ci-actions-to-v3 poco/1.11.2-r0/git $ git remote prune origin Pruning origin URL: https://github.com/pocoproject/poco.git ... * [pruned] origin/android-ndk-action * [pruned] origin/develop * [pruned] origin/feat/wepoll * [pruned] origin/fix/PollSet-race * [pruned] origin/fix/swap-noexcept * [pruned] origin/master * [pruned] origin/poco-1.10.2 * [pruned] origin/poco-1.9.5 refs/remotes/origin/HEAD has become dangling! poco/1.11.2-r0/git $ git branch -a --contains 9d1c428c861f2e5ccf09149bbe8d2149720c5896 * master ... remotes/origin/dev-task-test-diag remotes/origin/devel remotes/origin/discourage-using-configure-and-make remotes/origin/feat/acceptor-service-handler-args remotes/origin/feat/json-logging remotes/origin/fix/posix-sleep remotes/origin/issue-templates remotes/origin/main remotes/origin/master-pre-1.13.0 remotes/origin/master-unused remotes/origin/openssl_fix remotes/origin/poco-1.12.0 remotes/origin/poco-1.12.1 remotes/origin/poco-1.12.2 remotes/origin/poco-1.12.3 remotes/origin/poco-1.12.4 remotes/origin/poco-1.12.5 remotes/origin/poco-1.12.6 remotes/origin/poco-1.13.0 remotes/origin/poco-1.13.1 remotes/origin/poco-1.13.2 remotes/origin/poco-1.13.3 remotes/origin/poco-1.13.4 remotes/origin/poco-1.9.5-not-released remotes/origin/poll-closed-server-test remotes/origin/release-1.14-changelog-authors remotes/origin/search-support remotes/origin/upgrade-ci-actions-to-v3 switch to main branch which is the most common and the least surprising. Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libjs-jquery-cookie: update branch from master to mainMartin Jansa2024-12-081-1/+1
| | | | | | | | | | | * it was updated in nanbield with upgrade to 3.0.5 in: fc0a506bde libjs-jquery-cookie: upgrade 3.0.1 -> 3.0.5 * drop duplicated protocol param as in mickledore: 2e0a581bee recipes: Remove double protocol= from SRC_URIs Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-lxml: ignore incompatible-pointer-types issues in native buildMartin Jansa2024-12-081-0/+2
| | | | | | | | | | | | | * to allow building native version on hosts with gcc-14 * it's properly fixed in 5.0.2 version sent to oe-core/scarthgap in: https://lists.openembedded.org/g/openembedded-core/message/206391 but for kirkstone we can just demote the issue back to warning * fixes: https://bugs.launchpad.net/lxml/+bug/2045435 Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitpkgv: Fix python deprecation warningKhem Raj2024-12-081-1/+1
| | | | | | | | | | Fixes DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13 pipes is an alias for shlex therefore switch to using shlex Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* flatbuffers: fix native build with gcc-14 on hostMartin Jansa2024-12-082-1/+30
| | | | | | | | | | | | | | | | | | | In C++ we cannot have both assignment operator and const member. Since span::operator= is defined, span::count_ constness must be removed. Fixes: FAILED: CMakeFiles/flatc.dir/src/util.cpp.o ccache flatbuffers/2.0.0/recipe-sysroot-native/usr/bin/aarch64-webos-linux/aarch64-webos-linux-g++ --sysroot=flatbuffers/2.0.0/recipe-sysroot -DFLATBUFFERS_LOCALE_INDEPENDENT=1 -Iflatbuffers/2.0.0/git/include -Iflatbuffers/2.0.0/git/grpc -mbranch-protection=standard -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Werror=return-type -funwind-tables --sysroot=flatbuffers/2.0.0/recipe-sysroot -O2 -pipe -g -feliminate-unused-debug-types -fcanon-prefix-map -fmacro-prefix-map=flatbuffers/2.0.0/git=/usr/src/debug/flatbuffers/2.0.0 -fdebug-prefix-map=flatbuffers/2.0.0/git=/usr/src/debug/flatbuffers/2.0.0 -fmacro-prefix-map=flatbuffers/2.0.0/build=/usr/src/debug/flatbuffers/2.0.0 -fdebug-prefix-map=flatbuffers/2.0.0/build=/usr/src/debug/flatbuffers/2.0.0 -fdebug-prefix-map=flatbuffers/2.0.0/recipe-sysroot= -fmacro-prefix-map=flatbuffers/2.0.0/recipe-sysroot= -fdebug-prefix-map=flatbuffers/2.0.0/recipe-sysroot-native= -fvisibility-inlines-hidden -fPIC -DNDEBUG -MD -MT CMakeFiles/flatc.dir/src/util.cpp.o -MF CMakeFiles/flatc.dir/src/util.cpp.o.d -o CMakeFiles/flatc.dir/src/util.cpp.o -c flatbuffers/2.0.0/git/src/util.cpp In file included from ../git/include/flatbuffers/util.h:23, from ../git/src/util.cpp:44: ../git/include/flatbuffers/stl_emulation.h: In member function 'constexpr flatbuffers::span<T, Extent>& flatbuffers::span<T, Extent>::operator=(const flatbuffers::span<T, Extent>&)': ../git/include/flatbuffers/stl_emulation.h:549:12: error: assignment of read-only member 'flatbuffers::span<T, Extent>::count_' 549 | count_ = other.count_; | ~~~~~~~^~~~~~~~~~~~~~ Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* vk-gl-cts: Fix branch namesRamax Lo2024-12-081-3/+3
| | | | | | | | The branch names of several upstream repos have been changed, thus we update the recipe to avoid fetching failure. Signed-off-by: Ramax Lo <ramaxlo@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireguard-tools: clean the do_fecth warningHaixiao Yan2024-12-081-1/+1
| | | | | | | | | | | Update SRC_URI, change the protocol to https. do_fetch warning: WARNING: wireguard-tools-1.0.20210914-r0 do_fetch: Failed to fetch URL git://git.zx2c4.com/wireguard-tools;branch=master, attempting MIRRORS if available Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sound-theme-freedesktop: Update SRC_URILiyin Zhang2024-10-131-1/+1
| | | | | Signed-off-by: Liyin Zhang <liyin.zhang.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* keyutils: Update SRC_URILiyin Zhang2024-10-131-1/+1
| | | | | Signed-off-by: Liyin Zhang <liyin.zhang.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libatasmart: Update SRC_URI to fix fetch issueLiyin Zhang2024-10-131-1/+1
| | | | | Signed-off-by: Liyin Zhang <liyin.zhang.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* xmlrpc-c: fix do_fetch errorGuocai He2024-10-131-1/+1
| | | | | | | | | Fetcher failure: Unable to find revision 86405c7e1bd4f70287204a28d242a1054daab520 in branch master Signed-off-by: Guocai He <guocai.he.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* rocksdb: Add ptest supportMingli Yu2024-10-132-2/+29
| | | | | | | | | | | | # ./run-ptest PASS: arena_test PASS: cache_test PASS: db_basic_test PASS: env_basic_test PASS: testutil_test Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cjson: upgrade 1.7.17 -> 1.7.18Peter Marko2024-10-131-1/+1
| | | | | | | | | | | | | | | | Changelog: ============ * Add NULL check to cJSON_SetValuestring()(CVE-2024-31755) * Remove non-functional list handling of compiler flags * Fix heap buffer overflow * remove misused optimization flag -01 * Set free'd pointers to NULL whenever they are not reassigned immediately after Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (From meta-openembedded rev: 535822eff7647b6363225bb8f04d2d7d59a71204) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* android-tools: Create flag file /etc/usb-debugging-enabledDmitry Baryshkov2024-10-131-1/+1
| | | | | | | | | | | | | | | | Location of the file that systemd uses to check whether to start adbd or not has been updated from /var to /etc in android-tools-adbd.service. This change changes the path of creation of usb-debugging-enabled flag file in android-tools recipes from /var/usb-debugging-enabled to /etc/usb-debugging-enabled Backport-of: 2a3d4be9994e ("android-tools: create flag flag file for adbd at a proper location") Fixes: a29c6386d576 ("android-toold-adbd: Fix inconsistency between selinux configurations") Fixes: 8106cfe769aa ("android-tools-adbd.service: Change /var to /etc in ConditionPathExists") Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Raghuvarya S <quic_raghuvar@quicinc.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* android-tools-adbd.service: Update ConditionPathExists to /etcRaghuvarya S2024-10-131-1/+1
| | | | | | | | | | | | | | To ensure android-tools-adbd.service starts at boot, the path for ConditionPathExists must be present at build time. /etc is more suitable for build-time files than /var, which is for runtime files. Changed ConditionPathExists from /var/usb-debugging-enabled to /etc/usb-debugging-enabled Backport-of: 8106cfe769aa ("android-tools-adbd.service: Change /var to /etc in ConditionPathExists") CC: Khem Raj <raj.khem@gmail.com> CC: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Raghuvarya S <quic_raghuvar@quicinc.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tgt: Security fix for CVE-2024-45751Vijay Anusuri2024-10-132-0/+69
| | | | | | | | | Upstream-Status: Backport from https://github.com/fujita/tgt/commit/abd8e0d987ab56013d360077202bf2aca20a42dd Reference: https://ubuntu.com/security/CVE-2024-45751 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* frr: fix CVE-2024-44070Divya Chellam2024-10-132-0/+70
| | | | | | | | | | | | | | | An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-44070 Upstream patch: https://github.com/FRRouting/frr/commit/0998b38e4d61179441f90dd7e7fd6a3a8b7bd8c5 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libdevmapper: Inherit nopackagesPeter Kjellerstedt2024-10-131-0/+2
| | | | | | | | | | This fixes errors from buildhistory changes where packages-split would be empty. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 90f96e053ad3eefa7693d9748efdfbfa72d7dcfd) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-smbus2: Fix LIC_FILES_CHKSUMNiko Mauno2024-09-221-1/+1
| | | | | | | | | Change the reference to the MIT license containing LICENSE file in the downloaded archive. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-haversine: Fix LIC_FILES_CHKSUMNiko Mauno2024-09-221-1/+1
| | | | | | | | | Change the reference to the MIT license containing LICENSE file in the downloaded archive. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-googleapis-common-protos: Fix LIC_FILES_CHKSUMNiko Mauno2024-09-221-1/+1
| | | | | | | | | Change the reference to the Apache-2.0 license containing LICENSE file in the downloaded archive. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pycurl: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | Contents of https://github.com/pycurl/pycurl/blob/REL_7_45_1/COPYING-LGPL correspond to version 2.1 of the license rather than 2.0. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-fann2: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | | According to https://github.com/FutureLinkCorporation/fann2/tree/1.1.2?tab=readme-ov-file#license and https://github.com/FutureLinkCorporation/fann2/blob/1.1.2/LICENSE this project is subject to LGPL-2.1-only license. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-colorama: Fix LICENSENiko Mauno2024-09-221-1/+1
| | | | | | | | | | https://github.com/tartley/colorama?tab=readme-ov-file#license and https://github.com/tartley/colorama/blob/0.4.4/LICENSE.txt declare that this project is subject to BSD-3-Clause license. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pillow: Fix LICENSE and change SUMMARY to DESCRIPTIONNiko Mauno2024-09-221-2/+2
| | | | | | | | | | | | | According to https://pypi.org/project/pillow/ and https://github.com/python-pillow/Pillow/blob/9.4.0/LICENSE the project is subject to HPND license. Also change SUMMARY to DESCRIPTION as it's value is clearly over 72 characters long. Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-24 00:16:57 +0000