summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* samba: fix CVE-2023-42669Archana Polampalli2024-01-122-0/+95
| | | | | | | | | | | | | | | | | | | | A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task. References: https://nvd.nist.gov/vuln/detail/CVE-2023-42669 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cjson: upgrade 1.7.15 -> 1.7.17Archana Polampalli2024-01-121-1/+1
| | | | | | | | | | | The following CVEs are addressed in this release. CVE-2023-50471 CVE-2023-50472 https://github.com/DaveGamble/cJSON/releases/tag/v1.7.17 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-pillow: Fix CVE-2023-44271dnyandev2024-01-122-0/+157
| | | | | | | | | | Add patch to fix CVE-2023-44271 Reference: https://github.com/python-pillow/Pillow/commit/1fe1bb49c452b0318cad12ea9d97c3bef188e9a7 Signed-off-by: Dnyandev Padalkar <padalkards17082001@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* strongswan: upgrade 5.9.6 -> 5.9.12Archana Polampalli2024-01-121-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | * Drop backport patch 0001-enum-Fix-compiler-warning.patch. * Drop backport patch CVE-2022-40617.patch * Update RDEPENDS to fix strongswan startup failures: plugin 'mgf1': failed to load - mgf1_plugin_create not found and no plugin file available plugin 'fips-prf': failed to load - fips_prf_plugin_create not found and no plugin file available plugin 'kdf': failed to load - kdf_plugin_create not found and no plugin file available plugin 'drbg': failed to load - drbg_plugin_create not found and no plugin file available * Drop PACKAGECONFIG[scep] as scepclient has been removed. * Add plugin-gcm to RDEPENDS as gcm plugin has been added to the default plugins. ChangeLog: https://github.com/strongswan/strongswan/releases/tag/5.9.7 https://github.com/strongswan/strongswan/releases/tag/5.9.8 https://github.com/strongswan/strongswan/releases/tag/5.9.9 https://github.com/strongswan/strongswan/releases/tag/5.9.10 https://github.com/strongswan/strongswan/releases/tag/5.9.11 https://github.com/strongswan/strongswan/releases/tag/5.9.12 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: fix CVE-2022-4345 multiple (BPv6, OpenFlow, and Kafka protocol) ↵vkumbhar2024-01-122-0/+53
| | | | | | | | | dissector infinite loops Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/39db474f80af87449ce0f034522dccc80ed4153f Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireshark: fix CVE-2023-1992 RPCoRDMA dissector crashvkumbhar2024-01-122-0/+62
| | | | | | | Upstream-Status: Backport from https://gitlab.com/colin.mcinnes/wireshark/-/commit/3c8be14c827f1587da3c2b3bb0d9c04faff5741 Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip3: Add py_ssize_t_clean argumentRob Woolley2024-01-122-0/+17681
| | | | | | | | | | | | | | An unintentional breakage was made upstream in sip4 which results in builds reporting: QtCoremod.sip:23: syntax error This was reported in Debian, but not resolved: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998605 A backport of a fix from the upstream project fixes the parser to prevent it from complaining about the syntax error. Signed-off-by: Rob Woolley <rob.woolley@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip3: Add sipconfig.pyRob Woolley2024-01-121-1/+18
| | | | | | | | | | | | Add the destdir option to ensure that sipconfig.py gets installed to the site-packages directory and included in python3-sip3. Remove references to the build paths from sipconfig.py as part of the install stage. One may then prepend STAGING_DIR_NATIVE to sip_bin and STAGING_DIR_TARGET to *_dir in any recipe that uses sipconfig.py. Signed-off-by: Rob Woolley <rob.woolley@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.5 -> 4.2.7Narpat Mali2024-01-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 4.2.5 and 4.2.7 contains the fixes for CVE-2023-43665, CVE-2023-46695 and other bugfixes. git log --oneline 4.2.5..4.2.7 shows: d254a54e7f (tag: 4.2.7) [4.2.x] Bumped version for 4.2.7 release. 048a9ebb6e [4.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows. 3fae5d92da [4.2.x] Refs #30601 -- Fixed typos in docs/topics/db/transactions.txt. a8aa94062b [4.2.x] Refs #15578 -- Made cosmetic edits to fixtures docs. 109f39a38b [4.2.x] Fixed #34932 -- Restored varchar_pattern_ops/text_pattern_ops index creation when deterministic collaction is set. 61612990d8 [4.2.x] Fixed typos in docs/ref/models/expressions.txt. 696fbc32d6 [4.2.x] Fixed #30601 -- Doc'd the need to manually revert all app state on transaction rollbacks. ffba63180c [4.2.x] Fixed typo in docs/ref/contrib/gis/geos.txt. 43a3646070 [4.2.x] Fixed #15578 -- Stated the processing order of fixtures in the fixtures docs. 0cd8b867a0 [4.2.x] Added stub release notes and release date for 4.2.7, 4.1.13, and 3.2.23. 510a512119 [4.2.x] Fixed typo in docs/releases/4.2.txt. b644f8bc1f [4.2.x] Corrected note about using accents in writing documentation contributing guide. a576ef98ae [4.2.x] Refs #34900, Refs #34118 -- Updated assertion in test_skip_class_unless_db_feature() test on Python 3.12.1+. 803caec60b [4.2.x] Fixed #34798 -- Fixed QuerySet.aggregate() crash when referencing expressions containing subqueries. caec4f4a6f [4.2.x] Refs #34840 -- Improved release note describing index regression. b6bb2f8099 [4.2.x] Refs #34840 -- Fixed test_validate_nullable_textfield_with_isnull_true() on databases that don's support table check constraints. e8fe48d3a0 [4.2.x] Fixed #34808 -- Doc'd aggregate function's default argument. 830990fa6c [4.2.x] Reorganized tutorial's part 4 to better understand changes needed in URLConf. 0cbc92bc3a [4.2.x] Refs #26029 -- Improved get_storage_class() deprecation warning with stacklevel=2. 9c7627da30 [4.2.x] Refs #34043 -- Clarified how to test UI changes. 0bd53ab86a [4.2.x] Added backticks to setuptools in docs. 99dcba90b4 [4.2.x] Refs #32275 -- Added scrypt password hasher to PASSWORD_HASHERS setting docs. 6697880219 [4.2.x] Refs #31435 -- Doc'd potential infinite recursion when accessing model fields in __init__. a9a3317a95 [4.2.x] Corrected wrap_socket() reference in docs/ref/settings.txt. 9962f94a97 [4.2.x] Added CVE-2023-43665 to security archive. b2d95bb301 [4.2.x] Added stub release notes for 4.2.7. 08d54f83a9 [4.2.x] Post release version bump. c22017bd1d (tag: 4.2.6) [4.2.x] Bumped version for 4.2.6 release. be9c27c4d1 [4.2.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in django.utils.text.Truncator when truncating HTML text. 39fc3f46a8 [4.2.x] Added stub release notes and release date for 4.2.6, 4.1.12, and 3.2.22. dd0bf63d3e [4.2.x] Added warning about flatpages and untrusted users. fec4ed0a25 [4.2.x] Refs #34320 -- Skipped SchemaTests.test_rename_field_with_check_to_truncated_name on MariaBD 10.5.2+. a148461f1f [4.2.x] Fixed #34840 -- Avoided casting string base fields on PostgreSQL. b08f53ff46 [4.2.x] Refs #34808 -- Doc'd that aggregation functions on empty groups can return None. c70f08c4aa [4.2.x] Added updating the Django release process on Trac to release steps. d485aa2732 [4.2.x] Fixed typo in docs/howto/custom-file-storage.txt. ff26e6ad84 [4.2.x] Corrected QuerySet.prefetch_related() note about GenericRelation(). 866122690d [4.2.x] Doc'd HttpResponse.cookies. 97e8a2afb1 [4.2.x] Fixed #34821 -- Prevented DEFAULT_FILE_STORAGE/STATICFILES_STORAGE settings from mutating the main STORAGES. 39cb3b08bc [4.2.x] Bumped checkout version in Github actions configuration. 592ebd8920 [4.2.x] Added stub release notes for 4.2.6. a1dd785139 [4.2.x] Added CVE-2023-41164 to security archive. a9686cb871 [4.2.x] Post-release version bump. Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.7/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 3.2.21 -> 3.2.23Narpat Mali2024-01-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | The delta between 3.2.21 and 3.2.23 contains the fixes for CVE-2023-43665, CVE-2023-46695 and other bugfixes. git log --oneline 3.2.21..3.2.23 shows: 60e648a7ae (tag: 3.2.23) [3.2.x] Bumped version for 3.2.23 release. f9a7fb8466 [3.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows. e6d2591d9e [3.2.x] Added stub release notes for 3.2.23. 3c04b74293 [3.2.x] Added CVE-2023-43665 to security archive. 86a14d653f [3.2.x] Post release version bump. 3106e94e52 (tag: 3.2.22) [3.2.x] Bumped version for 3.2.22 release. ccdade1a02 [3.2.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in django.utils.text.Truncator when truncating HTML text. 6caf7b313d [3.2.x] Added stub release notes for 3.2.22. 9e814c3a5e [3.2.x] Added CVE-2023-41164 to security archive. 4b439dcd05 [3.2.x] Post-release version bump. Release Notes: https://docs.djangoproject.com/en/dev/releases/3.2.23/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix for CVE-2023-43665 and CVE-2023-46695Narpat Mali2024-01-123-0/+291
| | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-43665: In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. CVE-2023-46695: An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. References: https://www.djangoproject.com/weblog/2023/oct/04/security-releases/ https://www.djangoproject.com/weblog/2023/nov/01/security-releases/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* glmark2: inherit python3native to fix build with python-3.12 on build hostMartin Jansa2024-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fixes: | WARNING: Unable to execute waf --version, exit code 1. Assuming waf version without bindir/libdir support. | DEBUG: Python function waf_preconfigure finished | DEBUG: Executing shell function do_configure | Traceback (most recent call last): | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/./waf", line 163, in <module> | from waflib import Scripting | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Scripting.py", line 6, in <module> | from waflib import Utils,Configure,Logs,Options,ConfigSet,Context,Errors,Build,Node | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Configure.py", line 6, in <module> | from waflib import ConfigSet,Utils,Options,Logs,Context,Build,Errors | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Options.py", line 6, in <module> | from waflib import Logs,Utils,Context,Errors | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Context.py", line 5, in <module> | import os,re,imp,sys | ModuleNotFoundError: No module named 'imp' | WARNING: /OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/temp/run.do_configure.1263276:146 exit 1 from 'waf_do_configure' * this first issue can be fixed easily by backporting: https://gitlab.com/ita1024/waf/-/commit/d2060dfd8af4edb5824153ff24e207b39ecd67a2 * but then it still fails a bit later, because of SyntaxWarning in waf --version output: ERROR: glmark2-2021.12-r0 do_configure: Error executing a python function in exec_func_python() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_func_python() autogenerated', lineno: 2, function: <module> 0001: *** 0002:waf_preconfigure(d) 0003: File: '/OE/build/luneos-kirkstone/openembedded-core/meta/classes/waf.bbclass', lineno: 52, function: waf_preconfigure 0048: wafbin = os.path.join(subsrcdir, 'waf') 0049: try: 0050: result = subprocess.check_output([python, wafbin, '--version'], cwd=subsrcdir, stderr=subprocess.STDOUT) 0051: version = result.decode('utf-8').split()[1] *** 0052: if bb.utils.vercmp_string_op(version, "1.8.7", ">="): 0053: d.setVar("WAF_EXTRA_CONF", "--bindir=${bindir} --libdir=${libdir}") 0054: except subprocess.CalledProcessError as e: 0055: bb.warn("Unable to execute waf --version, exit code %d. Assuming waf version without bindir/libdir support." % e.returncode) 0056: except FileNotFoundError: File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 148, function: vercmp_string_op 0144: Compare two versions and check if the specified comparison operator matches the result of the comparison. 0145: This function is fairly liberal about what operators it will accept since there are a variety of styles 0146: depending on the context. 0147: """ *** 0148: res = vercmp_string(a, b) 0149: if op in ('=', '=='): 0150: return res == 0 0151: elif op == '<=': 0152: return res <= 0 File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 138, function: vercmp_string 0134: return r 0135: 0136:def vercmp_string(a, b): 0137: """ Split version strings and compare them """ *** 0138: ta = split_version(a) 0139: tb = split_version(b) 0140: return vercmp(ta, tb) 0141: 0142:def vercmp_string_op(a, b, op): File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 89, function: split_version 0085: """Split a version string into its constituent parts (PE, PV, PR)""" 0086: s = s.strip(" <>=") 0087: e = 0 0088: if s.count(':'): *** 0089: e = int(s.split(":")[0]) 0090: s = s.split(":")[1] 0091: r = "" 0092: if s.count('-'): 0093: r = s.rsplit("-", 1)[1] Exception: ValueError: invalid literal for int() with base 10: 'SyntaxWarning' ERROR: Logfile of failure stored in: /OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/temp/log.do_configure.1264918 so it's safer to just use python3-native everywhere, instead of more patches for waf Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libbytesize: update github branch to 'main'Wentao Zhang2024-01-121-1/+1
| | | | | | | | | the repo of libbytesize doesn't have a branch named master. Change the branch from master to main. Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> Signed-off-by: Wentao Zhang <wentao.zhang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* yasm: fix CVE-2023-37732Soumya2024-01-122-0/+42
| | | | | | | | | | | | | | | Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attacker to cause a denial of service via a crafted file. References: https://github.com/yasm/yasm/issues/233 https://nvd.nist.gov/vuln/detail/CVE-2023-37732 Signed-off-by: Soumya <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 41fffef6b044b2722aa13f7e7648a3f848231851) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* squid: fix CVE-2023-46847 Denial of Service in HTTP Digest Authenticationvkumbhar2023-12-132-0/+48
| | | | | Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: fix CVE-2023-5868 CVE-2023-5869 CVE-2023-5870Yogita Urade2023-12-134-0/+530
| | | | | | | | | | | | | | | | | | | | | | CVE-2023-5868: postgresql: Compute aggregate argument types correctly in transformAggregateCall() CVE-2023-5869: postgresql: Detect integer overflow while computing new array dimensions CVE-2023-5870: postgresql: Ban role pg_signal_backend from more superuser backend types. References: https://nvd.nist.gov/vuln/detail/CVE-2023-5868 https://nvd.nist.gov/vuln/detail/CVE-2023-5869 https://nvd.nist.gov/vuln/detail/CVE-2023-5870 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: Mitigate HTTP/2 Stream Resets Flood impactJasper Orschulko2023-12-133-0/+95
| | | | | | | | | | | | | | | | Reduces the impact of HTTP/2 Stream Reset flooding in the nginx product (CVE-2023-44487). See: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ This patch only reduces the impact and does not completely mitigate the CVE in question, the latter being due to a design flaw in the HTTP/2 protocol itself. For transparancy reasons I therefore opted to not mark the CVE as resolved, so that integrators can decide for themselves, wheither to enable HTTP/2 support or allow HTTP/1.1 connections only. Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-gcovr: switch to main branchChristian Eggers2023-12-131-1/+1
| | | | | | | Branch "master" has been renamed to "main". Signed-off-by: Christian Eggers <ceggers@arri.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba: fix CVE-2023-4091Archana Polampalli2023-12-133-0/+254
| | | | | | | | | | | | | | | | | | | | | | | | | A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions. References: https://nvd.nist.gov/vuln/detail/CVE-2023-4091 Fix is patched to the function call smbd_check_access_rights_fsp() of open_file(), But in samba_4.14.14 smbd_check_access_rights() is used, from samba_4.15.0 onwards smbd_check_access_rights() was replaced with smbd_check_access_rights_fsp() and samba_4.14.14 is still vulnerable through smbd_check_access_rights(). Ref: https://github.com/samba-team/samba/commit/3f61369d153419158c0f223e6f81c0bb07275833 https://github.com/samba-team/samba/commit/26dc10bdb2cff3eece4a2874931b4058f9f87d68 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sdbus-c++: Update ptest pathPoonam Jadhav2023-12-131-1/+6
| | | | | | | Update ptest path to run sdbus-c++ ptest Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* frr: Fix for multiple CVE'sNarpat Mali2023-12-137-0/+569
| | | | | | | | | | | | | Backport the below CVE fixes. CVE-2023-38406: https://security-tracker.debian.org/tracker/CVE-2023-38406 CVE-2023-38407: https://security-tracker.debian.org/tracker/CVE-2023-38407 CVE-2023-46752: https://security-tracker.debian.org/tracker/CVE-2023-46752 CVE-2023-46753: https://security-tracker.debian.org/tracker/CVE-2023-46753 CVE-2023-47234: https://security-tracker.debian.org/tracker/CVE-2023-47234 CVE-2023-47235: https://security-tracker.debian.org/tracker/CVE-2023-47235 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: upgrade to 1.24.0 releaseMichael Haener2023-11-181-0/+6
| | | | | | | | | | According to http://nginx.org/en/CHANGES nginx supports the openssl 3.x component only from version 1.21.2. In Kirstone openssl 3.x is included but all provided versions of nginx are older, so there is currently an incompatibility. With this patch this incompatibility get removed. Signed-off-by: Michael Haener <michael.haener@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-python: Drop broken BBCLASSEXTEND variantsRichard Purdie2023-11-187-13/+1
| | | | | | | | | | | | | | | | | | | | | | | | The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d4aa17dc436beb96a804860bc6d18cf72283709e) Backport: * Adapted paths to follow PV changes * Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-cson: fix run-time dependenciesBartosz Golaszewski2023-11-181-2/+1
| | | | | | | | | | | Add the missing run-time dependency on python3-json. As a result we no longer need to pull python3 native and can drop other *DEPENDS. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 40b4cf5a83098a5f1be873be5c29f26380bc7993) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-oe: Drop broken BBCLASSEXTEND variantsRichard Purdie2023-11-177-11/+2
| | | | | | | | | | | | | | | | | | | | | | | | The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9962d57f7c235873de0a0bb192b5f56747762fc7) Backport: * Updated paths to follow PV changes * Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libwebsockets: Support building for nativePeter Kjellerstedt2023-11-171-0/+3
| | | | | | | | | | | | | | | | | This is needed to be able to build mosquitto-native. The dependency on libcap when building for native is needed because cmake will pick up the existence of libcap from the host, but then the build fails if it is not available in the sysroot. Unfortunately, there does not seem to be any way to explicitly tell cmake to not build with libcap. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c083e0569ad80d11b4f5cfdfa89acdd4264d8152) Backported: Updated paths to follow PV changes. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-meta-oe-extended: RDEPENDS on an existing mozjs-91 packageYoann Congal2023-11-171-1/+1
| | | | | | | "mozjs" does not exist but "mozjs-91" does. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-networking: Drop broken BBCLASSEXTEND variantsRichard Purdie2023-11-172-2/+2
| | | | | | | | | | | | | | | | | | | | | | The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e1b332f2eff7df2336ff87917cd48249edf763a2) Backport: Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-perl: Drop broken BBCLASSEXTEND variantsRichard Purdie2023-11-175-9/+1
| | | | | | | | | | | | | | | | | | | | | | | | The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 79e0a9d237343ad0af0a40128494155ccaa131ec) Backported: * Adapted paths to follow PV changes * Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-soupsieve: Break circular dependency with beautifulsoup4Yoann Congal2023-11-171-4/+0
| | | | | | | | python3-beautifulsoup4 does depend on python3-soupsieve but python3-soupsieve does not depend on python3-beautifulsoup4. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nlohmann-json: Add ptest supportMingli Yu2023-11-152-3/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Fetch the test data during do_fetch phase to avoid internet access during test as some tests need test data. # ./run-ptest PASS: test-algorithms PASS: test-allocator PASS: test-alt-string PASS: test-assert_macro PASS: test-bson PASS: test-byte_container_with_subtype PASS: test-capacity PASS: test-cbor PASS: test-class_const_iterator PASS: test-class_iterator PASS: test-class_lexer PASS: test-class_parser PASS: test-comparison PASS: test-concepts PASS: test-constructor1 PASS: test-constructor2 PASS: test-convenience PASS: test-conversions PASS: test-conversions_cpp17 PASS: test-deserialization PASS: test-diagnostics PASS: test-disabled_exceptions PASS: test-element_access1 PASS: test-element_access2 PASS: test-hash PASS: test-inspection PASS: test-items PASS: test-items_cpp17 PASS: test-iterators1 PASS: test-iterators2 PASS: test-json_patch PASS: test-json_pointer PASS: test-large_json PASS: test-merge_patch PASS: test-meta PASS: test-modifiers PASS: test-msgpack PASS: test-noexcept PASS: test-ordered_json PASS: test-ordered_map PASS: test-pointer_access PASS: test-readme PASS: test-reference_access PASS: test-regression1 PASS: test-regression1_cpp17 PASS: test-regression2 PASS: test-regression2_cpp17 PASS: test-serialization PASS: test-testsuites PASS: test-to_chars PASS: test-ubjson PASS: test-udt PASS: test-udt_macro PASS: test-unicode1 PASS: test-unicode2 PASS: test-unicode3 PASS: test-unicode4 PASS: test-unicode5 PASS: test-user_defined_input PASS: test-wstring Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* traceroute: upgrade 2.1.0 -> 2.1.3Narpat Mali2023-11-141-2/+1
| | | | | | | | | | | | | | | | | | This upgrade incorporates the CVE-2023-46316 fix and other bug fixes. Changelog: ---------- - Interpret ipv4-mapped ipv6 addresses (::ffff:A.B.C.D) as true ipv4. - Return back more robast poll(2) loop handling. - Fix unprivileged ICMP tracerouting with Linux kernel >= 6.1 (Eric Dumazet, SF bug #14) - Fix command line parsing in wrappers. References: https://security-tracker.debian.org/tracker/CVE-2023-46316 https://sourceforge.net/projects/traceroute/files/traceroute/traceroute-2.1.3/ Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* emlog: ignore CVE-2022-3968 & CVE-2023-43291Yoann Congal2023-11-141-0/+2
| | | | | | | | CVE-2022-3968 & CVE-2023-43291 apply to the other "emlog" and can be safely ignored. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* emlog: Add PVKhem Raj2023-11-141-1/+1
| | | | | | | | | This is 0.70 release with few more commits on top. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 08edc0b6ace0d04688a5617cf05546a7b8ba6cca) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* open-vm-tools: fix CVE-2023-34058Archana Polampalli2023-11-142-0/+242
| | | | | | | | | | | | | | A flaw was found in open-vm-tools. This flaw allows a malicious actor that has been granted Guest Operation Privileges in a target virtual machine to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-34058 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> [minor fixup] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* open-vm-tools: fix CVE-2023-20900Narpat Mali2023-11-142-0/+37
| | | | | | | | | | | | | | | | | | A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID -6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download. vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31 e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . References: https://nvd.nist.gov/vuln/detail/CVE-2023-20900 https://security-tracker.debian.org/tracker/CVE-2023-20900 Signed-off-by: Narpat Mali <narpat.mali@windriver.com> [Minor fixup] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* indent: fix CVE-2023-40305stable/kirkstone-nutYogita Urade2023-11-033-0/+8452
| | | | | | | | | | | GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file. Reference: https://savannah.gnu.org/bugs/index.php?64503 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-meta-multimedia: restore x11 restriction for projucerMartin Jansa2023-11-031-1/+1
| | | | | | | | | | | | | * it was removed in: https://git.openembedded.org/meta-openembedded/commit/?id=deb11a823c32d4090b3724a589641810e06df6bc * but still needed as shown in world build without x11 in DISTRO_FEATURES: ERROR: Nothing RPROVIDES 'projucer' (but /OE/build/luneos-nanbield/meta-openembedded/meta-multimedia/recipes-multimedia/packagegroups/packagegroup-meta-multimedia.bb RDEPENDS on or otherwise requires it) projucer was skipped: missing required distro feature 'x11' (not in DISTRO_FEATURES) NOTE: Runtime target 'projucer' is unbuildable, removing... Missing or unbuildable dependency chain was: ['projucer'] Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mbedtls: upgrade 3.4.0 -> 3.5.0Beniamin Sandu2023-11-034-75/+89
| | | | | | | | | | | | | * Includes security fix for CVE-2023-43615 - Buffer overread in TLS stream cipher suites * Includes security fix for CVE-2023-45199 - Buffer overflow in TLS handshake parsing with ECDH * Includes aesce compilation fixes Full changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.5.0 The extra patch fixes x86 32-bit builds. Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suiteparse: Adapt to upstream branch name changesRichard Purdie2023-11-031-1/+1
| | | | | | | meta-oe master branch already made this change. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python-blivet: Adapt to upstream branch name changesRichard Purdie2023-11-031-1/+1
| | | | | Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* grubby: Update branchname to match upstreamRichard Purdie2023-11-031-1/+1
| | | | | | | | | | meta-oe master already made this change along with others. Update the branchname to match upstream repository changes to allow fetching to continue to work. Drop unneeded duplicate semicolon too. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ntfs-3g-ntfsprogs: Upgrade 2022.5.17 to 2022.10.3Omkar Patil2023-11-031-1/+1
| | | | | | | | | | | | | | | | | Changes: Rejected zero-sized runs Avoided merging runlists with no runs Fix CVE-2022-40284 Dunfell and master both have latest version of ntfs-3g-ntfsprogs 2022.10.3. Therefore, upgrade the version on kirkstone too. Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 5d5e8854718dab02c2737e3faf288f830a514841) Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mbedtls: upgrade 2.28.2 -> 2.28.5Yi Zhao2023-10-171-1/+1
| | | | | | | | | | | This release includes security fix for CVE-2023-43615. Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.5 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> [Minor tweak to get it to apply] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nginx: add configure optionJoe Slater2023-10-172-0/+42
| | | | | | | | | | Support --with-http_xslt_module configure option via a PACKAGECONFIG option. The option is not added to the defaults. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e0ac8eec48ddddc93751cfcdef2557998bfe91c8) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mbedtls: set up /usr/bin/hello as alternativeDenys Dmytriyenko2023-10-171-1/+4
| | | | | | | | | | As mbedtls installs this rather generically-named /usr/bin/hello binary, it conflicts with the one provided by lmbench, hence set it up as an alternative to avoid conflicts when both are installed to rootfs or SDK. Signed-off-by: Denys Dmytriyenko <denis@denix.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mosquitto: add missing Upstream-StatusMartin Jansa2023-10-172-0/+4
| | | | | | | Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mosquitto: upgrade 2.0.17 -> 2.0.18Gianfranco Costamagna2023-10-173-1/+51
| | | | | | | | | Add two patches from Debian, pull requests proposed upstream as 2894 and 2895 to make it start only when board is online, and to fix dynamic websockets link failure Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mosquitto: upgrade 2.0.15 -> 2.0.17Gianfranco Costamagna2023-10-172-11/+11
| | | | | | | | | Fix for CVE-2023-28366, CVE-2023-0809, CVE-2023-3592 Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@yahoo.it> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mosquitto: do not automatically depend on dlt-daemon, it's a non-mandatory ↵Gianfranco Costamagna2023-10-171-1/+1
| | | | | | | | logging system Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-05 00:17:26 +0000