summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* python3-django: Fix CVE-2024-41990Soumya Sambu2025-01-222-0/+70
| | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41990 Upstream-patch: https://github.com/django/django/commit/d0a82e26a74940bf0c78204933c3bdd6a283eb88 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-41989Soumya Sambu2025-01-225-0/+238
| | | | | | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41989 Upstream-patches: https://github.com/django/django/commit/08c5a787262c1ae57f6517d4574b54a5fcaad124 https://github.com/django/django/commit/4b066bde692078b194709d517b27e55defae787c https://github.com/django/django/commit/dcd974698301a38081c141ccba6dcafa5ed2c80e https://github.com/django/django/commit/fc76660f589ac07e45e9cd34ccb8087aeb11904b Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-39614Soumya Sambu2025-01-222-0/+139
| | | | | | | | | | | | | | | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-39614 Upstream-patch: https://github.com/django/django/commit/17358fb35fb7217423d4c4877ccb6d1a3a40b1c3 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2023-23969Soumya Sambu2025-01-222-0/+109
| | | | | | | | | | | | | | | | In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. References: https://nvd.nist.gov/vuln/detail/CVE-2023-23969 Upstream-patch: https://github.com/django/django/commit/c7e0151fdf33e1b11d488b6f67b94fdf3a30614a Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: upgrade 4.2.15 -> 4.2.17Soumya Sambu2025-01-221-2/+2
| | | | | | | | | | | | Fixes CVE-2024-45230, CVE-2024-45231, CVE-2024-53907 and CVE-2024-53908 Release Notes: https://docs.djangoproject.com/en/dev/releases/4.2.16/ https://docs.djangoproject.com/en/dev/releases/4.2.17/ Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-django: Fix CVE-2024-38875Soumya Sambu2025-01-222-0/+162
| | | | | | | | | | | | | | | | An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets. References: https://nvd.nist.gov/vuln/detail/CVE-2024-38875 https://github.com/advisories/GHSA-qg2p-9jwr-mmqf Upstream-patch: https://github.com/django/django/commit/79f368764295df109a37192f6182fb6f361d85b5 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* poppler: fix CVE-2024-56378Yogita Urade2025-01-222-0/+79
| | | | | | | | | | | | | | | libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-56378 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/ade9b5ebed44b0c15522c27669ef6cdf93eff84e Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* poppler: fix CVE-2024-6239Yogita Urade2025-01-223-1/+1370
| | | | | | | | | | | | | | | | | | | | | | A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service. CVE-2024-6239-0001 is the dependent commit and CVE-2024-6239-0002 is the actual CVE fix. fix indent issue in poppler_22.04.0.bb file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-6239 Upstream patches: https://gitlab.freedesktop.org/poppler/poppler/-/commit/0554731052d1a97745cb179ab0d45620589dd9c4 https://gitlab.freedesktop.org/poppler/poppler/-/commit/fc1c711cb5f769546c6b31cc688bf0ee7f0c1dbc Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* glade: fix CVE-2020-36774Zhang Peng2025-01-222-0/+55
| | | | | | | | | | | | | | | | CVE-2020-36774: plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). Reference: [https://nvd.nist.gov/vuln/detail/CVE-2020-36774] Upstream patches: [https://gitlab.gnome.org/GNOME/glade/-/commit/7acdd3c6f6934f47b8974ebc2190a59ea5d2ed17] Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libsass: upgrade 3.6.5 -> 3.6.6Wang Mingyu2025-01-221-2/+2
| | | | | | | | | (master rev: 3f88224fb9c436bdd3ccd5d0268914f08625efbf) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-oe: Remove True option to getVar callsakash hadke2025-01-224-9/+9
| | | | | | | | getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Signed-off-by: Akash Hadke <akash.hadke27@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-meta-multimedia: Remove library only packages from rdepsKhem Raj2025-01-011-32/+2
| | | | | | | | | | | | Because they get renamed, it is better to ignore them and let a dependency build them Fixes errors like ERROR: packagegroup-meta-multimedia-1.0-r0 do_package_write_ipk: An allarch packagegroup shouldn't depend on packages which are dynamically renamed (gssdp to libgssdp-1.2-0) Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit eafecde2aedae38879b4c45dd213ff9483f209ad) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lldpd: Fix CVE-2023-41910Colin McAllister2024-12-312-0/+27
| | | | | | | | Adds patch to backport fix for CVE-2023-41910. Signed-off-by: Colin McAllister <colin.mcallister@garmin.com> Change-Id: Iab619f1f5ba26b1141dffea065c90ef0b180b46e Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-werkzeug: Fix CVE-2024-49767Soumya Sambu2024-12-312-1/+89
| | | | | | | | | | | | | | | | | | | | Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulnerable to a relatively simple but effective resource exhaustion (denial of service) attack. A specifically crafted form submission request can cause the parser to allocate and block 3 to 8 times the upload size in main memory. There is no upper limit; a single upload at 1 Gbit/s can exhaust 32 GB of RAM in less than 60 seconds. Werkzeug version 3.0.6 fixes this issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-49767 Upstream-patch: https://github.com/pallets/werkzeug/commit/8760275afb72bd10b57d92cb4d52abf759b2f3a7 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-werkzeug: Fix CVE-2024-34069Soumya Sambu2024-12-313-1/+272
| | | | | | | | | | | | | | | | | | | | | Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-34069 Upstream-patches: https://github.com/pallets/werkzeug/commit/71b69dfb7df3d912e66bab87fbb1f21f83504967 https://github.com/pallets/werkzeug/commit/890b6b62634fa61224222aee31081c61b054ff01 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* asio: Add ptest supportMingli Yu2024-12-313-4/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # ./run-ptest PASS: address PASS: address_v4 PASS: address_v4_iterator PASS: address_v4_range PASS: address_v6 PASS: address_v6_iterator PASS: address_v6_range PASS: any_completion_executor PASS: any_completion_handler PASS: any_executor PASS: any_io_executor PASS: append PASS: as_tuple PASS: associated_allocator PASS: associated_cancellation_slot PASS: associated_executor PASS: associated_immediate_executor PASS: associator PASS: async_result [snip] Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (master rev: 1274b0df3c126e72dcbfd4678d1c25aadb8607dc) * remove duplicated SRC_URI * refresh 0001-tests-Remove-blocking_adaptation.cpp.patch Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: upgrade 14.13 -> 14.14Yogita Urade2024-12-312-4/+5
| | | | | | | | | | | | | Includes fix for CVE-2024-10976, CVE-2024-10977, CVE-2024-10978 and CVE-2024-10979 Changelog: https://www.postgresql.org/docs/release/14.14/ 0001-configure.ac-bypass-autoconf-2.69-version-check.patch refreshed for 14.14 Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
* php: upgrade 8.1.30 -> 8.1.31Vijay Anusuri2024-12-311-1/+1
| | | | | | | | | Includes fix for CVE-2024-8929, CVE-2024-11236, CVE-2024-11234 and CVE-2024-11233 Changelog: https://www.php.net/ChangeLog-8.php#8.1.31 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
* mosquitto: upgrade 2.0.19 -> 2.0.20Wang Mingyu2024-12-311-1/+1
| | | | | | | | | | | | | | | | | | | | | Changelog: ========== Broker: - Fix QoS 1 / QoS 2 publish incorrectly returning "no subscribers". Closes #3128. - Open files with appropriate access on Windows. - Don't allow invalid response topic values. - Fix some strict protocol compliance issues. Client library: - Fix cmake build on OS X. Build: - Fix build on NetBSD Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com>
* mosquitto: upgrade 2.0.18 -> 2.0.19Fabrice Aeschbacher2024-12-313-50/+1
| | | | | | | | | | | | - Solves CVE-2024-8376 - removed 1571.patch and 2894.patch, already applied in v2.0.19 https://github.com/eclipse/mosquitto/blob/v2.0.19/ChangeLog.txt Signed-off-by: Fabrice Aeschbacher <fabrice.aeschbacher@siemens.com> Reviewed-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Peter Marko <peter.marko@siemens.com>
* nspr: Fix build with clang16Khem Raj2024-12-312-0/+40
| | | | | | | * also needed for nspr-native build with gcc-14 on host Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
* hostapd: Patch security advisory 2024-2Peter Marko2024-12-313-0/+92
| | | | | | | | | | | | Pick patches according to http://w1.fi/security/2024-2/sae-h2h-and-incomplete-downgrade-protection-for-group-negotiation.txt SAE H2E and incomplete downgrade protection for group negotiation Patch 0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch was removed as it only patched wpa_supplicant. The patch names were not changed so it is comparable with wpa_supplicant recipe. Signed-off-by: Peter Marko <peter.marko@siemens.com>
* hostapd: Patch CVE-2024-3596Peter Marko2024-12-319-0/+618
| | | | | | | | | | | | | Picked patches according to http://w1.fi/security/2024-1/hostapd-and-radius-protocol-forgery-attacks.txt First patch is style commit picked to have a clean cherry-pick of all mentioned commits without any conflict. Patch CVE-2024-3596_03.patch was removed as it only patched wpa_supplicant. The patch names were not changed so it is comparable with wpa_supplicant recipe. Signed-off-by: Peter Marko <peter.marko@siemens.com>
* libgsf: Upgrade 1.14.49 -> 1.14.53Zhang Peng2024-12-081-5/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: libgsf 1.14.53 * Compilation fixes for libxml 2.13 * Fix ABR in gsf-vba-dump. * Teach gsf (the tool) to handle odf properties. * Fix integer overflows affecting memory allocation. * Add missing "DocumentStatus" ole2 property. * Avoid some undefined C behaviour in overflow checks. libgsf 1.14.51 * Fix thumbnailer crash. * Fix leaks. libgsf 1.14.50 * Fix error handling problem when writing ole files. License changed to LGPL-2.1-only from 1.14.51 [https://gitlab.gnome.org/GNOME/libgsf/-/commit/037c913eb631349c410ef45e49697bf5c46dac8a] remove obsolete DEPENDS from upstream [103f49b5fc987e7bb8765700d16bd387a33b62ca] Security fixes: CVE-2024-42415 An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. CVE-2024-36474 An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Reference: [https://gitlab.gnome.org/GNOME/libgsf/-/issues/34] (master rev: 6ed5891c18fc78a69764af0a29ad9b5feefb1aa8) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-aiohttp: fix ↵Jiaying Song2024-12-086-0/+855
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-49081/CVE-2024-30251/CVE-2024-52304/CVE-2023-49082/CVE-2024-27306 CVE-2023-49081: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49081 Upstream patches: https://github.com/aio-libs/aiohttp/commit/1e86b777e61cf4eefc7d92fa57fa19dcc676013b CVE-2024-30251: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions. References: https://nvd.nist.gov/vuln/detail/CVE-2024-30251 Upstream patches: https://github.com/aio-libs/aiohttp/commit/cebe526b9c34dc3a3da9140409db63014bc4cf19 https://github.com/aio-libs/aiohttp/commit/7eecdff163ccf029fbb1ddc9de4169d4aaeb6597 https://github.com/aio-libs/aiohttp/commit/f21c6f2ca512a026ce7f0f6c6311f62d6a638866 CVE-2024-52304: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue. References: https://nvd.nist.gov/vuln/detail/CVE-2024-52304 Upstream patches: https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71 CVE-2023-49082: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0. References: https://nvd.nist.gov/vuln/detail/CVE-2023-49082 Upstream patches: https://github.com/aio-libs/aiohttp/pull/7806/commits/a43bc1779892e7014b7723c59d08fb37a000955e CVE-2024-27306: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade. References: https://nvd.nist.gov/vuln/detail/CVE-2024-27306 Upstream patches: https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397 Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* protobuf: fix CVE-2024-7254Chen Qi2024-12-082-0/+796
| | | | | | | | Backport patch with tweaks for the current version to fix CVE-2024-7254. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* php: upgrade 8.1.29 -> 8.1.30Yogita Urade2024-12-081-1/+1
| | | | | | | | | | | Includes fix for CVE-2024-8925, CVE-2024-8926, CVE-2024-8927 and CVE-2024-9026 Changelog: https://www.php.net/ChangeLog-8.php#8.1.30 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* p7zip: Fix CVE-2023-52169 and CVE-2023-52168hongxu2024-12-082-0/+456
| | | | | | | | | | | | | According to [1][2], Igor Pavlov, the author of 7-Zip, refused to provide an advisory or any related change log entries. Have to backport a part of ./CPP/7zip/Archive/NtfsHandler.cpp from upstream big commit https://github.com/ip7z/7zip/commit/fc662341e6f85da78ada0e443f6116b978f79f22 [1] https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/ [2] https://dfir.ru/wp-content/uploads/2024/07/screenshot-2024-07-03-at-02-13-40-7-zip-_-bugs-_-2402-two-vulnerabilities-in-the-ntfs-handler.png Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* hostapd: Security fix for CVE-2023-52160Yi Zhao2024-12-082-0/+199
| | | | | | | | | | | | | | | | | | | | CVE-2023-52160: The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication. The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an adversary to impersonate Enterprise Wi-Fi networks. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-52160 Patch from: https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baffdea9e55255a81270b768439c Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ntfs-3g-ntfsprogs: fix CVE-2023-52890hongxu2024-12-082-0/+43
| | | | | | | | | Backport fix from upstream https://github.com/tuxera/ntfs-3g/commit/75dcdc2cf37478fad6c0e3427403d198b554951d Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* indent: fix CVE-2024-0911hongxu2024-12-082-0/+124
| | | | | | | | | Backport a fix from upstream to resolve CVE-2024-0911 https://git.savannah.gnu.org/git/indent.git feb2b646e6c3a05018e132515c5eda98ca13d50d Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* frr: fix multiple CVEsZhang Peng2024-12-086-1/+443
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2024-27913: ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OSPF LSA packet, because of an attempted access to a missing attribute field. CVE-2024-34088: In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling functions do not handle the returned NULL value, the OSPF daemon crashes, leading to denial of service. CVE-2024-31950: In FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets during an attempt to read Segment Routing subTLVs (their size is not validated). CVE-2024-31951: In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated). CVE-2024-31948: In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-27913] [https://nvd.nist.gov/vuln/detail/CVE-2024-34088] [https://nvd.nist.gov/vuln/detail/CVE-2024-31951] [https://nvd.nist.gov/vuln/detail/CVE-2024-31950] [https://nvd.nist.gov/vuln/detail/CVE-2024-31948] Upstream patches: [https://github.com/FRRouting/frr/commit/a73e66d07329d721f26f3f336f7735de420b0183] [https://github.com/FRRouting/frr/commit/8c177d69e32b91b45bda5fc5da6511fa03dc11ca] [https://github.com/FRRouting/frr/commit/5557a289acdaeec8cc63ffc97b5c2abf6dee7b3a] [https://github.com/FRRouting/frr/commit/f69d1313b19047d3d83fc2b36a518355b861dfc4] [https://github.com/FRRouting/frr/commit/babb23b74855e23c987a63f8256d24e28c044d07] [https://github.com/FRRouting/frr/commit/ba6a8f1a31e1a88df2de69ea46068e8bd9b97138] Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* freeradius: upgrade 3.0.21 -> 3.0.27Haixiao Yan2024-12-0820-1823/+192
| | | | | | | | | | | | | | | | | | | | | | | | | | | | ChangeLog: https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_27 Configuration changes: BlastRADIUS mitigations have been added to the "security" section. See require_message_authenticator and also limit_proxy_state. BlastRADIUS mitigations have been added to radclient. See man radclient, and the -b option. Security fixes: CVE-2024-3596: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-3596 https://www.freeradius.org/security/ https://www.blastradius.fail/ https://www.inkbridgenetworks.com/web/content/2557?unique=47be02c8aed46c53b0765db185320249ad873d95 Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> [Drop CVE-2024-3596 patch backported early] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openvpn: upgrade 2.5.6 -> 2.5.11Haixiao Yan2024-12-084-272/+2
| | | | | | | | | | | | | | | | | | License-Update: Add Apache2 linking for new commits [1] ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.5.11/Changes.rst Security fixes: CVE-2024-5594: control channel: refuse control channel messages with nonprintable characters in them. Security scope: a malicious openvpn peer can send garbage to openvpn log, or cause high CPU load. [1] https://github.com/OpenVPN/openvpn/commit/4a89a55b8a9d6193957711bef74228796a185179 Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apache2: Upgrade 2.4.60 -> 2.4.62Archana Polampalli2024-12-081-1/+1
| | | | | | | | | | | | | CVE's Fixed by upgrade: CVE-2024-39884 CVE-2024-40725 Other Changes between 2.4.60 -> 2.4.62 ====================================== https://github.com/apache/httpd/blob/2.4.62/CHANGES Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nss: patch CVE-2024-6609Peter Marko2024-12-082-0/+31
| | | | | | | | | | | | | | | | | | | Pick the same patch as Debian took for bullseye. There is no direct backport to version prior 3.102 because commit NSS_3_101_BETA2-12-g8d94c529b [1] rewrote this code. Applied patch was proposed for old versions in [2] and already applied in Debian bullseye. I could not find suitable upstream status, inappropriate is the best I could pick from offered possibilities. [1] https://github.com/nss-dev/nss/commit/8d94c529b333194d080c4885ddd3a40e6c296ae9< [2] https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/t9JmsYkujWM/m/HjKuk-ngBAAJ Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nss: patch CVE-2024-6602Peter Marko2024-12-082-0/+66
| | | | | | | Pick the same patch as Debian took for bullseye. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* open-vm-tools: Security fixes CVE-2023-34059Yi Zhao2024-12-082-0/+189
| | | | | | | | | | | | | | | | | | CVE-2023-34059: open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-34059 Patch from: https://github.com/vmware/open-vm-tools/blob/CVE-2023-34059.patch/CVE-2023-34059.patch Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mbedtls: Upgrade 2.28.8 -> 2.28.9Mingli Yu2024-12-081-1/+1
| | | | | | | | | | The mbedtls 2.28.9 includes the security fix for CVE-2024-45157, bug fixes and minor enhancements [1]. [1] https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.9 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* freeradius: Security fix for CVE-2024-3596Rohini Sangam2024-12-082-0/+1507
| | | | | | | | | | CVE fixed: - CVE-2024-3596 freeradius: forgery attack Upstream-Status: Backport from v3.0.x branch, commit range 3a00a6ecc188629b0441fd45ad61ca8986de156e..da643f1edc267ce95260dc36069e6f1a7a4d66f8 Signed-off-by: Rohini Sangam <rsangam@mvista.com> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* squid: conditionally set status of CVE-2024-45802Peter Marko2024-12-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | According to [1] the ESI feature implementation in squid is vulnerable without any fix available. NVD says it's fixed in 6.10, however the change in this release only disables ESI by default (which we always did via PACKAGECONFIG). Commit in master branch related to this CVE is [2]. Title is "Remove Edge Side Include (ESI) protocol" and it's also what it does. So there will never be a fix for these ESI vulnerabilities. We should not break features in LTS branch and cannot fix this problem. So ignrore this CVE based on set PACKAGECONFIG which should remove it from reports for most users. Thos who need ESI need to assess the risk themselves. [1] https://github.com/squid-cache/squid/security/advisories/GHSA-f975-v7qw-q7hj [2] https://github.com/squid-cache/squid/commit/5eb89ef3d828caa5fc43cd8064f958010dbc8158 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openipmi: upgrade 2.0.32->2.0.36Jiaying Song2024-12-084-103/+13
| | | | | | | | | | | | | | 2c4ab4a6c openipmi: fix do_configure error when using dash 03dd014eb openipmi: update 2.0.32 -> 2.0.34 Merge the above commits related to the upgrade, and then upgrade the version of openipmi from 2.0.34 to 2.0.36. Full changelog for openipmi:: https://sourceforge.net/p/openipmi/news/ Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-geomet: fix branch parameterMartin Jansa2024-12-081-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * drop unused SRC_URI[sha256sum] as this recipe uses git fetcher * release-0.3.0 branch doesn't exist, but the SRCREV is in master branch: geomet $ git branch -a --contains 73ec5ec96cca32f2e2461d3964fc3d4ab80248f9 * master remotes/origin/HEAD -> origin/master remotes/origin/master remotes/origin/release-1.0 remotes/origin/release-1.1.0 * release-0.3.0 branch doesn't exist even the tarball on MIRROR: https://sources.yoctoproject.org/mirror/sources/git2_github.com.geomet.geomet.git.tar.gz not sure when it was removed from upstream git repo, but it was removed: Pruning origin URL: https://github.com/geomet/geomet.git * [pruned] refs/heads/issue_esri_srid * [pruned] refs/pull/74/merge * [pruned] refs/pull/76/merge * [pruned] refs/pull/77/merge * [pruned] refs/heads/release-0.3.0 * master branch is used since mickledore upgrade to 1.0.0 in: https://git.openembedded.org/meta-openembedded/commit/?h=mickledore&id=382f7d51e3b92b8b7a23cd98f9bfc63c51a33dfd Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* poco: use main instead of master branchMartin Jansa2024-12-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Branches used in langdale, mickledore, nanbield were re-written in upstream :(, fixes were sent to meta-oe: langdale: https://lists.openembedded.org/g/openembedded-devel/message/107533 mickledore: https://lists.openembedded.org/g/openembedded-devel/message/107531 merged in: https://git.openembedded.org/meta-openembedded/commit/?h=mickledore&id=b0d67900ae9e8911f734c25c0674fe55df8cd188 nanbield: https://lists.openembedded.org/g/openembedded-devel/message/107532 merged in: https://git.openembedded.org/meta-openembedded/commit/?h=nanbield&id=2da6e1b0e43a8993fd422fee3f83940100b59f4c fix for langdale wasn't ever fixed because it was sent after langdale was already EOL, but looks like the version used in kirkstone got broken recently as well, because master branch was removed: poco/1.11.2-r0/git $ git branch -a --contains 9d1c428c861f2e5ccf09149bbe8d2149720c5896 * master ... remotes/origin/dev-task-test-diag remotes/origin/devel remotes/origin/feat/acceptor-service-handler-args remotes/origin/fix/posix-sleep remotes/origin/issue-templates remotes/origin/master remotes/origin/poco-1.12.0 remotes/origin/poco-1.12.1 remotes/origin/poco-1.12.2 remotes/origin/poco-1.12.3 remotes/origin/poco-1.12.4 remotes/origin/poco-1.12.5 remotes/origin/poco-1.12.6 remotes/origin/poco-1.9.5-not-released remotes/origin/poll-closed-server-test remotes/origin/upgrade-ci-actions-to-v3 poco/1.11.2-r0/git $ git remote prune origin Pruning origin URL: https://github.com/pocoproject/poco.git ... * [pruned] origin/android-ndk-action * [pruned] origin/develop * [pruned] origin/feat/wepoll * [pruned] origin/fix/PollSet-race * [pruned] origin/fix/swap-noexcept * [pruned] origin/master * [pruned] origin/poco-1.10.2 * [pruned] origin/poco-1.9.5 refs/remotes/origin/HEAD has become dangling! poco/1.11.2-r0/git $ git branch -a --contains 9d1c428c861f2e5ccf09149bbe8d2149720c5896 * master ... remotes/origin/dev-task-test-diag remotes/origin/devel remotes/origin/discourage-using-configure-and-make remotes/origin/feat/acceptor-service-handler-args remotes/origin/feat/json-logging remotes/origin/fix/posix-sleep remotes/origin/issue-templates remotes/origin/main remotes/origin/master-pre-1.13.0 remotes/origin/master-unused remotes/origin/openssl_fix remotes/origin/poco-1.12.0 remotes/origin/poco-1.12.1 remotes/origin/poco-1.12.2 remotes/origin/poco-1.12.3 remotes/origin/poco-1.12.4 remotes/origin/poco-1.12.5 remotes/origin/poco-1.12.6 remotes/origin/poco-1.13.0 remotes/origin/poco-1.13.1 remotes/origin/poco-1.13.2 remotes/origin/poco-1.13.3 remotes/origin/poco-1.13.4 remotes/origin/poco-1.9.5-not-released remotes/origin/poll-closed-server-test remotes/origin/release-1.14-changelog-authors remotes/origin/search-support remotes/origin/upgrade-ci-actions-to-v3 switch to main branch which is the most common and the least surprising. Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libjs-jquery-cookie: update branch from master to mainMartin Jansa2024-12-081-1/+1
| | | | | | | | | | | * it was updated in nanbield with upgrade to 3.0.5 in: fc0a506bde libjs-jquery-cookie: upgrade 3.0.1 -> 3.0.5 * drop duplicated protocol param as in mickledore: 2e0a581bee recipes: Remove double protocol= from SRC_URIs Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-lxml: ignore incompatible-pointer-types issues in native buildMartin Jansa2024-12-081-0/+2
| | | | | | | | | | | | | * to allow building native version on hosts with gcc-14 * it's properly fixed in 5.0.2 version sent to oe-core/scarthgap in: https://lists.openembedded.org/g/openembedded-core/message/206391 but for kirkstone we can just demote the issue back to warning * fixes: https://bugs.launchpad.net/lxml/+bug/2045435 Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitpkgv: Fix python deprecation warningKhem Raj2024-12-081-1/+1
| | | | | | | | | | Fixes DeprecationWarning: 'pipes' is deprecated and slated for removal in Python 3.13 pipes is an alias for shlex therefore switch to using shlex Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* flatbuffers: fix native build with gcc-14 on hostMartin Jansa2024-12-082-1/+30
| | | | | | | | | | | | | | | | | | | In C++ we cannot have both assignment operator and const member. Since span::operator= is defined, span::count_ constness must be removed. Fixes: FAILED: CMakeFiles/flatc.dir/src/util.cpp.o ccache flatbuffers/2.0.0/recipe-sysroot-native/usr/bin/aarch64-webos-linux/aarch64-webos-linux-g++ --sysroot=flatbuffers/2.0.0/recipe-sysroot -DFLATBUFFERS_LOCALE_INDEPENDENT=1 -Iflatbuffers/2.0.0/git/include -Iflatbuffers/2.0.0/git/grpc -mbranch-protection=standard -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Werror=return-type -funwind-tables --sysroot=flatbuffers/2.0.0/recipe-sysroot -O2 -pipe -g -feliminate-unused-debug-types -fcanon-prefix-map -fmacro-prefix-map=flatbuffers/2.0.0/git=/usr/src/debug/flatbuffers/2.0.0 -fdebug-prefix-map=flatbuffers/2.0.0/git=/usr/src/debug/flatbuffers/2.0.0 -fmacro-prefix-map=flatbuffers/2.0.0/build=/usr/src/debug/flatbuffers/2.0.0 -fdebug-prefix-map=flatbuffers/2.0.0/build=/usr/src/debug/flatbuffers/2.0.0 -fdebug-prefix-map=flatbuffers/2.0.0/recipe-sysroot= -fmacro-prefix-map=flatbuffers/2.0.0/recipe-sysroot= -fdebug-prefix-map=flatbuffers/2.0.0/recipe-sysroot-native= -fvisibility-inlines-hidden -fPIC -DNDEBUG -MD -MT CMakeFiles/flatc.dir/src/util.cpp.o -MF CMakeFiles/flatc.dir/src/util.cpp.o.d -o CMakeFiles/flatc.dir/src/util.cpp.o -c flatbuffers/2.0.0/git/src/util.cpp In file included from ../git/include/flatbuffers/util.h:23, from ../git/src/util.cpp:44: ../git/include/flatbuffers/stl_emulation.h: In member function 'constexpr flatbuffers::span<T, Extent>& flatbuffers::span<T, Extent>::operator=(const flatbuffers::span<T, Extent>&)': ../git/include/flatbuffers/stl_emulation.h:549:12: error: assignment of read-only member 'flatbuffers::span<T, Extent>::count_' 549 | count_ = other.count_; | ~~~~~~~^~~~~~~~~~~~~~ Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* vk-gl-cts: Fix branch namesRamax Lo2024-12-081-3/+3
| | | | | | | | The branch names of several upstream repos have been changed, thus we update the recipe to avoid fetching failure. Signed-off-by: Ramax Lo <ramaxlo@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* wireguard-tools: clean the do_fecth warningHaixiao Yan2024-12-081-1/+1
| | | | | | | | | | | Update SRC_URI, change the protocol to https. do_fetch warning: WARNING: wireguard-tools-1.0.20210914-r0 do_fetch: Failed to fetch URL git://git.zx2c4.com/wireguard-tools;branch=master, attempting MIRRORS if available Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 04:38:28 +0000