summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.27kirkstone-4.0.27Steve Sakoman2025-05-161-1/+1
| | | | | | (From OE-Core rev: e8be08a624b2d024715a5c8b0c37f2345a02336b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 4.0.27Steve Sakoman2025-05-161-1/+1
| | | | | | (From meta-yocto rev: ff73566d1786b524ec8c809bf641b0b74d85b512) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* perl: enable _GNU_SOURCE define via d_gnulibcAlexander Kanavin2025-05-161-0/+1
| | | | | | | | | | | | | | | | | This is needed to properly support memmem() and friends under musl as musl guards the declarations with _GNU_SOURCE define, and if the declarations are not present, gcc will issue warnings and generate assembly that assumes the functions return int (instead of e.g. void*), with catastrophic consequences at runtime. (From OE-Core rev: 79dc3f42958bfefe03a8240e2a57501c38d2bd3c) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6422e62fbc5c65a2165a72c97c880cfa9a80e957) Signed-off-by: Peter Hurley <peter@meraki.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* module.bbclass: add KBUILD_EXTRA_SYMBOLS to installAlon Bar-Lev2025-05-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Symbols are used during install as well, adding KBUILD_EXTRA_SYMBOLS enables successful installation. | DEBUG: Executing shell function do_install | NOTE: make -j 22 KERNEL_SRC=xxx/kernel-source -C xxx/drivers KDIR=xxx/kernel-source DEPMOD=echo MODLIB=xxx/image/lib/modules/6.6.75-yocto-standard-00189-g530c419bc9db INSTALL_FW_PATH=xxx/image/lib/firmware CC=aarch64-poky-linux-gcc -fuse-ld=bfd -fcanon-prefix-map LD=aarch64-poky-linux-ld.bfd OBJCOPY=aarch64-poky-linux-objcopy STRIP=aarch64-poky-linux-strip O=xxx/kernel-build-artifacts modules_install | make: Entering directory 'xxx/drivers' | make -C xxx/kernel-source M=xxx/drivers modules | make[1]: Entering directory 'xxx/kernel-source' | make[2]: Entering directory 'xxx/kernel-build-artifacts' | MODPOST xxx/drivers/Module.symvers | ERROR: modpost: "xxx" [xxx/xxx.ko] undefined! (From OE-Core rev: 1403ffa42014ad5c88c28da6c360ea5fd1857147) Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0ef80eeda967a9e04ff91c3583aabbc35c9868e8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.35 branch updatesDeepesh Varatharajan2025-05-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | d2febe7c40 math: Improve layout of exp/exp10 data 20b5d5ce26 AArch64: Use prefer_sve_ifuncs for SVE memset 9569a67a58 AArch64: Add SVE memset 59f67e1b82 math: Improve layout of expf data 904c58e47b AArch64: Remove zva_128 from memset 8042d17638 AArch64: Optimize memset be451d6053 AArch64: Improve generic strlen 8b3d09dc0d assert: Add test for CVE-2025-0395 29d9b1e59e assert: Reformat Makefile. Testresults: Before update |After update |Difference PASS: 4832 |PASS:4833 |PASS: +1 FAIL: 132 |FAIL:132 |FAIL: 0 XPASS: 6 |XPASS:6 |XPASS: 0 XFAIL: 16 |XFAIL:16 |XFAIL: 0 UNSUPPORTED: 200|UNSUPPORTED:200 |UNSUPPORTED: 0 (From OE-Core rev: 70e9ae425e34221af6a7bdda6b83f2f8e7848278) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* scripts/install-buildtools: Update to 4.0.26Aleksandar Nikolic2025-05-161-2/+2
| | | | | | | | | Update to the 4.0.26 release of the 4.0 series for buildtools (From OE-Core rev: 04ff268291598c1e0588cff43df694a714e48746) Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32914Vijay Anusuri2025-05-162-0/+112
| | | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/5bfcf8157597f2d327050114fb37ff600004dbcf] (From OE-Core rev: ce7cda16d823012f71d91c820083b0da93762d9d) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32912Vijay Anusuri2025-05-163-0/+73
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/cd077513f267e43ce4b659eb18a1734d8a369992 & https://gitlab.gnome.org/GNOME/libsoup/-/commit/910ebdcd3dd82386717a201c13c834f3a63eed7f (From OE-Core rev: 7c709d985c4e732f6fedd56748b3de3e52869282) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32911 & CVE-2025-32913Vijay Anusuri2025-05-163-0/+118
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/7b4ef0e004ece3a308ccfaa714c284f4c96ade34 & https://gitlab.gnome.org/GNOME/libsoup/-/commit/f4a761fb66512fff59798765e8ac5b9e57dceef0 (From OE-Core rev: e79585ab2a492a5023bce637cbe519fcd1370e04) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32910Vijay Anusuri2025-05-164-0/+277
| | | | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/e40df6d48a1cbab56f5d15016cc861a503423cfe & https://gitlab.gnome.org/GNOME/libsoup/-/commit/405a8a34597a44bd58c4759e7d5e23f02c3b556a & https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832 (From OE-Core rev: aeaa106595f173f5646a17adb413a85e0d01887e) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32909Vijay Anusuri2025-05-162-0/+37
| | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/comm it/ba4c3a6f988beff59e45801ab36067293d24ce92 (From OE-Core rev: 491373828c1c66030fb41687f9a42b9e4deb010b) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32906Vijay Anusuri2025-05-163-0/+146
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/1f509f31b6f8420a3661c3f990424ab7b9164931 & https://gitlab.gnome.org/GNOME/libsoup/-/commit/af5b9a4a3945c52b940d5ac181ef51bb12011f1f (From OE-Core rev: 17fbb56b3cbea445767cba988f3db5b32fb00b71) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: update fix CVE-2024-52532Vijay Anusuri2025-05-162-0/+47
| | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/4c9e75c6676a37b6485620c332e568e1a3f530ff (From OE-Core rev: caf0ac894d029aaac7d746fe87db1aa0e8c3c93f) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Fix CVE-2025-32909Vijay Anusuri2025-05-162-0/+37
| | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/comm it/ba4c3a6f988beff59e45801ab36067293d24ce92 (From OE-Core rev: ad1244ee75b4169eab21c2c8744b86342b32dd07) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Fix CVE-2025-32906Vijay Anusuri2025-05-163-0/+146
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/1f509f31b6f8420a3661c3f990424ab7b9164931 & https://gitlab.gnome.org/GNOME/libsoup/-/commit/af5b9a4a3945c52b940d5ac181ef51bb12011f1f (From OE-Core rev: 2b938dd6beb1badca59804ffbe395deb679bc1b1) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Update fix CVE-2024-52532Vijay Anusuri2025-05-162-0/+47
| | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/4c9e75c6676a37b6485620c332e568e1a3f530ff (From OE-Core rev: 144d067ed5b98b8ca477a6a0e8c958c0b15e9643) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* perl: patch CVE-2024-56406Peter Marko2025-05-162-0/+31
| | | | | | | | | | | | Pick patch mentioned in NVD links for this CVE. Tested by runniing ptest and CVE reproducer (before&after). Ptest fails on test dist/threads/t/join, however the same test also fails without this patch. (From OE-Core rev: 8e3c821e9ce8f3a9667847a284bc5a6f4973ea13) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: Add single-threaded fast path to rand()Haixiao Yan2025-05-142-0/+48
| | | | | | | | | | | | Backport a patch [1] to improve performance of rand() and __random()[2] by adding a single-threaded fast path. [1] https://sourceware.org/git/?p=glibc.git;a=commit;h=be0cfd848d9ad7378800d6302bc11467cf2b514f [2] https://sourceware.org/bugzilla/show_bug.cgi?id=32777 (From OE-Core rev: 00f7a2f60dd6de95a1a47fa642978613ce76dc56) Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: ignore CVE-2023-1386Peter Marko2025-05-141-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Upstream Repository: https://gitlab.com/qemu-project/qemu.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2023-1386 Type: Security Advisory CVE: CVE-2023-1386 Score: 3.3 Analysis: - According to redhat[1] this CVE has closed as not a bug. Reference: [1] https://bugzilla.redhat.com/show_bug.cgi?id=2223985 (From OE-Core rev: 6a5d9e3821246c39ec57fa483802e1bb74fca724) (From OE-Core rev: f7c8877395d4ec0a91cd5cf54e6c2858495746fb) Signed-off-by: Madhu Marri <madmarri@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (Converted to old CVE_CHECK_IGNORE syntax) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* busybox: fix CVE-2023-39810Hitendra Prajapati2025-05-142-0/+132
| | | | | | | | | Upstream-Status: Backport from https://git.busybox.net/busybox/commit/?id=9a8796436b9b0641e13480811902ea2ac57881d3 (From OE-Core rev: c0b71ec35716a512915b00808a26f77481db0e0a) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* connman :fix CVE-2025-32743Praveen Kumar2025-05-142-0/+44
| | | | | | | | | | | | | | | | | | | | In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response. This allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code, because those lookup values lead to incorrect length calculations and incorrect memcpy operations. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-32743 Upstream-patch: https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d90b911f6760959bdf1393c39fe8d1118315490f (From OE-Core rev: ece0fb01bf28fa114f0a6e479491b4b6f565c80c) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: ignore CVE-2024-29507Peter Marko2025-05-141-1/+1
| | | | | | | | | | | | | | | | | | | Fix for this CVE is [3] (per [1] and [2]). It fixes cidfsubstfont handling which is not present in 9.55.0 yet. It was introduced (as cidsubstpath) in 9.56.0 via [4] and later modified to cidfsubstfont in [5]. Since this recipe has version 9.55.0, mark it as not affected yet. [1] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=7745dbe24514710b0cfba925e608e607dee9eb0f [2] https://nvd.nist.gov/vuln/detail/CVE-2024-29507 [3] https://security-tracker.debian.org/tracker/CVE-2024-29507 [4] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=82efed6cae8b0f2a3d10593b21083be1e7b1ab23 [5] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=4422012f6b40f0627d3527dba92f3a1ba30017d3 (From OE-Core rev: 5c9f3c244971aadee65a98d83668e3d5d63825a0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: ignore CVE-2025-27837Peter Marko2025-05-141-0/+2
| | | | | | | | | | | | This CVE only impacts codepaths relevant for Windows builds. Se [1] from Debian which marks it as not applicable. [1] https://security-tracker.debian.org/tracker/CVE-2025-27837 (From OE-Core rev: fb5dc4a476bc4054493d6a7eb64a423e3665afb9) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Fix dead links that use the DISTRO macroAntonin Godard2025-05-029-12/+12
| | | | | | | | | | | | | | | | | | | | After introducing the DISTRO_LATEST_TAG and DISTRO_REL_LATEST_TAG macros, use them in links that currently use DISTRO/DISTRO_REL_TAG. When building for the tip of a branch, this will replace the current A.B.999 in links to the latest existing tag. The links were found across the documentation by running 'grep -r "http.*5\.2\.999"' inside the _build/html output after building the docs. [YOCTO #14802] (From yocto-docs rev: 0d51e553d5f83eea6634e03ddc9c7740bf72fcea) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 29be069ebbf2c55d72fc51d99ed5a558af37c05e) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.yaml: introduce DISTRO_LATEST_TAGAntonin Godard2025-05-022-2/+23
| | | | | | | | | | | | | | | | | | | | | | | | | Introduce the DISTRO_LATEST_TAG macro, which should always point to the latest existing tag in the documentation, unlike DISTRO which may point to A.B.999 to represent the tip of a branch. This variable is needed to fix dead links in the documentation that currently use the DISTRO macro. Also, make DISTRO_REL_TAG use the DISTRO macro directly, to avoid repetition, and add a DISTRO_REL_LATEST_TAG macro that has the same role as DISTRO_LATEST_TAG but with "yocto-" prepended to it. In set_versions.py, run the "git describe --abbrev=0 --tags --match='yocto-*'" command to get the latest existing tag on the currently checked out commit. Fallback to ourversion in case we didn't find any. (From yocto-docs rev: 9fabb08405601646fd9b00326442e03d43f68804) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit a85b0e500c94921f77fa7b7dbb877e4945f96d1e) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* manuals: remove repeated wordAndrew Kreimer2025-05-021-1/+1
| | | | | | | | | | The word "modern" appears twice, remove the extra one. (From yocto-docs rev: db02bc7eb59feaece5d2a07b3586fd41c7a73a1e) Signed-off-by: Andrew Kreimer <algonell@gmail.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: document autotools class related variablesAntonin Godard2025-05-021-0/+17
| | | | | | | | | Document the AUTOTOOLS_SCRIPT_PATH and the CONFIGURE_SCRIPT variables. (From yocto-docs rev: f7721ff5312b1ebf87dd374db22b254913879ff0) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "cve-update-nvd2-native: Tweak to work better with NFS DL_DIR"Peter Marko2025-05-021-2/+0
| | | | | | | | | | | | | | This reverts commit 7adaec468d3a61d88c990b1b319b34850bee7e44. It does not seem to fix the issue it was supposed to fix. Additionally it breaks code which decides in full/partial update, because it manipulates timestamp that code is relying on. (From OE-Core rev: 25ba9895b98715adb66a06e50f644aea2e2c9eb6) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ebc65fdddd7ce51f0f1008baa30d0ae7918ae0bb) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: systemd-journald fails to setup LogNamespaceHaitao Liu2025-05-022-0/+79
| | | | | | | | | | | | | | | | | | | | | A LogNamespace error for systemd v250: """ Apr 28 17:44:00 a-rinline2b systemd[467]: systemd-journald@tester.service: Failed to set up special execution directory in /var/log: Not a directory Apr 28 17:44:00 a-rinline2b systemd[467]: systemd-journald@tester.service: Failed at step LOGS_DIRECTORY spawning /lib/systemd/systemd-journald: Not a directory """ That's because that "/var/log/journal" couldn't be created during program runtime. (From OE-Core rev: 8eb185024f9a9e57a9b710c70f09552729558892) Signed-off-by: Haitao Liu <haitao.liu@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: backport patch to fix journal issueChen Qi2025-05-022-0/+88
| | | | | | | | | | | Backport a patch to fix systemd journal issue about sd_journal_next not behaving correctly after sd_journal_seek_tail. (From OE-Core rev: ea59aed1ff7dbfb28d1e2cd55adca80dad2502e2) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzdata/tzcode-native: upgrade 2025a -> 2025bPriyal Doshi2025-05-021-3/+3
| | | | | | | (From OE-Core rev: 2568f7ce707d63df1f98b3eeec6639d7a5a2d642) Signed-off-by: Priyal Doshi <pdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-setuptools: Fix CVE-2024-6345Soumya Sambu2025-05-022-0/+354
| | | | | | | | | | | | | | | | | | | | | A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0. References: https://nvd.nist.gov/vuln/detail/CVE-2024-6345 https://ubuntu.com/security/CVE-2024-6345 Upstream patch: https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0 (From OE-Core rev: 238c305ba2c513a070818de4b6ad4316b54050a7) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-1178Deepesh Varatharajan2025-05-022-0/+34
| | | | | | | | | | | | | | | Prevent an abort in the bfd linker when attempting to generate dynamic relocs for a corrupt input file. PR 32638 Backport a patch from upstream to fix CVE-2025-1178 Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0] (From OE-Core rev: e820e5364c4b3ec52796a77842b480fea8bc7967) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: patch CVE-2025-3360Peter Marko2025-05-027-0/+335
| | | | | | | | | | | | Backport commits from [1] fixing [2] for 2.82.x. [1] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4499 [2] https://gitlab.gnome.org/GNOME/glib/-/issues/3647x (From OE-Core rev: 606cc539ab19ae2bceb366eda7d4872c3763400f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: patch CVE-2025-32415Peter Marko2025-05-022-0/+40
| | | | | | | | | Pick commit from 2.13 branch as 2.9 branch is unmaintained now. (From OE-Core rev: 7777cd6b28988a0981b990d9da9d448dcdfe7b8b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: patch CVE-2025-32414Peter Marko2025-05-022-0/+75
| | | | | | | | | Pick commit from 2.12 branch as 2.9 branch is unmaintained now. (From OE-Core rev: fbd708438aba0381a6c4f3d6cfbbd743f89a4f97) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: ignore CVE-2024-48615Peter Marko2025-05-021-0/+2
| | | | | | | | | | | | | | | Fix for this CVE [1] is patchong code introduced by [2] in v3.7.5. So v3.6.2 is not affected yet and the CVE can be safely ignored. Also Debian tracker [3] contains this statement. [1] https://github.com/libarchive/libarchive/commit/565b5aea491671ae33df1ca63697c10d54c00165 [2] https://github.com/libarchive/libarchive/commit/2d8a5760c5ec553283a95a1aaca746f6eb472d0f [3] https://security-tracker.debian.org/tracker/CVE-2024-48615 (From OE-Core rev: 60390a3a28242efba32360426b0a3be6af5fb54b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: ignore CVE-2025-27833Peter Marko2025-05-021-1/+2
| | | | | | | | | | | | | | Vulnerable code was introduced in 9.56.0, so 9.55.0 is not affected yet Commit introducing vulnerable feature: * https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/pdf/pdf_fmap.c?id=0a1d08d91a95746f41e8c1d578a4e4af81ee5949 Commit fixing the vulnerability: * https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=477e36cfa1faa0037069a22eeeb4fc750733f120 (From OE-Core rev: e1f3d02e80f6bdd942321d9f6718dcc36afe9df8) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ppp: patch CVE-2024-58250Peter Marko2025-05-022-1/+186
| | | | | | | | | | | | | | | | Backport patch to remove vulnerable component. This is a breaking change, but there will be no other fix for this CVE as upstream did the deletion without providing a fix first. If someone really needs this feature, which the commit message describes as deprecated, bbappend with patch removal is possible. License-Update: passprompt plugin removed (From OE-Core rev: d04a2b5f4899845429e1c5893535f5df1221fcbf) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpam: Update fix for CVE-2024-10041Shubham Kulkarni2025-05-023-1/+79
| | | | | | | | | | | | | | | Initially, PAM community fixed CVE-2024-10041 in the version v1.6.0 via commit b3020da. But not all cases were covered with this fix and issues were reported after the release. In the v1.6.1 release, PAM community fixed these issues via commit b7b9636. Backport this commit b7b9636, which Fixes: b3020da ("pam_unix/passverify: always run the helper to obtain shadow password file entries") Backport from https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620 (From OE-Core rev: 71035c8c5907f7103ce40b92490a10bd3dde7226) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: patch CVE-2025-29088Peter Marko2025-05-022-0/+180
| | | | | | | | | | | | Pick commit [1] mentioned in [2]. [1] https://github.com/sqlite/sqlite/commit/56d2fd008b108109f489339f5fd55212bb50afd4 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-29088 (From OE-Core rev: 70d2d56f89d6f4589d65a0b4f0cbda20d2172167) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: fix CVE-2024-43398Divya Chellam2025-04-182-0/+82
| | | | | | | | | | | | | | | | | | | | | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected. The REXML gem 3.3.6 or later include the patch to fix the vulnerability. Reference: https://security-tracker.debian.org/tracker/CVE-2024-43398 Upstream-patch: https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3 (From OE-Core rev: f23d1bfca0ea57150c397bc2e495191fb61423d0) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-22871Hitendra Prajapati2025-04-182-0/+173
| | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/15e01a2e43ecb8c7e15ff7e9d62fe3f10dcac931 (From OE-Core rev: 2a9f47eb507cf57b58c4aa1baf0ef645b699fd6c) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: ignore CVEs which reappeared after upgrade to 250.14Peter Marko2025-04-181-0/+3
| | | | | | | | | | | | Upgrade from 250.5 to 250.14 removed patches for these CVEs because they were interated in the new version. However NVD DB does not contain information about these backports to v250 branch, so they need to be ignored. (From OE-Core rev: b86129da823c55a3e08ee72c99675301948949f8) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: add workaround for json5 style listPeter Marko2025-04-181-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NVD responses changed to an invalid json between: * April 5, 2025 at 3:03:44 AM GMT+2 * April 5, 2025 at 4:19:48 AM GMT+2 The last response is since then in format { "resultsPerPage": 625, "startIndex": 288000, "totalResults": 288625, "format": "NVD_CVE", "version": "2.0", "timestamp": "2025-04-07T07:17:17.534", "vulnerabilities": [ {...}, ... {...}, ] } Json does not allow trailing , in responses, that is json5 format. So cve-update-nvd2-native do_Fetch task fails with log backtrace ending: ... File: '/builds/ccp/meta-siemens/projects/ccp/../../poky/meta/recipes-core/meta/cve-update-nvd2-native.bb', lineno: 234, function: update_db_file 0230: if raw_data is None: 0231: # We haven't managed to download data 0232: return False 0233: *** 0234: data = json.loads(raw_data) 0235: 0236: index = data["startIndex"] 0237: total = data["totalResults"] 0238: per_page = data["resultsPerPage"] ... File: '/usr/lib/python3.11/json/decoder.py', lineno: 355, function: raw_decode 0351: """ 0352: try: 0353: obj, end = self.scan_once(s, idx) 0354: except StopIteration as err: *** 0355: raise JSONDecodeError("Expecting value", s, err.value) from None 0356: return obj, end Exception: json.decoder.JSONDecodeError: Expecting value: line 1 column 1442633 (char 1442632) ... There was no announcement about json format of API v2.0 by nvd. Also this happens only if whole database is queried (database update is fine, even when multiple pages as queried). And lastly it's only the cve list, all other lists inside are fine. So this looks like a bug in NVD 2.0 introduced with some update. Patch this with simple character deletion for now and let's monitor the situation and possibly switch to json5 in the future. Note that there is no native json5 support in python, we'd have to use one of external libraries for it. (From OE-Core rev: cee817c0c3653cc96833815bfe2c87d2d85cc19e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6e526327f5c9e739ac7981e4a43a4ce53a908945) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2025-27836Vijay Anusuri2025-04-113-0/+112
| | | | | | | | | | | | Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=8b6d19b2b4079da6863ef25f2370f25d4b054919 & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=d84efb73723384a8b7fb3989c824cfa218060085] (From OE-Core rev: 7399cf17590204f8289f356cce4575592d6e3536) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2025-27835Vijay Anusuri2025-04-112-0/+35
| | | | | | | | | | Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=de900010a6f2310d1fd54e99eeba466693da0e13] (From OE-Core rev: c30c46c2b4048dd58cf91b1523ddeca6075176ec) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2025-27834Vijay Anusuri2025-04-112-0/+58
| | | | | | | | | | Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ef42ff180a04926e187d40faea40d4a43e304e3b] (From OE-Core rev: 06fb236cabf550ea7c92cda0a725dd3db8a8a38b) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2025-27832Vijay Anusuri2025-04-112-0/+46
| | | | | | | | | Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=57291c846334f1585552010faa42d7cb2cbd5c41] (From OE-Core rev: a1cd1e6275cc5ae3c100a3259e24d03937a4b78d) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2025-27831Vijay Anusuri2025-04-113-0/+136
| | | | | | | | | | | | Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=bf79b61cb1677d6865c45d397435848a21e8a647 & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=bf79b61cb1677d6865c45d397435848a21e8a647] (From OE-Core rev: 810795d2f1d7798c52675efd94917bf99fb940d0) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-07 23:07:58 +0000