summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* python3-pycryptodome: Fix CVE-2023-52323Narpat Mali2024-02-154-0/+875
| | | | | | | | | | | | | | PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. References: https://security-tracker.debian.org/tracker/CVE-2023-52323 https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst (From OE-Core rev: 04c9b6b081914005209bac8eeb9f417e7b989cca) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libgit2: Fix CVE-2024-24575 and CVE-2024-24577Soumya Sambu2024-02-153-1/+112
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2024-24575: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in `src/libgit2/revparse.c` uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2. CVE-2024-24577: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2. References: https://nvd.nist.gov/vuln/detail/CVE-2024-24575 https://security-tracker.debian.org/tracker/CVE-2024-24575 https://nvd.nist.gov/vuln/detail/CVE-2024-24577 https://security-tracker.debian.org/tracker/CVE-2024-24577 (From OE-Core rev: 942254eb3ef29c8672a35015c086721c4fbe5a4f) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Fix CVE-2023-46219Archana Polampalli2024-02-154-0/+259
| | | | | | | | | | | When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. (From OE-Core rev: e0f503594e7bc0da9771b69ca7243a34dcadbdde) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2023-45285 and CVE-2023-45287Soumya Sambu2024-02-153-0/+1807
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2023-45285: Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). CVE-2023-45287: Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels. References: https://nvd.nist.gov/vuln/detail/CVE-2023-45285 https://nvd.nist.gov/vuln/detail/CVE-2023-45287 https://security-tracker.debian.org/tracker/CVE-2023-45285 https://security-tracker.debian.org/tracker/CVE-2023-45287 (From OE-Core rev: 616857b9918e8d2e576239b3db2f9f077d1a7222) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: Fix for CVE-2024-25062Vijay Anusuri2024-02-152-0/+34
| | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/2b0aac140d739905c7848a42efc60bfe783a39b7] (From OE-Core rev: 55027bc882cf6cab830f4e4f21fa9a2ffb4ad72e) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual: start: remove idle lineMichael Opdenacker2024-02-091-2/+1
| | | | | | | | | Align with text in the other branches. (From yocto-docs rev: 394ccddfa357d186006439600833fce917a1ffac) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* contributor-guide: fix lore URLBaruch Siach2024-02-091-1/+1
| | | | | | | | | Cc: Michael Opdenacker <michael.opdenacker@bootlin.com> (From yocto-docs rev: af340c7d9a327af0de14d7a6f19215866a0ea835) Signed-off-by: Baruch Siach <baruch@tkos.co.il> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual: gen-tapdevs need iptables installedSimone Weiß2024-02-091-0/+2
| | | | | | | | | | Add the hint to the test setup that runqemu-gen-tapdevs will need the iptables package installed. (From yocto-docs rev: ca4c984006972d34aa51f05797ec8bd47dc675bb) Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Upgrade 3.0.12 -> 3.0.13Peter Marko2024-02-094-424/+2
| | | | | | | | | | | | | | | | | Fixes CVE-2024-0727 Removed included CVE patch backports. New module was implemented in tests and needs to be installed to successfully pass 04-test_provider.t test. Release information: https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3012-and-openssl-3013-30-jan-2024 (From OE-Core rev: 2bdae590ab20dc4518ba247c903060fa67ed0fc4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc-shared-source: ignore CVE-2023-4039Peter Marko2024-02-091-0/+3
| | | | | | | | | | | | Concept of gcc-source prevents cve-check to detect existing CVE patch file. So ignore this CVE in all recipes using gcc-source via this include file. (From OE-Core rev: 04511734c6dc8c7dda3a943b385cd273d012d8c7) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gdb: Fix CVE-2023-39130Deepthi Hemraj2024-02-092-0/+327
| | | | | | | | CVE: CVE-2023-39130 (From OE-Core rev: 7b93bb0ba1513a60cf75ebe55b29723831dfb79a) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gdb: Fix CVE-2023-39129Deepthi Hemraj2024-02-092-0/+51
| | | | | | | | CVE: CVE-2023-39129 (From OE-Core rev: 67b62fd57d7073b42db2747227d07841d0d064e3) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: internal gdb: Fix CVE-2023-39130Deepthi Hemraj2024-02-092-0/+327
| | | | | | | | CVE: CVE-2023-39130 (From OE-Core rev: 97b5bf2505d68bea6d1c2a66318cfbc51335463a) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: internal gdb: Fix CVE-2023-39129Deepthi Hemraj2024-02-092-0/+51
| | | | | | | | CVE: CVE-2023-39129 (From OE-Core rev: fd3f20e1e8bcd63b75e8800fe60d6194a4fd6bd4) Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: ignore CVE-2023-42915Peter Marko2024-02-091-0/+3
| | | | | | | | | | | | | | This CVE reports that apple had to upgrade curl because of other already reported CVEs: * CVE-2023-38039: not affected, introduced in 7.84.0 * CVE-2023-38545: patch already backported * CVE-2023-38546: patch already backported * CVE-2023-42915: reference to itself (From OE-Core rev: 2771a1248a251650f6e2e64731f56ed928c29ce5) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* migration-guide: add release notes for 4.0.16Lee Chee Yang2024-02-072-0/+192
| | | | | | | | (From yocto-docs rev: e2f538547ace9f441795d51591dc620bfe517454) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* image-live.bbclass: LIVE_ROOTFS_TYPE support compressionLudovic Jozeau2024-02-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | The task for fstypes with compression is the same as the task for the uncompressed fstypes, e.g. when adding tar.xz to `IMAGE_FSTYPES`, it will be included into the do_image_tar task and not creating a separate do_image_tar.xz task. This commit fixes `LIVE_ROOTFS_TYPE` with compressed fstypes by depending on the actual task instead of the non-existent do_image_<fstype>.<compression> task. Fixes [YOCTO #15331] (From OE-Core rev: 60d88989698968c13f8e641f0ba1a82fcf700fb7) Signed-off-by: Ludovic Jozeau <ludovic.jozeau@smile.fr> Reviewed-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 67c507e3d42e52a6d452c4a453eeaf7f2e2d68d6) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-jinja2: upgrade 3.1.2 -> 3.1.3Wang Mingyu2024-02-071-1/+1
| | | | | | | | | | | | | | | | | | Changelog: ========== -Fix compiler error when checking if required blocks in parent templates are empty. -xmlattr filter does not allow keys with spaces. -Make error messages stemming from invalid nesting of {% trans %} blocks more helpful (cherry picked from OE-Core rev: 8a0524464583d69df7746253f5020c2c125a8e1f) (From OE-Core rev: 0f0dcf520505d809599a63961ecb5b1e74053b24) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-jinja2: upgrade 3.1.1 -> 3.1.2Alexander Kanavin2024-02-071-1/+1
| | | | | | | | | | | | (cherry picked from OE-Core rev: 1e58fa1fff649a4ab07290d2b0e5a8d69d51ef16) (From OE-Core rev: 90960bdef877c5dc03cc2cb03c77139d6d1e2f8f) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2023-6377 CVE-2023-6478Lee Chee Yang2024-02-073-0/+150
| | | | | | | (From OE-Core rev: 89974b7fa33f3e9d3e3a4df7ad219898fe400d3a) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: toaster/toastergui: Bug-fix verify given layer path only if ↵Alassane Yattara2024-02-071-5/+8
| | | | | | | | | | import/add local layer (Bitbake rev: a4c516ef5e72b2d77ac5ff7e86c5ee2190ebc42f) Signed-off-by: Alassane Yattara <alassane.yattara@savoirfairelinux.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.16kirkstone-4.0.16Steve Sakoman2024-01-251-1/+1
| | | | | | (From OE-Core rev: a744a897f0ea7d34c31c024c13031221f9a85f24) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 4.0.16Steve Sakoman2024-01-251-1/+1
| | | | | | (From meta-yocto rev: fa70fbb1ebf2a712eebc5b154ce6d754324fb6ef) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* documentation: Add UBOOT_BINARY, extend UBOOT_CONFIGJörg Sommer2024-01-242-17/+24
| | | | | | | | | | | | UBOOT_CONFIG accepts a third parameter for the UBOOT_BINARY that isn't documented. To show its usage another example from the meta-freescale layer was picked. (From yocto-docs rev: aba67b58711019a6ba439b2b77337f813ed799ac) Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* manuals: document VSCode extensionEnguerrand de Ribaucourt2024-01-246-3/+56
| | | | | | | | | | | | | | | | The VSCode extension is now officially maintained and published by the Yocto Project so it should be referenced in the manuals to help users discover it. I located the most relevant places to reference the extension by looking at how the old Eclipse plugin was documented in the 2.6 manuals as well as the current Toaster references. (From yocto-docs rev: 21ec0d3b52069dfc85ff47fb4f913a26a092c480) Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: resources: sync with master branchMichael Opdenacker2024-01-241-33/+33
| | | | | | | (From yocto-docs rev: 0c3596248cee47079a4c99ed6b476cee36cc84de) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: classes: remove insserv bbclassMaxin B. John2024-01-241-10/+0
| | | | | | | | | | | | | | | | insserv.bbclass was removed from oe-core: commit e6bb5dbb62257a7de730ea9085dfd89520f3e47d Author: Richard Purdie <richard.purdie@linuxfoundation.org> Date: Sun May 10 12:30:49 2015 +0100 insserv: Remove (From yocto-docs rev: eddb6c4e36e298218c23bf688cb1c9c06f32b0d6) Signed-off-by: Maxin John <maxin.john@gmail.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual: start.rst: update use of Download pageSimone Weiß2024-01-241-8/+10
| | | | | | | | | | | The yocto website has changed its structure. Update the section for Accessing the Downloads page to match the new structure. (From yocto-docs rev: c67d471145cf09162059368ffd99f0c80df92520) Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* contributor-guide: use "apt" instead of "aptitude"Michael Opdenacker2024-01-241-1/+1
| | | | | | | | | As used in the rest of the manual. (From yocto-docs rev: c68954d905f01f6cc4f7c8ceb90e77cf9068e639) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: Multiple CVE fixesVijay Anusuri2024-01-2411-0/+813
| | | | | | | | | | | | | | | Fix below CVE's CVE-2023-6816 CVE-2024-0229 CVE-2024-21885 CVE-2024-21886 CVE-2024-0408 CVE-2024-0409 (From OE-Core rev: ad696a0067e11c332a4542ccacd76455f5fbd984) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pam: fix CVE-2024-22365 pam_namespace missesHitendra Prajapati2024-01-242-0/+63
| | | | | | | | | Upstream-Status: Backport from https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb (From OE-Core rev: 9af2e012ee4483541559788dfb9510e0223daefe) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: Fix for CVE-2024-0553 and CVE-2024-0567Vijay Anusuri2024-01-243-0/+311
| | | | | | | | | | | | | | | | | | | | | CVE-2024-0553 A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981. CVE-2024-0567 A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack. Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/40dbbd8de499668590e8af51a15799fbc430595e & https://gitlab.com/gnutls/gnutls/-/commit/9edbdaa84e38b1bfb53a7d72c1de44f8de373405] Reference: https://ubuntu.com/security/CVE-2024-0553 https://ubuntu.com/security/CVE-2024-0567 (From OE-Core rev: de74fd5dea8cc71af1d457b4e688cfbe0f39e4d8) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: fix CVE-2023-6228Yogita Urade2024-01-242-0/+32
| | | | | | | | | | | | | | | | | CVE-2023-6228: An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash. References: https://nvd.nist.gov/vuln/detail/CVE-2023-6228 https://gitlab.com/libtiff/libtiff/-/issues/606 (From OE-Core rev: 0730806ae39093b05ce943df1f9f5d0a25a8a673) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: fix CVE-2023-6237 Excessive time spent checking invalid RSA public keysHitendra Prajapati2024-01-242-0/+128
| | | | | | | | | Upstream-Status: Backport from https://github.com/openssl/openssl/commit/e09fc1d746a4fd15bb5c3d7bbbab950aadd005db (From OE-Core rev: 6bb64af6ce167eadd34570b061b3e6ed13c39c74) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dropbear: backport patch for CVE-2023-48795Peter Marko2024-01-242-0/+235
| | | | | | | | | | Documentation for this patch is under https://github.com/mkj/dropbear/commit/66bc1fcdee594c6cb1139df0ef8a6c9c5fc3fde3 (From OE-Core rev: 626711a95f387090a4705401d2f9406909821f95) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pybootchartgui: fix 2 SyntaxWarningsMartin Jansa2024-01-211-2/+2
| | | | | | | | | | | | | | | scripts/pybootchartgui/pybootchartgui/draw.py:820: SyntaxWarning: "is not" with a literal. Did you mean "!="? if (OPTIONS.show_pid or OPTIONS.show_all) and ipid is not 0: scripts/pybootchartgui/pybootchartgui/draw.py:918: SyntaxWarning: "is not" with a literal. Did you mean "!="? if i is not 0: (From OE-Core rev: ebd61290a644a6d9f2b3701e0e7ea050636da76c) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 8d996616f0ca57220d939a41ca9ba6d696ea2a4f) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cpio: upgrade to 2.14Soumya Sambu2024-01-217-1016/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This includes fix for CVE-2023-7207. Drop all submitted patches. Apply a patch from git to fix the build with clang. [ YOCTO #11674 ] $git log --oneline release_2_13..v2.14 4a41909 (HEAD, tag: v2.14) Version 2.14 6f9e5d3 Update NEWS 807b3ea Use GNU ls algorithm for deciding timestamp format 19219d1 Fix integer overflows in timestamp output ed28f14 Whitespace cleanup 4ab2813 Update version of gnulib 0987d63 Fix appending to archives bigger than 2G 1df0062 Fix combination of --create, --append, --directory 6a94d5e New option --ignore-dirnlink 376d663 Fix 45b0ee2b407913c533f7ded8d6f8cbeec16ff6ca. beba8c0 Require automake 1.16.5 70fffa7 Update for newer autotools a1b2f78 Fix calculation of CRC in copy-out mode. 18ea636 Upgrade gnulib 1a61f62 Update copyright years a1c97c8 Fix wording in the manpage 97fab48 Update copyright years 86dacfe Remove redundant condition check 4d16930 Use inttostr to represent integer values as strings 236684f Fix dynamic string reallocations dfc801c Fix previous commit dd96882 Rewrite dynamic string support. 269d204 Improve online version of the documentation. 7dd8ba9 Update gnulib 905907c Update copyright years 4a78d77 Formatting changes in the documentation. 9fe8494 Update copyright years 641d3f4 Minor fix * src/global.c: Remove superfluous declaration of program_name 0c4ffde Fix handling of device numbers (part 2) df55fb1 Fix handling of device numbers on copy out. b1c8583 Improve 684b7ac5 684b7ac Fix cpio header verification. (From OE-Core rev: 203804370997eeb015ef9da90b567ea2c2f9f3a6) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: fix CVE-2023-7008Hitendra Prajapati2024-01-212-0/+41
| | | | | | | | | Upstream-Status: Backport from https://github.com/systemd/systemd/commit/3b4cc1437b51fcc0b08da8cc3f5d1175eed25eb1 (From OE-Core rev: 545fc081f16a63e5b012d4636deee98a788753bb) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* zlib: ignore CVE-2023-6992Peter Marko2024-01-211-0/+3
| | | | | | | | | | | | | This CVE is for iCPE cloudflare:zlib. Alternative to ignoring would be to limit CVE_PRODUCT, but historic CVEs already have two - gnu:zlib and zlib:zlib. So limiting it could miss future CVEs. (From OE-Core rev: f46c9105d4253153a5986f2b307273e43ee98c33) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: backport patch for CVE-2023-7104Peter Marko2024-01-212-0/+45
| | | | | | | | | Backport https://sqlite.org/src/info/0e4e7a05c4204b47 (From OE-Core rev: 31fb83ac3dcd2dd55b184de22a296ab4dc150d2e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "curl: Backport fix CVE-2023-32001"Poonam Jadhav2024-01-212-40/+0
| | | | | | | | | | | | | | This reverts commit 5eab65275dc9faa0b9a4371d5bcb6e95cfda61cd. CVE-2023-32001 has been marked "REJECT" in the NVD CVE List as there is no safe measure against it. These CVEs are stored in the NVD, but do not show up in search results. Link: https://nvd.nist.gov/vuln/detail/CVE-2023-32001 (From OE-Core rev: a3b6216bcb3425b6e30ca73488a5eb6ba58e4836) Signed-off-by: Poonam Jadhav poonam.jadhav@kpit.com Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Backport fix for CVE-2023-6129Vivek Kumbhar2024-01-212-0/+114
| | | | | | | | | Upstream-Status: Backport [https://github.com/openssl/openssl/commit/8d847a3ffd4f0b17ee33962cf69c36224925b34f] (From OE-Core rev: db1c8b434e1e249cf5a12fe39cf996373513f3dc) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* linux-firmware: upgrade 20230804 -> 20231030Dmitry Baryshkov2024-01-111-2/+2
| | | | | | | | | | | License-Update: additional firmwares (From OE-Core rev: 8e27f96c0befbbb5cf8a2f7076b7a1ffd79addb6) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7c725d1f2ed9a271d39d899ac2534558c2d103fc) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: increase the delay between subsequent request failuresDhairya Nagodra2024-01-111-4/+9
| | | | | | | | | | | | | | | | | | | | Sometimes NVD servers are unstable and return too many errors. There is an option to have higher fetch attempts to increase the chances of successfully fetching the CVE data. Additionally, it also makes sense to progressively increase the delay after a failed request to an already unstable or busy server. The increase in delay is reset after every successful request and the maximum delay is limited to 30 seconds. Also, the logs are improved to give more clarity. (From OE-Core rev: f2e30f54e1dbb36d7527d0117eb2435f25e7e154) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7101d654635b707e56b0dbae8c2146b312d211ea) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: faster requests with API keysDhairya Nagodra2024-01-111-1/+6
| | | | | | | | | | | | | | | | | | | As per NVD, the public rate limit is 5 requests in 30s (6s delay). Using an API key increases the limit to 50 requests in 30s (0.6s delay). However, NVD still recommends sleeping for several seconds so that the other legitimate requests are serviced without denial or interruption. Keeping the default sleep at 6 seconds and 2 seconds with an API key. For failures, the wait time is unchanged (6 seconds). Reference: https://nvd.nist.gov/developers/start-here#RateLimits (From OE-Core rev: 4f7e40652cdf647c28f7dc6052bfa5db6bc9d8fb) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 5c32e2941d1dc3d04a799a1b7cbd275c1ccc9e79) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: make number of fetch attemtps configurablePeter Marko2024-01-111-3/+7
| | | | | | | | | | | | | | | | | | Sometimes NVD servers are unstable and return too many errors. Last time we increased number of attempts from 3 to 5, but further increasing is not reasonable as in normal case too many retries is just abusive. Keep retries low as default and allow to increase as needed. (From OE-Core rev: 036969937e7c84cc068efe0355dd26281cf89f03) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6b6fd8043d83b99000054ab6ad2c745d07c6bcc1) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: remove unused variable CVE_SOCKET_TIMEOUTPeter Marko2024-01-111-3/+0
| | | | | | | | | | | | This variable is not referenced in oe-core anymore. (From OE-Core rev: 15a79302aa46c58f962e12956aa4fcd0a178cf58) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 905b45a814cb33327503b793741c19b44c8550b3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: Fix for CVE-2023-6377 and CVE-2023-6478Vijay Anusuri2024-01-113-0/+144
| | | | | | | | | | | | Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd & https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632] (From OE-Core rev: abadef9d1759254699577fe40ee353e75958f9a2) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: update tested and supported distrosMichael Opdenacker2024-01-101-11/+8
| | | | | | | | | | | | | | | | | | According to currently active workers https://autobuilder.yoctoproject.org/typhoon/#/workers and to the "workers_prev_releases" definition in https://git.yoctoproject.org/yocto-autobuilder2/tree/config.py Also correct the text saying that SANITY_TESTED_DISTROS lists currently tested distros. Also replace AlmaLinux 8.8 and 9.2 by just AlmaLinux 8 and 9, as we update our workers anyway. (From yocto-docs rev: 79a6ec6847cdfc40d75def36993a40fec853a7a1) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: asyncrpc: Add context manager APIJoshua Watt2024-01-103-22/+33
| | | | | | | | | | | | | | | | | | Adds context manager API for the asyncrcp client class which allow writing code that will automatically close the connection like so: with hashserv.create_client(address) as client: ... Rework the bitbake-hashclient tool and PR server to use this new API to fix warnings about unclosed event loops when exiting (Bitbake rev: ee090484cc25d760b8c20f18add17b5eff485b40) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d01d684a0f6398270fe35ed59b7d28f3fd9b7e41) Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-09 20:21:52 +0000