summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
Commit message (Collapse)AuthorAgeFilesLines
...
* python3-git: upgrade 3.1.27 -> 3.1.32Narpat Mali2023-08-303-590/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 3.1.27 & 3.1.32 contains the CVE-2022-24439 & CVE-2023-40267 fixes and other bugfixes. Changelog: https://github.com/gitpython-developers/GitPython/releases/tag/3.1.32 https://gitpython.readthedocs.io/en/stable/changes.html#id5 - Bump cygwin/cygwin-install-action from 3 to 4 by @dependabot in #1572 - Fix up the commit trailers functionality by @itsluketwist in #1576 - Name top-level exceptions as private variables by @Hawk777 in #1590 - fix pypi long description by @eUgEntOptIc44 in #1603 - Don't rely on del by @r-darwish in #1606 - Block insecure non-multi options in clone/clone_from by @Beuc in #1609 - Fix Sphinx rendering errors by @stephan-cr in #1524 - tests: Use command -v instead of third-party which program by @mgorny in #1525 - fix/add allow_unsafe_* params in docstrings + fix typo by @obfusk in #1530 - use tempfile.TemporaryDirectory & fix clone_from_unsafe_protocol tests by @obfusk in #1531 - Fix some resource leaks by open file handles by @marlamb in #1532 - fix files list on file rename by @teknoraver in #1537 - Declare support for Python 3.11 by @hugovk in #1541 - Fix ignored by @Lightborne in #1545 - Fix timezone parsing functions for non-hour timezones by @jcowgill in #1547 - Enable user to override default diff -M arg by @mellowed100 in #1551 - Remove optional from two member variables by @Sineaggi in #1550 - Fix RecursionError when iterating streams by @eric-wieser in #1554 - Fix get_values() so it correctly loads section names by @Codym48 in #1555 - Add datetime.datetime type to commit_date and author_date by @SergeantMenacingGarlic in #1501 - Bump cygwin/cygwin-install-action from 2 to 3 by @dependabot in #1514 - Fix command injection by @stsewd in #1518 - Document PushInfoList by @skinitimski in #1522 - Fix type hint on create_tag by @drewcassidy in #1523 - Block insecure options and protocols by default by @stsewd in #1521 - Make the git.__version__ re-appear. (From OE-Core rev: 8ceaeff90023e51c7e874464f026b30d24035bda) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Qemu: Resolve undefined reference issue in CVE-2023-2861Siddharth2023-08-301-29/+37
| | | | | | | | | | | | | | The commit [https://github.com/openembedded/openembedded-core/commit/9bd4ddeb4b5efc65b0514d50d6991211271924c1] backports fix for CVE-2023-2861 for version 6.2.0. The 'qemu_fstat' in `do_create_others' is not defined which leads to the undefined symbol error on certain architectures. Also, the commit message says "(Mjt: drop adding qemu_fstat wrapper for 7.2 where wrappers aren't used)". So either the wrapper has to be dropped or it has to be defined. Hence, backported the main patch rather than the cherry picked one. (From OE-Core rev: 983d19dfdad361f8b3275b404f1ac0b9befc9f6c) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2023-29409Soumya Sambu2023-08-302-0/+176
| | | | | | | | | | | | | | | | | | | | | | Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable. References: https://nvd.nist.gov/vuln/detail/CVE-2023-29409 (From OE-Core rev: 51c2fee0e4bb4b3131c61d91510394cd4b4f9eb9) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* automake: fix buildtest patchJulien Stephan2023-08-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Add check_PROGRAMS as a dependency of buildtest-TESTS target. This is required because according to the official automake documentation [1]: * TESTS: contains all the tests files * check_PROGRAMS: contains the programs used by the tests * check_PROGRAMS is not automatically added to TESTS So, by using only TESTS as a dependency for buildtest-TESTS we may end up having runtime errors because of missing program required by the tests. [1]: https://www.gnu.org/software/automake/manual/html_node/Scripts_002dbased-Testsuites.html (From OE-Core rev: 5859a4143a1495198af323cedf06248c9b363060) Signed-off-by: Julien Stephan <jstephan@baylibre.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee3e2af4f8ed95b4fd0f7cec52ae4e169401b719) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dmidecode: fixup for CVE-2023-30630Adrian Freihofer2023-08-196-191/+394
| | | | | | | | | | | | | | | | | | | | | | | | | | | The previous CVE-2023-30630_1.patch picked only the patch "dmidecode: Write the whole dump file at once" d8cfbc808f. But there was a refactoring which does not allow to cherry-pick it fast forward. Resolving this conflict was not correctly done. The patch was: + u32 len; + u8 *table; ... - if (!(opt.flags & FLAG_QUIET)) - pr_comment("Writing %d bytes to %s.", crafted[0x05], - opt.dumpfile); - write_dump(0, crafted[0x05], crafted, opt.dumpfile, 1); + dmi_table_dump(crafted, crafted[0x05], table, len); It looks like the variables len and table have been added without initialization. Now this problem is solved by applying the previous refactoring as well. Patch 1 gets replaced by Patch 1a and Patch 1b. Patch 2..4 are rebased without changes. (From OE-Core rev: ea069a94a213cc153528aebfc387f30215566cc7) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3180Archana Polampalli2023-08-192-0/+51
| | | | | | | | | | | | | | | | | | | A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ. References: https://nvd.nist.gov/vuln/detail/CVE-2023-3180 Upstream patches: https://gitlab.com/qemu-project/qemu/-/commit/49f1e02bac166821c712534aaa775f50e1afe17f (From OE-Core rev: de421cab92c49ba0f068eae9d6b458a0368fcd03) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3354 VNC: improper I/O watch removal in TLS handshake can ↵Vivek Kumbhar2023-08-192-0/+88
| | | | | | | | | lead to remote unauthenticated denial of service (From OE-Core rev: 42859fe600e5dddba3c51fa8d1e680721b73e5dc) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2020-14394Yogita Urade2023-08-192-0/+80
| | | | | | | | | | | | QEMU: infinite loop in xhci_ring_chain_length() in hw/usb/hcd-xhci.c Reference: https://gitlab.com/qemu-project/qemu/-/issues/646 (From OE-Core rev: 057f4f77ac2e83f99c916dceb4cbbcc8de448ad4) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-certifi: fix CVE-2023-37920Narpat Mali2023-08-192-1/+304
| | | | | | | | | | | | | | | | | | | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. References: https://nvd.nist.gov/vuln/detail/CVE-2023-37920 https://github.com/certifi/python-certifi/security/advisories/GHSA-xqr8-7jwr-rhp7 (From OE-Core rev: 98abbe3394638c6ce795b34247a9e49120e4ffba) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: fix runpath errors in cc1 binarySteve Sakoman2023-08-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The runpath in the cc1 binary is: Library runpath: [$ORIGIN/../../../recipe-sysroot-native/usr/lib:$ORIGIN/../../../recipe-sysroot-native/lib] This does not match the actual location of the libraries, which would require: Library runpath: [$ORIGIN/../../recipe-sysroot-native/usr/lib:$ORIGIN/../../recipe-sysroot-native/lib] Prior to gcc 9.1 the recipe set B explicity with: B = "${WORKDIR}/gcc-${PV}/build.${HOST_SYS}.${TARGET_SYS}" and this build directory structure matches the runpath in cc1, so there is no issue. This line was commented out in versions 9.1 through 11.3. The upgrade to 12.1 once again uncommented this line. As a result the runpath is incorrect in version 9.1 through 11.3 and cc1 defaults to using host libraries. This patch restores setting B as done in master and versions prior to 9.1 (From OE-Core rev: b6f4b3d43a399c2b446754de56ebea35657e13de) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc : upgrade to v11.4Sundeep KOKKONDA2023-08-0715-96/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | gcc stable version upgraded from v11.3 to v11.4 For changes in v11.4 see - https://gcc.gnu.org/gcc-11/changes.html Below is the bug fix list for v11.4 https://gcc.gnu.org/bugzilla/buglist.cgi?bug_status=RESOLVED&order=short_desc%2Cbug_status%2Cpriority%2Cassigned_to%2Cbug_id&query_format=advanced&resolution=FIXED&target_milestone=11.4 There are a total 115 bugs are fixed in this release, below is the list of bugs fixed excluding the regression fixes. ID Product Comp Resolution Summary▲ 108199 gcc tree-opt FIXE Bitfields, unions and SRA and storage_order_attribute 107801 gcc libstdc+ FIXE Building cross compiler for H8 family fails in libstdc++ (c++17/memory_resource.cc) 108265 gcc libstdc+ FIXE chrono::hh_mm_ss can't be constructed from unsigned durations 104443 gcc libstdc+ FIXE common_iterator<I, S>::operator-> is not correctly implemented 98056 gcc c++ FIXE coroutines: ICE tree check: expected record_type or union_type or qual_union_type, have array_type since r11-2183-g0f66b8486cea8668 107061 gcc target FIXE ENCODEKEY128 clobbers xmm4-xmm6 105433 gcc testsuit FIXE FAIL: gcc.target/i386/iamcu/test_3_element_struct_and_unions.c 105095 gcc testsuit FIXE gcc.dg/vect/complex/fast-math-complex-* tests are not executed 100474 gcc c++ FIXE ICE: in diagnose_trait_expr, at cp/constraint.cc:3706 105854 gcc target FIXE ICE: in extract_constrain_insn, at recog.cc:2692 (insn does not satisfy its constraints: sse2_lshrv1ti3) 104462 gcc target FIXE ICE: in extract_constrain_insn_cached, at recog.cc:2682 with -mavx512fp16 -mno-xsave 106045 gcc libgomp FIXE Incorrect testcase in libgomp.c/target-31.c at -O0 56189 gcc c++ FIXE Infinite recursion with noexcept when instantiating function template 100295 gcc c++ FIXE Internal compiler error from generic lambda capturing parameter pack and expanding it in if constexpr 100613 gcc jit FIXE libgccjit should produce dylib on macOS 104875 gcc libstdc+ FIXE libstdc++-v3/src/c++11/codecvt.cc:312:24: warning: left shift count >= width of type 107471 gcc libstdc+ FIXE mismatching constraints in common_iterator 105284 gcc libstdc+ FIXE missing syncstream and spanstream forward decl. in <iosfwd> 98821 gcc c++ FIXE modules : c++tools configures with CC but code fragments assume CXX. 109846 gcc fortran FIXE Pointer-valued function reference rejected as actual argument 101324 gcc target FIXE powerpc64le: hashst appears before mflr at -O1 or higher 102479 gcc c++ FIXE segfault when deducing class template arguments for tuple with libc++-14 105128 gcc libstdc+ FIXE source_location compile error for latest clang 15 106183 gcc libstdc+ FIXE std::atomic::wait might fail to be unblocked by notify_one/all on platforms without platform_wait() 102994 gcc libstdc+ FIXE std::atomic<ptr>::wait is not marked const 105324 gcc libstdc+ FIXE std::from_chars() assertion at floating_from_chars.cc:78 when parsing 1.11111111.... 105375 gcc libstdc+ FIXE std::packaged_task has no deduction guide. 104602 gcc libstdc+ FIXE std::source_location::current uses cast from void* 106808 gcc libstdc+ FIXE std::string_view range concept requirement causes compile error with Boost.Filesystem 105725 gcc c++ FIXE [ICE] segfault with `-Wmismatched-tags` 105920 gcc target FIXE __builtin_cpu_supports ("f16c") should check AVX (From OE-Core rev: 4fd7e5951c42336729f12cde71450ec298f2078b) Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24531Sakib Sajal2023-08-073-1/+302
| | | | | | | | | Backport required patches from go1.21 to fix CVE-2023-24531. (From OE-Core rev: 6d892c52bd5806507a05e8b6f749c54bbd9e9da6) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24536Sakib Sajal2023-08-074-0/+676
| | | | | | | | | Backport required patches to fix CVE-2023-24536. (From OE-Core rev: a774c895f4a425979cef8e05e8dd17c2dcb67654) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-2861Archana Polampalli2023-08-072-0/+173
| | | | | | | | | | | | | | | 9pfs: prevent opening special files References: https://nvd.nist.gov/vuln/detail/CVE-2023-2861 Upstream patches: https://github.com/qemu/qemu/commit/10fad73a2bf1c76c8aa9d6322755e5f877d83ce5 (From OE-Core rev: 9bd4ddeb4b5efc65b0514d50d6991211271924c1) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3255Archana Polampalli2023-08-072-0/+65
| | | | | | | | | | | | | | | VNC: infinite loop in inflate_buffer() leads to denial of service References: https://nvd.nist.gov/vuln/detail/CVE-2023-3255 Upstream patches: https://gitlab.com/qemu-project/qemu/-/commit/d921fea338c1059a27ce7b75309d7a2e485f710b (From OE-Core rev: 52711b1392ed0c5cbe4ddf70a94b21be2f4e6e58) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2023-3301Archana Polampalli2023-08-072-0/+61
| | | | | | | | | | | | | | | | qemu: hotplug/hotunplug mlx vdpa device to the occupied addr port, then qemu core dump occurs after shutdown guest References: https://nvd.nist.gov/vuln/detail/CVE-2023-3301 Upstream patches: https://gitlab.com/qemu-project/qemu/-/commit/a0d7215e339b61c7d7a7b3fcf754954d80d93eb8 (From OE-Core rev: f549ff6db018f66a80fc65987675e8bb6afcd002) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: fix missing comma in get_module_deps3.pyRoss Burton2023-08-021-1/+1
| | | | | | | | | | | | | | | Wes Tarro <wes.tarro@azuresummit.com> noticed a missing comma in a preplace() call, add it. That said, calling replace() with one argument results in a TypeError, so this is obviously dead code. (From OE-Core rev: 3a79a210665efae1af6d68e9e923a739c82d800e) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9b2e2c8d809e7ca34451ec9702b029a00dfb410b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: upgrade 3.10.9 -> 3.10.12Tim Orling2023-08-022-53/+2
| | | | | | | | | | | | | | | | | | | | | | | | Security and bugfix updates. * Drop cve-2023-24329.patch as it is merged in 3.10.12 CVE: CVE-2023-24329 Includes openssl 1.1.1u which addresses: CVE: CVE-2023-0286 CVE: CVE-2022-4304 CVE: CVE-2022-4203 https://docs.python.org/release/3.10.12/whatsnew/changelog.html#python-3-10-12-final https://docs.python.org/release/3.10.12/whatsnew/changelog.html#python-3-10-11-final https://docs.python.org/release/3.10.12/whatsnew/changelog.html#python-3-10-10-final License-Update: Update Copyright years to include 2023 (From OE-Core rev: 4df594dbc1b391afbe703f663fb2d5c9e9d35078) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dmidecode: fix CVE-2023-30630Yogita Urade2023-08-025-0/+527
| | | | | | | | | | | | | | | | | | | | | Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. References: https://nvd.nist.gov/vuln/detail/CVE-2023-30630 https://lists.nongnu.org/archive/html/dmidecode-devel/2023-04/msg00016.html https://lists.nongnu.org/archive/html/dmidecode-devel/2023-04/msg00017.html Backport: fixes fuzz in the CVE-2023-30630_2.patch in kirkstone (From OE-Core rev: 4f83427a0a01e8285c9eb42d2a635d1ff7b23779) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit f92e59a0894145a828dc9ac74bf8c7a9355e0587) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29406 net/http insufficient sanitization of Host headerVivek Kumbhar2023-08-022-0/+211
| | | | | | | (From OE-Core rev: 5dc74138649ab7a2c0158a43225dc7a8fd732355) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: ignore CVE-2023-36632Peter Marko2023-08-021-0/+2
| | | | | | | | | | | | | | This CVE shouldn't have been filed as the "exploit" is described in the documentation as how the library behaves. (From OE-Core rev: 9665121fd9daf1174ec4045071b900de9195b11e) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c652f094d86c4efb7ff99accba63b8169493ab18) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc-testsuite: Fix ppc cpu specificationRichard Purdie2023-07-261-2/+3
| | | | | | | | | | | | | | | | | After this change in qemu: https://gitlab.com/qemu-project/qemu/-/commit/c7e89de13224c1e6409152602ac760ac91f606b4 there is no 'max' cpu model on ppc. Drop it to clean up ppc gcc testsuite failures. In order for this to work we do need to pull in the alternative cpu option from QEMU_EXTRAOPTIONS on powerpc. (From OE-Core rev: 3a1b9f300a796e1216d0094043dba7b0f39ec869) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c447f2b21b20fb2b1829d540af2cc0bf8242700c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: don't pass --enable-standard-branch-protectionRoss Burton2023-07-261-1/+0
| | | | | | | | | | | | | | | | | | | | | | By changing the default code generation of GCC we're inadvertently breaking the GCC test suite, which has ~120K+ more failures when run for aarch64 compared to x86-64. This was because the generated code fragments included the BTI instructions, which the test case wasn't expecting. We can't tell the tests globally to run without branch protection, as that will break the tests which also turn it on. Remove the enabling of branch protection by standard in GCC, we'll enable it in the tune files instead. (From OE-Core rev: 759327cf6bd79118bae0c68e63742ae4721471d8) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bb4b9017db6a893ed054a2d2ad4cc671dec09c42) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: backport Debian patch to fix CVE-2023-0330Vijay Anusuri2023-07-262-0/+76
| | | | | | | | | | | | | import patch from ubuntu to fix CVE-2023-0330 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/qemu/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://gitlab.com/qemu-project/qemu/-/commit/b987718bbb1d0eabf95499b976212dd5f0120d75] (From OE-Core rev: aae5bf06ad3c67386544f9da55aa21fbf32c3418) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cmake: Fix CMAKE_SYSTEM_PROCESSOR setting for SDKTom Hochstein2023-07-211-4/+1
| | | | | | | | | | | | | | | | When building using an SDK, cmake complains that the target architecture 'cortexa53-crypto' is unknown. The same build in bitbake uses the target architecture 'aarch64'. Set CMAKE_SYSTEM_PROCESSOR the same as for bitbake. (From OE-Core rev: d877d5f07772ec4a05332068ddc03cf387313036) Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d32a6225eefce2073a1cd401034b5b4c68351bfe) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust-llvm: backport a fix for build with gcc-13Alexander Sverdlin2023-07-212-1/+35
| | | | | | | | | | | * needed for rust-llvm-native on hosts with gcc-13 Based on commit 3382759cb6c5 ("llvm: backport a fix for build with gcc-13") (From OE-Core rev: d6684a9c9f713ad30442a2a036ff86b534585400) Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* perl: Fix CVE-2023-31486Soumya2023-07-213-0/+253
| | | | | | | | | | | | | | | | | | HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. References: https://nvd.nist.gov/vuln/detail/CVE-2023-31486 Upstream patches: https://github.com/chansen/p5-http-tiny/commit/77f557ef84698efeb6eed04e4a9704eaf85b741d https://github.com/chansen/p5-http-tiny/commit/a22785783b17cbaa28afaee4a024d81a1903701d (From OE-Core rev: 5819c839e1de92ab7669a0d4997886d0306c4cc1) Signed-off-by: Soumya <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* strace: Update patches/tests with upstream fixesRichard Purdie2023-07-124-38/+102
| | | | | | | | | | | | Replace the sockopt disable patch with a fix from upstream (From OE-Core rev: cef730284b8616ba07c1b062c992c36af730580e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ac921989991c319ecad01bec37c4ccaa15a7b58f) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit c1beb73526e3ade75bd6dae5f9310107c50f1226) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* strace: Merge two similar patchesRichard Purdie2023-07-123-48/+30
| | | | | | | | | | | | | Both patches change the same paths to gawk, merge them together as we only need one patch for this. (From OE-Core rev: 81af8c6fdc6f0b6617b7258c9b3e2e26a76db5c8) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 79c0b18e29cad337640860f57683f0a170f6daab) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 6080138fd0c27db7029b5a76e69b8dc241ad8dc3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* strace: Disable failing testRichard Purdie2023-07-122-0/+38
| | | | | | | | | | | | This test is failing for uncertain reasons. We have reported upstream, disable it until we can work out why this happened. The point it started failing is unclear due to other test framework issues. (From OE-Core rev: fc32e725a0c73772a2ad4e31e1aa1d61f72f9da1) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2e9165a854c7b83f163479e9dbd3cb183a9d71f5) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29400 html/template improper handling of empty HTML attributesVivek Kumbhar2023-07-122-0/+100
| | | | | | | (From OE-Core rev: 3224084a1ca301ff4fb4735ccc80d24aaec13257) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29402Archana Polampalli2023-07-012-0/+195
| | | | | | | | | | | | | | | | | | | | The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected). References: https://nvd.nist.gov/vuln/detail/CVE-2023-29402 Upstream patches: https://github.com/golang/go/commit/4dae3bbe0e6a5700037bb996ae84d6f457c4f58a (From OE-Core rev: aeb0829e52c60a77a2135af8332435b6e2db5b3d) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ninja: ignore CVE-2021-4336, wrong ninjaRoss Burton2023-07-011-0/+3
| | | | | | | | | | | | (From OE-Core rev: c2dd2c13ff26c3f046e35a2f6b8afeb099ef422a) (From OE-Core rev: 804067b760591d33cd49f8c31fa68a92fcbf5445) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9a106486ad7900924a87c5869702903204a35b54) Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29405Archana Polampalli2023-07-012-0/+110
| | | | | | | | | | | | | | | | | | | | | The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler. References: https://nvd.nist.gov/vuln/detail/CVE-2023-29405 Upstream patches: https://github.com/golang/go/commit/6d8af00a630aa51134e54f0f321658621c6410f0 (From OE-Core rev: 7ce6d0029effc06cff500271a124150f1a7db7b3) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29404Archana Polampalli2023-07-012-0/+79
| | | | | | | | | | | | | | | | | | | | | The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. References: https://nvd.nist.gov/vuln/detail/CVE-2023-29404 Upstream patches: https://github.com/golang/go/commit/bbeb55f5faf93659e1cfd6ab073ab3c9d126d195 (From OE-Core rev: 3e51122f8e2b4a7cd2a1c711175e6daf59b8368b) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* nasm: fix CVE-2022-46457Archana Polampalli2023-06-232-0/+51
| | | | | | | | | | | | | | | | NASM v2.16 was discovered to contain a segmentation violation in the component ieee_write_file at /output/outieee.c. References: https://nvd.nist.gov/vuln/detail/CVE-2022-46457 Upstream patches: https://github.com/netwide-assembler/nasm/commit/c8af73112027fad0ecbb277e9cba257678c405af (From OE-Core rev: 6b82d998184112c42b4298aef6a0b9e314fc8ee4) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* e2fsprogs: fix ptest bug for second runningQiu Tingting2023-06-212-0/+4
| | | | | | | | | | | | | | | At second running, there are four new failed case: d_loaddump f_bigalloc_badinode f_bigalloc_orphan_list f_dup_resize The test_data.tmp is necessary, but it is deleted by run-ptest. So it should be restored after testing. (From OE-Core rev: 3a5ce6f8090f912bb9744e8cc8f3f2510f351a33) Signed-off-by: Qiu Tingting <qiutt@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit d0d08dd9a8a179e25b9cfcbac696c1d212a1910c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-requests: fix for CVE-2023-32681Narpat Mali2023-06-142-0/+65
| | | | | | | | | | | | | | | | | | | | | Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0. Reference: https://github.com/advisories/GHSA-j8r2-6x86-q33q (From OE-Core rev: e806c625d9a7eb08079a3268d2d8b20b582d0b6c) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* perl: fix CVE-2023-31484Soumya2023-06-142-0/+30
| | | | | | | | | | CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. (From OE-Core rev: b093db144b35e7c140ac830dbe67cabfaac69f73) Signed-off-by: Soumya <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24539 html/template improper sanitization of CSS valuesVivek Kumbhar2023-06-142-0/+54
| | | | | | | | | | | | | | | | | | Angle brackets should not appear in CSS contexts, as they may affect token boundaries (such as closing a <style> tag, resulting in injection). Instead emit filterFailsafe, matching the behavior for other dangerous characters. Thanks to Juho Nurminen of Mattermost for reporting this issue. For #59720 Fixes #59811 Fixes CVE-2023-24539 (From OE-Core rev: 0a09194f3d4ad98d0cf0d070ec0c99e7a6c8a158) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* quilt: Fix merge.test race conditionKhem Raj2023-05-302-0/+49
| | | | | | | | | | | | | This is consistently seen with musl and grep from busybox Therefore backport a patch from upstream to fix it (From OE-Core rev: 769290794fc23894211c56b1878a73634fd20283) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 511bcd965af658e6bb0c61d9f2adb1af75af773b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* llvm: backport a fix for build with gcc-13Martin Jansa2023-05-302-0/+32
| | | | | | | | | * needed for llvm-native on hosts with gcc-13 (From OE-Core rev: 3382759cb6c5cee42151e72fd94e99a3060317f5) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc-runtime: Use static dummy libstdc++Khem Raj2023-05-301-1/+2
| | | | | | | | | | | | | some standalone targets e.g. riscv64-elf disable shared linking for baremetal ELF ABI in ld, therefore lets make it a static library (From OE-Core rev: 3c6219dfcbcbde314648ba8cc54a90b32ea1c952) (From OE-Core rev: 4ee9d5839669560ec10f23445fa8bbc03a4c5406) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24540Sakib Sajal2023-05-302-0/+94
| | | | | | | | | | | | | References: https://nvd.nist.gov/vuln/detail/CVE-2023-24540 Upstream patch: https://github.com/golang/go/commit/ce7bd33345416e6d8cac901792060591cafc2797 (go 1.19.9) (From OE-Core rev: 5defed7d5dc8bc6f68f021d19c4f42832d33472b) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: ignore CVE-2023-25815Archana Polampalli2023-05-301-0/+2
| | | | | | | | | This is specific to Git-for-Windows. (From OE-Core rev: 472a3e05270deace2862973dee2e65e60f9c0c19) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2023-25652Archana Polampalli2023-05-122-0/+95
| | | | | | | | | | | | | | | | | | | | | | | | Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists. References: https://nvd.nist.gov/vuln/detail/CVE-2023-25652 Upstream patches: https://github.com/git/git/commit/9db05711c98efc14f414d4c87135a34c13586e0b (From OE-Core rev: 335ad8a6d795cd94b872370e44a033ce3fbf4890) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2023-29007Archana Polampalli2023-05-122-0/+163
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. References: https://nvd.nist.gov/vuln/detail/CVE-2023-29007 Upstream patches: https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4 https://github.com/git/git/commit/29198213c9163c1d552ee2bdbf78d2b09ccc98b8 https://github.com/git/git/commit/a5bb10fd5e74101e7c07da93e7c32bbe60f6173a https://github.com/git/git/commit/e91cfe6085c4a61372d1f800b473b73b8d225d0d https://github.com/git/git/commit/3bb3d6bac5f2b496dfa2862dc1a84cbfa9b4449a (From OE-Core rev: 1b55343b6346437b80b8a8180ae1bc9f480d92ef) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* run-postinsts: Set dependency for ldconfig to avoid boot issuesArturo Buzarra2023-05-101-1/+1
| | | | | | | | | | | | | | | | | | | | | If a package with a postsints script requires ldconfig, the package class adds a ldconfig postinst fragment to initialize it before. Systemd has its own ldconfig.service to initialize it and sometimes if both services are running at the same time in the first boot, the first one will work, but the second one will fail with the following error: ldconfig[141]: /sbin/ldconfig: Renaming of /etc/ld.so.cache~ to /etc/ld.so.cache failed: No such file or directory This commit adds a ordering dependency between them to make sure that only one service is running at the same time. (From OE-Core rev: 5fca673d8fe0ee97dc37ed2c9941696842cd667a) Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4e9d812e127dc6743f52f4881e509e8e2e833afe) Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-cryptography: fix for CVE-2023-23931Narpat Mali2023-05-102-0/+50
| | | | | | | | | | | | | | | | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8. (From OE-Core rev: 368e450c2d800790a05924519f34c579e28e9cbb) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils : Fix CVE-2023-25588Deepthi Hemraj2023-05-102-0/+148
| | | | | | | | | Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=d12f8998d2d086f0a6606589e5aedb7147e6f2f1] (From OE-Core rev: fd0d01aca6f2aea51e9704e0ba48dc35dfd87b81) Signed-off-by: Deepthi Hemraj <deepadeepthi98@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-05 22:37:08 +0000