2586 Commits

Author SHA1 Message Date
Ashish Sharma
bf0da59a92 c-ares: Backport fix for CVE-2024-25629
Upstream-Status: Backport [a804c04ddc]

References:
https://nvd.nist.gov/vuln/detail/CVE-2024-25629
https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q
https://security-tracker.debian.org/tracker/CVE-2024-25629

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-04-02 08:12:59 -04:00
virendra thakur
60569e5c89 opensc: Fix CVE-2023-40661
Upstream-Status: Backport[8026fb4ca0]

Signed-off-by: virendra thakur <virendrak@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-01-16 07:31:14 -05:00
virendra thakur
23ca2973ff opensc: Fix CVE-2023-40660
Upstream-Status: Backport [940e8bc764]

Signed-off-by: virendra thakur <virendrak@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-01-16 07:31:14 -05:00
Martin Jansa
7c74ee839d libiio: use main branch instead of master
* the branch was renamed upstream

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-12 10:41:03 -05:00
Vijay Anusuri
300be97535 libssh2: Backport fix for CVE-2020-22218
Bug: https://github.com/libssh2/libssh2/pull/476

Upstream-Status: Backport [642eec48ff
&
0b44e558f3]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-21 16:31:35 -04:00
Priyal Doshi
2f4f70a703 open-vm-tools: Security fix for CVE-2023-20900
Backport-from: 74b6d0d900

Signed-off-by: Priyal Doshi <pdoshi@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-30 08:54:36 -04:00
Vijay Anusuri
3c62000f88 c-ares: CVE-2023-32067 0-byte UDP payload Denial of Service
Upstream-Status: Backport from b9b8413cfd

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22 07:49:35 -04:00
Khem Raj
98982f3f3e libb64: Add recipe
Add Base64 encode/decode library, some packages e.g. sysdig can benefit
from it

Disable parallel make as it races at times
make[1]: *** No rule to make target 'libb64.a', needed by 'c-example1'.  Stop.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6946f40707ed43426cd05ada1933e4867c7f6d4f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22 07:49:35 -04:00
Hitendra Prajapati
b5282ece91 openldap: fix CVE-2021-27212 Assertion failure in slapd
Upstream-Status: Backport from 9badb73425

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
3e51eb35ae multipath-tools: fix CVE-2022-41974
Upstream-Status: Backport from fbbf280a0e

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
virendra thakur
e5808a69cd c-ares: whitelist CVE-2023-31124
CVE-2023-31124 applies only when cross-compiling using autotools.
Yocto cross-compiles via cmake which is also listed as official workaround.

See:
* https://nvd.nist.gov/vuln/detail/CVE-2023-31124
* https://github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4

Signed-off-by: virendra thakur <virendrak@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Vijay Anusuri
00de17fa46 libssh: CVE-2020-16135 NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL
Upstream-Status: Backport
[533d881b0f
&
2782cb0495
&
10b3ebbe61
&
245ad744b5]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
6334241447 c-ares: CVE-2023-31147 Insufficient randomness in generation of DNS query IDs
Upstream-Status: Backport from 823df3b989

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Hitendra Prajapati
1b4564b6d9 c-ares: CVE-2023-31130 fix Buffer Underwrite
Upstream-Status: Backport from f22cc01039

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Vijay Anusuri
eae14f75ed c-ares: fix CVE-2022-4904 & Update SRC_URI branch and protocols
Upstream-Status: Backport
[https://git.openembedded.org/meta-openembedded-contrib/commit/?h=stable/kirkstone-nut&id=092e125f44f65427d42db95db3779daf4893d10f
& https://git.openembedded.org/meta-openembedded-contrib/commit/meta-oe/recipes-support/c-ares/c-ares_1.18.1.bb?h=stable/kirkstone-nut&id=b402a3076fbafe05d0b8621e50603b65c3fe8147
Upstream-Commit:
9903253c34]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Vijay Anusuri
d8c29311e5 openldap: Fix CVE-2023-2953
Upstream-Status: Backport
[752d320cf9
&
6563fab9e2]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
schitrod=cisco.com@lists.openembedded.org
65efd68735 gnulib: Update recipe name to 2018-12-18
As per gnulib_2018-03-07 recipe information,
SRCREV = "0d6e3307bbdb8df4d56043d5f373eeeffe4cbef3"
This revision was committed on "2018-12-18".

There is a discrepancy between SRCREV and the recipe version.
Which reports "CVE-2018-17942" as unpatched.

To report "CVE-2018-17942" as patched,
We need to align a recipe name with SRCREV commit date.

Signed-off-by: Sanjay Chitroda <schitrod@cisco.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9edbe7033cc41f4a49f74717cd3146b52588ce22)
Signed-off-by: Sanjay Chitroda <schitrod@cisco.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Jack Mitchell
4c533a5f90 nss: backport fix for native build failure due to dangling pointer with gcc13
Upstream-Status: Backport
Link: cbf5a2bce7

Signed-off-by: Jack Mitchell <ml@embed.me.uk>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16 07:09:25 -04:00
Jack Mitchell
c69846bfc6 nss: backport fix for native build failure due to implicit casting with gcc13
Upstream-Status: Backport
Link: 4e7e332b25

Signed-off-by: Jack Mitchell <ml@embed.me.uk>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16 07:09:25 -04:00
Hitendra Prajapati
e39b002df9 multipath-tools: CVE-2022-41973 Symlink attack multipathd operates insecurely
Upstream-Status: Backport from cb57b930fa

dev/shm may have unsafe permissions. Use /run instead.
Use systemd's tmpfiles.d mechanism to create /run/multipath
early during boot.

For backward compatibilty, make the runtime directory configurable
via the "runtimedir" make variable.

QA Issue: non -dev/-dbg/nativesdk- package multipath-tools-libs
  contains symlink .so '/usr/lib/libdmmp.so'
  ...

Fix this by making the new pattern for multipath-tools-libs package
more specific.

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-05 07:20:59 -04:00
Alex Yao
eca75eba7d lcov: Fix Perl Path
Fixes an issue where lcov is using the system Perl rather than the yocto
provided Perl. This causes packages to not be found during runtime such
as PerlIO::gzip.

Signed-off-by: Alex Yao <alexyao1@meraki.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-05 07:20:59 -04:00
Hitendra Prajapati
94b30b7d85 syslog-ng: CVE-2022-38725 An integer overflow in the RFC3164 parser
Upstream-Status: Backport from b5a060f2eb && 81a07263f1 && 4b8dc56ca8 && 73b5c300b8 && 45f0512393 && 09f489c89c && 8c6e2c1c41 && 56f881c5ea

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-06 07:32:11 -04:00
Virendra Thakur
7b7913fd47 nss: Fix CVE CVE-2023-0767
Add CVE-2023-0767.patch to fix CVE-2023-0767

Signed-off-by: Virendra Thakur <virendrak@kpit.com>
Signed-off-by: Bhabu Bindu <bindudaniel1996@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-06 07:32:11 -04:00
Priyal Doshi
0a7d275985 open-vm-tools: Security fix for CVE-2022-31676
Backport from 70a74758bf

Signed-off-by: Priyal Doshi <pdoshi@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-18 16:16:42 -04:00
Mathieu Dubois-Briand
56403db5e3 nss: Fix CVE-2020-25648
Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 11:24:23 -05:00
Mathieu Dubois-Briand
50b6fb7d62 nss: Whitelist CVEs related to libnssdbm
These CVEs only affect libnssdbm, compiled when --enable-legacy-db is
used.

https://bugzilla.mozilla.org/show_bug.cgi?id=1360782#c6
https://bugzilla.mozilla.org/show_bug.cgi?id=1360778#c8
https://bugzilla.mozilla.org/show_bug.cgi?id=1360900#c6
https://bugzilla.mozilla.org/show_bug.cgi?id=1360779#c9
Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 11:24:23 -05:00
Mathieu Dubois-Briand
f0f9398891 nss: Add missing CVE product
Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 11:24:23 -05:00
wangmy
6792ebdd96 c-ares: upgrade 1.17.2 -> 1.18.1
c-ares version 1.18.1 - Oct 27 2021
Bug fixes:

ares_getaddrinfo() would return ai_addrlen of 16 for ipv6 adddresses
rather than the sizeof(struct sockaddr_in6)

Conflicts:
meta-oe/recipes-support/c-ares/c-ares_1.18.1.bb

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e251d7b827d63277a36f1b8094d992303329b866)
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.vom>
2022-09-11 13:49:52 -04:00
Sinan Kaya
ad1dcf68b6 c-ares: remove custom patches
Current patch is breaking the library dependencies added by cmake
especially when you are static linking.

Applications need the ws2_32 library to be linked for mingw32
and with the existing patch this is not getting passed to the users.

Current patch seems to address this issue:
https://github.com/c-ares/c-ares/issues/373

Both issues are resolved in 1.17.2:

1.17.2-r0/git $ find . | grep c-ares-config.cmake.in
./c-ares-config.cmake.in
1.17.2-r0/git $ find . | grep libcares.pc.cmake
./libcares.pc.cmake

Conflicts:
meta-oe/recipes-support/c-ares/c-ares_1.17.2.bb

Signed-off-by: Sinan Kaya <okaya@kernel.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 621bdc1993d2e8da08b9b240043dc13481cd644f)
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.vom>
2022-09-11 13:49:52 -04:00
wangmy
cd8d2f689f c-ares: upgrade 1.17.1 -> 1.17.2
Conflicts:
meta-oe/recipes-support/c-ares/c-ares_1.17.2.bb

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c49173b09c998bb3893ae873f68823647f1a7e18)
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.vom>
2022-09-11 13:49:52 -04:00
Khem Raj
de05a500b9 c-ares: Upgrade to 1.17.1 release
Forward port cmake-install-libcares.pc.patch, drop the need to install
pkgconfig files as its already being done by main Makefile

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Forward port cmake-install-libcares.pc.patch, drop the need to install
pkgconfig files as its already being done by main Makefile

Conflicts:
meta-oe/recipes-support/c-ares/c-ares_1.17.1.bb

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b65f2904191b8d309b3971d4e65c5e1701156b1c)
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.vom>
2022-09-11 13:49:52 -04:00
Armin Kuster
87841f0c18 Revert "c-ares: Add fix for CVE-2021-3672"
This reverts commit b06724bc274f751004ade2ceeddfb8ec40d93f16.
Revert this CVE fix as we upgrade c-ares to 1.18.1

Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.vom>
2022-09-11 13:49:52 -04:00
Khem Raj
f22bf6efaa meta-oe: Add leading whitespace for append operator
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 92441f9d6a958c245a03f89ec44ef2c17dd6b0ee)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 06:59:38 -07:00
Hitendra Prajapati
a24773d39e openldap: CVE-2022-29155 OpenLDAP SQL injection
Source: https://git.openldap.org/openldap/openldap
MR: 117821
Type: Security Fix
Disposition: Backport from 87df6c1991
ChangeID: d534808c796600ca5994bcda28938d45405bc7b4
Description:
	CVE-2022-29155 openldap: OpenLDAP SQL injection

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-16 12:56:17 -07:00
Minjae Kim
5cdde2991e multipath-tools: update SRC_URI
The git repo for multipath-tools was changed, so update the
SRC_URI accordingly with the new link.

Signed-off-by:Minjae Kim <flowergom@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18 07:37:42 -07:00
Christian Ege
717b8b9286 cli11: switch from default master branch to main to fix do_fetch failure
The branch was renamed in the upstream repository

Signed-off-by: Christian Ege <christian.ege@ifm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18 07:37:42 -07:00
Daniel Stadelmann
17ee7b0348 imagemagick: update SRC_URI branch from master to main
master branch in imagemagick was renamed to main (https://github.com/ImageMagick/ImageMagick).
Similar change is already in master branch for version 7.0.10 (see 248739128389)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18 07:37:42 -07:00
Ranjitsinh Rathod
aa5b9a1ff0 nss: Add fix for CVE-2022-22747
Add a patch to fix CVE-2022-22747

Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-13 10:47:08 -08:00
Virendra Thakur
4e7d34df0f udisks2: Fix for CVE-2021-3802
Add patch to fix CVE-2021-3802

Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-01-29 06:26:51 -08:00
Armin Kuster
4bd7715a9d c-ares: bump PV in recipe to 1.16.1
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-01-27 07:42:07 -08:00
Ernst Sjöstrand
ddaf5f92cc libmicrohttpd: Add patch to fix CVE-2021-3466
Extract patch from the 0.9.71 release commit.

Upstream-Status: Backport
CVE: CVE-2021-3466

Signed-off-by: Ernst Sjöstrand <ernst.sjostrand@verisure.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-27 11:50:03 -08:00
sana kazi
82264cbf0b nss: Fix CVE-2021-43527
Add patch to fix CVE-2021-43527 which causes heap overflow in nss.

Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com>
Signed-off-by: Sana Kazi <sanakazisk19@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-18 11:08:54 -08:00
Jeremy Puhlman
6025097d08 c-ares: switch from master to main
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-18 11:08:51 -08:00
Ranjitsinh Rathod
bcf93614a0 nss: Fix CVE-2020-12403
Add patch for CVE-2020-12403

Link:
9ff9d3925d
06b2b1c50b

Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-17 12:26:32 -08:00
Armin Kuster
59bff77ad0 recipes: Update SRC_URI branch and protocols
This patch updates SRC_URIs using git to include branch=master if no branch is set
and also to use protocol=https for github urls as generated by the conversion script
in OE-Core.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-17 12:26:21 -08:00
Marek Vasut
5368c7c63d dstat: Add missing python-six runtime dependency
The tool depends on the six module, add it, otherwise the following
traceback happens when running it on the target:

Traceback (most recent call last):
  File "/usr/bin/dstat", line 32, in <module>
    import six
ModuleNotFoundError: No module named 'six'

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Khem Raj <raj.khem@gmail.com>
Cc: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-20 15:52:10 -07:00
Neetika Singh
b06724bc27 c-ares: Add fix for CVE-2021-3672
Added below patches to fix CVE-2021-3672

1. ares_expand_name-should-escape-more-characters.patch
2. ares_expand_name-fix-formatting-and-handling-of-root.patch

Link: http://snapshot.debian.org/archive/debian-security/20210810T064453Z/pool/updates/main/c/c-ares/c-ares_1.17.1-1%2Bdeb11u1.debian.tar.xz

Signed-off-by: akash hadke <Akash.Hadke@kpit.com>
Signed-off-by: Neetika Singh <Neetika.Singh@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-20 15:51:39 -07:00
Armin Kuster
5c347d8ce4 nss: Two Security fixes CVE-2020-6829 and 12400
Source: https://hg.mozilla.org/projects/nss
MR: 106863
Type: Security Fix
Disposition: Backport from e55ab31455 and 3f022d5eca5d3cd0e366a825a5681953d76299d0
ChangeID: f7f16ca20fbb2436071fde063fe56aa8b319ce41
Description:

Affects NSS < 3.55
This address both VE-2020-6829 and CVE-2020-12400

Signed-off-by: Armin Kuster <akuster@mvista.com>
2021-09-05 11:54:45 -07:00
Zang Ruochen
9ce3df8c2a c-ares: upgrade 1.16.0 -> 1.16.1
Source: https://git.openembedded.org
MR: 111050
Type: Security Fix
Disposition: Backport from https://git.openembedded.org/meta-openembedded/commit/meta-oe/recipes-support/c-ares?h=hardknott&id=dc25d9f11f3c7abc84700fc1d51fe6c2088a11c4
ChangeID: dc25d9f11f3c7abc84700fc1d51fe6c2088a11c4
Description:

Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit dc25d9f11f3c7abc84700fc1d51fe6c2088a11c4)
[Includes cve: CVE-2020-14354. Bug fix update, no ABI changes]
Signed-off-by: Armin Kuster <akuster@mvista.com>
2021-09-05 10:36:03 -07:00
Anatol Belski
b472160c77 backport: xmlsec1: Fix configure QA error caused by host lookup path
The configure script contains hardcoded lookup paths to /usr and other
paths that might interfere with the host. These are overwritten with the
staging dir locations for Poky compatibility.

Backport from meta-oe master rev. 74b66d1911118bac53033f77ba6d3923f4809d5a

Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Jan-Simon Moeller <dl9pf@gmx.de>
2021-08-15 07:14:07 -07:00