testrunners file was coming out to be empty after anon python was turned
into a prepend to populate_packages which is executed during do_package
and hence POCO_TESTRUNNERS was not populated when it was used during
do_ptest_install now. Therefore alter the logic to collect the list of
tests to run into testrunners file. Also package the ignore file which
is platform specific, here the lnx version is packaged and specified
using -ignore cmd to tests
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This could be worked out without needing to add bash dependency
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Pick commit mentioned in [1].
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-6375
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Fix following CVEs for imagemagick:
CVE-2023-5341, CVE-2022-1114, CVE-2023-1289 and CVE-2023-34474
Signed-off-by: Sana Kazi <sanakazi720@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
syslog-ng is an enhanced log daemo. Prior to version 4.8.2,
`tls_wildcard_match()` matches on certificates such as `foo.*.bar`
although that is not allowed. It is also possible to pass partial
wildcards such as `foo.a*c.bar` which glib matches but should be
avoided / invalidated. This issue could have an impact on TLS
connections, such as in man-in-the-middle situations. Version
4.8.2 contains a fix for the issue.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-47619
Upstream patch:
12a0624e4c
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Fix following CVEs for imagemagick:
CVE-2021-20311, CVE-2021-20312, CVE-2021-20313
CVE-2021-20309, CVE-2021-20310, CVE-2021-3610
CVE-2022-0284, CVE-2022-2719
fix-cipher-leak.patch fixes CVE-2021-20311, CVE-2021-20312, CVE-2021-20313
Ignore following CVES as current version is not affected by them:
CVE-2014-9826, CVE-2016-7538, CVE-2017-5506
Signed-off-by: Sana Kazi <sanakazi720@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not
verify the adbe.pkcs7.sha1 signatures on documents, resulting
in potential signature forgeries.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-43903
Upstream patch:
f1b9c830f1
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Poppler before 25.04.0 allows crafted input files to trigger
out-of-bounds reads in the JBIG2Bitmap::combine function in
JBIG2Stream.cc because of a misplaced isOk check.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32365
Upstream patch:
1f151565bb
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
A floating-point exception in the PSStack::roll function of
Poppler before 25.04.0 can cause an application to crash when
handling malformed inputs associated with INT_MIN.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32364
Upstream patch:
d87bc726c7
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Change the SRC_URI to the correct value due to the following error:
WARNING: eject-2.1.5-r0.wr2401 do_fetch: Failed to fetch URL http://sources.openembedded.org/eject-2.1.5.tar.gz, attempting MIRRORS if available
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit da361d2d7cf4501ab7a88bc898be187243005c47)
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2024-45620:
A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use
a crafted USB Device or Smart Card, which would present the system with a specially
crafted response to APDUs. When buffers are partially filled with data, initialized
parts of the buffer can be incorrectly accessed.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-45620]
Upstream patches:
[a1bcc6516f]
[6baa195965]
[468a314d76]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2024-45619:
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK.
An attacker could use a crafted USB Device or Smart Card, which would present the system
with a specially crafted response to APDUs. When buffers are partially filled with data,
initialized parts of the buffer can be incorrectly accessed.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-45619]
Upstream patches:
[f01bfbd19b]
[a1d8c01c1c]
[673065630b]
[e20ca25204]
[2b6cd52775]
[dd554a2e1e]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2024-45618:
A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted
USB Device or Smart Card, which would present the system with a specially crafted
response to APDUs. Insufficient or missing checking of return values of functions
leads to unexpected work with variables that have not been initialized.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-45618]
Upstream patches:
[8632ec172b]
[f9d68660f0]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2024-45617:
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK.
An attacker could use a crafted USB Device or Smart Card, which would present the system
with a specially crafted response to APDUs. Insufficient or missing checking of return
values of functions leads to unexpected work with variables that have not been initialized.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-45617]
Upstream patches:
[fdb9e903eb]
[fdb9e903eb]
[efbc14ffa1]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2024-45616:
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK.
An attacker could use a crafted USB Device or Smart Card, which would present the system
with a specially crafted response to APDUs. The following problems were caused by
insufficient control of the response APDU buffer and its length when communicating
with the card.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-45616]
Upstream patches:
[1d3b410e06]
[265b28344d]
[e7177c7ca0]
[ef7b10a18e]
[76115e3479]
[16ada9dc7c]
[3562969c90]
[cccdfc46b1]
[5fa758767e]
[aa102cd9ab]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2024-45615:
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK.
The problem is missing initialization of variables expected to be initialized
(as arguments to other functions, etc.).
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-45615]
Upstream patches:
[5e4f26b510]
[7d68a7f442]
[bb3dedb71e]
[42d718dfcc]
[bde991b0fe]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2024-8443:
The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable
to Stored Cross-Site Scripting via the ‘themehunk_megamenu_bg_image' parameter in all
versions up to, and including, 1.1.0 due to insufficient input sanitization and output
escaping. This makes it possible for authenticated attackers, with subscriber-level
access and above, to inject arbitrary web scripts in pages that will execute whenever
a user accesses an injected page. Please note that this was partially fixed in 1.1.0
due to the missing authorization protection that was added.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-8433]
Upstream patches:
[02e8474583]
[b28a3cef41]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2024-1454:
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages,
occuring in the card enrolment process using pkcs15-init when a user or administrator
enrols or modifies cards. An attacker must have physical access to the computer system
and requires a crafted USB device or smart card to present the system with specially
crafted responses to the APDUs, which are considered high complexity and low severity.
This manipulation can allow for compromised card management operations during enrolment.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-1454]
Upstream patches:
[5835f0d4f6]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
libpoppler.so in Poppler through 24.12.0 has an out-of-bounds
read vulnerability within the JBIG2Bitmap::combine function
in JBIG2Stream.cc.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-56378
Upstream patch:
ade9b5ebed
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
A flaw was found in the Poppler's Pdfinfo utility. This issue
occurs when using -dests parameter with pdfinfo utility. By
using certain malformed input files, an attacker could cause
the utility to crash, leading to a denial of service.
CVE-2024-6239-0001 is the dependent commit and CVE-2024-6239-0002
is the actual CVE fix.
fix indent issue in poppler_22.04.0.bb file.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-6239
Upstream patches:
0554731052fc1c711cb5
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
* also needed for nspr-native build with gcc-14 on host
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Pick the same patch as Debian took for bullseye.
There is no direct backport to version prior 3.102 because
commit NSS_3_101_BETA2-12-g8d94c529b [1] rewrote this code.
Applied patch was proposed for old versions in [2] and already
applied in Debian bullseye.
I could not find suitable upstream status, inappropriate is the best
I could pick from offered possibilities.
[1] 8d94c529b3<
[2] https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/t9JmsYkujWM/m/HjKuk-ngBAAJ
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Pick the same patch as Debian took for bullseye.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Branches used in langdale, mickledore, nanbield were re-written in upstream :(, fixes were sent to meta-oe:
langdale: https://lists.openembedded.org/g/openembedded-devel/message/107533
mickledore: https://lists.openembedded.org/g/openembedded-devel/message/107531
merged in:
https://git.openembedded.org/meta-openembedded/commit/?h=mickledore&id=b0d67900ae9e8911f734c25c0674fe55df8cd188
nanbield: https://lists.openembedded.org/g/openembedded-devel/message/107532
merged in:
https://git.openembedded.org/meta-openembedded/commit/?h=nanbield&id=2da6e1b0e43a8993fd422fee3f83940100b59f4c
fix for langdale wasn't ever fixed because it was sent after langdale
was already EOL, but looks like the version used in kirkstone got
broken recently as well, because master branch was removed:
poco/1.11.2-r0/git $ git branch -a --contains 9d1c428c861f2e5ccf09149bbe8d2149720c5896
* master
...
remotes/origin/dev-task-test-diag
remotes/origin/devel
remotes/origin/feat/acceptor-service-handler-args
remotes/origin/fix/posix-sleep
remotes/origin/issue-templates
remotes/origin/master
remotes/origin/poco-1.12.0
remotes/origin/poco-1.12.1
remotes/origin/poco-1.12.2
remotes/origin/poco-1.12.3
remotes/origin/poco-1.12.4
remotes/origin/poco-1.12.5
remotes/origin/poco-1.12.6
remotes/origin/poco-1.9.5-not-released
remotes/origin/poll-closed-server-test
remotes/origin/upgrade-ci-actions-to-v3
poco/1.11.2-r0/git $ git remote prune origin
Pruning origin
URL: https://github.com/pocoproject/poco.git
...
* [pruned] origin/android-ndk-action
* [pruned] origin/develop
* [pruned] origin/feat/wepoll
* [pruned] origin/fix/PollSet-race
* [pruned] origin/fix/swap-noexcept
* [pruned] origin/master
* [pruned] origin/poco-1.10.2
* [pruned] origin/poco-1.9.5
refs/remotes/origin/HEAD has become dangling!
poco/1.11.2-r0/git $ git branch -a --contains 9d1c428c861f2e5ccf09149bbe8d2149720c5896
* master
...
remotes/origin/dev-task-test-diag
remotes/origin/devel
remotes/origin/discourage-using-configure-and-make
remotes/origin/feat/acceptor-service-handler-args
remotes/origin/feat/json-logging
remotes/origin/fix/posix-sleep
remotes/origin/issue-templates
remotes/origin/main
remotes/origin/master-pre-1.13.0
remotes/origin/master-unused
remotes/origin/openssl_fix
remotes/origin/poco-1.12.0
remotes/origin/poco-1.12.1
remotes/origin/poco-1.12.2
remotes/origin/poco-1.12.3
remotes/origin/poco-1.12.4
remotes/origin/poco-1.12.5
remotes/origin/poco-1.12.6
remotes/origin/poco-1.13.0
remotes/origin/poco-1.13.1
remotes/origin/poco-1.13.2
remotes/origin/poco-1.13.3
remotes/origin/poco-1.13.4
remotes/origin/poco-1.9.5-not-released
remotes/origin/poll-closed-server-test
remotes/origin/release-1.14-changelog-authors
remotes/origin/search-support
remotes/origin/upgrade-ci-actions-to-v3
switch to main branch which is the most common and the least surprising.
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
* it was updated in nanbield with upgrade to 3.0.5 in:
fc0a506bde libjs-jquery-cookie: upgrade 3.0.1 -> 3.0.5
* drop duplicated protocol param as in mickledore:
2e0a581bee recipes: Remove double protocol= from SRC_URIs
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This fixes errors from buildhistory changes where packages-split would
be empty.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 90f96e053ad3eefa7693d9748efdfbfa72d7dcfd)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
According to https://github.com/OpenSC/OpenSC/wiki#license OpenSC is
licensed under LGPL-2.1 or later, which seems to be affirmed also by
the comments in the source code files, as well as the COPYING file.
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The expiration date of the "NameConstraints.*.cert" test certificate in
the nss package is Sep 4 2023 and causing a test failure.
This commit regenerate NameConstraints test certificates and changes the
validity period of test certs generated by `make-nc` from ~10 years to
~20 years.
regenerate_NameConstrain_test_certificates.tar.gz is a snapshot of certs
files based on the commit which update them. It fails to apply binary
commit, so create a tarball as part of SRC_URI rather than a .patch
file.
Upstream-Status: Backport [1d565dc7e1]
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The expiration date of the "PayPalEE.cert" test certificate in the nss package
is Jan 12 2022 and causing a test failure.
Signed-off-by: Wentao Zhang <wentao.zhang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
<cstdint> need to be included explicitly when compiling with gcc-13.
Upstream-Status: Backport [1.6.0 f6c3f698dd]
Signed-off-by: Jiaqing Zhao <jiaqing.zhao@linux.intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Upstream-Status: Backport from [https://git.savannah.gnu.org/cgit/nano.git/commit/?id=5e7a3c2e7e118c7f12d5dfda9f9140f638976aa2]
CVE's Fixed:
CVE-2024-5742 nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
A flaw was found in libssh. By utilizing the
ProxyCommand or ProxyJump feature, users can exploit
unchecked hostname syntax on the client. This issue
may allow an attacker to inject malicious code into
the command of the features mentioned through the
hostname parameter
Signed-off-by: Nikhil R <nikhil.r@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
https://nvd.nist.gov/vuln/detail/CVE-2024-0743
mentions bug 1867408 as tracking fix for this issue.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
https://nvd.nist.gov/vuln/detail/CVE-2023-5388
mentions bug 1780432 as tracking fix for this issue.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
iniparser v4.1 is vulnerable to NULL Pointer Dereference
in function iniparser_getlongint which misses check NULL
for function iniparser_getstring's return.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-33461
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
An out-of-bounds stack write flaw was found in unixODBC on 64-bit
architectures where the caller has 4 bytes and callee writes 8 bytes.
This issue may go unnoticed on little-endian architectures, while
big-endian architectures can be broken.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-1013
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
c-ares is a C library for asynchronous DNS requests.
`ares__read_line()` is used to parse local configuration
files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`,
the `HOSTALIASES` file, and if using a c-ares version
prior to 1.27.0, the `/etc/hosts` file. If any of these
configuration files has an embedded `NULL` character as
the first character in a new line, it can lead to
attempting to read memory prior to the start of the given
buffer which may result in a crash. This issue is fixed
in c-ares 1.27.0. No known workarounds exist.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-25629https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48qhttps://security-tracker.debian.org/tracker/CVE-2024-25629
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Download and unpack contrib modules and other repositories in S instead
of WORKDIR so they don't escape file-prefix-map substitutions.
Fixes a number of reproducibility problems because of OpenCV check
macros that were embedding path to files in contrib/.
MJ: this is backport from langdale and fixes not only reproducibility
issues but also pseudo aborts in do_install when do_install
is executed again after do_package (in incremental builds):
| DEBUG: Executing shell function do_install
| NOTE: DESTDIR=opencv/4.5.5-r0/image VERBOSE=1 cmake --build opencv/4.5.5-r0/build --target install --
| abort()ing pseudo client by server request. See https://wiki.yoctoproject.org/wiki/Pseudo_Abort for more details on this.
| Check logfile: opencv/4.5.5-r0/pseudo//pseudo.log
| Subprocess aborted
and pseudo.log file shows:
path mismatch [3 links]: ino 214373575 db 'opencv/4.5.5-r0/package/usr/src/debug/lib32-opencv/4.5.5-r0/contrib/modules/intensity_transform/src/bimef.cpp' req 'opencv/4.5.5-r0/contrib/modules/intensity_transform/src/bimef.cpp'.
easily reproducible with:
bitbake -c cleansstate opencv; bitbake -c package opencv; bitbake -c install -f opencv
unlike ${S} ${WORKDIR}/contrib isn't in default PSEUDO_IGNORE_PATHS
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
