The tarball of version 0.20.0 can not be found on old SRC_URI.
Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
In MIT krb5 release 1.7 and later with incremental propagation
enabled, an authenticated attacker can cause kadmind to write beyond
the end of the mapped region for the iprop log file, likely causing a
process crash.
Reference:
https://security-tracker.debian.org/tracker/CVE-2025-24528
Upstream-patch:
78ceba024b
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Backport PR merged to thrift v0.21.0 to be able to compile thrift
generated c++ code with C++20 clang 15+.
Signed-off-by: Stanislav Angelovic <stanislav.angelovic.ext@siemens.com>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2023-52160:
The implementation of PEAP in wpa_supplicant through 2.10 allows
authentication bypass. For a successful attack, wpa_supplicant must be
configured to not verify the network's TLS certificate during Phase 1
authentication, and an eap_peap_decrypt vulnerability can then be abused
to skip Phase 2 authentication. The attack vector is sending an EAP-TLV
Success packet instead of starting Phase 2. This allows an adversary to
impersonate Enterprise Wi-Fi networks.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-52160
Patch from:
https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baffdea9e55255a81270b768439c
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Pick patches according to
http://w1.fi/security/2024-2/sae-h2h-and-incomplete-downgrade-protection-for-group-negotiation.txt
SAE H2E and incomplete downgrade protection for group negotiation
Patch 0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
was removed as it only patched wpa_supplicant. The patch names were
not changed so it is comparable with wpa_supplicant recipe.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Picked patches according to
http://w1.fi/security/2024-1/hostapd-and-radius-protocol-forgery-attacks.txt
First patch is style commit picked to have a clean cherry-pick of all
mentioned commits without any conflict.
Patch CVE-2024-3596_03.patch was removed as it only patched
wpa_supplicant. The patch names were not changed so it is comparable
with wpa_supplicant recipe.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Only include the lines from the README that cover the copyright and the
license text.
License-Update: Only include the relevant parts of the README
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
For "devtool modify" to work correctly, ${B} needs to match ${S}.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
* after buildpath warnings fix from:
https://git.openembedded.org/meta-openembedded/commit/?id=eeef1fddd9052bed4b1a91565260518eb042fed2
the LibwebsocketsTargets.cmake ends with:
INTERFACE_LINK_LIBRARIES "ssl;crypto;ssl;crypto;/libcap.so;-lpthread"
instead of:
INTERFACE_LINK_LIBRARIES "ssl;crypto;ssl;crypto;/OE/build/.../libwebsockets/4.3.3/lib32-recipe-sysroot/usr/lib/libcap.so;-lpthread"
which causes e.g. mosquitto to fail in do_compile with:
ninja: error: '/libcap.so', needed by 'src/mosquitto', missing and no known rule to make it
* this happens only when libwebsocket is built with libcap enabled
(by libcap in DEPENDS)
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
In order to remove absolute paths from the cmake artifacts, paths from
the `$lib` folder should also be stripped off, otherwise internally
linked libraries (e.g. libz) may appear.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
----
v2]
Scarthgap has the same error as master: initialize timespec variable.
pcapplusplus/23.09/git/Packet++/src/RawPacket.cpp:23:18: error: 'nsec_time.timespec::<anonymous>' is used uninitialized [-Werror=uninitialized]
| 23 | timespec nsec_time;
| | ^~~~~~~~~
| cc1plus: all warnings being treated as errors
Changelog:
==========
-github: Don't run oomtest9 and oomtest11 on windows
-sound: Fix a possible multiply overflow
-gtlsshd: Don't use alloc_sprintf() to duplicate a string
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Set CVE_PRODUCT for this recipe to fix the mapping,
as it was checking against the wrong recipe before.
Log from cve_check after change:
NOTE: libtorrent-rasterbar-2.0.10 is not vulnerable to CVE-2008-0646
NOTE: libtorrent-rasterbar-2.0.10 is not vulnerable to CVE-2009-1760
NOTE: libtorrent-rasterbar-2.0.10 is not vulnerable to CVE-2016-5301
NOTE: libtorrent-rasterbar-2.0.10 is not vulnerable to CVE-2016-7164
NOTE: libtorrent-rasterbar-2.0.10 is not vulnerable to CVE-2017-9847
Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The CVE_PRODUCT variable is assigned automatically to BPN.
Unset it for this recipe so the CVEs can be checked
against the correct recipe.
Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The CVE mentioned in the recipe applies to a different libtorrent
library, from:
https://github.com/arvidn/libtorrent
Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
-C++ library don't work with HTTP (csharp server, cpp client; need cross test enhancement)
-Swift service generator doesn't support oneway
-LNK4042 and LNK2019 in go_validator_generator.cc
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This adds and installs a simple systemd service for ser2net.
The service is only started in case a non-zero configuration file
/etc/ser2net/ser2net.yaml exists.
Additionally, this configuration file a marked as such in the recipe.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* it uses gdbus-codegen from glib-2.0-native which depended
on python3-distutils-native until
https://lists.openembedded.org/g/openembedded-core/message/196136
but distutils on host was enforced by sanity check only until mickledore with:
https://git.openembedded.org/openembedded-core/commit/?id=8e3a5b0709384f2b455a82ac1e8e212686fe4456
so on hosts without distutils this was already failing with:
http://errors.yoctoproject.org/Errors/Details/754696/
cd TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/build/dbus && gdbus-codegen --pragma-once --interface-prefix org.bluez.Descriptor1. --generate-c-code TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/build/dbus/org-bluez-gattdescriptor1 TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/git/dbus/dbus-bluez-v5.48/org.bluez.GattDescriptor1.xml
Traceback (most recent call last):
File "TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/recipe-sysroot-native/usr/bin/gdbus-codegen", line 53, in <module>
from codegen import codegen_main
File "TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/recipe-sysroot-native/usr/share/glib-2.0/codegen/codegen_main.py", line 29, in <module>
from . import dbustypes
File "TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/recipe-sysroot-native/usr/share/glib-2.0/codegen/dbustypes.py", line 22, in <module>
from . import utils
File "TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/recipe-sysroot-native/usr/share/glib-2.0/codegen/utils.py", line 22, in <module>
import distutils.version
ModuleNotFoundError: No module named 'distutils'
and the glib-2.0-native change only changes the dependency from
distutils to packaging which results in:
http://errors.yoctoproject.org/Errors/Details/754692/
FAILED: dbus/org-bluez-gattdescriptor1.c TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/build/dbus/org-bluez-gattdescriptor1.c
cd TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/build/dbus && gdbus-codegen --pragma-once --interface-prefix org.bluez.Descriptor1. --generate-c-code TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/build/dbus/org-bluez-gattdescriptor1 TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/git/dbus/dbus-bluez-v5.48/org.bluez.GattDescriptor1.xml
Traceback (most recent call last):
File "TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/recipe-sysroot-native/usr/bin/gdbus-codegen", line 53, in <module>
from codegen import codegen_main
File "TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/recipe-sysroot-native/usr/share/glib-2.0/codegen/codegen_main.py", line 29, in <module>
from . import dbustypes
File "TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/recipe-sysroot-native/usr/share/glib-2.0/codegen/dbustypes.py", line 22, in <module>
from . import utils
File "TOPDIR/tmp-glibc/work/core2-64-oe-linux/gattlib/0.2+git/recipe-sysroot-native/usr/share/glib-2.0/codegen/utils.py", line 22, in <module>
import packaging.version
ModuleNotFoundError: No module named 'packaging'
* packaging probably isn't as wide spread on host distros as old
distutils was, so make sure it's available by using
python3-native with python3-packaging-native from OE build
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
ver 2.14:
Fix issue with accepting PTK 4/4 after receiving PTK 2/4.
Fix issue with frequency limit for quick scans.
Fix issue with limiting DHCPv4 attempts.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
ver 2.13:
Fix issue with handling netconfig and roaming conditions.
Fix issue with logging requirement for CMD_EXTERNAL_AUTH.
Fix issue with using OpenSSL 3.2 installations.
ver 2.12:
Fix issue with DPP extra settings not being used.
Fix issue with DPP and PRF+ handling on AARCH64.
Add support for SAE password identifiers.
ver 2.11:
Fix issue with handling iovecs with multiple IEs.
Fix issue with handling SAE password identifiers.
Fix issue with handling agent release method call.
ver 2.10:
Fix issue with buffer overflow for 32 byte SSIDs.
Fix issue with deauthentication before FT work completes.
Fix issue with power save disabling procedure.
ver 2.9:
Fix issue with handling certain FT failures.
Fix issue with handling user-disabled bands.
Fix issue with handling roam on beacon loss event.
Add support for PKEX configurator.
Add support for PKEX enrollee.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Recent changes to oe-core[1] mean that if a configure.ac uses gtk-doc
then gtkdocize will be called. This means that recipes that don't
inherit gtk-doc (to depend on gtk-doc-native) but don't explicitly
disable the use of gtkdocize will fail to configure.
Inheriting gtk-doc both solves the configure failure, and allows us to
build the API documentation.
[1] oe-core 891ec38d4c5cc5ac7bc34938276261ebd6f6d54e
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The 'krb5-config' tool should be in ${PN}-dev (as intented by
binconfig class).
Use PACKAGE_BEFORE_PN for extra packages so that -dev is handled
before -user.
Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Old versions of abseil-cpp could not be compiled using C++ Standard 17.
For now this cmake flag is not needed.
Mosh compilation fixed by specifying c++17 standard.
Signed-off-by: Petr Chernikov <p.chernikov@yadro.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
