Commit Graph

17236 Commits

Author SHA1 Message Date
Bartosz Golaszewski
0fb64aff05 python3-cson: fix run-time dependencies
Add the missing run-time dependency on python3-json. As a result we no
longer need to pull python3 native and can drop other *DEPENDS.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 40b4cf5a83)
Backported: adapted to old override syntax
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Richard Purdie
fbf0b80ad2 meta-perl: Drop broken BBCLASSEXTEND variants
The command "bitbake universe -c fetch" currently throws a ton of warnings
as there are many 'impossible' dependencies.

In some cases these variants may never have worked and were just added by copy
and paste of recipes. In some cases they once clearly did work but became
broken somewhere along the way. Users may also be carrying local bbappend files
which add further BBCLASSEXTEND.

Having universe fetch work without warnings is desireable so clean up the broken
variants. Anyone actually needing something dropped here can propose adding it
and the correct functional dependencies back quite easily. This also then
ensures we're not carrying or fixing things nobody uses.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 79e0a9d237)
Backported:
* Adapted paths to follow PV changes
* Adapted modified recipes to the ones generating warnings
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Richard Purdie
bc22fe3465 meta-oe: Drop broken BBCLASSEXTEND variants
The command "bitbake universe -c fetch" currently throws a ton of warnings
as there are many 'impossible' dependencies.

In some cases these variants may never have worked and were just added by copy
and paste of recipes. In some cases they once clearly did work but became
broken somewhere along the way. Users may also be carrying local bbappend files
which add further BBCLASSEXTEND.

Having universe fetch work without warnings is desireable so clean up the broken
variants. Anyone actually needing something dropped here can propose adding it
and the correct functional dependencies back quite easily. This also then
ensures we're not carrying or fixing things nobody uses.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9962d57f7c)
Backport:
* Updated paths to follow PV changes
* Adapted modified recipes to the ones generating warnings
* NB: cups-filter needs poppler-native but its not available. To fix
  this, 5fa0188b8c could be backported.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Davide Gardenal
0689773963 openflow: ignore CVE-2018-1078
CVE-2018-1078 is not for openflow but in the NVD database the
CVE is for a specific implementation that we don't have so we
can ignore it.

Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
(cherry picked from commit c1e7b0b993)
Backported: Changed CVE_CHECK_IGNORE to CVE_CHECK_WHITELIST
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Davide Gardenal
85d87a62df usrsctp: add CVE_VERSION to correctly check for CVEs
The current version of usrsctp is not a release so cve-check
is not able to find the product version. CVE_VERSION is now set
to 0.9.3.0  that is the nearest version in the past starting from
the revision we have.
This is done because we don't have the complete 0.9.4.0 release.

Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 279fce2c87)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Yoann Congal
8c13e8dc28 libusbmuxd: Add PV
This is 1.0.10 release with few more commits on top.

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Yoann Congal
b9c0cacc11 emlog: ignore inapplicable CVEs
The CVEs:
 * CVE-2019-16868
 * CVE-2019-17073
 * CVE-2021-44584
 * CVE-2022-1526
 * CVE-2022-3968
 * CVE-2023-43291
... apply to the other "emlog" and can be safely ignored.

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Khem Raj
77a7a2881d emlog: Add PV
This is 0.70 release with few more commits on top.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 08edc0b6ac)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Hitendra Prajapati
d9ba954b6a wireshark: Fix CVE-2022-0585-CVE-2023-2879
Upstream-Status: Backport from 8d3c217779 && 118815ca7c

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Martin Jansa
9135c7ea73 glmark2: fix compatibility with python-3.11
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-12 10:42:03 -05:00
Hitendra Prajapati
026fcadc2e wireshark: Fix CVE-2023-3649
Upstream-Status: Backport from 75e0ffcb42

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-12 10:41:59 -05:00
Martin Jansa
7c74ee839d libiio: use main branch instead of master
* the branch was renamed upstream

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-12 10:41:03 -05:00
Richard Purdie
415b791459 grubby: Update branchname to match upstream
meta-oe master already made this change along with others. Update the branchname
to match upstream repository changes to allow fetching to continue to work.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-12 10:41:00 -05:00
Khem Raj
c319930fbf ibus: Swith to use main branch instead of master
Upstream has switched to using main for tip of trunk, therefore follow
it here in SRC_URI as well.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Suggested-by: Fabio Estevam <festevam@gmail.com>
Reported-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-12 10:40:57 -05:00
Vijay Anusuri
300be97535 libssh2: Backport fix for CVE-2020-22218
Bug: https://github.com/libssh2/libssh2/pull/476

Upstream-Status: Backport [642eec48ff
&
0b44e558f3]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-21 16:31:35 -04:00
Siddharth Doshi
0f10a0d394 php: Fix CVE-2023-3824
Upstream-Status: Backport from [80316123f3]
CVE: CVE-2023-3824
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-30 08:55:03 -04:00
Priyal Doshi
2f4f70a703 open-vm-tools: Security fix for CVE-2023-20900
Backport-from: 74b6d0d900

Signed-off-by: Priyal Doshi <pdoshi@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-30 08:54:36 -04:00
Kirill Esipov
56f8513464 catch2: switch from master to v2.x branch
"master" branch does not exist in original repo.

Signed-off-by: Kirill Esipov <yesipov@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-30 08:54:04 -04:00
Hitendra Prajapati
964979d26d wireshark: Fix CVE-2023-2906
Upstream-Status: Backport from 44dc70cc5a

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-19 07:34:28 -04:00
Bhargav Das
0fb607b8db iperf3: Fix CVE-2023-38403
iperf3 before 3.14 allows peers to cause an integer overflow and heap
corruption via a crafted length field.

NVD link: https://nvd.nist.gov/vuln/detail/CVE-2023-38403

Upstream-Status: Backported from 0ef151550d

Signed-off-by: Bhargav Das <bhargav.das@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-19 07:30:51 -04:00
Armin Kuster
e42d1e758f postgresql: refresh patches
fixes:

WARNING: postgresql-12.16-r0 do_patch: Fuzz detected:

Applying patch 0001-Add-support-for-RISC-V.patch
patching file src/include/storage/s_lock.h
Hunk #2 succeeded at 339 with fuzz 1.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-09 12:52:03 -04:00
Sourav Kumar Pramanik
ffa6aff5da meta-oe-components: Avoid usage of nobranch=1
The usage of nobranch=1 in SRC_URI allows using unprotected branches.

This change updates the real branch name in place of nobranch=1 for these components.

Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 09:05:55 -04:00
Sourav Pramanik
a84764cd13 nlohmann-json: Avoid usage of nobranch=1
The usage of nobranch=1 in SRC_URI allows using unprotected branches.

This change updates the real branch name in place of nobranch=1.

Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 09:05:52 -04:00
Sourav Pramanik
637cd4fd96 rapidjson: Avoid usage of nobranch=1
The usage of nobranch=1 in SRC_URI allows using unprotected branches.

This change updates the real branch name in place of nobranch=1.

Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 09:05:48 -04:00
Robert Joslyn
d96f8c4853 postgresql: Update to 12.16
This is a minor release to address CVEs and other bug fixes without new
features. Remove patches that are fixed in this release. Release notes are
available at:

https://www.postgresql.org/docs/release/12.10/
https://www.postgresql.org/docs/release/12.11/
https://www.postgresql.org/docs/release/12.12/
https://www.postgresql.org/docs/release/12.13/
https://www.postgresql.org/docs/release/12.14/
https://www.postgresql.org/docs/release/12.15/
https://www.postgresql.org/docs/release/12.16/

License-Update: Copyright year updated

Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 09:05:03 -04:00
Ashish Sharma
1ff41cb9c6 php: Backport fix CVE-2023-3247
Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-16 08:39:45 -04:00
Martin Jansa
172fc48573 nodejs-14: add -fpermissive BUILD_CXXFLAGS to fix build with gcc-13 on host
Fixes nodejs-native build with gcc-13 on host:
http://errors.yoctoproject.org/Errors/Details/728221/

nodejs-12 doesn't need it yet and nodejs-16 doesn't need it as well

'-DV8_TYPED_ARRAY_MAX_SIZE_IN_HEAP=64' '-D__STDC_FORMAT_MACROS' '-DOPENSSL_NO_PINSHARED' '-DOPENSSL_THREADS' '-DV8_TARGET_ARCH_X64' '-DV8_EMBEDDER_STRING="-node.84"' '-DENABLE_DISASSEMBLER' '-DV8_PROMISE_INTERNAL_FIELD_COUNT=1' '-DENABLE_MINOR_MC' '-DOBJECT_PRINT' '-DV8_INTL_SUPPORT' '-DV8_CONCURRENT_MARKING' '-DV8_ARRAY_BUFFER_EXTENSION' '-DV8_ENABLE_LAZY_SOURCE_POSITIONS' '-DV8_USE_SIPHASH' '-DDISABLE_UNTRUSTED_CODE_MITIGATIONS' '-DV8_WIN64_UNWINDING_INFO' '-DV8_ENABLE_REGEXP_INTERPRETER_THREADED_DISPATCH' '-DV8_SNAPSHOT_COMPRESSION' -ITOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -I../deps/v8 -I../deps/v8/include -I.//Release/obj/gen/torque-output-root -I.//Release/obj/gen/generate-bytecode-output-root  -pthread -Wno-unused-parameter -m64 -Wno-return-type -fno-strict-aliasing -m64 -O3 -fno-omit-frame-pointer -fdata-sections -ffunction-sections -O3 -fno-rtti -fno-exceptions -std=gnu++1y -MMD -MF .//Release/.deps/Release/obj.host/v8_initializers/gen/torque-output-root/torque-generated/../../deps/v8/src/builtins/array-find-tq-csa.o.d.raw -isystemTOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -isystemTOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -O2 -pipe -c
In file included from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/bits/move.h:37,
                 from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/bits/stl_function.h:60,
                 from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/functional:49,
                 from ../deps/v8/src/codegen/code-stub-assembler.h:8,
                 from ../deps/v8/src/builtins/builtins-promise-gen.h:8,
                 from ../deps/v8/src/builtins/builtins-async-gen.h:8,
                 from ../deps/v8/src/builtins/builtins-async-function-gen.cc:5:
/usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/type_traits: In instantiation of ‘struct std::is_convertible<v8::internal::Cell, v8::internal::Object>’:
../deps/v8/src/codegen/tnode.h:262:72:   required from ‘const bool v8::internal::is_subtype<v8::internal::Cell, v8::internal::Cell>::value’
../deps/v8/src/codegen/tnode.h:346:75:   required by substitution of ‘template<class U, typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> > v8::internal::TNode<v8::internal::Cell>::TNode(const v8::internal::TNode<T>&) [with U = v8::internal::Cell; typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> = <missing>]’
../deps/v8/src/codegen/code-stub-assembler.h:1868:33:   required from here
/usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/type_traits:1417:30: error: invalid use of incomplete type ‘class v8::internal::Cell’ [-fpermissive]
 1417 |     : public __bool_constant<__is_convertible(_From, _To)>
      |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../deps/v8/src/objects/objects.h:26,
                 from ../deps/v8/src/objects/fixed-array.h:10,
                 from ../deps/v8/src/objects/contexts.h:8,
                 from ../deps/v8/src/execution/thread-local-top.h:10,
                 from ../deps/v8/src/execution/isolate-data.h:12,
                 from ../deps/v8/src/execution/isolate.h:24,
                 from ../deps/v8/src/codegen/interface-descriptors.h:14,
                 from ../deps/v8/src/codegen/callable.h:8,
                 from ../deps/v8/src/codegen/code-factory.h:8,
                 from ../deps/v8/src/compiler/code-assembler.h:17,
                 from ../deps/v8/src/codegen/code-stub-assembler.h:15:
../deps/v8/src/objects/object-list-macros.h:19:7: note: forward declaration of ‘class v8::internal::Cell’
   19 | class Cell;
      |       ^~~~
In file included from ../deps/v8/src/codegen/interface-descriptors.h:12:
../deps/v8/src/codegen/tnode.h: In instantiation of ‘const bool v8::internal::is_subtype<v8::internal::Cell, v8::internal::Cell>::value’:
../deps/v8/src/codegen/tnode.h:346:75:   required by substitution of ‘template<class U, typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> > v8::internal::TNode<v8::internal::Cell>::TNode(const v8::internal::TNode<T>&) [with U = v8::internal::Cell; typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> = <missing>]’
../deps/v8/src/codegen/code-stub-assembler.h:1868:33:   required from here
../deps/v8/src/codegen/tnode.h:262:72: error: ‘value’ is not a member of ‘std::is_convertible<v8::internal::Cell, v8::internal::Object>’
  262 |                                        std::is_convertible<T, Object>::value);
      |                                                                        ^~~~~

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:29:13 -04:00
Khem Raj
0aa6a3ddc6 nodejs: Fix build with gcc13
* MJ: remove AUTHORS modification from the original patch from
  nodejs-16, so that the same patch does apply for both 14 and 12
  versions used in dunfell

* MJ: gcc-13 isn't used for target builds in dunfell, but can be used
  on host, so this is useful backport for nodejs-native

* MJ: this fixes default nodejs-native-12, nodejs-native-14 with negative
  D_P might need additional fix on top

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:29:04 -04:00
Vijay Anusuri
3c62000f88 c-ares: CVE-2023-32067 0-byte UDP payload Denial of Service
Upstream-Status: Backport from b9b8413cfd

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22 07:49:35 -04:00
Khem Raj
b8b0b06821 sysdig: Depend on system libb64
avoid using vendored version

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d8053b7e2b)
[FIxes this error
 --- LOG END ---
 |          error: downloading 'http://download.draios.com/dependencies/libb64-1.2.src.zip' failed
 |          status_code: 22
 |          status_string: "HTTP response code said error"
 |          log:
 |          --- LOG BEGIN ---
 ]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22 07:49:35 -04:00
Khem Raj
98982f3f3e libb64: Add recipe
Add Base64 encode/decode library, some packages e.g. sysdig can benefit
from it

Disable parallel make as it races at times
make[1]: *** No rule to make target 'libb64.a', needed by 'c-example1'.  Stop.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6946f40707)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22 07:49:35 -04:00
Alexander Thoma
74f90db833 Fix tigervnc crash due to missing xkbcomp rdepends
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 447de4d47b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit b3b00a270e)
[Fixup for Dunfell context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22 07:49:35 -04:00
Hitendra Prajapati
b5282ece91 openldap: fix CVE-2021-27212 Assertion failure in slapd
Upstream-Status: Backport from 9badb73425

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
2dd0c9db67 quagga: CVE-2021-44038 unsafe chown/chmod operations may lead to privileges escalation
Upstream-Status: Backport from https://build.opensuse.org/package/view_file/network/quagga/remove-chown-chmod.service.patch

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
3e51eb35ae multipath-tools: fix CVE-2022-41974
Upstream-Status: Backport from fbbf280a0e

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
fbe2d05a15 ntp: backport patch for 5 CVEs CVE-2023-26551/2/3/4/5
Upstream-Status: Backport from https://archive.ntp.org/ntp4/ntp-4.2/ntp-4.2.8p15-3806-3807.patch

Patch taken from https://archive.ntp.org/ntp4/ntp-4.2/ntp-4.2.8p15-3806-3807.patch
It is linked as official patch for p15 in:
- https://www.ntp.org/support/securitynotice/ntpbug3807/
- https://www.ntp.org/support/securitynotice/ntpbug3806/

Small adaptation to build is needed because of how tests are built.

Backport fixes for:
CVE: CVE-2023-26551
CVE: CVE-2023-26552
CVE: CVE-2023-26553
CVE: CVE-2023-26554
CVE: CVE-2023-26555

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
7ca27d5cf3 yajl: CVE-2023-33460 memory leak in yajl_tree_parse function
Upstream-Status: Backport from 23a122edda

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
205b72edaa wireshark: Fix CVE-2023-0667 & CVE-2023-0668
Backport fixes for:
* CVE-2023-0667 - Upstream-Status: Backport from 35418a73f7 && 85fbca8adb
* CVE-2023-0668 - Upstream-Status: Backport from c4f37d77b2

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
vkumbhar
5f94e67479 postgresql: fix CVE-2023-2454 & CVE-2023-2455
fixed Below security CVE:
1)CVE-2023-2454 postgresql: schema_element defeats protective search_path changes.
2)CVE-2023-2455 postgresql: row security policies disregard user ID changes after inlining.

Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
virendra thakur
e5808a69cd c-ares: whitelist CVE-2023-31124
CVE-2023-31124 applies only when cross-compiling using autotools.
Yocto cross-compiles via cmake which is also listed as official workaround.

See:
* https://nvd.nist.gov/vuln/detail/CVE-2023-31124
* https://github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4

Signed-off-by: virendra thakur <virendrak@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
8b5ce0d524 wireshark: Fix Multiple CVEs
Backport fixes for:
* CVE-2023-2855 - Upstream-Status: Backport from 0181fafb21
* CVE-2023-2856 - Upstream-Status: Backport from db5135826d
* CVE-2023-2858 - Upstream-Status: Backport from cb190d6839
* CVE-2023-2952 - Upstream-Status: Backport from e18d0e3697

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Vijay Anusuri
00de17fa46 libssh: CVE-2020-16135 NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL
Upstream-Status: Backport
[533d881b0f
&
2782cb0495
&
10b3ebbe61
&
245ad744b5]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
6334241447 c-ares: CVE-2023-31147 Insufficient randomness in generation of DNS query IDs
Upstream-Status: Backport from 823df3b989

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Hitendra Prajapati
1b4564b6d9 c-ares: CVE-2023-31130 fix Buffer Underwrite
Upstream-Status: Backport from f22cc01039

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Vijay Anusuri
a0a0abb540 python3-cryptography: fix CVE-2023-23931
Upstream-Status: Backport
[9fbf84efc8]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Vijay Anusuri
eae14f75ed c-ares: fix CVE-2022-4904 & Update SRC_URI branch and protocols
Upstream-Status: Backport
[https://git.openembedded.org/meta-openembedded-contrib/commit/?h=stable/kirkstone-nut&id=092e125f44f65427d42db95db3779daf4893d10f
& https://git.openembedded.org/meta-openembedded-contrib/commit/meta-oe/recipes-support/c-ares/c-ares_1.18.1.bb?h=stable/kirkstone-nut&id=b402a3076fbafe05d0b8621e50603b65c3fe8147
Upstream-Commit:
9903253c34]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Vijay Anusuri
d8c29311e5 openldap: Fix CVE-2023-2953
Upstream-Status: Backport
[752d320cf9
&
6563fab9e2]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
schitrod=cisco.com@lists.openembedded.org
65efd68735 gnulib: Update recipe name to 2018-12-18
As per gnulib_2018-03-07 recipe information,
SRCREV = "0d6e3307bbdb8df4d56043d5f373eeeffe4cbef3"
This revision was committed on "2018-12-18".

There is a discrepancy between SRCREV and the recipe version.
Which reports "CVE-2018-17942" as unpatched.

To report "CVE-2018-17942" as patched,
We need to align a recipe name with SRCREV commit date.

Signed-off-by: Sanjay Chitroda <schitrod@cisco.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9edbe7033c)
Signed-off-by: Sanjay Chitroda <schitrod@cisco.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Samuli Piippo
bb928e789c spirv-tools: switch from master branch to main for re2
Signed-off-by: Samuli Piippo <samuli.piippo@qt.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Martin Jansa
d25f2f1cac nodejs: fix native node-gyp to work with python-3.11
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00