summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2024-01-24gnutls: Fix for CVE-2024-0553 and CVE-2024-0567Vijay Anusuri
CVE-2024-0553 A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981. CVE-2024-0567 A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack. Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/40dbbd8de499668590e8af51a15799fbc430595e & https://gitlab.com/gnutls/gnutls/-/commit/9edbdaa84e38b1bfb53a7d72c1de44f8de373405] Reference: https://ubuntu.com/security/CVE-2024-0553 https://ubuntu.com/security/CVE-2024-0567 (From OE-Core rev: de74fd5dea8cc71af1d457b4e688cfbe0f39e4d8) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-24tiff: fix CVE-2023-6228Yogita Urade
CVE-2023-6228: An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash. References: https://nvd.nist.gov/vuln/detail/CVE-2023-6228 https://gitlab.com/libtiff/libtiff/-/issues/606 (From OE-Core rev: 0730806ae39093b05ce943df1f9f5d0a25a8a673) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-24openssl: fix CVE-2023-6237 Excessive time spent checking invalid RSA public keysHitendra Prajapati
Upstream-Status: Backport from https://github.com/openssl/openssl/commit/e09fc1d746a4fd15bb5c3d7bbbab950aadd005db (From OE-Core rev: 6bb64af6ce167eadd34570b061b3e6ed13c39c74) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-24dropbear: backport patch for CVE-2023-48795Peter Marko
Documentation for this patch is under https://github.com/mkj/dropbear/commit/66bc1fcdee594c6cb1139df0ef8a6c9c5fc3fde3 (From OE-Core rev: 626711a95f387090a4705401d2f9406909821f95) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-21pybootchartgui: fix 2 SyntaxWarningsMartin Jansa
scripts/pybootchartgui/pybootchartgui/draw.py:820: SyntaxWarning: "is not" with a literal. Did you mean "!="? if (OPTIONS.show_pid or OPTIONS.show_all) and ipid is not 0: scripts/pybootchartgui/pybootchartgui/draw.py:918: SyntaxWarning: "is not" with a literal. Did you mean "!="? if i is not 0: (From OE-Core rev: ebd61290a644a6d9f2b3701e0e7ea050636da76c) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 8d996616f0ca57220d939a41ca9ba6d696ea2a4f) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-21cpio: upgrade to 2.14Soumya Sambu
This includes fix for CVE-2023-7207. Drop all submitted patches. Apply a patch from git to fix the build with clang. [ YOCTO #11674 ] $git log --oneline release_2_13..v2.14 4a41909 (HEAD, tag: v2.14) Version 2.14 6f9e5d3 Update NEWS 807b3ea Use GNU ls algorithm for deciding timestamp format 19219d1 Fix integer overflows in timestamp output ed28f14 Whitespace cleanup 4ab2813 Update version of gnulib 0987d63 Fix appending to archives bigger than 2G 1df0062 Fix combination of --create, --append, --directory 6a94d5e New option --ignore-dirnlink 376d663 Fix 45b0ee2b407913c533f7ded8d6f8cbeec16ff6ca. beba8c0 Require automake 1.16.5 70fffa7 Update for newer autotools a1b2f78 Fix calculation of CRC in copy-out mode. 18ea636 Upgrade gnulib 1a61f62 Update copyright years a1c97c8 Fix wording in the manpage 97fab48 Update copyright years 86dacfe Remove redundant condition check 4d16930 Use inttostr to represent integer values as strings 236684f Fix dynamic string reallocations dfc801c Fix previous commit dd96882 Rewrite dynamic string support. 269d204 Improve online version of the documentation. 7dd8ba9 Update gnulib 905907c Update copyright years 4a78d77 Formatting changes in the documentation. 9fe8494 Update copyright years 641d3f4 Minor fix * src/global.c: Remove superfluous declaration of program_name 0c4ffde Fix handling of device numbers (part 2) df55fb1 Fix handling of device numbers on copy out. b1c8583 Improve 684b7ac5 684b7ac Fix cpio header verification. (From OE-Core rev: 203804370997eeb015ef9da90b567ea2c2f9f3a6) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-21systemd: fix CVE-2023-7008Hitendra Prajapati
Upstream-Status: Backport from https://github.com/systemd/systemd/commit/3b4cc1437b51fcc0b08da8cc3f5d1175eed25eb1 (From OE-Core rev: 545fc081f16a63e5b012d4636deee98a788753bb) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-21zlib: ignore CVE-2023-6992Peter Marko
This CVE is for iCPE cloudflare:zlib. Alternative to ignoring would be to limit CVE_PRODUCT, but historic CVEs already have two - gnu:zlib and zlib:zlib. So limiting it could miss future CVEs. (From OE-Core rev: f46c9105d4253153a5986f2b307273e43ee98c33) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-21sqlite3: backport patch for CVE-2023-7104Peter Marko
Backport https://sqlite.org/src/info/0e4e7a05c4204b47 (From OE-Core rev: 31fb83ac3dcd2dd55b184de22a296ab4dc150d2e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-21Revert "curl: Backport fix CVE-2023-32001"Poonam Jadhav
This reverts commit 5eab65275dc9faa0b9a4371d5bcb6e95cfda61cd. CVE-2023-32001 has been marked "REJECT" in the NVD CVE List as there is no safe measure against it. These CVEs are stored in the NVD, but do not show up in search results. Link: https://nvd.nist.gov/vuln/detail/CVE-2023-32001 (From OE-Core rev: a3b6216bcb3425b6e30ca73488a5eb6ba58e4836) Signed-off-by: Poonam Jadhav poonam.jadhav@kpit.com Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-21openssl: Backport fix for CVE-2023-6129Vivek Kumbhar
Upstream-Status: Backport [https://github.com/openssl/openssl/commit/8d847a3ffd4f0b17ee33962cf69c36224925b34f] (From OE-Core rev: db1c8b434e1e249cf5a12fe39cf996373513f3dc) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-11linux-firmware: upgrade 20230804 -> 20231030Dmitry Baryshkov
License-Update: additional firmwares (From OE-Core rev: 8e27f96c0befbbb5cf8a2f7076b7a1ffd79addb6) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7c725d1f2ed9a271d39d899ac2534558c2d103fc) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-11cve-update-nvd2-native: increase the delay between subsequent request failuresDhairya Nagodra
Sometimes NVD servers are unstable and return too many errors. There is an option to have higher fetch attempts to increase the chances of successfully fetching the CVE data. Additionally, it also makes sense to progressively increase the delay after a failed request to an already unstable or busy server. The increase in delay is reset after every successful request and the maximum delay is limited to 30 seconds. Also, the logs are improved to give more clarity. (From OE-Core rev: f2e30f54e1dbb36d7527d0117eb2435f25e7e154) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7101d654635b707e56b0dbae8c2146b312d211ea) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-11cve-update-nvd2-native: faster requests with API keysDhairya Nagodra
As per NVD, the public rate limit is 5 requests in 30s (6s delay). Using an API key increases the limit to 50 requests in 30s (0.6s delay). However, NVD still recommends sleeping for several seconds so that the other legitimate requests are serviced without denial or interruption. Keeping the default sleep at 6 seconds and 2 seconds with an API key. For failures, the wait time is unchanged (6 seconds). Reference: https://nvd.nist.gov/developers/start-here#RateLimits (From OE-Core rev: 4f7e40652cdf647c28f7dc6052bfa5db6bc9d8fb) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 5c32e2941d1dc3d04a799a1b7cbd275c1ccc9e79) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-11cve-update-nvd2-native: make number of fetch attemtps configurablePeter Marko
Sometimes NVD servers are unstable and return too many errors. Last time we increased number of attempts from 3 to 5, but further increasing is not reasonable as in normal case too many retries is just abusive. Keep retries low as default and allow to increase as needed. (From OE-Core rev: 036969937e7c84cc068efe0355dd26281cf89f03) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6b6fd8043d83b99000054ab6ad2c745d07c6bcc1) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-11cve-update-nvd2-native: remove unused variable CVE_SOCKET_TIMEOUTPeter Marko
This variable is not referenced in oe-core anymore. (From OE-Core rev: 15a79302aa46c58f962e12956aa4fcd0a178cf58) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 905b45a814cb33327503b793741c19b44c8550b3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-11xserver-xorg: Fix for CVE-2023-6377 and CVE-2023-6478Vijay Anusuri
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd & https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632] (From OE-Core rev: abadef9d1759254699577fe40ee353e75958f9a2) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-10ref-manual: update tested and supported distrosMichael Opdenacker
According to currently active workers https://autobuilder.yoctoproject.org/typhoon/#/workers and to the "workers_prev_releases" definition in https://git.yoctoproject.org/yocto-autobuilder2/tree/config.py Also correct the text saying that SANITY_TESTED_DISTROS lists currently tested distros. Also replace AlmaLinux 8.8 and 9.2 by just AlmaLinux 8 and 9, as we update our workers anyway. (From yocto-docs rev: 79a6ec6847cdfc40d75def36993a40fec853a7a1) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-10bitbake: asyncrpc: Add context manager APIJoshua Watt
Adds context manager API for the asyncrcp client class which allow writing code that will automatically close the connection like so: with hashserv.create_client(address) as client: ... Rework the bitbake-hashclient tool and PR server to use this new API to fix warnings about unclosed event loops when exiting (Bitbake rev: ee090484cc25d760b8c20f18add17b5eff485b40) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d01d684a0f6398270fe35ed59b7d28f3fd9b7e41) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-04tzdata: Upgrade to 2023dShubham Kulkarni
(From OE-Core rev: 227b3d4edad31b0d0045f41133271693265240b0) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2956b1aa22129951b8c08ac06ff1ffd66811a26c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-04testimage: drop target_dumper, host_dumper, and monitor_dumperSteve Sakoman
The target_dumper code is basically broken. It has been reading binary files over the text base serial communication and runs at every command failure which makes no sense. Each run might overwrite files from the previous run and the output appears corrupted due to confusion from the binary data. It isn't possible to cherry-pick "testimage: Drop target_dumper and most of monitor_dumper" from master, so just make target_dumper, host_dumper, and monitor_dumper empty functions. For further details see: https://lists.openembedded.org/g/openembedded-architecture/message/1888 (From OE-Core rev: 960e7e3dffa22c2142cb672c68cd9a8f0e3998a3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-04elfutils: Disable stringop-overflow warning for build hostKhem Raj
Some distributions shipping gcc12 end up with stringop-overflow warnings e.g. /usr/include/bits/unistd.h:74:10: error: ‘__pread_alias’ specified size between 9223372036854775813 and 18446744073709551615 exceeds maximum object size 9223372036854775807 [-Werror=stringop-overflow=] 74 | return __glibc_fortify (pread, __nbytes, sizeof (char), | ^~~~~~~~~~~~~~~ Until fixed, lets not treat this warning as hard error MJ: this is needed e.g. on ubuntu 24.04 after gcc was upgraded from 13.2.0-8ubuntu1 to 13.2.0-9ubuntu1 which includes switch _FORTIFY_SOURCE to 3: https://changelogs.ubuntu.com/changelogs/pool/main/g/gcc-13/gcc-13_13.2.0-9ubuntu1/changelog elfutils config.log then shows: configure:6762: checking whether to add -D_FORTIFY_SOURCE=2 to CFLAGS configure:6779: gcc -c -D_FORTIFY_SOURCE=2 -isystem/work/x86_64-linux/elfutils-native/0.186-r0/recipe-sysroot-native/usr/include -O2 -pipe -Werror -isystem/work/x86_64-linux/elfutils-native/0.186-r0/recipe-sysroot-native/usr/include conftest.c >&5 <command-line>: error: "_FORTIFY_SOURCE" redefined [-Werror] <built-in>: note: this is the location of the previous definition cc1: all warnings being treated as errors configure:6786: result: no and -D_FORTIFY_SOURCE=2 missing in CFLAGS later causes the above error in do_compile (From OE-Core rev: 94d1640d374c9a8827957cba8dbc1c1f978701b5) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-04openssh: fix CVE-2023-51385Archana Polampalli
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name. References: https://nvd.nist.gov/vuln/detail/CVE-2023-51385 Upstream patches: https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a (From OE-Core rev: 617640bd045f07b0870dc9f3bc838b3a9fbc3de7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-04openssh: fix CVE-2023-51384Archana Polampalli
In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys. References: https://nvd.nist.gov/vuln/detail/CVE-2023-51384 Upstream patches: https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b (From OE-Core rev: 7a745dd1aa13fbf110cc4d86ddbc86617975d6ad) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-04bitbake: lib/bb: Add workaround for libgcc issues with python 3.8 and 3.9Richard Purdie
With python 3.8 and 3.9, we see intermittent errors of: libgcc_s.so.1 must be installed for pthread_cancel to work Aborted (core dumped) which seem related to: https://stackoverflow.com/questions/64797838/libgcc-s-so-1-must-be-installed-for-pthread-cancel-to-work https://bugs.ams1.psf.io/issue42888 These tend to occur on debian 11 and ubuntu 20.04. Workaround this by ensuring libgcc is preloaded in all cases. (Bitbake rev: 2c6183594279e2e9d03f11155ad969448869c863) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2024-01-04bitbake: data: Add missing dependency handling of remove operatorInsu Park
A recipe variable handles its dependencies even on the "contains" variables within the "inline Python expressions" like bb.utils.filter(). And it also handles those in the append operator correctly, but the problem is that it does not so in the remove operator. Fix it by adding the missing dependencies every time the remove operator has been handled. Also add a test case to check if the override operators handle dependencies correctly. (Bitbake rev: 23639edfbbb3fced7606dce211db8a31c5766585) Signed-off-by: Insu Park <insu0.park@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Cherry-picked from master: b90520eedb1dbc7f6a3928d089fe74fafb864eb5 - Conflicts in data.py are resolved as the master branch moved handle_contains() and handle_remove() out of the try block. - The test code in codeparser.py are modified as the master branch added three more arguments to the build_dependencies(). Signed-off-by: Insu Park <insu0.park@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-22testimage: Exclude wtmp from target-dumper commandsRichard Purdie
wtmp is filled with binary data which the run_serial command can't cope with. Catting this results in confusion of the serial interface and potentially large backlogs of data in the buffers which can hang qemu. Exclude the problematic files from the command. (From OE-Core rev: 2afd9a6002cba2a23dd62a1805b4be04083c041b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 599ac08a6f6fb3f6a89a897c8e06367c63c2f979) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-22python3-ptest: skip test_storlinesTrevor Gamblin
[YOCTO #14933] test_storlines is yet another Python ptest that fails intermittently on the Yocto AB, so disable it during ptests for now. (From OE-Core rev: b71d5ec10f8e64fc6102c66dfc36151f2b0b3c86) Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit d7b9f8157e6214a83b5495e8a32e11540ae65ff8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-22externalsrc: Ensure SRCREV is processed before accessing SRC_URIYoann Congal
When SRCREV is used, call bb.fetch.get_srcrev() before accessing SRC_URI. Without this new bb.fetch.get_srcrev() call, SRC_URI might be accessed before SRCREV had a chance to be processed. In master, this is fixed by https://git.yoctoproject.org/poky/commit/?id=62afa02d01794376efab75623f42e7e08af08526 However, this commit is not suited for backport since it is quite invasive. The part of the commit that fix the bug is: --- a/meta/classes/externalsrc.bbclass +++ b/meta/classes/externalsrc.bbclass @@ -63,6 +63,7 @@ python () { else: d.setVar('B', '${WORKDIR}/${BPN}-${PV}') + bb.fetch.get_hashvalue(d) local_srcuri = [] fetch = bb.fetch2.Fetch((d.getVar('SRC_URI') or '').split(), d) for url in fetch.urls: NB: bb.fetch.get_hashvalue() does not exist in kirkstone but is equivalent to bb.fetch.get_srcrev(). Fixes [YOCTO #14918] (From OE-Core rev: f6563cca6c4bf627e904d81fbe5b0b0f2b16a107) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Suggested-by: Chris Wyse <chris.wyse@wysechoice.net> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-22perl: update 5.34.1 -> 5.34.3Soumya Sambu
This includes security fix for CVE-2023-47038 Changes: https://metacpan.org/release/PEVANS/perl-5.34.3/changes (From OE-Core rev: d1bc5fb1d090cf93b9014a050b418499c0209080) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-22openssh: backport Debian patch for CVE-2023-48795Vijay Anusuri
import patches from ubuntu to fix fix-authorized-principals-command CVE-2023-48795 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/openssh/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://github.com/openssh/openssh-portable/commit/fcd78e31cdd45a7e69ccfe6d8a3b1037dc1de290 & https://github.com/openssh/openssh-portable/commit/1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5] Reference: https://ubuntu.com/security/CVE-2023-48795 (From OE-Core rev: df5dc8d67e67a2aebf1a552c3e22374e305270bf) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-22go: Fix CVE-2023-39326Soumya Sambu
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. References: https://nvd.nist.gov/vuln/detail/CVE-2023-39326 https://security-tracker.debian.org/tracker/CVE-2023-39326 (From OE-Core rev: 448df3bb9277287dd8586987199223b7314fdd01) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-22ffmpeg: fix for CVE-2022-3965mark.yang
Without a CVE tag, It will be recognised as Unpatched by cve_check task. (From OE-Core rev: afc21d7fe86d26bf62e56fc611750f89fe73aa1a) Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-22ffmpeg: fix for CVE-2022-3964mark.yang
Without a CVE tag, It will be recognised as Unpatched by cve_check task. (From OE-Core rev: ce4ac3d167496d2f3a3029ef83dc418a0794c2fb) Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-22qemu: Fix CVE-2023-5088Sourav Pramanik
A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This change is to fix CVE-2023-5088. Link: https://gitlab.com/qemu-project/qemu/-/commit/7d7512019fc40c577e2bdd61f114f31a9eb84a8e (From OE-Core rev: aa84c668bfe2436d36f49a422c775119e2412c8b) Signed-off-by: Sourav Pramanik <sourav.pramanik@kpit.com> Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-22curl: Fix CVE-2023-46218Poonam Jadhav
Add patch to fix CVE-2023-46218 Link: https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/curl/7.88.1-8ubuntu2.4/curl_7.88.1-8ubuntu2.4.debian.tar.xz https://github.com/curl/curl/commit/2b0994c29a721c91c57 (From OE-Core rev: f27a93299f554e0bde610f70e6a042b4a24abf20) Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-22ghostscript: Backport fix for CVE-2023-46751Vijay Anusuri
Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=5d2da96e81c7455338302c71a291088a8396245a] (From OE-Core rev: f01a0e7fcf3c2d277be0cd85c0cd6b2eff2e5f0a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21test-manual: use working exampleMichael Opdenacker
(From yocto-docs rev: 7438d32b45b12b034a7d9c9e60b8e8c083ef85d3) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21migration-guides: add release notes for 4.0.15Lee Chee Yang
(From yocto-docs rev: b6e13990229baa91d8b9b885848230d40cb9e045) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21dev-manual: runtime-testing: fix test module nameMichael Opdenacker
(From yocto-docs rev: 15a5a6de535db637abe15c24b6d6d9d1e0fb444e) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21manuals: brief-yoctoprojectqs: align variable order with default local.confSimone Weiß
Align the order from `BB_SIGNATURE_HANDLER` to `SSTATE_MIRRORS` in Quick Build with the order in the default local conf. While trivial it is easier to find, if the order matches. (From yocto-docs rev: 2ab0bdc7ff74aaddd8a556046de3410300ba560a) Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21test-manual: add or improve hyperlinksMichael Opdenacker
(From yocto-docs rev: d6ea0c9c7713e265f5044548112f865348b21576) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21test-manual: explicit or fix file pathsMichael Opdenacker
(From yocto-docs rev: f947a07350aaddb798a1348c3bd5e77faf3849e7) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21test-manual: add links to python unittestMichael Opdenacker
Better than using "python unittest" without any special formatting. (From yocto-docs rev: 544cc1f950445d2c103c9adfa9147af1513b7a14) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21test-manual: resource updatesMichael Opdenacker
(From yocto-docs rev: 1a89f195eb7d9b16b481055c85632bf6524f777b) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21test-manual: text and formatting fixesMichael Opdenacker
(From yocto-docs rev: 330092ae9e624cef0fb8494a0deab896fb1b9026) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21dev-manual: Discourage the use of SRC_URI[md5sum]Peter Kjellerstedt
SRC_URI[md5sum] has been deprecated for a long time. Discourage its use by removing it from examples and note that it should be replaced by SRC_URI[sha256sum] when updating recipes. Also mention that bitbake supports other checksums, though they are not commonly used. (From yocto-docs rev: fb5b87cf7322542896c269f404571a655ed6bf91) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21migration-guides: release 3.5 is actually 4.0Michael Opdenacker
(From yocto-docs rev: 3b09e8ab838d8b14fd259d17a6597ea43bf46578) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21docs: add CONVERSION_CMD definitionAatir Manzur
(From yocto-docs rev: ba1458b04e2828e728c2815b1221e9399132d25d) Signed-off-by: Aatir Manzur <aatrapps@gmail.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-12-21contributor-guide: fix command optionMichael Opdenacker
"--subject-prefix" applies to "git format-patch", not "git send-email" (From yocto-docs rev: cf3697cebc0494a624fa2766d07c3532ec6b4341) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-06-02 20:55:28 +0000