summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2022-06-11cve-update-db-native: make it possible to disable database updatesMarta Rybczynska
Make it possible to disable the database update completely by using a negative update interval CVE_DB_UPDATE_INTERVAL. Disabling the update is useful when running multiple parallel builds when we want to have a control on the database version. This allows coherent cve-check results without an database update for only some of the builds. (From OE-Core rev: 487a53522a739b9a52720c4c40b93f88ad77d242) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b5c2269240327c2a8f93b9e55354698f52c976f3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11cve-check: add coverage statistics on recipes with/without CVEsMarta Rybczynska
Until now the CVE checker was giving information about CVEs found for a product (or more products) contained in a recipe. However, there was no easy way to find out which products or recipes have no CVEs. Having no reported CVEs might mean there are simply none, but can also mean a product name (CPE) mismatch. This patch adds CVE_CHECK_COVERAGE option enabling a new type of statistics. Then we use the new JSON format to report the information. The legacy text mode report does not contain it. This option is expected to help with an identification of recipes with mismatched CPEs, issues in the database and more. This work is based on [1], but adding the JSON format makes it easier to implement, without additional result files. [1] https://lists.openembedded.org/g/openembedded-core/message/159873 (From OE-Core rev: c63d06becc340270573bdef2630749db1f5230d4) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit d1849a1facd64fa0bcf8336a0ed5fbf71b2e3cb5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11cve-check: write empty fragment files in the text modeMarta Rybczynska
In the cve-check text mode output, we didn't write fragment files if there are no CVEs (if CVE_CHECK_REPORT_PATCHED is 1), or no unpached CVEs otherwise. However, in a system after multiple builds, cve_check_write_rootfs_manifest might find older files and use them as current, what leads to incorrect reporting. Fix it by always writing a fragment file, even if empty. (From OE-Core rev: 4c10ee956f21ea2f805403704ac3c54b7f1be78c) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f1b7877acd0f6e3626faa57d9f89809cfcdfd0f1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11cve-check: move update_symlinks to a libraryMarta Rybczynska
Move the function to a library, it could be useful in other places. (From OE-Core rev: c8a0e7ecee15985f7eed10ce9c86c48a77c5b7c5) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit debd37abcdde8788761ebdb4a05bc61f7394cbb8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11curl: Fix CVE_CHECK_WHITELIST typoRobert Joslyn
Fix typo to properly whitelist CVE-2021-22945. (From OE-Core rev: 7b2a1d908d3b63da5e9f072b61dd3c5fa91c7b8f) Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11curl: Backport CVE fixesRobert Joslyn
Backport patches to address CVE-2022-27774, CVE-2022-27781, and CVE-2022-27782. (From OE-Core rev: f8cdafc0ef54ab203164366ad96288fd10144b30) Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11libxslt: Mark CVE-2022-29824 as not applyingRichard Purdie
We have libxml2 2.9.10 and we don't link statically against libxml2 anyway so the CVE doesn't apply to libxslt. (From OE-Core rev: c6315d8a2a1429a0fb7563b1d6352ceee7bc222c) (From OE-Core rev: 9c736c9dcf5f18b8db082a0903be0acb3fbb51c2) Signed-off-by: Omkar Patil <Omkar.Patil@kpit.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ad63694e6df4f284879f7220962a821f97928eb0) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11libxslt: Fix CVE-2021-30560omkar patil
CVE: CVE-2021-30560 (From OE-Core rev: 3e01aa47b85ebeba26443fc3293c341b5ef72817) Signed-off-by: omkar patil <omkar.patil@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11pcre2: CVE-2022-1587 Out-of-bounds readHitendra Prajapati
Source: https://github.com/PCRE2Project/pcre2 MR: 118031 Type: Security Fix Disposition: Backport from https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0 ChangeID: 8fbc562b3e6b6a3674f435f6527a62afc67ef933 Description: CVE-2022-1587 pcre2: Out-of-bounds read in get_recurse_data_length in pcre2_jit_compile.c. (From OE-Core rev: 46323b9e0f44f58f6aae242ebf5a0101d8c36654) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11e2fsprogs: CVE-2022-1304 out-of-bounds read/write via crafted filesystemHitendra Prajapati
Source: https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git MR: 117430 Type: Security Fix Disposition: Backport from https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/commit/?h=maint&id=ab51d587bb9b229b1fade1afd02e1574c1ba5c76 ChangeID: e6db00c6e8375a2e869fd2e4ead61ca9149eb8fa Description: CVE-2022-1304 e2fsprogs: out-of-bounds read/write via crafted filesystem. (From OE-Core rev: b4f9ba859ed1fe5e1d42258fee1dd2e8e85e7eba) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11openssl: update the epoch time for ct_test ptestSteve Sakoman
We are getting an additional ptest failure after fixing the expired certificates. Backport a patch from upstream to fix this. (From OE-Core rev: 3af161acc13189cb68549f898f3964d83d00ce56) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11openssl: backport fix for ptest certificate expirationSteve Sakoman
ptests in in openssl have started failing as test certificates have expired. Backport a fix for this from upstream, replacing the test certificates to allow the ptests to pass again. (From OE-Core rev: 40858a05989d45b0c772fdec837d3dc95d4df59d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11Revert "openssl: Backport fix for ptest cert expiry"Steve Sakoman
Version 1.1.1 requires additional changes This reverts commit 4051d1a3aa5f70da96c381f9dea5f52cd9306939. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-07openssl: Backport fix for ptest cert expiryRichard Purdie
ptests in in openssl have started failing as one of the test certificates has expired. Backport a fix for this from upstream, replacing the test certificate to allow the ptests to pass again. (From OE-Core rev: 4051d1a3aa5f70da96c381f9dea5f52cd9306939) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f26f0b34f12bbca2beed153da402a3594d127374) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-06poky.conf: bump version for 3.1.17 releaseSteve Sakoman
(From meta-yocto rev: 215cfdaeb88bbfdb995d0a09685271d586558af6) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-06documentation: update for 3.1.17 releaseSteve Sakoman
(From yocto-docs rev: 8dd19c901813263554ac2bc6bda2cf9a1c3c1e58) Signed-off-by: Steve Sakoman <steve@sakoman.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-04cve-check: Allow warnings to be disabledRichard Purdie
When running CVE checks in CI we're usually not interested in warnings on the console for any CVEs present. Add a configuration option CVE_CHECK_SHOW_WARNINGS to allow this to be disabled (it is left enabled by default). (From OE-Core rev: d009233f36fb866f6bdaa12fb6deedf5e253e9c9) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1054d3366ba528f2ad52585cf951e508958c5c68) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 8fd6a9f521ea6b1e10c80fe33968943db30991ba) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-04cve-check: Only include installed packages for rootfs manifestErnst Sjöstrand
Before this the rootfs manifest and the summary were identical. We should separate the summary and rootfs manifest more clearly, now the summary is for all CVEs and the rootfs manifest is only for things in that image. This is even more useful if you build multiple images. (From OE-Core rev: 2bacd7cc67b2f624885ce9c9c9e48950b359387d) Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3b8cc6fc45f0ea5677729ee2b1819bdc7a441ab1) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 65498411d73e8008d5550c2d0a1148f990717587) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-04cve-check: Add helper for symlink handlingErnst Sjöstrand
(From OE-Core rev: 8a178a728f2318c55d5ecaef0ef9e0fd8ebc333b) Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5046d54df2c3057be2afa4143a2833183fca0d67) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-04cve-check.bbclass: Added do_populate_sdk[recrdeptask].leimaohui
As product, sdk should do cve check as well as rootfs. (From OE-Core rev: df09cd71b4cd3f830fced9ce91aa202c1609bfc5) Signed-off-by: Lei Maohui <leimaohui@fujitsu.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit cc17753935c5f9e08aaa6c5886f059303147c07b) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-04vim: Upgrade 8.2.4912 -> 8.2.5034 to fix 9 CVEsRichard Purdie
Address CVE-2022-1621, CVE-2022-1629, CVE-2022-1674, CVE-2022-1733, CVE-2022-1735 CVE-2022-1769, CVE-2022-1771, CVE-2022-1785, CVE-2022-1796 (From OE-Core rev: cd259a00503af360524f58c9cea51aa142dee250) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit fafce97bd440150ac5c586b53b887ee70a5b66bd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-04libxml2: Fix CVE-2022-29824 for libxml2Riyaz
Add patch for CVE issue: CVE-2022-29824 CVE-2022-29824 Link: [https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab] Dependent patch: [https://gitlab.gnome.org/GNOME/libxml2/-/commit/b07251215ef48c70c6e56f7351406c47cfca4d5b] (From OE-Core rev: 096ca5fa8cc4672e5e9b25dffe81b176b252d570) Signed-off-by: Riyaz <Riyaz.Khan@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-04ncurses: Fix CVE-2022-29458Dan Tran
ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. Backported from the link below, extracting only the relevant changes. https://github.com/ThomasDickey/ncurses-snapshots/commit/9d1d651878d4bf0695872a64cc65ba0acb825f36 (From OE-Core rev: 2287d591cf32f5580ea6679805d04c3a5146ecd5) Signed-off-by: Gustavo Lima Chaves <gustavo.chaves@microsoft.com> Signed-off-by: Dan Tran <dantran@microsoft.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-04ffmpeg: Fix for CVE-2022-1475Virendra Thakur
Add patch to fix CVE-2022-1475 (From OE-Core rev: 2a97ba89f236b751b333622fbbc14180e9b72245) Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-04libsdl2: Add fix for CVE-2021-33657Ranjitsinh Rathod
Add patch to fix CVE-2021-33657 issue for libsdl2 Link: https://security-tracker.debian.org/tracker/CVE-2021-33657 (From OE-Core rev: 1cc84e4c51c9afaa5dcb5011e6511496e00d2c8a) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-04ruby: Whitelist CVE-2021-28966 as this affects Windows OS onlyRanjitsinh Rathod
As per below debian link, CVE-2021-28966 affects Windows only Link: https://security-tracker.debian.org/tracker/CVE-2021-28966 (From OE-Core rev: df6242b72b0477fb61c7dc18ad52a1f147ec7d07) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-04ruby: Upgrade ruby to 2.7.6 for security fixRanjitsinh Rathod
Upgrade ruby to 2.7.6 Link: https://www.ruby-lang.org/en/news/2022/04/12/ruby-2-7-6-released/ This includes CVE-2022-28739 security fix (From OE-Core rev: 4514b1b8cacb92b1790b636b111c071190b2e4b2) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-28oeqa/selftest/cve_check: add tests for recipe and image reportsRoss Burton
Add a test to verify that the JSON reports are generated correctly for both single recipe builds and image builds. More tests are needed, but this is better than nothing. (From OE-Core rev: add860e1a69f848097bbc511137a62d5746e5019) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit df0f35555b09c4bc75470eb45ec9c74e6587d460) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-28mobile-broadband-provider-info: upgrade 20220315 -> 20220511Alexander Kanavin
(From OE-Core rev: 9d5b4fdc7ce0458577af5a16b6d7277e3d812e36) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f14c8094e7a049ac1b04c45b76855d0503559932) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-28pcre2: CVE-2022-1586 Out-of-bounds readHitendra Prajapati
Source: https://github.com/PCRE2Project/pcre2 MR: 118027 Type: Security Fix Disposition: Backport from https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a ChangeID: e9b448d96a7e58b34b2c4069757a6f3ca0917713 Description: CVE-2022-1586: pcre2: Out-of-bounds read in compile_xclass_matchingpath in pcre2_jit_compile.c. (From OE-Core rev: 7f4daf88b71f486ddc7140500d2b44181a99222f) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-24cve-check: Fix report generationMarta Rybczynska
The addition of summary output caused two issues: error when building an image and the fact that JSON output was generated even when CVE_CHECK_FORMAT_JSON. When generating an image it caused an error like: ERROR: core-image-minimal-1.0-r0 do_rootfs: Error executing a python function in exec_func_python() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_func_python() autogenerated', lineno: 2, function: <module> 0001: *** 0002:cve_check_write_rootfs_manifest(d) 0003: File: '/home/alexk/poky/meta/classes/cve-check.bbclass', lineno: 213, function: cve_check_write_rootfs_manifest 0209: 0210: link_path = os.path.join(deploy_dir, "%s.json" % link_name) 0211: manifest_path = d.getVar("CVE_CHECK_MANIFEST_JSON") 0212: bb.note("Generating JSON CVE manifest") *** 0213: generate_json_report(json_summary_name, json_summary_link_name) 0214: bb.plain("Image CVE JSON report stored in: %s" % link_path) 0215:} 0216: 0217:ROOTFS_POSTPROCESS_COMMAND:prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}" Exception: NameError: name 'json_summary_name' is not defined The fix is to pass the d variable to the pure python function generate_json_report to get correct values of variables and add conditions for the JSON output where needed. In addition clarify the message presenting the summary JSON file, which isn't related to an image. Uses partial fixes from Alex Kiernan, Ernst Sjöstrand (ernstp), and Davide Gardenal. Fixes: f2987891d315 ("cve-check: add JSON format to summary output") (From OE-Core rev: 665f981fccbb09d51349c4bd4cfe4ca91001e3bd) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9015dec93233c7d45fd0c9885ff5d4ec23ad377d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-24manuals: add missing space in appendsMichael Opdenacker
(From yocto-docs rev: 447be1d6b8f770171799c2275edb65cbdc0fee2d) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Reported-by: Quentin Schulz <foss@0leil.net> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20selftest: skip virgl test on alma 8.6Steve Sakoman
This test will fail any time the host has libdrm > 2.4.107 (From OE-Core rev: 48ce924dc82aa959fb897ec36873db7dc3813b71) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20linux-firmware: upgrade 20220411 -> 20220509Dmitry Baryshkov
License-Update: additional files (From OE-Core rev: 1ec7c6f0f048482ae902fd15beab5cdfc7b50c7b) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 85b1fef733683be09a1efdb2d8b8ffe543053ace) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20linux-firmware: replace mkdir by installKonrad Weihmann
if a setup is using RPM for packaging and there are multiple recipes that install to ${nonarch_base_libdir}/firmware by using install -d ${nonarch_base_libdir}/firmware, it will create installation clashes on image install, as linux-firmware in before this patch used mkdir -p, which creates different file mode bits (depending on the current user's settings). In a particular example linux-fimware created /lib/firmware with 0600 while other-firmware-package created it with 0644 making the combination not installable by rpm backend (From OE-Core rev: c89bc0fc7f8afdf8ff0e93c3ebd7538987170a0c) Signed-off-by: Konrad Weihmann <kweihmann@outlook.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 98bf3f427702687bf81ed759e7cde5d6d15e77eb) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20openssl: Minor security upgrade 1.1.1n to 1.1.1oRanjitsinh Rathod
This security upgrade fixes CVE-2022-1292 as per below link Link: https://www.openssl.org/news/cl111.txt (From OE-Core rev: de0cafc01804a8d43b4b97e22fdc9a6b0adb8a48) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20git: Use CVE_CHECK_WHITELIST instead of CVE_CHECK_IGNORERanjitsinh Rathod
Use CVE_CHECK_WHITELIST as CVE_CHECK_IGNORE is not valid on dunfell branch (From OE-Core rev: 970743af349e21a399da6241587b849b14933bc5) Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20freetype: Fix CVEs for freetypeRanjitsinh Rathod
Apply below patches to fix the CVEs for freetype: CVE-2022-27404.patch Link: https://gitlab.freedesktop.org/freetype/freetype/-/commit/53dfdcd8198d2b3201a23c4bad9190519ba918db.patch CVE-2022-27405.patch Link: https://gitlab.freedesktop.org/freetype/freetype/-/commit/22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5.patch CVE-2022-27406.patch Link: https://gitlab.freedesktop.org/freetype/freetype/-/commit/0c2bdb01a2e1d24a3e592377a6d0822856e10df2.patch (From OE-Core rev: 51a92860bdbab28a2b487be3b054f103a54b86ac) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20tiff: Add patches to fix multiple CVEsRanjitsinh Rathod
Add patches to fix below CVE issues CVE-2022-0865 CVE-2022-0907 CVE-2022-0908 CVE-2022-0909 CVE-2022-0924 (From OE-Core rev: 7c71434832caf6a15f8fb884d028a8c1bf4090a9) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20curl: Fix CVEs for curlSana Kazi
Fix below listed CVEs: CVE-2022-22576 Link: https://github.com/curl/curl/commit/852aa5ad351ea53e5f01d2f44b5b4370c2bf5425.patch CVE-2022-27775 Link: https://github.com/curl/curl/commit/058f98dc3fe595f21dc26a5b9b1699e519ba5705.patch CVE-2022-27776 Link: https://github.com/curl/curl/commit/6e659993952aa5f90f48864be84a1bbb047fc258.patch (From OE-Core rev: bbbd258a1c56d75ccb7e07ddc3bc1beb11d48a3a) Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20vim: Upgrade 8.2.4681 -> 8.2.4912Richard Purdie
Includes fixes for CVE-2022-1381, CVE-2022-1420. (From OE-Core rev: c7d43000ce137e1f9302b4b6cec149adb1435f47) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 77d745bd49c979de987c75fd7a3af116e99db82b) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-14scripts/git: Ensure we don't have circular referencesRichard Purdie
This is horrible but I'm running out of better ideas. We hit circular reference issues which we were trying to avoid in the core HOSTTOOLS code. When building the eSDK, there can be two copies of the script. Therefore assume git will never be in a directory called scripts. This fixes eSDK build failures. (From OE-Core rev: 0f6ae13d76129d96f788b7ede312cfc361ee2bda) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 27de610ac30d4c81352efc794df7e9b1060f7a68) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-14scripts: Make git intercept globalRichard Purdie
The previous minimially invasive git intercept simply isn't enough. For example, meson used in the igt-gpu-tools recipe hardcodes the path to git in the configure step so at install time, changing PATH has no effect. There are lots of interesting things we could do to try and avoid problems but making the git intercept and dropping fakeroot privs for git global is probably the least worst solution at this point. It will add slight overhead to git calls but we don't make many so the overall impact is likely minimal. (From OE-Core rev: ce6e606ba8b975a33df2f3dc6104abed9cfa7a36) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit af27c81eaf68ee681dcd9456a74cca6a9ab40bf6) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-14base: Avoid circular references to our own scriptsRichard Purdie
We'd like to intercept git calls but we don't want circular references and HOSTTOOLS currently sets them up. Tweak to avoid them. (From OE-Core rev: 1567b7cec5ccbe198bfd0cca9ee8a2b1cf6dbf42) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 52c37e133fa55846aca2248ffcf3a10648dbb8d7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-14rootfs-postcommands: fix symlinks where link and output path are equalDavide Gardenal
When creating the manifest and the testdata.json links, if the link name is equal to the output name the link is not created, otherwise it is. This prevents a link-to-self in the first case. (From OE-Core rev: e3672b5ccd6e0f130b1657017802db130a859d20) Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bed63756c56f296ff3d5a7eef66e978bd19f1008) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-14volatile-binds: Change DefaultDependencies from false to noPortia
The systemd-unit parameter DefaultDependencies changed from true/false to yes/no. This changed in systemd in v242. (From OE-Core rev: 00db62342e67b916213c3b54db23c8090621462f) Signed-off-by: Portia Stephens <stephensportia@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit add4dcb03dc7b034253db05f0023cb97cab8b26d) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 9da23a2b912edd043037a8e2e1047f7f3ba6886a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-14cve-check: fix symlinks where link and output path are equalDavide Gardenal
An if statement now checks if the link and output path are the same, if they are then the link is not created, otherwise it is. (From OE-Core rev: 62965ca8ca7077c12d75dac37efe204d7159cddd) Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 2f024c0236c4806f0e59e4ce51a42f6b80fdf1b3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-14cve-check: add JSON format to summary outputDavide Gardenal
Create generate_json_report including all the code used to generate the JSON manifest file. Add to cve_save_summary_handler the ability to create the summary in JSON format. (From OE-Core rev: d8ef964ffeb92684d01d71c983af9dbb1e1b0c4f) Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit f2987891d315466b7ef180ecce81d15320ce8487) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-14cve-update-db-native: let the user to drive the update intervalMarta Rybczynska
Add a new variable CVE_DB_UPDATE_INTERVAL allowing the user to set the database update interval. - a positive value sets an interval (in seconds) - a zero ("0") forces the database update (From OE-Core rev: ce79a724dc0f9baac480cbadc05894ffcaf48eb7) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit fe7bc6f16184d5ebdb1dd914b6dcb75c9e5e0c9c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-14cve-update-db-native: update the CVE database once a day onlyMarta Rybczynska
The update of the NVD database was expected to happen once per hour. However, the database file date changes only if the content was actually updated. In practice, the check worked for the first hour after the new download. As the NVD database changes usually only once a day, we can just update it less frequently. (From OE-Core rev: d0a56ad3a278e18e766f833619cf97869bdf6a4c) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 35bccdedadeaba820d58b69fe74ce5e4c1f577e3) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 88f2fb1581a17b2cf59a694ca9afb89e38ed40b5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-06-11 20:37:54 +0000