* [OE-core][kirkstone 0/6] Patch review
@ 2023-04-05 2:29 Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 1/6] go-runtime: Security fix for CVE-2022-41723 Steve Sakoman
` (5 more replies)
0 siblings, 6 replies; 17+ messages in thread
From: Steve Sakoman @ 2023-04-05 2:29 UTC (permalink / raw)
To: openembedded-core
Please review this final set of patches for the kirkstone 4.0.9 release and
have comments back by end of day Thursday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5147
The following changes since commit 3eeab90fd45a1e8de6d9d16dfdec79c72639614b:
rsync: Turn on -pedantic-errors at the end of 'configure' (2023-03-30 08:29:50 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alexander Kanavin (1):
patchelf: replace a rejected patch with an equivalent
uninative.bbclass tweak
Michael Halstead (2):
uninative: Upgrade to 3.8.1 to include libgcc
uninative: Upgrade to 3.9 to include glibc 2.37
Shubham Kulkarni (1):
go-runtime: Security fix for CVE-2022-41723
Simone Weiss (1):
json-c: Add ptest for json-c
pawan (1):
curl: Add fix for CVE-2023-23916
meta/classes/uninative.bbclass | 2 +
.../distro/include/ptest-packagelists.inc | 1 +
meta/conf/distro/include/yocto-uninative.inc | 10 +-
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.18/CVE-2022-41723.patch | 156 +++++++++++++
meta/recipes-devtools/json-c/json-c/run-ptest | 20 ++
meta/recipes-devtools/json-c/json-c_0.15.bb | 16 +-
.../patchelf/handle-read-only-files.patch | 65 ------
.../patchelf/patchelf_0.14.5.bb | 1 -
.../curl/curl/CVE-2023-23916.patch | 219 ++++++++++++++++++
meta/recipes-support/curl/curl_7.82.0.bb | 1 +
11 files changed, 419 insertions(+), 73 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2022-41723.patch
create mode 100644 meta/recipes-devtools/json-c/json-c/run-ptest
delete mode 100644 meta/recipes-devtools/patchelf/patchelf/handle-read-only-files.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23916.patch
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 1/6] go-runtime: Security fix for CVE-2022-41723
2023-04-05 2:29 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
@ 2023-04-05 2:29 ` Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 2/6] curl: Add fix for CVE-2023-23916 Steve Sakoman
` (4 subsequent siblings)
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2023-04-05 2:29 UTC (permalink / raw)
To: openembedded-core
From: Shubham Kulkarni <skulkarni@mvista.com>
Disable cmd/internal/moddeps test, since this update includes PRIVATE
track fixes.
Backport from https://github.com/golang/go/commit/5c3e11bd0b5c0a86e5beffcd4339b86a902b21c3
Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.18/CVE-2022-41723.patch | 156 ++++++++++++++++++
2 files changed, 157 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2022-41723.patch
diff --git a/meta/recipes-devtools/go/go-1.17.13.inc b/meta/recipes-devtools/go/go-1.17.13.inc
index 856c14de40..14d58932dc 100644
--- a/meta/recipes-devtools/go/go-1.17.13.inc
+++ b/meta/recipes-devtools/go/go-1.17.13.inc
@@ -22,6 +22,7 @@ SRC_URI += "\
file://CVE-2022-41717.patch \
file://CVE-2022-2879.patch \
file://CVE-2022-41720.patch \
+ file://CVE-2022-41723.patch \
"
SRC_URI[main.sha256sum] = "a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784ada0cd300fd"
diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2022-41723.patch b/meta/recipes-devtools/go/go-1.18/CVE-2022-41723.patch
new file mode 100644
index 0000000000..a93fa31dcd
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.18/CVE-2022-41723.patch
@@ -0,0 +1,156 @@
+From 451766789f646617157c725e20c955d4a9a70d4e Mon Sep 17 00:00:00 2001
+From: Roland Shoemaker <bracewell@google.com>
+Date: Mon, 6 Feb 2023 10:03:44 -0800
+Subject: [PATCH] net/http: update bundled golang.org/x/net/http2
+
+Disable cmd/internal/moddeps test, since this update includes PRIVATE
+track fixes.
+
+Fixes CVE-2022-41723
+Fixes #58355
+Updates #57855
+
+Change-Id: Ie870562a6f6e44e4e8f57db6a0dde1a41a2b090c
+Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1728939
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-by: Julie Qiu <julieqiu@google.com>
+Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
+Run-TryBot: Roland Shoemaker <bracewell@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/468118
+TryBot-Result: Gopher Robot <gobot@golang.org>
+Run-TryBot: Michael Pratt <mpratt@google.com>
+Auto-Submit: Michael Pratt <mpratt@google.com>
+Reviewed-by: Than McIntosh <thanm@google.com>
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/5c3e11bd0b5c0a86e5beffcd4339b86a902b21c3]
+CVE: CVE-2022-41723
+Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
+---
+ src/vendor/golang.org/x/net/http2/hpack/hpack.go | 79 +++++++++++++++---------
+ 1 file changed, 49 insertions(+), 30 deletions(-)
+
+diff --git a/src/vendor/golang.org/x/net/http2/hpack/hpack.go b/src/vendor/golang.org/x/net/http2/hpack/hpack.go
+index 85f18a2..02e80e3 100644
+--- a/src/vendor/golang.org/x/net/http2/hpack/hpack.go
++++ b/src/vendor/golang.org/x/net/http2/hpack/hpack.go
+@@ -359,6 +359,7 @@ func (d *Decoder) parseFieldLiteral(n uint8, it indexType) error {
+
+ var hf HeaderField
+ wantStr := d.emitEnabled || it.indexed()
++ var undecodedName undecodedString
+ if nameIdx > 0 {
+ ihf, ok := d.at(nameIdx)
+ if !ok {
+@@ -366,15 +367,27 @@ func (d *Decoder) parseFieldLiteral(n uint8, it indexType) error {
+ }
+ hf.Name = ihf.Name
+ } else {
+- hf.Name, buf, err = d.readString(buf, wantStr)
++ undecodedName, buf, err = d.readString(buf)
+ if err != nil {
+ return err
+ }
+ }
+- hf.Value, buf, err = d.readString(buf, wantStr)
++ undecodedValue, buf, err := d.readString(buf)
+ if err != nil {
+ return err
+ }
++ if wantStr {
++ if nameIdx <= 0 {
++ hf.Name, err = d.decodeString(undecodedName)
++ if err != nil {
++ return err
++ }
++ }
++ hf.Value, err = d.decodeString(undecodedValue)
++ if err != nil {
++ return err
++ }
++ }
+ d.buf = buf
+ if it.indexed() {
+ d.dynTab.add(hf)
+@@ -459,46 +472,52 @@ func readVarInt(n byte, p []byte) (i uint64, remain []byte, err error) {
+ return 0, origP, errNeedMore
+ }
+
+-// readString decodes an hpack string from p.
++// readString reads an hpack string from p.
+ //
+-// wantStr is whether s will be used. If false, decompression and
+-// []byte->string garbage are skipped if s will be ignored
+-// anyway. This does mean that huffman decoding errors for non-indexed
+-// strings past the MAX_HEADER_LIST_SIZE are ignored, but the server
+-// is returning an error anyway, and because they're not indexed, the error
+-// won't affect the decoding state.
+-func (d *Decoder) readString(p []byte, wantStr bool) (s string, remain []byte, err error) {
++// It returns a reference to the encoded string data to permit deferring decode costs
++// until after the caller verifies all data is present.
++func (d *Decoder) readString(p []byte) (u undecodedString, remain []byte, err error) {
+ if len(p) == 0 {
+- return "", p, errNeedMore
++ return u, p, errNeedMore
+ }
+ isHuff := p[0]&128 != 0
+ strLen, p, err := readVarInt(7, p)
+ if err != nil {
+- return "", p, err
++ return u, p, err
+ }
+ if d.maxStrLen != 0 && strLen > uint64(d.maxStrLen) {
+- return "", nil, ErrStringLength
++ // Returning an error here means Huffman decoding errors
++ // for non-indexed strings past the maximum string length
++ // are ignored, but the server is returning an error anyway
++ // and because the string is not indexed the error will not
++ // affect the decoding state.
++ return u, nil, ErrStringLength
+ }
+ if uint64(len(p)) < strLen {
+- return "", p, errNeedMore
+- }
+- if !isHuff {
+- if wantStr {
+- s = string(p[:strLen])
+- }
+- return s, p[strLen:], nil
++ return u, p, errNeedMore
+ }
++ u.isHuff = isHuff
++ u.b = p[:strLen]
++ return u, p[strLen:], nil
++}
+
+- if wantStr {
+- buf := bufPool.Get().(*bytes.Buffer)
+- buf.Reset() // don't trust others
+- defer bufPool.Put(buf)
+- if err := huffmanDecode(buf, d.maxStrLen, p[:strLen]); err != nil {
+- buf.Reset()
+- return "", nil, err
+- }
++type undecodedString struct {
++ isHuff bool
++ b []byte
++}
++
++func (d *Decoder) decodeString(u undecodedString) (string, error) {
++ if !u.isHuff {
++ return string(u.b), nil
++ }
++ buf := bufPool.Get().(*bytes.Buffer)
++ buf.Reset() // don't trust others
++ var s string
++ err := huffmanDecode(buf, d.maxStrLen, u.b)
++ if err == nil {
+ s = buf.String()
+- buf.Reset() // be nice to GC
+ }
+- return s, p[strLen:], nil
++ buf.Reset() // be nice to GC
++ bufPool.Put(buf)
++ return s, err
+ }
+--
+2.7.4
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 2/6] curl: Add fix for CVE-2023-23916
2023-04-05 2:29 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 1/6] go-runtime: Security fix for CVE-2022-41723 Steve Sakoman
@ 2023-04-05 2:29 ` Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 3/6] json-c: Add ptest for json-c Steve Sakoman
` (3 subsequent siblings)
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2023-04-05 2:29 UTC (permalink / raw)
To: openembedded-core
From: pawan <badganchipv@gmail.com>
Add below patch to fix CVE-2023-23916
CVE-2023-23916.patch
Link: https://curl.se/docs/CVE-2023-23916.html
Signed-off-by: pawan <badganchipv@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../curl/curl/CVE-2023-23916.patch | 219 ++++++++++++++++++
meta/recipes-support/curl/curl_7.82.0.bb | 1 +
2 files changed, 220 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23916.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2023-23916.patch b/meta/recipes-support/curl/curl/CVE-2023-23916.patch
new file mode 100644
index 0000000000..a57d275902
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2023-23916.patch
@@ -0,0 +1,219 @@
+From 119fb187192a9ea13dc90d9d20c215fc82799ab9 Mon Sep 17 00:00:00 2001
+From: Patrick Monnerat <patrick@monnerat.net>
+Date: Mon, 13 Feb 2023 08:33:09 +0100
+Subject: [PATCH] content_encoding: do not reset stage counter for each header
+
+Test 418 verifies
+
+Closes #10492
+
+CVE: CVE-2023-23916
+Upstream-Status: Backport [https://github.com/curl/curl/commit/119fb187192a9ea13dc.patch]
+Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com>
+---
+ lib/content_encoding.c | 7 +-
+ lib/urldata.h | 1 +
+ tests/data/Makefile.inc | 2 +-
+ tests/data/test387 | 2 +-
+ tests/data/test418 | 152 ++++++++++++++++++++++++++++++++++++++++
+ 5 files changed, 158 insertions(+), 6 deletions(-)
+ create mode 100644 tests/data/test418
+
+--- a/lib/content_encoding.c
++++ b/lib/content_encoding.c
+@@ -1037,7 +1037,6 @@ CURLcode Curl_build_unencoding_stack(str
+ const char *enclist, int maybechunked)
+ {
+ struct SingleRequest *k = &data->req;
+- int counter = 0;
+
+ do {
+ const char *name;
+@@ -1072,9 +1071,9 @@ CURLcode Curl_build_unencoding_stack(str
+ if(!encoding)
+ encoding = &error_encoding; /* Defer error at stack use. */
+
+- if(++counter >= MAX_ENCODE_STACK) {
+- failf(data, "Reject response due to %u content encodings",
+- counter);
++ if(k->writer_stack_depth++ >= MAX_ENCODE_STACK) {
++ failf(data, "Reject response due to more than %u content encodings",
++ MAX_ENCODE_STACK);
+ return CURLE_BAD_CONTENT_ENCODING;
+ }
+ /* Stack the unencoding stage. */
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -682,6 +682,7 @@ struct SingleRequest {
+ struct dohdata *doh; /* DoH specific data for this request */
+ #endif
+ unsigned char setcookies;
++ unsigned char writer_stack_depth; /* Unencoding stack depth. */
+ BIT(header); /* incoming data has HTTP header */
+ BIT(content_range); /* set TRUE if Content-Range: was found */
+ BIT(upload_done); /* set to TRUE when doing chunked transfer-encoding
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -69,6 +69,7 @@
+ \
+ test400 test401 test402 test403 test404 test405 test406 test407 test408 \
+ test409 test410 \
++test418 \
+ \
+ test430 test431 test432 test433 test434 test435 test436 \
+ \
+--- /dev/null
++++ b/tests/data/test418
+@@ -0,0 +1,152 @@
++<testcase>
++<info>
++<keywords>
++HTTP
++gzip
++</keywords>
++</info>
++
++#
++# Server-side
++<reply>
++<data nocheck="yes">
++HTTP/1.1 200 OK
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++Transfer-Encoding: gzip
++
++-foo-
++</data>
++</reply>
++
++#
++# Client-side
++<client>
++<server>
++http
++</server>
++ <name>
++Response with multiple Transfer-Encoding headers
++ </name>
++ <command>
++http://%HOSTIP:%HTTPPORT/%TESTNUMBER -sS
++</command>
++</client>
++
++#
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="yes">
++GET /%TESTNUMBER HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++
++# CURLE_BAD_CONTENT_ENCODING is 61
++<errorcode>
++61
++</errorcode>
++<stderr mode="text">
++curl: (61) Reject response due to more than 5 content encodings
++</stderr>
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl_7.82.0.bb b/meta/recipes-support/curl/curl_7.82.0.bb
index b583060889..945745cdde 100644
--- a/meta/recipes-support/curl/curl_7.82.0.bb
+++ b/meta/recipes-support/curl/curl_7.82.0.bb
@@ -39,6 +39,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2023-23914_5-3.patch \
file://CVE-2023-23914_5-4.patch \
file://CVE-2023-23914_5-5.patch \
+ file://CVE-2023-23916.patch \
"
SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c"
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 3/6] json-c: Add ptest for json-c
2023-04-05 2:29 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 1/6] go-runtime: Security fix for CVE-2022-41723 Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 2/6] curl: Add fix for CVE-2023-23916 Steve Sakoman
@ 2023-04-05 2:29 ` Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 4/6] patchelf: replace a rejected patch with an equivalent uninative.bbclass tweak Steve Sakoman
` (2 subsequent siblings)
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2023-04-05 2:29 UTC (permalink / raw)
To: openembedded-core
From: Simone Weiss <simone.weiss@elektrobit.com>
Adapt json-c recipe to compile and deploy a ptest for json-c.
Also add a small script for executing the tests.
All tests were successful on a trial and took around 20 seconds.
Signed-off-by: Simone Weiß <simone.weiss@elektrobit.com>
Signed-off-by: Kai Tomerius <kai.tomerius@elektrobit.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 757a5fbdeed58573c40d6e21475cc516aa49fd1c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../distro/include/ptest-packagelists.inc | 1 +
meta/recipes-devtools/json-c/json-c/run-ptest | 20 +++++++++++++++++++
meta/recipes-devtools/json-c/json-c_0.15.bb | 16 +++++++++++++--
3 files changed, 35 insertions(+), 2 deletions(-)
create mode 100644 meta/recipes-devtools/json-c/json-c/run-ptest
diff --git a/meta/conf/distro/include/ptest-packagelists.inc b/meta/conf/distro/include/ptest-packagelists.inc
index a65c048984..5bcff83093 100644
--- a/meta/conf/distro/include/ptest-packagelists.inc
+++ b/meta/conf/distro/include/ptest-packagelists.inc
@@ -22,6 +22,7 @@ PTESTS_FAST = "\
gettext-ptest \
glib-networking-ptest \
gzip-ptest \
+ json-c-ptest \
json-glib-ptest \
libconvert-asn1-perl-ptest \
liberror-perl-ptest \
diff --git a/meta/recipes-devtools/json-c/json-c/run-ptest b/meta/recipes-devtools/json-c/json-c/run-ptest
new file mode 100644
index 0000000000..9ee6095ea2
--- /dev/null
+++ b/meta/recipes-devtools/json-c/json-c/run-ptest
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+# This script is used to run json-c test suites
+cd tests
+
+ret_val=0
+for i in test*.test; do
+ # test_basic is not an own testcase, just
+ # contains common code of other tests
+ if [ "$i" != "test_basic.test" ]; then
+ if ./$i > json-c_test.log 2>&1 ; then
+ echo PASS: $i
+ else
+ ret_val=1
+ echo FAIL: $i
+ fi
+ fi
+done
+
+exit $ret_val
diff --git a/meta/recipes-devtools/json-c/json-c_0.15.bb b/meta/recipes-devtools/json-c/json-c_0.15.bb
index a4673a2f0e..7cbed55b3b 100644
--- a/meta/recipes-devtools/json-c/json-c_0.15.bb
+++ b/meta/recipes-devtools/json-c/json-c_0.15.bb
@@ -4,7 +4,10 @@ HOMEPAGE = "https://github.com/json-c/json-c/wiki"
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://COPYING;md5=de54b60fbbc35123ba193fea8ee216f2"
-SRC_URI = "https://s3.amazonaws.com/json-c_releases/releases/${BP}.tar.gz"
+SRC_URI = " \
+ https://s3.amazonaws.com/json-c_releases/releases/${BP}.tar.gz \
+ file://run-ptest \
+"
SRC_URI[sha256sum] = "b8d80a1ddb718b3ba7492916237bbf86609e9709fb007e7f7d4322f02341a4c6"
@@ -13,6 +16,15 @@ UPSTREAM_CHECK_REGEX = "json-c-(?P<pver>\d+(\.\d+)+)-\d+"
RPROVIDES:${PN} = "libjson"
-inherit cmake
+inherit cmake ptest
+
+do_install_ptest() {
+ install -d ${D}/${PTEST_PATH}/tests
+ install ${B}/tests/test* ${D}/${PTEST_PATH}/tests
+ install ${S}/tests/*.test ${D}/${PTEST_PATH}/tests
+ install ${S}/tests/*.expected ${D}/${PTEST_PATH}/tests
+ install ${S}/tests/test-defs.sh ${D}/${PTEST_PATH}/tests
+ install ${S}/tests/valid*json ${D}/${PTEST_PATH}/tests
+}
BBCLASSEXTEND = "native nativesdk"
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 4/6] patchelf: replace a rejected patch with an equivalent uninative.bbclass tweak
2023-04-05 2:29 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
` (2 preceding siblings ...)
2023-04-05 2:29 ` [OE-core][kirkstone 3/6] json-c: Add ptest for json-c Steve Sakoman
@ 2023-04-05 2:29 ` Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 5/6] uninative: Upgrade to 3.8.1 to include libgcc Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 6/6] uninative: Upgrade to 3.9 to include glibc 2.37 Steve Sakoman
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2023-04-05 2:29 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex.kanavin@gmail.com>
This was the original reason to add the patch:
https://git.openembedded.org/openembedded-core/commit/?id=18efcbcb896239c64fedd009ce57f3f0c668cbc0
and this is the upstream discussion which suggests handling
read-only files explicitly outside of patchelf:
https://github.com/NixOS/patchelf/pull/89
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/uninative.bbclass | 2 +
.../patchelf/handle-read-only-files.patch | 65 -------------------
.../patchelf/patchelf_0.14.5.bb | 1 -
3 files changed, 2 insertions(+), 66 deletions(-)
delete mode 100644 meta/recipes-devtools/patchelf/patchelf/handle-read-only-files.patch
diff --git a/meta/classes/uninative.bbclass b/meta/classes/uninative.bbclass
index 6a9e862bcd..7f0591d49a 100644
--- a/meta/classes/uninative.bbclass
+++ b/meta/classes/uninative.bbclass
@@ -167,5 +167,7 @@ python uninative_changeinterp () {
if not elf.isDynamic():
continue
+ os.chmod(f, s[stat.ST_MODE] | stat.S_IWUSR)
subprocess.check_output(("patchelf-uninative", "--set-interpreter", d.getVar("UNINATIVE_LOADER"), f), stderr=subprocess.STDOUT)
+ os.chmod(f, s[stat.ST_MODE])
}
diff --git a/meta/recipes-devtools/patchelf/patchelf/handle-read-only-files.patch b/meta/recipes-devtools/patchelf/patchelf/handle-read-only-files.patch
deleted file mode 100644
index b755a263a4..0000000000
--- a/meta/recipes-devtools/patchelf/patchelf/handle-read-only-files.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 682fb48c137b687477008b68863c2a0b73ed47d1 Mon Sep 17 00:00:00 2001
-From: Fabio Berton <fabio.berton@ossystems.com.br>
-Date: Fri, 9 Sep 2016 16:00:42 -0300
-Subject: [PATCH] handle read-only files
-
-Patch from:
-https://github.com/darealshinji/patchelf/commit/40e66392bc4b96e9b4eda496827d26348a503509
-
-Upstream-Status: Denied [https://github.com/NixOS/patchelf/pull/89]
-
-Signed-off-by: Fabio Berton <fabio.berton@ossystems.com.br>
-
----
- src/patchelf.cc | 16 +++++++++++++++-
- 1 file changed, 15 insertions(+), 1 deletion(-)
-
-Index: git/src/patchelf.cc
-===================================================================
---- git.orig/src/patchelf.cc
-+++ git/src/patchelf.cc
-@@ -534,9 +534,19 @@ void ElfFile<ElfFileParamNames>::sortShd
-
- static void writeFile(const std::string & fileName, const FileContents & contents)
- {
-+ struct stat st;
-+ int fd;
-+
- debug("writing %s\n", fileName.c_str());
-
-- int fd = open(fileName.c_str(), O_CREAT | O_TRUNC | O_WRONLY, 0777);
-+ if (stat(fileName.c_str(), &st) != 0)
-+ error("stat");
-+
-+ if (chmod(fileName.c_str(), 0600) != 0)
-+ error("chmod");
-+
-+ fd = open(fileName.c_str(), O_CREAT | O_TRUNC | O_WRONLY, 0777);
-+
- if (fd == -1)
- error("open");
-
-@@ -551,8 +561,6 @@ static void writeFile(const std::string
- bytesWritten += portion;
- }
-
-- if (close(fd) >= 0)
-- return;
- /*
- * Just ignore EINTR; a retry loop is the wrong thing to do.
- *
-@@ -561,9 +569,11 @@ static void writeFile(const std::string
- * http://utcc.utoronto.ca/~cks/space/blog/unix/CloseEINTR
- * https://sites.google.com/site/michaelsafyan/software-engineering/checkforeintrwheninvokingclosethinkagain
- */
-- if (errno == EINTR)
-- return;
-- error("close");
-+ if ((close(fd) < 0) && errno != EINTR)
-+ error("close");
-+
-+ if (chmod(fileName.c_str(), st.st_mode) != 0)
-+ error("chmod");
- }
-
-
diff --git a/meta/recipes-devtools/patchelf/patchelf_0.14.5.bb b/meta/recipes-devtools/patchelf/patchelf_0.14.5.bb
index 0fa2c00f1d..82c7e807ac 100644
--- a/meta/recipes-devtools/patchelf/patchelf_0.14.5.bb
+++ b/meta/recipes-devtools/patchelf/patchelf_0.14.5.bb
@@ -5,7 +5,6 @@ HOMEPAGE = "https://github.com/NixOS/patchelf"
LICENSE = "GPL-3.0-only"
SRC_URI = "git://github.com/NixOS/patchelf;protocol=https;branch=master \
- file://handle-read-only-files.patch \
"
SRCREV = "a35054504293f9ff64539850d1ed0bfd2f5399f2"
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 5/6] uninative: Upgrade to 3.8.1 to include libgcc
2023-04-05 2:29 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
` (3 preceding siblings ...)
2023-04-05 2:29 ` [OE-core][kirkstone 4/6] patchelf: replace a rejected patch with an equivalent uninative.bbclass tweak Steve Sakoman
@ 2023-04-05 2:29 ` Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 6/6] uninative: Upgrade to 3.9 to include glibc 2.37 Steve Sakoman
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2023-04-05 2:29 UTC (permalink / raw)
To: openembedded-core
From: Michael Halstead <mhalstead@linuxfoundation.org>
Including libgcc solves issues with libpthread.
Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/conf/distro/include/yocto-uninative.inc | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/meta/conf/distro/include/yocto-uninative.inc b/meta/conf/distro/include/yocto-uninative.inc
index 7012db441b..51c0cdee43 100644
--- a/meta/conf/distro/include/yocto-uninative.inc
+++ b/meta/conf/distro/include/yocto-uninative.inc
@@ -7,9 +7,9 @@
#
UNINATIVE_MAXGLIBCVERSION = "2.36"
-UNINATIVE_VERSION = "3.7"
+UNINATIVE_VERSION = "3.8.1"
UNINATIVE_URL ?= "http://downloads.yoctoproject.org/releases/uninative/${UNINATIVE_VERSION}/"
-UNINATIVE_CHECKSUM[aarch64] ?= "6a29bcae4b5b716d2d520e18800b33943b65f8a835eac1ff8793fc5ee65b4be6"
-UNINATIVE_CHECKSUM[i686] ?= "3f6d52e64996570c716108d49f8108baccf499a283bbefae438c7266b7a93305"
-UNINATIVE_CHECKSUM[x86_64] ?= "b110bf2e10fe420f5ca2f3ec55f048ee5f0a54c7e34856a3594e51eb2aea0570"
+UNINATIVE_CHECKSUM[aarch64] ?= "3f15d420049b21854bd7a8843da0f42f17064559492c8b752d7a6f998ff5ea65"
+UNINATIVE_CHECKSUM[i686] ?= "a6dcf316d738ade2e5e463bd3b33a270b4bfc25bba41770ad5cbdc3b0e24044c"
+UNINATIVE_CHECKSUM[x86_64] ?= "5fab9a5c97fc73a21134e5a81f74498cbaecda75d56aab971c934e0b803bcc00"
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 6/6] uninative: Upgrade to 3.9 to include glibc 2.37
2023-04-05 2:29 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
` (4 preceding siblings ...)
2023-04-05 2:29 ` [OE-core][kirkstone 5/6] uninative: Upgrade to 3.8.1 to include libgcc Steve Sakoman
@ 2023-04-05 2:29 ` Steve Sakoman
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2023-04-05 2:29 UTC (permalink / raw)
To: openembedded-core
From: Michael Halstead <mhalstead@linuxfoundation.org>
Update uninative to work with the new glibc 2.37.
Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/conf/distro/include/yocto-uninative.inc | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/meta/conf/distro/include/yocto-uninative.inc b/meta/conf/distro/include/yocto-uninative.inc
index 51c0cdee43..8a5cab5360 100644
--- a/meta/conf/distro/include/yocto-uninative.inc
+++ b/meta/conf/distro/include/yocto-uninative.inc
@@ -6,10 +6,10 @@
# to the distro running on the build machine.
#
-UNINATIVE_MAXGLIBCVERSION = "2.36"
-UNINATIVE_VERSION = "3.8.1"
+UNINATIVE_MAXGLIBCVERSION = "2.37"
+UNINATIVE_VERSION = "3.9"
UNINATIVE_URL ?= "http://downloads.yoctoproject.org/releases/uninative/${UNINATIVE_VERSION}/"
-UNINATIVE_CHECKSUM[aarch64] ?= "3f15d420049b21854bd7a8843da0f42f17064559492c8b752d7a6f998ff5ea65"
-UNINATIVE_CHECKSUM[i686] ?= "a6dcf316d738ade2e5e463bd3b33a270b4bfc25bba41770ad5cbdc3b0e24044c"
-UNINATIVE_CHECKSUM[x86_64] ?= "5fab9a5c97fc73a21134e5a81f74498cbaecda75d56aab971c934e0b803bcc00"
+UNINATIVE_CHECKSUM[aarch64] ?= "de35708c95c34573af140da910132c3291ba4fd26ebf7b74b755ada432cdf07b"
+UNINATIVE_CHECKSUM[i686] ?= "adac07b08adb88eb26fc7fd87fee0cec9d5be167bf7c5ffd3a549a2a6699c29c"
+UNINATIVE_CHECKSUM[x86_64] ?= "3dd82c3fbdb59e87bf091c3eef555a05fae528eeda3083828f76cd4deaceca8b"
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2023-10-21 15:28 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2023-10-21 15:28 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, October 24
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6084
The following changes since commit 5570e49791b770271f176a4deeb5f6f1a028cb4a:
uboot-extlinux-config.bbclass: fix missed override syntax migration (2023-10-17 12:19:37 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Lee Chee Yang (1):
qemu: ignore RHEL specific CVE-2023-2680
Meenali Gupta (1):
linux-firmware: upgrade 20230625 -> 20230804
Peter Marko (1):
zlib: patch CVE-2023-45853
Siddharth Doshi (2):
libx11: Security Fix for CVE-2023-43785, CVE-2023-43786 and
CVE-2023-43787
vim: Upgrade 9.0.2009 -> 9.0.2048
Vijay Anusuri (1):
gawk: backport Debian patch to fix CVE-2023-4156
.../zlib/zlib/CVE-2023-45853.patch | 42 +++++++++++++
meta/recipes-core/zlib/zlib_1.2.11.bb | 1 +
meta/recipes-devtools/qemu/qemu.inc | 4 ++
.../gawk/gawk/CVE-2023-4156.patch | 28 +++++++++
meta/recipes-extended/gawk/gawk_5.1.1.bb | 1 +
.../xorg-lib/libx11/CVE-2023-43785.patch | 62 ++++++++++++++++++
.../xorg-lib/libx11/CVE-2023-43786-0001.patch | 41 ++++++++++++
.../xorg-lib/libx11/CVE-2023-43786-0002.patch | 45 +++++++++++++
.../xorg-lib/libx11/CVE-2023-43786-0003.patch | 51 +++++++++++++++
.../xorg-lib/libx11/CVE-2023-43787.patch | 63 +++++++++++++++++++
.../xorg-lib/libx11_1.7.3.1.bb | 5 ++
...20230625.bb => linux-firmware_20230804.bb} | 4 +-
meta/recipes-support/vim/vim.inc | 4 +-
13 files changed, 347 insertions(+), 4 deletions(-)
create mode 100644 meta/recipes-core/zlib/zlib/CVE-2023-45853.patch
create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43785.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0001.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0002.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0003.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43787.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20230625.bb => linux-firmware_20230804.bb} (99%)
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-01-08 16:14 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-01-08 16:14 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, January 10
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6425
The following changes since commit 227b3d4edad31b0d0045f41133271693265240b0:
tzdata: Upgrade to 2023d (2024-01-02 03:46:18 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Dhairya Nagodra (2):
cve-update-nvd2-native: faster requests with API keys
cve-update-nvd2-native: increase the delay between subsequent request
failures
Dmitry Baryshkov (1):
linux-firmware: upgrade 20230804 -> 20231030
Peter Marko (2):
cve-update-nvd2-native: remove unused variable CVE_SOCKET_TIMEOUT
cve-update-nvd2-native: make number of fetch attemtps configurable
Vijay Anusuri (1):
xserver-xorg: Fix for CVE-2023-6377 and CVE-2023-6478
.../meta/cve-update-nvd2-native.bb | 27 +++++--
.../xserver-xorg/CVE-2023-6377.patch | 79 +++++++++++++++++++
.../xserver-xorg/CVE-2023-6478.patch | 63 +++++++++++++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 2 +
...20230804.bb => linux-firmware_20231030.bb} | 4 +-
5 files changed, 165 insertions(+), 10 deletions(-)
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6377.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6478.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20230804.bb => linux-firmware_20231030.bb} (99%)
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-01-21 18:57 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-01-21 18:57 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, January 23
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6471
The following changes since commit ebd61290a644a6d9f2b3701e0e7ea050636da76c:
pybootchartgui: fix 2 SyntaxWarnings (2024-01-16 04:10:03 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Hitendra Prajapati (2):
openssl: fix CVE-2023-6237 Excessive time spent checking invalid RSA
public keys
pam: fix CVE-2024-22365 pam_namespace misses
Peter Marko (1):
dropbear: backport patch for CVE-2023-48795
Vijay Anusuri (2):
gnutls: Fix for CVE-2024-0553 and CVE-2024-0567
xserver-xorg: Multiple CVE fixes
Yogita Urade (1):
tiff: fix CVE-2023-6228
.../openssl/openssl/CVE-2023-6237.patch | 127 ++++++++++
.../openssl/openssl_3.0.12.bb | 1 +
meta/recipes-core/dropbear/dropbear.inc | 1 +
.../dropbear/dropbear/CVE-2023-48795.patch | 234 ++++++++++++++++++
.../pam/libpam/CVE-2024-22365.patch | 62 +++++
meta/recipes-extended/pam/libpam_1.5.2.bb | 1 +
.../xserver-xorg/CVE-2023-6816.patch | 55 ++++
.../xserver-xorg/CVE-2024-0229-1.patch | 87 +++++++
.../xserver-xorg/CVE-2024-0229-2.patch | 221 +++++++++++++++++
.../xserver-xorg/CVE-2024-0229-3.patch | 41 +++
.../xserver-xorg/CVE-2024-0229-4.patch | 45 ++++
.../xserver-xorg/CVE-2024-0408.patch | 64 +++++
.../xserver-xorg/CVE-2024-0409.patch | 46 ++++
.../xserver-xorg/CVE-2024-21885.patch | 113 +++++++++
.../xserver-xorg/CVE-2024-21886-1.patch | 74 ++++++
.../xserver-xorg/CVE-2024-21886-2.patch | 57 +++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 10 +
.../libtiff/tiff/CVE-2023-6228.patch | 31 +++
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 1 +
.../gnutls/gnutls/CVE-2024-0553.patch | 125 ++++++++++
.../gnutls/gnutls/CVE-2024-0567.patch | 184 ++++++++++++++
meta/recipes-support/gnutls/gnutls_3.7.4.bb | 2 +
22 files changed, 1582 insertions(+)
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-6237.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2023-48795.patch
create mode 100644 meta/recipes-extended/pam/libpam/CVE-2024-22365.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6816.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-1.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-2.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-3.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-4.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0408.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0409.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21885.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21886-1.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21886-2.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2023-6228.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2024-0553.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2024-0567.patch
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-05-13 12:18 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-05-13 12:18 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, May 17
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6895
The following changes since commit 24fd9b6756728a0337100f53a1c6e92aba092f9d:
ppp: Add RSA-MD in LICENSE (2024-05-08 05:19:26 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Archana Polampalli (2):
xserver-xorg: fix CVE-2024-31082
xserver-xorg: fix CVE-2024-31083
Bhabu Bindu (1):
libpciaccess: Remove duplicated license entry
Peter Marko (1):
glibc: Update to latest on stable 2.35 branch
Vijay Anusuri (2):
bluez5: Fix CVE-2023-27349 CVE-2023-50229 & CVE-2023-50230
gstreamer1.0-plugins-bad: fix CVE-2023-50186
meta/recipes-connectivity/bluez5/bluez5.inc | 2 +
.../bluez5/bluez5/CVE-2023-27349.patch | 48 +++++++
.../CVE-2023-50229_CVE-2023-50230.patch | 67 ++++++++++
meta/recipes-core/glibc/glibc-version.inc | 2 +-
...y-the-header-between-arm-and-aarch64.patch | 64 +++++-----
meta/recipes-core/glibc/glibc_2.35.bb | 5 +-
.../xorg-lib/libpciaccess_0.16.bb | 2 +-
.../xserver-xorg/CVE-2024-31082.patch | 52 ++++++++
.../xserver-xorg/CVE-2024-31083-0001.patch | 117 ++++++++++++++++++
.../xserver-xorg/CVE-2024-31083-0002.patch | 76 ++++++++++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 3 +
.../CVE-2023-50186.patch | 70 +++++++++++
.../gstreamer1.0-plugins-bad_1.20.7.bb | 1 +
13 files changed, 478 insertions(+), 31 deletions(-)
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/CVE-2023-27349.patch
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/CVE-2023-50229_CVE-2023-50230.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31082.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31083-0001.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31083-0002.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-50186.patch
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-07-20 12:42 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-07-20 12:42 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, July 23
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7158
The following changes since commit 5d97b0576e98a2cf402abab1a1edcab223545d87:
build-appliance-image: Update to kirkstone head revision (2024-07-15 10:31:11 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Ashish Sharma (1):
ruby: backport fix for CVE-2024-27282
Florian Amstutz (1):
uboot-sign: Fix index error in concat_dtb_helper() with multiple
configs
Hitendra Prajapati (1):
busybox: Fix CVE-2023-42363
Peter Marko (2):
busybox: Patch CVE-2021-42380
libarchive: ignore CVE-2024-37407
Vijay Anusuri (1):
python3-jinja2: Upgrade 3.1.3 -> 3.1.4
meta/classes/uboot-sign.bbclass | 6 +-
.../busybox/busybox/CVE-2021-42380.patch | 151 ++++++++++++++++++
.../busybox/busybox/CVE-2023-42363.patch | 68 ++++++++
meta/recipes-core/busybox/busybox_1.35.0.bb | 2 +
...inja2_3.1.3.bb => python3-jinja2_3.1.4.bb} | 8 +-
.../ruby/ruby/CVE-2024-27282.patch | 29 ++++
meta/recipes-devtools/ruby/ruby_3.1.3.bb | 1 +
.../libarchive/libarchive_3.6.2.bb | 2 +
8 files changed, 261 insertions(+), 6 deletions(-)
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2021-42380.patch
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2023-42363.patch
rename meta/recipes-devtools/python/{python3-jinja2_3.1.3.bb => python3-jinja2_3.1.4.bb} (82%)
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-27282.patch
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-08-25 18:49 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-08-25 18:49 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, August 27
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7272
The following changes since commit 6c1000a2bbfe5e618e42bc5be2058332337d4177:
python3-pycryptodome(x): use python_setuptools_build_meta build class (2024-08-15 05:58:11 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Guocai He (1):
libsoup: fix compile error on centos7
Leon Anavi (1):
python3: add PACKAGECONFIG[editline]
Niko Mauno (1):
image_types.bbclass: Use --force also with lz4,lzop
Peter Marko (1):
libyaml: ignore CVE-2024-35326
Siddharth Doshi (2):
Tiff: Security fix for CVE-2024-7006
curl: Security fix for CVE-2024-7264
meta/classes/image_types.bbclass | 4 +-
.../python/python3_3.10.14.bb | 5 +-
.../libtiff/tiff/CVE-2024-7006.patch | 64 ++++
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 1 +
.../curl/curl/CVE-2024-7264_1.patch | 66 ++++
.../curl/curl/CVE-2024-7264_2.patch | 320 ++++++++++++++++++
meta/recipes-support/curl/curl_7.82.0.bb | 2 +
.../0001-meson.build-set-c_std-to-gnu99.patch | 44 +++
.../libsoup/libsoup-2.4_2.74.2.bb | 4 +-
meta/recipes-support/libyaml/libyaml_0.2.5.bb | 2 +-
10 files changed, 506 insertions(+), 6 deletions(-)
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2024-7006.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-7264_1.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-7264_2.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/0001-meson.build-set-c_std-to-gnu99.patch
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-09-05 12:40 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-09-05 12:40 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Friday, September 6
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7310
The following changes since commit 6992437d725f9cc88da4261814b69aaadc5ef0f2:
grub: fs/fat: Don't error when mtime is 0 (2024-08-29 06:13:56 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Hitendra Prajapati (1):
qemu: fix CVE-2024-7409
Rohini Sangam (1):
python3: Security fix for CVE-2024-8088
Vijay Anusuri (1):
apr: upgrade 1.7.2 -> 1.7.5
Vrushti Dabhi (2):
sqlite3: CVE-ID correction for CVE-2023-7104
sqlite3: Rename patch for CVE-2022-35737
Wang Mingyu (1):
wireless-regdb: upgrade 2024.05.08 -> 2024.07.04
.../python/python3/CVE-2024-8088.patch | 124 +++++++++++++
.../python/python3_3.10.14.bb | 1 +
meta/recipes-devtools/qemu/qemu.inc | 4 +
.../qemu/qemu/CVE-2024-7409-0001.patch | 162 ++++++++++++++++
.../qemu/qemu/CVE-2024-7409-0002.patch | 174 ++++++++++++++++++
.../qemu/qemu/CVE-2024-7409-0003.patch | 122 ++++++++++++
.../qemu/qemu/CVE-2024-7409-0004.patch | 163 ++++++++++++++++
....05.08.bb => wireless-regdb_2024.07.04.bb} | 2 +-
...-runtime-test-for-mmap-that-can-map-.patch | 2 +-
.../apr/{apr_1.7.2.bb => apr_1.7.5.bb} | 2 +-
...lementation.patch => CVE-2022-35737.patch} | 0
.../sqlite/files/CVE-2023-7104.patch | 10 +-
meta/recipes-support/sqlite/sqlite3_3.38.5.bb | 4 +-
13 files changed, 761 insertions(+), 9 deletions(-)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2024-8088.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-7409-0001.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-7409-0002.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-7409-0003.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-7409-0004.patch
rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2024.05.08.bb => wireless-regdb_2024.07.04.bb} (94%)
rename meta/recipes-support/apr/{apr_1.7.2.bb => apr_1.7.5.bb} (98%)
rename meta/recipes-support/sqlite/files/{0001-sqlite-Increased-the-size-of-loop-variables-in-the-printf-implementation.patch => CVE-2022-35737.patch} (100%)
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2025-03-10 13:36 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-10 13:36 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, March 12
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1152
The following changes since commit 0d9f2fcc2058407eb138297d9f8f12595851b963:
mesa: Fix missing GLES3 headers in SDK sysroot (2025-03-04 08:43:39 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alessio Cascone (1):
tzcode-native: Fix compiler setting from 2023d version
Deepesh Varatharajan (1):
binutils: Fix CVE-2025-0840
Hitendra Prajapati (1):
ruby: Fix CVE-2025-27220
Priyal Doshi (1):
tzdata/tzcode-native: upgrade 2024b -> 2025a
Vijay Anusuri (2):
openssh: Fix CVE-2025-26465
libtasn1: upgrade 4.19.0 -> 4.20.0
.../openssh/openssh/CVE-2025-26465.patch | 140 ++++++++++++++++++
.../openssh/openssh_8.9p1.bb | 1 +
.../binutils/binutils-2.38.inc | 1 +
.../binutils/0038-CVE-2025-0840.patch | 53 +++++++
.../ruby/ruby/CVE-2025-27220.patch | 76 ++++++++++
meta/recipes-devtools/ruby/ruby_3.1.3.bb | 1 +
meta/recipes-extended/timezone/timezone.inc | 6 +-
.../timezone/tzcode-native.bb | 2 +-
...{libtasn1_4.19.0.bb => libtasn1_4.20.0.bb} | 7 +-
9 files changed, 279 insertions(+), 8 deletions(-)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2025-26465.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0038-CVE-2025-0840.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2025-27220.patch
rename meta/recipes-support/gnutls/{libtasn1_4.19.0.bb => libtasn1_4.20.0.bb} (63%)
--
2.43.0
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2025-03-24 19:36 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-24 19:36 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, March 26
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1242
The following changes since commit acb88b244e89bc1300a24f60d0a44c21e0ab1af6:
vim: Upgrade 9.1.1043 -> 9.1.1115 (2025-03-13 09:19:58 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Peter Marko (1):
tiff: mark CVE-2023-30774 as patched
Robert Yang (1):
libxcrypt-compat: Remove libcrypt.so to fix conflict with libcrypt
Vijay Anusuri (2):
libxslt: Fix for CVE-2024-55549
libxslt: Fix for CVE-2025-24855
Yogita Urade (2):
xserver-xorg: fix CVE-2022-49737
xwayland: fix CVE-2022-49737
.../libxcrypt/libxcrypt-compat_4.4.33.bb | 2 +-
.../xserver-xorg/CVE-2022-49737.patch | 90 ++++++++++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 1 +
.../xwayland/xwayland/CVE-2022-49737.patch | 90 ++++++++++++
.../xwayland/xwayland_22.1.8.bb | 1 +
...-of-TIFFTAG_INKNAMES-and-related-TIF.patch | 4 +-
.../libxslt/libxslt/CVE-2024-55549.patch | 49 +++++++
.../libxslt/libxslt/CVE-2025-24855.patch | 134 ++++++++++++++++++
.../recipes-support/libxslt/libxslt_1.1.35.bb | 5 +-
9 files changed, 373 insertions(+), 3 deletions(-)
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-49737.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2022-49737.patch
create mode 100644 meta/recipes-support/libxslt/libxslt/CVE-2024-55549.patch
create mode 100644 meta/recipes-support/libxslt/libxslt/CVE-2025-24855.patch
--
2.43.0
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2025-05-09 16:16 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-05-09 16:16 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, May 13
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1554
The following changes since commit 25ba9895b98715adb66a06e50f644aea2e2c9eb6:
Revert "cve-update-nvd2-native: Tweak to work better with NFS DL_DIR" (2025-04-29 07:45:33 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Haixiao Yan (1):
glibc: Add single-threaded fast path to rand()
Hitendra Prajapati (1):
busybox: fix CVE-2023-39810
Peter Marko (3):
ghostscript: ignore CVE-2025-27837
ghostscript: ignore CVE-2024-29507
qemu: ignore CVE-2023-1386
Praveen Kumar (1):
connman :fix CVE-2025-32743
.../connman/connman/CVE-2025-32743.patch | 43 ++++++
.../connman/connman_1.41.bb | 1 +
.../busybox/busybox/CVE-2023-39810.patch | 131 ++++++++++++++++++
meta/recipes-core/busybox/busybox_1.35.0.bb | 1 +
...dd-single-threaded-fast-path-to-rand.patch | 47 +++++++
meta/recipes-core/glibc/glibc_2.35.bb | 1 +
meta/recipes-devtools/qemu/qemu.inc | 3 +
.../ghostscript/ghostscript_9.55.0.bb | 4 +-
8 files changed, 230 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2025-32743.patch
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2023-39810.patch
create mode 100644 meta/recipes-core/glibc/glibc/0001-stdlib-Add-single-threaded-fast-path-to-rand.patch
--
2.43.0
^ permalink raw reply [flat|nested] 17+ messages in thread
end of thread, other threads:[~2025-05-09 16:17 UTC | newest]
Thread overview: 17+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-04-05 2:29 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 1/6] go-runtime: Security fix for CVE-2022-41723 Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 2/6] curl: Add fix for CVE-2023-23916 Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 3/6] json-c: Add ptest for json-c Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 4/6] patchelf: replace a rejected patch with an equivalent uninative.bbclass tweak Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 5/6] uninative: Upgrade to 3.8.1 to include libgcc Steve Sakoman
2023-04-05 2:29 ` [OE-core][kirkstone 6/6] uninative: Upgrade to 3.9 to include glibc 2.37 Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2023-10-21 15:28 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
2024-01-08 16:14 Steve Sakoman
2024-01-21 18:57 Steve Sakoman
2024-05-13 12:18 Steve Sakoman
2024-07-20 12:42 Steve Sakoman
2024-08-25 18:49 Steve Sakoman
2024-09-05 12:40 Steve Sakoman
2025-03-10 13:36 Steve Sakoman
2025-03-24 19:36 Steve Sakoman
2025-05-09 16:16 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox