Re: [PATCH 7/9] release-notes: Add CVEs, recipe upgrades and contributors for 5.0

[Michael Opdenacker <michael.opdenacker@bootlin.com>]

Hi Paul

Thanks for this update!

On 4/14/24 at 22:43, Paul Eggleton wrote:
> * Add CVEs from commits
> * Add recipe upgrades using layer index branch comparison
> * Add contributors from commits
>
> Signed-off-by: Paul Eggleton <paul.eggleton@microsoft.com>
> ---
>   .../migration-guides/release-notes-5.0.rst    | 564 +++++++++++++++++-
>   1 file changed, 563 insertions(+), 1 deletion(-)
>
> diff --git a/documentation/migration-guides/release-notes-5.0.rst b/documentation/migration-guides/release-notes-5.0.rst
> index 7767a4229d..21de79a638 100644
> --- a/documentation/migration-guides/release-notes-5.0.rst
> +++ b/documentation/migration-guides/release-notes-5.0.rst
> @@ -264,16 +264,578 @@ The following corrections have been made to the :term:`LICENSE` values set by re
>   Security Fixes in 5.0
>   ~~~~~~~~~~~~~~~~~~~~~
>   
> +-  avahi: :cve:`2023-1981`, :cve:`2023-38469-2`, :cve:`2023-38470-2`, :cve:`2023-38471-2`,

Oops, these last 3 don't work. For example, 
https://nvd.nist.gov/vuln/detail/CVE-2023-38469-2 is invalid.

So, I replaced those with

:cve:`2023-38469`, :cve:`2023-38470`, :cve:`2023-38471`

I hope that's correct, as they still point to Avahi CVEs.


> :cve:`2023-38469`, :cve:`2023-38470`, :cve:`2023-38471`, :cve:`2023-38472`, :cve:`2023-38473`
> +-  bind: :cve:`2023-4408`, :cve:`2023-5517`, :cve:`2023-5679`, :cve:`2023-50387`
> +-  bluez5: :cve:`2023-45866`
> +-  coreutils: :cve:`2024-0684`
> +-  cups: :cve:`2023-4504`
> +-  curl: :cve:`2023-46218`
> +-  expat: :cve:`2024-28757`
> +-  gcc: :cve:`2023-4039`
> +-  glibc: :cve:`2023-5156`, :cve:`2023-0687`
> +-  gnutls: :cve:`2024-0553`, :cve:`2024-0567`, :cve:`2024-28834`, :cve:`2024-28835`
> +-  go: :cve:`2023-45288`
> +-  grub: :cve:`2023-4692`, :cve:`2023-4693`
> +-  grub2: :cve:`2023-4001` (ignored), :cve:`2024-1048` (ignored)
> +-  libgit2: :cve:`2024-24575`, :cve:`2024-24577`
> +-  libsndfile1: :cve:`2022-33065`
> +-  libssh2: :cve:`2023-48795`
> +-  libuv: :cve:`2024-24806`
> +-  libxml2: :cve:`2023-45322` (ignored)
> +-  linux-yocto/6.6: :cve:`2020-16119`
> +-  openssh: :cve:`2023-48795`, :cve:`2023-51384`, :cve:`2023-51385`
> +-  openssl: :cve:`2023-5363`, :cve:`2023-5678`, :cve:`2023-6129`, :cve:`2023-6237`, :cve:`2024-0727`


I had to replace :cve:`2023-6237 by :cve_mitre:`2023-6237` as this was a 
"reserved" CVE.

>   
>   Contributors to 5.0
>   ~~~~~~~~~~~~~~~~~~~
>   
>   Thanks to the following people who contributed to this release:
>   
> +-  Adam Johnston
> +-  Adithya Balakumar
> +-  Adrian Freihofer
> +-  Alassane Yattara
> +-  Alejandro Hernandez Samaniego
> +-  Aleksey Smirnov
> +-  Alexander Kanavin
> +-  Alexander Lussier-Cullen
> +-  Alexander Sverdlin
> +-  Alexandre Belloni
> +-  Alexandre Truong
> +-  Alex Bennée
> +-  Alexis Lothoré
> +-  Alex Kiernan
> +-  Alex Stewart
> +-  André Draszik
> +-  Anibal Limon
> +-  Anuj Mittal
> +-  Archana Polampalli
> +-  Arne Schwerdt
> +-  Bartosz Golaszewski
> +-  Baruch Siach
> +-  baruch@tkos.co.il

Removed that last line as this is the same person :)
Thanks
Michael.

-- 
Michael Opdenacker, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com