Commit Graph

23973 Commits

Author SHA1 Message Date
Gyorgy Sarvari 4f2fdcb503 python3-aspectlib: fix ptests
Backport patch that adapts failing tests.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:09:03 +01:00
Gyorgy Sarvari 53cb1f213c libxml++: fix ptests
The previous version installed the examples as ptests, not the actual tests.

This change compiles the tests on the build machine, install them, and execute
them on the target machine.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:09:01 +01:00
Zhang Peng 4cbf9d8d2c opensc: fix CVE-2023-5992
CVE-2023-5992:
A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not
implemented as side-channel resistant. This issue may result in the potential leak
of private data.

Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2023-5992]
[https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992]

Upstream patches:
[https://github.com/OpenSC/OpenSC/pull/2948]
[https://github.com/OpenSC/OpenSC/pull/3016]

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:09:01 +01:00
Gyorgy Sarvari 01b7c42dfd ostree: fix ptests
1. Fix tests that output colored text but try to verify uncolored text - filter the
   output through "tee" to remove coloring.
2. Add missing dependency
3. Fix a test that fails when C.utf-8 locale is not available on the machine (patch submitted upstream)
4. Enable network connection by setting a nameserver in resolv.conf

While execution is possible, it still requires both ostree and busybox to be compiled statically.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:08:59 +01:00
Gyorgy Sarvari ea936b8f0e poco: fix ptests
1. Add a patch to fix an incorrect and failing test
2. Add missing dependencies and test files
3. Enable network in run-ptest script by adding a nameserver
4. Start mongodb from run-ptest script, if it wouldn't be running.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:08:58 +01:00
Gyorgy Sarvari 491dd81581 mongodb: add tzdata to runtime dependencies
Though tzdata is present in almost all images, some of them are lacking it:
most notably minimal ptest images. mongodb relies on tzdata, otherwise it
doesn't even start up. To ensure that mongodb can be started up
successfully, explicitly add tzdata to its dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:08:54 +01:00
Gyorgy Sarvari 83ab3a8e1d libencode-perl: fix ptests
Add missing dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:35 +01:00
Gyorgy Sarvari 28daa44bd3 libmime-types-perl: fix ptests
Add missing dependency

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:32 +01:00
Gyorgy Sarvari f3deb0dc0a libfile-slurper-perl: fix ptests
Install missing test file.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:30 +01:00
Gyorgy Sarvari f528a1d67c libdbd-sqlite-perl: fix ptests
Install missing files.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:28 +01:00
Gyorgy Sarvari 753b55487e libcrypt-openssl-guess-perl: fix ptests
Add missing dependency.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:24 +01:00
Gyorgy Sarvari 738f8cb93b libconfig-autoconf-perl: fix ptests
Add missing dependencies.

Also, fixing the tests have surfaced an actual bug: the module
expects unversioned perl library to be present on the system
(or at least present in Perl's $Config{libperl}), however the
OE Perl build has a versioned library, which causes final linking
to fail.

A patch to correct this is part of this change, and it has been
submitted upstream also.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:23 +01:00
Gyorgy Sarvari 0fe4ce465e libauthen-sasl-perl: fix ptest
Add missing dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:22 +01:00
Gyorgy Sarvari 69fbdd491a libopenmpt: fix ptests
Install missing test file.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:20 +01:00
Gyorgy Sarvari 8984c822f6 fuse3: fix ptests
Add run-ptest to SRC_URI, and add missing kernel module that's required
for the tests.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:19 +01:00
Gyorgy Sarvari edc8c68ab0 sshfs-fuse: fix ptests
Disable host key checking during tests, so the test can be executed without
human intervention. Also add missing dependency.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:17 +01:00
Gyorgy Sarvari da6b309429 net-snmp: fix ptests
Add missing dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:14 +01:00
Khem Raj 3f4f321d04 openl2tp: Fix ptests
- Detect active network interface to use, instead of asking user, this needs
  to run in automation
- Find the location of ppp_null.so with find instead of rpm, rpm is a distro choice
  it can be assumed to be always there.
- Add missing runtime deps for ptests
- Kill openl2tpd started by run-ptest script before exiting, otherwise
  ptest runner hangs forever.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d30427f475)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 16:59:58 +01:00
Zhang Peng 50c69deb2c frr: fix CVE-2024-31949
CVE-2024-31949:
In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability
as a dynamic capability because malformed data results in a pointer not advancing.

Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-31949]
[https://salsa.debian.org/lts-team/packages/frr/-/blob/debian/7.5.1-1.1+deb10u4/debian/patches/CVE-2024-31949.patch?ref_type=tags]

Upstream patches:
[https://github.com/FRRouting/frr/pull/15640/commits/30a332dad86fafd2b0b6c61d23de59ed969a219b]

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 16:59:21 +01:00
Gyorgy Sarvari d2da8450c0 freediameter: fix run-ptest reporting
Add PASS/FAIL printout at the end of the execution.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 21:13:20 +01:00
Gyorgy Sarvari c71d61037e python3-scapy: fix ptests
1. Enable network access during tests by setting a nameserver
2. Add missing tshark dependency
3. Install missing test files

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 21:13:18 +01:00
Gyorgy Sarvari 13af8f7506 libtest-harness-perl: fix ptests
Add missing dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 21:13:17 +01:00
Gyorgy Sarvari 9b62181e04 libunix-statgrab: fix ptests
Add missing argument to perl in run-ptest script - one of the tests require it.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 21:13:16 +01:00
Gyorgy Sarvari 39c4a8d1f5 libxml-libxml-perl: fix ptests
Add missing dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 21:13:14 +01:00
Gyorgy Sarvari 0d9619b1bc keepalived: patch CVE-2021-44225
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-44225

Pick patch mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:08:19 +01:00
Gyorgy Sarvari 16071ef98f iptraf-ng: patch CVE-2024-52949
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-52949

Pick the commit that mentions the CVE in its description.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:08:19 +01:00
Ninette Adhikari ac6ad965b2 influxdb: Update CVE status for CVE-2019-10329
The version don't match and only the Jenkins plugin is affected.

Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 524acf0542)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE))

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:08:19 +01:00
Peter Marko 6ca1fde08b id3lib: mark CVE-2007-4460 as fixed
This is fixed in id3lib3.8.3_3.8.3-16.2.debian.tar.xz patch included in
SRC_URI.
Version 3.8.3-7 contains patch for this CVE, we use 3.8.3-16.2.
This can be verified by checking the debian/changelog within this patch
or diffing [1] and [2] and verifying that this can be reverse-applied.

[1] https://snapshot.debian.org/archive/debian/20070819T000000Z/pool/main/i/id3lib3.8.3/id3lib3.8.3_3.8.3-6.diff.gz
[2] https://snapshot.debian.org/archive/debian/20070819T000000Z/pool/main/i/id3lib3.8.3/id3lib3.8.3_3.8.3-7.diff.gz

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9fff0040f1)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:08:19 +01:00
Gyorgy Sarvari 12a04da1b8 gattlib: ignore CVE-2019-6498
Details: https://nvd.nist.gov/vuln/detail/CVE-2019-6498

The used revision already contains the fix.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:08:17 +01:00
Alexandre Truong d1b12c6bd1 evince: Update status for CVE-2011-0433 and CVE-2011-5244
The current version 46.0 is not affected by the issues.
Both issues have been fixed in commit [0].
The fix is in effect since early versions of evince (3.1.2).
Thus, both can be safely ignored.

[0]: https://gitlab.gnome.org/GNOME/evince/-/commit/efadec4ffcdde3373f6f4ca0eaac98dc963c4fd5

Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 492b1b1adc)

Reworked for Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:06:55 +01:00
Gyorgy Sarvari ed50ac3ff1 klibc: patch CVE-2021-31873
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-31873

Pick the patch mentioned by the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:06:54 +01:00
Gyorgy Sarvari 23f84ad1b7 klibc: patch CVE-2021-31872
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-31872

Pick the patch mentioned by the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:06:52 +01:00
Gyorgy Sarvari aec3f2b612 klibc: patch CVE-2021-31871
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-31871

Pick the patch mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:06:49 +01:00
Gyorgy Sarvari dab398c7e0 klibc: patch CVE-2021-31870
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-31870

Pick patch mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:06:34 +01:00
Divya Chellam 3c55e66f1f mariadb: fix CVE-2025-30722
Vulnerability in the MySQL Client product of Oracle MySQL (component:
Client: mysqldump). Supported versions that are affected are 8.0.0-8.0.41,
8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows low
privileged attacker with network access via multiple protocols to compromise
MySQL Client. Successful attacks of this vulnerability can result in
unauthorized access to critical data or complete access to all MySQL Client
accessible data as well as unauthorized update, insert or delete access to
some of MySQL Client accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality
and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N).

Reference:
https://security-tracker.debian.org/tracker/CVE-2025-30722

Upstream-patch:
https://github.com/MariaDB/server/commit/6aa860be27480db134a3c71065b9b47d15b72674

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:59 +01:00
Divya Chellam 6306bae883 jq: fix CVE-2025-9403
A vulnerability was determined in jqlang jq up to 1.6. Impacted is the
function run_jq_tests of the file jq_test.c of the component JSON Parser.
Executing manipulation can lead to reachable assertion. The attack
requires local access. The exploit has been publicly disclosed and may be
utilized. Other versions might be affected as well.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-9403

Upstream-patch:
https://github.com/jqlang/jq/commit/a4d9d540103ff9a262e304329c277ec89b27e5f9

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:59 +01:00
Divya Chellam 63bb7a478e mariadb: fix CVE-2025-21490
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).
Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior
and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged
attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to
cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

References:
https://nvd.nist.gov/vuln/detail/CVE-2025-21490
https://security-tracker.debian.org/tracker/CVE-2025-21490

Upstream-patch:
https://github.com/MariaDB/server/commit/82310f926b7c6547f25dd80e4edf3f38b22913e5

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:59 +01:00
Praveen Kumar 9f802bd1a3 cjson: upgrade 1.7.18 -> 1.7.19
This includes CVE-fix for CVE-2023-26819.

Removed CVE-2025-57052, as the issue was already resolved
in v1.7.19.

Changelog:
==========
https://github.com/DaveGamble/cJSON/blob/master/CHANGELOG.md

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:59 +01:00
Gyorgy Sarvari 4384648768 python3-gunicorn: add patch work with geventlet
python3-gunicorn depends on python3-geventlet. geventlet has made some
breaking changes (which is part of meta-oe/kirkstone), however gunicorn
wasn't adapted to this, and it broke some features (at least ptests).

This patch backports the change that adapts gunicorn to the used version
of geventlet.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:53 +01:00
Gyorgy Sarvari 8c59686618 python3-gevent: fix syntax error in cve patch
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:48 +01:00
Gyorgy Sarvari 5c7400ca76 python3-pint: fix ptests
1. Add missing ptest dependency (pytest-subtest)

2. The testsuite is installed in both the site-packages and ${PTEST_PATH}
folders, however some dependencies are only available in the site-packages
folder, so many test cases fail.
At this point of the branch lifecycle I decided not to refactor the recipe, but
rather to just use the installation in the site-packages dir to run the
tests (switch to that folder in the run-ptest script)

3. Fix the run-ptest script to output PASS/FAIL status.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:43 +01:00
Gyorgy Sarvari 1ff49e5d78 python3-requests-toolbelt: disable tests with expired certificate
The application ships with a self signed certificate as part of the test suite.
Unfortunately this certificate has expired in 2021, and since then the tests
refuse to use it, they just fail.

Upstream has fixed this issue by refactoring these tests[1] not to use a vendored
certificate, but rather to use the "python3-trustme" module - however this
is not part of Kirkstone meta-oe, so that patch cannot be used.

Due to this, disable these particular test cases.

[1]: https://github.com/requests/toolbelt/commit/b93b4067ea1ded1e33959920ae5ff4163fdd6939

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:38 +01:00
Gyorgy Sarvari a943a21152 python3-py-cpuinfo: fix ptests
The tests require the library to be present in the folder of test execution,
otherwise many of them fail.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:36 +01:00
Vijay Anusuri d342d283b3 unbound: Fix CVE-2022-3204
Upstream-Status: Backport from https://github.com/NLnetLabs/unbound/commit/137719522a8ea5b380fbb6206d2466f402f5b554

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:35 +01:00
Vijay Anusuri 0bf05b6de8 unbound: Fix for CVE-2022-30698 and CVE-2022-30699
Upstream-Status: Backport from https://github.com/NLnetLabs/unbound/commit/f6753a0f1018133df552347a199e0362fc1dac68

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:35 +01:00
Gyorgy Sarvari 88be6af76b squid: fix esi PACKAGECONFIG
libxml has derecated the "xmlSetFeature" call, and hid is behind a special
config flag (--with-legacy), which is not used by default in oe-core.

This makes compilation fail, when "esi" PACKAGECONFIG is enabled:

Libxml2Parser.cc:94:5: error: 'xmlSetFeature' was not declared in this scope; did you mean 'xmlHasFeature'?

This backported patch fixes this.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:33 +01:00
Gyorgy Sarvari efbc247121 squid: patch CVE-2025-59362
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-59362

Pick the PR content that's referenced in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:30 +01:00
Gyorgy Sarvari bb7620585c squid: patch CVE-2023-46724
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-46724

Pick the patch from the details of the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:28 +01:00
Gyorgy Sarvari 4c30475f5d squid: patch CVE-2022-41318
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-41318

Pick the v4 patch referenced in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:25 +01:00
Gyorgy Sarvari 3183e67999 squid: patch CVE-2022-41317
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-41317

Pick the v4 patch referenced in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:22 +01:00