Commit Graph

24083 Commits

Author SHA1 Message Date
Gyorgy Sarvari b0d98aae8c gimp: patch CVE-2022-32990
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-32990

Pick the patches that resolved the issue mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-07 11:37:29 +01:00
Gyorgy Sarvari 62db80942f gimp: patch CVE-2022-30067
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-30067

Pick patch that resolved the issue mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-07 11:37:08 +01:00
Gyorgy Sarvari 4cf6b7140f inotify-tools: add PASS/FAIL status to run-ptest script
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-07 11:36:42 +01:00
Nikhil R c3c873d0dc inotify-tools: add ptest support for inotify-tools
Add ptest support for inotify-tools by introducing a run-ptest script.
The ptest verifies the correct functioning of inotify event handling
and related utilities.

Test coverage includes:
 - File creation, modification, and deletion event monitoring
 - Event handling and command-line option parsing
 - Basic consistency and behavior of inotify event queues

The ptest completes in under 20 seconds

output:
root@qemux86-64:~# ptest-runner inotify-tools
START: ptest-runner
BEGIN: /usr/lib/inotify-tools/ptest
If you want to do a malloc trace, set MALLOC_TRACE to a path for logging.
event_to_str: test begin
event_to_str: test end
event_to_str_sep: test begin
event_to_str_sep: test end
str_to_event: test begin
str_to_event: test end
str_to_event_sep: test begin
str_to_event_sep: test end
basic_watch_info: test begin
basic_watch_info: test end
watch_limit: test begin
watch_limit: Warning, this test may take a while
watch_limit: test end
tst_inotifytools_snprintf: test begin
tst_inotifytools_snprintf: test end
Out of 362746 tests, 362746 succeeded and 0 failed.
All tests passed successfully.
DURATION: 16
END: /usr/lib/inotify-tools/ptest
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Verified that enabling ptest does not modify existing package contents
for inotify-tools

Signed-off-by: Nikhil R <nikhil.r@bmwtechworks.in>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-05 16:46:21 +01:00
Peter Marko 03cca3a147 hostapd: patch CVE-2022-37660
Pick patches according to oe-core patch for this CVE in wpa-supplicant.
Leave out commit which patched only files not present in hostapd.

Note that Debian just picked the last commit (actually fixing the CVE)
and removed not-applicable parts, but it is probably better to be
consistent with oe-core status.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-05 16:45:19 +01:00
Yi Zhao edccf97374 mbedtls: upgrade 2.28.9 -> 2.28.10
ChangeLog
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.10

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ca08c74223)
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-05 16:42:50 +01:00
Chen Qi f9577ae033 frr: add CVE_PRODUCT
The CVE_PRODUCT is frrouting in NVD database.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 10c7793832)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-03 16:35:26 +01:00
Gyorgy Sarvari 2c5e52a9d6 gimp: ignore CVE-2007-3741
It has been fixed in version 2.2.16: [1] references [2].

[1]: https://bugzilla.redhat.com/show_bug.cgi?id=248053
[2]: https://bugzilla.gnome.org/show_bug.cgi?id=453973

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 16:52:19 +01:00
Peter Marko 3ee7d08d9e hostapd: patch CVE-2025-24912
Pick patches as listed in NVD CVE report.

Note that Debian lists one of the patches as introducing the
vulnerability. This is against what the original report [1] says.
Also the commit messages provide hints that the first patch fixes this
issue and second is fixing problem with the first patch.

[1] https://jvn.jp/en/jp/JVN19358384/

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:09:10 +01:00
Gyorgy Sarvari 1230d56e01 libnet-dns-perl: fix ptests
Enable network connection to get a test unstuck that was trying to access the network.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:09:08 +01:00
Gyorgy Sarvari 4f2fdcb503 python3-aspectlib: fix ptests
Backport patch that adapts failing tests.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:09:03 +01:00
Gyorgy Sarvari 53cb1f213c libxml++: fix ptests
The previous version installed the examples as ptests, not the actual tests.

This change compiles the tests on the build machine, install them, and execute
them on the target machine.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:09:01 +01:00
Zhang Peng 4cbf9d8d2c opensc: fix CVE-2023-5992
CVE-2023-5992:
A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not
implemented as side-channel resistant. This issue may result in the potential leak
of private data.

Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2023-5992]
[https://github.com/OpenSC/OpenSC/wiki/CVE-2023-5992]

Upstream patches:
[https://github.com/OpenSC/OpenSC/pull/2948]
[https://github.com/OpenSC/OpenSC/pull/3016]

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:09:01 +01:00
Gyorgy Sarvari 01b7c42dfd ostree: fix ptests
1. Fix tests that output colored text but try to verify uncolored text - filter the
   output through "tee" to remove coloring.
2. Add missing dependency
3. Fix a test that fails when C.utf-8 locale is not available on the machine (patch submitted upstream)
4. Enable network connection by setting a nameserver in resolv.conf

While execution is possible, it still requires both ostree and busybox to be compiled statically.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:08:59 +01:00
Gyorgy Sarvari ea936b8f0e poco: fix ptests
1. Add a patch to fix an incorrect and failing test
2. Add missing dependencies and test files
3. Enable network in run-ptest script by adding a nameserver
4. Start mongodb from run-ptest script, if it wouldn't be running.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:08:58 +01:00
Gyorgy Sarvari 491dd81581 mongodb: add tzdata to runtime dependencies
Though tzdata is present in almost all images, some of them are lacking it:
most notably minimal ptest images. mongodb relies on tzdata, otherwise it
doesn't even start up. To ensure that mongodb can be started up
successfully, explicitly add tzdata to its dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-02 15:08:54 +01:00
Gyorgy Sarvari 83ab3a8e1d libencode-perl: fix ptests
Add missing dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:35 +01:00
Gyorgy Sarvari 28daa44bd3 libmime-types-perl: fix ptests
Add missing dependency

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:32 +01:00
Gyorgy Sarvari f3deb0dc0a libfile-slurper-perl: fix ptests
Install missing test file.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:30 +01:00
Gyorgy Sarvari f528a1d67c libdbd-sqlite-perl: fix ptests
Install missing files.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:28 +01:00
Gyorgy Sarvari 753b55487e libcrypt-openssl-guess-perl: fix ptests
Add missing dependency.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:24 +01:00
Gyorgy Sarvari 738f8cb93b libconfig-autoconf-perl: fix ptests
Add missing dependencies.

Also, fixing the tests have surfaced an actual bug: the module
expects unversioned perl library to be present on the system
(or at least present in Perl's $Config{libperl}), however the
OE Perl build has a versioned library, which causes final linking
to fail.

A patch to correct this is part of this change, and it has been
submitted upstream also.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:23 +01:00
Gyorgy Sarvari 0fe4ce465e libauthen-sasl-perl: fix ptest
Add missing dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:22 +01:00
Gyorgy Sarvari 69fbdd491a libopenmpt: fix ptests
Install missing test file.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:20 +01:00
Gyorgy Sarvari 8984c822f6 fuse3: fix ptests
Add run-ptest to SRC_URI, and add missing kernel module that's required
for the tests.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:19 +01:00
Gyorgy Sarvari edc8c68ab0 sshfs-fuse: fix ptests
Disable host key checking during tests, so the test can be executed without
human intervention. Also add missing dependency.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:17 +01:00
Gyorgy Sarvari da6b309429 net-snmp: fix ptests
Add missing dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 17:05:14 +01:00
Khem Raj 3f4f321d04 openl2tp: Fix ptests
- Detect active network interface to use, instead of asking user, this needs
  to run in automation
- Find the location of ppp_null.so with find instead of rpm, rpm is a distro choice
  it can be assumed to be always there.
- Add missing runtime deps for ptests
- Kill openl2tpd started by run-ptest script before exiting, otherwise
  ptest runner hangs forever.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d30427f475)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 16:59:58 +01:00
Zhang Peng 50c69deb2c frr: fix CVE-2024-31949
CVE-2024-31949:
In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability
as a dynamic capability because malformed data results in a pointer not advancing.

Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-31949]
[https://salsa.debian.org/lts-team/packages/frr/-/blob/debian/7.5.1-1.1+deb10u4/debian/patches/CVE-2024-31949.patch?ref_type=tags]

Upstream patches:
[https://github.com/FRRouting/frr/pull/15640/commits/30a332dad86fafd2b0b6c61d23de59ed969a219b]

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-29 16:59:21 +01:00
Gyorgy Sarvari d2da8450c0 freediameter: fix run-ptest reporting
Add PASS/FAIL printout at the end of the execution.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 21:13:20 +01:00
Gyorgy Sarvari c71d61037e python3-scapy: fix ptests
1. Enable network access during tests by setting a nameserver
2. Add missing tshark dependency
3. Install missing test files

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 21:13:18 +01:00
Gyorgy Sarvari 13af8f7506 libtest-harness-perl: fix ptests
Add missing dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 21:13:17 +01:00
Gyorgy Sarvari 9b62181e04 libunix-statgrab: fix ptests
Add missing argument to perl in run-ptest script - one of the tests require it.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 21:13:16 +01:00
Gyorgy Sarvari 39c4a8d1f5 libxml-libxml-perl: fix ptests
Add missing dependencies.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 21:13:14 +01:00
Gyorgy Sarvari 0d9619b1bc keepalived: patch CVE-2021-44225
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-44225

Pick patch mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:08:19 +01:00
Gyorgy Sarvari 16071ef98f iptraf-ng: patch CVE-2024-52949
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-52949

Pick the commit that mentions the CVE in its description.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:08:19 +01:00
Ninette Adhikari ac6ad965b2 influxdb: Update CVE status for CVE-2019-10329
The version don't match and only the Jenkins plugin is affected.

Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 524acf0542)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE))

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:08:19 +01:00
Peter Marko 6ca1fde08b id3lib: mark CVE-2007-4460 as fixed
This is fixed in id3lib3.8.3_3.8.3-16.2.debian.tar.xz patch included in
SRC_URI.
Version 3.8.3-7 contains patch for this CVE, we use 3.8.3-16.2.
This can be verified by checking the debian/changelog within this patch
or diffing [1] and [2] and verifying that this can be reverse-applied.

[1] https://snapshot.debian.org/archive/debian/20070819T000000Z/pool/main/i/id3lib3.8.3/id3lib3.8.3_3.8.3-6.diff.gz
[2] https://snapshot.debian.org/archive/debian/20070819T000000Z/pool/main/i/id3lib3.8.3/id3lib3.8.3_3.8.3-7.diff.gz

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9fff0040f1)

Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:08:19 +01:00
Gyorgy Sarvari 12a04da1b8 gattlib: ignore CVE-2019-6498
Details: https://nvd.nist.gov/vuln/detail/CVE-2019-6498

The used revision already contains the fix.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:08:17 +01:00
Alexandre Truong d1b12c6bd1 evince: Update status for CVE-2011-0433 and CVE-2011-5244
The current version 46.0 is not affected by the issues.
Both issues have been fixed in commit [0].
The fix is in effect since early versions of evince (3.1.2).
Thus, both can be safely ignored.

[0]: https://gitlab.gnome.org/GNOME/evince/-/commit/efadec4ffcdde3373f6f4ca0eaac98dc963c4fd5

Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 492b1b1adc)

Reworked for Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:06:55 +01:00
Gyorgy Sarvari ed50ac3ff1 klibc: patch CVE-2021-31873
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-31873

Pick the patch mentioned by the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:06:54 +01:00
Gyorgy Sarvari 23f84ad1b7 klibc: patch CVE-2021-31872
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-31872

Pick the patch mentioned by the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:06:52 +01:00
Gyorgy Sarvari aec3f2b612 klibc: patch CVE-2021-31871
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-31871

Pick the patch mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:06:49 +01:00
Gyorgy Sarvari dab398c7e0 klibc: patch CVE-2021-31870
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-31870

Pick patch mentioned in the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 18:06:34 +01:00
Divya Chellam 3c55e66f1f mariadb: fix CVE-2025-30722
Vulnerability in the MySQL Client product of Oracle MySQL (component:
Client: mysqldump). Supported versions that are affected are 8.0.0-8.0.41,
8.4.0-8.4.4 and 9.0.0-9.2.0. Difficult to exploit vulnerability allows low
privileged attacker with network access via multiple protocols to compromise
MySQL Client. Successful attacks of this vulnerability can result in
unauthorized access to critical data or complete access to all MySQL Client
accessible data as well as unauthorized update, insert or delete access to
some of MySQL Client accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality
and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N).

Reference:
https://security-tracker.debian.org/tracker/CVE-2025-30722

Upstream-patch:
https://github.com/MariaDB/server/commit/6aa860be27480db134a3c71065b9b47d15b72674

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:59 +01:00
Divya Chellam 6306bae883 jq: fix CVE-2025-9403
A vulnerability was determined in jqlang jq up to 1.6. Impacted is the
function run_jq_tests of the file jq_test.c of the component JSON Parser.
Executing manipulation can lead to reachable assertion. The attack
requires local access. The exploit has been publicly disclosed and may be
utilized. Other versions might be affected as well.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-9403

Upstream-patch:
https://github.com/jqlang/jq/commit/a4d9d540103ff9a262e304329c277ec89b27e5f9

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:59 +01:00
Divya Chellam 63bb7a478e mariadb: fix CVE-2025-21490
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).
Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior
and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged
attacker with network access via multiple protocols to compromise MySQL Server.
Successful attacks of this vulnerability can result in unauthorized ability to
cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector:
(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

References:
https://nvd.nist.gov/vuln/detail/CVE-2025-21490
https://security-tracker.debian.org/tracker/CVE-2025-21490

Upstream-patch:
https://github.com/MariaDB/server/commit/82310f926b7c6547f25dd80e4edf3f38b22913e5

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:59 +01:00
Praveen Kumar 9f802bd1a3 cjson: upgrade 1.7.18 -> 1.7.19
This includes CVE-fix for CVE-2023-26819.

Removed CVE-2025-57052, as the issue was already resolved
in v1.7.19.

Changelog:
==========
https://github.com/DaveGamble/cJSON/blob/master/CHANGELOG.md

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:59 +01:00
Gyorgy Sarvari 4384648768 python3-gunicorn: add patch work with geventlet
python3-gunicorn depends on python3-geventlet. geventlet has made some
breaking changes (which is part of meta-oe/kirkstone), however gunicorn
wasn't adapted to this, and it broke some features (at least ptests).

This patch backports the change that adapts gunicorn to the used version
of geventlet.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:53 +01:00
Gyorgy Sarvari 8c59686618 python3-gevent: fix syntax error in cve patch
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-10-27 11:17:48 +01:00