Commit Graph

19830 Commits

Author SHA1 Message Date
Mingli Yu 6905274d2f libteam: switch to python3
The original fix for team_basic_test.py only change the interpreter
to python3, but still some error as below:
 # ./run-ptest
 File "/usr/lib64/libteam/ptest/./team_basic_test.py", line 35
 print "Usage: team_basic_test.py [OPTION...]"
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 SyntaxError: Missing parentheses in call to 'print'. Did you mean print(...)?

 # ./run-ptest
 RUN #1
 # "ip link add testteamx type team"
 # "teamnl testteamx getoption mode"
 # "ip link del testteamx"
 # "modprobe -r team_mode_loadbalance team_mode_roundrobin team_mode_activebackup team_mode_broadcast team"
 Traceback (most recent call last):
  File "/usr/lib64/libteam/ptest/./team_basic_test.py", line 206, in <module>
    main()
  File "/usr/lib64/libteam/ptest/./team_basic_test.py", line 203, in main
    btest.run()
  File "/usr/lib64/libteam/ptest/./team_basic_test.py", line 180, in run
    self._run_one_loop(i + 1)
  File "/usr/lib64/libteam/ptest/./team_basic_test.py", line 173, in _run_one_loop
    self._run_one_mode(mode_name)
  File "/usr/lib64/libteam/ptest/./team_basic_test.py", line 101, in _run_one_mode
    cmd_exec("teamnl %s getoption mode" % team_name, "*NOMODE*")
  File "/usr/lib64/libteam/ptest/./team_basic_test.py", line 80, in cmd_exec
    raise CmdExecUnexpectedOutputException(output, expected_output)
 __main__.CmdExecUnexpectedOutputException: Command execution output unexpected: "b'*NOMODE*'" != "*NOMODE*"

 So rework team_basic_test.py to fix the above issue.

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-27 14:44:57 -08:00
Changqing Li 79b62c1383 syslog-ng: adjust control socket location
Commit [1] changed the pidfile dir to /var/run/syslog-ng. This also changed
the location where the control socket is searched for, causing the following
error with systemd:

root@qemux86-64:~# syslog-ng-ctl config
Error connecting control socket, socket='/var/run/syslog-ng/syslog-ng.ctl',
error='No such file or directory'

Update the systemd service file to point to the new location.

[1] 00d1d63e4f ("syslog-ng: provide correct PID directory location to
                   restart/stop syslog-ng daemon")

(master rev: b57d824fdf)

Signed-off-by: lmorales <luisalejandro.moralespena@windriver.com>
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-27 14:44:57 -08:00
Jeremy Puhlman f72a73b42f ifenslave: Add branch=main
master branch has been removed upstream

Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
[tweeked to apply to previous branch define]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-05 11:32:16 -08:00
Khem Raj 4932616b69 sdbus-c++-libsystemd: Avoid hard dependency on rsync
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit dcb8ab6169)
[Fixup for hardknott context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-18 08:05:44 -08:00
Martin Jansa 42d05b0f38 sdbus-c++: don't fetch googletest during do_configure
* with PTEST_ENABLED it enables with-tests PACKAGECONFIG which
  instead of using system googletest gmock, tries to fetch googletest
  from github and fails because branch was recently renamed from master to main

| -- Found PkgConfig: /OE/tmp-glibc/work/qemux86-oe-linux/sdbus-c++/0.8.3-r0/recipe-sysroot-native/usr/bin/pkg-config (found version "0.29.2")
| -- Checking for module 'libsystemd>=236'
| --   Found libsystemd, version 249
| -- Building with tests
| Fetching googletest...
| [1/9] Creating directories for 'googletest-populate'
| [1/9] Performing download step (git clone) for 'googletest-populate'
| Cloning into 'googletest-src'...
| fatal: invalid reference: master
| CMake Error at googletest-subbuild/googletest-populate-prefix/tmp/googletest-populate-gitclone.cmake:40 (message):
|   Failed to checkout tag: 'master'
|
|
| FAILED: googletest-populate-prefix/src/googletest-populate-stamp/googletest-populate-download
| cd /OE/tmp-glibc/work/qemux86-oe-linux/sdbus-c++/0.8.3-r0/build/_deps && /OE/tmp-glibc/work/qemux86-oe-linux/sdbus-c++/0.8.3-r0/recipe-sysroot-native/usr/bin/cmake -P /OE/tmp-glibc/work/qemux86-oe-linux/sdbus-c++/0.8.3-r0/build/_deps/googletest-subbuild/googletest-populate-prefix/tmp/googletest-populate-gitclone.cmake && /OE/tmp-glibc/work/qemux86-oe-linux/sdbus-c++/0.8.3-r0/recipe-sysroot-native/usr/bin/cmake -E touch /OE/tmp-glibc/work/qemux86-oe-linux/sdbus-c++/0.8.3-r0/build/_deps/googletest-subbuild/googletest-populate-prefix/src/googletest-populate-stamp/googletest-populate-download
| ninja: build stopped: subcommand failed.
|
| CMake Error at /OE/tmp-glibc/work/qemux86-oe-linux/sdbus-c++/0.8.3-r0/recipe-sysroot-native/usr/share/cmake-3.19/Modules/FetchContent.cmake:989 (message):
|   Build step for googletest failed: 1
| Call Stack (most recent call first):
|   /OE/tmp-glibc/work/qemux86-oe-linux/sdbus-c++/0.8.3-r0/recipe-sysroot-native/usr/share/cmake-3.19/Modules/FetchContent.cmake:1118:EVAL:2 (__FetchContent_directPopulate)
|   /OE/tmp-glibc/work/qemux86-oe-linux/sdbus-c++/0.8.3-r0/recipe-sysroot-native/usr/share/cmake-3.19/Modules/FetchContent.cmake:1118 (cmake_language)
|   tests/CMakeLists.txt:17 (FetchContent_Populate)
|
|
| -- Configuring incomplete, errors occurred!

* unfortunately this backported patch fixes the fetching failure, because
  it uses release-${GOOGLETEST_VERSION} tag instead of now non-existent
  master branch, but is not enough to prevent fetching from github during
  do_configure:

  -- Building with tests
  -- Could NOT find GTest (missing: GTest_DIR)
  -- Checking for module 'gmock>=1.10.0'
  --   No package 'gmock' found
  Fetching googletest...

  we also need to add googletest dependency to with-tests PACKAGECONFIG was fixed in meta-oe/master with the upgrade to 1.0.0:
  https://github.com/openembedded/meta-openembedded/commit/b26b66e5da92718b4e99a57fbfaaef9e751c3cfe#diff-48a847e7323703994fd2ce0fcb731ff860fa955a77cdfe39d71a9cc84a042c06L15

  then it's ok and not fetching:

  -- Building with tests
  -- Looking for pthread.h
  -- Looking for pthread.h - found

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-18 08:03:48 -08:00
Changqing Li b87521033c postgresql: fix CVE-2021-23214,CVE-2021-23222
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-18 07:36:34 -08:00
Otto Esko 93befa6cf5 Use old override syntax
- can-utils and dstat recipes were using the colon override syntax
  introduced in honister
- revert back to underline override notation

Signed-off-by: Otto Esko <otto.esko@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-16 05:30:44 -08:00
Armin Kuster 7fbb276718 recipes: Update SRC_URI branch and protocols
This patch updates SRC_URIs using git to include branch=master if no branch is set
and also to use protocol=https for github urls as generated by the conversion script
in OE-Core.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-13 07:45:48 -08:00
Zoltán Böszörményi 10dabf3896 c-ares: Use branch=main and protocol=https in SRC_URI
Without the branch setting, this error occurs:

ERROR: c-ares-native-1.16.0+gitrAUTOINC+74a1426ba6-r0 do_fetch:
Fetcher failure: Unable to find revision 74a1426ba60e2cd7977e53a22ef839c87415066e
in branch master even from upstream
ERROR: c-ares-native-1.16.0+gitrAUTOINC+74a1426ba6-r0 do_fetch:
Fetcher failure for URL: 'git://github.com/c-ares/c-ares.git'.
Unable to fetch URL from any source.

Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-07 10:40:23 -08:00
Khem Raj 0b0ab6a2d2 android-tools: Define SRCREV_FORMAT
Since it uses multiple fetch URIs make it explicit to define SRCREV_FORMAT

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c508760614)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-02 05:57:09 -07:00
Khem Raj 5254782010 gst-shark: Define SRCREV_FORMAT
Since it uses multiple fetch URIs make it explicit to define SRCREV_FORMAT

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 196a128681)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-02 05:56:53 -07:00
Changqing Li d3f0dddd64 redis: upgrade 6.2.2 -> 6.2.6
refer https://redis.io/, this upgrade container sereval CVE
fixes.

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-01 20:29:40 -07:00
Richard Purdie 47799c15b6 gattlib: Place pkgconfig file in correct package
Fixes in OE-Core added some pkgconfig dependencies back and this flagged
that the .pc file was in ${PN}, not ${PN}-dev. Fix that.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit ea4afdb6a8)
[fixup for hardknott context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-30 04:35:21 -07:00
Changqing Li 43004de1bf redis: fix sereval CVEs
Fixes CVEs:
CVE-2021-32626
CVE-2021-32627
CVE-2021-32628
CVE-2021-32675
CVE-2021-32687
CVE-2021-32762
CVE-2021-41099

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-28 21:14:44 -07:00
Armin Kuster b7e32131a5 Apache: Several CVE fixes
Source: Apache.org
MR: 113457, 113453
Type: Security Fix
Disposition: Backport from apache.org 2.4.51
ChangeID: 9d7b58f49487baff99bf8f101e53217425a2b81f
Description:

Bug fix only update. LTS version
https://httpd.apache.org/security/vulnerabilities_24.html

Fixes CVEs:
CVE-2021-42013
CVE-2021-41524
CVE-2021-41773

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-28 21:14:03 -07:00
Changqing Li d378e4293d postgresql: upgrade 13.3 -> 13.4
This upgrade fix CVE-2021-3677

refer: https://www.postgresql.org/support/security/CVE-2021-3677/

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-23 07:39:43 -07:00
Mingli Yu 672a7420b2 vsftpd: Upgrade to 3.0.5
Drop 2 seccomp patches as seccomp sandbox policy tweaks in new version [1].

[1] https://security.appspot.com/vsftpd/Changelog.txt

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>

This upgrade fix CVE-2021-3618, refer above Changelog
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-23 07:39:36 -07:00
Chen Qi e95ed41c01 ntfs-3g-ntfsprogs: upgrade to 2021.8.22
This upgrade revolves a bunch of CVEs. See more details in:
https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp.

These CVEs cannot be reolved one by one. Upgrading the package
is the only reasonable way.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
[CVE-2021-33285, CVE-2021-35269, CVE-2021-35268, CVE-2021-33289, CVE-2021-33286, CVE-2021-35266, CVE-2021-33287, CVE-2021-35267, CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE-2021-39254, CVE-2021-39255, CVE-2021-39256, CVE-2021-39257, CVE-2021-39258, CVE-2021-39259, CVE-2021-39260, CVE-2021-39261, CVE-2021-39262, CVE-2021-39263]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-19 08:07:21 -07:00
Trevor Gamblin 82cc965742 python3-pyinotify: Add fcntl, logging to RDEPENDS
"import pyinotify" throws an error for these modules if they are not
included.

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-19 08:07:13 -07:00
Trevor Gamblin 406a405af2 python3-pillow: Fix CVE-2021-23437
Backport an upstream fix since an uprev would include
potentially-breaking functionality changes.

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-08 12:40:15 -07:00
Sakib Sajal 3f8d565e39 gd: upgrade v2.3.2 -> v2.3.3
Changes:
 i) removed patches contained in newer version

ii) LIC_FILES_CHKSUM changed because of the following commits:
6013c7bc Just make it easier for the doc
82d26095 merge duplicate COPYING files

Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-08 12:40:11 -07:00
Trevor Gamblin 965b85b678 python3-sqlparse: Fix CVE-2021-32839
Backport a patch from version 0.4.2 upstream since the uprev would add
functionality changes.

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-08 12:40:08 -07:00
Peter Kjellerstedt 871cc98187 libiio: Make libiio-python3 depend on python3-core
Inheriting setuptools3 incorrectly adds the dependency on python3-core
to libiio instead of to libiio-python3 where it belongs.

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-08 12:40:05 -07:00
wangmy f44e1a2b57 apache2: upgrade 2.4.48 -> 2.4.49
Changes with Apache 2.4.49

  *) SECURITY: CVE-2021-40438 (cve.mitre.org)
     mod_proxy: Server Side Request Forgery (SSRF) vulnerabilty [Yann Ylavic]

  *) SECURITY: CVE-2021-39275 (cve.mitre.org)
     core: ap_escape_quotes buffer overflow

  *) SECURITY: CVE-2021-36160 (cve.mitre.org)
     mod_proxy_uwsgi: Out of bound read vulnerability [Yann Ylavic]

  *) SECURITY: CVE-2021-34798 (cve.mitre.org)
     core: null pointer dereference on malformed request

  *) SECURITY: CVE-2021-33193 (cve.mitre.org)
     mod_http2: Request splitting vulnerability with mod_proxy [Stefan Eissing]

  *) core/mod_proxy/mod_ssl:
     Adding `outgoing` flag to conn_rec, indicating a connection is
     initiated by the server to somewhere, in contrast to incoming
     connections from clients.
     Adding 'ap_ssl_bind_outgoing()` function that marks a connection
     as outgoing and is used by mod_proxy instead of the previous
     optional function `ssl_engine_set`. This enables other SSL
     module to secure proxy connections.
     The optional functions `ssl_engine_set`, `ssl_engine_disable` and
     `ssl_proxy_enable` are now provided by the core to have backward
     compatibility with non-httpd modules that might use them. mod_ssl
     itself no longer registers these functions, but keeps them in its
     header for backward compatibility.
     The core provided optional function wrap any registered function
     like it was done for `ssl_is_ssl`.
     [Stefan Eissing]

  *) mod_ssl: Support logging private key material for use with
     wireshark via log file given by SSLKEYLOGFILE environment
     variable.  Requires OpenSSL 1.1.1.  PR 63391.  [Joe Orton]

  *) mod_proxy: Do not canonicalize the proxied URL when both "nocanon" and
     "ProxyPassInterpolateEnv On" are configured.  PR 65549.
     [Joel Self <joelself gmail.com>]

  *) mpm_event: Fix children processes possibly not stopped on graceful
     restart.  PR 63169.  [Joel Self <joelself gmail.com>]

  *) mod_proxy: Fix a potential infinite loop when tunneling Upgrade(d)
     protocols from mod_proxy_http, and a timeout triggering falsely when
     using mod_proxy_wstunnel, mod_proxy_connect or mod_proxy_http with
     upgrade= setting.  PRs 65521 and 65519.  [Yann Ylavic]

  *) mod_unique_id: Reduce the time window where duplicates may be generated
     PR 65159
     [Christophe Jaillet]

  *) mpm_prefork: Block signals for child_init hooks to prevent potential
     threads created from there to catch MPM's signals.
     [Ruediger Pluem, Yann Ylavic]

  *) Revert "mod_unique_id: Fix potential duplicated ID generation under heavy load.
     PR 65159" added in 2.4.47.
     This causes issue on Windows.
     [Christophe Jaillet]

  *) mod_proxy_uwsgi: Fix PATH_INFO setting for generic worker.  [Yann Ylavic]

  *) mod_md: Certificate/keys pairs are verified as matching before a renewal is accepted
     as successful or a staged renewal is replacing the existing certificates.
     This avoid potential mess ups in the md store file system to render the active
     certificates non-working. [@mkauf]

  *) mod_proxy: Faster unix socket path parsing in the "proxy:" URL.
     [Yann Ylavic]

  *) mod_ssl: tighten the handling of ALPN for outgoing (proxy)
     connections. If ALPN protocols are provided and sent to the
     remote server, the received protocol selected is inspected
     and checked for a match. Without match, the peer handshake
     fails.
     An exception is the proposal of "http/1.1" where it is
     accepted if the remote server did not answer ALPN with
     a selected protocol. This accomodates for hosts that do
     not observe/support ALPN and speak http/1.x be default.

  *) mod_proxy: Fix possible reuse/merging of Proxy(Pass)Match worker instances
     with others when their URLs contain a '$' substitution.  PR 65419 + 65429.
     [Yann Ylavic]

  *) mod_dav: Add method_precondition hook. WebDAV extensions define
     conditions that must exist before a WebDAV method can be executed.
     This hook allows a WebDAV extension to verify these preconditions.
     [Graham Leggett]

  *) Add hooks deliver_report and gather_reports to mod_dav.h. Allows other
     modules apart from versioning implementations to handle the REPORT method.
     [Graham Leggett]

  *) Add dav_get_provider(), dav_open_lockdb(), dav_close_lockdb() and
     dav_get_resource() to mod_dav.h. [Graham Leggett]

  *) core: fix ap_escape_quotes substitution logic. [Eric Covener]

  *) Easy patches: synch 2.4.x and trunk
     - mod_auth_basic: Use ap_cstr_casecmp instead of strcasecmp.
     - mod_ldap: log and abort locking errors.
     - mod_ldap: style fix for r1831165
     - mod_ldap: build break fix for r1831165
     - mod_deflate: Avoid hard-coded "%ld" format strings in mod_deflate's logging statements
     - mod_deflate: Use apr_uint64_t instead of uint64_t (follow up to r1849590)
     - mod_forensic: Follow up to r1856490: missing one mod_log_forensic test_char_table case.
     - mod_rewrite: Save a few cycles.
     - mod_request: Fix a comment (missing '_' in 'keep_body') and some style issues
     - core: remove extra whitespace in HTTP_NOT_IMPLEMENTED
    [Christophe Jaillet]

  *) core/mpm: add hook 'child_stopping` that gets called when the MPM is
     stopping a child process. The additional `graceful` parameter allows
     registered hooks to free resources early during a graceful shutdown.
     [Yann Ylavic, Stefan Eissing]

  *) mod_proxy: Fix icomplete initialization of BalancerMember(s) from the
     balancer-manager, which can lead to a crash.  [Yann Ylavic]

  *) mpm_event: Fix graceful stop/restart of children processes if connections
     are in lingering close for too long.  [Yann Ylavic]

  *) mod_md: fixed a potential null pointer dereference if ACME/OCSP
     server returned 2xx responses without content type. Reported by chuangwen.
     [chuangwen, Stefan Eissing]

  *) mod_md:
     - Domain names in `<MDomain ...>` can now appear in quoted form.
     - Fixed a failure in ACME challenge selection that aborted further searches
       when the tls-alpn-01 method did not seem to be suitable.
     - Changed the tls-alpn-01 setup to only become unsuitable when none of the
       dns names showed support for a configured 'Protocols ... acme-tls/1'. This
       allows use of tls-alpn-01 for dns names that are not mapped to a VirtualHost.
     [Stefan Eissing]

  *) Add CPING to health check logic. [Jean-Frederic Clere]

  *) core: Split ap_create_request() from ap_read_request(). [Graham Leggett]

  *) core, h2: common ap_parse_request_line() and ap_check_request_header()
     code. [Yann Ylavic]

  *) core: Add StrictHostCheck to allow unconfigured hostnames to be
     rejected. [Eric Covener]

  *) htcacheclean: Improve help messages.  [Christophe Jaillet]

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 54a96fa4fe)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-26 16:35:31 -07:00
zangrc 135af4f1f7 dash: upgrade 0.5.11.3 -> 0.5.11.5
parser: Fix VSLENGTH parsing with trailing garbage
eval: Do not cache value of eflag in evaltree

Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 633f211505)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-26 16:26:19 -07:00
zangrc 929c2eebfa crash: upgrade 7.2.9 -> 7.3.0
Refresh the following patch:
donnot-extract-gdb-during-do-compile.patch
remove-unrecognized-gcc-option-m32-for-mips.patch

0001-printk-add-support-for-lockless-ringbuffer.patch
0002-printk-use-committed-finalized-state-values.patch
Removed since these are included in 7.3.0.

Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c833f02489)
[Fixes issue with 5.10 kernel]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-26 16:18:21 -07:00
Alexander Kanavin 62a8dfa754 can-utils: rrecommend iproute2 to make it possible to configure can interfaces
This replicates the fix from canutils.bb, for the same issue. See the link
in the comment for details.

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 020b87add3)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-26 16:12:02 -07:00
Marek Vasut 772157bb57 dstat: Add missing python-six runtime dependency
The tool depends on the six module, add it, otherwise the following
traceback happens when running it on the target:

Traceback (most recent call last):
  File "/usr/bin/dstat", line 32, in <module>
    import six
ModuleNotFoundError: No module named 'six'

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Khem Raj <raj.khem@gmail.com>
Cc: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 866e2e88911c0975403b6f2be2cd498b34c2b395)
[minor fixup for Hardknott context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-20 15:46:34 -07:00
Mingli Yu aa137e3344 mariadb: Upgrade to 10.5.12
Fixes for the following security vulnerabilities:
 CVE-2021-2372
 CVE-2021-2389

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-15 07:45:38 -07:00
Changqing Li dc262c52b0 c-ares: fix CVE-2021-3672
Refer:
https://c-ares.org/adv_20210810.html
https://github.com/c-ares/c-ares/commit/362f91d807d293791008cdb7616d40f7784ece83
https://github.com/c-ares/c-ares/commit/44c009b8e62ea1929de68e3f438181bea469ec14

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-14 07:41:42 -07:00
Khem Raj 355e47cd85 vboxguestdrivers: Remove __divmoddi4 patch
This function has been added upstream as well, therefore the patch is no
longer needed

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Cc: Gianfranco Costamagna <locutusofborg@debian.org>
(cherry picked from commit 552269da69)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-08 21:25:39 -07:00
Joe Slater cea26b8482 redis: fix CVE-2021-32761
Backport from version 6.2.5.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-07 12:53:53 -07:00
Kristian Klausen 32f1d758a1 cryptsetup: Add runtime dependency on lvm2-udevrules for udev
Without the udevrules cryptsetup luksOpen will be hanging with "Udev
cookie 0xd4de0f6 (semid 5) waiting for zero".

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 60b33e376b2331cd20950f0745336397790d2201)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-07 08:18:09 -07:00
Peter Kjellerstedt 7aca7fa6db cryptsetup: Only recommend kernel modules when building for target
Otherwise cryptsetup-native depends on the target kernel and thus the
target compiler, as can be seen by:

  $ bitbake -g cryptsetup-native
  $ grep 'cryptsetup.*linux-yocto' task-depends.dot
  "cryptsetup-native.do_build" -> "linux-yocto.do_deploy"
  "cryptsetup-native.do_build" -> "linux-yocto.do_package_write_rpm"
  "cryptsetup-native.do_populate_sysroot" -> "linux-yocto.do_populate_sysroot"
  $ grep 'linux-yocto.*gcc-cross' task-depends.dot
  "linux-yocto.do_kernel_configme" -> "gcc-cross-x86_64.do_populate_sysroot"
  "linux-yocto.do_prepare_recipe_sysroot" -> "gcc-cross-x86_64.do_populate_sysroot"

This also moves the runtime dependencies to near the end of the recipe,
which is more customary.

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 497602b484)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-07 08:17:42 -07:00
zangrc 110b275c6d cryptsetup: upgrade 2.3.5 -> 2.3.6
Signed-off-by: Zang Ruochen <zangrc.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 056d0892f0)
[Bugz fix only update]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-07 08:14:56 -07:00
Yi Zhao 523f6d834d krb5: fix CVE-2021-36222
CVE-2021-36222:
ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC)
in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2
allows remote attackers to cause a NULL pointer dereference and daemon
crash. This occurs because a return value is not properly managed in a
certain situation.

References:
https://nvd.nist.gov/vuln/detail/CVE-2021-36222

Patches from:
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 620badcbf8a59fbd2cdda6ab01c4ffba1c3ee327)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-07 08:09:37 -07:00
wangmy 08ff683e00 cjson: upgrade 1.7.14 -> 1.7.15
Fixes:
Fix potential core dumped for strrchr, see https://github.com/DaveGamble/cJSON/pull/546
Fix null pointer crash in cJSON_CreateXxArray, see https://github.com/DaveGamble/cJSON/pull/538
Fix several null pointer problems on allocation failure, see https://github.com/DaveGamble/cJSON/pull/526
Fix a possible dereference of null pointer, see https://github.com/DaveGamble/cJSON/pull/519
Fix windows build failure about defining nan, see https://github.com/DaveGamble/cJSON/pull/518

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fa00ac02df)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-06 11:58:58 -07:00
zhengruoqin 011f049c20 wireshark: upgrade 3.4.7 -> 3.4.8
Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 340ec8b25e)
[bug fix only update]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-06 11:58:07 -07:00
Gianfranco 7bd7e1da90 dlt-daemon: update from 2.18.6 to 2.18.7
- add an upstream proposed patch 317.patch to fix a build failure with enabled systemd binding

Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Signed-off-by: Gianfranco Costamagna <locutusofborg@debian.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 01fa60898c)
[Stable version, bug fix only]
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-04 10:39:29 -07:00
Joe Slater 262d9bd0d0 nginx: fix CVE-2021-3618
Apply patch made to version 1.20.1 to version 1.18.0.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-02 18:25:42 -07:00
Changqing Li 4b28324739 apache2: upgrade 2.4.46 -> 2.4.48
Source: https://git.openembedded.org/meta-openembedded
https://git.openembedded.org/meta-openembedded
MR: 112869, 112835, 105131, 112702, 112829
Type: Security Fix
Disposition: Backport from https://git.openembedded.org/meta-openembedded/commit/meta-webserver/recipes-httpd/apache2?id=ba016d73b5233a43ec6e398b45445d13ddaad745
ChangeID: f3ac0bc1005c94a694573b823c8f3f7d4a15360c
Description:

Apache2 2.4.x is an LTS version with bug and CVE fixes.
https://downloads.apache.org/httpd/CHANGES_2.4.48

Includes these CVE fixes:

2.4.48
CVE-2021-31618

2.4.47
CVE-2020-13938
CVE-2020-11985
CVE-2021-33193
CVE-2019-17567

Drop these patches included in update:
CVE-2020-13950.patch
CVE-2020-35452.patch
CVE-2021-26690.patch
CVE-2021-26691.patch
CVE-2021-30641.patch

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ba016d73b5)
Signed-off-by: Armin Kuster <akuster@mvista.com>
2021-09-02 18:22:44 -07:00
Sakib Sajal 5741b949a8 gd: fix CVE-2021-38115
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-26 19:18:35 -07:00
Changqing Li 14958cdad1 linuxptp: upgrade 3.1 -> 3.1.1
* fix WARNING: linuxptp-3.1-r0 do_fetch: Failed to fetch URL
http://sourceforge.net/projects/linuxptp/files/v3.1/linuxptp-3.1.tgz,
attempting MIRRORS if available

linuxptp-3.1.tgz replace by linuxptp-3.1.1.tgz

* 3.1.1 release note
Version 3.1.1

Fixes:

    CVE-2021-3570 linuxptp: missing length check of forwarded messages
    CVE-2021-3571 linuxptp: wrong length of one-step follow-up in transparent clock

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-26 19:18:28 -07:00
Roland Hieber 341fcf678c ldns: fix override syntax
Commit 2e794f33a4 cherry-picked a fix from master, which used
the new override syntax, which was introduced in poky commit
2abf8a699edd513405be (2021-07-25, "bitbake: bitbake: Switch to using new
override syntax"). However, this change was merged after 3.4_M2 and is
not part of hardknott, so bitbake complains about the new syntax:

    ERROR: ParseError at
    …/meta-openembedded/meta-oe/recipes-devtools/ldns/ldns_1.7.1.bb:20:
    unparsed line: 'do_install:append() {'

Revert to the old syntax on the hardknott branch for now.

Fixes: 2e794f33a4 (2021-08-09, "ldns: fix QA Issue after LDFLAGS change")
Signed-off-by: Roland Hieber <rhi@pengutronix.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-25 07:16:32 -07:00
Roland Hieber 323f33560c curlpp: fix override syntax
Commit bca3bbbf20 cherry-picked a fix from master, which used
the new override syntax, which was introduced in poky commit
2abf8a699edd513405be (2021-07-25, "bitbake: bitbake: Switch to using new
override syntax"). However, this change was merged after 3.4_M2 and is
not part of hardknott, so bitbake complains about the new syntax:

    ERROR: ParseError at
    …/meta-openembedded/meta-networking/recipes-support/curlpp/curlpp_0.8.1.bb:20:
    unparsed line: 'do_install:append() {'

Revert to the old syntax on the hardknott branch for now.

Fixes: bca3bbbf20 (2021-08-09, "curlpp: fix QA Issue after LDFLAGS change")
Signed-off-by: Roland Hieber <rhi@pengutronix.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-25 07:16:32 -07:00
Mingli Yu cef3e037ac polkit: fix CVE-2021-3560
Backport a patch [1] to fix CVE-2021-3560.

[1] https://gitlab.freedesktop.org/polkit/polkit/-/commit/a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b65c646b25)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-21 10:40:27 -07:00
Khem Raj d323115ecd fvwm: Fix build time paths in target perl/python scripts
Add rdeps as needed
Fixes shebang-size QA warnings

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8cc64128c7)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-15 07:09:56 -07:00
Khem Raj ec601332b2 fvwm: Package extra files and man pages
Avoids using installed-vs-shipped

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 566049b4f1)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-15 07:09:38 -07:00
Tony Tascioglu acf5769aff redis: fix CVE-2021-32625
CVE: CVE-2021-32625
Upstream-Status: Backport [e9a1438ac4c52aa68dfa2a8324b6419356842116]

Fix integer overflow in STRALGO LCS (CVE-2021-32625) (#9011)
An integer overflow bug in Redis version 6.0 or newer can be exploited using the
STRALGO LCS command to corrupt the heap and potentially result with remote code
execution. This is a result of an incomplete fix by CVE-2021-29477.

Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-14 11:43:12 -07:00
Michael Opdenacker b2c8972406 bigbuckbunny-1080p: fix sample video URL
Replace a link that's now broken.

The original download link on blender.org still works
(https://download.blender.org/peach/bigbuckbunny_movies/big_buck_bunny_1080p_surround.avi)
but is still extremely slow.

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 223243d649)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-14 07:19:22 -07:00