Commit Graph

1613 Commits

Author SHA1 Message Date
Polampalli, Archana d3ee870fb0 nodejs: fix CVE-2022-25883
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression
Denial of Service (ReDoS) via the function new Range, when untrusted user data is
provided as a range.

References:
https://nvd.nist.gov/vuln/detail/CVE-2022-25883

Upstream patches:
https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 11:59:59 -04:00
Sourav Pramanik 7c127728e7 nlohmann-json: Avoid usage of nobranch=1
The usage of nobranch=1 in SRC_URI allows using unprotected branches.

This change updates the real branch name in place of nobranch=1.

Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-30 13:41:52 -04:00
Sourav Pramanik a76c87aa0a rapidjson: Avoid usage of nobranch=1
The usage of nobranch=1 in SRC_URI allows using unprotected branches.

This change updates the real branch name in place of nobranch=1.

Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-30 13:41:52 -04:00
Polampalli, Archana 20ed5727af php: upgrade 8.1.16 -> 8.1.22
Upgrade php to 8.1.22

Security fixes:
    CVE-2023-3824
    CVE-2023-3823
    CVE-2023-3247

https://www.php.net/ChangeLog-8.php#8.1.22

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-25 10:39:46 -04:00
Polampalli, Archana 529620141e nodejs: upgrade 16.20.1 -> 16.20.2
This release contains bug fixes only.
The following CVEs have been addressed:

CVE-2023-32002
CVE-2023-32006
CVE-2023-32559

$ git log --oneline v16.20.1..v16.20.2
dadbde963f (tag: v16.20.2) 2023-08-09, Version 16.20.2 'Gallium' (LTS)
d8ccfe9ad4 policy: handle Module.constructor and main.extensions bypass
242aaa0caa policy: disable process.binding() when enabled
40c3958a5a  deps: update archs files for OpenSSL-1.1.1v
a9ac9da89a deps: fix openssl crypto clean
362d4c7494 deps: upgrade openssl sources to OpenSSL_1_1_1v
7447de2794 Working on v16.20.2

https://github.com/nodejs/node/releases/tag/v16.20.2

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-11 10:32:04 -04:00
Polampalli, Archana 83f5741bd5 yasm: fix CVE-2023-31975
yasm v1.3.0 was discovered to contain a memory leak via the function
yasm_intnum_copy at /libyasm/intnum.c.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-31975
https://github.com/yasm/yasm/issues/210

Upstream patches:
https://github.com/yasm/yasm/commit/b2cc5a1693b17ac415df76d0795b15994c106441

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-03 16:47:53 -04:00
Polampalli, Archana 8814f25902 nodejs: upgrade 16.19.1 -> 16.20.1
Drop the gcc13.patch as it has been merged in 16.20.1
    56cbc7fdda deps: V8: cherry-pick c2792e58035f

The list of the CVEs are fixed in this relase:

    CVE-2023-30581
    CVE-2023-30585
    CVE-2023-30588
    CVE-2023-30589
    CVE-2023-30590

https://nodejs.org/en/blog/release/v16.20.0
https://nodejs.org/en/blog/release/v16.20.1

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-16 15:30:53 -04:00
Hitendra Prajapati 297bc1cc64 yajl: CVE-2023-33460 memory leak in yajl_tree_parse function
Upstream-Status: Backport from https://github.com/openEuler-BaseService/yajl/commit/23a122eddaa28165a6c219000adcc31ff9a8a698

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-02 11:19:22 -04:00
Peter Marko d7ece8be99 grpc: ignore CVE-2023-32732
It was introduced in in v1.53.0 and not backported to v1.46.x branch.
NVD references PR which intrioduces the vulnerability:
  https://github.com/grpc/grpc/pull/32309#issuecomment-1589561295

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-02 11:17:52 -04:00
Arash Partow a82d92c8a6 ExprTk: Update package to release/0.0.2
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0522e66a26)
[The SRC_URI HASH no longer exists in repo so use 0.0.2 version]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-19 09:17:01 -04:00
Adrian Zaharia 5bb0b48228 lapack: add packageconfig for lapacke
backport of commit:
   d799db35d lapack: add packageconfig for lapacke

Signed-off-by: Adrian Zaharia <Adrian.Zaharia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-15 07:47:55 -04:00
Xiangyu Chen 09a027b488 Revert "pahole: fix native package build error"
This reverts commit 0cc8e22c46.

The pahole-native package should use the header from libbpf instead of linux-libc-headers,
the 0cc8e22c would cause compile error, so revert it.

Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-23 23:12:46 -04:00
Khem Raj 4cc7363978 nodejs: Fix build with gcc13
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-19 09:46:38 -04:00
Martin Jansa ac933b0d1e abseil-cpp: backport a fix for build with gcc-13
* needed for abseil-cpp-native on hosts with gcc-13"

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-19 09:46:05 -04:00
Chee Yang Lee 9e539aaed6 capnproto: upgrade to 0.9.2
upgrade include fix for CVE-2022-46149

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-09 06:51:22 -04:00
Xiangyu Chen 0cc8e22c46 pahole: fix native package build error
pahole-native package needs some uapi headers such like linux/btf.h,
otherwise it would report error as below:

btf_loader.c:342:54: error: invalid use of undefined type ‘struct btf_enum64’

Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-06 07:42:05 -04:00
Martin Jansa 207807733e pahole: respect libdir
* use the same expression as cmake.bbclass is using:
  CMAKE_INSTALL_LIBDIR:PATH=${@os.path.relpath(d.getVar('libdir'), d.getVar('prefix') + '/')}
  but ${baselib} should work here as well

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-13 08:26:08 -04:00
BINDU b97dbaac66 flatbuffers: adapt for cross-compilation environments
Flatbuffers contains a library and a schema compiler. The package
contains cmake files to discover the libraries and the compiler tool.
Currently, all of these cmake files are installed into the target
sysroot. However, the compiler utility isn't installed into the sysroot
(as it is not runnable on the build machine).

When an application that depends on flatbuffers gets built, it uses
flatbuffers' exported cmake targets to configure the project. One of the
exported targets is FlatcTarget.cmake which expects to see flatc binary
in /usr/bin of the sysroot. Since binaries for target don't end up in
target sysroot, cmake configuration fails.

This patch addresses this problem of flatbuffers' build infrastructure
in cross-compiling environments. By removing FlatcTarget.cmake for
target builds from the sysroot we essentially skip this step of
flatbuffers' configuration.

Signed-off-by: Ivan Stepic <Ivan.Stepic@bmw.de>
Signed-off-by: Bhabu Bindu <bindudaniel1996@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-13 08:23:09 -04:00
Polampalli, Archana 9cf4ebeb3d nodejs: Upgrade 16.19.0 -> 16.19.1
The following CVEs fixed in this version:
     CVE-2023-23918
     CVE-2023-23919
     CVE-2023-23920
     CVE-2023-23936
     CVE-2023-24807

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-13 08:58:37 -04:00
Tom Hochstein acd692b775 nlohmann-json: Allow empty main package for SDK
The header-only package cannot be included in the SDK without marking
the main package with ALLOW_EMPTY.

Fixes rootfs problem:
```
The following packages have unmet dependencies:
 imx-gpu-sdk : Depends: nlohmann-json but it is not installable
E: Unable to correct problems, you have held broken packages.
```

Signed-off-by: Tom Hochstein <tom.hochstein@nxp.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f9c9e7a448)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-13 08:58:37 -04:00
Mingli Yu 9d4bbb9b32 php: Upgrade to 8.1.16
Upgrade php to 8.1.16 [1].

[1] https://www.php.net/ChangeLog-8.php#8.1.16

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-13 08:58:37 -04:00
Andrej Valek 54960c549b grpc: upgrade 1.46.6 -> 1.46.7
Includes fix for CVE-2023-0286

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-05 07:52:09 -05:00
Tim Orling 278ec081a6 nodejs: upgrade 16.18.1 -> 16.19.0
* 16.18.0 (npm 8.19.2) introduced a regression in git+ssh urls
  - https://github.com/nodejs/node/issues/44992
  - https://github.com/npm/cli/pull/5761

https://nodejs.org/ko/blog/release/v16.19.0/

License-Update: Clarify vendored OpenSSL Toolkit is OpenSSL and SSLeay
License-Update: JS Foundation -> OpenJS Foundation

https://github.com/nodejs/node/commit/e7ed56f501389978e4619ab697a812631c4061ff

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-04 12:16:38 -05:00
Andrej Valek 06fb36d33c grpc: upgrade 1.45.2 -> 1.46.6
Backporting the version from master (1.50.1) would a big risk. So use the
version 1.46.6 which also includes fixes of bundled z-lib library.

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-29 11:19:58 -05:00
Mingli Yu 352d7f8205 php: Upgrade to 8.1.12
This is a security release[1].

[1] https://www.php.net/ChangeLog-8.php#8.1.12

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-12-26 14:15:26 -05:00
Archana Polampalli 1c7063e57d Nodejs: Fixed python3 DeprecationWarning
Distutils package and pipes are deprecated and slated for removal in Python 3.13 for Nodejs 16.18
Replaced distutils with setuptools

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
2022-12-20 10:00:29 -05:00
He Zhe bfe2aea83b protobuf: upgrade 3.19.4 -> 3.19.6
Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-12-11 16:18:47 -05:00
Archana Polampalli 08b6b6846a Nodejs - Upgrade to 16.18.1
* Drop Openssl legacy provider patch and install both binaries patch
  which are already available in 16.x
* Refresh native binaries patch against 16.x base

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-11-19 11:19:11 -05:00
wangmy 8c62aaa67e php: upgrade 8.1.9 -> 8.1.10
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2e768a2846)
[Bug fix only release]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-20 08:17:56 -04:00
Wang Mingyu 3cd6cc5dec php: upgrade 8.1.8 -> 8.1.9
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 610b8fdfd4)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-15 08:30:26 -04:00
Enrico Scholz 035d9c61e8 nodejs-oe-cache-native: initial checkin
This implements an 'npm cache add' like functionality but allows to
specify the key of the data and sets metadata which are required to
find the data.

It is used to cache information as done during 'npm install'.

Keyformat and metadata are nodejs version specific.

Signed-off-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-09-15 08:17:25 -04:00
Anuj Mittal 9165fb0d1f yasm: fix buildpaths warning
ax_create_stdint_h.m4 includes $CC as a comment in the generated header
which leads to buildpaths warning:

| WARNING: yasm-1.3.0+gitAUTOINC+ba463d3c26-r0 do_package_qa: QA Issue: File /usr/include/libyasm-stdint.h in package yasm-dev contains reference to TMPDIR [buildpaths]

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a7346d2bb1)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-07 15:02:38 -07:00
Wang Mingyu 7eb9e5004a php: upgrade 8.1.7 -> 8.1.8
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8d7b56ff23)
[Bug fix only update]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-21 07:43:46 -07:00
Davide Gardenal b0bf2829a2 php: ignore patched CVEs
CVE-2007-2728, CVE-2007-3205 and CVE-2007-4596 are patched in our
version of php but they don't have a vulnerable version range in the
NVD database, that's why they need to be ignored.

Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 1642bfcb07)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-21 07:17:15 -07:00
Davide Gardenal bd8f5fa080 meta-oe: ignore patched CVEs
Some old CVEs don't have a vulnerable version range in the NVD database,
this causes come mismatch with cve-check. Ignore many CVEs that are
picked up by the class but are patched in our products.

Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit efa12676dd)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-21 07:17:15 -07:00
Wentao Zhang b9bbc38bfb protobuf-c: update to 1.4.1 fix CVE-2022-33070
Signed-off-by: Wentao Zhang <wzhang4@ala-lpd-susbld2.wrs.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 95904cca4a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-14 09:06:29 -07:00
wangmy 1a09e4ffd2 php: upgrade 8.1.6 -> 8.1.7
Changelog:
==========
https://www.php.net/ChangeLog-8.php#8.1.7

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 75749fa360)
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-09 12:10:00 -07:00
Khem Raj 442af705f0 unattended-upgrades: Disable auto-detecting modules
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e7193af6c9)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-03 06:56:20 -07:00
wangmy 71613a9fa1 php: upgrade 8.1.5 -> 8.1.6
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b7bef32000)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-30 13:12:43 -07:00
wangmy 7566c789da php: upgrade 8.1.4 -> 8.1.5
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 412638c21b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-30 13:07:26 -07:00
Joerg Vehlow 2c051c65a4 jq: Fix typo OE_EXTRACONF -> EXTRA_OECONF
Signed-off-by: Joerg Vehlow <joerg.vehlow@aox.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 1aa9d7d53d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-30 13:02:52 -07:00
Willy Tu 198e343117 absil-cpp: Update SRC_URI to to the latest google internal sync
https://github.com/abseil/abseil-cpp/commit/7c6608d0dbe43cf9bdf7f77787bc6bc89cc42f8b

The internal sync are tested within Google and ready for use.

Signed-off-by: Willy Tu <wltu@google.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 3c1c07e9a5)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-03 06:49:08 -07:00
Khem Raj 89bc6331f4 ltrace: Fix build on ppc64 with gcc12
gcc-12 has a better static analyser and finds additional use-after-free
case, addressed by removing the double free

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-04-20 10:58:01 -07:00
Khem Raj 1d7385bba5 grpc: Fix build with rv32/rv64
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-04-20 10:58:01 -07:00
Khem Raj 5a52bffde1 nodejs: Upgrade to 16.14.2
Fix build with mips32, found with gcc12

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-04-20 10:58:01 -07:00
Mingli Yu 55ba2545a0 libconfig-general-perl: move from meta-openstack
tgt rdepends on libconfig-general-perl.

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-04-18 10:13:16 -07:00
wangmy b2d963ea14 squashfs-tools-ng: upgrade 1.0.2 -> 1.1.4
Changelog from 1.0.2 to 1.1.4:
https://github.com/AgentD/squashfs-tools-ng/blob/master/CHANGELOG.md

License-Update:
- COPYING.md
  Add exceptions to files under **GNU Lesser General Public License version 3 or later**
  Add description to examples
- zstd.txt
  Delete blank lines at the end of the text

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-04-14 19:42:10 -07:00
wangmy 4b1149fe19 pax-utils: upgrade 1.2.2 -> 1.3.3
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-04-14 19:42:10 -07:00
wangmy e4df09949b octave: upgrade 6.4.0 -> 7.1.0
Changelog from 6.4.0 to 7.1.0:
https://www.gnu.org/software/octave/news.html

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-04-13 19:21:41 -07:00
wangmy 6c51fe70fa mercurial: upgrade 5.5 -> 6.1
Changelog from 5.5 to 6.1:
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_6.1_.282022-03-01.29_to_6.1.1_.282022-04-05.29

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2022-04-13 19:21:41 -07:00