Commit Graph

8518 Commits

Author SHA1 Message Date
Narpat Mali
7b65658ede python3-pygments: fix for CVE-2022-40896
A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments
through 2.15.0 via SmithyLexer.

The CVE issue is fixed by these 3 different commits in different version:
1. Improve the Smithy metadata matcher (These changes are already available as part
   of current python3-pygments_2.14.0 version):
dd52102c38 (2.14.0)
2. SQL+Jinja: use a simpler regex in analyse_text:
97eb3d5ec7 (2.15.0)
3. Improve Java properties lexer (#2404):
fdf182a7af (2.15.1)

References:
https://nvd.nist.gov/vuln/detail/CVE-2022-40896
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2/

(From OE-Core rev: 5a02307af5e593be864423a9f3ab309703d61dbf)

Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-09-04 04:13:24 -10:00
Richard Purdie
89394ac832 pseudo: Fix to work with glibc 2.38
This adds a horrible hack to get pseudo working with glibc 2.38. We can't
drop _GNU_SOURCE to something like _DEFAULT_SOURCE since we need the defines
the gnu options bring in. That leaves using internal glibc defines to disable
the c23 versions of strtol/fscanf and friends. Which would break pseudo
build with 2.38 from running on hosts with older glibc.

We'll probably need to come up with something better but this gets glibc 2.38
and working and avoids autobuilder failures.

(From OE-Core rev: 387b276c2d56d58c2a25d59984fcaaf9c88ac788)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 596fb699d470d7779bfa694e04908929ffeabcf7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-30 04:52:35 -10:00
Wang Mingyu
2b1745c74b file: upgrade 5.44 -> 5.45
Changelog:
==========
-PR/465: psrok1: Avoid muslc asctime_r crash
-add SIMH tape format support
-bump the max size of the elf section notes to be read to 128K
 and make it configurable
-PR/415: Fix decompression with program returning empty
-PR/408: fix -p with seccomp
-PR/412: fix MinGW compilation

(From OE-Core rev: 6f1caa944982e265c394a554bfcfa8a105b1d698)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit facef006da35e22394a4cbb13243769586d10f31)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-30 04:52:35 -10:00
Narpat Mali
4c9e8b0390 python3-git: upgrade 3.1.31 -> 3.1.32
The delta between 3.1.31 & 3.1.32 contains the CVE-2023-40267 fix and other bugfixes.

Changelog:
https://github.com/gitpython-developers/GitPython/releases/tag/3.1.32

- Bump cygwin/cygwin-install-action from 3 to 4 by @dependabot in #1572
- Fix up the commit trailers functionality by @itsluketwist in #1576
- Name top-level exceptions as private variables by @Hawk777 in #1590
- fix pypi long description by @eUgEntOptIc44 in #1603
- Don't rely on del by @r-darwish in #1606
- Block insecure non-multi options in clone/clone_from by @Beuc in #1609

(From OE-Core rev: fd38c8d91f95b44ea7b833772b9a07e1f1d74479)

Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-30 04:52:35 -10:00
Mark Hatle
51904d6c60 tcf-agent: Update to 1.8.0 release
New 1.8 release of tcf-agent.  Implements DWARF 5 support and various
bug fixes.

Changelog since last SRCREV:
   Releng: Upversion TCF to 1.8
   Fixed possible SEGFAULT after error message queue overflow
   Fixed misspelling in a comment
   TCF Agent: update breakpoint error message
   Fixed regression: possible segfault in run_safe_events()
   Bug 581978 - TCF agent wrong handle the call frame debug info generated by LLVM 16 for RISC-V
   DWARF: a bit faster implementation of dio_ReadAddressX()
   Bug 581971 - Failed to handle loclist for DWARF 5
   Fixed handling of situation when a context resumed or exited during breakpoint evaluation
   Bug 581799 - when loads .debug_info section from dwarf 5 file, the content of some part are zero
   Updated examples/daytime/readme.txt

(From OE-Core rev: 1b5b577f1b766ed6f98b6854e6968d4b9b02a45a)

Signed-off-by: Mark Hatle <mark.hatle@amd.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 0c2c7c910fa933bc46f69207f1f7641c1e7b77e0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-18 03:57:05 -10:00
sanjana
f9c58a63f0 binutils: stable 2.40 branch updates
Below commits on binutils-2.40 stable branch are updated.

391fd4d9ee5 PR30697, ppc32 mix of local-dynamic and global-dynamic TLS
7ad52a2357f [GOLD] powerpc DT_RELACOUNT
03f49a0619c PR30536, ppc64el gold linker produces unusable clang-16 binary

(From OE-Core rev: 74e6452a9fbeb928a635869160bc17cfeab867f0)

Signed-off-by: sanjana <sanjanasanju1608@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-18 03:57:05 -10:00
Yogita Urade
ee45db898f qemu: fix CVE-2023-2861
qemu: 9pfs: prevent opening special files

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-2861

(From OE-Core rev: 4dd99f7f48664dbaef7f3a083a9d362552ba44ac)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-18 03:57:05 -10:00
Yogita Urade
911a4b03a5 qemu: fix CVE-2023-3255
QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-3255

(From OE-Core rev: 886536b056230a9d72c900eacc8d1d8b44bd2836)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-18 03:57:05 -10:00
Yogita Urade
f86817b160 qemu: fix CVE-2023-3301
qemu: hotplug/hotunplug mlx vdpa device to the occupied addr port,
then qemu core dump occurs after shutdown guest

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-3301

(From OE-Core rev: 82bf6c4cba88dc9f25caf14d60e79ce0c366919c)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-18 03:57:04 -10:00
Oleksandr Hnatiuk
805b208d23 file: fix the way path is written to environment-setup.d
$OECORE_NATIVE_SYSROOT is not escaped, thus it is expanded to an empty string.
This happens to work because we have ${datadir} which in this context is
relocated to the buildtools sysroot after installation of buildtools.

If the $ before OECORE_NATIVE_SYSROOT is escaped, it will be saved to file.sh
as intended, but MAGIC will point to the wrong location because both
OECORE_NATIVE_SYSROOT and datadir resolve to sysroot which doubles the path
like so:
/path/to/buildtools/sysroots/x86_64-xesdk-linux/path/to/buildtools/sysroots/x86_64-xesdk-linux/usr/share/misc/magic.mgc
which does not exist. So, removing reference to OECORE_NATIVE_SYSROOT.

(From OE-Core rev: 7ae5c9a17d6f8133fa5b4e127dd4e9cc43454ee8)

Signed-off-by: Oleksandr Hnatiuk <ohnatiuk@cisco.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit c6206249683876670602888e78ecaf719753a317)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:49 -10:00
Oleksandr Hnatiuk
5a717511f2 file: return wrapper to fix builds when file is in buildtools-tarball
Wrapper that adds proper path to magic file was removed in
47db876d09d9a4394048579c21d0b394450ce681 in favor of
environment-setup.d/file.sh which now contains `MAGIC` environment variable.
This breaks builds that rely on external buildtools with `file` included in
buildtools-tarball (e.g. via TOOLCHAIN_HOST_TASK) because do_populate_sysroot
task invokes `file` via `subprocess.check_output` (in is_elf function) and
doesn't use variables from files in environment-setup.d. To address this use
case, we need to preserve the wrapper, but also have
environment-setup.d/file.sh for the purposes described in
47db876d09d9a4394048579c21d0b394450ce681.

(From OE-Core rev: 4a9832c55044b894e933179e5c1b6a96634809c0)

Signed-off-by: Oleksandr Hnatiuk <ohnatiuk@cisco.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit e76b059cf4ba9a79150032d68d012b233dd79a65)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:49 -10:00
Julien Stephan
4b5695593a automake: fix buildtest patch
Add check_PROGRAMS as a dependency of buildtest-TESTS target.
This is required because according to the official automake
documentation [1]:
* TESTS: contains all the tests files
* check_PROGRAMS: contains the programs used by the tests
* check_PROGRAMS is not automatically added to TESTS

So, by using only TESTS as a dependency for buildtest-TESTS we may end
up having runtime errors because of missing program required by the
tests.

[1]: https://www.gnu.org/software/automake/manual/html_node/Scripts_002dbased-Testsuites.html

(From OE-Core rev: 8a5630c113bd8509fcb62e8a32fcadfc2dc94181)

Signed-off-by: Julien Stephan <jstephan@baylibre.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ee3e2af4f8ed95b4fd0f7cec52ae4e169401b719)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:49 -10:00
Wang Mingyu
a8455f68dc opkg-utils: upgrade 0.5.0 -> 0.6.2
(From OE-Core rev: 525459d2f387ec82fabccdae19aa8b977f534929)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit b0fe9b3dfbe78716c96b70ef098d9cfbf430d5b7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:49 -10:00
Wang Mingyu
abbd466097 opkg: upgrade 0.6.1 -> 0.6.2
0001-Define-alignof-using-_Alignof-when-using-C11-or-newe.patch
0002-opkg-key-remove-no-options-flag-from-gpg-calls.patch
removed since they're included in 0.6.2.

Changelog:
===========
### Changed
- the project's developer documentation to be more correct and current.

### Fixed
- a bug in the 'opkg-keys' utility script which caused the script to ignore settings in the '/etc/opkg/gpg/gpg.conf' file.
- a compilation error in 'md5.c' when using clang16+ and '-std >= gnu11'.

(From OE-Core rev: 5bdfde3fd4266d637019b59d55a33438cb36903f)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit d7c8a58297e38f6222035aa9135fedf2ca387742)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:49 -10:00
Narpat Mali
c36a0bd406 python3-certifi: upgrade 2022.12.7 -> 2023.7.22
python3-certifi 2023.7.22 contains the CVE-2023-37920 fix.

No changelog provided. Commits:

8fb96ed (tag: 2023.07.22) 2023.07.22
afe7722 Bump actions/setup-python from 4.6.1 to 4.7.0 (#230)
2038739 Bump dessant/lock-threads from 3.0.0 to 4.0.1 (#229)
44df761 Hash pin Actions and enable dependabot (#228)
8b3d7ba (tag: 2023.05.07) 2023.05.07
53da240 ci: Add Python 3.12-dev to the testing (#224)
c2fc3b1 Create a Security Policy (#222)
c211ef4 Set up permissions to github workflows (#218)
2087de5 Don't let deprecation warning fail CI (#219)
e0b9fc5 remove paragraphs about 1024-bit roots from README
9427a5a fix CI
fed4048 get CI passing again
9e9e840 (tag: 2022.12.07) 2022.12.07

(From OE-Core rev: ec5e5ae6b304dee9b323bd20f3db25152a083398)

Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:48 -10:00
Jose Quaresma
9128886912 go: update 1.20.5 -> 1.20.6
Upgrade to latest 1.20.x release [1]:

$ git log --oneline go1.20.5..go1.20.6 origin/release-branch.go1.20
2c358ffe97 (tag: go1.20.6, origin/release-branch.go1.20) [release-branch.go1.20] go1.20.6
312920c00a [release-branch.go1.20] net/http: validate Host header before sending
4db13d762b [release-branch.go1.20] runtime: set raceignore to zero when starting a new goroutine
08a58dd8b6 [release-branch.go1.20] runtime: allow for 5 more threads in TestWindowsStackMemory*
65092835c5 [release-branch.go1.20] cmd/go: skip TestScript/gccgo_link_ldflags on aix/ppc64
bca817594c [release-branch.go1.20] crypto/x509: tolerate multiple matching chains in testVerify
b8e67d1ddd [release-branch.go1.20] cmd/go/internal/test: don't wait for previous test actions when interrupted
3db4f8146c [release-branch.go1.20] runtime: resolve checkdead panic by refining `startm` lock handling in caller context
6b45fb7b73 [release-branch.go1.20] runtime: fallback to TEB arbitrary pointer when TLS slots are full
be30960e58 [release-branch.go1.20] runtime: use 1-byte load for address checking in racecallatomic
b59efe6c34 [release-branch.go1.20] net/mail: permit more characters in mail headers
c32f1afb41 [release-branch.go1.20] all: make safe for new vet analyzer
c7b145655b [release-branch.go1.20] cmd/go: fix tests for new builder environment
03063101a2 [release-branch.go1.20] text/template: set variables correctly in range assignment
d51e322a3f [release-branch.go1.20] go/printer: error out of Fprint when it would write a '//line' directive with a multiline file path
49594244d3 [release-branch.go1.20] cmd/cover: error out if a requested source file contains a newline
4719048211 [release-branch.go1.20] cmd/cgo: error out if the source path used in line directives would contain a newline
6c606fc191 [release-branch.go1.20] cmd/go: fix TestScript/build_cwd_newline with CGO_ENABLED=0
63ad2b5811 [release-branch.go1.20] cmd/compile: do not report division by error during typecheck
95f377daad [release-branch.go1.20] cmd/go: retain extra roots to disambiguate imports in 'go mod tidy'
a7a48fad7e [release-branch.go1.20] crypto/ecdsa: properly truncate P-521 hashes
f5172dcd38 [release-branch.go1.20] go/build: check for invalid import paths again
8b3acefcbe [release-branch.go1.20] cmd/go: omit checksums for go.mod files needed for go version lines more often in pre-1.21 modules
1008486a9f [release-branch.go1.20] cmd/cgo: correct _cgo_flags output

[1] https://github.com/golang/go/compare/go1.20.5...go1.20.6

(From OE-Core rev: 944b186eeb6821654ce6ef56df7ac0f2829696f5)

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8d8216d8c4d37cc0d9508eb644653f94fff8989c)
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-15 06:18:48 -10:00
Ross Burton
1dccb216a0 python3: fix missing comma in get_module_deps3.py
Wes Tarro <wes.tarro@azuresummit.com> noticed a missing comma in a
preplace() call, add it.

That said, calling replace() with one argument results in a TypeError,
so this is obviously dead code.

(From OE-Core rev: f24236b7b52dd753d7170bac9c38dff1133db76e)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9b2e2c8d809e7ca34451ec9702b029a00dfb410b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-01 06:17:28 -10:00
Ross Burton
9b6c564afc pkgconf: update SRC_URI
dereferenced.org is now longer controlled by the pkgconf maintainers[1],
so use the the new hosting location.

[1] 437c2a3218

(From OE-Core rev: 7b50737b787311216670aa4b83b0a363d9a12aa3)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c3df4594513410c7a6352e62aa928c42982eac13)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-01 06:17:28 -10:00
Mingli Yu
452cc7b484 ruby: Fix CVE-2023-36617
Backport two patches [1] [2] to fix CVE-2023-36617 [3].

[1] 9010ee2536
[2] 9d7bcef1e6
[3] https://www.ruby-lang.org/en/news/2023/06/29/redos-in-uri-CVE-2023-36617/

(From OE-Core rev: 403a24f02600e2462e8ccfbb42651e15e002bd2e)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-01 06:17:27 -10:00
Peter Marko
38c70c430f python3: ignore CVE-2023-36632
This CVE shouldn't have been filed as the "exploit" is described in the
documentation as how the library behaves.

(From OE-Core rev: 3e7f736fa07a132d4fe42a59baaabe565238da21)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c652f094d86c4efb7ff99accba63b8169493ab18)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-08-01 06:17:27 -10:00
Richard Purdie
7995f780f9 gcc-testsuite: Fix ppc cpu specification
After this change in qemu:

c7e89de132

there is no 'max' cpu model on ppc. Drop it to clean up ppc gcc testsuite failures.

In order for this to work we do need to pull in the alternative cpu option from
QEMU_EXTRAOPTIONS on powerpc.

(From OE-Core rev: ea3143b243bb979f9b89f01fc2e7826cac0a7d75)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c447f2b21b20fb2b1829d540af2cc0bf8242700c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26 05:12:21 -10:00
Ross Burton
151fd33bbe gcc: don't pass --enable-standard-branch-protection
By changing the default code generation of GCC we're inadvertently
breaking the GCC test suite, which has ~120K+ more failures when run for
aarch64 compared to x86-64.

This was because the generated code fragments included the BTI
instructions, which the test case wasn't expecting.  We can't tell the
tests globally to run without branch protection, as that will break the
tests which also turn it on.

Remove the enabling of branch protection by standard in GCC, we'll
enable it in the tune files instead.

(From OE-Core rev: 81351d984bc6238e9b901ae83c0de6e3d3463c77)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bb4b9017db6a893ed054a2d2ad4cc671dec09c42)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26 05:12:21 -10:00
Sakib Sajal
3bd29f3620 go: fix CVE-2023-24531
Backport required commits to fix CVE-2023-24531.

(From OE-Core rev: 5d80e920c7ceaf091ccace8a3b6781b720abafbf)

Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26 05:12:21 -10:00
Archana Polampalli
2e660a5be9 qemu: fix CVE-2023-0330
A vulnerability in the lsi53c895a device affects the latest version
of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption
bugs like stack overflow or use-after-free.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-0330

Upstream patches:
b987718bbb

(From OE-Core rev: 3be283237a9e473112430bcb614b25b7ff7e64b2)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-26 05:12:21 -10:00
Alexander Kanavin
1f2b28e9c6 rust-common.bbclass: move musl-specific linking fix from rust-source.inc
This needs to be done for any item that is linked under rustc,
and not just rust itself. Latest python-cryptography exposes the issue.

(From OE-Core rev: 967d847a9815df43d0c92ca61cc544e1fe5dcc03)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d3811228747590ea06e8d68be4785d45ec9c478f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-20 12:10:40 -10:00
Changqing Li
ffe2b61053 erofs-utils: fix CVE-2023-33551/CVE-2023-33552
* CVE-2023-33551.patch is for fix CVE-2023-33551.
* CVE-2023-33552-3.patch is upstream patch for fix CVE-2023-33552, since
  the patch context is changed, CVE-2023-33552-1.patch and
  CVE-2023-33552-2.patch is backported.

(From OE-Core rev: 77b5c2f68ea0eef45e77936ce3e7caafa7bd3f54)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-20 12:10:40 -10:00
Yogita Urade
4c0213759a dmidecode: fix CVE-2023-30630
Dmidecode before 3.5 allows -dump-bin to overwrite a local file.
This has security relevance because, for example, execution of
Dmidecode via Sudo is plausible.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-30630
https://lists.nongnu.org/archive/html/dmidecode-devel/2023-04/msg00016.html
https://lists.nongnu.org/archive/html/dmidecode-devel/2023-04/msg00017.html

(From OE-Core rev: f92e59a0894145a828dc9ac74bf8c7a9355e0587)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-20 12:10:40 -10:00
Chee Yang Lee
02f1740351 python3-requests: fix CVE-2023-32681
(From OE-Core rev: 11b6e64c07df043441824511c931fb0bc9673adc)

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-20 12:10:40 -10:00
Changqing Li
e7242a885b dnf: only write the log lock to root for native dnf
From commit 742a1b7124, log_lock.pid is writen to root, but following
file is not changed, which will make it never deleted, and an unexpected
file exist in root dir after boot target.

$ tail  -n 1 etc/tmpfiles.d/dnf.conf
r /var/log/log_lock.pid

Besides, root dir may be read-only, so it is better still
keep the log_lock.pid under /var/log, only write the log lock to root
for native dnf for fixing issue mentioned in 742a1b7124

(From OE-Core rev: 207cc7acef40f92b5de306aa6f035258c0eec828)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:26 -10:00
Khem Raj
725d9c170d python3-bcrypt: Use BFD linker when building tests
Some of the tests use symbols from libpython3 e.g. PyBytes_FromStringAndSize
but does not add it to linker cmdline, its perhaps cargo which
should be fixed for that, this however is not something we can
fix in OE. So switch to using bfd linker explicitly when
building with ptests

(From OE-Core rev: 353b9c765218ed631fc14a406fcdfe1c36a8237b)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b4392ebb512fa48168a48fbff3e9140a8e1b7ec4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:26 -10:00
Chen Qi
2ed4fd70e4 rpm: write macros under libdir
If we create a macros file under etc/, the populate_sdk task would
fail if 'package-management' is in SDKIMAGE_FEATURES and nativesdk-rpm-build
is installed.. The error message is like below:

  unable to place /.../sdk/image/etc/rpm in final SDK location

This is because it's trying to move the etc/rpm dictory into the
host sysroot but the <host_sysroot>/etc/rpm has already exists.

To solve this problem, avoid creating /etc/rpm/macros for nativesdk-rpm-build,
use ${libdir}/macros instead. In this way, the macros file is hold
in nativesdk-rpm. As nativesdk-rpm-build depends on nativesdk-rpm,
the 'rpmbuild' command inside SDK can still correctly find find-debuginfo
binary.

(From OE-Core rev: 2a13a671910cad68ab962ce369b9ed60a9bf7eea)

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5fde0eadf16d34d88a599009013913fe55d89283)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:26 -10:00
Richard Purdie
e1e65f69c8 strace: Update patches/tests with upstream fixes
Replace the sockopt disable patch with a fix from upstream

(From OE-Core rev: c1beb73526e3ade75bd6dae5f9310107c50f1226)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ac921989991c319ecad01bec37c4ccaa15a7b58f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:25 -10:00
Richard Purdie
242dff550e strace: Merge two similar patches
Both patches change the same paths to gawk, merge them together
as we only need one patch for this.

(From OE-Core rev: 6080138fd0c27db7029b5a76e69b8dc241ad8dc3)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 79c0b18e29cad337640860f57683f0a170f6daab)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:25 -10:00
Alexander Kanavin
b1493fb1a8 gdb: upgrade 13.1 -> 13.2
Fixes:

 * PR testsuite/30158 (rustc testsuite fails with 13.1, apparently worked before with trunk 20230114 on i686-linux-gnu and powerpc64le-linux-gnu)

 * PR gdb/30214 (GDB 13.1 does not compile on FreeBSD 13.1)

 * PR gdb/30240 ((linux/aarch) thread.c:86: internal-error: inferior_thread: Assertion `current_thread_ != nullptr' failed)

 * PR gdb/30249 ([13 regression] hookpost-extended-remote will not work)

 * PR exp/30271 (Addresses of static thread_local fields are badly calculated sometimes)

 * PR symtab/30357 (Segmentation fault for the 'start' command)

 * PR symtab/30369 ([gdb/symtab] False match issue in skip_prologue_using_linetable)

 * PR gdb/30423 (Build failures with clang 16)

 * PR build/30450 (Build failure (linux-low.cc:5393:45: error: expected ':' before ')' token) with musl-1.2.4)

(From OE-Core rev: 900379776878c363ff7c802f6b740ee89661ea9c)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d10764916624f61d39cb9ea368359837156ad960)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:25 -10:00
Soumya
68b407ff94 perl: Fix CVE-2023-31484 & CVE-2023-31486
CPAN.pm before 2.35 does not verify TLS certificates when downloading
distributions over HTTPS.

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and
available standalone on CPAN, has an insecure default TLS
configuration where users must opt in to verify certificates.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-31484
https://nvd.nist.gov/vuln/detail/CVE-2023-31486

Upstream patches:
9c98370287
77f557ef84
a22785783b

(From OE-Core rev: f4fe9861d6aebd971a3120a0eb43f752c73ce2fb)

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-07 04:30:25 -10:00
Alexander Kanavin
4036c7097a qemu: a pending patch was submitted and accepted upstream
(From OE-Core rev: 13c9eba31a848450b1502c1677536ce42576ed08)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f59df55d63a8841c834bbc488589209e7f23f803)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-04 05:32:29 -10:00
Mingli Yu
3ee2522d8a python3-numpy: remove NPY_INLINE, use inline instead
The build fails when DEBUG_BUILD is enabled with GCC-13 as [1] and [2].

Fixes:
   | numpy/core/src/umath/simd.inc.src:977:20: note: called from here
   | 977 |     @vtype@ zeros = _mm512_setzero_@vsuffix@();
      |                    ^~~~~~~~~~~~~~~~~~~
   | numpy/core/src/umath/simd.inc.src:596:1: error: inlining failed in call to ‘always_inline’ ‘avx512_get_full_load_mask_ps’: target specific option mismatch
  596 | avx512_get_full_load_mask_ps(void)
      | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
   | numpy/core/src/umath/simd.inc.src:976:27: note: called from here
  976 |     @mask@ load_mask = avx512_get_full_load_mask_@vsuffix@();
      |                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   | /usr/lib/gcc/x86_64-redhat-linux/13/include/avx512fintrin.h:6499:1: error: inlining failed in call to ‘always_inline’ ‘_mm512_loadu_si512’: target specific option mismatch

Reference: 3947b1a023

[1] https://git.openembedded.org/openembedded-core/commit/?id=8596678667797971559aed962b1c204266032186
[2] http://errors.yoctoproject.org/Errors/Details/689841/

(From OE-Core rev: 77a64a8686b6c9ef3bc6adbce6cdc442096decfd)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-07-04 05:32:29 -10:00
Richard Purdie
87d4204dd3 strace: Disable failing test
This test is failing for uncertain reasons. We have reported upstream, disable
it until we can work out why this happened. The point it started failing is
unclear due to other test framework issues.

(From OE-Core rev: ef1b309ec04aa16020c6a8ca3939fb8eccca3edb)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 2e9165a854c7b83f163479e9dbd3cb183a9d71f5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-30 04:07:59 -10:00
Denys Dmytriyenko
550a303326 binutils: move packaging of gprofng static lib into common .inc
Commit f72fd51e0d (binutils: package static libs from gprofng) added
corresponding FILES:${PN}-staticdev entry to the main .bb recipe.
But binutils-cross-canadian fails with exactly the same QA issue,
hence move FILES:${PN}-staticdev to the common shared .inc file.

(From OE-Core rev: a4c3f22c93a944aef11bb8f2637f45c1d72d380c)

Signed-off-by: Denys Dmytriyenko <denys@konsulko.com>
Signed-off-by: Denys Dmytriyenko <denis@denix.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 75beddd33e132333c36ad067e2cf90edffeb5bf5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-30 04:07:59 -10:00
Sudip Mukherjee
c6a776870d dpkg: upgrade to v1.21.22
* Code internals:
    - libdpkg: Handle missing Version when formatting source:Upstream-Version.
      Reported by John Scott <email address hidden>.
  * Localization:
    - Add Portuguese scripts translations.
      Thanks to Américo Monteiro <email address hidden>. Closes: #1032562

(From OE-Core rev: eddc394e6ad88679b6cb8db30ccf9c8134ce87bf)

Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 56bdf69a06be21ea376303fbb4d50e9dd570cdbb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-30 04:07:59 -10:00
Ross Burton
2eef87a66b git: upgrade to 2.39.3
This minor point release fixes CVE-2023-25652 and CVE-2023-29007.

(From OE-Core rev: ebe205b32fd959b3d7281ec95ac7f7cf88e37ed2)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 469c28924ab9debe810e3277b27ad936781e7ce5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-30 04:07:59 -10:00
Ross Burton
f6ce5347c0 pkgconf: upgrade 1.9.4 -> 1.9.5
Changes from 1.9.4 to 1.9.5:
----------------------------

* Fix incorrect assumptions involving the use of ctype(3) functions.
  Patch by Taylor R Campbell.

* Fix detection of provided functions on autoconf.
  Patches by Harmen Stoppels.

* Fix deletion of tests/meson.build by the autoconf build system.
  Patch by h30032433.

* Fix quoting rules in argvsplit.c.
  Patch by huyubiao.

* Update libpkgconf documentation and documentation building scripts.
  Patches by Andrew Shadura.

* Enforce maximum package count correctly for --modversion.

(From OE-Core rev: 046e33769121aee169ffb6c790a880dc420a5a76)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fb9e05592e7c1c61a677d9cb842c9adc84689dde)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-30 04:07:59 -10:00
Sakib Sajal
24723a4904 go: Upgrade 1.20.4 -> 1.20.5
Upgrade to latest 1.20.x release:
go.git$ git log --oneline go1.20.4..go1.20.5
e827d41c0a (tag: go1.20.5) [release-branch.go1.20] go1.20.5
c0ed873cd8 [release-branch.go1.20] cmd/go: disallow package directories containing newlines
356a419e2f [release-branch.go1.20] cmd/go: enforce flags with non-optional arguments
fa60c381ed [release-branch.go1.20] cmd/go,cmd/cgo: in _cgo_flags use one line per flag
36144ba429 [release-branch.go1.20] runtime: implement SUID/SGID protections
5036ba77eb [release-branch.go1.20] net: skip TestFileFdBlocks if the "unix" network is not supported
b249ec5655 [release-branch.go1.20] cmd/go/internal: update documentation of go test and go generate
4b95fc1e6c [release-branch.go1.20] cmd/go: save checksums for go.mod files needed for go version lines
31a1e19a59 [release-branch.go1.20] net, os: net.Conn.File.Fd should return a blocking descriptor
450c8021a5 [release-branch.go1.20] runtime: change fcntl to return two values
22741120ee [release-branch.go1.20] runtime: consistently define fcntl
9270e3be8f [release-branch.go1.20] os: if descriptor is non-blocking, retain that in Fd method
600636e931 [release-branch.go1.20] crypto/rsa: use BoringCrypto for 4096 bit keys
afbe101950 [release-branch.go1.20] cmd/compile: fix bswap/load rewrite rules

(From OE-Core rev: 1234971eea7b07e89efaf20055ba9580fbe2cb08)

Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3ea1e9e9d7385c78bdd513e44cea5c36444529b2)
Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-30 04:07:59 -10:00
Sundeep KOKKONDA
769673babc gcc : upgrade to v12.3
gcc stable version upgraded from v12.2 to v12.3

Below is the bug fix list for v12.3
https://gcc.gnu.org/bugzilla/buglist.cgi?bug_status=RESOLVED&resolution=FIXED&target_milestone=12.3

(From OE-Core rev: 5aacf91e9839f60f5cb933e27a349c2ed7fcddf4)

Signed-off-by: Sundeep KOKKONDA <sundeep.kokkonda@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-30 04:07:59 -10:00
Ross Burton
6cd353ffe7 binutils: fix CVE-2023-1972
Backport a patch from upstream to fix CVE-2023-1972.

(From OE-Core rev: ebb15853372d28808189fc417409229ed051ad57)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 10d63933e3a30bfac2f6cec896460c22e04baadd)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-30 04:07:59 -10:00
Deepthi Hemraj
e009586ce8 binutils: stable 2.40 branch updates
Below commits on binutils-2.40 stable branch are updated.
0dc8f96598a Updated Swedish translation for the opcodes directory
85c5365527f New Georgian translation for the bfd sub-directory.

(From OE-Core rev: eeed062f7c9b3c615080678e7ad66d4906b01dc2)

Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-24 09:13:07 -10:00
Wang Mingyu
6bfec1ac8e libdnf: upgrade 0.70.0 -> 0.70.1
Changelog:
==========
 Add repoid to solver errors for RPMs (RhBug:2179413)
 Avoid using obsolete RPM API and drop redundant calls
 Remove DNF from list of protected packages

(From OE-Core rev: 04bc1d32ee1084f6c13ae20f21efb6c92c1c5e9c)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 965f0b5f50c2c1453d6e7d4f32091635c0ec1e49)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-24 09:13:07 -10:00
Ross Burton
b2cd8e22d2 ninja: ignore CVE-2021-4336, wrong ninja
(From OE-Core rev: 9201a3d766db1caaf020bd3cb7f4f70429b1a7e1)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c2dd2c13ff26c3f046e35a2f6b8afeb099ef422a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-24 09:13:07 -10:00
Martin Jansa
1c5de5342f qemu: remove unused qemu-7.0.0-glibc-2.36.patch
* it was removed from SRC_URI in:
  https://git.openembedded.org/openembedded-core/commit/?id=e94d182889ca3c02df913c59f0b66b228ffe588c

(From OE-Core rev: 9bd2cd7673c2c4d2c3c99b2caffff53521c1fc78)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 351c461859df02118e9fadb57320120dfbcd97eb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-21 06:50:51 -10:00
Martin Jansa
7b8d2c3c2e rpm: drop unused 0001-Rip-out-partial-support-for-unused-MD2-and-RIPEMD160.patch
* it was removed from SRC_URI in oe-core commit:
  commit 67257ca87c6fa8e6050a20ecea50daf834c7e869
  Author: Alexander Kanavin <alex.kanavin@gmail.com>
  Date:   Sat Apr 25 19:28:00 2020 +0200
  Subject: rpm: upgrade to 4.15.1

  and it's unused since then

(From OE-Core rev: c7324d03ebd58c247611a9955b6029bf66f05826)

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c801a215fb2d53bdec7f4c9a20ff7969e8071e5c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-06-14 04:14:25 -10:00