Commit Graph

67870 Commits

Author SHA1 Message Date
BELHADJ SALEM Talel
bdea205855 ref-manual: variables: add TOOLCHAIN_OPTIONS variable
(From yocto-docs rev: d7397a985fa085b4ca97aaebedfec5fcaf4e82de)

Signed-off-by: Talel BELHAJSALEM <bhstalel@gmail.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
BELHADJ SALEM Talel
bf5e50a353 ref-manual: variables: add RECIPE_SYSROOT and RECIPE_SYSROOT_NATIVE
(From yocto-docs rev: e4c3fd543cb1b98255dcd3b40819ebcc7ef3a52a)

Signed-off-by: Talel BELHAJSALEM <bhstalel@gmail.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
3fd3ed3b11 dev-manual: start.rst: remove obsolete reference
Remove a reference to a web resource which is clearly marked as obsolete.
Replace the unnecessarily verbose note by just links to the mentioned tools.

[YOCTO #15233]

(From yocto-docs rev: b2db385b859faa775f7c92072ba9bbeebb90e713)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
b5b18d155e brief-yoctoprojectqs: use new CDN mirror for sstate
Recommended instead of the Yocto Project mirror, because expected
to be faster. Make sure you only set one such mirror.

(From yocto-docs rev: 2c2dae48619f3e2a600fcdba7cd0dcb0bd313b75)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
CC: richard.purdie@linuxfoundation.org
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
BELHADJ SALEM Talel
c3032cebe7 dev-manual: layers: Add notes about layer.conf
As discussed before with Richard Purdie, the code supports this but the documentation does not.
Developers in general will not notice this or focus on it because they do not mess with the
layer.conf template file, but in my opinion I think more details can help.

(From yocto-docs rev: c4b94c24ff7e1b1609f9c7f0aebd24fd04d00ae9)

Signed-off-by: Talel BELHAJSALEM <bhstalel@gmail.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Quentin Schulz
955796ad7e ref-manual: variables: provide no-match example for COMPATIBLE_MACHINE
COMPATIBLE_MACHINE is used to forbid the use of a recipe or its packages
for a specific set of machines.

In some cases, it may make more sense to have the logic inverted and
have the recipe always forbidden except for hand-picked machines. Such
could be the case for pieces of software that only support some
architectures. In that scenario, it is sometimes a bit easier on the eye
and for maintenance to use the OVERRIDES mechanism but for that, a
default should be set.

COMPATIBLE_MACHINE:aarch64 = "^(aarch64)$"
COMPATIBLE_MACHINE:mips64 = "^(mips64)$"

wouldn't do much because if COMPATIBLE_MACHINE isn't set, the recipe is
assumed compatible and therefore, if no default is provided we enter
that case.

Hence, we need to add

COMPATIBLE_MACHINE = "^$"

as default so that it only matches the empty string, which isn't
possible for MACHINEOVERRIDES.

Cc: Quentin Schulz <foss+yocto@0leil.net>
(From yocto-docs rev: d66b53eebe5b2320ce12926b309e48c9e32523f3)

Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Robert P. J. Day
650980791e profile-manual: aesthetic cleanups
Various aesthetic cleanups of section 1 of that manual, including:

  * replace 'HOWTO' with manual
  * add more examples of sdk-related images
  * font fixes

(From yocto-docs rev: 3f271b53f2103c3a7eb76ab17f0c945512493471)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
BELHADJ SALEM Talel
0f23056836 ref-manual: Fix PACKAGECONFIG term and add an example
PACKAGECONFIG's first and second flag value will be added to PACKAGECONFIG_CONFARGS
and then it will be added to the appropriate variable (EXTRA_OECMAKE, or ...)
So we need to only mention PACKAGECONFIG_CONFARGS and it will lead to other variables.

I added a custom example that can help understanding very well PACKAGECONFIG.

(From yocto-docs rev: 94eb37ef56cbb19b5b6e28bef522a7288a1a61f9)

Signed-off-by: Talel BELHAJSALEM <bhstalel@gmail.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Paul Eggleton
6fd2902f05 dev/ref-manual: Document INIT_MANAGER
The INIT_MANAGER variable was added in 3.0 but it seems we didn't get
around to documenting it yet. I have added a variable glossary entry and
made the basic adjustment of the "Using systemd Exclusively" section in
the dev manual, however I think the latter section still needs work.

(From yocto-docs rev: a84adfaeda5a790275d020fc77d721e8560a5728)

Signed-off-by: Paul Eggleton <bluelightning@bluelightning.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Robert P. J. Day
720324bd18 dev-manual: new-recipe.rst: add missing parenthesis to "Patching Code" section
Add missing parenthesis, and another example of a compressed patch filename.

(From yocto-docs rev: febc0c6b7b5843c70ed01f9b2bda71c02091eae6)

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
6a3b428c7c bsp-guide: bsp: skip Intel machines no longer supported in Poky
(From yocto-docs rev: ab6a260de80e8a73079e1ac5430a3688be025d5d)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
c969a2456c sdk-manual: appendix-obtain: improve and update descriptions
- Improve text formatting
- Stop mentioning all possible values
- Update examples
- Correct descriptions

(From yocto-docs rev: d44cd995e4abc1bed57a7edbe27fdfd642768d4f)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
734069e81b dev-manual: wic: update "wic list images" output
(From yocto-docs rev: 46fdf58f4a26de2989261eb451380905ae0f1a41)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Michael Opdenacker
aaf748b95f manuals: update linux-yocto append examples
(From yocto-docs rev: b5d385f20d22566e12a7938a9894b86429f1dcfb)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Arne Schwerdt
811cf0320c ref-manual: Warn about COMPATIBLE_MACHINE skipping native recipes
(From yocto-docs rev: 48e5fb383570dc6a067b14cc621e4cb347db900c)

Signed-off-by: Arne Schwerdt <arne.schwerdt@elbbits.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:51 -10:00
Siddharth Doshi
a6f551f516 vim: Upgrade 9.0.2009 -> 9.0.2048
This includes CVE fix for CVE-2023-5535.

(From OE-Core rev: 7681436190354b5c5b6c3a82b3094badd81113de)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Siddharth Doshi
fb38c59633 libx11: Security Fix for CVE-2023-43785, CVE-2023-43786 and CVE-2023-43787
CVE's Fixed:
CVE-2023-43785: libX11: out-of-bounds memory access in _XkbReadKeySyms()
CVE-2023-43786: libX11: stack exhaustion from infinite recursion in PutSubImage()
CVE-2023-43787: libX11: integer overflow in XCreateImage() leading to a heap overflow

(From OE-Core rev: 8175d023c203d524d011d8947f90fbd02786c6db)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Meenali Gupta
386672ff8c linux-firmware: upgrade 20230625 -> 20230804
License-Update: additional firmwares

upgrade include fix for CVE-2023-20569 CVE-2022-40982 CVE-2023-20593

Changelog:
      https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/

References:
      https://nvd.nist.gov/vuln/detail/CVE-2023-20569
      https://nvd.nist.gov/vuln/detail/CVE-2022-40982
      https://nvd.nist.gov/vuln/detail/CVE-2023-20593

(From OE-Core rev: d3f1448246c9711f4f23f2e12c664e0ba3ae3f02)

Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Peter Marko
e06868eff3 zlib: patch CVE-2023-45853
Backport commit merged to develop branch from PR linked in NVD report:
* https://nvd.nist.gov/vuln/detail/CVE-2023-45853
* https://github.com/madler/zlib/pull/843

(From OE-Core rev: 6e265e44febbb6fdf85c7926b9a64b731c98d814)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Vijay Anusuri
024fa046fc gawk: backport Debian patch to fix CVE-2023-4156
Upstream-Status: Backport
[https://git.launchpad.net/ubuntu/+source/gawk/tree/debian/patches?h=ubuntu/jammy-security
&
https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212]

(From OE-Core rev: 0547b60d3485c2e3853e5a9e0a3e051882b283f3)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Lee Chee Yang
7725c28871 qemu: ignore RHEL specific CVE-2023-2680
(From OE-Core rev: a1256b8fa415002eee78427cc292b866570ee267)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-25 04:45:50 -10:00
Richard Purdie
b1c1d6d048 SECURITY.md: Add file
Add a SECURITY.md file with hints for security researchers and other
parties who might report potential security vulnerabilities.

(From meta-yocto rev: e3c11a51dc814fdd400998f50b17e572d453e1d2)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-24 05:28:15 -10:00
Marta Rybczynska
70f4bd1b3c bitbake: SECURITY.md: add file
Add a SECURITY.md file with hints for security researchers and other
parties who might report potential security vulnerabilities.

(Bitbake rev: 6c1ffa9091d0c53a100e8c8c15122d28642034bd)

Signed-off-by: Marta Rybczynska <marta.rybczynska@syslinbit.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-24 05:28:15 -10:00
Quentin Schulz
72ddfbc89a uboot-extlinux-config.bbclass: fix missed override syntax migration
uboot-extlinux-config allows to specify multiple "labels" (entries in a
menu, à-la grub) and each of them have their own values for some fields.
Each "base" variable, e.g. UBOOT_EXTLINUX_FDT can be overridden for each
label. This is done via the OVERRIDES mechanism based on the label name,
e.g. UBOOT_EXTLINUX_FDT:linux if linux is a label.

However, OVERRIDES doesn't contain the label globally because it's only
necessary in one task. Therefore, the OVERRIDES itself is modified
within the task. This means that the sigdata will not be told the
dependency on UBOOT_EXTLINUX_FDT:linux, because it cannot know about it.

For this reason, we need to explicitly specify which variables this task
depends on via vardeps varflag for the task.

This was done in the past, but we missed updating it during the override
syntax migration so the cache wouldn't get invalidated if someone
modifies UBOOT_EXTLINUX_FDT:linux from a configuration file or a
bbappend for example.

Let's fix this by migrating it to the new syntax.

(From OE-Core rev: 5570e49791b770271f176a4deeb5f6f1a028cb4a)

Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b4dd9d873508128adbbf5ff6cf0a3df3d2ffbcf6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:36 -10:00
Siddharth Doshi
36a2a0129a libxpm: upgrade to 3.5.17
This release fixes the following CVEs:

- CVE-2023-43788
- CVE-2023-43789

(From OE-Core rev: 1475a47239d77a368bcec69f12e5a63f8bebe14f)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:36 -10:00
Siddharth Doshi
6da1e21e9a tiff: Security fix for CVE-2023-40745
Upstream-Status: Backport from [4fc16f649f]
CVE: CVE-2023-40745
(From OE-Core rev: f1aa2dd493c01e18ee0f534ff00523a1274f9066)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:36 -10:00
Hitendra Prajapati
24e9fed15a libtiff: Add fix for tiffcrop CVE-2023-1916
Add fix for tiffcrop tool CVE-2023-1916 [1].

A flaw was found in tiffcrop, a program distributed by the libtiff
package. A specially crafted tiff file can lead to an out-of-bounds
read in the extractImageSection function in tools/tiffcrop.c, resulting
in a denial of service and limited information disclosure. This issue
affects libtiff versions 4.x.

The tool is no longer part of newer libtiff distributions, hence the
fix is rejected by upstream in [2]. The backport is still applicable
to older versions of libtiff, pick the CVE fix from ubuntu 20.04 [3].

[1] https://nvd.nist.gov/vuln/detail/CVE-2023-1916
[2] https://gitlab.com/libtiff/libtiff/-/merge_requests/535
[3] https://packages.ubuntu.com/source/focal-updates/tiff

(From OE-Core rev: 4d3e7f9a157e56a4a8ffb4d16fd6401a22851307)

Signed-off-by: Marek Vasut <marex@denx.de>

Upstream-Status: Backport from 848434a81c && https://gitlab.com/libtiff/libtiff/-/merge_requests/535
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:36 -10:00
Armin Kuster
f550a63161 binutils: CVE-2022-48063
Source: Binutils
MR: 128800
Type: Security Fix
Disposition: Backport from https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75393a2d54bcc40053e5262a3de9d70c5ebfbbfd
ChangeID: ab04e4ec62d054c90d94f82230adb2342ce1ee1b
Description:

Affects binutils < 2.40

(From OE-Core rev: 80a8d16a4038868469b4583404b6f73e12bae0f1)

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:36 -10:00
Deepthi Hemraj
8391218990 binutils: Fix CVE-2022-47011
(From OE-Core rev: 5ff2e3c880705c2e920a4a61a5165810fadd7b84)

Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:35 -10:00
Deepthi Hemraj
bdcc4c9909 binutils: Fix CVE-2022-47008
(From OE-Core rev: 3a299d1610bf085790017569de090b0a41cf809b)

Signed-off-by: Deepthi Hemraj <Deepthi.Hemraj@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:35 -10:00
Chaitanya Vadrevu
4b721dc5c8 binutils: Mark CVE-2022-47696 as patched
(From OE-Core rev: bc480221d8091be460a1b8c4d023b9841e1df3c2)

Signed-off-by: Chaitanya Vadrevu <chaitanya.vadrevu@ni.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:35 -10:00
Chaitanya Vadrevu
455b08d0a9 binutils: Mark CVE-2022-47673 as patched
(From OE-Core rev: 96fe4b522a35f75a7d2b597d7e650dfc7ae82e27)

Signed-off-by: Chaitanya Vadrevu <chaitanya.vadrevu@ni.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:35 -10:00
Chaitanya Vadrevu
4537f28311 binutils: Fix CVE-2022-47695
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=3d3af4ba39e892b1c544d667ca241846bc3df386]

(From OE-Core rev: 4d4732c2e295fea610d266fa12bae3cc01f93dfa)

Signed-off-by: Chaitanya Vadrevu <chaitanya.vadrevu@ni.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-21 05:21:35 -10:00
Lee Chee Yang
47d212a57f migration-guides: add release notes for 4.0.13
(From yocto-docs rev: 9a03e60370bb4f10fa340c1e29cd743e5703653b)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Joshua Watt
a721e0f85b overview: Add note about non-reproducibility side effects
Adds an additional note about some of the side effects that can occur if
recipes are not reproducible and hash equivalence is enabled.

(From yocto-docs rev: aaf3e97c78e235bf3042c79ecdcf0b7c1a68ca8f)

Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Trevor Gamblin
fbf88236e3 dev-manual: fix testimage usage instructions
The proper way to inherit the testimage class is now

IMAGE_CLASSES += "testimage"

so change lines with 'INHERIT += "testimage"' to match. This makes the
dev-manual consistent with the migration guide, which already specifies
that the old way causes an error.

(From yocto-docs rev: 40d82ec5f55c2353ef6f052e8460a6003fd903f4)

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>
Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Michael Opdenacker
7b43af7ad4 ref-manual: releases.svg: Scarthgap is now version 5.0
According to https://wiki.yoctoproject.org/wiki/Releases

(From yocto-docs rev: 1ce820adce0d9ca4eb6457dc089d55a0cec8c266)

Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Khem Raj
f989613808 apt: add missing <cstdint> for uint16_t
(From OE-Core rev: 2572b32e729831762790ebfbf930a1140657faea)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8c46ded67df2d830c8bbf5f7b82d75db81d797e2)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Lee Chee Yang
3f174130d3 python3-urllib3: 1.26.15 -> 1.26.17
1.26.17 (2023-10-02)
Added the Cookie header to the list of headers to strip from requests
when redirecting to a different host. As before, different headers can
be set via Retry.remove_headers_on_redirect. (CVE-2023-43804)

1.26.16 (2023-05-23)
Fixed thread-safety issue where accessing a PoolManager with many
distinct origins would cause connection pools to be closed while
requests are in progress (#2954)

(From OE-Core rev: 27a1de55a46b7b313eb2a6370e9d779a7cd49154)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Wang Mingyu
43e36aec34 python3-urllib3: upgrade 1.26.14 -> 1.26.15
Changelog:
==========
* Fix socket timeout value when "HTTPConnection" is reused ('#2645 <https://github.com/urllib3/urllib3/issues/2645>'__)
* Remove "!" character from the unreserved characters in IPv6 Zone ID parsing
  ('#2899 <https://github.com/urllib3/urllib3/issues/2899>'__)
* Fix IDNA handling of '\x80' byte ('#2901 <https://github.com/urllib3/urllib3/issues/2901>'__)

(From OE-Core rev: a335ccbcc9913e79bfe958c41690b7efa189ae93)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8e062efbac29a81831c3060bcae601dc533d65dd)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Tim Orling
c0b54da555 python3-urllib3: upgrade 1.26.13 -> 1.26.14
https://github.com/urllib3/urllib3/blob/1.26.14/CHANGES.rst#12614-2023-01-11

1.26.14 (2023-01-11)
    Fixed parsing of port 0 (zero) returning None, instead of 0. (#2850)
    Removed deprecated getheaders() calls in contrib module.

(From OE-Core rev: aefb7af6b56269d45170beb99e6c878bf2448b78)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 55ab1bf20e6893088acb6460e9004dac8e205559)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Alexander Kanavin
cc936073a4 python3-urllib3: upgrade 1.26.12 -> 1.26.13
(From OE-Core rev: e8ae3247795d9333f6252bbec85a8e09c0c9cb48)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b18552f69a2eb8900981a10ba386dc4f862b29c3)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
wangmy
36e8271ca0 python3-urllib3: upgrade 1.26.11 -> 1.26.12
(From OE-Core rev: 69a610b440b5e9e92931e43bd1c75230bb99f03e)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit cb05578af3ace6e3983f93e16d9ad1ac2a65fbe2)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Alexander Kanavin
49ebeb4b0d python3-urllib3: upgrade 1.26.10 -> 1.26.11
(From OE-Core rev: d83b4afc17839b6c11b540aabf056647ddacb587)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit dbe07ff87e2cb1a8276e69a43c7cdbb9ae6e5493)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
wangmy
73d81d2908 python3-urllib3: upgrade 1.26.9 -> 1.26.10
Add dependence python3-logging.

Changelog:
=========
* Removed support for Python 3.5
* Fixed an issue where a "ProxyError" recommending configuring the proxy as HTTP
  instead of HTTPS could appear even when an HTTPS proxy wasn't configured.

(From OE-Core rev: d9f200b931e48d957b721005f0140ef3fff55af3)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a8a26a92dfe367472daf086a33a1b30ff6d17540)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Siddharth Doshi
9d5d4218ec vim: Upgrade 9.0.1894 -> 9.0.2009
This includes CVE fix for CVE-2023-5441.

(From OE-Core rev: 6c88137d4ab36054ac97cff0457d78ef503f383e)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Yash Shinde
e77b551dbf binutils: Fix CVE-2022-45703
(From OE-Core rev: b2fa5b29462a16b238f8a6a40886b45aa483e963)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Yash Shinde
600b508c37 binutils: Fix CVE-2022-44840
(From OE-Core rev: 7a42ae332ebde565cc7c6fca568563f076bd26ba)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Hitendra Prajapati
2a2ea5ac75 xdg-utils: Fix CVE-2022-4055
Upstream-Status: Backport from f67c4d1f8b

(From OE-Core rev: fc4eecb6143b2b32a374388248b41c1d95b33968)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00
Hitendra Prajapati
de59761cbb libtiff: fix CVE-2022-40090 improved IFD-Loop handling
Upstream-Status: Backport from c7caec9a4d

(From OE-Core rev: 1effa609b5b527eb9afa5a2c529bdc0b317e4be0)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-18 05:13:24 -10:00