Commit Graph

67351 Commits

Author SHA1 Message Date
Yann E. MORIN
5c7130f970 doc/manual: fix formatting slightly
Signed-off-by: Thierry GUIBERT <thierry.guibert@croix-rouge.fr>
[yann.morin.1998@free.fr: split off the previous patch by Thierry]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4468f82885)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-23 12:28:12 +02:00
Thierry GUIBERT
7e86856d69 doc/manual: add documentation about docker registry on gitlab.com
Add a paragraph and an example about using the Buildroot image registry
hosted on gtilab.com, for people who want to build their own image based
on the offical one.

Signed-off-by: Thierry GUIBERT <thierry.guibert@croix-rouge.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d9228faa4d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-23 12:28:06 +02:00
Fabrice Fontaine
8e4bf44aad package/poppler: fix introspection build
Fix the following build failure raised since commit
9d1d4818c3:

[ 98%] Generating Poppler-0.18.typelib
Could not find GIR file 'GObject-2.0.gir'; check XDG_DATA_DIRS or use --includedir
error parsing file /home/giuliobenetti/autobuild/run/instance-1/output-1/build/poppler-21.12.0/glib/Poppler-0.18.gir: Failed to parse included gir GObject-2.0
If the above error message is about missing .so libraries, then setting up GIR_EXTRA_LIBS_PATH in the .mk file should help.
Typically like this: PKG_MAKE_ENV += GIR_EXTRA_LIBS_PATH="$(@D)/.libs"

Fixes:
 - http://autobuild.buildroot.org/results/d2f50aa56410c2fff8a0538c57038104906e747e

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr:
  - drop patch adding INTROSPECTION_COMPILER_ARGS as it's now upstream
    as of 22.02.0, and we use 22.10.0
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4466c20621)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-23 11:57:59 +02:00
Giulio Benetti
cec14f3328 package/mali-driver: bump to version 2023-04-04
This versions fixed build failure on Linux 6.1

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b713a230c5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-23 11:45:41 +02:00
Vincent Fazio
d2b0ce01ba docs/manual: rewrite section for upstream documentation
Previously, the documentation only requested links to upstream commits
when backporting patches.

Based on a mailing list discussion [0], patches should, when possible
and when approriate, provide a link as evidence that the patch has been
submitted upstream.

The motivation is that hopefully the patch gets applied to upstream at
some point reducing the long term maintenance burden within Buildroot.
This also makes future patch review on subsequent package version bumps
more streamlined.

For patches that are unique to BR and do not apply to the upstream
repository, patches should have a comment explaining why they do not
apply upstream.

[0] https://lists.buildroot.org/pipermail/buildroot/2023-March/666000.html

Signed-off-by: Vincent Fazio <vfazio@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5b00b40a05)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-23 11:42:19 +02:00
Sergey Matyukevich
f87fe6d419 package/xr819-xradio: bump version
With introduction of vmap'ed stacks to ARM in Linux v5.18, stack
parameters can no longer be used for DMA. So pull the latest xradio
changes that fix the driver and make it work with vmap'ed stacks
in new kernels.

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 53baedf912)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-23 11:39:32 +02:00
Stefan Ott
6b82c00c5d package/eudev: fix compile-time issue with very old kernel headers
Kernel versions prior to 3.4 did not have V4L2_CAP_DEVICE_CAPS and
compiling against such a kernel will fail.

This patch introduces a version check and makes eudev fall back to
v2cap.capabilities on these kernels.

Signed-off-by: Stefan Ott <stefan@ott.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8f646eb2a1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-23 11:21:59 +02:00
Peter Seiderer
02b2c66ffc package/nginx: change project and download URL to https
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5b4eaa635f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-23 11:08:57 +02:00
James Hilliard
f29a5497f5 package/pkg-cargo: ensure host/target rustflags are properly split
In Cargo, it is quite typical for "build scripts" to be written in Rust
and therefore they need to be compiled as part of the overall build. In
cross-compilation, that means a mixed host and target build.

Unfortunately, by default Cargo makes no distinction between the
RUSTFLAGS used for the host and the target. There is, however, an
unstable feature to make this distinction [1][2].

We already have CARGO_TARGET_APPLIES_TO_HOST="false". This makes sure
that any configuration that we make for the target doesn't automatically
apply to the host as well. However, this only applies for per-target
configuration, for example the setting of "cc" in the config.toml
generated by package/rust/rust.mk. Flags that are passed with RUSTFLAGS
still apply to both host and target. Therefore, we need to use the
CARGO_TARGET_<tuple>_RUSTFLAGS environment variable instead of plain
RUSTFLAGS.

This, however, doesn't allow us to specify flags that apply only to the
host. We could use CARGO_TARGET_<hosttuple>_RUSTFLAGS for that, but that
doesn't work in case the host and target tuple are the same. For this,
we need another unstable feature, enabled with
CARGO_UNSTABLE_HOST_CONFIG="true". With this enabled, we can specify
flags that apply only for the host build using CARGO_HOST_RUSTFLAGS.

Currently, we don't have any such flags, but we really should: we should
pass the proper link flags to point to $(HOST_DIR)/lib. Therefore, add
CARGO_HOST_RUSTFLAGS doing exactly that.

[1] https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#host-config
[2] https://github.com/rust-lang/cargo/pull/10395

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit b40a2cc391)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-23 11:02:31 +02:00
Vincent Fazio
aa658bec37 utils/check-package: drop six usage
The shebang in check-package now defines python3. There is no longer a
need to maintain support with python 2.x.

See-also: 02b165dc71 (check-package: fix Python3 support)

Signed-off-by: Vincent Fazio <vfazio@gmail.com>
Tested-by: James Knight <james.d.knight@live.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b7d4ae98fa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-22 23:08:32 +02:00
Francois Perrad
410c9f01ed configs/olimex_a20_olinuxino_lime*: configure eth0 with DHCP
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 370af35425)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-22 23:06:26 +02:00
Francois Perrad
7660792c1e configs/olimex_a20_olinuxino_lime*: bump Linux and U-Boot
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9177186711)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-22 23:06:14 +02:00
Arnout Vandecappelle
2554f30194 package/efivar: don't install in $(HOST_DIR)/usr
For years already, $(HOST_DIR)/usr is deprecated. Install directly in
$(HOST_DIR). This will trigger a check-package error in the following
commit.

Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 47910ccc36)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-22 22:14:54 +02:00
James Hilliard
6ce7cd546b package/pkg-cargo: set RUSTFLAGS for host in HOST_PKG_CARGO_ENV
Move RUSTFLAGS for host builds to HOST_PKG_CARGO_ENV so that they
are set for host cargo builds which don't use the cargo infrastructure,
e.g. python packages that include rust code.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit d775b2ac05)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-22 22:06:54 +02:00
Julien Olivain
8716d50651 package/fluidsynth: bump to version 2.3.2
For change log since v2.3.1, see:
- https://github.com/FluidSynth/fluidsynth/releases/tag/v2.3.2

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 15a649fd2d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-22 22:02:52 +02:00
Simon Rowe
b649f233ea package/mdadm: install udev rules
mdadm contains various udev rules to manage RAID assembly and create
symlinks, install them if udev (or equivalent) is enabled.

Signed-off-by: Simon Rowe <simon.rowe@nutanix.com>
[Arnout: use MDADM_INSTALL_TARGET_OPTS for install-bin as well]
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 0385719706)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-22 21:59:35 +02:00
James Hilliard
d9c4e693a1 package/{rust, rust-bin}: bump to version 1.67.1
Link to Rust 1.67.1 announcement: https://blog.rust-lang.org/2023/02/09/Rust-1.67.1.html

Drop patch which is now upstream.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 792f197517)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-11 14:32:52 +02:00
Joachim Wiberg
5a8b764cd8 package/libite: bump version to v2.5.3
Fixes, from https://github.com/troglobit/libite/releases/tag/v2.5.3

 - rsync() does not copy single files correctly
 - copyfile() does not handle empty source files correctly (error)
 - copyfile() does not properly create destination dir

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit be44dcf695)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-11 14:19:26 +02:00
Dario Binacchi
644110a921 configs/stm32f469_disco_sd_defconfig: explicitly set U-Boot version
The version of U-Boot must be explicitly set because if you keep the
default setting, the bootloader is continuously updated in buildroot with
the risk of building a non-working image.

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 924b163b1e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-11 14:16:46 +02:00
Giulio Benetti
8c84c53a15 package/matio: fix build failure due to gcc bug 99410
The matio package exhibits gcc bug 99410 when built for the Nios2
architecture with optimization enabled, which causes a build failure.

As done for other packages in Buildroot work around this gcc bug by
setting optimization to -O0 if BR2_TOOLCHAIN_HAS_GCC_BUG_99410=y.

Fixes:
http://autobuild.buildroot.net/results/971/9714160b80a0d1a01983d29af38a95049c07b4d3/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 97f8cc355b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-11 14:11:10 +02:00
Christian Stewart
8d44a0369d package/go: security bump to version 1.19.8
go1.19.8 (released 2023-04-04) includes security fixes to the go/parser,
html/template, mime/multipart, net/http, and net/textproto packages, as well as
bug fixes to the compiler, the linker, the runtime, and the time package.

Fixes security vulnerabilities:

go/parser: infinite loop in parsing (CVE-2023-24537)

html/template: backticks not treated as string delimiters (CVE-2023-24538)

net/http, net/textproto: denial of service from excessive memory
allocation (CVE-2023-24534)

net/http, net/textproto, mime/multipart: denial of service from excessive
resource consumption (CVE-2023-24536)

https://go.dev/doc/devel/release#go1.19.8
https://github.com/golang/go/issues?q=milestone%3AGo1.19.8+label%3ACherryPickApproved

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b7eaa9af7b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 23:30:37 +02:00
Stefan Agner
e0b0380de4 package/docker-cli: bump version to v23.0.3
This release contains some fixes and small improvements. For the
full list see:
https://github.com/moby/moby/releases/tag/v23.0.3

Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0d8d348826)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 23:11:45 +02:00
Stefan Agner
dacc6751f5 package/docker-engine: security bump version to v23.0.3
Fixed a number of issues that can cause Swarm encrypted overlay networks
to fail to uphold their guarantees, addressing CVE-2023-28841,
CVE-2023-28840, and CVE-2023-28842.

https://github.com/moby/moby/releases/tag/v23.0.3

Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 238d494687)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 23:11:32 +02:00
Stefan Agner
2689e6974a package/containerd: security bump to version 1.6.20
Various bugfixes and improvements. Noteable security fixes:

- CVE-2023-25153: Fix OCI image importer memory exhaustion
  https://github.com/containerd/containerd/security/advisories/GHSA-259w-8hf6-59c2

- CVE-2023-25173: Fix supplementary groups not being set up properly
  https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p

https://github.com/containerd/containerd/releases/tag/v1.6.20

Signed-off-by: Stefan Agner <stefan@agner.ch>
[Peter: add CVE references]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8bf66c5640)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:43:11 +02:00
Waldemar Brodkorb
f7c17b3e02 package/uclibc: security update to 1.0.43
Security fix for CVE-2022-29503

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f12bf2e6a7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:34:34 +02:00
Stefan Agner
901031eecc package/docker-cli: bump version to v23.0.2
This release contains some fixes and small improvements. For the
full list see:
https://github.com/moby/moby/releases/tag/v23.0.2

Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 413a28940b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:33:03 +02:00
Stefan Agner
75a10d935f package/docker-engine: security bump version to v23.0.2
Fixes the following security issue:

- CVE-2023-26054: (Buildkit): Credentials inlined to Git URLs could end up
  in provenance attestation
  https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc

In addition, a number of issues have been fixed. For the full list, see:
https://github.com/moby/moby/releases/tag/v23.0.2

Signed-off-by: Stefan Agner <stefan@agner.ch>
[Peter: Mark as security bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cebd1389f4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:32:55 +02:00
Christian Stewart
69d1d353d3 package/runc: security bump to version v1.1.5
This is the fifth patch release in the 1.1.z series of runc, which fixes
three CVEs found in runc.

CVE-2023-25809 is a vulnerability involving rootless containers where
(under specific configurations), the container would have write access to the
/sys/fs/cgroup/user.slice/... cgroup hierarchy. No other hierarchies on the host
were affected. This vulnerability was discovered by Akihiro Suda.
GHSA-m8cg-xc2p-r3fc

CVE-2023-27561 was a regression which effectively re-introduced CVE-2019-19921.
This bug was present from v1.0.0-rc95 to v1.1.4. This regression was discovered
by Beuc. GHSA-vpvm-3wq2-2wvm

CVE-2023-28642 is a variant of CVE-2023-27561 and was fixed by the same patch.
This variant of the above vulnerability was reported by Lei Wang.
GHSA-g2j6-57v7-gm8c

In addition, the following other fixes are included in this release:

 - Fix the inability to use /dev/null when inside a container
 - Fix changing the ownership of host's /dev/null caused by fd redirection
 - Fix rare runc exec/enter unshare error on older kernels, including CentOS < 7.7
 - nsexec: Check for errors in write_log()

https://github.com/opencontainers/runc/releases/tag/v1.1.5

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 52976c54f7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:30:54 +02:00
Fabrice Fontaine
3f359328bb package/snmppp: fix build without SNMPV3
Fix the following build failure without BR2_PACKAGE_SNMPPP_SNMPV3 raised
since bump to version 3.5.0 in commit
e011fa0415:

msgqueue.cpp: In member function 'int Snmp_pp::CSNMPMessage::ResendMessage()':
msgqueue.cpp:263:34: error: 'version3' was not declared in this scope; did you mean 'version1'?
  263 |   if (m_target->get_version() == version3) {
      |                                  ^~~~~~~~
      |                                  version1

Fixes:
 - http://autobuild.buildroot.org/results/8ef3e4407a51c53c15e530606227338761dd905b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a45f2af7fa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:28:40 +02:00
Peter Seiderer
e660b4fe42 package/flann: needs C++11 support
Fixes:

  - http://autobuild.buildroot.net/results/c92a3df1bc73e00e1e4493500bfb7277cf5064ee

  .../build/flann-1.9.2/src/cpp/flann/util/lsh_table.h:367:5: error: 'random_device' is not a member of 'std'
     std::random_device rd;
     ^

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 16cd9494ba)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:26:13 +02:00
Luca Ceresoli
5380a3f3ae docs/manual: ditch redundant -f 'rm' flag
The value of the RM variable in make is 'rm -f' [0], thus the additional
-f is redundant. Avoid it on the docs to avoid developers taking it as a
good example to follow.

[0] https://www.gnu.org/software/make/manual/make.html#index-RM

Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9a3d4e3818)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:23:28 +02:00
Luca Ceresoli
61acdc6047 package/linux-tools: perf: ditch redundant -f 'rm' flag
The value of the RM variable in make is 'rm -f' [0], thus the additional
-f is redundant.

[0] https://www.gnu.org/software/make/manual/make.html#index-RM

Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 37e63bb2c9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:23:23 +02:00
Peter Seiderer
9d215d42b9 package/zerofree: fix double space in Config.in comment
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 05d3fdfd13)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:19:33 +02:00
Peter Seiderer
786756e423 package/osm2pgsql: fix double space in Config.in comment
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9611a3b323)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:19:28 +02:00
Peter Seiderer
737d221753 package/libosmium: fix double space in Config.in comment
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e81ca40516)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:19:19 +02:00
Peter Seiderer
8406e06af3 package/lcdproc: fix double space in Config.in comment
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2b2a679dfb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:19:17 +02:00
Peter Seiderer
de6e600859 package/protozero: fix double space in Config.in comment
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0472287484)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:18:35 +02:00
Peter Seiderer
a23d06e96c package/openssh: security bump to version 9.3p1
From [1]:

 * sshd(8): fix a pre-authentication double-free memory fault
   introduced in OpenSSH 9.1. This is not believed to be exploitable,
   and it occurs in the unprivileged pre-auth process that is
   subject to chroot(2) and is further sandboxed on most major
   platforms.

 * ssh(8): in OpenSSH releases after 8.7, the PermitRemoteOpen option
   would ignore its first argument unless it was one of the special
   keywords "any" or "none", causing the permission list to fail open
   if only one permission was specified. bz3515

 * ssh(1): if the CanonicalizeHostname and CanonicalizePermittedCNAMEs
   options were enabled, and the system/libc resolver did not check
   that names in DNS responses were valid, then use of these options
   could allow an attacker with control of DNS to include invalid
   characters (possibly including wildcards) in names added to
   known_hosts files when they were updated. These names would still
   have to match the CanonicalizePermittedCNAMEs allow-list, so
   practical exploitation appears unlikely.

From [2]:

* ssh-add(1): when adding smartcard keys to ssh-agent(1) with the
   per-hop destination constraints (ssh-add -h ...) added in OpenSSH
   8.9, a logic error prevented the constraints from being
   communicated to the agent. This resulted in the keys being added
   without constraints. The common cases of non-smartcard keys and
   keys without destination constraints are unaffected. This problem
   was reported by Luci Stanescu.

 * ssh(1): Portable OpenSSH provides an implementation of the
   getrrsetbyname(3) function if the standard library does not
   provide it, for use by the VerifyHostKeyDNS feature. A
   specifically crafted DNS response could cause this function to
   perform an out-of-bounds read of adjacent stack data, but this
   condition does not appear to be exploitable beyond denial-of-
   service to the ssh(1) client.

   The getrrsetbyname(3) replacement is only included if the system's
   standard library lacks this function and portable OpenSSH was not
   compiled with the ldns library (--with-ldns). getrrsetbyname(3) is
   only invoked if using VerifyHostKeyDNS to fetch SSHFP records. This
   problem was found by the Coverity static analyzer.

[1] https://www.openssh.com/txt/release-9.2
[2] https://www.openssh.com/txt/release-9.3

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 68ca5f1e1f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:07:30 +02:00
Fabrice Fontaine
2bc49f4cb2 package/sudo: security bump to version 1.9.13p3
- Fix CVE-2023-27320: Sudo before 1.9.13p3 has a double free in the
  per-command chroot feature.
- Update patch
- Update hash of LICENSE.md (year and indentation updated:
  dd934d6a21
  e5634ae991)

https://www.sudo.ws/security/advisories/double_free
https://www.sudo.ws/releases/stable/#1.9.13p3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 556c32264c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:03:49 +02:00
Fabrice Fontaine
1bf2cdc30c package/python-web2py: security bump to version 2.23.1
Fix CVE-2023-22432: Open redirect vulnerability exists in web2py
versions prior to 2.23.1. When using the tool, a web2py user may be
redirected to an arbitrary website by accessing a specially crafted URL.
As a result, the user may become a victim of a phishing attack.

https://github.com/web2py/web2py/compare/v2.23.0...v2.23.1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 11f8c11dfb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-10 21:00:28 +02:00
Fabrice Fontaine
c7dee88ef0 package/agentpp: security bump to version 4.6.0
- Fixed (security) [APP-70]: Memory leak in MibLeaf::set if same OID is set
  twice in the same PDU.
- Fix the following build failure raised since bump of snmppp to version
  3.5.0 in commit e011fa0415:

snmp_pp_ext.cpp: In member function 'int Agentpp::Snmpx::send(const Agentpp::Pdux&, Snmp_pp::SnmpTarget*)':
snmp_pp_ext.cpp:1172:47: error: binding reference of type 'Snmp_pp::Pdu&' to 'const Snmp_pp::Pdu' discards qualifiers
 1172 |     status = snmpmsg.loadv3(Snmp::get_mpv3(), pdu, engine_id, security_name,
      |

Fixes:
 - http://autobuild.buildroot.net/results/d7347b8b3953596b66da6ca6d85f084fb427934c

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5f06ecf5e1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-08 21:59:27 +02:00
Fabrice Fontaine
35485b3d10 package/snmppp: security bump to version 3.5.0
- Improved (security): Avoid timing attacks on authentication
  verification.
- Drop patch (already in version)

https://www.agentpp.com/download/changes_snmp++v3.txt

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e011fa0415)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-08 21:59:21 +02:00
Fabrice Fontaine
71655041dc package/vim: security bump to version 9.0.1414
Fix CVE-2023-1127, CVE-2023-1170, CVE-2023-1175, CVE-2023-1264 and
CVE-2023-1355

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 31a0d92bf3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-08 21:48:12 +02:00
Fabrice Fontaine
021eba76f0 package/wireshark: security bump to version 4.0.4
Fix CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash in Wireshark
4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet
injection or crafted capture file

https://www.wireshark.org/security/wnpa-sec-2023-08.html
https://www.wireshark.org/news/20230302.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9d39b2aed2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-08 21:44:32 +02:00
Fabrice Fontaine
373b98b5a8 package/libmicrohttpd: security bump to version 0.9.76
Fix CVE-2023-27371: GNU libmicrohttpd before 0.9.76 allows remote DoS
(Denial of Service) due to improper parsing of a multipart/form-data
boundary in the postprocessor.c MHD_create_post_processor() method. This
allows an attacker to remotely send a malicious HTTP POST packet that
includes one or more '\0' bytes in a multipart/form-data boundary field,
which - assuming a specific heap layout - will result in an
out-of-bounds read and a crash in the find_boundary() function.

https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg00000.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3b645ffda6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-08 21:42:58 +02:00
ʎɐH ǝʌǝʇS
76b6da9d4f package/ca-certificates: bump version to 20230311
The impetus for this change was that wget fails to load pages signed by
Let's Encrypt due to missing root certs. This version has the updated and
correct certs.

0002-mozilla-certdata2pem.py-Fix-compat-with-cryptography.patch

Patch dropped because the fix is incorporated upstream.

Signed-off-by: Steve Hay <me@stevenhay.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9f5c8bd430)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-08 21:35:34 +02:00
Giulio Benetti
898f7adcb1 package/rtl8189fs: bump to version 2023-03-13 on branch rtl8189fs
rtl8189fs branch is specific for rtl8189fs controller and diverged from
master so let's switch branch from master to rtl8189s to fix runtime
failure.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Tested-by: Indrek Kruusa <indrek.kruusa@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5b1e431500)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-04-08 21:34:34 +02:00
Lang Daniel
971bf1f768 package/bluez5_utils: fix SysV init script
- Use daemon name (bluetoothd) as file name.
- Script doesn't need to be executable.

Signed-off-by: Daniel Lang <d.lang@abatec.at>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 456204e7e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-03-20 10:03:40 +01:00
Peter Seiderer
91d669e7a0 package/qt6base: network module needs libopenssl PSK feature
Fixes:

  - http://autobuild.buildroot.net/results/fdf2b2eb252a24e81bddad1c81c4fdfb03dc0afe

  .../build/qt6base-6.4.2/src/plugins/tls/openssl/qdtls_openssl.cpp: In member function 'bool dtlsopenssl::DtlsState::initCtxAndConnection(QDtlsBasePrivate*)':
  .../build/qt6base-6.4.2/src/plugins/tls/openssl/qdtls_openssl.cpp:669:9: error: 'q_SSL_set_psk_server_callback' was not declared in this scope; did you mean 'q_SSL_set_psk_use_session_callback'?
    669 |         q_SSL_set_psk_server_callback(newConnection.data(), dtlscallbacks::q_PSK_server_callback);
        |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        |         q_SSL_set_psk_use_session_callback
  .../build/qt6base-6.4.2/src/plugins/tls/openssl/qdtls_openssl.cpp:671:9: error: 'q_SSL_set_psk_client_callback' was not declared in this scope; did you mean 'q_SSL_set_info_callback'?
    671 |         q_SSL_set_psk_client_callback(newConnection.data(), dtlscallbacks::q_PSK_client_callback);
        |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        |         q_SSL_set_info_callback

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 971ae7b266)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-03-20 09:42:19 +01:00
Julien Olivain
9581a99263 package/linux-tools/S10hyperv: fix shellcheck warnings
When running "make check-package" on a system with shellcheck 0.9.0,
the command fails with output:

    make check-package
    package/linux-tools/S10hyperv:0: run 'shellcheck' and fix the warnings
    ...
    2 warnings generated

This commit fixes the warnings reported by the command:

    shellcheck package/linux-tools/S10hyperv

This commit also fixes the four-space indent by a single tab on the
changed lines. Since this fixes the indentation warnings of
check-package, the Indent exclusion in .checkpackageignore is also
removed.

Fixes:

    In package/linux-tools/S10hyperv line 27:
        return $ret
               ^--^ SC2086 (info): Double quote to prevent globbing and word splitting.

    In package/linux-tools/S10hyperv line 48:
        return $ret
               ^--^ SC2086 (info): Double quote to prevent globbing and word splitting.

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c4173d8b08)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-03-20 09:36:20 +01:00