Commit Graph

60334 Commits

Author SHA1 Message Date
Francois Perrad
8f4a347754 package/prosody: bump to version 0.11.11
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ab9d3bb990)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 20:30:20 +01:00
Fabrice Fontaine
0eb0c1bba0 package/libjpeg: security bump to version 9e
rdgif.c, cderror.h: add sanity check for GIF image dimensions.
Thank to Casper Sun for cjpeg potential vulnerability report.

- Update hash of README (changes not related to license)
- Update indentation in hash file (two spaces)

https://jpegclub.org/reference/reference-sources/

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b5e36f80a6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 20:27:21 +01:00
Quentin Schulz
5c5064a8b4 package/qt5/qt5base: fix CVE-2021-38593
5.15.2 is the last public release of 5.15 and does not contain this CVE
fix. However, >=6.1.2 and >5.12.12 all contain the necessary patches so
let's port them to 5.15.2.

Technically only the first two patches are required to patch the CVE.
However, the second patch introduces a regression that is fixed in the third
patch.

The patches are taken from KDE kde/5.15 git branch.

Cc: Quentin Schulz <foss+buildroot@0leil.net>
Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9151eab3c7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 19:35:59 +01:00
Peter Seiderer
e4390ab287 package/enlightenment: change download URL to https
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[yann.morin.1998@free.fr: also change in Config.in]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f6297befe1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 19:35:11 +01:00
Peter Seiderer
681fc3e74c package/efl: change download URL to https
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[yann.morin.1998@free.fr: canonicalise homepage]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c3d5b27d5d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 19:35:09 +01:00
Peter Korsgaard
d8d740b04a package/nodejs: security bump to version 14.18.3
Fixes the following security issues:

Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is
specifically defined to use a particular SAN type, can result in bypassing
name-constrained intermediates.  Node.js was accepting URI SAN types, which
PKIs are often not defined to use.  Additionally, when a protocol allows URI
SANs, Node.js did not match the URI correctly.

Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)

Node.js converts SANs (Subject Alternative Names) to a string format.  It
uses this string to check peer certificates against hostnames when
validating connections.  The string format was subject to an injection
vulnerability when name constraints were used within a certificate chain,
allowing the bypass of these name constraints.

Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)

Node.js did not handle multi-value Relative Distinguished Names correctly.
Attackers could craft certificate subjects containing a single-value
Relative Distinguished Name that would be interpreted as a multi-value
Relative Distinguished Name, for example, in order to inject a Common Name
that would allow bypassing the certificate subject verification.

Prototype pollution via console.table properties (Low)(CVE-2022-21824)

Due to the formatting logic of the console.table() function it was not safe
to allow user controlled input to be passed to the properties parameter
while simultaneously passing a plain object with at least one property as
the first parameter, which could be __proto__.  The prototype pollution has
very limited control, in that it only allows an empty string to be assigned
numerical keys of the object prototype.

For details, see the advisory:
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9096036f00)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 18:01:20 +01:00
Fabrice Fontaine
a07dc684c3 package/python-django: security bump to version 3.2.11
Fixes:
 - CVE-2021-45115: Denial-of-service possibility in
   UserAttributeSimilarityValidator
 - CVE-2021-45116: Potential information disclosure in dictsort template
   filter
 - CVE-2021-45452: Potential directory-traversal via Storage.save()

https://www.djangoproject.com/weblog/2022/jan/04/security-releases

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a17d4aba54)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 18:00:21 +01:00
Fabrice Fontaine
226a8ae7f2 package/ghostscript: fix CVE-2021-45949
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer
overflow in sampled_data_finish (called from sampled_data_continue and
interp).

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c817641331)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 17:57:51 +01:00
Fabrice Fontaine
cfdca3ebf8 package/ghostscript: fix CVE-2021-45944
Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in
sampled_data_sample (called from sampled_data_continue and interp).

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 70910c4092)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 17:57:44 +01:00
Fabrice Fontaine
7f9b37303b package/targetcli-fb: security bump to version 2.1.54
Fix CVE-2020-13867: Open-iSCSI targetcli-fb through 2.1.52 has weak
permissions for /etc/target (and for the backup directory and backup
files).

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 488f92a1c3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 17:56:23 +01:00
Fabrice Fontaine
6cdc0f655e package/targetcli-fb: add TARGETCLI_FB_CPE_ID_VENDOR
cpe:2.3🅰️targetcli-fb_project:targetcli-fb is a valid CPE identifier
for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atargetcli-fb_project%3Atargetcli-fb

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 67af1b5ba5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 17:53:14 +01:00
Fabrice Fontaine
e2c278e83f package/open62541: add OPEN62541_CPE_ID_VENDOR
cpe:2.3🅰️open62541:open62541 is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aopen62541%3Aopen62541

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 88606bd9eb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 17:53:07 +01:00
Fabrice Fontaine
5dd97c860c package/wireshark: security bump to version 3.4.11
Fix the following security issues:
- https://www.wireshark.org/security/wnpa-sec-2021-16.html
  (CVE-2021-4186)
- https://www.wireshark.org/security/wnpa-sec-2021-17.html
  (CVE-2021-4185)
- https://www.wireshark.org/security/wnpa-sec-2021-18.html
  (CVE-2021-4184)
- https://www.wireshark.org/security/wnpa-sec-2021-20.html
  (CVE-2021-4182)
- https://www.wireshark.org/security/wnpa-sec-2021-21.html
  (CVE-2021-4181)

https://www.wireshark.org/docs/relnotes/wireshark-3.4.11.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d19436b88d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 13:45:56 +01:00
Fabrice Fontaine
cd8f975dc0 package/vim: security bump to version 8.2.4092
Fix CVE-2021-4192: vim is vulnerable to Use After Free
Fix CVE-2021-4193: vim is vulnerable to Out-of-bounds Read

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 33a3f1f30d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 13:45:13 +01:00
TIAN Yuanhao
7261f8e7a0 package/util-linux/util-linux-libs: add a missing patch
The commit 2f50686401 added a patch for
util-linux, but forgot to create a symlink to util-linux-libs. This
results in inconsistent libblkid.so builds from util-linux and
util-linux-libs.

If you enable BR2_PER_PACKAGE_DIRECTORIES, you will find that different
libblkid.so is used in different
$(BASE_DIR)/per-package/$(PKG)_NAME/target.

Signed-off-by: TIAN Yuanhao <tianyuanhao3@163.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 93d23ef91f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 12:37:38 +01:00
Fabrice Fontaine
598b97465a package/gstreamer1/gst1-rtsp-server: fix introspection
Fix the following build failure with introspection:

/home/giuliobenetti/autobuild/run/instance-3/output-1/host/riscv32-buildroot-linux-gnu/sysroot/usr/bin/g-ir-compiler gst/rtsp-server/GstRtspServer-1.0.gir --output gst/rtsp-server/GstRtspServer-1.0.typelib --includedir=/usr/share/gir-1.0
Could not find GIR file 'Gst-1.0.gir'; check XDG_DATA_DIRS or use --includedir
error parsing file gst/rtsp-server/GstRtspServer-1.0.gir: Failed to parse included gir Gst-1.0
If the above error message is about missing .so libraries, then setting up GIR_EXTRA_LIBS_PATH in the .mk file should help.
Typically like this: PKG_MAKE_ENV += GIR_EXTRA_LIBS_PATH="$(@D)/.libs"

Fixes:
 - http://autobuild.buildroot.org/results/04af6b22cfa0cffb6a3109a3b32b27137ad2e0b0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fa3e7a63b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 12:30:00 +01:00
Peter Korsgaard
fa7f960200 {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{4, 10, 15}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit db14f7d715)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 11:25:27 +01:00
Fabrice Fontaine
08b34bc392 package/erlang: bump to version 22.3.4.22
- Drop third patch (already in version)
- Fix build failure with autoconf >= 2.70 raised since commit
  ecd54b65c1

Fixes:
 - http://autobuild.buildroot.org/results/4f52b2f194dcfd619fefb192d1c0fd070d5bd408

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2ad6a3a428)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-28 09:10:44 +01:00
Thomas Petazzoni
3da77e6b25 DEVELOPERS: drop Henrique Camargo
He has privately requested to no longer be notified regarding this
package.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f51be73f25)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 19:31:23 +01:00
Santosh Multhalli
11f988730e Developpers: remove Santosh Multhalli for valjson
Signed-off-by: Santosh Multhalli <santosh.multhalli@rockwellcollins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 31fd98c6ae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 19:29:50 +01:00
Yegor Yefremov
a19f45e642 DEVELOPERS: add entry for avrdude to Yegor Yefremov
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 922fdcd47d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 19:29:43 +01:00
Fabrice Fontaine
213d4e125d package/libvirt: drop C++ comment
Commit f81242ae4f forgot to drop C++
comment

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit fb9a65d98b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 19:21:40 +01:00
Yann E. MORIN
dcc1585d9d package/libvirtd: fix recursive dependency in Kconfig
Commit 4dff1be05e (package/libvirt: libvirtd needs C++ for nmap-ncat)
introduce a recursive dependency (really: a circular dependency):

    package/busybox/Config.in:33:error: recursive dependency detected!
    package/busybox/Config.in:33:   symbol BR2_PACKAGE_BUSYBOX_SHOW_OTHERS is selected by BR2_PACKAGE_EBTABLES_UTILS_SAVE
    package/ebtables/Config.in:11:  symbol BR2_PACKAGE_EBTABLES_UTILS_SAVE depends on BR2_PACKAGE_EBTABLES
    package/ebtables/Config.in:1:   symbol BR2_PACKAGE_EBTABLES is selected by BR2_PACKAGE_LIBVIRT_DAEMON
    package/libvirt/Config.in:44:   symbol BR2_PACKAGE_LIBVIRT_DAEMON depends on BR2_PACKAGE_NETCAT_OPENBSD
    package/netcat-openbsd/Config.in:1:     symbol BR2_PACKAGE_NETCAT_OPENBSD depends on BR2_PACKAGE_BUSYBOX_SHOW_OTHERS

As usual with this kind of circular depednency, it is not trivial to see
what the real cuplrit is, or where to cut the circle.

A simple solution in this case is to drop the C++ dependency, and switch
the netcat-openbsd and nmap-ncat dependencies conditions.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f81242ae4f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 19:21:02 +01:00
Fabrice Fontaine
5319581253 package/libvirt: libvirtd needs C++ for nmap-ncat
Fix the following build failure raised since commit
fbf25acfbf:

WARNING: unmet direct dependencies detected for BR2_PACKAGE_NMAP
  Depends on [n]: BR2_INSTALL_LIBSTDCPP [=n] && BR2_USE_MMU [=y] && BR2_TOOLCHAIN_HAS_THREADS [=y]
  Selected by [y]:
  - BR2_PACKAGE_LIBVIRT_DAEMON [=y] && BR2_PACKAGE_LIBVIRT [=y] && !BR2_PACKAGE_NETCAT_OPENBSD [=n]

Fixes:
 - No autobuilder failures (yet)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: C++ only needed without NETCAT_OPENBSD]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4dff1be05e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 19:20:51 +01:00
Fabrice Fontaine
cf0b5f2442 package/libvirt: disable sasl
sasl depends on libsasl2 (https://github.com/cyrusimap/cyrus-sasl) which
is not packaged yet in buildroot and will result in the following build
failure raised since commit fbf25acfbf:

output/build/libvirt-7.7.0/meson.build:1212:2: ERROR: Dependency "libsasl2" not found, tried pkgconfig

Fixes:
 - No autobuilder failures (yet)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ba2016dc04)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 17:58:08 +01:00
Fabrice Fontaine
b7e5a5a791 package/libvirt: fix ssh2 option
Fix the following build failure raised since commit
fbf25acfbf:

output/build/libvirt-7.7.0/meson.build:1:0: ERROR: Unknown options: "ssh2"

Fixes:
 - No autobuilder failures (yet)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c077b4a919)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 17:54:00 +01:00
Arnout Vandecappelle (Essensium/Mind)
29e4ff33c3 support/scripts/pkg-stats: fix flake8 errors
support/scripts/pkg-stats:1171:8: E713 test for membership should be 'not in'
support/scripts/pkg-stats:1175:8: E713 test for membership should be 'not in'
support/scripts/pkg-stats:1179:8: E713 test for membership should be 'not in'
3     E713 test for membership should be 'not in'

Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/1955772278

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 02e679d8bf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 17:50:38 +01:00
Thomas Petazzoni
c1261aa3c0 support/scripts/pkg-stats: add --disable option
When debugging pkg-stats, it's quite useful to be able to disable some
features that are quite long (checking upstream URL, checking latest
version, checking CVE). This commit adds a --disable option, which can
take a comma-separated list of features to disable, such as:

     ./support/scripts/pkg-stats --disable url,upstream

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b102352b62)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 17:48:24 +01:00
Gregory CLEMENT
c1329957bd support/scripts/pkg-stats: account for unsure CVEs
The .affects() method of the CVE class in support/scripts/cve.py can
return 3 values: CVE_AFFECTS, CVE_DOESNT_AFFECT and CVE_UNKNOWN.

We of course properly account for CVEs where .affects() return
CVE_AFFECTS, but the ones for which CVE_UNKNOWN is returned are
currently ignored, and therefore treated as if they did not affect the
package.

However CVE_UNKNOWN in fact indicates that the v_start/v_end fields of
the CPE entry could not be parsed by
distutils.version.LooseVersion(). Instead of ignoring such cases, this
commit adds support for the concept of "unsure CVEs", which will be
listed next to CVEs known to affect the package, so that we are aware
of them and can investigate the version issue.

Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a206bbc5fe)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 17:46:30 +01:00
Peter Korsgaard
9279040543 package/pkg-python.mk: fix typos
s/interperter/interpreter/ and drop 'use use' / 'depend on use'.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 65054d1a19)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 17:41:31 +01:00
Fabrice Fontaine
52404bc144 package/gnuchess: security bump to version 6.2.9
Fixed potential buffer overflow in pgnload and pgnreplay
(CVE-2021-30184)

https://lists.gnu.org/archive/html/info-gnu-chess/2021-07/msg00000.html
https://git.savannah.gnu.org/cgit/chess.git/tree/NEWS?h=v6.2.9

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 85aab41ef9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 17:38:49 +01:00
Peter Korsgaard
ae2a31295c package/poppler: use HTTPS for upstream URL
Fixes:
http://autobuild.buildroot.net/results/145/1456f9512371ecb5a0a374943178e4bd7b0967e8/

The HTTP URL returns a 308 redirect to HTTPS, which confuses old wget
versions (E.G.  s.b.o):

wget -d http://poppler.freedesktop.org/poppler-21.12.0.tar.xz
DEBUG output created by Wget 1.14 on linux-gnu.

URI encoding = ‘UTF-8’
Converted file name 'poppler-21.12.0.tar.xz' (UTF-8) -> 'poppler-21.12.0.tar.xz' (UTF-8)
Converted file name 'poppler-21.12.0.tar.xz' (UTF-8) -> 'poppler-21.12.0.tar.xz' (UTF-8)
--2022-01-09 09:28:02--  http://poppler.freedesktop.org/poppler-21.12.0.tar.xz
Resolving poppler.freedesktop.org (poppler.freedesktop.org)... 147.75.198.156
Caching poppler.freedesktop.org => 147.75.198.156
Connecting to poppler.freedesktop.org (poppler.freedesktop.org)|147.75.198.156|:80... connected.
Created socket 3.
Releasing 0x0000000001ceda80 (new refcount 1).

---request begin---
GET /poppler-21.12.0.tar.xz HTTP/1.1
User-Agent: Wget/1.14 (linux-gnu)
Accept: */*
Host: poppler.freedesktop.org
Connection: Keep-Alive

---request end---
HTTP request sent, awaiting response...
---response begin---
HTTP/1.1 308 Permanent Redirect
Date: Sun, 09 Jan 2022 09:28:02 GMT
Content-Type: text/html
Content-Length: 164
Connection: keep-alive
Location: https://poppler.freedesktop.org/poppler-21.12.0.tar.xz

---response end---
308 Permanent Redirect
Registered socket 3 for persistent reuse.
Skipping 164 bytes of body: [<html>
<head><title>308 Permanent Redirect</title></head>
<body>
<center><h1>308 Permanent Redirect</h1></center>
<hr><center>nginx</center>
</body>
</html>
] done.
2022-01-09 09:28:02 ERROR 308: Permanent Redirect.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c39e0abba9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 11:52:14 +01:00
Fabrice Fontaine
5b75389cb4 package/hackrf: add a comma between licenses
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4afa6fd8c1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 08:59:34 +01:00
Fabrice Fontaine
58203964d7 package/nvidia-driver: add Linux in comment
Add "Linux" before kernel in comment to be consistent with other
packages and manual

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 956cd5b9b7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 08:58:22 +01:00
Fabrice Fontaine
2628dcdd47 package/libss7: add Linux in comment
Add "Linux" before kernel in comment to be consistent with other
packages and manual

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e0de6291e3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 08:57:36 +01:00
Fabrice Fontaine
957a7ff5b6 package/libpri: add Linux in comment
Add "Linux" before kernel in comment to be consistent with other
packages and manual

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0730b8b822)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 08:57:30 +01:00
Fabrice Fontaine
824bd21137 package/libeastl: drop duplicated sentence
Drop duplicated sentence from Config.in

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 59bbe7cc74)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 08:54:27 +01:00
Thomas Petazzoni
e7ac911660 package/rustc: fix the riscv64gc architecture handling
riscv64gc was made available for BR2_riscv, but RISC-V can be 32-bit
or 64-bit, so we need to restrict it to BR2_RISCV_64. There's no need
to keep the BR2_riscv dependency, as BR2_RISCV_64 can only be true
when BR2_riscv is true.

Also, BR2_PACKAGE_HOST_RUSTC_ARCH needs to be set to riscv64gc to
allow rust-bin to download its pre-compiled standard library
correctly.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 79c5639597)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 08:53:49 +01:00
Thomas Petazzoni
6a45747f72 package/rustc: fix BR2_PACKAGE_HOST_RUSTC_ARCH for ARMv5
BR2_PACKAGE_HOST_RUSTC_ARCH only had a special value for
BR2_ARM_CPU_ARMV7A, but it also needs a special value for
BR2_ARM_CPU_ARMV5, as the pre-compiled Rust standard library for
ARMv5TE is identified with the "armv5te" architecture name, see
https://doc.rust-lang.org/nightly/rustc/platform-support.html.

We noticed this because Rust binaries wouldn't work on an ARMv5
platform (Illegal instruction). This was due to the usage of the
arm-unknown-linux-gnueabi variant of the Rust standard library, which
is for ARMv6. Thanks to this commit, we correctly use the
armv5te-unknown-linux-gnueabi variant, and Rust binaries work properly
on ARMv5TE.

A better approach would be to do the conversion from architecture
options to Rust tuples in a single string symbol that also defines the
supported architectures, similar to how it's done in e.g. openblas.
However, that's a much bigger change. So for now, just do the easy thing
and fix this one issue.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 1ed4147e76)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 08:23:48 +01:00
Thomas Petazzoni
fbbf702f00 package/opengl/libgbm: clarify option comments
The comments were *after* the option they applied to, which was
confusing, so bring back the comments before the option they apply to.

In addition, instead of saying "this option", explicitly name the
option to clear any ambiguity.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2b5f7ce292)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 08:19:05 +01:00
Fabrice Fontaine
e5e649a544 package/rhash: fix activation of gettext
Since commit ead2afda13, gettext is
wrongly disabled when BR2_SYSTEM_ENABLE_NLS is set

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5630e83c84)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-27 08:15:30 +01:00
Bernd Kuhls
ecaafd1804 package/freeswitch: security bump version to 1.10.7
Fixes the following security issues:

- CVE-2021-41105: FreeSWITCH susceptible to Denial of Service via invalid
  SRTP packets

  When handling SRTP calls, FreeSWITCH is susceptible to a DoS where calls
  can be terminated by remote attackers.  This attack can be done
  continuously, thus denying encrypted calls during the attack.

  https://github.com/signalwire/freeswitch/security/advisories/GHSA-jh42-prph-gp36

- CVE-2021-41157: FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default

  By default, SIP requests of the type SUBSCRIBE are not authenticated in
  the affected versions of FreeSWITCH.

  https://github.com/signalwire/freeswitch/security/advisories/GHSA-g7xg-7c54-rmpj

- CVE-2021-37624: FreeSWITCH does not authenticate SIP MESSAGE requests,
  leading to spam and message spoofing

  By default, SIP requests of the type MESSAGE (RFC 3428) are not
  authenticated in the affected versions of FreeSWITCH.  MESSAGE requests
  are relayed to SIP user agents registered with the FreeSWITCH server
  without requiring any authentication.  Although this behaviour can be
  changed by setting the auth-messages parameter to true, it is not the
  default setting.

  https://github.com/signalwire/freeswitch/security/advisories/GHSA-mjcm-q9h8-9xv3

- CVE-2021-41145: FreeSWITCH susceptible to Denial of Service via SIP flooding

  When flooding FreeSWITCH with SIP messages, it was observed that after a
  number of seconds the process was killed by the operating system due to
  memory exhaustion

  https://github.com/signalwire/freeswitch/security/advisories/GHSA-jvpq-23v4-gp3m

- CVE-2021-41158: FreeSWITCH vulnerable to SIP digest leak for configured gateways

  An attacker can perform a SIP digest leak attack against FreeSWITCH and
  receive the challenge response of a gateway configured on the FreeSWITCH
  server.  This is done by challenging FreeSWITCH's SIP requests with the
  realm set to that of the gateway, thus forcing FreeSWITCH to respond with
  the challenge response which is based on the password of that targeted
  gateway.

  https://github.com/signalwire/freeswitch/security/advisories/GHSA-3v3f-99mv-qvj4

Release notes:
https://github.com/signalwire/freeswitch/releases/tag/v1.10.7

Removed patch, upstream applied a different fix:
e9fde845de

Added optional dependency to libks, needed due to upstream commit
ed98516666

Added upstream patches to fix build errors.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Peter: mention security fixes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 829777c1c9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-26 21:52:51 +01:00
Bernd Kuhls
16cbd66f04 package/sofia-sip: bump version to 1.13.6
Needed to bump freeswitch to 1.10.7.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 30b2dbeae3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-26 21:52:28 +01:00
Fabrice Fontaine
ae3a675417 package/mpd: fix comment
Commit 1bf512e9ff wrongly added that
BR2_USE_WCHAR is due to flac dependency but flac is optional so remove
this comment and add boost instead

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 20584d1ef2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-26 21:46:49 +01:00
Romain Naour
7263cf4946 package/mender: remove single hyphen command
Single hyphen commands has been removed since Mender 3.0.0 [1]

[1] fd838ec1b0

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Cc: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 97daba5781)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-26 21:41:40 +01:00
Christian Stewart
288007dc4a package/go: bump version to 1.17.6
View the release notes for more information:

https://go.dev/doc/devel/release.html#go1.17.minor

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7af6659cb2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-26 21:37:58 +01:00
Fabrice Fontaine
e6a838d6ac package/liburiparser: security bump to version 0.9.6
- Fixed: [CVE-2021-46141]
  Fix a bug affecting both uriNormalizeSyntax* and uriMakeOwner*
  functions where the text range in .hostText would not be duped using
  malloc but remain unchanged (and hence "not owned") for URIs with
  an IPv4 or IPv6 address hostname; depending on how an application
  uses uriparser, this could lead the application into a use-after-free
  situation.
  As the second half, fix uriFreeUriMembers* functions that would not
  free .hostText memory for URIs with an IPv4 or IPv6 address host;
  also, calling uriFreeUriMembers* multiple times on a URI of this
  very nature would result in trying to free pointers to stack
  (rather than heap) memory.
- Fixed: [CVE-2021-46142]
  Fix functions uriNormalizeSyntax* for out-of-memory situations
  (i.e. malloc returning NULL) for URIs containing empty segments
  (any of user info, host text, query, or fragment) where previously
  pointers to stack (rather than heap) memory were freed.

https://github.com/uriparser/uriparser/blob/uriparser-0.9.6/ChangeLog

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e00379361e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-26 21:31:34 +01:00
Fabrice Fontaine
896791904c package/mutt: bump to version 2.1.5
Mutt 2.1.5 was released on December 30, 2021. This is a bug-fix release,
fixing two SMTP authentication issues, a crash bug on NetBSD, and a
couple other issues.

https://gitlab.com/muttmua/mutt/-/blob/mutt-2-1-5-rel/ChangeLog

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit db156d693a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-26 21:20:02 +01:00
Florent AUMAITRE
19fdc1367a package/python-pyqt5: Fix per-package build
pyqt5 uses qmake internally, but is python package rather than a qmake
package. Therefore, we need to manually apply the same fixup as for
qmake packages.

Without this, top-level parallel build may fail because dependencies are
looked for in the qt5 per-package staging directory instead of the
python-pyqt5 one.

Signed-off-by: Florent AUMAITRE <florent.aumaitre@medianesysteme.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 51c22b4ba9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-26 21:12:16 +01:00
Fabrice Fontaine
2686b22bc5 package/libiio: set PYTHON_EXECUTABLE
Set PYTHON_EXECUTABLE to avoid the following build failure when
BR2_PACKAGE_PYTHON is enabled but libiio finds python3 without
setuptools on host:

-- Found Python: /usr/bin/python3.5 (found version "3.5.3") found components: Interpreter
-- new
-- Python_EXECUTABLE /usr/bin/python3.5

[...]

Traceback (most recent call last):
  File "/home/buildroot/autobuild/instance-0/output-1/build/libiio-0.23/bindings/python/setup.py", line 15, in <module>
    from setuptools import setup
ImportError: No module named 'setuptools'

Fixes:
 - http://autobuild.buildroot.org/results/d80e56e4ad84c8e7f244cf6d1cb96c116e8eb734

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Acked-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit f384de4f4e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-01-26 21:08:57 +01:00