Commit Graph

56583 Commits

Author SHA1 Message Date
Fabrice Fontaine
89d08aeba3 package/x11r7/xlib_libXfixes: add CPE variables
cpe:2.3🅰️x:libxfixes is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxfixes

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 73ddf01dd8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 23:18:49 +02:00
Fabrice Fontaine
3b4c01ddd7 package/x11r7/xlib_libXinerama: add CPE variables
cpe:2.3🅰️x:libxinerama is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxinerama

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 713a76560b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 23:18:08 +02:00
Fabrice Fontaine
db7de62da9 package/x11r7/xlib_libXfont2: add CPE variables
cpe:2.3🅰️x:libxfont is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ax%3Alibxfont

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 68436b2335)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 23:18:03 +02:00
Peter Seiderer
b74235234b package/localedef: fix host gcc-11.x compile
Add two upstream patches fixing host gcc-11.x compile.

Fixes:

  - https://bugs.busybox.net/show_bug.cgi?id=13806

  In file included from ../include/pthread.h:1,
                   from ../sysdeps/nptl/thread_db.h:25,
                   from ../nptl/descr.h:32,
                   from ../sysdeps/x86_64/nptl/tls.h:130,
                   from ../sysdeps/generic/libc-tsd.h:44,
                   from ./localeinfo.h:224,
                   from programs/ld-ctype.c:37:
  ../sysdeps/nptl/pthread.h:734:47: error: argument 1 of type ‘struct __jmp_buf_tag *’ declared as a pointer [-Werror=array-parameter=]
    734 | extern int __sigsetjmp (struct __jmp_buf_tag *__env, int __savemask) __THROWNL;
        |                         ~~~~~~~~~~~~~~~~~~~~~~^~~~~
  In file included from ../include/setjmp.h:2,
                   from ../nptl/descr.h:24,
                   from ../sysdeps/x86_64/nptl/tls.h:130,
                   from ../sysdeps/generic/libc-tsd.h:44,
                   from ./localeinfo.h:224,
                   from programs/ld-ctype.c:37:
  ../setjmp/setjmp.h:54:46: note: previously declared as an array ‘struct __jmp_buf_tag[1]’
     54 | extern int __sigsetjmp (struct __jmp_buf_tag __env[1], int __savemask) __THROWNL;
        |                         ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4174f79a57)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 23:16:45 +02:00
Fabrice Fontaine
2b1836d9ec package/libxslt: fix build with latest libxml2
Build is broken since bump of libxml2 to version 2.9.11 in commit
a241dcec41 because libxslt calls the
following command "${XML_CONFIG} --libs print" which will return an
error code since
2a357ab99e

Fixes:
 - http://autobuild.buildroot.org/results/47ceb8c24c9ead8a450b7fea3266f760d6b77b4f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7320e5dd62)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 21:25:47 +02:00
Peter Korsgaard
aaeaac8595 package/prosody: security bump to version 0.11.9
Fixes the following security issues:

- CVE-2021-32918: DoS via insufficient memory consumption controls

  It was discovered that default settings leave Prosody susceptible to
  remote unauthenticated denial-of-service (DoS) attacks via memory
  exhaustion when running under Lua 5.2 or Lua 5.3.  Lua 5.2 is the default
  and recommended Lua version for Prosody 0.11.x series.

- CVE-2021-32920: DoS via repeated TLS renegotiation causing excessive CPU
  consumption

  It was discovered that Prosody does not disable SSL/TLS renegotiation,
  even though this is not used in XMPP.  A malicious client may flood a
  connection with renegotiation requests to consume excessive CPU resources
  on the server.

- CVE-2021-32921: Use of timing-dependent string comparison with sensitive
  values

  It was discovered that Prosody does not use a constant-time algorithm for
  comparing certain secret strings when running under Lua 5.2 or later.
  This can potentially be used in a timing attack to reveal the contents of
  secret strings to an attacker.

- CVE-2021-32917: Use of mod_proxy65 is unrestricted in default
  configuration

  mod_proxy65 is a file transfer proxy provided with Prosody to facilitate
  the transfer of files and other data between XMPP clients.

  It was discovered that the proxy65 component of Prosody allows open access
  by default, even if neither of the users have an XMPP account on the local
  server, allowing unrestricted use of the server’s bandwidth.

- CVE-2021-32919: Undocumented dialback-without-dialback option insecure

  The undocumented option ‘dialback_without_dialback’ enabled an
  experimental feature for server-to-server authentication.  A flaw in this
  feature meant it did not correctly authenticate remote servers, allowing a
  remote server to impersonate another server when this option is enabled.

For more details, see the advisory:
https://prosody.im/security/advisory_20210512/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9c108afab8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 21:25:13 +02:00
Peter Korsgaard
e4ee7144ac test_docker_compose.py: Test the volume mount feature
Extend docker_compose_test() to expose /bin on the host to the container
through a volume mount and verify that /bin/busybox can be downloaded and
contains the right data.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit aa31d10808)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 21:24:11 +02:00
Peter Korsgaard
3adc69a086 test_docker_compose.py: Test the port publish feature
Extend docker_test() to expose a random (8888) port to verify that doesn't
fail, and extend the docker-compose test to run the busybox httpd in the
background, expose that as port 80 and verify that /etc/resolv.conf could be
fetched by wget.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4915b692c8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 21:23:59 +02:00
Peter Korsgaard
1a48c70e07 package/docker-engine: fix port forwarding for hosts without IPv6
docker-engine 20.10.6 broke container port forwarding for hosts without IPv6
support:

docker: Error response from daemon: driver failed programming external
connectivity on endpoint naughty_moore
(038e9ed4b5ea77e1c52462d6d04ad001fbad9beb185a6511aadc217c8a271608): Error
starting userland proxy: listen tcp6 [::]:80: socket: address family not
supported by protocol.

Add a libnetwork patch from an upstream pull request to fix this, after
adjusting the patch to apply to docker-engine (which has libnetwork vendored
under vendor/github.com/docker/libnetwork):

- https://github.com/moby/libnetwork/pull/2635,
- https://github.com/moby/moby/pull/42322

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2fd33900f5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 21:23:47 +02:00
Fabrice Fontaine
8ff560df67 package/live555: security bump to version 2021.05.03
Fix CVE-2021-28899: Vulnerability in the
AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession,
and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession
subclasses in Networks LIVE555 Streaming Media before 2021.3.16.

http://live555.com/liveMedia/public/changelog.txt

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6ad1c7f12e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 21:23:26 +02:00
Fabrice Fontaine
8108c70cc6 package/libxml2: bump to version 2.9.12
Brown-paper bag release:
b48e77cf4f

Update indentation in hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b304a458bd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 21:22:52 +02:00
Dick Olsson
ddd01c9ea5 DEVELOPERS: add package/bitcoin for Dick Olsson
Signed-off-by: Dick Olsson <hi@senzilla.io>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b6c1151936)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 21:22:11 +02:00
Bernd Kuhls
32cd16d5d6 DEVELOPERS: add myself for bitcoin
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0845329e27)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 21:22:03 +02:00
Yann E. MORIN
12d3b998b2 package/opentyrian: switch to using github
OpenTyrian was previously managed in a Mercurial repository hosted on
Bitbucket. Mid-2020, Bitbucket shut off all its Mercurial repositories:
    https://bitbucket.org/blog/sunsetting-mercurial-support-in-bitbucket

Since then, OpenTyrian's source code is inacessible, but we have had no
build failure associated as there is an old archive hosted on s.b.o, so
that all builds fallback to downloading that:
    http://sources.buildroot.net/opentyrian/opentyrian-9c9f0ec3532b.tar.gz

However, the project has been revived (kinda) on github:
    https://github.com/opentyrian/opentyrian

Git commit cf5dbeb69eebd9ef9afc4473088d9469b79589eb has been found to
be the closest, both in content and date, to the Mercuail reference
9c9f0ec3532b we were using. The only deltas are in Mercurial-specific
files:

 b/.hg_archival.txt |    5     0     5     0 -----
 b/.hgtags          |    2     1     1     0 +-
 2 files changed, 1 insertion(+), 6 deletions(-)

While at it, add a hash file.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Julien Boibessot <julien.boibessot@armadeus.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 64e7c63528)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 21:21:14 +02:00
Peter Seiderer
0b3a2db21c package/libgeos: fix comment dependencies (binutils-bug-12464, binutils-bug-27597)
The comment dependencies need to be the inverse of the package
dependencies (fixes comment shown in menuconfig even if the package
is available).

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 03a8d70f52)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-17 21:20:24 +02:00
Adrian Perez de Castro
cdbc10dddf package/libxml2: security bump to version 2.9.11
Update libxml2 to version 2.9.11, which incorporates all the patches
carried by Buildroot (which are hence removed), and includes fixes for
CVE-2020-7595, CVE-2019-20388, CVE-2020-24977, and CVE-2021-3541 (at
least), as per

  https://gitlab.gnome.org/GNOME/libxml2/-/issues/186#note_1104945

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a241dcec41)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-14 19:23:16 +02:00
Bernd Kuhls
fdedf7c984 package/postgresql: security bump version to 13.3
Fixes CVE-2021-32027, CVE-2021-32028 & CVE-2021-32029:
https://www.postgresql.org/about/news/postgresql-133-127-1112-1017-and-9622-released-2210/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b544587806)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-14 19:23:11 +02:00
Peter Korsgaard
cbc530bfa6 package/rt-tests: add patch to fix compatibility with make 3.81
Fixes:
http://autobuild.buildroot.net/results/cf7c4f360f5464c700788cc8299fd086544c80e8/build-end.log

Older GNU make versions don't like the explicit undefine.  It isn't really
needed as ifdef handles undefined and defined-to-the-empty-string the same
way, so just drop the undefine logic.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b8a1301e81)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-14 19:22:03 +02:00
Fabrice Fontaine
35627e9222 package/bitcoin: security bump to version 0.21.1
Tag as a security bump as having an up to date bitcoin is important:
https://patchwork.ozlabs.org/project/buildroot/patch/20200202085526.35742-1-james.hilliard1@gmail.com

https://github.com/bitcoin/bitcoin/blob/master/doc/release-notes/release-notes-0.21.1.md

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a7a58df5f0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-14 19:21:46 +02:00
Bernd Kuhls
ef91c329b2 package/vlc: security bump version to 3.0.14
Removed patch 0002 which was applied upstream:
41caaa08cd

Renumbered remaining patches.

Release notes:
https://www.videolan.org/vlc/releases/3.0.13.html
https://www.videolan.org/vlc/releases/3.0.12-update.html

Version 3.0.13 fixes VideoLAN-SB-VLC-3013:
https://www.videolan.org/security/sb-vlc3013.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6a07591484)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-14 19:21:19 +02:00
Peter Korsgaard
76b4f9e9b6 Update for 2021.02.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-12 11:06:28 +02:00
Joachim Wiberg
ce583c4d2d package/sysklogd: bump to version 2.2.3
https://github.com/troglobit/sysklogd/releases/tag/v2.2.3

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8036c23d59)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-12 11:01:21 +02:00
Bernd Kuhls
a2a1768d2a package/php: bump version to 7.4.19
Changelog: https://www.php.net/ChangeLog-7.php#7.4.19

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f4d0191689)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-12 08:05:29 +02:00
Bernd Kuhls
89688a2d24 package/tor: bump version to 0.4.5.8
Release notes: https://blog.torproject.org/node/2031

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 294e939a51)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-12 08:05:20 +02:00
Marcin Niestroj
0fe2e0ab07 package/lvm2: use http instead of ftp
ftp links do not seem to be accessible anymore. Replace them with http.

Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 92378c6063)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-11 22:14:37 +02:00
Sébastien Szymanski
d277ca3305 package/boost: fix broken BOOST_SITE URL
Current URL returns 403 error:

--2021-05-10 10:04:12--  https://dl.bintray.com/boostorg/release/1.75.0/source/boost_1_75_0.tar.bz2
Resolving dl.bintray.com... 18.193.131.58, 3.66.199.110
Connecting to dl.bintray.com|18.193.131.58|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2021-05-10 10:04:12 ERROR 403: Forbidden.

Bintray has been sunset on May 1st:
https://jfrog.com/blog/into-the-sunset-bintray-jcenter-gocenter-and-chartcenter/

Update the URL to the new upstream location to fix this issue.

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 345bb23050)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-11 22:13:28 +02:00
Fabrice Fontaine
a8112b55f9 package/rust: security bump to version 1.52.0
Fix CVE-2020-36317, CVE-2020-36318, CVE-2020-36323, CVE-2021-28877,
CVE-2021-28875, CVE-2021-28876, CVE-2021-28878 and CVE-2021-28879

https://github.com/rust-lang/rust/blob/1.52.0/RELEASES.md

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0a4a69bb48)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-11 22:12:47 +02:00
Peter Korsgaard
442ec6253f CHANGES: update with recent changes
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-10 20:37:12 +02:00
Peter Korsgaard
b93c89f243 {linux, linux-headers}: bump 4.19.x / 5.{4, 10, 11, 12}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b50cc77a09)
[Peter: drop 5.11.x/5.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-10 11:27:24 +02:00
John Keeping
2ca165f46b package/cryptsetup: disable tmpfiles.d for host build
When building host-cryptsetup, if tmpfiles.d support is enabled then the
install step tries to install /usr/lib/tmpfiles.d/cryptsetup.conf
globally on the host system.

Even if the tmpfiles.d config were installed correctly in the host
directory, nothing would ever run these rules, so disable this feature
via configure.

Signed-off-by: John Keeping <john@metanate.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b2e82f9fa5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-10 11:25:19 +02:00
Fabrice Fontaine
3f164d1273 package/haproxy: bump to version 2.2.14
http://www.haproxy.org/download/2.2/src/CHANGELOG

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5fe4fcdb64)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-10 11:23:37 +02:00
Peter Korsgaard
337331bfc4 package/ruby: security bump to version 2.7.3
This release includes security fixes:
- CVE-2021-28965: XML round-trip vulnerability in REXML
- CVE-2021-28966: Path traversal in Tempfile on Windows

https://www.ruby-lang.org/en/news/2021/04/05/ruby-2-7-3-released/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-10 11:21:57 +02:00
Peter Korsgaard
4c9459e305 package/xen: bump version to 4.14.2
Includes a number of bugfixes and the security fixes up to 368, so drop
those.

For details, see the release notes:
https://xenproject.org/downloads/xen-project-archives/xen-project-4-14-series/xen-project-4-14-2/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dc5d9c9835)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:49:02 +02:00
Peter Korsgaard
91eb510511 package/go: security bump to version 1.15.12
Fixes the following security issues:

- CVE-2021-31525: ReadRequest and ReadResponse in net/http can hit an
  unrecoverable panic when reading a very large header (over 7MB on 64-bit
  architectures, or over 4MB on 32-bit ones).  Transport and Client are
  vulnerable and the program can be made to crash by a malicious server.
  Server is not vulnerable by default, but can be if the default max header
  of 1MB is overridden by setting Server.MaxHeaderBytes to a higher value,
  in which case the program can be made to crash by a malicious client.

  https://github.com/golang/go/issues/45710

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:41:19 +02:00
Peter Korsgaard
5e17a5c716 package/python3: security bump to version 3.9.5
Fixes the following security issues:

- bpo-43434: Creating a sqlite3.Connection object now also produces a
  sqlite3.connect auditing event.  Previously this event was only produced
  by sqlite3.connect() calls.  Patch by Erlend E.  Aasland.

- bpo-43882: The presence of newline or tab characters in parts of a URL
  could allow some forms of attacks.
  Following the controlling specification for URLs defined by WHATWG
  urllib.parse() now removes ASCII newlines and tabs from URLs, preventing
  such attacks.

- bpo-43472: Ensures interpreter-level audit hooks receive the
  cpython.PyInterpreterState_New event when called through the
  _xxsubinterpreters module.

- bpo-36384: ipaddress module no longer accepts any leading zeros in IPv4
  address strings.  Leading zeros are ambiguous and interpreted as octal
  notation by some libraries.  For example the legacy function
  socket.inet_aton() treats leading zeros as octal notatation.  glibc
  implementation of modern inet_pton() does not accept any leading zeros.
  For a while the ipaddress module used to accept ambiguous leading zeros.

- bpo-43075: Fix Regular Expression Denial of Service (ReDoS) vulnerability
  in urllib.request.AbstractBasicAuthHandler.  The ReDoS-vulnerable regex
  has quadratic worst-case complexity and it allows cause a denial of
  service when identifying crafted invalid RFCs.  This ReDoS issue is on the
  client side and needs remote attackers to control the HTTP server.

- bpo-42800: Audit hooks are now fired for frame.f_code, traceback.tb_frame,
  and generator code/frame attribute access.

https://www.python.org/downloads/release/python-395/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f02c0ee1b0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:39:20 +02:00
Fabrice Fontaine
9b0361c5f6 package/cegui: add libfribidi optional dependency
libfribidi is an optional dependency (enabled by default) since version
0.8.0 and
17974582e6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Tested-by: Bartosz Bilas<b.bilas@grinn-global.com>
Reviewed-by: Bartosz Bilas<b.bilas@grinn-global.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 1556484f0b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:37:56 +02:00
Fabrice Fontaine
186e804dc8 package/cifs-utils: security bump to version 6.13
Fix CVE-2021-20208: A flaw was found in cifs-utils in versions before
6.13. A user when mounting a krb5 CIFS file system from within a
container can use Kerberos credentials of the host. The highest threat
from this vulnerability is to data confidentiality and integrity.

https://lists.samba.org/archive/samba-technical/2021-April/136467.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0b332bb15c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:36:18 +02:00
Fabrice Fontaine
ab13c7a97e package/cifs-utils: add missing python dependencies
Add missing python dependencies which have been forgotten when bumping
to version 6.12 in commit b5dede7d1a

Fixes:
 - http://autobuild.buildroot.org/results/acdbf7c58ec8ae648f8048bc75650dcdcdca6285

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr:
  - dependencies are because of python3, not python
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 99001b0a81)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:35:59 +02:00
Peter Seiderer
88bf9a1b9e package/cifs-utils: bump version to 6.12
- removed 0001-Use-DESTDIR-when-installing-mount.smb3-and-optionall.patch
  (superseded by upstream commit [1])

- adjust autoreconf comment accordingly

- add option for smb tools to avoid hard python runtime dependency
  (smbinfo and smb2-quota are python scripts)

Changelog ([2]):

  December, 2020: Release 6.12
  get/setcifsacl tools are improved to support changing owner, group and SACLs
  mount.cifs is enhanced to use SUDO_UID env variable for cruid
  smbinfo is re-written in Python language
  https://lists.samba.org/archive/samba-technical/2020-December/136156.html

[1] https://git.samba.org/?p=cifs-utils.git;a=patch;h=a00e84378d9c5e63272ff69ca18fd0e872b384d3
[2] https://wiki.samba.org/index.php/LinuxCIFS_utils

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b5dede7d1a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:35:50 +02:00
Peter Korsgaard
fdbdcb4a75 package/python-django: security bump to version 3.2.2
Django 3.0.x is EOL, so move to 3.2.x which is the new LTS release.  For
details of the changes and update instructions, see the announcement:

https://www.djangoproject.com/weblog/2021/apr/06/django-32-released/

Fixes the following security issues:

- CVE-2021-30459 - SQL Injection via Select, Explain and Analyze forms of
  the SQLPanel for Django Debug Toolbar >= 0.10.0

  With Django Debug Toolbar 0.10.0 and above, attackers are able to execute
  SQL by changing the raw_sql input of the SQL explain, analyze or select
  forms and submitting the form.  This is a high severity issue for anyone
  using the toolbar in a production environment.  Generally the Django Debug
  Toolbar team only maintains the latest version of django-debug-toolbar,
  but an exception was made because of the high severity of this issue.

  The GitHub Security Advisory can be found here:
  https://github.com/jazzband/django-debug-toolbar/security/advisories/GHSA-pghf-347x-c2gj

- CVE-2021-31542: Potential directory-traversal via uploaded files

  MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal
  via uploaded files with suitably crafted file names.

  In order to mitigate this risk, stricter basename and path sanitation is
  now applied.  Specifically, empty file names and paths with dot segments
  will be rejected.

  This issue has low severity, according to the Django security policy.

- CVE-2021-32052: Header injection possibility since URLValidator accepted
  newlines in input on Python 3.9.5+

  On Python 3.9.5+, URLValidator didn't prohibit newlines and tabs.  If you
  used values with newlines in HTTP response, you could suffer from header
  injection attacks.  Django itself wasn't vulnerable because HttpResponse
  prohibits newlines in HTTP headers.

  Moreover, the URLField form field which uses URLValidator silently removes
  newlines and tabs on Python 3.9.5+, so the possibility of newlines
  entering your data only existed if you are using this validator outside of
  the form fields.

  This issue was introduced by the bpo-43882 fix.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 84441433ec)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:34:07 +02:00
Peter Korsgaard
1c5e17f41b package/python-asgiref: bump version to 3.3.4
Needed by django 3.2.x

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8cccb01bbd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:34:00 +02:00
Thomas Petazzoni
8650a3c05e package/Makefile.in: expose CONFIG_DIR to post-build/post-image scripts
Sometimes, post-build or post-image scripts need to reinvoke
Buildroot's make, for example to execute "make printvars".

However, so far post-build/image/fakeroot can't trivially run printvars
in a way that worked for both in-tree and out-of-tree builds. Indeed:

 * "make printvars" would work for in-tree builds, but not out of tree
   builds

 * "make -C ${O} printvars" would work for out-of-tree builds, but not
   in-tree builds

 * "make -C ${BR2_CONFIG%/*} printvars" works in both cases, but it is
   a bit cryptic, and two maintainers did not even immediately think of
   it

In order to solve this, this commit exposes $(CONFIG_DIR) to
post-build/image/fakeroot scripts, through the EXTRA_ENV variable.

The documentation is updated accordingly.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[yann.morin.1998@free.fr:
  - reference BR2_CONFIG as an exemple
  - slightly reword the commit log accordingly
  - move the doc for CONFIG_DIR next to that of BR2_CONFIG
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit efdcd651bf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:30:31 +02:00
Matthew Weber
61c39d7a45 DEVELOPERS: transition rockwellcollins.com to collins.com
Email addresses are all live and some of us will start contributing
with the new collins.com domain.

Signed-off-by: Matthew Weber <matthew.weber@collins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8c8f375bad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:29:10 +02:00
Fabrice Fontaine
bd84c189b5 package/coremark-pro: disable parallel build
Disable parallel build as it seems to be totally broken:

/bin/bash: line 0: cd: /home/buildroot/autobuild/instance-2/output-1/build/coremark-pro-1.1.2743/builds/linux64/gcc64/obj/bench/core: No such file or directory

/bin/sh: 1: cd: can't cd to /home/buildroot/autobuild/instance-1/output-1/build/coremark-pro-1.1.2743/builds/linux/gcc/obj/bench/fp/loops/SP

Fixes:
 - http://autobuild.buildroot.org/results/7ba5e209772af7037fc735ea174d3fc3eaf46f4b
 - http://autobuild.buildroot.org/results/32b51bb9eda7899b6cc331f10a860644bd6004fa

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit eec72d3a94)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:24:15 +02:00
Fabrice Fontaine
e43db1180f package/monkey: bump to latest git commit
This will fix a build failure with gcc 10

- Update indentation in hash file (two spaces)
- Drop INSTALL_SYSCONFDIR, INSTALL_WEBROOTDIR and WITH_SYSTEM_MALLOC
  (not available since
  df145932e3)
- Set WITHOUT_HEADERS to ON because headers are not needed and to avoid
  the following build failure:

CMake Error at include/cmake_install.cmake:46 (file):
  file INSTALL cannot find
  "/home/fabrice/buildroot/output/build/monkey-f54856ce250c4e25735434dc75717a4b7fbfc45b/include/mk_core.h":
  No such file or directory.
Call Stack (most recent call first):
  cmake_install.cmake:69 (include)

Upstream is aware than the lack of release is an issue but no comments
since 2018: https://github.com/monkey/monkey/issues/276

Fixes:
 - http://autobuild.buildroot.org/results/0b723937ca048228082d040100f6e6324ac8300b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 26a7d912f4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:17:27 +02:00
Adam Duskett
a523755bfb testing/tests/package/test_openjdk.py: bump kernel version to 5.10.34
Kernel 4.16.7 is old enough to produce the "multiple definition of `yylloc'"
error which is fixed in newer versions.

Bump the test kernel version from 4.16.7 to 5.10.34 to prevent this error wwhen
building the test image.

Signed-off-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ab2d472cde)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 16:14:25 +02:00
Bernd Kuhls
08c510f60b package/exim: security bump version to 4.94.2
Release announcement:
https://lists.exim.org/lurker/message/20210421.123632.08bb711a.en.html

According to
http://www.exim.org/static/doc/security/CVE-2020-qualys/21nails.txt
this version bump fixes

Local vulnerabilities
- CVE-2020-28007: Link attack in Exim's log directory
- CVE-2020-28008: Assorted attacks in Exim's spool directory
- CVE-2020-28014: Arbitrary file creation and clobbering
- CVE-2021-27216: Arbitrary file deletion
- CVE-2020-28011: Heap buffer overflow in queue_run()
- CVE-2020-28010: Heap out-of-bounds write in main()
- CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
- CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
- CVE-2020-28015: New-line injection into spool header file (local)
- CVE-2020-28012: Missing close-on-exec flag for privileged pipe
- CVE-2020-28009: Integer overflow in get_stdinput()

Remote vulnerabilities
- CVE-2020-28017: Integer overflow in receive_add_recipient()
- CVE-2020-28020: Integer overflow in receive_msg()
- CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
- CVE-2020-28021: New-line injection into spool header file (remote)
- CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
- CVE-2020-28026: Line truncation and injection in spool_read_header()
- CVE-2020-28019: Failure to reset function pointer after BDAT error
- CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
- CVE-2020-28018: Use-after-free in tls-openssl.c
- CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 1e96b6189a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 11:38:22 +02:00
Peter Seiderer
8addf4b71e package/libtomcrypt: compile with -fPIC to enable linking to dynamic libraries/exectuables
Fixes:

  .../x86_64-buildroot-linux-gnu/bin/ld: .../host/x86_64-buildroot-linux-gnu/sysroot/usr/lib/libtomcrypt.a(md5.o): relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a shared object; recompile with -fPIC

when building a shared library that links with libtomcrypt. Our only
internal user dropbear doesn't do this, so there are no autobuilder
failures.

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit ec2ee79ec1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-08 11:32:36 +02:00
Christian Stewart
d66c6bf5e5 package/libfuse3: bump version to 3.10.3
Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0b09d6feaa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-07 10:42:32 +02:00
Fabrice Fontaine
6be12789dc package/libopenssl: fix performance issue in static build
Revert commit 8c2c959b02 as no-dso has
been added back to openssl since version 1.1.1e and
8dcd574619
and because gcc no-asm has performance issue

Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=13751

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 67d19f6014)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-05-07 10:38:50 +02:00