Commit Graph

61601 Commits

Author SHA1 Message Date
Peter Korsgaard
5803bbd900 configs/qemu_aarch64_virt_defconfig: linux.config: enable fb/input support
The Linux config already enabled drm-virtio for graphics output, but not the
corresponding virtio-input / evdev drivers for input or the compatibility fb
option.

Enable them so keyboard/mouse input works and /dev/fb0 is provided.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-22 20:08:41 +01:00
Peter Korsgaard
24307955a2 configs/qemu_aarch64_virt_defconfig: don't hard code getty port
The Linux defconfig both has VT and serial port support, so it makes more
sense to run getty on /dev/console instead of hard coding the serial port.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-22 20:08:38 +01:00
Fabrice Fontaine
829bf508bb package/expat: security bump to version 2.4.3
Fix CVE-2021-45960, CVE-2021-46143 and CVE-2022-22822 to CVE-2022-22827

https://blog.hartwork.org/posts/expat-2-4-3-released
https://github.com/libexpat/libexpat/blob/R_2_4_3/expat/Changes

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 15:39:32 +01:00
Fabrice Fontaine
937a70001f Revert "package/libmicrohttpd: fix pthread detection"
This reverts commit 834464792e, the build
failure is not related to the bump to 0.9.75 but to or1k and gcc 10.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 15:33:13 +01:00
Fabrice Fontaine
98e39dc80e package/gcc: define _REENTRANT for OpenRISC when -pthread is passed
Patch added by commit eee96b0f0a on gcc
9.3.0 must also be applied on gcc 10 and 11 to avoid the following build
failure on numerous packages (babeltrace2, pcsc-lite, tpm2-pkcs11,
etc.):

configure:13774: checking whether pthreads work with -pthread
configure:13868: /home/giuliobenetti/autobuild/run/instance-0/output-1/host/bin/or1k-linux-gcc -o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64  -Os -g2  -std=gnu99 -pthread -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64  conftest.c   >&5
conftest.c:27:26: error: #error "_REENTRANT must be defined"
   27 | #                        error "_REENTRANT must be defined"
      |                          ^~~~~

It should be noted that external bootlins will have to be rebuilt.

Fixes:
 - http://autobuild.buildroot.org/results/cb58d4fbaeb08d188c2f8bf05ef1604789fa8766
 - http://autobuild.buildroot.org/results/7af9d4b68bd46ed260ed66ba2cc3c9c21482e741
 - http://autobuild.buildroot.org/results/6f926bec146752873f8032b593f0de1cb222ea46

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 15:33:07 +01:00
Heiko Thiery
96a1344aae configs/kontron_pitx_imx8m: bump kernel to 5.16.1
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 15:08:18 +01:00
Heiko Thiery
ed380f62e0 board/kontron/pitx-imx8m: use extlinux instead of U-Boot boot script
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 15:07:23 +01:00
Fabio Estevam
c8bf60c50c configs/mx6sx_udoo_neo: select BR2_TARGET_UBOOT_NEEDS_OPENSSL
Select BR2_TARGET_UBOOT_NEEDS_OPENSSL to fix the following build
error:

include/image.h:1178:12: fatal error: openssl/evp.h: No such file or directory
 1178 | #  include <openssl/evp.h>
      |            ^~~~~~~~~~~~~~~

Fixes:
- https://gitlab.com/buildroot.org/buildroot/-/jobs/1970083907

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 15:01:57 +01:00
Francois Perrad
2d99bd8f7e package/prosody: security bump to 0.11.12
see https://blog.prosody.im/prosody-0.11.12-released/

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Thomas: update separator for license file hash.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 14:54:13 +01:00
Rainer Jonsson
2ecc4379d1 package/vte: install to staging
vte also provides libvte, a library that can be linked to by other
programs, so install it in staging.

Signed-off-by: Rainer Jonsson <rainbox2k12@msgsafe.io>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 14:52:21 +01:00
Guillaume W. Bres
61ef0ff827 package/libxcrypt: bump to version 4.4.27
The hash of the LICENSING file is modified due to changes in file
paths listed in that file. No impact on the licensing terms.

Signed-off-by: Guillaume W. Bres <guillaume.bressaix@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 14:38:51 +01:00
Fabrice Fontaine
b5e36f80a6 package/libjpeg: security bump to version 9e
rdgif.c, cderror.h: add sanity check for GIF image dimensions.
Thank to Casper Sun for cjpeg potential vulnerability report.

- Update hash of README (changes not related to license)
- Update indentation in hash file (two spaces)

https://jpegclub.org/reference/reference-sources/

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 14:35:37 +01:00
Peter Seiderer
2915d5a9f1 package/rtl8812au-aircrack-ng: bump version to 3a6402e
Changelog:

  47a38b7 Fix kernel 5.15 compilation
  6fd304f fix libc6_2.34 dependency on build
  307d694 Merge pull request #898 from CGarces/fix_5.15
  191f5bc Remove REMAKE_INITRD
  bd8e44b Add back 8814au support
  849206d Merge pull request #913 from iyanmv/iyanmv-remove-remake-initrd
  7bb5114 Fix kernel v5.15+ compiler warnings
  1b63ee6 Fixed compiler warning for unused function
  a72835d Fix (test) for IPX header on various distros
  3a6402e Fix for kernel v3.20

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 14:21:06 +01:00
James Hilliard
49d7c85421 package/libxml2: add optional icu support
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 13:20:07 +01:00
Pedro Aguilar
4ad77c42db package/libunistring: bump version to 1.0
- Update indentation in hash file (two spaces)

Signed-off-by: Pedro Aguilar <paguilar@paguilar.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 13:18:50 +01:00
Danilo Bargen
944eb00fd1 configs/pcengines_apu2_defconfig: bump kernel to 5.16
This fixes the compile errors that were present with the previous
kernel version (4.19):

https://gitlab.com/buildroot.org/buildroot/-/jobs/1970084022

Additionally, the defconfig file was refactored: Configuration
values are now grouped logically, thus increasing readability and
maintainability.

Signed-off-by: Danilo Bargen <mail@dbrgn.ch>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 13:17:16 +01:00
Giulio Benetti
aab9cb163e package/xr819-xradio: bump to latest version to fix Linux >= 5.13 building
Pending PR is now merged[1] and it fixes Linux >= 5.13 building. So let's
bump xr819-xradio version.

[1]: https://github.com/fifteenhex/xradio/pull/15

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Tested-by: Sergey Kuzminov <kuzminov.sergey81@gmail.com>
Tested-by: Sergey Kuzminov <kuzminov.sergey81@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 13:16:14 +01:00
Peter Seiderer
d958ae450d package/readline: bump version to 8.1.2
For details see [1].

[1] http://git.savannah.gnu.org/cgit/readline.git/log

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 13:15:21 +01:00
Heiko Thiery
b399de3a12 configs/kontron_pitx_imx8m: remove BR2_ARM_FPU_VFPV3
The FP setting is not used for aarch64 in buildroot. The FPU options are
set implicit.

Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-22 13:15:09 +01:00
Francois Perrad
970f1b0df0 package/perl-uri: bump to version 5.10
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-21 22:23:56 +01:00
Francois Perrad
3d3a26867b package/perl-try-tiny: bump to version 0.31
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-21 22:23:54 +01:00
Francois Perrad
19f318a1e1 package/perl-path-tiny: bump to version 0.122
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-21 22:23:51 +01:00
Francois Perrad
7b9961c6e1 package/perl-net-dns: bump to version 1.33
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-21 22:23:49 +01:00
Francois Perrad
b1050a4c32 package/perl-libwww-perl: bump to version 6.60
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-21 22:23:47 +01:00
Francois Perrad
bd75f2d403 package/perl-io-socket-ssl: bump to version 2.074
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-21 22:23:44 +01:00
Francois Perrad
6b1e9b844c package/perl-http-message: bump to version 6.36
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-21 22:23:42 +01:00
Francois Perrad
068d86abf1 package/perl-date-manip: bump to version 6.86
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-21 22:23:40 +01:00
Quentin Schulz
9151eab3c7 package/qt5/qt5base: fix CVE-2021-38593
5.15.2 is the last public release of 5.15 and does not contain this CVE
fix. However, >=6.1.2 and >5.12.12 all contain the necessary patches so
let's port them to 5.15.2.

Technically only the first two patches are required to patch the CVE.
However, the second patch introduces a regression that is fixed in the third
patch.

The patches are taken from KDE kde/5.15 git branch.

Cc: Quentin Schulz <foss+buildroot@0leil.net>
Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-21 21:50:27 +01:00
Peter Seiderer
9757e7d99e package/hwloc: bump version to 2.7.0
For details see [1].

[1] https://github.com/open-mpi/hwloc/blob/hwloc-2.7.0/NEWS

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-20 21:54:28 +01:00
Peter Seiderer
b61f0d74c9 package/hwdata: bump version to 355
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-20 21:54:25 +01:00
Peter Seiderer
b50ab233e6 package/hdparm: bump version to 9.63
For details see [1].

[1] https://sourceforge.net/p/hdparm/news/2022/01/hdparm-963-is-released-

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-20 21:35:31 +01:00
Peter Seiderer
80b3c51c06 package/bash: bump version to 5.1.16
- remove upstream patch level patches
  0001-bash51-001.patch
  0002-bash51-002.patch
  0003-bash51-003.patch
  0004-bash51-004.patch

- renumber remaining patches

For details see [1].

[1] http://git.savannah.gnu.org/cgit/bash.git/log

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-20 21:35:28 +01:00
Alexey Brodkin
507b1b9770 configs/cubieboard2: U-Boot needs Python3 & OpenSSL
After update of the U-Boot [1] we were missing dependency on Python3,
and so were seeing failures like in [2]:
------------------------->8--------------------
  HOSTLD  scripts/dtc/dtc
scripts/dtc/pylibfdt/libfdt_wrap.c:154:11: fatal error: Python.h: No such file or directory
  154 | # include <Python.h>
      |           ^~~~~~~~~~
compilation terminated.
error: command '/usr/bin/gcc' failed with exit code 1
------------------------->8--------------------

So that get fixed with "BR2_TARGET_UBOOT_NEEDS_PYTHON3=y".
And then once we use Python3, we also need OpenSSL, similarly to [3]
and the likes. So do it with "BR2_TARGET_UBOOT_NEEDS_OPENSSL=y".

Hopefully now all starts to build w/o any issues.

And while at it let's add a bit more structure to the config!

[1] https://git.buildroot.net/buildroot/commit/?id=06f10a88f30b73aaea5c0e0888d7ba9d9a6420f3
[2] https://gitlab.com/buildroot.org/buildroot/-/jobs/1946650570
[3] https://git.buildroot.net/buildroot/commit/?id=cf2a7663ccc6089e98e0d6ec39fa8623749c0c24

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 22:50:41 +01:00
Michael Fischer
3a4300e826 package/gnuplot: bump version to 5.4.3
Signed-off-by: Michael Fischer <mf@go-sys.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 22:46:49 +01:00
Peter Seiderer
6775e3e476 package/strace: bump version to 5.16
- update license file hash for COPYING (copyright year update)

Changelog (from [1]):

  Noteworthy changes in strace 5.16 (2022-01-10)
  ==============================================

  * Improvements
    * Implemented --secontext=mismatch option to find mismatches in SELinux
      contexts.
    * Implemented decoding of futex_waitv syscall introduced in Linux 5.16.
    * Implemented decoding of BPF_LINK_GET_NEXT_ID and BPF_LINK_GET_FD_BY_ID bpf
      syscall commands.
    * Enhanced decoding of BPF_MAP_CREATE, BPF_PROG_TEST_RUN, and BPF_PROG_LOAD
      bpf syscall commands.
    * Enhanced decoding of BTRFS_IOC_FS_INFO ioctl command.
    * Updated lists of AUDIT_*, BPF_*, BTRFS_*, DEVCONF_*, FAN_*, ETH_P_*,
      IPV4_DEVCONF_*, KVM_*, NDA_*, SO_*, and V4L2_* constants.
    * Updated lists of ioctl commands from Linux 5.16.

  * Bug fixes
    * Fixed build for older Android.

[1] https://strace.io/files/5.16/

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 22:45:22 +01:00
Peter Seiderer
f6297befe1 package/enlightenment: change download URL to https
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[yann.morin.1998@free.fr: also change in Config.in]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 22:34:43 +01:00
Peter Seiderer
c3d5b27d5d package/efl: change download URL to https
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[yann.morin.1998@free.fr: canonicalise homepage]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 22:34:35 +01:00
Peter Seiderer
7527324132 package/brcmfmac_sdio-firmware-rpi: merge of rpi-{bt,wifi}-firmware
Move rpi-bt-firmware and rpi-wifi-firmware packages to the new
brcmfmac_sdio-firmware-rpi one (as they are the same upstream
package).

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[yann.morin.1998@free.fr:
  - fix check-package
  - legacy symbols still depend on arm || aarch64
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 22:24:11 +01:00
Peter Seiderer
5ccb5f9dbe package/rpi-wifi-firmware bump version to ea9963f
- add cypress files

- update links

Chanelog (since 3888ba2):

  - Sync with RPi-Distro repo
    Switch to "bullseye" branch which moved several firmware files to
    the cypress dir.
    Add 43438 firmware 7.45.98.118 + external clm_blob
    Add 43455 firmware 7.45.241 and clm_blob

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 22:12:10 +01:00
Peter Seiderer
520b760a53 package/rpi-bt-firmware: bump version to ea9963f
Chanelog (since 3888ba2):

  - Sync with RPi-Distro repo
    Switch to "bullseye" branch which moved several firmware files to
    the cypress dir.
    Add 43438 firmware 7.45.98.118 + external clm_blob
    Add 43455 firmware 7.45.241 and clm_blob

  - README.md: update link to RPi-distro repo wifi firmware files
  - Merge pull request #19 from HiassofT/2021-12

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 22:12:06 +01:00
Peter Seiderer
8a71f9f827 package/rpi-userland: bump version to 14b90ff
Changelog:

  f5404b2 raspicam: Check system is running legacy camera stack
  14b90ff mmal: Hack to make mmal core register VideoCore components

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 22:12:04 +01:00
Peter Seiderer
9958744a0c package/rpi-firmware: bump version to 3f20b83
Changelog:

  095deea759 kernel: overlays: vc4-kms-v3d: Change composite handling
  2e9b609e53c kernel: Bump to 5.10.79
  12bc6e36773 firmware: dtoverlay: Rebase aliases in overlays like labels
  24d966d35bb kernel: Bump to 5.10.81
  ca52e7c1303 kernel: edt-ft5x06 touchscreen fixes
  1a0297bfbf7 kernel: Bump to 5.10.82
  0a1a871d04c kernel: Fix for IN Token of USB Endpoint 1 stopping occasionally on Pi 4
  303d0012cd7 kernel: Bump to 5.10.83
  bd8b6d5dc8e kernel: Bump to 5.10.85
  56f1b8bbc88 kernel: Bump to 5.10.87
  536baf33ae9 kernel: Bump to 5.10.88
  ce71e3e9b34 kernel: Bump to 5.10.89
  19b570d0d6a firmware: arm-loader: Fix kernel8.img selection on 2837 with arm_64bit=1
  fbbde90b709 kernel: drm/vc4: fix non-working audio on RPi3 and no video with DVI
  165bd7bc562 firmware: improve firmware camera detection
  318e3373496 kernel: Bump to 5.10.90
  175984a6dc4 kernel: drm/vc4: Add alpha_blend_mode property to each plane
  20c5829b0af kernel: Bump to 5.10.92
  3f20b832b27 firmware: arm_loader: Only clip min/max to the same value for turbo clocks

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 22:12:00 +01:00
Peter Seiderer
4a8a6dc41c configs/raspberrypi*: bump kernel version to 0b54dbd (5.10.92)
Now based on 5.10.92 (from 5.10.78).

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 22:11:58 +01:00
Tilman Keskinöz
cbb70493af paclage/tpm2-tss: do not select liburiparser
Commit 593683b45f (package/tpm2-tss: remove unused dependency)
removed the build-time dependency (in the .mk), but forgot to
remove it from the Config.in.

Signed-off-by: Tilman Keskinöz <arved@arved.at>
[yann.morin.1998@free.fr: reword commit log]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-19 21:28:02 +01:00
Fabrice Fontaine
8ae840ba19 package/riscv-isa-sim: set --with-boost
Set --with-boost to avoid the following build failure when a non working
boost version is installed on host. This failure is raised since the
addition of the package in commit
ea033cecf9:

configure:5559: error: Could not find a version of the Boost::Asio library!

Fixes:
 - http://autobuild.buildroot.org/results/855b66b86d979cc922b947da932b0e2388481263

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-18 18:27:46 +01:00
Peter Korsgaard
9096036f00 package/nodejs: security bump to version 14.18.3
Fixes the following security issues:

Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is
specifically defined to use a particular SAN type, can result in bypassing
name-constrained intermediates.  Node.js was accepting URI SAN types, which
PKIs are often not defined to use.  Additionally, when a protocol allows URI
SANs, Node.js did not match the URI correctly.

Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)

Node.js converts SANs (Subject Alternative Names) to a string format.  It
uses this string to check peer certificates against hostnames when
validating connections.  The string format was subject to an injection
vulnerability when name constraints were used within a certificate chain,
allowing the bypass of these name constraints.

Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)

Node.js did not handle multi-value Relative Distinguished Names correctly.
Attackers could craft certificate subjects containing a single-value
Relative Distinguished Name that would be interpreted as a multi-value
Relative Distinguished Name, for example, in order to inject a Common Name
that would allow bypassing the certificate subject verification.

Prototype pollution via console.table properties (Low)(CVE-2022-21824)

Due to the formatting logic of the console.table() function it was not safe
to allow user controlled input to be passed to the properties parameter
while simultaneously passing a plain object with at least one property as
the first parameter, which could be __proto__.  The prototype pollution has
very limited control, in that it only allows an empty string to be assigned
numerical keys of the object prototype.

For details, see the advisory:
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-17 22:34:41 +01:00
Alexander Egorenkov
6e4791b751 package/multipath-tools: bump to version 0.8.8
Signed-off-by: Alexander Egorenkov <egorenar-dev@posteo.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-15 17:09:08 +01:00
Romain Naour
04afe86cd7 board/qemu/arm-vexpress-tz: use enable=on
Since Qemu 6.0.0 [1], a warning appear in the log if a short-form
boolean option is used.

[1] https://git.qemu.org/?p=qemu.git;a=commitdiff;h=ccd3b3b8112b670fdccf8a392b8419b173ffccb4

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Etienne Carriere <etienne.carriere@linaro.org>
Cc: Dick Olsson <hi@senzilla.io>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-15 17:02:52 +01:00
Fabrice Fontaine
a17d4aba54 package/python-django: security bump to version 3.2.11
Fixes:
 - CVE-2021-45115: Denial-of-service possibility in
   UserAttributeSimilarityValidator
 - CVE-2021-45116: Potential information disclosure in dictsort template
   filter
 - CVE-2021-45452: Potential directory-traversal via Storage.save()

https://www.djangoproject.com/weblog/2022/jan/04/security-releases

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-15 15:22:02 +01:00
Fabrice Fontaine
a4830cf9e4 package/bento4: add BENTO4_CPE_ID_VENDOR
cpe:2.3🅰️axiosys:bento4 is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aaxiosys%3Abento4

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-01-15 15:20:17 +01:00