CVE Packages Update

Move libfastjson to the rsyslog directory

rsyslog 8.2002.0 -> 8.2206.0

add ntp4.2.8 recipe with fixed CVEs

update cryptsetup to 2.4.3

fix libxml2 CVE-2016-3709

curl 7.75.0 -> 7.86.0

strongswan 5.8.4 -> 5.9.8

libmodbus 3.1.6 -> 3.1.7

libesmtp 1.0.6 -> 1.1.0

cifs-utils 6.1 -> 7.0

update libtirpc to version 1.3.3

update rsync to version 3.2.5

Add zlib 1.2.13

upgrade gnutls to 3.7.8

upgrade openssh to 8.9p1

Add cmake 3.24.2 and cmake-native 3.24.2 to avoid loop dependecies building expat

Add expat 2.5.0 to fix CVE-2022-40674 and CVE-2022-43680

openvpn 2.4.9 -> 2.4.12

hostapd 2.9 -> 2.10

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Openssh 8.9p1 no longer needed, because all necessary CVE fixes, backports and whitelists are present for current Openssh 8.4p1. There are no new CVE's in report.

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Backported CVE patches for python3 component. Need to remove after upgrading Yocto to version more than 3.1.21.

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Backported CVE patch for sudo component.
Added 2 CVE's to whitelist for OpenVPN component.

9 files changed, 329 insertions, 0 deletions

diff --git a/recipes-devtools/cmake/cmake-native_3.24.2.bb b/recipes-devtools/cmake/cmake-native_3.24.2.bb
new file mode 100644
index 0000000..bcc87eb
--- /dev/null
+++ b/recipes-devtools/cmake/cmake-native_3.24.2.bb
@@ -0,0 +1,65 @@
+require cmake.inc
+inherit native
+
+DEPENDS += "bzip2-replacement-native xz-native zlib-native curl-native ncurses-native zstd-native"
+
+SRC_URI += "file://OEToolchainConfig.cmake \
+            file://environment.d-cmake.sh \
+            file://0001-CMakeDetermineSystem-use-oe-environment-vars-to-load.patch \
+            file://0005-Disable-use-of-ext2fs-ext2_fs.h-by-cmake-s-internal-.patch \
+            "
+
+LICENSE:append = " & BSD-1-Clause & MIT & BSD-2-Clause"
+LIC_FILES_CHKSUM:append = " \
+    file://Utilities/cmjsoncpp/LICENSE;md5=5d73c165a0f9e86a1342f32d19ec5926 \
+    file://Utilities/cmlibarchive/COPYING;md5=d499814247adaee08d88080841cb5665 \
+    file://Utilities/cmexpat/COPYING;md5=9e2ce3b3c4c0f2670883a23bbd7c37a9 \
+    file://Utilities/cmlibrhash/COPYING;md5=a8c2a557a5c53b1c12cddbee98c099af \
+    file://Utilities/cmlibuv/LICENSE;md5=ad93ca1fffe931537fcf64f6fcce084d \
+"
+
+B = "${WORKDIR}/build"
+do_configure[cleandirs] = "${B}"
+
+CMAKE_EXTRACONF = "\
+    -DCMAKE_LIBRARY_PATH=${STAGING_LIBDIR_NATIVE} \
+    -DBUILD_CursesDialog=1 \
+    -DCMAKE_USE_SYSTEM_LIBRARIES=1 \
+    -DCMAKE_USE_SYSTEM_LIBRARY_JSONCPP=0 \
+    -DCMAKE_USE_SYSTEM_LIBRARY_LIBARCHIVE=0 \
+    -DCMAKE_USE_SYSTEM_LIBRARY_LIBUV=0 \
+    -DCMAKE_USE_SYSTEM_LIBRARY_LIBRHASH=0 \
+    -DCMAKE_USE_SYSTEM_LIBRARY_EXPAT=0 \
+    -DENABLE_ACL=0 -DHAVE_ACL_LIBACL_H=0 \
+    -DHAVE_SYS_ACL_H=0 \
+    -DCURL_LIBRARIES=-lcurl \
+"
+
+do_configure () {
+	${S}/configure --verbose --prefix=${prefix} \
+		${@oe.utils.parallel_make_argument(d, '--parallel=%d')} \
+		${@bb.utils.contains('CCACHE', 'ccache ', '--enable-ccache', '', d)} \
+		-- ${CMAKE_EXTRACONF}
+}
+
+do_compile() {
+	oe_runmake
+}
+
+do_install() {
+	oe_runmake 'DESTDIR=${D}' install
+
+	# The following codes are here because eSDK needs to provide compatibilty
+	# for SDK. That is, eSDK could also be used like traditional SDK.
+	mkdir -p ${D}${datadir}/cmake
+	install -m 644 ${WORKDIR}/OEToolchainConfig.cmake ${D}${datadir}/cmake/
+	mkdir -p ${D}${base_prefix}/environment-setup.d
+	install -m 644 ${WORKDIR}/environment.d-cmake.sh ${D}${base_prefix}/environment-setup.d/cmake.sh
+
+	# Help docs create tons of files in the native sysroot and aren't needed there
+	rm -rf ${D}${datadir}/cmake-*/Help
+}
+
+do_compile[progress] = "percent"
+
+SYSROOT_DIRS_NATIVE += "${datadir}/cmake ${base_prefix}/environment-setup.d"
diff --git a/recipes-devtools/cmake/cmake.inc b/recipes-devtools/cmake/cmake.inc
new file mode 100644
index 0000000..7561e85
--- /dev/null
+++ b/recipes-devtools/cmake/cmake.inc
@@ -0,0 +1,28 @@
+# Copyright (C) 2005, Koninklijke Philips Electronics NV.  All Rights Reserved
+# Released under the MIT license (see packages/COPYING)
+
+SUMMARY = "Cross-platform, open-source make system"
+DESCRIPTION = "CMake is used to control the software compilation process \
+using simple platform and compiler independent configuration files. CMake \
+generates native makefiles and workspaces that can be used in the compiler \
+environment of your choice."
+HOMEPAGE = "http://www.cmake.org/"
+BUGTRACKER = "http://public.kitware.com/Bug/my_view_page.php"
+SECTION = "console/utils"
+LICENSE = "BSD-3-Clause"
+LIC_FILES_CHKSUM = "file://Copyright.txt;md5=45025187a129339459b6f1a24f7fac6e \
+                    file://Source/cmake.h;beginline=1;endline=2;md5=a5f70e1fef8614734eae0d62b4f5891b \
+                    "
+
+CMAKE_MAJOR_VERSION = "${@'.'.join(d.getVar('PV').split('.')[0:2])}"
+
+SRC_URI = "https://cmake.org/files/v${CMAKE_MAJOR_VERSION}/cmake-${PV}.tar.gz \
+"
+
+SRC_URI[sha256sum] = "0d9020f06f3ddf17fb537dc228e1a56c927ee506b486f55fe2dc19f69bf0c8db"
+
+UPSTREAM_CHECK_REGEX = "cmake-(?P<pver>\d+(\.\d+)+)\.tar"
+
+# This is specific to the npm package that installs cmake, so isn't
+# relevant to OpenEmbedded
+CVE_CHECK_IGNORE += "CVE-2016-10642"
diff --git a/recipes-devtools/cmake/cmake/0001-CMakeDetermineSystem-use-oe-environment-vars-to-load.patch b/recipes-devtools/cmake/cmake/0001-CMakeDetermineSystem-use-oe-environment-vars-to-load.patch
new file mode 100644
index 0000000..9a2287f
--- /dev/null
+++ b/recipes-devtools/cmake/cmake/0001-CMakeDetermineSystem-use-oe-environment-vars-to-load.patch
@@ -0,0 +1,44 @@
+From 89f6c846f02ad6d30b9ebb7eaaaa4fb6f9cec054 Mon Sep 17 00:00:00 2001
+From: Cody P Schafer <dev@codyps.com>
+Date: Thu, 27 Apr 2017 11:35:05 -0400
+Subject: [PATCH] CMakeDetermineSystem: use oe environment vars to load default
+ toolchain file in sdk
+
+Passing the toolchain by:
+
+ - shell aliases does not work if cmake is called by a script
+ - unconditionally by a wrapper script causes cmake to believe it is
+   configuring things when it is not (for example, `cmake --build` breaks).
+
+The OE_CMAKE_TOOLCHAIN_FILE variable is only used as a default if no
+toolchain is explicitly specified.
+
+Setting the CMAKE_TOOLCHAIN_FILE cmake variable is marked as cached
+because '-D' options are cache entries themselves.
+
+Upstream-Status: Inappropriate [oe-core specific]
+Signed-off-by: Cody P Schafer <dev@codyps.com>
+Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
+
+---
+ Modules/CMakeDetermineSystem.cmake | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/Modules/CMakeDetermineSystem.cmake b/Modules/CMakeDetermineSystem.cmake
+index 8c7af067..ade2b189 100644
+--- a/Modules/CMakeDetermineSystem.cmake
++++ b/Modules/CMakeDetermineSystem.cmake
+@@ -112,6 +112,13 @@ else()
+   endif()
+ endif()
+ 
++if(NOT DEFINED CMAKE_TOOLCHAIN_FILE)
++  if(DEFINED ENV{OE_CMAKE_TOOLCHAIN_FILE})
++    set(CMAKE_TOOLCHAIN_FILE "$ENV{OE_CMAKE_TOOLCHAIN_FILE}" CACHE FILEPATH "toolchain file")
++    message(STATUS "Toolchain file defaulted to '${CMAKE_TOOLCHAIN_FILE}'")
++  endif()
++endif()
++
+ # if a toolchain file is used, the user wants to cross compile.
+ # in this case read the toolchain file and keep the CMAKE_HOST_SYSTEM_*
+ # variables around so they can be used in CMakeLists.txt.
diff --git a/recipes-devtools/cmake/cmake/0005-Disable-use-of-ext2fs-ext2_fs.h-by-cmake-s-internal-.patch b/recipes-devtools/cmake/cmake/0005-Disable-use-of-ext2fs-ext2_fs.h-by-cmake-s-internal-.patch
new file mode 100644
index 0000000..d6f7308
--- /dev/null
+++ b/recipes-devtools/cmake/cmake/0005-Disable-use-of-ext2fs-ext2_fs.h-by-cmake-s-internal-.patch
@@ -0,0 +1,39 @@
+From fd9a04c1434e12f21c043385e306e0b52d38d749 Mon Sep 17 00:00:00 2001
+From: Otavio Salvador <otavio@ossystems.com.br>
+Date: Thu, 5 Jul 2018 10:28:04 -0300
+Subject: [PATCH] Disable use of ext2fs/ext2_fs.h by cmake's internal
+
+ libarchive copy
+Organization: O.S. Systems Software LTDA.
+
+We don't want to add a dependency on e2fsprogs-native for cmake-native,
+and we don't use CPack so just disable this functionality.
+
+Upstream-Status: Inappropriate [config]
+
+Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
+Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
+
+---
+ Utilities/cmlibarchive/CMakeLists.txt | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/Utilities/cmlibarchive/CMakeLists.txt b/Utilities/cmlibarchive/CMakeLists.txt
+index bfcaf30..2960683 100644
+--- a/Utilities/cmlibarchive/CMakeLists.txt
++++ b/Utilities/cmlibarchive/CMakeLists.txt
+@@ -682,12 +682,8 @@ LA_CHECK_INCLUDE_FILE("copyfile.h" HAVE_COPYFILE_H)
+ LA_CHECK_INCLUDE_FILE("direct.h" HAVE_DIRECT_H)
+ LA_CHECK_INCLUDE_FILE("dlfcn.h" HAVE_DLFCN_H)
+ LA_CHECK_INCLUDE_FILE("errno.h" HAVE_ERRNO_H)
+-LA_CHECK_INCLUDE_FILE("ext2fs/ext2_fs.h" HAVE_EXT2FS_EXT2_FS_H)
+-
+-CHECK_C_SOURCE_COMPILES("#include <sys/ioctl.h>
+-#include <ext2fs/ext2_fs.h>
+-int main(void) { return EXT2_IOC_GETFLAGS; }" HAVE_WORKING_EXT2_IOC_GETFLAGS)
+-
++SET(HAVE_EXT2FS_EXT2_FS_H 0)
++SET(HAVE_WORKING_EXT2_IOC_GETFLAGS 0)
+ LA_CHECK_INCLUDE_FILE("fcntl.h" HAVE_FCNTL_H)
+ LA_CHECK_INCLUDE_FILE("grp.h" HAVE_GRP_H)
+ LA_CHECK_INCLUDE_FILE("io.h" HAVE_IO_H)
diff --git a/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake b/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake
new file mode 100644
index 0000000..d6a1e04
--- /dev/null
+++ b/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake
@@ -0,0 +1,20 @@
+set( CMAKE_SYSTEM_NAME Linux )
+set( CMAKE_C_FLAGS $ENV{CFLAGS} CACHE STRING "" FORCE )
+set( CMAKE_CXX_FLAGS $ENV{CXXFLAGS}  CACHE STRING "" FORCE )
+set( CMAKE_SYSROOT $ENV{OECORE_TARGET_SYSROOT} )
+
+set( CMAKE_FIND_ROOT_PATH $ENV{OECORE_TARGET_SYSROOT} )
+set( CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER )
+set( CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY )
+set( CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY )
+set( CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY )
+
+set(CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX "$ENV{OE_CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX}")
+
+set( CMAKE_SYSTEM_PROCESSOR $ENV{OECORE_TARGET_ARCH} )
+
+# Include the toolchain configuration subscripts
+file( GLOB toolchain_config_files "${CMAKE_CURRENT_LIST_FILE}.d/*.cmake" )
+foreach(config ${toolchain_config_files})
+    include(${config})
+endforeach()
diff --git a/recipes-devtools/cmake/cmake/SDKToolchainConfig.cmake.template b/recipes-devtools/cmake/cmake/SDKToolchainConfig.cmake.template
new file mode 100644
index 0000000..c69569a
--- /dev/null
+++ b/recipes-devtools/cmake/cmake/SDKToolchainConfig.cmake.template
@@ -0,0 +1,31 @@
+set(SDK_INSTALL_DIR "${CMAKE_CURRENT_LIST_DIR}/../../../../..")
+set(HOST_SYSROOT    "${SDK_INSTALL_DIR}/sysroots/@OECORE_SDK_SYS")
+set(TARGET_SYSROOT  "${SDK_INSTALL_DIR}/sysroots/@OECORE_TARGET_SYS")
+set(HOST_BIN        "${HOST_SYSROOT}/usr/bin")
+set(TOOLCHAIN_NAME  "@OECORE_TARGET_ALIAS")
+set(GCC_DIR         "${HOST_BIN}/${TOOLCHAIN_NAME}")
+
+set(CMAKE_SYSTEM_NAME       Linux)
+set(CMAKE_SYSTEM_PROCESSOR "@OECORE_TARGET_ARCH")
+
+set(CMAKE_C_COMPILER    "${GCC_DIR}/${TOOLCHAIN_NAME}-gcc")
+set(CMAKE_CXX_COMPILER  "${GCC_DIR}/${TOOLCHAIN_NAME}-g++")
+
+set(ARCH_FLAGS          "@OECORE_TUNE_CCARGS")
+set(CMAKE_C_FLAGS       "${ARCH_FLAGS}" CACHE STRING "" FORCE )
+set(CMAKE_CXX_FLAGS     "${ARCH_FLAGS}" CACHE STRING "" FORCE )
+set(CMAKE_ASM_FLAGS     ${CMAKE_C_FLAGS} CACHE STRING "" FORCE )
+set(CMAKE_LDFLAGS_FLAGS ${CMAKE_C_FLAGS} CACHE STRING "" FORCE )
+
+set(CMAKE_SYSROOT "${TARGET_SYSROOT}")
+
+set(CMAKE_FIND_ROOT_PATH "${TARGET_SYSROOT}" )
+
+set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER )
+set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY )
+set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY )
+set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY )
+
+set(CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX "")
+
+set(CMAKE_PROGRAM_PATH "${HOST_SYSROOT}/usr/bin" CACHE STRING "" FORCE)
diff --git a/recipes-devtools/cmake/cmake/cmake-setup.py b/recipes-devtools/cmake/cmake/cmake-setup.py
new file mode 100755
index 0000000..af587a4
--- /dev/null
+++ b/recipes-devtools/cmake/cmake/cmake-setup.py
@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+
+import os
+import string
+import sys
+
+class Template(string.Template):
+    delimiter = "@"
+
+class Environ():
+    def __getitem__(self, name):
+        if name == "OECORE_SDK_SYS":
+            return  os.path.basename(os.environ["OECORE_NATIVE_SYSROOT"])
+        elif name == "OECORE_TARGET_SYS":
+            return  os.path.basename(os.environ["OECORE_TARGET_SYSROOT"])
+        elif name == "OECORE_TARGET_ALIAS":
+            return  os.path.basename(os.environ["TARGET_PREFIX"].strip("-"))
+        else:
+            return  os.environ[name]
+
+try:
+    sysroot = os.environ['OECORE_NATIVE_SYSROOT']
+except KeyError:
+    print("Not in environment setup, bailing")
+    sys.exit(1)
+
+template_file = os.path.join(sysroot, 'usr/share/cmake/SDKToolchainConfig.cmake.template')
+cross_file = os.path.join(sysroot, 'usr/share/cmake/%s-toolchain.cmake' % (os.path.basename(os.environ["OECORE_TARGET_SYSROOT"])))
+with open(template_file) as in_file:
+    template = in_file.read()
+    output = Template(template).substitute(Environ())
+    with open(cross_file, "w") as out_file:
+        out_file.write(output)
diff --git a/recipes-devtools/cmake/cmake/environment.d-cmake.sh b/recipes-devtools/cmake/cmake/environment.d-cmake.sh
new file mode 100644
index 0000000..7bdb19f
--- /dev/null
+++ b/recipes-devtools/cmake/cmake/environment.d-cmake.sh
@@ -0,0 +1,2 @@
+export OE_CMAKE_TOOLCHAIN_FILE="$OECORE_NATIVE_SYSROOT/usr/share/cmake/OEToolchainConfig.cmake"
+export OE_CMAKE_FIND_LIBRARY_CUSTOM_LIB_SUFFIX="`echo $OECORE_BASELIB | sed -e s/lib//`"
diff --git a/recipes-devtools/cmake/cmake_3.24.2.bb b/recipes-devtools/cmake/cmake_3.24.2.bb
new file mode 100644
index 0000000..bb7ed83
--- /dev/null
+++ b/recipes-devtools/cmake/cmake_3.24.2.bb
@@ -0,0 +1,67 @@
+require cmake.inc
+
+inherit cmake bash-completion
+
+DEPENDS += "curl expat zlib libarchive xz ncurses bzip2"
+
+SRC_URI:append:class-nativesdk = " \
+    file://OEToolchainConfig.cmake \
+    file://SDKToolchainConfig.cmake.template \
+    file://cmake-setup.py \
+    file://environment.d-cmake.sh \
+    file://0001-CMakeDetermineSystem-use-oe-environment-vars-to-load.patch \
+"
+
+LICENSE:append = " & BSD-1-Clause & MIT"
+LIC_FILES_CHKSUM:append = " \
+    file://Utilities/cmjsoncpp/LICENSE;md5=5d73c165a0f9e86a1342f32d19ec5926 \
+    file://Utilities/cmlibrhash/COPYING;md5=a8c2a557a5c53b1c12cddbee98c099af \
+    file://Utilities/cmlibuv/LICENSE;md5=ad93ca1fffe931537fcf64f6fcce084d \
+"
+
+# Strip ${prefix} from ${docdir}, set result into docdir_stripped
+python () {
+    prefix=d.getVar("prefix")
+    docdir=d.getVar("docdir")
+
+    if not docdir.startswith(prefix):
+        bb.fatal('docdir must contain prefix as its prefix')
+
+    docdir_stripped = docdir[len(prefix):]
+    if len(docdir_stripped) > 0 and docdir_stripped[0] == '/':
+        docdir_stripped = docdir_stripped[1:]
+
+    d.setVar("docdir_stripped", docdir_stripped)
+}
+
+EXTRA_OECMAKE=" \
+    -DCMAKE_DOC_DIR=${docdir_stripped}/cmake-${CMAKE_MAJOR_VERSION} \
+    -DCMAKE_USE_SYSTEM_LIBRARIES=1 \
+    -DCMAKE_USE_SYSTEM_LIBRARY_JSONCPP=0 \
+    -DCMAKE_USE_SYSTEM_LIBRARY_LIBUV=0 \
+    -DCMAKE_USE_SYSTEM_LIBRARY_LIBRHASH=0 \
+    -DKWSYS_CHAR_IS_SIGNED=1 \
+    -DBUILD_CursesDialog=0 \
+    -DKWSYS_LFS_WORKS=1 \
+"
+
+do_install:append:class-nativesdk() {
+    mkdir -p ${D}${datadir}/cmake
+    install -m 644 ${WORKDIR}/OEToolchainConfig.cmake ${D}${datadir}/cmake/
+
+    mkdir -p ${D}${SDKPATHNATIVE}/environment-setup.d
+    install -m 644 ${WORKDIR}/environment.d-cmake.sh ${D}${SDKPATHNATIVE}/environment-setup.d/cmake.sh
+
+    # install cmake-setup.py to create arch-specific toolchain cmake file from template
+    install -m 0644 ${WORKDIR}/SDKToolchainConfig.cmake.template ${D}${datadir}/cmake/
+    install -d ${D}${SDKPATHNATIVE}/post-relocate-setup.d
+    install -m 0755 ${WORKDIR}/cmake-setup.py ${D}${SDKPATHNATIVE}/post-relocate-setup.d/
+}
+
+FILES:${PN}:append:class-nativesdk = " ${SDKPATHNATIVE}"
+
+FILES:${PN} += "${datadir}/cmake-${CMAKE_MAJOR_VERSION} ${datadir}/cmake ${datadir}/aclocal ${datadir}/emacs ${datadir}/vim"
+FILES:${PN}-doc += "${docdir}/cmake-${CMAKE_MAJOR_VERSION}"
+FILES:${PN}-dev = ""
+
+BBCLASSEXTEND = "nativesdk"