CVE Packages Update

Move libfastjson to the rsyslog directory

rsyslog 8.2002.0 -> 8.2206.0

add ntp4.2.8 recipe with fixed CVEs

update cryptsetup to 2.4.3

fix libxml2 CVE-2016-3709

curl 7.75.0 -> 7.86.0

strongswan 5.8.4 -> 5.9.8

libmodbus 3.1.6 -> 3.1.7

libesmtp 1.0.6 -> 1.1.0

cifs-utils 6.1 -> 7.0

update libtirpc to version 1.3.3

update rsync to version 3.2.5

Add zlib 1.2.13

upgrade gnutls to 3.7.8

upgrade openssh to 8.9p1

Add cmake 3.24.2 and cmake-native 3.24.2 to avoid loop dependecies building expat

Add expat 2.5.0 to fix CVE-2022-40674 and CVE-2022-43680

openvpn 2.4.9 -> 2.4.12

hostapd 2.9 -> 2.10

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Openssh 8.9p1 no longer needed, because all necessary CVE fixes, backports and whitelists are present for current Openssh 8.4p1. There are no new CVE's in report.

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Backported CVE patches for python3 component. Need to remove after upgrading Yocto to version more than 3.1.21.

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Backported CVE patch for sudo component.
Added 2 CVE's to whitelist for OpenVPN component.

1 files changed, 84 insertions, 0 deletions

diff --git a/recipes-support/ntp/files/ntpd b/recipes-support/ntp/files/ntpd
new file mode 100755
index 0000000..d1b9c49
--- /dev/null
+++ b/recipes-support/ntp/files/ntpd
@@ -0,0 +1,84 @@
+#! /bin/sh
+
+### BEGIN INIT INFO
+# Provides:        ntp
+# Required-Start:  $network $remote_fs $syslog
+# Required-Stop:   $network $remote_fs $syslog
+# Default-Start:   2 3 4 5
+# Default-Stop:
+# Short-Description: Start NTP daemon
+### END INIT INFO
+
+PATH=/sbin:/bin:/usr/bin:/usr/sbin
+
+DAEMON=/usr/sbin/ntpd
+PIDFILE=/var/run/ntpd.pid
+
+# ntpd	init.d script for ntpdc from ntp.isc.org
+test -x $DAEMON -a -r /etc/ntp.conf || exit 0
+
+# rcS contains TICKADJ
+test -r /etc/default/rcS && . /etc/default/rcS
+
+# Source function library.
+. /etc/init.d/functions
+
+# Functions to do individual actions
+settick(){
+  	# If TICKADJ is set we *must* adjust it before we start, because the
+	# driftfile relies on the correct setting
+	test -n "$TICKADJ" -a -x /usr/sbin/tickadj && {
+		echo -n "Setting tick to $TICKADJ: "
+		/usr/sbin/tickadj "$TICKADJ"
+		echo "done"
+	}
+}
+startdaemon(){
+	# The -g option allows ntpd to step the time to correct it just
+	# once.  The daemon will exit if the clock drifts too much after
+	# this.  If ntpd seems to disappear after a while assume TICKADJ
+	# above is set to a totally incorrect value.
+	echo -n "Starting ntpd: "
+	start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --startas $DAEMON -- -u ntp:ntp -p $PIDFILE "$@"
+	echo "done"
+}
+stopdaemon(){
+	echo -n "Stopping ntpd: "
+	start-stop-daemon --stop --quiet --oknodo -p $PIDFILE
+	echo "done"
+}
+
+case "$1" in
+  start)
+  	settick
+	startdaemon -g
+	;;
+  stop)
+  	stopdaemon
+	;;
+  force-reload)
+  	stopdaemon
+  	settick
+	startdaemon -g
+	;;
+  restart)
+  	# Don't reset the tick here
+	stopdaemon
+	startdaemon -g
+	;;
+  reload)
+  	# Must do this by hand, but don't do -g
+	stopdaemon
+	startdaemon
+	;;
+  status)
+	status /usr/sbin/ntpd;
+	exit $?
+	;;
+  *)
+	echo "Usage: ntpd { start | stop | status | restart | reload }" >&2
+	exit 1
+	;;
+esac
+
+exit 0