CVE Packages Update

Move libfastjson to the rsyslog directory

rsyslog 8.2002.0 -> 8.2206.0

add ntp4.2.8 recipe with fixed CVEs

update cryptsetup to 2.4.3

fix libxml2 CVE-2016-3709

curl 7.75.0 -> 7.86.0

strongswan 5.8.4 -> 5.9.8

libmodbus 3.1.6 -> 3.1.7

libesmtp 1.0.6 -> 1.1.0

cifs-utils 6.1 -> 7.0

update libtirpc to version 1.3.3

update rsync to version 3.2.5

Add zlib 1.2.13

upgrade gnutls to 3.7.8

upgrade openssh to 8.9p1

Add cmake 3.24.2 and cmake-native 3.24.2 to avoid loop dependecies building expat

Add expat 2.5.0 to fix CVE-2022-40674 and CVE-2022-43680

openvpn 2.4.9 -> 2.4.12

hostapd 2.9 -> 2.10

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Openssh 8.9p1 no longer needed, because all necessary CVE fixes, backports and whitelists are present for current Openssh 8.4p1. There are no new CVE's in report.

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Backported CVE patches for python3 component. Need to remove after upgrading Yocto to version more than 3.1.21.

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Backported CVE patch for sudo component.
Added 2 CVE's to whitelist for OpenVPN component.

13 files changed, 346 insertions, 0 deletions

diff --git a/recipes-support/ntp/files/0001-libntp-Do-not-use-PTHREAD_STACK_MIN-on-glibc.patch b/recipes-support/ntp/files/0001-libntp-Do-not-use-PTHREAD_STACK_MIN-on-glibc.patch
new file mode 100644
index 0000000..372938c
--- /dev/null
+++ b/recipes-support/ntp/files/0001-libntp-Do-not-use-PTHREAD_STACK_MIN-on-glibc.patch
@@ -0,0 +1,32 @@
+From 082a504cfcc046c3d8adaae1164268bc94e5108a Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 31 Jul 2021 10:51:41 -0700
+Subject: [PATCH] libntp: Do not use PTHREAD_STACK_MIN on glibc
+
+In glibc 2.34+ PTHREAD_STACK_MIN is not a compile-time constant which
+could mean different stack sizes at runtime on different architectures
+and it also causes compile failure. Default glibc thread stack size
+or 64Kb set by ntp should be good in glibc these days.
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ libntp/work_thread.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libntp/work_thread.c b/libntp/work_thread.c
+index 03a5647..3ddd751 100644
+--- a/libntp/work_thread.c
++++ b/libntp/work_thread.c
+@@ -41,7 +41,7 @@
+ #ifndef THREAD_MINSTACKSIZE
+ # define THREAD_MINSTACKSIZE	(64U * 1024)
+ #endif
+-#ifndef __sun
++#if !defined(__sun) && !defined(__GLIBC__)
+ #if defined(PTHREAD_STACK_MIN) && THREAD_MINSTACKSIZE < PTHREAD_STACK_MIN
+ # undef THREAD_MINSTACKSIZE
+ # define THREAD_MINSTACKSIZE PTHREAD_STACK_MIN
+-- 
+2.32.0
+
diff --git a/recipes-support/ntp/files/0001-test-Fix-build-with-new-compiler-defaults-to-fno-com.patch b/recipes-support/ntp/files/0001-test-Fix-build-with-new-compiler-defaults-to-fno-com.patch
new file mode 100644
index 0000000..42e1efd
--- /dev/null
+++ b/recipes-support/ntp/files/0001-test-Fix-build-with-new-compiler-defaults-to-fno-com.patch
@@ -0,0 +1,66 @@
+From 778f3cddc20930185a917fa3f8ffe1ef2b0b0ea0 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sat, 31 Jul 2021 13:27:16 -0700
+Subject: [PATCH] test: Fix build with new compiler defaults to -fno-common
+
+Upstream-Status: Pending
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ sntp/tests/run-packetHandling.c | 2 +-
+ sntp/tests/run-t-log.c          | 2 +-
+ sntp/tests/run-utilities.c      | 2 +-
+ tests/libntp/test-libntp.h      | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sntp/tests/run-packetHandling.c b/sntp/tests/run-packetHandling.c
+index 7790b20..c58380c 100644
+--- a/sntp/tests/run-packetHandling.c
++++ b/sntp/tests/run-packetHandling.c
+@@ -64,7 +64,7 @@ void resetTest(void)
+   setUp();
+ }
+ 
+-char const *progname;
++extern char const *progname;
+ 
+ 
+ //=======MAIN=====
+diff --git a/sntp/tests/run-t-log.c b/sntp/tests/run-t-log.c
+index 268bf41..cd835bc 100644
+--- a/sntp/tests/run-t-log.c
++++ b/sntp/tests/run-t-log.c
+@@ -50,7 +50,7 @@ void resetTest(void)
+   setUp();
+ }
+ 
+-char const *progname;
++extern char const *progname;
+ 
+ 
+ //=======MAIN=====
+diff --git a/sntp/tests/run-utilities.c b/sntp/tests/run-utilities.c
+index f717882..98d9bf1 100644
+--- a/sntp/tests/run-utilities.c
++++ b/sntp/tests/run-utilities.c
+@@ -58,7 +58,7 @@ void resetTest(void)
+   setUp();
+ }
+ 
+-char const *progname;
++extern char const *progname;
+ 
+ 
+ //=======MAIN=====
+diff --git a/tests/libntp/test-libntp.h b/tests/libntp/test-libntp.h
+index 93050b3..60461d8 100644
+--- a/tests/libntp/test-libntp.h
++++ b/tests/libntp/test-libntp.h
+@@ -5,4 +5,4 @@
+ 
+ time_t timefunc(time_t *ptr);
+ void settime(int y, int m, int d, int H, int M, int S);
+-time_t nowtime;
++extern time_t nowtime;
+-- 
+2.32.0
+
diff --git a/recipes-support/ntp/files/ntp-4.2.4_p6-nano.patch b/recipes-support/ntp/files/ntp-4.2.4_p6-nano.patch
new file mode 100644
index 0000000..d45b7e3
--- /dev/null
+++ b/recipes-support/ntp/files/ntp-4.2.4_p6-nano.patch
@@ -0,0 +1,27 @@
+From 2310898533f059d875dcffd26ab6cf1b280292fd Mon Sep 17 00:00:00 2001
+From: Koen Kooi <koen@dominion.thruhere.net>
+Date: Wed, 12 Jan 2011 21:38:46 +0100
+
+---
+ include/ntp_syscall.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/include/ntp_syscall.h b/include/ntp_syscall.h
+index d1ce03e..9e18432 100644
+--- a/include/ntp_syscall.h
++++ b/include/ntp_syscall.h
+@@ -10,6 +10,14 @@
+ # include <sys/timex.h>
+ #endif
+ 
++#if defined(ADJ_NANO) && !defined(MOD_NANO)
++#define MOD_NANO ADJ_NANO
++#endif
++
++#if defined(ADJ_TAI) && !defined(MOD_TAI)
++#define MOD_TAI ADJ_TAI
++#endif
++
+ #ifndef NTP_SYSCALLS_LIBC
+ # ifdef NTP_SYSCALLS_STD
+ #  define ntp_adjtime(t)	syscall(SYS_ntp_adjtime, (t))
diff --git a/recipes-support/ntp/files/ntp.conf b/recipes-support/ntp/files/ntp.conf
new file mode 100644
index 0000000..b590030
--- /dev/null
+++ b/recipes-support/ntp/files/ntp.conf
@@ -0,0 +1,21 @@
+# This is the most basic ntp configuration file
+# The driftfile must remain in a place specific to this
+# machine - it records the machine specific clock error
+driftfile /var/lib/ntp/drift
+# This should be a server that is close (in IP terms)
+# to the machine.  Add other servers as required.
+# Unless you un-comment the line below ntpd will sync
+# only against the local system clock.
+#
+# server time.server.example.com
+#
+# Using local hardware clock as fallback
+# Disable this when using ntpd -q -g -x as ntpdate or it will sync to itself
+server 127.127.1.0
+fudge 127.127.1.0 stratum 14
+# Defining a default security setting
+restrict -4 default notrap nomodify nopeer noquery
+restrict -6 default notrap nomodify nopeer noquery
+
+restrict 127.0.0.1    # allow local host
+restrict ::1          # allow local host
diff --git a/recipes-support/ntp/files/ntpd b/recipes-support/ntp/files/ntpd
new file mode 100755
index 0000000..d1b9c49
--- /dev/null
+++ b/recipes-support/ntp/files/ntpd
@@ -0,0 +1,84 @@
+#! /bin/sh
+
+### BEGIN INIT INFO
+# Provides:        ntp
+# Required-Start:  $network $remote_fs $syslog
+# Required-Stop:   $network $remote_fs $syslog
+# Default-Start:   2 3 4 5
+# Default-Stop:
+# Short-Description: Start NTP daemon
+### END INIT INFO
+
+PATH=/sbin:/bin:/usr/bin:/usr/sbin
+
+DAEMON=/usr/sbin/ntpd
+PIDFILE=/var/run/ntpd.pid
+
+# ntpd	init.d script for ntpdc from ntp.isc.org
+test -x $DAEMON -a -r /etc/ntp.conf || exit 0
+
+# rcS contains TICKADJ
+test -r /etc/default/rcS && . /etc/default/rcS
+
+# Source function library.
+. /etc/init.d/functions
+
+# Functions to do individual actions
+settick(){
+  	# If TICKADJ is set we *must* adjust it before we start, because the
+	# driftfile relies on the correct setting
+	test -n "$TICKADJ" -a -x /usr/sbin/tickadj && {
+		echo -n "Setting tick to $TICKADJ: "
+		/usr/sbin/tickadj "$TICKADJ"
+		echo "done"
+	}
+}
+startdaemon(){
+	# The -g option allows ntpd to step the time to correct it just
+	# once.  The daemon will exit if the clock drifts too much after
+	# this.  If ntpd seems to disappear after a while assume TICKADJ
+	# above is set to a totally incorrect value.
+	echo -n "Starting ntpd: "
+	start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --startas $DAEMON -- -u ntp:ntp -p $PIDFILE "$@"
+	echo "done"
+}
+stopdaemon(){
+	echo -n "Stopping ntpd: "
+	start-stop-daemon --stop --quiet --oknodo -p $PIDFILE
+	echo "done"
+}
+
+case "$1" in
+  start)
+  	settick
+	startdaemon -g
+	;;
+  stop)
+  	stopdaemon
+	;;
+  force-reload)
+  	stopdaemon
+  	settick
+	startdaemon -g
+	;;
+  restart)
+  	# Don't reset the tick here
+	stopdaemon
+	startdaemon -g
+	;;
+  reload)
+  	# Must do this by hand, but don't do -g
+	stopdaemon
+	startdaemon
+	;;
+  status)
+	status /usr/sbin/ntpd;
+	exit $?
+	;;
+  *)
+	echo "Usage: ntpd { start | stop | status | restart | reload }" >&2
+	exit 1
+	;;
+esac
+
+exit 0
diff --git a/recipes-support/ntp/files/ntpd.list b/recipes-support/ntp/files/ntpd.list
new file mode 100644
index 0000000..d1fe6b7
--- /dev/null
+++ b/recipes-support/ntp/files/ntpd.list
@@ -0,0 +1 @@
+ntpd.service
diff --git a/recipes-support/ntp/files/ntpd.service b/recipes-support/ntp/files/ntpd.service
new file mode 100644
index 0000000..0e3d7cd
--- /dev/null
+++ b/recipes-support/ntp/files/ntpd.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Network Time Service
+After=network.target
+
+[Service]
+Type=forking
+PIDFile=/run/ntpd.pid
+ExecStart=/usr/sbin/ntpd -u ntp:ntp -p /run/ntpd.pid -g
+
+[Install]
+WantedBy=multi-user.target
diff --git a/recipes-support/ntp/files/ntpdate b/recipes-support/ntp/files/ntpdate
new file mode 100755
index 0000000..be3bacf
--- /dev/null
+++ b/recipes-support/ntp/files/ntpdate
@@ -0,0 +1,59 @@
+#!/bin/sh
+
+PATH=/sbin:/bin:/usr/bin:/usr/sbin
+
+test -x /usr/sbin/ntpdate || exit 0
+
+if test -f /etc/default/ntpdate ; then
+. /etc/default/ntpdate
+fi
+
+if [ "$NTPSERVERS" = "" ] ; then
+	if [ "$METHOD" = "" -a "$1" != "silent" ] ; then
+		echo "Please set NTPSERVERS in /etc/default/ntpdate"
+		exit 1
+	else
+		exit 0
+	fi
+fi
+
+# This is a heuristic:  The idea is that if a static interface is brought
+# up, that is a major event, and we can put in some extra effort to fix
+# the system time.  Feel free to change this, especially if you regularly
+# bring up new network interfaces.
+if [ "$METHOD" = static ]; then
+	OPTS="-b"
+fi
+
+if [ "$METHOD" = loopback ]; then
+	exit 0
+fi
+
+(
+
+LOCKFILE=/var/lock/ntpdate
+
+# Avoid running more than one at a time
+if [ -x /usr/bin/lockfile-create ]; then
+	lockfile-create $LOCKFILE
+	lockfile-touch $LOCKFILE &
+	LOCKTOUCHPID="$!"
+fi
+
+if /usr/sbin/ntpdate -s $OPTS $NTPSERVERS 2>/dev/null; then
+	if [ "$UPDATE_HWCLOCK" = "yes" ]; then
+		hwclock --systohc || :
+	fi
+fi
+
+if [ -x /usr/bin/lockfile-create ] ; then
+	kill $LOCKTOUCHPID
+	lockfile-remove $LOCKFILE
+fi
+
+) &
+
+# wait for all subprocesses to finish
+# this is required when using systemd service as ntpd will start before ntpdate finishes
+# and results in a bind error (port 123)
+wait
diff --git a/recipes-support/ntp/files/ntpdate.default b/recipes-support/ntp/files/ntpdate.default
new file mode 100644
index 0000000..486b6e0
--- /dev/null
+++ b/recipes-support/ntp/files/ntpdate.default
@@ -0,0 +1,7 @@
+# Configuration script used by ntpdate-sync script
+
+NTPSERVERS=""
+
+# Set to "yes" to write time to hardware clock on success
+UPDATE_HWCLOCK="no"
+
diff --git a/recipes-support/ntp/files/ntpdate.service b/recipes-support/ntp/files/ntpdate.service
new file mode 100644
index 0000000..10cbd70
--- /dev/null
+++ b/recipes-support/ntp/files/ntpdate.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Network Time Service (one-shot ntpdate mode)
+Before=ntpd.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/ntpdate-sync silent
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/recipes-support/ntp/files/reproducibility-fixed-path-to-posix-shell.patch b/recipes-support/ntp/files/reproducibility-fixed-path-to-posix-shell.patch
new file mode 100644
index 0000000..571db75
--- /dev/null
+++ b/recipes-support/ntp/files/reproducibility-fixed-path-to-posix-shell.patch
@@ -0,0 +1,15 @@
+--- ntp-4.2.8p12.original/sntp/libopts/m4/libopts.m4	2018-11-12 17:54:57.747220846 +1300
++++ ntp-4.2.8p12/sntp/libopts/m4/libopts.m4	2018-11-12 18:00:50.626211641 +1300
+@@ -114,12 +114,6 @@
+   AC_PROG_SED
+   [while :
+   do
+-      POSIX_SHELL=`which bash`
+-      test -x "$POSIX_SHELL" && break
+-      POSIX_SHELL=`which dash`
+-      test -x "$POSIX_SHELL" && break
+-      POSIX_SHELL=/usr/xpg4/bin/sh
+-      test -x "$POSIX_SHELL" && break
+       POSIX_SHELL=`/bin/sh -c '
+           exec 2>/dev/null
+           if ! true ; then exit 1 ; fi
diff --git a/recipes-support/ntp/files/sntp b/recipes-support/ntp/files/sntp
new file mode 100644
index 0000000..f8c5895
--- /dev/null
+++ b/recipes-support/ntp/files/sntp
@@ -0,0 +1 @@
+NTPSERVER="ntpserver.example.org"
diff --git a/recipes-support/ntp/files/sntp.service b/recipes-support/ntp/files/sntp.service
new file mode 100644
index 0000000..4898b8a
--- /dev/null
+++ b/recipes-support/ntp/files/sntp.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Simple Network Time Service Client
+After=network.target
+
+[Service]
+Type=oneshot
+EnvironmentFile=-/etc/default/sntp
+ExecStart=/usr/sbin/sntp -s $NTPSERVER
+
+[Install]
+WantedBy=multi-user.target