From 2eaa3fd064097eb221b56d5df0e7136ba705a0cd Mon Sep 17 00:00:00 2001
From: Andrii Davydenko <andrii.davydenko@globallogic.com>
Date: Wed, 14 Dec 2022 12:08:42 +0200
Subject: CVE Packages Update

Move libfastjson to the rsyslog directory

rsyslog 8.2002.0 -> 8.2206.0

add ntp4.2.8 recipe with fixed CVEs

update cryptsetup to 2.4.3

fix libxml2 CVE-2016-3709

curl 7.75.0 -> 7.86.0

strongswan 5.8.4 -> 5.9.8

libmodbus 3.1.6 -> 3.1.7

libesmtp 1.0.6 -> 1.1.0

cifs-utils 6.1 -> 7.0

update libtirpc to version 1.3.3

update rsync to version 3.2.5

Add zlib 1.2.13

upgrade gnutls to 3.7.8

upgrade openssh to 8.9p1

Add cmake 3.24.2 and cmake-native 3.24.2 to avoid loop dependecies building expat

Add expat 2.5.0 to fix CVE-2022-40674 and CVE-2022-43680

openvpn 2.4.9 -> 2.4.12

hostapd 2.9 -> 2.10

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Openssh 8.9p1 no longer needed, because all necessary CVE fixes, backports and whitelists are present for current Openssh 8.4p1. There are no new CVE's in report.

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Backported CVE patches for python3 component. Need to remove after upgrading Yocto to version more than 3.1.21.

[GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28)
Backported CVE patch for sudo component.
Added 2 CVE's to whitelist for OpenVPN component.
---
 recipes-core/expat/expat_2.5.0.bb  | 32 ++++++++++++++++++++++++++++++++
 recipes-core/expat/files/run-ptest |  9 +++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 recipes-core/expat/expat_2.5.0.bb
 create mode 100644 recipes-core/expat/files/run-ptest

(limited to 'recipes-core/expat')

diff --git a/recipes-core/expat/expat_2.5.0.bb b/recipes-core/expat/expat_2.5.0.bb
new file mode 100644
index 0000000..47334ed
--- /dev/null
+++ b/recipes-core/expat/expat_2.5.0.bb
@@ -0,0 +1,32 @@
+SUMMARY = "A stream-oriented XML parser library"
+DESCRIPTION = "Expat is an XML parser library written in C. It is a stream-oriented parser in which an application registers handlers for things the parser might find in the XML document (like start tags)"
+HOMEPAGE = "https://github.com/libexpat/libexpat"
+SECTION = "libs"
+LICENSE = "MIT"
+
+LIC_FILES_CHKSUM = "file://COPYING;md5=7b3b078238d0901d3b339289117cb7fb"
+
+VERSION_TAG = "${@d.getVar('PV').replace('.', '_')}"
+
+SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2  \
+           file://run-ptest \
+           "
+
+GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
+UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P<pver>.+)"
+
+SRC_URI[sha256sum] = "6f0e6e01f7b30025fa05c85fdad1e5d0ec7fd35d9f61b22f34998de11969ff67"
+
+EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"
+
+RDEPENDS:${PN}-ptest += "bash"
+
+inherit cmake lib_package ptest
+
+do_install_ptest:class-target() {
+	install -m 755 ${B}/tests/* ${D}${PTEST_PATH}
+}
+
+BBCLASSEXTEND += "native nativesdk"
+
+CVE_PRODUCT = "expat libexpat"
diff --git a/recipes-core/expat/files/run-ptest b/recipes-core/expat/files/run-ptest
new file mode 100644
index 0000000..dbf602c
--- /dev/null
+++ b/recipes-core/expat/files/run-ptest
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+TIME=$(which time)
+
+echo "runtests"
+${TIME} -f 'Execution time: %e s' bash -c "./runtests -v"
+echo "runtestspp"
+${TIME} -f 'Execution time: %e s' bash -c "./runtestspp -v"
+echo
-- 
cgit v1.2.3