From 2eaa3fd064097eb221b56d5df0e7136ba705a0cd Mon Sep 17 00:00:00 2001 From: Andrii Davydenko Date: Wed, 14 Dec 2022 12:08:42 +0200 Subject: CVE Packages Update Move libfastjson to the rsyslog directory rsyslog 8.2002.0 -> 8.2206.0 add ntp4.2.8 recipe with fixed CVEs update cryptsetup to 2.4.3 fix libxml2 CVE-2016-3709 curl 7.75.0 -> 7.86.0 strongswan 5.8.4 -> 5.9.8 libmodbus 3.1.6 -> 3.1.7 libesmtp 1.0.6 -> 1.1.0 cifs-utils 6.1 -> 7.0 update libtirpc to version 1.3.3 update rsync to version 3.2.5 Add zlib 1.2.13 upgrade gnutls to 3.7.8 upgrade openssh to 8.9p1 Add cmake 3.24.2 and cmake-native 3.24.2 to avoid loop dependecies building expat Add expat 2.5.0 to fix CVE-2022-40674 and CVE-2022-43680 openvpn 2.4.9 -> 2.4.12 hostapd 2.9 -> 2.10 [GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28) Openssh 8.9p1 no longer needed, because all necessary CVE fixes, backports and whitelists are present for current Openssh 8.4p1. There are no new CVE's in report. [GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28) Backported CVE patches for python3 component. Need to remove after upgrading Yocto to version more than 3.1.21. [GP-1837] mPower R.6.3.X (Fall'22): CVE Upgrade (after 2022-12-28) Backported CVE patch for sudo component. Added 2 CVE's to whitelist for OpenVPN component. --- ...0001-configure-Pass-LDFLAGS-to-link-tests.patch | 80 ++++++++++++++++++++++ recipes-core/zlib/zlib/run-ptest | 7 ++ recipes-core/zlib/zlib_1.2.13.bb | 47 +++++++++++++ 3 files changed, 134 insertions(+) create mode 100644 recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch create mode 100644 recipes-core/zlib/zlib/run-ptest create mode 100644 recipes-core/zlib/zlib_1.2.13.bb (limited to 'recipes-core/zlib') diff --git a/recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch b/recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch new file mode 100644 index 0000000..e6cc915 --- /dev/null +++ b/recipes-core/zlib/zlib/0001-configure-Pass-LDFLAGS-to-link-tests.patch @@ -0,0 +1,80 @@ +Upstream-Status: Submitted [https://github.com/madler/zlib/pull/599] +Signed-off-by: Ross Burton + +From f15584918a7fbbe3cc794ad59100e5e8153ea9f6 Mon Sep 17 00:00:00 2001 +From: Khem Raj +Date: Tue, 8 Mar 2022 22:38:47 -0800 +Subject: [PATCH] configure: Pass LDFLAGS to link tests + +LDFLAGS can contain critical flags without which linking wont succeed +therefore ensure that all configure tests involving link time checks are +using LDFLAGS on compiler commandline along with CFLAGS to ensure the +tests perform correctly. Without this some tests may fail resulting in +wrong confgure result, ending in miscompiling the package + +Signed-off-by: Khem Raj +--- + configure | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/configure b/configure +index 52ff4a0..d04ee59 100755 +--- a/configure ++++ b/configure +@@ -427,7 +427,7 @@ if test $shared -eq 1; then + echo Checking for shared library support... | tee -a configure.log + # we must test in two steps (cc then ld), required at least on SunOS 4.x + if try $CC -w -c $SFLAGS $test.c && +- try $LDSHARED $SFLAGS -o $test$shared_ext $test.o; then ++ try $LDSHARED $SFLAGS $LDFLAGS -o $test$shared_ext $test.o; then + echo Building shared library $SHAREDLIBV with $CC. | tee -a configure.log + elif test -z "$old_cc" -a -z "$old_cflags"; then + echo No shared library support. | tee -a configure.log +@@ -503,7 +503,7 @@ int main(void) { + } + EOF + fi +- if try $CC $CFLAGS -o $test $test.c; then ++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then + sizet=`./$test` + echo "Checking for a pointer-size integer type..." $sizet"." | tee -a configure.log + CFLAGS="${CFLAGS} -DNO_SIZE_T=${sizet}" +@@ -537,7 +537,7 @@ int main(void) { + return 0; + } + EOF +- if try $CC $CFLAGS -o $test $test.c; then ++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then + echo "Checking for fseeko... Yes." | tee -a configure.log + else + CFLAGS="${CFLAGS} -DNO_FSEEKO" +@@ -554,7 +554,7 @@ cat > $test.c < + int main() { return strlen(strerror(errno)); } + EOF +-if try $CC $CFLAGS -o $test $test.c; then ++if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then + echo "Checking for strerror... Yes." | tee -a configure.log + else + CFLAGS="${CFLAGS} -DNO_STRERROR" +@@ -661,7 +661,7 @@ int main() + return (mytest("Hello%d\n", 1)); + } + EOF +- if try $CC $CFLAGS -o $test $test.c; then ++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then + echo "Checking for vsnprintf() in stdio.h... Yes." | tee -a configure.log + + echo >> configure.log +@@ -751,7 +751,7 @@ int main() + } + EOF + +- if try $CC $CFLAGS -o $test $test.c; then ++ if try $CC $CFLAGS $LDFLAGS -o $test $test.c; then + echo "Checking for snprintf() in stdio.h... Yes." | tee -a configure.log + + echo >> configure.log +-- +2.25.1 + diff --git a/recipes-core/zlib/zlib/run-ptest b/recipes-core/zlib/zlib/run-ptest new file mode 100644 index 0000000..065863e --- /dev/null +++ b/recipes-core/zlib/zlib/run-ptest @@ -0,0 +1,7 @@ +#!/bin/sh + +if ./examplesh ; then + echo "PASS: zlib" +else + echo "FAIL: zlib" +fi diff --git a/recipes-core/zlib/zlib_1.2.13.bb b/recipes-core/zlib/zlib_1.2.13.bb new file mode 100644 index 0000000..ec977a3 --- /dev/null +++ b/recipes-core/zlib/zlib_1.2.13.bb @@ -0,0 +1,47 @@ +SUMMARY = "Zlib Compression Library" +DESCRIPTION = "Zlib is a general-purpose, patent-free, lossless data compression \ +library which is used by many different programs." +HOMEPAGE = "http://zlib.net/" +SECTION = "libs" +LICENSE = "Zlib" +LIC_FILES_CHKSUM = "file://zlib.h;beginline=6;endline=23;md5=5377232268e952e9ef63bc555f7aa6c0" + +# The source tarball needs to be .gz as only the .gz ends up in fossils/ +SRC_URI = "https://zlib.net/${BP}.tar.gz \ + file://0001-configure-Pass-LDFLAGS-to-link-tests.patch \ + file://run-ptest \ + " +UPSTREAM_CHECK_URI = "http://zlib.net/" + +SRC_URI[sha256sum] = "b3a24de97a8fdbc835b9833169501030b8977031bcb54b3b3ac13740f846ab30" + +# When a new release is made the previous release is moved to fossils/, so add this +# to PREMIRRORS so it is also searched automatically. +PREMIRRORS:append = " https://zlib.net/ https://zlib.net/fossils/" + +CFLAGS += "-D_REENTRANT" + +RDEPENDS:${PN}-ptest += "make" + +inherit ptest + +B = "${WORKDIR}/build" + +do_configure() { + LDCONFIG=true ${S}/configure --prefix=${prefix} --shared --libdir=${libdir} --uname=GNU +} +do_configure[cleandirs] += "${B}" + +do_compile() { + oe_runmake shared +} + +do_install() { + oe_runmake DESTDIR=${D} install +} + +do_install_ptest() { + install ${B}/examplesh ${D}${PTEST_PATH} +} + +BBCLASSEXTEND = "native nativesdk" -- cgit v1.2.3