* [hardknott 0/6] Patch review April 24th
@ 2021-04-24 10:11 Armin Kuster
2021-04-24 10:11 ` [hardknott 1/6] v4l-utils: fix reproducibility Armin Kuster
` (6 more replies)
0 siblings, 7 replies; 11+ messages in thread
From: Armin Kuster @ 2021-04-24 10:11 UTC (permalink / raw)
To: openembedded-devel
These have been sent to the list already so shorter review cycle.
Please have feedback by Sunday.
The following changes since commit 2297d4ee04b47bc574f8879732d9e213ab7bf685:
wireguard: update to v1.0.20210219 +1 (2021-04-18 13:49:13 -0700)
are available in the Git repository at:
git://git.openembedded.org/meta-openembedded-contrib stable/hardknott-nut
http://cgit.openembedded.org/meta-openembedded-contrib/log/?h=stable/hardknott-nut
Chen Qi (2):
tigervnc: upgrade to 1.11.0
python3-django: upgrade to 2.2.20
Mingli Yu (2):
php: Upgrade to 7.4.16
python3-cryptography: Upgrade to 3.3.2
Stefan Ghinea (1):
python3-django: fix CVE-2021-28658
Ulrich Ölmann (1):
v4l-utils: fix reproducibility
.../php/php/CVE-2020-7069.patch | 158 ------------------
.../php/php/CVE-2020-7070.patch | 24 ---
.../php/{php_7.4.9.bb => php_7.4.16.bb} | 7 +-
...002-do-not-build-tests-sub-directory.patch | 21 +--
...vnc-add-fPIC-option-to-COMPILE_FLAGS.patch | 36 ++--
...{tigervnc_1.10.1.bb => tigervnc_1.11.0.bb} | 13 +-
...c-autodetect-availability-of-systemd.patch | 47 ++++++
...ct-installation-of-50-rc_keymap.conf.patch | 40 +++++
.../v4l2apps/v4l-utils_1.20.0.bb | 11 +-
...3.3.1.bb => python3-cryptography_3.3.2.bb} | 2 +-
...ngo_2.2.16.bb => python3-django_2.2.20.bb} | 4 +-
11 files changed, 130 insertions(+), 233 deletions(-)
delete mode 100644 meta-oe/recipes-devtools/php/php/CVE-2020-7069.patch
delete mode 100644 meta-oe/recipes-devtools/php/php/CVE-2020-7070.patch
rename meta-oe/recipes-devtools/php/{php_7.4.9.bb => php_7.4.16.bb} (97%)
rename meta-oe/recipes-graphics/tigervnc/{tigervnc_1.10.1.bb => tigervnc_1.11.0.bb} (89%)
create mode 100644 meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0008-configure.ac-autodetect-availability-of-systemd.patch
create mode 100644 meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0009-keytable-restrict-installation-of-50-rc_keymap.conf.patch
rename meta-python/recipes-devtools/python/{python3-cryptography_3.3.1.bb => python3-cryptography_3.3.2.bb} (94%)
rename meta-python/recipes-devtools/python/{python3-django_2.2.16.bb => python3-django_2.2.20.bb} (41%)
--
2.17.1
^ permalink raw reply [flat|nested] 11+ messages in thread
* [hardknott 1/6] v4l-utils: fix reproducibility
2021-04-24 10:11 [hardknott 0/6] Patch review April 24th Armin Kuster
@ 2021-04-24 10:11 ` Armin Kuster
2021-04-24 10:11 ` [hardknott 2/6] python3-django: fix CVE-2021-28658 Armin Kuster
` (5 subsequent siblings)
6 siblings, 0 replies; 11+ messages in thread
From: Armin Kuster @ 2021-04-24 10:11 UTC (permalink / raw)
To: openembedded-devel
From: Ulrich Ölmann <u.oelmann@pengutronix.de>
Add upstream patches [1] & [2] to automatically detect the availability of
systemd and (currently) never install '50-rc_keymap.conf' at all as the
prerequisite would be the ability to compile BPF programs which is not supported
in this recipe (at least not now).
Previously if your distro was not systemd based the existance of the host
system's path "/lib/systemd/system" decided if '50-rc_keymap.conf' was installed
or not.
[1] https://git.linuxtv.org/v4l-utils.git/commit/?id=3f61e353424fb9ea3dce742022b94dfd7ea1ed9f
[2] https://git.linuxtv.org/v4l-utils.git/commit/?id=01f2c6c58e6f4441df7df8e27eb7919f1f01e310
Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
...c-autodetect-availability-of-systemd.patch | 47 +++++++++++++++++++
...ct-installation-of-50-rc_keymap.conf.patch | 40 ++++++++++++++++
.../v4l2apps/v4l-utils_1.20.0.bb | 11 +++--
3 files changed, 93 insertions(+), 5 deletions(-)
create mode 100644 meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0008-configure.ac-autodetect-availability-of-systemd.patch
create mode 100644 meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0009-keytable-restrict-installation-of-50-rc_keymap.conf.patch
diff --git a/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0008-configure.ac-autodetect-availability-of-systemd.patch b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0008-configure.ac-autodetect-availability-of-systemd.patch
new file mode 100644
index 0000000000..5aec3c5747
--- /dev/null
+++ b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0008-configure.ac-autodetect-availability-of-systemd.patch
@@ -0,0 +1,47 @@
+From 3f61e353424fb9ea3dce742022b94dfd7ea1ed9f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ulrich=20=C3=96lmann?= <u.oelmann@pengutronix.de>
+Date: Thu, 4 Mar 2021 14:23:39 +0100
+Subject: [PATCH] configure.ac: autodetect availability of systemd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Import systemd's official suggestion [1] how this should be handled in packages
+using autoconf. A side effect of this is the removal of the hardcoded fallback
+path "/lib/systemd/system" which leaks build host information when cross
+compiling v4l-utils and therefore defeats reproducible builds.
+
+[1] https://www.freedesktop.org/software/systemd/man/daemon.html#Installing%20systemd%20Service%20Files
+
+Upstream-Status: Backport [https://git.linuxtv.org/v4l-utils.git/commit/?id=3f61e353424fb9ea3dce742022b94dfd7ea1ed9f]
+
+Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
+Signed-off-by: Sean Young <sean@mess.org>
+---
+ configure.ac | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 727730c5ccf4..8470116df4b1 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -388,7 +388,15 @@ AC_ARG_WITH(udevdir,
+ AC_ARG_WITH(systemdsystemunitdir,
+ AS_HELP_STRING([--with-systemdsystemunitdir=DIR], [set systemd system unit directory]),
+ [],
+- [with_systemdsystemunitdir=`$PKG_CONFIG --variable=systemdsystemunitdir systemd || echo /lib/systemd/system`])
++ [with_systemdsystemunitdir=auto])
++AS_IF([test "x$with_systemdsystemunitdir" = "xyes" -o "x$with_systemdsystemunitdir" = "xauto"],
++ [def_systemdsystemunitdir=$($PKG_CONFIG --variable=systemdsystemunitdir systemd)
++ AS_IF([test "x$def_systemdsystemunitdir" = "x"],
++ [AS_IF([test "x$with_systemdsystemunitdir" = "xyes"],
++ [AC_MSG_ERROR([systemd support requested but pkg-config unable to query systemd package])])
++ with_systemdsystemunitdir=no],
++ [with_systemdsystemunitdir="$def_systemdsystemunitdir"])])
++AM_CONDITIONAL([HAVE_SYSTEMD], [test "x$with_systemdsystemunitdir" != "xno"])
+
+ # Generic check: works with most distributions
+ def_gconv_dir=`for i in /lib64 /usr/lib64 /usr/local/lib64 /lib /usr/lib /usr/local/lib; do if @<:@ -d \$i/gconv @:>@; then echo \$i/gconv; break; fi; done`
+--
+2.29.2
+
diff --git a/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0009-keytable-restrict-installation-of-50-rc_keymap.conf.patch b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0009-keytable-restrict-installation-of-50-rc_keymap.conf.patch
new file mode 100644
index 0000000000..63a695f8f9
--- /dev/null
+++ b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0009-keytable-restrict-installation-of-50-rc_keymap.conf.patch
@@ -0,0 +1,40 @@
+From 01f2c6c58e6f4441df7df8e27eb7919f1f01e310 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ulrich=20=C3=96lmann?= <u.oelmann@pengutronix.de>
+Date: Thu, 4 Mar 2021 14:23:40 +0100
+Subject: [PATCH] keytable: restrict installation of 50-rc_keymap.conf
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It is only needed if BPF is effectively used and the package is compiled for a
+systemd based target.
+
+Upstream-Status: Backport [https://git.linuxtv.org/v4l-utils.git/commit/?id=01f2c6c58e6f4441df7df8e27eb7919f1f01e310]
+
+Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
+Signed-off-by: Sean Young <sean@mess.org>
+---
+ utils/keytable/Makefile.am | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/utils/keytable/Makefile.am b/utils/keytable/Makefile.am
+index c5eb414acf2f..eee61f0e0551 100644
+--- a/utils/keytable/Makefile.am
++++ b/utils/keytable/Makefile.am
+@@ -3,9 +3,13 @@ man_MANS = ir-keytable.1 rc_keymap.5
+ sysconf_DATA = rc_maps.cfg
+ keytablesystem_DATA = $(srcdir)/rc_keymaps/*
+ udevrules_DATA = 70-infrared.rules
++if WITH_BPF
++if HAVE_SYSTEMD
+ if HAVE_UDEVDSYSCALLFILTER
+ systemdsystemunit_DATA = 50-rc_keymap.conf
+ endif
++endif
++endif
+
+ ir_keytable_SOURCES = keytable.c parse.h ir-encode.c ir-encode.h toml.c toml.h keymap.c keymap.h
+
+--
+2.29.2
+
diff --git a/meta-oe/recipes-multimedia/v4l2apps/v4l-utils_1.20.0.bb b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils_1.20.0.bb
index 3e92d49b4f..2261feb56c 100644
--- a/meta-oe/recipes-multimedia/v4l2apps/v4l-utils_1.20.0.bb
+++ b/meta-oe/recipes-multimedia/v4l2apps/v4l-utils_1.20.0.bb
@@ -5,7 +5,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=48da9957849056017dc568bbc43d8975 \
PROVIDES = "libv4l media-ctl"
DEPENDS = "jpeg \
- ${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'virtual/libx11', '', d)}"
+ ${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'virtual/libx11', '', d)} \
+ ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'systemd', '', d)}"
DEPENDS_append_libc-musl = " argp-standalone"
DEPENDS_append_class-target = " udev"
LDFLAGS_append = " -pthread"
@@ -21,13 +22,14 @@ SRC_URI = "http://linuxtv.org/downloads/v4l-utils/v4l-utils-${PV}.tar.bz2 \
file://export-mediactl-headers.patch \
file://0002-contrib-test-Link-mc_nextgen_test-with-libargp-if-ne.patch \
file://0007-Do-not-use-getsubopt.patch \
+ file://0008-configure.ac-autodetect-availability-of-systemd.patch \
+ file://0009-keytable-restrict-installation-of-50-rc_keymap.conf.patch \
"
SRC_URI[md5sum] = "46f9e2c0b2fdccd009da2f7e1aa87894"
SRC_URI[sha256sum] = "956118713f7ccb405c55c7088a6a2490c32d54300dd9a30d8d5008c28d3726f7"
EXTRA_OECONF = "--disable-qv4l2 --enable-shared --with-udevdir=${base_libdir}/udev \
- --disable-v4l2-compliance-32 --disable-v4l2-ctl-32 \
- --with-systemdsystemunitdir=${systemd_system_unitdir}"
+ --disable-v4l2-compliance-32 --disable-v4l2-ctl-32"
VIRTUAL-RUNTIME_ir-keytable-keymaps ?= "rc-keymaps"
@@ -37,8 +39,7 @@ RPROVIDES_${PN}-dbg += "libv4l-dbg"
FILES_media-ctl = "${bindir}/media-ctl ${libdir}/libmediactl.so.*"
-FILES_ir-keytable = "${bindir}/ir-keytable ${base_libdir}/udev/rules.d/*-infrared.rules \
- ${systemd_system_unitdir}/systemd-udevd.service.d/50-rc_keymap.conf"
+FILES_ir-keytable = "${bindir}/ir-keytable ${base_libdir}/udev/rules.d/*-infrared.rules"
RDEPENDS_ir-keytable += "${VIRTUAL-RUNTIME_ir-keytable-keymaps}"
FILES_rc-keymaps = "${sysconfdir}/rc* ${base_libdir}/udev/rc*"
--
2.17.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [hardknott 2/6] python3-django: fix CVE-2021-28658
2021-04-24 10:11 [hardknott 0/6] Patch review April 24th Armin Kuster
2021-04-24 10:11 ` [hardknott 1/6] v4l-utils: fix reproducibility Armin Kuster
@ 2021-04-24 10:11 ` Armin Kuster
2021-04-24 10:11 ` [hardknott 3/6] tigervnc: upgrade to 1.11.0 Armin Kuster
` (4 subsequent siblings)
6 siblings, 0 replies; 11+ messages in thread
From: Armin Kuster @ 2021-04-24 10:11 UTC (permalink / raw)
To: openembedded-devel
From: Stefan Ghinea <stefan.ghinea@windriver.com>
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8,
MultiPartParser allowed directory traversal via uploaded files with
suitably crafted file names. Built-in upload handlers were not affected
by this vulnerability.
References:
https://nvd.nist.gov/vuln/detail/CVE-2021-28658
Upstream patches:
https://github.com/django/django/commit/4036d62bda0e9e9f6172943794b744a454ca49c2
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../CVE-2021-28658.patch | 289 ++++++++++++++++++
.../python/python3-django_2.2.16.bb | 2 +
2 files changed, 291 insertions(+)
create mode 100644 meta-python/recipes-devtools/python/python3-django-2.2.16/CVE-2021-28658.patch
diff --git a/meta-python/recipes-devtools/python/python3-django-2.2.16/CVE-2021-28658.patch b/meta-python/recipes-devtools/python/python3-django-2.2.16/CVE-2021-28658.patch
new file mode 100644
index 0000000000..325aa00420
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-django-2.2.16/CVE-2021-28658.patch
@@ -0,0 +1,289 @@
+From 4036d62bda0e9e9f6172943794b744a454ca49c2 Mon Sep 17 00:00:00 2001
+From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
+Date: Tue, 16 Mar 2021 10:19:00 +0100
+Subject: [PATCH] Fixed CVE-2021-28658 -- Fixed potential directory-traversal
+ via uploaded files.
+
+Thanks Claude Paroz for the initial patch.
+Thanks Dennis Brinkrolf for the report.
+
+Backport of d4d800ca1addc4141e03c5440a849bb64d1582cd from main.
+
+Upstream-Status: Backport
+CVE: CVE-2021-28658
+
+Reference to upstream patch:
+[https://github.com/django/django/commit/4036d62bda0e9e9f6172943794b744a454ca49c2]
+
+[SG: Adapted stable/2.2.x patch for 2.2.16]
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+---
+ django/http/multipartparser.py | 13 ++++--
+ docs/releases/2.2.16.txt | 12 +++++
+ tests/file_uploads/tests.py | 72 ++++++++++++++++++++++-------
+ tests/file_uploads/uploadhandler.py | 31 +++++++++++++
+ tests/file_uploads/urls.py | 1 +
+ tests/file_uploads/views.py | 12 ++++-
+ 6 files changed, 120 insertions(+), 21 deletions(-)
+
+diff --git a/django/http/multipartparser.py b/django/http/multipartparser.py
+index f6f12ca..5a9cca8 100644
+--- a/django/http/multipartparser.py
++++ b/django/http/multipartparser.py
+@@ -7,6 +7,7 @@ file upload handlers for processing.
+ import base64
+ import binascii
+ import cgi
++import os
+ from urllib.parse import unquote
+
+ from django.conf import settings
+@@ -205,7 +206,7 @@ class MultiPartParser:
+ file_name = disposition.get('filename')
+ if file_name:
+ file_name = force_text(file_name, encoding, errors='replace')
+- file_name = self.IE_sanitize(unescape_entities(file_name))
++ file_name = self.sanitize_file_name(file_name)
+ if not file_name:
+ continue
+
+@@ -293,9 +294,13 @@ class MultiPartParser:
+ self._files.appendlist(force_text(old_field_name, self._encoding, errors='replace'), file_obj)
+ break
+
+- def IE_sanitize(self, filename):
+- """Cleanup filename from Internet Explorer full paths."""
+- return filename and filename[filename.rfind("\\") + 1:].strip()
++ def sanitize_file_name(self, file_name):
++ file_name = unescape_entities(file_name)
++ # Cleanup Windows-style path separators.
++ file_name = file_name[file_name.rfind('\\') + 1:].strip()
++ return os.path.basename(file_name)
++
++ IE_sanitize = sanitize_file_name
+
+ def _close_files(self):
+ # Free up all file handles.
+diff --git a/docs/releases/2.2.16.txt b/docs/releases/2.2.16.txt
+index 31231fb..4b7021b 100644
+--- a/docs/releases/2.2.16.txt
++++ b/docs/releases/2.2.16.txt
+@@ -2,6 +2,18 @@
+ Django 2.2.16 release notes
+ ===========================
+
++*April 6, 2021*
++
++Backported from Django 2.2.20 a fix for a security issue.
++
++CVE-2021-28658: Potential directory-traversal via uploaded files
++================================================================
++
++``MultiPartParser`` allowed directory-traversal via uploaded files with
++suitably crafted file names.
++
++Built-in upload handlers were not affected by this vulnerability.
++
+ *September 1, 2020*
+
+ Django 2.2.16 fixes two security issues and two data loss bugs in 2.2.15.
+diff --git a/tests/file_uploads/tests.py b/tests/file_uploads/tests.py
+index ea4976d..2a08d1b 100644
+--- a/tests/file_uploads/tests.py
++++ b/tests/file_uploads/tests.py
+@@ -22,6 +22,21 @@ UNICODE_FILENAME = 'test-0123456789_中文_Orléans.jpg'
+ MEDIA_ROOT = sys_tempfile.mkdtemp()
+ UPLOAD_TO = os.path.join(MEDIA_ROOT, 'test_upload')
+
++CANDIDATE_TRAVERSAL_FILE_NAMES = [
++ '/tmp/hax0rd.txt', # Absolute path, *nix-style.
++ 'C:\\Windows\\hax0rd.txt', # Absolute path, win-style.
++ 'C:/Windows/hax0rd.txt', # Absolute path, broken-style.
++ '\\tmp\\hax0rd.txt', # Absolute path, broken in a different way.
++ '/tmp\\hax0rd.txt', # Absolute path, broken by mixing.
++ 'subdir/hax0rd.txt', # Descendant path, *nix-style.
++ 'subdir\\hax0rd.txt', # Descendant path, win-style.
++ 'sub/dir\\hax0rd.txt', # Descendant path, mixed.
++ '../../hax0rd.txt', # Relative path, *nix-style.
++ '..\\..\\hax0rd.txt', # Relative path, win-style.
++ '../..\\hax0rd.txt', # Relative path, mixed.
++ '../hax0rd.txt', # HTML entities.
++]
++
+
+ @override_settings(MEDIA_ROOT=MEDIA_ROOT, ROOT_URLCONF='file_uploads.urls', MIDDLEWARE=[])
+ class FileUploadTests(TestCase):
+@@ -205,22 +220,8 @@ class FileUploadTests(TestCase):
+ # a malicious payload with an invalid file name (containing os.sep or
+ # os.pardir). This similar to what an attacker would need to do when
+ # trying such an attack.
+- scary_file_names = [
+- "/tmp/hax0rd.txt", # Absolute path, *nix-style.
+- "C:\\Windows\\hax0rd.txt", # Absolute path, win-style.
+- "C:/Windows/hax0rd.txt", # Absolute path, broken-style.
+- "\\tmp\\hax0rd.txt", # Absolute path, broken in a different way.
+- "/tmp\\hax0rd.txt", # Absolute path, broken by mixing.
+- "subdir/hax0rd.txt", # Descendant path, *nix-style.
+- "subdir\\hax0rd.txt", # Descendant path, win-style.
+- "sub/dir\\hax0rd.txt", # Descendant path, mixed.
+- "../../hax0rd.txt", # Relative path, *nix-style.
+- "..\\..\\hax0rd.txt", # Relative path, win-style.
+- "../..\\hax0rd.txt" # Relative path, mixed.
+- ]
+-
+ payload = client.FakePayload()
+- for i, name in enumerate(scary_file_names):
++ for i, name in enumerate(CANDIDATE_TRAVERSAL_FILE_NAMES):
+ payload.write('\r\n'.join([
+ '--' + client.BOUNDARY,
+ 'Content-Disposition: form-data; name="file%s"; filename="%s"' % (i, name),
+@@ -240,7 +241,7 @@ class FileUploadTests(TestCase):
+ response = self.client.request(**r)
+ # The filenames should have been sanitized by the time it got to the view.
+ received = response.json()
+- for i, name in enumerate(scary_file_names):
++ for i, name in enumerate(CANDIDATE_TRAVERSAL_FILE_NAMES):
+ got = received["file%s" % i]
+ self.assertEqual(got, "hax0rd.txt")
+
+@@ -518,6 +519,36 @@ class FileUploadTests(TestCase):
+ # shouldn't differ.
+ self.assertEqual(os.path.basename(obj.testfile.path), 'MiXeD_cAsE.txt')
+
++ def test_filename_traversal_upload(self):
++ os.makedirs(UPLOAD_TO, exist_ok=True)
++ self.addCleanup(shutil.rmtree, MEDIA_ROOT)
++ file_name = '../test.txt',
++ payload = client.FakePayload()
++ payload.write(
++ '\r\n'.join([
++ '--' + client.BOUNDARY,
++ 'Content-Disposition: form-data; name="my_file"; '
++ 'filename="%s";' % file_name,
++ 'Content-Type: text/plain',
++ '',
++ 'file contents.\r\n',
++ '\r\n--' + client.BOUNDARY + '--\r\n',
++ ]),
++ )
++ r = {
++ 'CONTENT_LENGTH': len(payload),
++ 'CONTENT_TYPE': client.MULTIPART_CONTENT,
++ 'PATH_INFO': '/upload_traversal/',
++ 'REQUEST_METHOD': 'POST',
++ 'wsgi.input': payload,
++ }
++ response = self.client.request(**r)
++ result = response.json()
++ self.assertEqual(response.status_code, 200)
++ self.assertEqual(result['file_name'], 'test.txt')
++ self.assertIs(os.path.exists(os.path.join(MEDIA_ROOT, 'test.txt')), False)
++ self.assertIs(os.path.exists(os.path.join(UPLOAD_TO, 'test.txt')), True)
++
+
+ @override_settings(MEDIA_ROOT=MEDIA_ROOT)
+ class DirectoryCreationTests(SimpleTestCase):
+@@ -591,6 +622,15 @@ class MultiParserTests(SimpleTestCase):
+ }, StringIO('x'), [], 'utf-8')
+ self.assertEqual(multipart_parser._content_length, 0)
+
++ def test_sanitize_file_name(self):
++ parser = MultiPartParser({
++ 'CONTENT_TYPE': 'multipart/form-data; boundary=_foo',
++ 'CONTENT_LENGTH': '1'
++ }, StringIO('x'), [], 'utf-8')
++ for file_name in CANDIDATE_TRAVERSAL_FILE_NAMES:
++ with self.subTest(file_name=file_name):
++ self.assertEqual(parser.sanitize_file_name(file_name), 'hax0rd.txt')
++
+ def test_rfc2231_parsing(self):
+ test_data = (
+ (b"Content-Type: application/x-stuff; title*=us-ascii'en-us'This%20is%20%2A%2A%2Afun%2A%2A%2A",
+diff --git a/tests/file_uploads/uploadhandler.py b/tests/file_uploads/uploadhandler.py
+index 7c6199f..65d70c6 100644
+--- a/tests/file_uploads/uploadhandler.py
++++ b/tests/file_uploads/uploadhandler.py
+@@ -1,6 +1,8 @@
+ """
+ Upload handlers to test the upload API.
+ """
++import os
++from tempfile import NamedTemporaryFile
+
+ from django.core.files.uploadhandler import FileUploadHandler, StopUpload
+
+@@ -35,3 +37,32 @@ class ErroringUploadHandler(FileUploadHandler):
+ """A handler that raises an exception."""
+ def receive_data_chunk(self, raw_data, start):
+ raise CustomUploadError("Oops!")
++
++
++class TraversalUploadHandler(FileUploadHandler):
++ """A handler with potential directory-traversal vulnerability."""
++ def __init__(self, request=None):
++ from .views import UPLOAD_TO
++
++ super().__init__(request)
++ self.upload_dir = UPLOAD_TO
++
++ def file_complete(self, file_size):
++ self.file.seek(0)
++ self.file.size = file_size
++ with open(os.path.join(self.upload_dir, self.file_name), 'wb') as fp:
++ fp.write(self.file.read())
++ return self.file
++
++ def new_file(
++ self, field_name, file_name, content_type, content_length, charset=None,
++ content_type_extra=None,
++ ):
++ super().new_file(
++ file_name, file_name, content_length, content_length, charset,
++ content_type_extra,
++ )
++ self.file = NamedTemporaryFile(suffix='.upload', dir=self.upload_dir)
++
++ def receive_data_chunk(self, raw_data, start):
++ self.file.write(raw_data)
+diff --git a/tests/file_uploads/urls.py b/tests/file_uploads/urls.py
+index 3e7985d..eaac1da 100644
+--- a/tests/file_uploads/urls.py
++++ b/tests/file_uploads/urls.py
+@@ -4,6 +4,7 @@ from . import views
+
+ urlpatterns = [
+ path('upload/', views.file_upload_view),
++ path('upload_traversal/', views.file_upload_traversal_view),
+ path('verify/', views.file_upload_view_verify),
+ path('unicode_name/', views.file_upload_unicode_name),
+ path('echo/', views.file_upload_echo),
+diff --git a/tests/file_uploads/views.py b/tests/file_uploads/views.py
+index d4947e4..137c6f3 100644
+--- a/tests/file_uploads/views.py
++++ b/tests/file_uploads/views.py
+@@ -6,7 +6,9 @@ from django.http import HttpResponse, HttpResponseServerError, JsonResponse
+
+ from .models import FileModel
+ from .tests import UNICODE_FILENAME, UPLOAD_TO
+-from .uploadhandler import ErroringUploadHandler, QuotaUploadHandler
++from .uploadhandler import (
++ ErroringUploadHandler, QuotaUploadHandler, TraversalUploadHandler,
++)
+
+
+ def file_upload_view(request):
+@@ -158,3 +160,11 @@ def file_upload_fd_closing(request, access):
+ if access == 't':
+ request.FILES # Trigger file parsing.
+ return HttpResponse('')
++
++
++def file_upload_traversal_view(request):
++ request.upload_handlers.insert(0, TraversalUploadHandler())
++ request.FILES # Trigger file parsing.
++ return JsonResponse(
++ {'file_name': request.upload_handlers[0].file_name},
++ )
+--
+2.17.1
+
diff --git a/meta-python/recipes-devtools/python/python3-django_2.2.16.bb b/meta-python/recipes-devtools/python/python3-django_2.2.16.bb
index 0715abbd4c..eb626e8d3f 100644
--- a/meta-python/recipes-devtools/python/python3-django_2.2.16.bb
+++ b/meta-python/recipes-devtools/python/python3-django_2.2.16.bb
@@ -7,3 +7,5 @@ SRC_URI[sha256sum] = "62cf45e5ee425c52e411c0742e641a6588b7e8af0d2c274a27940931b2
RDEPENDS_${PN} += "\
${PYTHON_PN}-sqlparse \
"
+SRC_URI += "file://CVE-2021-28658.patch \
+"
--
2.17.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [hardknott 3/6] tigervnc: upgrade to 1.11.0
2021-04-24 10:11 [hardknott 0/6] Patch review April 24th Armin Kuster
2021-04-24 10:11 ` [hardknott 1/6] v4l-utils: fix reproducibility Armin Kuster
2021-04-24 10:11 ` [hardknott 2/6] python3-django: fix CVE-2021-28658 Armin Kuster
@ 2021-04-24 10:11 ` Armin Kuster
2021-04-24 10:11 ` [hardknott 4/6] python3-django: upgrade to 2.2.20 Armin Kuster
` (3 subsequent siblings)
6 siblings, 0 replies; 11+ messages in thread
From: Armin Kuster @ 2021-04-24 10:11 UTC (permalink / raw)
To: openembedded-devel
From: Chen Qi <Qi.Chen@windriver.com>
Upgrade to latest stable version.
The 1.10 branch is not maitained any more, it stops update in 2019.
The 1.11 branch has fix for CVE-2020-26117, which is a high risk CVE.
https://nvd.nist.gov/vuln/detail/CVE-2020-26117
Some changes in this new version are as below.
1) 'bash' is added to RDEPENDS as /usr/libexec/vncsession-start requires it.
2) DEPENDS on libpam and requires 'pam' distro feature.
This is because upstream has made 'pam' mandatory in the following commit.
"""
commit d80817f101d1b3f1a9b1c5ec268f28fffa2d75f9
Author: Pierre Ossman <ossman@cendio.se>
Date: Wed Jul 11 15:49:46 2018 +0200
Make PAM mandatory
It is present on all UNIX systems anyway, so let's simplify things.
We will need it for more proper session startup anyway.
"""
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
...002-do-not-build-tests-sub-directory.patch | 21 +++++------
...vnc-add-fPIC-option-to-COMPILE_FLAGS.patch | 36 +++++++------------
...{tigervnc_1.10.1.bb => tigervnc_1.11.0.bb} | 13 ++++---
3 files changed, 32 insertions(+), 38 deletions(-)
rename meta-oe/recipes-graphics/tigervnc/{tigervnc_1.10.1.bb => tigervnc_1.11.0.bb} (89%)
diff --git a/meta-oe/recipes-graphics/tigervnc/files/0002-do-not-build-tests-sub-directory.patch b/meta-oe/recipes-graphics/tigervnc/files/0002-do-not-build-tests-sub-directory.patch
index 4e875ba82b..5a42e67d06 100644
--- a/meta-oe/recipes-graphics/tigervnc/files/0002-do-not-build-tests-sub-directory.patch
+++ b/meta-oe/recipes-graphics/tigervnc/files/0002-do-not-build-tests-sub-directory.patch
@@ -1,29 +1,30 @@
-From c3460d63f0b6cd50b9a64265f420f0439e12a1d5 Mon Sep 17 00:00:00 2001
-From: Hongxu Jia <hongxu.jia@windriver.com>
-Date: Tue, 25 Apr 2017 01:36:44 -0400
-Subject: [PATCH 2/4] do not build tests sub directory
+From 076d0e12a7be6cd2108e4ca0dcde1cb658918fa5 Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Mon, 19 Apr 2021 23:02:45 -0700
+Subject: [PATCH] do not build tests sub directory
-Upstream-Status: Inappropriate [oe specific]
+Upstream-Status: Inappropriate [OE Specific]
-Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+Signed-off-by: Hongxu Jia <Hongxu.Jia@windriver.com>
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
CMakeLists.txt | 3 ---
1 file changed, 3 deletions(-)
diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 94ec2ef..fb72a00 100644
+index 7bf99441..bda80598 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
-@@ -300,9 +300,6 @@ if(BUILD_VIEWER)
+@@ -304,9 +304,6 @@ if(BUILD_VIEWER)
add_subdirectory(media)
endif()
-add_subdirectory(tests)
-
-
- include(cmake/BuildPackages.cmake)
+ add_subdirectory(release)
# uninstall
--
-2.7.4
+2.30.2
diff --git a/meta-oe/recipes-graphics/tigervnc/files/0004-tigervnc-add-fPIC-option-to-COMPILE_FLAGS.patch b/meta-oe/recipes-graphics/tigervnc/files/0004-tigervnc-add-fPIC-option-to-COMPILE_FLAGS.patch
index 97b0a388a2..5f14665b8d 100644
--- a/meta-oe/recipes-graphics/tigervnc/files/0004-tigervnc-add-fPIC-option-to-COMPILE_FLAGS.patch
+++ b/meta-oe/recipes-graphics/tigervnc/files/0004-tigervnc-add-fPIC-option-to-COMPILE_FLAGS.patch
@@ -1,44 +1,34 @@
-From 9563b69640227da2220ee0c39077afb736cc96d1 Mon Sep 17 00:00:00 2001
-From: Hongxu Jia <hongxu.jia@windriver.com>
-Date: Thu, 20 Jul 2017 17:12:17 +0800
-Subject: [PATCH 4/4] tigervnc: add fPIC option to COMPILE_FLAGS
+From 7f8acd59bb2e54f9be25a98dd71534700a9e355a Mon Sep 17 00:00:00 2001
+From: Chen Qi <Qi.Chen@windriver.com>
+Date: Mon, 19 Apr 2021 23:14:28 -0700
+Subject: [PATCH] tigervnc: add fPIC option to COMPILE_FLAGS
-The static libraries in Xregion/network/rdr/rfb were linked by shared
+The static libraries in network/rdr/rfb were linked by shared
library libvnc.so, so we should add fPIC option to COMPILE_FLAGS to fix
relocation issue.
Upstream-Status: Pending
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
---
- common/Xregion/CMakeLists.txt | 1 +
common/network/CMakeLists.txt | 1 +
common/rdr/CMakeLists.txt | 1 +
common/rfb/CMakeLists.txt | 1 +
- 4 files changed, 4 insertions(+)
+ 3 files changed, 3 insertions(+)
-diff --git a/common/Xregion/CMakeLists.txt b/common/Xregion/CMakeLists.txt
-index 40ca97e..9411328 100644
---- a/common/Xregion/CMakeLists.txt
-+++ b/common/Xregion/CMakeLists.txt
-@@ -3,4 +3,5 @@ add_library(Xregion STATIC
-
- if(UNIX)
- libtool_create_control_file(Xregion)
-+ set_target_properties(Xregion PROPERTIES COMPILE_FLAGS -fPIC)
- endif()
diff --git a/common/network/CMakeLists.txt b/common/network/CMakeLists.txt
-index b624c8e..6c06ec9 100644
+index d00ca452..e84e0290 100644
--- a/common/network/CMakeLists.txt
+++ b/common/network/CMakeLists.txt
-@@ -9,4 +9,5 @@ endif()
+@@ -16,4 +16,5 @@ endif()
if(UNIX)
libtool_create_control_file(network)
+ set_target_properties(network PROPERTIES COMPILE_FLAGS -fPIC)
endif()
diff --git a/common/rdr/CMakeLists.txt b/common/rdr/CMakeLists.txt
-index 989ba2f..20f6489 100644
+index 989ba2f4..20f6489d 100644
--- a/common/rdr/CMakeLists.txt
+++ b/common/rdr/CMakeLists.txt
@@ -27,4 +27,5 @@ target_link_libraries(rdr ${RDR_LIBRARIES})
@@ -48,15 +38,15 @@ index 989ba2f..20f6489 100644
+ set_target_properties(rdr PROPERTIES COMPILE_FLAGS -fPIC)
endif()
diff --git a/common/rfb/CMakeLists.txt b/common/rfb/CMakeLists.txt
-index 5047e5e..88838ab 100644
+index fc5a37bf..7f5ce131 100644
--- a/common/rfb/CMakeLists.txt
+++ b/common/rfb/CMakeLists.txt
-@@ -98,4 +98,5 @@ target_link_libraries(rfb ${RFB_LIBRARIES})
+@@ -99,4 +99,5 @@ target_link_libraries(rfb ${RFB_LIBRARIES})
if(UNIX)
libtool_create_control_file(rfb)
+ set_target_properties(rfb PROPERTIES COMPILE_FLAGS -fPIC)
endif()
--
-2.7.4
+2.30.2
diff --git a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.10.1.bb b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
similarity index 89%
rename from meta-oe/recipes-graphics/tigervnc/tigervnc_1.10.1.bb
rename to meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
index f97c2b2d6c..ce6c59bc39 100644
--- a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.10.1.bb
+++ b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
@@ -2,22 +2,22 @@ DESCRIPTION = "TigerVNC remote display system"
HOMEPAGE = "http://www.tigervnc.com/"
LICENSE = "GPLv2+"
SECTION = "x11/utils"
-DEPENDS = "xserver-xorg gnutls jpeg libxtst gettext-native fltk"
-RDEPENDS_${PN} = "coreutils hicolor-icon-theme perl"
+DEPENDS = "xserver-xorg gnutls jpeg libxtst gettext-native fltk libpam"
+RDEPENDS_${PN} = "coreutils hicolor-icon-theme perl bash"
LIC_FILES_CHKSUM = "file://LICENCE.TXT;md5=75b02c2872421380bbd47781d2bd75d3"
S = "${WORKDIR}/git"
inherit features_check
-REQUIRED_DISTRO_FEATURES = "x11"
+REQUIRED_DISTRO_FEATURES = "x11 pam"
inherit autotools cmake
B = "${S}"
-SRCREV = "4739493b635372bd40a34640a719f79fa90e4dba"
+SRCREV = "540bfc3278e396321124d4b18a798ac2bc18b6ca"
-SRC_URI = "git://github.com/TigerVNC/tigervnc.git;branch=1.10-branch \
+SRC_URI = "git://github.com/TigerVNC/tigervnc.git;branch=1.11-branch \
file://0002-do-not-build-tests-sub-directory.patch \
file://0003-add-missing-dynamic-library-to-FLTK_LIBRARIES.patch \
file://0004-tigervnc-add-fPIC-option-to-COMPILE_FLAGS.patch \
@@ -83,6 +83,8 @@ EXTRA_OECONF = "--disable-xorg --disable-xnest --disable-xvfb --disable-dmx \
--disable-xwayland \
"
+EXTRA_OECMAKE += "${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '-DCMAKE_INSTALL_UNITDIR=/lib/systemd/system', '-DINSTALL_SYSTEMD_UNITS=OFF', d)}"
+
do_configure_append () {
olddir=`pwd`
cd ${XSERVER_SOURCE_DIR}
@@ -125,6 +127,7 @@ do_install_append() {
FILES_${PN} += " \
${libdir}/xorg/modules/extensions \
${datadir}/icons \
+ ${systemd_unitdir} \
"
FILES_${PN}-dbg += "${libdir}/xorg/modules/extensions/.debug"
--
2.17.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [hardknott 4/6] python3-django: upgrade to 2.2.20
2021-04-24 10:11 [hardknott 0/6] Patch review April 24th Armin Kuster
` (2 preceding siblings ...)
2021-04-24 10:11 ` [hardknott 3/6] tigervnc: upgrade to 1.11.0 Armin Kuster
@ 2021-04-24 10:11 ` Armin Kuster
2021-04-24 10:11 ` [hardknott 5/6] php: Upgrade to 7.4.16 Armin Kuster
` (2 subsequent siblings)
6 siblings, 0 replies; 11+ messages in thread
From: Armin Kuster @ 2021-04-24 10:11 UTC (permalink / raw)
To: openembedded-devel
From: Chen Qi <Qi.Chen@windriver.com>
2.2.x is LTS, so upgrade to latest release 2.2.20.
This upgrade fixes several CVEs such as CVE-2021-3281.
Also, CVE-2021-28658.patch is dropped as it's already in 2.2.20.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../CVE-2021-28658.patch | 289 ------------------
.../python/python3-django_2.2.16.bb | 11 -
.../python/python3-django_2.2.20.bb | 9 +
3 files changed, 9 insertions(+), 300 deletions(-)
delete mode 100644 meta-python/recipes-devtools/python/python3-django-2.2.16/CVE-2021-28658.patch
delete mode 100644 meta-python/recipes-devtools/python/python3-django_2.2.16.bb
create mode 100644 meta-python/recipes-devtools/python/python3-django_2.2.20.bb
diff --git a/meta-python/recipes-devtools/python/python3-django-2.2.16/CVE-2021-28658.patch b/meta-python/recipes-devtools/python/python3-django-2.2.16/CVE-2021-28658.patch
deleted file mode 100644
index 325aa00420..0000000000
--- a/meta-python/recipes-devtools/python/python3-django-2.2.16/CVE-2021-28658.patch
+++ /dev/null
@@ -1,289 +0,0 @@
-From 4036d62bda0e9e9f6172943794b744a454ca49c2 Mon Sep 17 00:00:00 2001
-From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
-Date: Tue, 16 Mar 2021 10:19:00 +0100
-Subject: [PATCH] Fixed CVE-2021-28658 -- Fixed potential directory-traversal
- via uploaded files.
-
-Thanks Claude Paroz for the initial patch.
-Thanks Dennis Brinkrolf for the report.
-
-Backport of d4d800ca1addc4141e03c5440a849bb64d1582cd from main.
-
-Upstream-Status: Backport
-CVE: CVE-2021-28658
-
-Reference to upstream patch:
-[https://github.com/django/django/commit/4036d62bda0e9e9f6172943794b744a454ca49c2]
-
-[SG: Adapted stable/2.2.x patch for 2.2.16]
-Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
----
- django/http/multipartparser.py | 13 ++++--
- docs/releases/2.2.16.txt | 12 +++++
- tests/file_uploads/tests.py | 72 ++++++++++++++++++++++-------
- tests/file_uploads/uploadhandler.py | 31 +++++++++++++
- tests/file_uploads/urls.py | 1 +
- tests/file_uploads/views.py | 12 ++++-
- 6 files changed, 120 insertions(+), 21 deletions(-)
-
-diff --git a/django/http/multipartparser.py b/django/http/multipartparser.py
-index f6f12ca..5a9cca8 100644
---- a/django/http/multipartparser.py
-+++ b/django/http/multipartparser.py
-@@ -7,6 +7,7 @@ file upload handlers for processing.
- import base64
- import binascii
- import cgi
-+import os
- from urllib.parse import unquote
-
- from django.conf import settings
-@@ -205,7 +206,7 @@ class MultiPartParser:
- file_name = disposition.get('filename')
- if file_name:
- file_name = force_text(file_name, encoding, errors='replace')
-- file_name = self.IE_sanitize(unescape_entities(file_name))
-+ file_name = self.sanitize_file_name(file_name)
- if not file_name:
- continue
-
-@@ -293,9 +294,13 @@ class MultiPartParser:
- self._files.appendlist(force_text(old_field_name, self._encoding, errors='replace'), file_obj)
- break
-
-- def IE_sanitize(self, filename):
-- """Cleanup filename from Internet Explorer full paths."""
-- return filename and filename[filename.rfind("\\") + 1:].strip()
-+ def sanitize_file_name(self, file_name):
-+ file_name = unescape_entities(file_name)
-+ # Cleanup Windows-style path separators.
-+ file_name = file_name[file_name.rfind('\\') + 1:].strip()
-+ return os.path.basename(file_name)
-+
-+ IE_sanitize = sanitize_file_name
-
- def _close_files(self):
- # Free up all file handles.
-diff --git a/docs/releases/2.2.16.txt b/docs/releases/2.2.16.txt
-index 31231fb..4b7021b 100644
---- a/docs/releases/2.2.16.txt
-+++ b/docs/releases/2.2.16.txt
-@@ -2,6 +2,18 @@
- Django 2.2.16 release notes
- ===========================
-
-+*April 6, 2021*
-+
-+Backported from Django 2.2.20 a fix for a security issue.
-+
-+CVE-2021-28658: Potential directory-traversal via uploaded files
-+================================================================
-+
-+``MultiPartParser`` allowed directory-traversal via uploaded files with
-+suitably crafted file names.
-+
-+Built-in upload handlers were not affected by this vulnerability.
-+
- *September 1, 2020*
-
- Django 2.2.16 fixes two security issues and two data loss bugs in 2.2.15.
-diff --git a/tests/file_uploads/tests.py b/tests/file_uploads/tests.py
-index ea4976d..2a08d1b 100644
---- a/tests/file_uploads/tests.py
-+++ b/tests/file_uploads/tests.py
-@@ -22,6 +22,21 @@ UNICODE_FILENAME = 'test-0123456789_中文_Orléans.jpg'
- MEDIA_ROOT = sys_tempfile.mkdtemp()
- UPLOAD_TO = os.path.join(MEDIA_ROOT, 'test_upload')
-
-+CANDIDATE_TRAVERSAL_FILE_NAMES = [
-+ '/tmp/hax0rd.txt', # Absolute path, *nix-style.
-+ 'C:\\Windows\\hax0rd.txt', # Absolute path, win-style.
-+ 'C:/Windows/hax0rd.txt', # Absolute path, broken-style.
-+ '\\tmp\\hax0rd.txt', # Absolute path, broken in a different way.
-+ '/tmp\\hax0rd.txt', # Absolute path, broken by mixing.
-+ 'subdir/hax0rd.txt', # Descendant path, *nix-style.
-+ 'subdir\\hax0rd.txt', # Descendant path, win-style.
-+ 'sub/dir\\hax0rd.txt', # Descendant path, mixed.
-+ '../../hax0rd.txt', # Relative path, *nix-style.
-+ '..\\..\\hax0rd.txt', # Relative path, win-style.
-+ '../..\\hax0rd.txt', # Relative path, mixed.
-+ '../hax0rd.txt', # HTML entities.
-+]
-+
-
- @override_settings(MEDIA_ROOT=MEDIA_ROOT, ROOT_URLCONF='file_uploads.urls', MIDDLEWARE=[])
- class FileUploadTests(TestCase):
-@@ -205,22 +220,8 @@ class FileUploadTests(TestCase):
- # a malicious payload with an invalid file name (containing os.sep or
- # os.pardir). This similar to what an attacker would need to do when
- # trying such an attack.
-- scary_file_names = [
-- "/tmp/hax0rd.txt", # Absolute path, *nix-style.
-- "C:\\Windows\\hax0rd.txt", # Absolute path, win-style.
-- "C:/Windows/hax0rd.txt", # Absolute path, broken-style.
-- "\\tmp\\hax0rd.txt", # Absolute path, broken in a different way.
-- "/tmp\\hax0rd.txt", # Absolute path, broken by mixing.
-- "subdir/hax0rd.txt", # Descendant path, *nix-style.
-- "subdir\\hax0rd.txt", # Descendant path, win-style.
-- "sub/dir\\hax0rd.txt", # Descendant path, mixed.
-- "../../hax0rd.txt", # Relative path, *nix-style.
-- "..\\..\\hax0rd.txt", # Relative path, win-style.
-- "../..\\hax0rd.txt" # Relative path, mixed.
-- ]
--
- payload = client.FakePayload()
-- for i, name in enumerate(scary_file_names):
-+ for i, name in enumerate(CANDIDATE_TRAVERSAL_FILE_NAMES):
- payload.write('\r\n'.join([
- '--' + client.BOUNDARY,
- 'Content-Disposition: form-data; name="file%s"; filename="%s"' % (i, name),
-@@ -240,7 +241,7 @@ class FileUploadTests(TestCase):
- response = self.client.request(**r)
- # The filenames should have been sanitized by the time it got to the view.
- received = response.json()
-- for i, name in enumerate(scary_file_names):
-+ for i, name in enumerate(CANDIDATE_TRAVERSAL_FILE_NAMES):
- got = received["file%s" % i]
- self.assertEqual(got, "hax0rd.txt")
-
-@@ -518,6 +519,36 @@ class FileUploadTests(TestCase):
- # shouldn't differ.
- self.assertEqual(os.path.basename(obj.testfile.path), 'MiXeD_cAsE.txt')
-
-+ def test_filename_traversal_upload(self):
-+ os.makedirs(UPLOAD_TO, exist_ok=True)
-+ self.addCleanup(shutil.rmtree, MEDIA_ROOT)
-+ file_name = '../test.txt',
-+ payload = client.FakePayload()
-+ payload.write(
-+ '\r\n'.join([
-+ '--' + client.BOUNDARY,
-+ 'Content-Disposition: form-data; name="my_file"; '
-+ 'filename="%s";' % file_name,
-+ 'Content-Type: text/plain',
-+ '',
-+ 'file contents.\r\n',
-+ '\r\n--' + client.BOUNDARY + '--\r\n',
-+ ]),
-+ )
-+ r = {
-+ 'CONTENT_LENGTH': len(payload),
-+ 'CONTENT_TYPE': client.MULTIPART_CONTENT,
-+ 'PATH_INFO': '/upload_traversal/',
-+ 'REQUEST_METHOD': 'POST',
-+ 'wsgi.input': payload,
-+ }
-+ response = self.client.request(**r)
-+ result = response.json()
-+ self.assertEqual(response.status_code, 200)
-+ self.assertEqual(result['file_name'], 'test.txt')
-+ self.assertIs(os.path.exists(os.path.join(MEDIA_ROOT, 'test.txt')), False)
-+ self.assertIs(os.path.exists(os.path.join(UPLOAD_TO, 'test.txt')), True)
-+
-
- @override_settings(MEDIA_ROOT=MEDIA_ROOT)
- class DirectoryCreationTests(SimpleTestCase):
-@@ -591,6 +622,15 @@ class MultiParserTests(SimpleTestCase):
- }, StringIO('x'), [], 'utf-8')
- self.assertEqual(multipart_parser._content_length, 0)
-
-+ def test_sanitize_file_name(self):
-+ parser = MultiPartParser({
-+ 'CONTENT_TYPE': 'multipart/form-data; boundary=_foo',
-+ 'CONTENT_LENGTH': '1'
-+ }, StringIO('x'), [], 'utf-8')
-+ for file_name in CANDIDATE_TRAVERSAL_FILE_NAMES:
-+ with self.subTest(file_name=file_name):
-+ self.assertEqual(parser.sanitize_file_name(file_name), 'hax0rd.txt')
-+
- def test_rfc2231_parsing(self):
- test_data = (
- (b"Content-Type: application/x-stuff; title*=us-ascii'en-us'This%20is%20%2A%2A%2Afun%2A%2A%2A",
-diff --git a/tests/file_uploads/uploadhandler.py b/tests/file_uploads/uploadhandler.py
-index 7c6199f..65d70c6 100644
---- a/tests/file_uploads/uploadhandler.py
-+++ b/tests/file_uploads/uploadhandler.py
-@@ -1,6 +1,8 @@
- """
- Upload handlers to test the upload API.
- """
-+import os
-+from tempfile import NamedTemporaryFile
-
- from django.core.files.uploadhandler import FileUploadHandler, StopUpload
-
-@@ -35,3 +37,32 @@ class ErroringUploadHandler(FileUploadHandler):
- """A handler that raises an exception."""
- def receive_data_chunk(self, raw_data, start):
- raise CustomUploadError("Oops!")
-+
-+
-+class TraversalUploadHandler(FileUploadHandler):
-+ """A handler with potential directory-traversal vulnerability."""
-+ def __init__(self, request=None):
-+ from .views import UPLOAD_TO
-+
-+ super().__init__(request)
-+ self.upload_dir = UPLOAD_TO
-+
-+ def file_complete(self, file_size):
-+ self.file.seek(0)
-+ self.file.size = file_size
-+ with open(os.path.join(self.upload_dir, self.file_name), 'wb') as fp:
-+ fp.write(self.file.read())
-+ return self.file
-+
-+ def new_file(
-+ self, field_name, file_name, content_type, content_length, charset=None,
-+ content_type_extra=None,
-+ ):
-+ super().new_file(
-+ file_name, file_name, content_length, content_length, charset,
-+ content_type_extra,
-+ )
-+ self.file = NamedTemporaryFile(suffix='.upload', dir=self.upload_dir)
-+
-+ def receive_data_chunk(self, raw_data, start):
-+ self.file.write(raw_data)
-diff --git a/tests/file_uploads/urls.py b/tests/file_uploads/urls.py
-index 3e7985d..eaac1da 100644
---- a/tests/file_uploads/urls.py
-+++ b/tests/file_uploads/urls.py
-@@ -4,6 +4,7 @@ from . import views
-
- urlpatterns = [
- path('upload/', views.file_upload_view),
-+ path('upload_traversal/', views.file_upload_traversal_view),
- path('verify/', views.file_upload_view_verify),
- path('unicode_name/', views.file_upload_unicode_name),
- path('echo/', views.file_upload_echo),
-diff --git a/tests/file_uploads/views.py b/tests/file_uploads/views.py
-index d4947e4..137c6f3 100644
---- a/tests/file_uploads/views.py
-+++ b/tests/file_uploads/views.py
-@@ -6,7 +6,9 @@ from django.http import HttpResponse, HttpResponseServerError, JsonResponse
-
- from .models import FileModel
- from .tests import UNICODE_FILENAME, UPLOAD_TO
--from .uploadhandler import ErroringUploadHandler, QuotaUploadHandler
-+from .uploadhandler import (
-+ ErroringUploadHandler, QuotaUploadHandler, TraversalUploadHandler,
-+)
-
-
- def file_upload_view(request):
-@@ -158,3 +160,11 @@ def file_upload_fd_closing(request, access):
- if access == 't':
- request.FILES # Trigger file parsing.
- return HttpResponse('')
-+
-+
-+def file_upload_traversal_view(request):
-+ request.upload_handlers.insert(0, TraversalUploadHandler())
-+ request.FILES # Trigger file parsing.
-+ return JsonResponse(
-+ {'file_name': request.upload_handlers[0].file_name},
-+ )
---
-2.17.1
-
diff --git a/meta-python/recipes-devtools/python/python3-django_2.2.16.bb b/meta-python/recipes-devtools/python/python3-django_2.2.16.bb
deleted file mode 100644
index eb626e8d3f..0000000000
--- a/meta-python/recipes-devtools/python/python3-django_2.2.16.bb
+++ /dev/null
@@ -1,11 +0,0 @@
-require python-django.inc
-inherit setuptools3
-
-SRC_URI[md5sum] = "93faf5bbd54a19ea49f4932a813b9758"
-SRC_URI[sha256sum] = "62cf45e5ee425c52e411c0742e641a6588b7e8af0d2c274a27940931b2786594"
-
-RDEPENDS_${PN} += "\
- ${PYTHON_PN}-sqlparse \
-"
-SRC_URI += "file://CVE-2021-28658.patch \
-"
diff --git a/meta-python/recipes-devtools/python/python3-django_2.2.20.bb b/meta-python/recipes-devtools/python/python3-django_2.2.20.bb
new file mode 100644
index 0000000000..905d022a4f
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-django_2.2.20.bb
@@ -0,0 +1,9 @@
+require python-django.inc
+inherit setuptools3
+
+SRC_URI[md5sum] = "947060d96ccc0a05e8049d839e541b25"
+SRC_URI[sha256sum] = "2569f9dc5f8e458a5e988b03d6b7a02bda59b006d6782f4ea0fd590ed7336a64"
+
+RDEPENDS_${PN} += "\
+ ${PYTHON_PN}-sqlparse \
+"
--
2.17.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [hardknott 5/6] php: Upgrade to 7.4.16
2021-04-24 10:11 [hardknott 0/6] Patch review April 24th Armin Kuster
` (3 preceding siblings ...)
2021-04-24 10:11 ` [hardknott 4/6] python3-django: upgrade to 2.2.20 Armin Kuster
@ 2021-04-24 10:11 ` Armin Kuster
2021-04-24 10:11 ` [hardknott 6/6] python3-cryptography: Upgrade to 3.3.2 Armin Kuster
2021-04-24 10:36 ` [oe] [hardknott 0/6] Patch review April 24th Martin Jansa
6 siblings, 0 replies; 11+ messages in thread
From: Armin Kuster @ 2021-04-24 10:11 UTC (permalink / raw)
To: openembedded-devel
From: Mingli Yu <mingli.yu@windriver.com>
License-Update: License updated (year updated)
Fix some security issues such as CVE-2021-21702 and remove two
cve patches which already included in the new version.
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
.../php/php/CVE-2020-7069.patch | 158 ------------------
.../php/php/CVE-2020-7070.patch | 24 ---
.../php/{php_7.4.9.bb => php_7.4.16.bb} | 7 +-
3 files changed, 2 insertions(+), 187 deletions(-)
delete mode 100644 meta-oe/recipes-devtools/php/php/CVE-2020-7069.patch
delete mode 100644 meta-oe/recipes-devtools/php/php/CVE-2020-7070.patch
rename meta-oe/recipes-devtools/php/{php_7.4.9.bb => php_7.4.16.bb} (97%)
diff --git a/meta-oe/recipes-devtools/php/php/CVE-2020-7069.patch b/meta-oe/recipes-devtools/php/php/CVE-2020-7069.patch
deleted file mode 100644
index 0cf4d5ed60..0000000000
--- a/meta-oe/recipes-devtools/php/php/CVE-2020-7069.patch
+++ /dev/null
@@ -1,158 +0,0 @@
-Subject: Fix bug #79601 (Wrong ciphertext/tag in AES-CCM encryption
- for a 12 bytes IV)
-
----
- ext/openssl/openssl.c | 10 ++++-----
- ext/openssl/tests/cipher_tests.inc | 21 +++++++++++++++++
- ext/openssl/tests/openssl_decrypt_ccm.phpt | 22 +++++++++++-------
- ext/openssl/tests/openssl_encrypt_ccm.phpt | 26 ++++++++++++++--------
- 4 files changed, 57 insertions(+), 22 deletions(-)
-
-diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
-index 04cb9b0f..fdad2c3b 100644
---- a/ext/openssl/openssl.c
-+++ b/ext/openssl/openssl.c
-@@ -6521,11 +6521,6 @@ static int php_openssl_validate_iv(char **piv, size_t *piv_len, size_t iv_requir
- {
- char *iv_new;
-
-- /* Best case scenario, user behaved */
-- if (*piv_len == iv_required_len) {
-- return SUCCESS;
-- }
--
- if (mode->is_aead) {
- if (EVP_CIPHER_CTX_ctrl(cipher_ctx, mode->aead_ivlen_flag, *piv_len, NULL) != 1) {
- php_error_docref(NULL, E_WARNING, "Setting of IV length for AEAD mode failed");
-@@ -6534,6 +6529,11 @@ static int php_openssl_validate_iv(char **piv, size_t *piv_len, size_t iv_requir
- return SUCCESS;
- }
-
-+ /* Best case scenario, user behaved */
-+ if (*piv_len == iv_required_len) {
-+ return SUCCESS;
-+ }
-+
- iv_new = ecalloc(1, iv_required_len + 1);
-
- if (*piv_len == 0) {
-diff --git a/ext/openssl/tests/cipher_tests.inc b/ext/openssl/tests/cipher_tests.inc
-index b1e46b41..779bfa85 100644
---- a/ext/openssl/tests/cipher_tests.inc
-+++ b/ext/openssl/tests/cipher_tests.inc
-@@ -1,5 +1,26 @@
- <?php
- $php_openssl_cipher_tests = array(
-+ 'aes-128-ccm' => array(
-+ array(
-+ 'key' => '404142434445464748494a4b4c4d4e4f',
-+ 'iv' => '1011121314151617',
-+ 'aad' => '000102030405060708090a0b0c0d0e0f',
-+ 'tag' => '1fc64fbfaccd',
-+ 'pt' => '202122232425262728292a2b2c2d2e2f',
-+ 'ct' => 'd2a1f0e051ea5f62081a7792073d593d',
-+ ),
-+ array(
-+ 'key' => '404142434445464748494a4b4c4d4e4f',
-+ 'iv' => '101112131415161718191a1b',
-+ 'aad' => '000102030405060708090a0b0c0d0e0f' .
-+ '10111213',
-+ 'tag' => '484392fbc1b09951',
-+ 'pt' => '202122232425262728292a2b2c2d2e2f' .
-+ '3031323334353637',
-+ 'ct' => 'e3b201a9f5b71a7a9b1ceaeccd97e70b' .
-+ '6176aad9a4428aa5',
-+ ),
-+ ),
- 'aes-256-ccm' => array(
- array(
- 'key' => '1bde3251d41a8b5ea013c195ae128b21' .
-diff --git a/ext/openssl/tests/openssl_decrypt_ccm.phpt b/ext/openssl/tests/openssl_decrypt_ccm.phpt
-index a5f01b87..08ef5bb7 100644
---- a/ext/openssl/tests/openssl_decrypt_ccm.phpt
-+++ b/ext/openssl/tests/openssl_decrypt_ccm.phpt
-@@ -10,14 +10,16 @@ if (!in_array('aes-256-ccm', openssl_get_cipher_methods()))
- --FILE--
- <?php
- require_once __DIR__ . "/cipher_tests.inc";
--$method = 'aes-256-ccm';
--$tests = openssl_get_cipher_tests($method);
-+$methods = ['aes-128-ccm', 'aes-256-ccm'];
-
--foreach ($tests as $idx => $test) {
-- echo "TEST $idx\n";
-- $pt = openssl_decrypt($test['ct'], $method, $test['key'], OPENSSL_RAW_DATA,
-- $test['iv'], $test['tag'], $test['aad']);
-- var_dump($test['pt'] === $pt);
-+foreach ($methods as $method) {
-+ $tests = openssl_get_cipher_tests($method);
-+ foreach ($tests as $idx => $test) {
-+ echo "$method - TEST $idx\n";
-+ $pt = openssl_decrypt($test['ct'], $method, $test['key'], OPENSSL_RAW_DATA,
-+ $test['iv'], $test['tag'], $test['aad']);
-+ var_dump($test['pt'] === $pt);
-+ }
- }
-
- // no IV
-@@ -32,7 +34,11 @@ var_dump(openssl_decrypt($test['ct'], $method, $test['key'], OPENSSL_RAW_DATA,
-
- ?>
- --EXPECTF--
--TEST 0
-+aes-128-ccm - TEST 0
-+bool(true)
-+aes-128-ccm - TEST 1
-+bool(true)
-+aes-256-ccm - TEST 0
- bool(true)
-
- Warning: openssl_decrypt(): Setting of IV length for AEAD mode failed in %s on line %d
-diff --git a/ext/openssl/tests/openssl_encrypt_ccm.phpt b/ext/openssl/tests/openssl_encrypt_ccm.phpt
-index fb5dbbc8..8c4c41f8 100644
---- a/ext/openssl/tests/openssl_encrypt_ccm.phpt
-+++ b/ext/openssl/tests/openssl_encrypt_ccm.phpt
-@@ -10,15 +10,17 @@ if (!in_array('aes-256-ccm', openssl_get_cipher_methods()))
- --FILE--
- <?php
- require_once __DIR__ . "/cipher_tests.inc";
--$method = 'aes-256-ccm';
--$tests = openssl_get_cipher_tests($method);
-+$methods = ['aes-128-ccm', 'aes-256-ccm'];
-
--foreach ($tests as $idx => $test) {
-- echo "TEST $idx\n";
-- $ct = openssl_encrypt($test['pt'], $method, $test['key'], OPENSSL_RAW_DATA,
-- $test['iv'], $tag, $test['aad'], strlen($test['tag']));
-- var_dump($test['ct'] === $ct);
-- var_dump($test['tag'] === $tag);
-+foreach ($methods as $method) {
-+ $tests = openssl_get_cipher_tests($method);
-+ foreach ($tests as $idx => $test) {
-+ echo "$method - TEST $idx\n";
-+ $ct = openssl_encrypt($test['pt'], $method, $test['key'], OPENSSL_RAW_DATA,
-+ $test['iv'], $tag, $test['aad'], strlen($test['tag']));
-+ var_dump($test['ct'] === $ct);
-+ var_dump($test['tag'] === $tag);
-+ }
- }
-
- // Empty IV error
-@@ -32,7 +34,13 @@ var_dump(strlen($tag));
- var_dump(openssl_encrypt('data', $method, 'password', 0, str_repeat('x', 16), $tag, '', 1024));
- ?>
- --EXPECTF--
--TEST 0
-+aes-128-ccm - TEST 0
-+bool(true)
-+bool(true)
-+aes-128-ccm - TEST 1
-+bool(true)
-+bool(true)
-+aes-256-ccm - TEST 0
- bool(true)
- bool(true)
-
---
-2.25.1
-
diff --git a/meta-oe/recipes-devtools/php/php/CVE-2020-7070.patch b/meta-oe/recipes-devtools/php/php/CVE-2020-7070.patch
deleted file mode 100644
index e5b527f989..0000000000
--- a/meta-oe/recipes-devtools/php/php/CVE-2020-7070.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-Subject: Patch fix-urldecode for HTTP related Bug #79699
-
----
- main/php_variables.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/main/php_variables.c b/main/php_variables.c
-index 1a40c2a1..cbdc7cf1 100644
---- a/main/php_variables.c
-+++ b/main/php_variables.c
-@@ -514,7 +514,9 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
- }
-
- val = estrndup(val, val_len);
-- php_url_decode(var, strlen(var));
-+ if (arg != PARSE_COOKIE) {
-+ php_url_decode(var, strlen(var));
-+ }
- if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len)) {
- php_register_variable_safe(var, val, new_val_len, &array);
- }
---
-2.25.1
-
diff --git a/meta-oe/recipes-devtools/php/php_7.4.9.bb b/meta-oe/recipes-devtools/php/php_7.4.16.bb
similarity index 97%
rename from meta-oe/recipes-devtools/php/php_7.4.9.bb
rename to meta-oe/recipes-devtools/php/php_7.4.16.bb
index e19d5dd21c..821d9cd046 100644
--- a/meta-oe/recipes-devtools/php/php_7.4.9.bb
+++ b/meta-oe/recipes-devtools/php/php_7.4.16.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "http://www.php.net"
SECTION = "console/network"
LICENSE = "PHP-3.0"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=7e571b888d585b31f9ef5edcc647fa30"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=99532e0f6620bc9bca34f12fadaee33c"
BBCLASSEXTEND = "native"
DEPENDS = "zlib bzip2 libxml2 virtual/libiconv php-native lemon-native"
@@ -30,13 +30,10 @@ SRC_URI_append_class-target = " \
file://phar-makefile.patch \
file://0001-opcache-config.m4-enable-opcache.patch \
file://xfail_two_bug_tests.patch \
- file://CVE-2020-7070.patch \
- file://CVE-2020-7069.patch \
"
S = "${WORKDIR}/php-${PV}"
-SRC_URI[md5sum] = "e68a66c54b080d108831f6dc2e1e403d"
-SRC_URI[sha256sum] = "2e270958a4216480da7886743438ccc92b6acf32ea96fefda88d07e0a5095deb"
+SRC_URI[sha256sum] = "85710f007cfd0fae94e13a02a3a036f4e81ef43693260cae8a2e1ca93659ce3e"
inherit autotools pkgconfig python3native gettext
--
2.17.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [hardknott 6/6] python3-cryptography: Upgrade to 3.3.2
2021-04-24 10:11 [hardknott 0/6] Patch review April 24th Armin Kuster
` (4 preceding siblings ...)
2021-04-24 10:11 ` [hardknott 5/6] php: Upgrade to 7.4.16 Armin Kuster
@ 2021-04-24 10:11 ` Armin Kuster
2021-04-24 10:36 ` [oe] [hardknott 0/6] Patch review April 24th Martin Jansa
6 siblings, 0 replies; 11+ messages in thread
From: Armin Kuster @ 2021-04-24 10:11 UTC (permalink / raw)
To: openembedded-devel
From: Mingli Yu <mingli.yu@windriver.com>
Fix a security issue CVE-2020-36242 where certain sequences of
``update()`` calls when symmetrically encrypting very large
payloads (>2GB) could result in an integer overflow, leading to
buffer overflows.
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
...hon3-cryptography_3.3.1.bb => python3-cryptography_3.3.2.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-python/recipes-devtools/python/{python3-cryptography_3.3.1.bb => python3-cryptography_3.3.2.bb} (94%)
diff --git a/meta-python/recipes-devtools/python/python3-cryptography_3.3.1.bb b/meta-python/recipes-devtools/python/python3-cryptography_3.3.2.bb
similarity index 94%
rename from meta-python/recipes-devtools/python/python3-cryptography_3.3.1.bb
rename to meta-python/recipes-devtools/python/python3-cryptography_3.3.2.bb
index 79a7ac1bf9..0a36ffe1bd 100644
--- a/meta-python/recipes-devtools/python/python3-cryptography_3.3.1.bb
+++ b/meta-python/recipes-devtools/python/python3-cryptography_3.3.2.bb
@@ -6,7 +6,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=bf405a8056a6647e7d077b0e7bc36aba"
LDSHARED += "-pthread"
-SRC_URI[sha256sum] = "7e177e4bea2de937a584b13645cab32f25e3d96fc0bc4a4cf99c27dc77682be6"
+SRC_URI[sha256sum] = "5a60d3780149e13b7a6ff7ad6526b38846354d11a15e21068e57073e29e19bed"
SRC_URI += " \
file://run-ptest \
--
2.17.1
^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [oe] [hardknott 0/6] Patch review April 24th
2021-04-24 10:11 [hardknott 0/6] Patch review April 24th Armin Kuster
` (5 preceding siblings ...)
2021-04-24 10:11 ` [hardknott 6/6] python3-cryptography: Upgrade to 3.3.2 Armin Kuster
@ 2021-04-24 10:36 ` Martin Jansa
2021-04-25 20:56 ` Armin Kuster
6 siblings, 1 reply; 11+ messages in thread
From: Martin Jansa @ 2021-04-24 10:36 UTC (permalink / raw)
To: Armin Kuster; +Cc: openembedded-devel
[-- Attachment #1: Type: text/plain, Size: 2737 bytes --]
Please take
https://git.openembedded.org/meta-openembedded/commit/?id=b5ad9c011db2581cc84e5daa139acf73a0f6f5c0
as well to fix
https://git.openembedded.org/meta-openembedded/commit/?h=hardknott&id=98a26903f770aa8698770817bdaf6175367917e1
merged in previous PR.
On Sat, Apr 24, 2021 at 3:12 AM Armin Kuster <akuster808@gmail.com> wrote:
> These have been sent to the list already so shorter review cycle.
> Please have feedback by Sunday.
>
> The following changes since commit
> 2297d4ee04b47bc574f8879732d9e213ab7bf685:
>
> wireguard: update to v1.0.20210219 +1 (2021-04-18 13:49:13 -0700)
>
> are available in the Git repository at:
>
> git://git.openembedded.org/meta-openembedded-contrib
> stable/hardknott-nut
>
> http://cgit.openembedded.org/meta-openembedded-contrib/log/?h=stable/hardknott-nut
>
> Chen Qi (2):
> tigervnc: upgrade to 1.11.0
> python3-django: upgrade to 2.2.20
>
> Mingli Yu (2):
> php: Upgrade to 7.4.16
> python3-cryptography: Upgrade to 3.3.2
>
> Stefan Ghinea (1):
> python3-django: fix CVE-2021-28658
>
> Ulrich Ölmann (1):
> v4l-utils: fix reproducibility
>
> .../php/php/CVE-2020-7069.patch | 158 ------------------
> .../php/php/CVE-2020-7070.patch | 24 ---
> .../php/{php_7.4.9.bb => php_7.4.16.bb} | 7 +-
> ...002-do-not-build-tests-sub-directory.patch | 21 +--
> ...vnc-add-fPIC-option-to-COMPILE_FLAGS.patch | 36 ++--
> ...{tigervnc_1.10.1.bb => tigervnc_1.11.0.bb} | 13 +-
> ...c-autodetect-availability-of-systemd.patch | 47 ++++++
> ...ct-installation-of-50-rc_keymap.conf.patch | 40 +++++
> .../v4l2apps/v4l-utils_1.20.0.bb | 11 +-
> ...3.3.1.bb => python3-cryptography_3.3.2.bb} | 2 +-
> ...ngo_2.2.16.bb => python3-django_2.2.20.bb} | 4 +-
> 11 files changed, 130 insertions(+), 233 deletions(-)
> delete mode 100644 meta-oe/recipes-devtools/php/php/CVE-2020-7069.patch
> delete mode 100644 meta-oe/recipes-devtools/php/php/CVE-2020-7070.patch
> rename meta-oe/recipes-devtools/php/{php_7.4.9.bb => php_7.4.16.bb} (97%)
> rename meta-oe/recipes-graphics/tigervnc/{tigervnc_1.10.1.bb =>
> tigervnc_1.11.0.bb} (89%)
> create mode 100644
> meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0008-configure.ac-autodetect-availability-of-systemd.patch
> create mode 100644
> meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0009-keytable-restrict-installation-of-50-rc_keymap.conf.patch
> rename meta-python/recipes-devtools/python/{python3-cryptography_3.3.1.bb
> => python3-cryptography_3.3.2.bb} (94%)
> rename meta-python/recipes-devtools/python/{python3-django_2.2.16.bb =>
> python3-django_2.2.20.bb} (41%)
>
> --
> 2.17.1
>
>
>
>
>
[-- Attachment #2: Type: text/html, Size: 4978 bytes --]
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [oe] [hardknott 0/6] Patch review April 24th
2021-04-24 10:36 ` [oe] [hardknott 0/6] Patch review April 24th Martin Jansa
@ 2021-04-25 20:56 ` Armin Kuster
2021-04-25 21:41 ` Martin Jansa
0 siblings, 1 reply; 11+ messages in thread
From: Armin Kuster @ 2021-04-25 20:56 UTC (permalink / raw)
To: Martin Jansa; +Cc: openembedded-devel
On 4/24/21 3:36 AM, Martin Jansa wrote:
> Please take
> https://git.openembedded.org/meta-openembedded/commit/?id=b5ad9c011db2581cc84e5daa139acf73a0f6f5c0
> as well to fix
> https://git.openembedded.org/meta-openembedded/commit/?h=hardknott&id=98a26903f770aa8698770817bdaf6175367917e1
> merged in previous PR.
Hardknott already has that commit. Was this meant for Gatesgarth?
-armin
>
> On Sat, Apr 24, 2021 at 3:12 AM Armin Kuster <akuster808@gmail.com
> <mailto:akuster808@gmail.com>> wrote:
>
> These have been sent to the list already so shorter review cycle.
> Please have feedback by Sunday.
>
> The following changes since commit
> 2297d4ee04b47bc574f8879732d9e213ab7bf685:
>
> wireguard: update to v1.0.20210219 +1 (2021-04-18 13:49:13 -0700)
>
> are available in the Git repository at:
>
> git://git.openembedded.org/meta-openembedded-contrib
> <http://git.openembedded.org/meta-openembedded-contrib>
> stable/hardknott-nut
>
> http://cgit.openembedded.org/meta-openembedded-contrib/log/?h=stable/hardknott-nut
>
> Chen Qi (2):
> tigervnc: upgrade to 1.11.0
> python3-django: upgrade to 2.2.20
>
> Mingli Yu (2):
> php: Upgrade to 7.4.16
> python3-cryptography: Upgrade to 3.3.2
>
> Stefan Ghinea (1):
> python3-django: fix CVE-2021-28658
>
> Ulrich Ölmann (1):
> v4l-utils: fix reproducibility
>
> .../php/php/CVE-2020-7069.patch | 158
> ------------------
> .../php/php/CVE-2020-7070.patch | 24 ---
> .../php/{php_7.4.9.bb <http://php_7.4.9.bb> => php_7.4.16.bb
> <http://php_7.4.16.bb>} | 7 +-
> ...002-do-not-build-tests-sub-directory.patch | 21 +--
> ...vnc-add-fPIC-option-to-COMPILE_FLAGS.patch | 36 ++--
> ...{tigervnc_1.10.1.bb <http://tigervnc_1.10.1.bb> =>
> tigervnc_1.11.0.bb <http://tigervnc_1.11.0.bb>} | 13 +-
> ...c-autodetect-availability-of-systemd.patch | 47 ++++++
> ...ct-installation-of-50-rc_keymap.conf.patch | 40 +++++
> .../v4l2apps/v4l-utils_1.20.0.bb <http://v4l-utils_1.20.0.bb>
> | 11 +-
> ...3.3.1.bb <http://3.3.1.bb> => python3-cryptography_3.3.2.bb
> <http://python3-cryptography_3.3.2.bb>} | 2 +-
> ...ngo_2.2.16.bb <http://ngo_2.2.16.bb> =>
> python3-django_2.2.20.bb <http://python3-django_2.2.20.bb>} | 4 +-
> 11 files changed, 130 insertions(+), 233 deletions(-)
> delete mode 100644
> meta-oe/recipes-devtools/php/php/CVE-2020-7069.patch
> delete mode 100644
> meta-oe/recipes-devtools/php/php/CVE-2020-7070.patch
> rename meta-oe/recipes-devtools/php/{php_7.4.9.bb
> <http://php_7.4.9.bb> => php_7.4.16.bb <http://php_7.4.16.bb>} (97%)
> rename meta-oe/recipes-graphics/tigervnc/{tigervnc_1.10.1.bb
> <http://tigervnc_1.10.1.bb> => tigervnc_1.11.0.bb
> <http://tigervnc_1.11.0.bb>} (89%)
> create mode 100644
> meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0008-configure.ac-autodetect-availability-of-systemd.patch
> create mode 100644
> meta-oe/recipes-multimedia/v4l2apps/v4l-utils/0009-keytable-restrict-installation-of-50-rc_keymap.conf.patch
> rename
> meta-python/recipes-devtools/python/{python3-cryptography_3.3.1.bb
> <http://python3-cryptography_3.3.1.bb> =>
> python3-cryptography_3.3.2.bb
> <http://python3-cryptography_3.3.2.bb>} (94%)
> rename
> meta-python/recipes-devtools/python/{python3-django_2.2.16.bb
> <http://python3-django_2.2.16.bb> => python3-django_2.2.20.bb
> <http://python3-django_2.2.20.bb>} (41%)
>
> --
> 2.17.1
>
>
>
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [oe] [hardknott 0/6] Patch review April 24th
2021-04-25 20:56 ` Armin Kuster
@ 2021-04-25 21:41 ` Martin Jansa
2021-04-25 22:34 ` Armin Kuster
0 siblings, 1 reply; 11+ messages in thread
From: Martin Jansa @ 2021-04-25 21:41 UTC (permalink / raw)
To: akuster808; +Cc: openembedded-devel
[-- Attachment #1: Type: text/plain, Size: 923 bytes --]
On Sun, Apr 25, 2021 at 1:56 PM akuster808 <akuster808@gmail.com> wrote:
>
>
> On 4/24/21 3:36 AM, Martin Jansa wrote:
> > Please take
> >
> https://git.openembedded.org/meta-openembedded/commit/?id=b5ad9c011db2581cc84e5daa139acf73a0f6f5c0
> > as well to fix
> >
> https://git.openembedded.org/meta-openembedded/commit/?h=hardknott&id=98a26903f770aa8698770817bdaf6175367917e1
> > merged in previous PR.
>
> Hardknott already has that commit. Was this meant for Gatesgarth?
>
I don't see b5ad9c011db2581cc84e5daa139acf73a0f6f5c0 in hardknott nor in
hardknott-next:
https://git.openembedded.org/meta-openembedded/log/?h=hardknott-next&qt=grep&q=tbb
And in master it's between the last 2 commits you did cherry-pick for
hardknott in this round, so I don't understand why this one was skipped.
It's not needed in gatesgarth, because the tbb upgrade which dropped in PE
wasn't merged to gatesgarth.
[-- Attachment #2: Type: text/html, Size: 1772 bytes --]
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [oe] [hardknott 0/6] Patch review April 24th
2021-04-25 21:41 ` Martin Jansa
@ 2021-04-25 22:34 ` Armin Kuster
0 siblings, 0 replies; 11+ messages in thread
From: Armin Kuster @ 2021-04-25 22:34 UTC (permalink / raw)
To: Martin Jansa; +Cc: openembedded-devel
On 4/25/21 2:41 PM, Martin Jansa wrote:
>
>
> On Sun, Apr 25, 2021 at 1:56 PM akuster808 <akuster808@gmail.com
> <mailto:akuster808@gmail.com>> wrote:
>
>
>
> On 4/24/21 3:36 AM, Martin Jansa wrote:
> > Please take
> >
> https://git.openembedded.org/meta-openembedded/commit/?id=b5ad9c011db2581cc84e5daa139acf73a0f6f5c0
> > as well to fix
> >
> https://git.openembedded.org/meta-openembedded/commit/?h=hardknott&id=98a26903f770aa8698770817bdaf6175367917e1
> > merged in previous PR.
>
> Hardknott already has that commit. Was this meant for Gatesgarth?
>
>
> I don't see b5ad9c011db2581cc84e5daa139acf73a0f6f5c0 in hardknott nor
> in hardknott-next:
> https://git.openembedded.org/meta-openembedded/log/?h=hardknott-next&qt=grep&q=tbb
>
> And in master it's between the last 2 commits you did cherry-pick for
> hardknott in this round, so I don't understand why this one was skipped.
All will right itself soon. I think its a timing issue.
see stable/hardknott-nut.
-armin
>
> It's not needed in gatesgarth, because the tbb upgrade which dropped
> in PE wasn't merged to gatesgarth.
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2021-04-25 22:34 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-24 10:11 [hardknott 0/6] Patch review April 24th Armin Kuster
2021-04-24 10:11 ` [hardknott 1/6] v4l-utils: fix reproducibility Armin Kuster
2021-04-24 10:11 ` [hardknott 2/6] python3-django: fix CVE-2021-28658 Armin Kuster
2021-04-24 10:11 ` [hardknott 3/6] tigervnc: upgrade to 1.11.0 Armin Kuster
2021-04-24 10:11 ` [hardknott 4/6] python3-django: upgrade to 2.2.20 Armin Kuster
2021-04-24 10:11 ` [hardknott 5/6] php: Upgrade to 7.4.16 Armin Kuster
2021-04-24 10:11 ` [hardknott 6/6] python3-cryptography: Upgrade to 3.3.2 Armin Kuster
2021-04-24 10:36 ` [oe] [hardknott 0/6] Patch review April 24th Martin Jansa
2021-04-25 20:56 ` Armin Kuster
2021-04-25 21:41 ` Martin Jansa
2021-04-25 22:34 ` Armin Kuster
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.