Commit Graph

2775 Commits

Author SHA1 Message Date
Jan Hak
b4016afdd2 libedit: update to version 20210522-3.1
Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit 0b8f3ea81a)
2022-09-07 14:23:27 +02:00
Jan Hak
5ad19e5a40 libedit: update to version 20210419-3.1
Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit b0870d792b)
2022-09-07 14:23:22 +02:00
Michael Heimpold
5a399f1448 cyrus-sasl: install pkg-config file and fine-tune installed files
Installing the .pc files helps other programs to detect
the presence of libsasl2.

While at, reduce the glob pattern a little bit to not
include unneeded symlinks.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit c9ce769b1a)
2022-07-18 14:41:32 +02:00
Petr Štetiar
0bab8ae2a7 libarchive: fix ext2fs build race error condition
libarchive looks for ext2fs headers during configure, and if it finds
them it will expect to find them during compile, or on the rare occasion
when they aren't it will fail:

 libarchive/archive_entry.c:59:55: fatal error: ext2fs/ext2_fs.h: No such file or directory

As we just need headers for some type constants, let's re-use headers
from tools/e2fsprogs package which are always available.

Reported-by: Adam Dov <adov@maxlinear.com>
Suggested-by: Paul Eggleton <paul.eggleton@linux.intel.com>
References: https://git.yoctoproject.org/poky/commit/?id=f0b9a7cf9f80be1917e45266fa201f464a28c1e5
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 797945dfaa)
2022-07-13 08:47:54 +02:00
Michal Vasilek
90ff2ed162 libgd: install pkgconfig file
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
2022-06-23 12:35:30 -06:00
W. Michael Petullo
f08dae84f8 openldap: drop use of HTTP in favor of HTTPS
Signed-off-by: W. Michael Petullo <mike@flyn.org>
(cherry picked from commit bab2f020ee)
2022-06-10 13:56:56 +02:00
Michael Heimpold
1ad2e67d4c libxml2: update to 2.9.14
This fixes CVE-2022-29824.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit c12e1cfcab)
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
2022-06-02 15:27:28 +02:00
Michael Heimpold
0da04ff0b7 libxml2: update to 2.9.13
This fixes CVE-2022-23308.

Also switch to GNOME as download source and xz tarball.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 81fd836f97)
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
2022-06-02 15:27:22 +02:00
Michael Heimpold
a3557e5362 libxml2: update to 2.9.12
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 6b932d3ff7)
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
2022-06-02 15:26:05 +02:00
Michael Heimpold
a23bfc9774 libxml2: update to 2.9.10
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 10e867d026)
[remove no longer needed CVE-2019-19956 patch (fixed in libxml2 2.9.10)]
Signed-off-by: Šimon Bořek <simon.borek@nic.cz>
2022-06-02 15:12:45 +02:00
Daniel Golle
6dbc752fdd db47: don't depend on libxml2 at run-time
libxml2 seems to be required only during build, hence no need to
depend on it in run-time.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 1f3585a387)
2022-06-02 14:44:29 +02:00
Michal Vasilek
58a5dd8fd7 postgresql: security update to 11.16
* fixes CVE-2022-1552

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
2022-05-14 21:34:11 -07:00
Michal Vasilek
79db9a8e24 expat: import patches for CVEs
* import patches for CVEs from alpine 3.13

CVE-2021-45960, CVE-2021-46143, CVE-2022-22822, CVE-2022-23852, CVE-2022-23990
CVE-2022-25235, CVE-2022-25236, CVE-2022-25313, CVE-2022-25314, CVE-2022-25315

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 584c0c4378)
2022-02-24 15:09:35 +01:00
Rosen Penev
448eb6e4b9 expat: update to 2.2.10
Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit c69160e6ae)
2022-02-24 15:09:18 +01:00
Josef Schlehofer
b61f1d4850 Merge pull request #17756 from BKPepe/nss-cve-2021-43527
nss: backport patch for CVE-2021-43527
2022-02-02 18:23:45 +01:00
Josef Schlehofer
864ffb6ca1 nss: backport patch for CVE-2021-43527
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2022-01-31 11:50:25 +01:00
Josef Schlehofer
0e3869c2ad Merge pull request #17476 from BKPepe/buildonly
treewide: add missing BUILDONLY
2022-01-03 19:58:33 +01:00
Rosen Penev
f299c29a45 treewide: add missing BUILDONLY
Fixes Makefile warnings:

WARNING: skipping X -- package has no install section

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 5a7148d112)
2022-01-02 10:02:23 +01:00
Petr Štetiar
7db6f87334 Merge pull request #17250 from ynezz/ynezz/cares-fix-CVE-2021-3672
[19.07] libs/c-ares: fix domain hijacking CVE-2021-3672
2021-12-12 12:11:24 +01:00
Daniel Golle
a135aedaf1 Merge pull request #17267 from BKPepe/postgresql-update
[19.07] postgresql: security update to version 11.14
2021-12-12 11:06:51 +00:00
Josef Schlehofer
535f4804b6 postgresql: security update to version 11.14
Patch 001-configure_fixes does not apply anymore.
Other patches were refreshed.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2021-12-04 01:04:48 +01:00
Petr Štetiar
e93fc5a20f libs/c-ares: fix domain hijacking CVE-2021-3672
Missing input validation of host names returned by Domain Name Servers
in the c-ares library can lead to output of wrong hostnames (leading to
Domain Hijacking).

I've just taken patch from the advisory[1] and rebased it onto 1.15.0
version.

1. 809d5e8..44c009b.patch

Fixes: CVE-2021-3672
Signed-off-by: Petr Štetiar <ynezz@true.cz>
2021-12-02 13:54:42 +01:00
Hirokazu MORIKAWA
1d5b64958b icu: Fix memory bug w/ baseName
CVE-2021-30535 : Double free in ICU
https://nvd.nist.gov/vuln/detail/CVE-2021-30535
https://security-tracker.debian.org/tracker/CVE-2021-30535

ICU-21587 : Fix memory bug w/ baseName
https://github.com/unicode-org/icu/pull/1698

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
2021-11-29 01:42:37 -08:00
Michal Vasilek
af8fe2363d cyrus-sasl: patch CVE-2019-19906
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit f7717bd382)
2021-11-13 16:11:23 +01:00
Michal Vasilek
72d806d181 apr: patch CVE-2021-35940
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
(cherry picked from commit 0777e40b74)
2021-08-25 06:06:48 +02:00
Rosen Penev
844cde96b8 Merge pull request #16444 from paper42/postgresql-fix-hardening
[19.07] postgresql: disable PIC
2021-08-24 19:04:13 -07:00
Michal Vasilek
4b091361ef postgresql: disable PIC
with PIC enabled, build fails with
ld: access/gist/gistproc.o: in function `rtree_internal_consistent':
gistproc.c:(.text+0x188): relocation truncated to fit: R_AARCH64_LD64_GOTPAGE_LO15 against symbol `DirectFunctionCall2Coll' defined in .text section in utils/fmgr/fmgr.o
ld: gistproc.c:(.text+0x188): warning: too many GOT entries for -fpic, please recompile with -fPIC
ld: final link failed: symbol needs debug section which does not exist
collect2: error: ld returned 1 exit status

Related-to: 8e9ad7bb51
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
2021-08-24 12:48:19 +02:00
Michal Vasilek
0573fb59ab file: update to 5.38
* fixes CVE-2019-18218

Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
2021-08-23 12:25:13 +02:00
Eneas U de Queiroz
865ae46492 unixodbc: use 'install' when copying host binaries
'cp' fails with a text file busy error if it tries to overwrite an
executable file that is running.  'install' unlinks the file first, so
it will not cause the problem.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit 47f98d7030)
2021-08-14 13:45:53 -07:00
Rosen Penev
0872827d2d librouteros: don't build docs
Fixes compilation without host pod2man.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit e41fd1794b)
2021-07-25 22:19:29 +03:00
Rosen Penev
d617e7b143 Merge pull request #16062 from miska/snort3
snort3: Backport update to the stable version
2021-07-14 19:23:31 -07:00
Hirokazu MORIKAWA
c0e93ddff3 libuv: fix CVE-2021-22918
idna: fix OOB read in punycode decoder

libuv was vulnerable to out-of-bounds reads in the uv__idna_toascii()
function which is used to convert strings to ASCII. This is called by
the DNS resolution function and can lead to information disclosures or
crashes.

libuv/libuv@b7466e3
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990561
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
2021-07-12 15:13:13 +09:00
Josef Schlehofer
dd32c2cbee czmq: disable nss
While bumping czmq to version 4.2.1 from master branch into OpenWrt
19.07, it automatically detects nss when compiled before czmq.

These steps can verify this:

make package/nss/compile V=s
make package/czmq/compile V=s

Then czmq requires many dependencies:
Package czmq is missing dependencies for the following libraries:
libnspr4.so
libnss3.so
libnssutil3.so
libplc4.so
libplds4.so
libsmime3.so
libsoftokn3.so
libssl3.so

And this fails. If you are using SDK and wants to have just a few
packages then czmq gets compiled if any of those packages are not
present in build system.

This was also mentioned in the release notes for czmq 4.2.1:
https://github.com/zeromq/czmq/releases/tag/v4.2.1

> Note for packagers: NSS can now be used and linked against to avoid using
an internal embedded reimplementation of SHA. It is enabled by default if
present.

NSS was disabled before, so let's disable it.

This is required only for OpenWrt 19.07 as this is done differently in OpenWrt 21.02 and OpenWrt
master and czmq is compiled there.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2021-07-11 19:48:56 +02:00
Jan Pavlinec
a16402770c czmq: update to version 4.2.1
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry picked from commit 39b4c64545)
2021-07-10 23:08:20 +02:00
Michal Hrusecky
5d189c1013 libdaq3: New package, dependency of snort3
Backport from 21.02 in order to satisfy dependencies of snort3 to allow
upgrade to stable version of snort3 from beta available now.

Signed-off-by: Michal Hrusecky <michal.hrusecky@turris.com>
2021-07-07 12:36:20 +02:00
David Bauer
73c0984779 xr_usb_serial_common: add PKG_MIRROR_HASH
The CI complained about a missing PKG_MIRROR_HASH.

Signed-off-by: David Bauer <mail@david-bauer.net>
2021-06-08 17:18:02 +02:00
David Bauer
7100f40063 xr_usb_serial_common: fix build
Building the xr_usb_serial module fails for recent 4.14 kernel with
CONFIG_PM enabled:

xr_usb_serial_common.c:1574:15: error: 'ASYNCB_INITIALIZED' undeclared
(first use in this function); did you mean 'RCU_INITIALIZER'?

Use tty_port_initialized in order to determine the status of the TTY
port.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 69cf7836df)
2021-06-08 17:11:41 +02:00
Dylan Corrales
bdbf33f697 libnet: Export libnet-config in development enviornments
Affects `libnet-1.2.x`

Signed-off-by: Dylan Corrales <deathcamel58@gmail.com>
2021-06-03 15:20:44 -04:00
Nikos Mavrogiannopoulos
7436ea3fb1 Merge pull request #15252 from ja-pa/gnutls-security-fix-19.07
[OpenWrt 19.07] gnutls: patch security issue
2021-03-26 21:55:20 +01:00
Giovanni Giacobbi
7af60cc3e2 libftdi1: Improve build binary reproducibility
The library embeds the result of "git describe" inside the source code, making the binary result dependent of the particular commit being used in the build root when building inside a git working copy.

As this is unnecessary information, remove this option and fallback to the default "unknown", which is also the value compiled by tools that do not clone but export the openwrt base tree.

Signed-off-by: Giovanni Giacobbi <giovanni@giacobbi.net>
2021-03-26 10:48:39 +00:00
Jan Pavlinec
cb6509e882 gnutls: patch security issue
Fixes
CVE-2021-20231
CVE-2021-20232

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
2021-03-25 10:34:58 +01:00
Hirokazu MORIKAWA
13ab7af3f0 icu: update to 68.2
Maintainer: me
Compile tested: head r15324-920b692, aarch64, x86_64
Run tested: (qemu-5.2.0) aarch64

Description:
Update to 68.2

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit d6317132dd)
2021-03-22 00:31:59 +01:00
Hirokazu MORIKAWA
2120a3cf51 icu: update to 68.1
It updates to CLDR 38. New features including locale-dependent smart unit preferences (road distance, temperature, etc.) and locale ID canonicalization conformant with CLDR.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 4f3a8c1535)
2021-03-22 00:31:51 +01:00
Rosen Penev
10712797f0 icu: fix compilation under CentOS 7
CentOS 7's GCC is quite old and does not put max_align_t under std.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 6255a77128)
2021-03-22 00:31:43 +01:00
Hirokazu MORIKAWA
79ddd03288 icu: update to 67.1
Unicode 13 & CLDR 37. Bug fixes for date and number formatting, enhanced support for user preferences in the locale identifier. LocaleMatcher code and data improved. Number skeletons have a new “concise” form that can be used in MessageFormat strings.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit e3be3aadc1)
2021-03-22 00:31:34 +01:00
Tianling Shen
01ab015a9a msgpack-c: add new package
This is needed by tmate.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit cfc965b107)
2021-03-18 23:22:48 -10:00
Rosen Penev
5c58de5e63 libpam: update to 1.5.1
Fix installed paths. After e52d0487e88c3c8c57e1310d1a02b18eae0d142e
upstream, this bug was exposed.

Instead of working around it, fix the patch.

After this, everything consistently gets installed to ipkg-install/usr.

Minor Makefile reorganization.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit b75f250f3b)
2021-03-07 13:55:07 +01:00
Rosen Penev
86a70892d8 libpam: update to 1.5.0
Fixes CVE-2020-27780

Removed upstreamed patches.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 0f317e9fbd)
2021-03-07 13:54:58 +01:00
Rosen Penev
ef17e4a30c libpam: update to 1.4.0
Remove upstreamed patch and add a new one to fix compilation.

Add some more configure options.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit a05db1acfe)
2021-03-07 13:54:46 +01:00
Jan Hak
7d9d8616cf libedit: update to version 20210216-3.1
Signed-off-by: Jan Hak <jan.hak@nic.cz>
(cherry picked from commit fd7f43ae46)
2021-02-24 10:20:48 +01:00