1. 17 Feb, 2021 7 commits
    • Peter Korsgaard's avatar
      docs/website: update for 2020.02.11 · d8447af9
      Peter Korsgaard authored
      Signed-off-by: default avatarPeter Korsgaard <peter@korsgaard.com>
      d8447af9
    • Peter Korsgaard's avatar
      Update for 2020.02.11 · 947e9219
      Peter Korsgaard authored
      Signed-off-by: default avatarPeter Korsgaard <peter@korsgaard.com>
      (cherry picked from commit 08e03785d3812c085c438a6040ccedc3e9f5809d)
      [Peter: drop Makefile changes]
      Signed-off-by: default avatarPeter Korsgaard <peter@korsgaard.com>
      947e9219
    • Peter Korsgaard's avatar
      docs/website: update for 2020.11.3 · b284c1a4
      Peter Korsgaard authored
      Signed-off-by: default avatarPeter Korsgaard <peter@korsgaard.com>
      b284c1a4
    • Peter Korsgaard's avatar
      Update for 2020.11.3 · ecbfbabc
      Peter Korsgaard authored
      Signed-off-by: default avatarPeter Korsgaard <peter@korsgaard.com>
      (cherry picked from commit 610e67b1fc4ac44e0c4a7ba437c917ad6d63f481)
      [Peter: drop Makefile changes]
      Signed-off-by: default avatarPeter Korsgaard <peter@korsgaard.com>
      ecbfbabc
    • Peter Korsgaard's avatar
      Update for 2021.02-rc2 · 21eb7775
      Peter Korsgaard authored
      Signed-off-by: default avatarPeter Korsgaard <peter@korsgaard.com>
      21eb7775
    • Fabrice Fontaine's avatar
      package/perl-extutils-pkgconfig: set PATH to BR_PATH · 91b39d03
      Fabrice Fontaine authored
      Set PATH to BR_PATH to allow perl-extutils-pkgconfig to find pkg-config
      binary
      
      Fixes:
       - http://autobuild.buildroot.org/results/d87787fbf2a8cb9bbaa3b59d1e8004ad1459536aSigned-off-by: default avatarFabrice Fontaine <fontaine.fabrice@gmail.com>
      Signed-off-by: default avatarPeter Korsgaard <peter@korsgaard.com>
      91b39d03
    • Peter Korsgaard's avatar
      package/libopenssl: security bump to version 1.1.1j · 4745a484
      Peter Korsgaard authored
      Fixes the following security issues:
      
      - CVE-2021-23841: Null pointer deref in X509_issuer_and_serial_hash()
      
        The OpenSSL public API function X509_issuer_and_serial_hash() attempts to
        create a unique hash value based on the issuer and serial number data
        contained within an X509 certificate.  However it fails to correctly
        handle any errors that may occur while parsing the issuer field (which
        might occur if the issuer field is maliciously constructed).  This may
        subsequently result in a NULL pointer deref and a crash leading to a
        potential denial of service attack.
      
        The function X509_issuer_and_serial_hash() is never directly called by
        OpenSSL itself so applications are only vulnerable if they use this
        function directly and they use it on certificates that may have been
        obtained from untrusted sources.
      
      - CVE-2021-23839: Incorrect SSLv2 rollback protection
      
        OpenSSL 1.0.2 supports SSLv2.  If a client attempts to negotiate SSLv2
        with a server that is configured to support both SSLv2 and more recent SSL
        and TLS versions then a check is made for a version rollback attack when
        unpadding an RSA signature.  Clients that support SSL or TLS versions
        greater than SSLv2 are supposed to use a special form of padding.  A
        server that supports greater than SSLv2 is supposed to reject connection
        attempts from a client where this special form of padding is present,
        because this indicates that a version rollback has occurred (i.e.  both
        client and server support greater than SSLv2, and yet this is the version
        that is being requested).
      
        The implementation of this padding check inverted the logic so that the
        connection attempt is accepted if the padding is present, and rejected if
        it is absent.  This means that such as server will accept a connection if
        a version rollback attack has occurred.  Further the server will
        erroneously reject a connection if a normal SSLv2 connection attempt is
        made.
      
        OpenSSL 1.1.1 does not have SSLv2 support and therefore is not vulnerable
        to this issue.  The underlying error is in the implementation of the
        RSA_padding_check_SSLv23() function.  This also affects the
        RSA_SSLV23_PADDING padding mode used by various other functions.  Although
        1.1.1 does not support SSLv2 the RSA_padding_check_SSLv23() function still
        exists, as does the RSA_SSLV23_PADDING padding mode.  Applications that
        directly call that function or use that padding mode will encounter this
        issue.  However since there is no support for the SSLv2 protocol in 1.1.1
        this is considered a bug and not a security issue in that version.
      
      - CVE-2021-23840: Integer overflow in CipherUpdate
      
        Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may
        overflow the output length argument in some cases where the input length
        is close to the maximum permissable length for an integer on the platform.
        In such cases the return value from the function call will be 1
        (indicating success), but the output length value will be negative.  This
        could cause applications to behave incorrectly or crash.
      
      For more details, see the advisory:
      https://www.openssl.org/news/secadv/20210216.txtSigned-off-by: default avatarPeter Korsgaard <peter@korsgaard.com>
      4745a484
  2. 16 Feb, 2021 28 commits
  3. 15 Feb, 2021 4 commits
  4. 14 Feb, 2021 1 commit
    • Thomas Petazzoni's avatar
      support/scripts/cpedb.py: drop CPE XML database caching · 09a71e6a
      Thomas Petazzoni authored
      Currently, the CPE XML database is parsed into a Python dict, which is
      then pickled into a local file, to speed up the processing of further
      invocations.
      
      However, it turns out that since the initial implementation, we have
      switched the XML parsing from the out of tree xmltodict module to the
      standard ElementTree one, which has made the parsing much faster. The
      pickle caching only saves 6 seconds, on something that takes more than
      13 minutes total.
      
      In addition, this pickle caching consumes a significant amount of RAM,
      causing the Python process to be OOM-killed on a server with 4 GB of
      RAM.
      
      So let's just drop this caching entirely.
      Signed-off-by: default avatarThomas Petazzoni <thomas.petazzoni@bootlin.com>
      Signed-off-by: default avatarYann E. MORIN <yann.morin.1998@free.fr>
      09a71e6a