CVE-2017-6508: CRLF injection vulnerability in the url_parse function in
url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary
HTTP headers via CRLF sequences in the host subcomponent of a URL.
External References:
https://nvd.nist.gov/vuln/detail/CVE-2017-6508
Patch from:
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=4d729e322fae359a1aefaafec1144764a54e8ad4
(From OE-Core rev: 28404157e07a915d1445166df566c8838f2cce57)
(From OE-Core rev: 03fbdba18b767be95c5fa13d72b52c16f8a77b52)
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Replace some "+=/=+" with "=" when setting BBCLASSEXTEND, they are
redundant and inconsistent with the same setting in other recipes.
(From OE-Core rev: 09266d6c91acd8ba4df6e8242aa44d9ba41e9cee)
Signed-off-by: Ming Liu <peter.x.liu@external.atlascopco.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: b74b8fe61f3cf619133b7fbdd1db80e5c67d0878)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add PACKAGECONFIG for ipv6 and control it based
on DISTRO_FEATURES instead of unconditionally enabled.
(From OE-Core rev: ab699155f2fa6f19b4020e7d1c2097e867d9e977)
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: eccd082d5bb2ddfab3b87c3f0ff08a6877d12f10)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed:
aclocal: error: cannot open [snip] |: Argument list too long
Set acpaths to fix the problem.
(From OE-Core rev: 2114b5a9a70bb07bdb15edafa6ec9689933db871)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Remove fix_makefile.patch, it is already in the source.
(From OE-Core rev: f2a4a5e7e237fd0a3ab13a16f2674c41e1a3c853)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fix a variety of problems such as typos, bad punctuations, or incorrect
Upstream-Status values.
(From OE-Core rev: bd220fe6ce8c3a0805f13a14706d3130ea872604)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is same gnulib fix replicated across needed recipes
Change-Id: I756713407111a726eae98e26c9c1ff64981371c0
(From OE-Core rev: fbe6d2c12aa9f7956bc87efeb68cb64b26b60c7a)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 9b2e9a08f3e77b1df604f3d283cac91e7ff7c602)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update fix_makefile.patch:
* The patch for po/Makefile.in.in is not needed any more since fixed.
* Update the patch for configure.ac
(From OE-Core rev: 2cc2ea51c131f75739470cb8384d931a525bb627)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed:
WARNING: QA Issue: wget rdepends on util-linux-libuuid, but it isn't a build dependency? [build-deps]
(From OE-Core rev: 079c9cee02f8e7c79c76997db55cc26d8d70ff95)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Among other things, fixes CVE-2014-4877:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4877
(From OE-Core rev: de31ee56e07fea9e3f8ae2f71c69ab5e9c48836f)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
OpenSSL has license complications and GnuTLS is preferred, so although the
license complications don't impact wget use GnuTLS for consistency.
Also add a recommendation on ca-certificates so that https: URLs work.
(From OE-Core rev: 4c9c737c1b93663a18e625918f32dfc2d4f9ca2f)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The class itself currently does nothing. The idea is to mark all recipes that
make use of the texinfo utilities. In the future, this class could be used to
suppress the generation/formatting of documentation for performance,
explicitly track dependencies on these utilities, and eliminate Yocto's
current dependency on the host system's texinfo utilities.
(From OE-Core rev: e6fb2f9afe2ba6b676c46d1eb297ca9cc532d405)
Signed-off-by: Max Eliaser <max.eliaser@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Completes previous commit b5292d4115a4555a66b5e35acdc67dd71fb8577f.
Updates SUMMARY[doc] (meta/conf/documentation.conf).
Changes:
- rename DESCRIPTION with length < 80 to (non present tag) SUMMARY
- drop final point character at the end of SUMMARY string
- remove trailing whitespace of SUMMARY line
Note: don't bump PR
(From OE-Core rev: ad17dfd31a2b97b3e610a0ea0889f5ecb2a63b97)
Signed-off-by: Matthieu Crapet <Matthieu.Crapet@ingenico.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
A lot of our recipes had short one-line DESCRIPTION values and no
SUMMARY value set. In this case it's much better to just set SUMMARY
since DESCRIPTION is defaulted from SUMMARY anyway and then the SUMMARY
is at least useful. I also took the opportunity to fix up a lot of the
new SUMMARY values, making them concisely explain the function of the
recipe / package where possible.
(From OE-Core rev: b8feee3cf21f70ba4ec3b822d2f596d4fc02a292)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Remove the --with-libc, I can't find anything about this option from
wget's log history.
(From OE-Core rev: 4751b3d4c5002759ba8f574167a6c321ff9042d6)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The po.m4 file is deleted by the more recent autotools.bbclass
autotools_do_configure code which handles gettext. There is therefore
no point in patching the file anymore.
(From OE-Core rev: 986c660cdb34e23a9c72f219db9363a6b4e4b7ec)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This will ensure a consistent build and not add additional dependency of
util-linux to wget
(From OE-Core rev: 919e4335c5f907fde4b46eb0cd421fbd360ddbae)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is a build issue with wget idn support. When libidn has been
populated to sysroot but rpm packages are not created, wget checks libidn
support automatically and then depends on libidn. But package libidn
doesn't exist, build image which includes wget will fail with:
| error: Failed dependencies:
| libidn.so.11 is needed by wget-1.13.4-r14.3.core2
| libidn.so.11(LIBIDN_1.0) is needed by wget-1.13.4-r14.3.core2
Disable iri/idn support to fix it.
Signer-off-by: Kang Kai <kai.kang@windriver.com>
(From OE-Core rev: 48a11f8dc9f70cfc205f558b4dc959c8b4d5e0cd)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
remove-gets.patch: removed
- included in the new version
(From OE-Core rev: 396af9e2c8a8b7ad8d49566350d79f05898734a7)
Signed-off-by: Constantin Musca <constantinx.musca@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The patch in this recipe patches both configure and configure.in which leads
to build failures once configure has executed and regenerated configure.
The fix to make patch re-executable is not to patch configure and
only patch configure.in.
[YOCTO #2194]
(From OE-Core rev: b3df34ba57284fa2c85f34be86d5d8e357becf7c)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
On my x86-64 Ubuntu 11.04, with MACHINE=qemux86, "bitbake wget" fails. The
config.log shows:
configure:30072: i586-poky-linux-gcc -m32 -march=i586
--sysroot=/distro/dcui/1212/p1/build/tmp/sysroots/qemux86 -o conftest -O2
-pipe -g -feliminate-unused-debug-types -Wl,-O1 -Wl,--hash-style=gnu
-Wl,--as-needed conftest.c -ldl -lz /usr/lib/libssl.so /usr/lib/libcrypto.so
-lz >&5
/usr/lib/libssl.so: could not read symbols: File in wrong format
The patch fixes the issue by specifying libssl-prefix.
(From OE-Core rev: 5f9851f609f503aec098778ef59c27e5f5dd9579)
Signed-off-by: Dexuan Cui <dexuan.cui@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* remove gnutls.bzr patch as it was in upstream
(From OE-Core rev: 32dc588820006a6c5f86c4b4da8dab09c8b49f73)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Needed to support building oe-core with oe-core
(From OE-Core rev: 017595a81acff23290894cf3e3e60f7fc88510f9)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Yi Zhao
Ming Liu
Peter Kjellerstedt
Richard Purdie
Robert Yang
Jackie Huang
Fan Xin
Ross Burton
Khem Raj
Paul Eggleton
Koen Kooi
Tudor Florea
Max Eliaser
Matthieu Crapet
Martin Jansa
Saul Wold
Jonathan Liu
Hongxu Jia
Kang Kai
Constantin Musca
Mark Hatle
Dexuan Cui