Django 5.0.7 fixes the following CVEs:
* CVE-2024-38875: Potential denial-of-service vulnerability in django.utils.html.urlize()
* CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords
* CVE-2024-39330: Potential directory-traversal via Storage.save()
* CVE-2024-39614: Potential denial-of-service vulnerability in get_supported_language_variant()
Django 5.0.8 fixes the following CVEs:
* CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat()
* CVE-2024-41990: Potential denial-of-service vulnerability in django.utils.html.urlize()
* CVE-2024-41991: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget
* CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()
Further release Notes: https://docs.djangoproject.com/en/5.0/releases/
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f777ce1fd6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit 9696d27756 "package/gpsd: condition python stuff to the proper
kconfig option" changed the condition in which the gpsd python scripts
are installed. After that change, the "gpsfake" command (which is a
python script) is no longer found and the runtime test is failing.
This commit fixes the issue by reflecting the change in the runtime
test Buildroot configuration.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b6f4d79df2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This didn't work out as planned, neither the restriction of muting
unregistered users, nor the exception for matrix users worked as planned.
The channel mode has been reverted to +R (meaning only registered users
are allowed to join) and an exception for *that* has been introduced for
matrix users via +e. The channel modes are documented in [1].
[1] https://www.oftc.net/ChannelModes/
This reverts commit d1e6d7845b.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit bede54c774)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Building with GCC 14 fails at the configure step with:
./configure: error: libatomic_ops library was not found.
The error is not caused by a missing library, but by an unrelated
"incompatible pointer type" error in the test program:
...
checking for atomic_ops library
objs/autotest.c: In function 'main':
objs/autotest.c:9:48: error: passing argument 1 of 'AO_compare_and_swap' from incompatible pointer type [-Wincompatible-pointer-types]
This used to be a warning, but it is an error since GCC 14.[1]
Fix this by patching the test program in order to use the correct
pointer types.
Fixes: http://autobuild.buildroot.net/results/a3d/a3d8c6fd631b31e272e4d8cc6c3318f2e4151882
[1] https://gcc.gnu.org/gcc-14/porting_to.html#incompatible-pointer-types
Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 7d249dab51)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The mysql virtual package was removed in commit 8708f3a23a
"package/mysql: drop virtual package".
The mariadb runtime test was authored before this mysql virtual
package removal, but was merged after it, in commit 5356754d1e
"support/testing: add mariadb runtime test". Due to this, this test
always failed with the error:
Makefile.legacy:9: *** "You have legacy configuration in your .config! Please check your configuration.". Stop.
This commit fixes the issue by removing the legacy
BR2_PACKAGE_MYSQL=y configuration directive.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/7540345406
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3da3361a1b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Maeva told me personally she will no longer contribute to Buildroot
for the time being. This commit removes all the associated DEVELOPERS
entries.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 92d652df48)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Currently, we have a Kconfig symbol to enable the python support in
gpsd, but the condition at configure time is based on whether the python
package is enabled. So, if a user does not enable python support in
gpsd, they still get it.
Switch to using the proper symbol.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Jan Havran <havran.jan@email.cz>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9696d27756)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Pass USE_LIBDRM=OFF to the wpewebkit CMake configuration step when the
libdrm package has not been selected.
WPE WebKit can be built without libdrm support, and it will still work
with backends that use other platform-specific methods to handle
graphics buffers and/or presenting content onto an output. For example
this is the case with wpebackend-rdk configured to use rpi-userland,
which uses dispmanx to produce the output instead of DRM/KMS.
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 65f8174648)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
mdio-tools depends on CONFIG_MDIO_DEVICE in order for mdiobus driver to
be built, but CONFIG_MDIO_DEVICE depends on CONFIG_NETDEVICES which we
are not enabling so on platforms without it enabled in kernel config
building mdio-tools will fail with:
ERROR: modpost: "mdio_find_bus" [output-1/build/mdio-tools-1.3.1/kernel/mdio-netlink.ko] undefined!
ERROR: modpost: "__mdiobus_c45_read" [output-1/build/mdio-tools-1.3.1/kernel/mdio-netlink.ko] undefined!
ERROR: modpost: "__mdiobus_read" [output-1/build/mdio-tools-1.3.1/kernel/mdio-netlink.ko] undefined!
ERROR: modpost: "__mdiobus_c45_write" [output-1/build/mdio-tools-1.3.1/kernel/mdio-netlink.ko] undefined!
ERROR: modpost: "__mdiobus_write" [output-1/build/mdio-tools-1.3.1/kernel/mdio-netlink.ko] undefined!
So enable CONFIG_NETDEVICES as well to make sure CONFIG_MDIO_DEVICE can be enabled.
Fixes: http://autobuild.buildroot.net/results/edf47df96cde6094c890c0b74034cced90335a39/
Signed-off-by: Robert Marko <robimarko@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b95fff0185)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
On the architectures that supports libsanitizer (part of gcc), the
build is currently failing with BR2_TIME_BITS_64=y. This is because
some code in libsanitizer unsets _FILE_OFFSET_BITS, but building code
with _FILE_OFFSET_BITS unset, but _TIME_BITS set isn't legal.
To fix this, this commit backports two changes:
- One change to also unset _TIME_BITS in
sanitizer_platform_limits_posix.cpp. This change is upstream in
LLVM, and already part of GCC 14.x, so we only bringing it to GCC
12.x and GCC 13.x.
- A second change doing the same modification, but in
sanitizer_procmaps_solaris.cpp, which as crazy as it might sound,
also gets compiled on Linux platforms (but to basically an empty
file). This change has been submitted upstream to both LLVM and gcc.
Notes:
- the special PowerPC SPE version of GCC cannot be affected, as only
uClibc-ng is used for this architecture, and uClibc-ng doesn't use
_TIME_BITS=64 (but now default to 64-bit time_t on 32-bit
architectures, like musl does).
- the special ARC version doesn't need patching because libsanitizer
doesn't support the ARC architecture, so it doesn't get built
Fixes:
http://autobuild.buildroot.net/results/ff2dbfdabf0bb6a0d82ea8a80122ab97fd75bd3f/https://gitlab.com/buildroot.org/buildroot/-/issues/16
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 81a4b6e7b8)
[Peter: drop 14.1.0 patch]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The kconfig infra defines a 'PKG_KCONFIG_MAKE' var that wraps all the
standard kconfig options. Switch to this so we aren't duplicating the
logic.
Signed-off-by: Brandon Maier <brandon.maier@collins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 009d31b438)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The 'linux-diff-config' target fails with the below error when
PER_PACKAGE_DIRECTORIES is enabled and the 'host-finalize' target hasn't
run yet.
scripts/Kconfig.include:39: C compiler '.../buildroot/output/host/bin/arm-buildroot-linux-gnueabihf-gcc' not found
The 'PPD' variable isn't defined for this target, so 'BR_PATH' falls
back to the final host directory.
Signed-off-by: Brandon Maier <brandon.maier@collins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 641084bfb3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The 'linux-savedefconfig' target fails with the below error when
PER_PACKAGE_DIRECTORIES is enabled and the 'host-finalize' target hasn't
run yet.
scripts/Kconfig.include:39: C compiler '.../buildroot/output/host/bin/arm-buildroot-linux-gnueabihf-gcc' not found
The 'PPD' variable isn't defined for this target, so 'BR_PATH' falls
back to the final host directory.
Reported-by: Nathaniel Roach <nroach44@gmail.com>
Signed-off-by: Brandon Maier <brandon.maier@collins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit de11afaa34)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Runtime tests running on test runners are subject to a high
variability in term of performance and timing. Most or the runtime
test commands are executed with a timeout, in pexpect.
Slow or very loaded test runners can use the timeout_multiplier to
globally increase those timeouts.
Some runtime test commands sometimes needs to poll or query a state,
rather than having purely sequential actions. It is sometimes hard to
know, from the test writer point of view, the maximum timeout to set, or
if a retry logic is needed.
In order to help debugging runtime tests failing due very slow
execution, this commit adds extra information on the host test runner
about its load in the run log. Relevant information are: number of
cpus, the load average at the moment the emulator is started and the
current timeout_multiplier.
Note: this change was discussed in:
https://lists.buildroot.org/pipermail/buildroot/2024-July/759119.html
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7a6edbc7b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The libpwquality package provides the pam_pwquality PAM module - the
replacement for pam_cracklib that was dropped from linux-pam back in
version 1.5.0. However, it currently installs it to the wrong place,
so passwd and friends fail to find it. This commit sets the security
directory path to /lib/security to match the corresponding setting in
linux-pam.mk.
Note that libpwquality has *always* installed pam_pwquality in the wrong
place, since version 1.3.0 was added to buildroot in 2017 in commit
462040443c. However, back then, linux-pam
version 1.3.0 still provided pam_cracklib for advanced password checking.
Linux-pam deprecated pam_cracklib in 1.4.0 but still built it for us when
linux-pam.mk set --enable-cracklib. Linux-PAM deleted pam_cracklib
altogether in 1.5.0, so it was not until our update to linux-pam-1.5.1
in commit 276f1e0a89 that pam_cracklib
became unavailable. After that point, pam_pwquality was the only
alternative for PAM-based password checking.
Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 541eb8bf7d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit allows the package patches to be applied with fuzz factor 0.
The fuzz factor specifies how many lines of the patch can be inexactly
matched, so the value 0 requires all lines to be exactly matched.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit f5226cd6b7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When using BR2_STATIC_LIBS=y, tinysshd's build was successful, but the
binary didn't work on the final target: this is because a dynamically
linked ELF was produced, on a target having no dynamic loader at all.
Using $(TARGET_CONFIGURE_OPTS) propagates all the options and not only
"CC", resulting in a correct static binary able to run on the target.
Without the patch:
> tinysshd: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV),
> dynamically linked, interpreter /lib/ld-musl-armhf.so.1, stripped
With the patch:
> tinysshd: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV),
> statically linked, stripped
Fixes: a7b3de8a3b
Signed-off-by: Martin Wetterwald <martin@wetterwald.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 90e22ff48b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
