From patchwork Tue Dec 17 23:26:57 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Frank Hunleth X-Patchwork-Id: 1211814 Return-Path: X-Original-To: incoming-buildroot@patchwork.ozlabs.org Delivered-To: patchwork-incoming-buildroot@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=busybox.net (client-ip=140.211.166.138; helo=whitealder.osuosl.org; envelope-from=buildroot-bounces@busybox.net; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=troodon-software.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=troodon-software-com.20150623.gappssmtp.com header.i=@troodon-software-com.20150623.gappssmtp.com header.b="lcJh14ou"; dkim-atps=neutral Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 47cvdC0hfTz9sR1 for ; Wed, 18 Dec 2019 10:35:11 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 1AD048745D; Tue, 17 Dec 2019 23:35:09 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IhPdebp8DQV1; Tue, 17 Dec 2019 23:35:06 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by whitealder.osuosl.org (Postfix) with ESMTP id D225A8763C; Tue, 17 Dec 2019 23:35:05 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by ash.osuosl.org (Postfix) with ESMTP id 663551BF479 for ; Tue, 17 Dec 2019 23:35:04 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 3D0CF869D7 for ; Tue, 17 Dec 2019 23:35:04 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nvbBWY6Q59vK for ; Tue, 17 Dec 2019 23:35:03 +0000 (UTC) X-Greylist: delayed 00:07:17 by SQLgrey-1.7.6 Received: from mail-qt1-f177.google.com (mail-qt1-f177.google.com [209.85.160.177]) by fraxinus.osuosl.org (Postfix) with ESMTPS id DFA71860C8 for ; Tue, 17 Dec 2019 23:35:02 +0000 (UTC) Received: by mail-qt1-f177.google.com with SMTP id 5so408036qtz.1 for ; Tue, 17 Dec 2019 15:35:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=troodon-software-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=WxtKO+IolcJT5PY2UC/47FZAe9vymMyyJW6vTaHBo1s=; b=lcJh14ouTnQV9EnoSMBfjNy2yLe4e8n/EgJ1WxDQ8gwEfHbfzQV7JilT7S88Lz53Dl RFvFs3qbTVmR2REdbU6U3scgodDxLmznGXQsii6PbWgTxdwQhHzoBjR8YpT35gqfnx0H AcM6JsZjxUCB4TvqHafP5FRNCeDPgKoxUTl1v3gktgGinmfaQHh1UYHdxZwxAVBq8xAI lQ6e0ba9qY/+eUpZcaMuuMJGIGZlqmiHC93f1DMLa5Py+jctiP/KmOkIfm2WAm+Xd9xJ czPbxPsf1xv32s4+nKDJZgagzIE4uSGaqaB8WN6FejeTgrLF+DR/3AWCY6eVBFpkkWLe /y2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=WxtKO+IolcJT5PY2UC/47FZAe9vymMyyJW6vTaHBo1s=; b=iV18oaDEi2/bVTFOFjKzNV4v9OTeU0FhogPpTzU3oD6VLjr8mKpLmqtaju1VtozLow equJgqgtxYWNktuKMRwTyH+0BLVJTkITGahF4Wgmown3sX65nUmxBLfbi5yE2vnidi6j e74rc8uyCEmzypAu9pq790FHNmQdH33m0e4Czpzu1ypKl5FXfe5qyF8MPuswHfOpnzWZ viBwUM6CzWj1vey/VbIstdUPTW17p/D4ZBw6RFwm/vdo0GmHmlWGYafqj56UJ06yt+7n tLbi/exrsCB/L1Wc0TEVKyopfWlOITPOJe6dtbVmKaX1huyM6HU3tjukHg4hTQYAk0o+ j4oQ== X-Gm-Message-State: APjAAAUDF+hZ2o4TWJtVWa0/VOEPtW+AKHumP6TZ/IoLamLwBvSzQ1Bu RLMAagFc3+JSvEMREqDI2eZJkLoLeEVXlA== X-Google-Smtp-Source: APXvYqxxtz+k6QgeIxngjV0BmwVVCQ8Wz8jvsEzFU3mzQZBJPbKSgwpAtu5xZI+k47/MXnuXvlUWqA== X-Received: by 2002:ac8:100d:: with SMTP id z13mr448659qti.1.1576625264135; Tue, 17 Dec 2019 15:27:44 -0800 (PST) Received: from sprint.hunleth.lan (pool-173-79-29-152.washdc.fios.verizon.net. [173.79.29.152]) by smtp.gmail.com with ESMTPSA id x16sm41656qki.110.2019.12.17.15.27.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 17 Dec 2019 15:27:43 -0800 (PST) From: Frank Hunleth To: buildroot@buildroot.org Date: Tue, 17 Dec 2019 18:26:57 -0500 Message-Id: <20191217232657.6582-1-fhunleth@troodon-software.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Subject: [Buildroot] [PATCH] package/openocd: bump to version 104a5cb X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" The OpenOCD project hasn't made a release since January 2017. Much work has happened since then and now. This bumps the version to the latest commit and removes a patch that has been applied upstream. Signed-off-by: Frank Hunleth --- ...event-some-forms-of-Cross-Protocol-S.patch | 50 ------------------- package/openocd/openocd.hash | 5 +- package/openocd/openocd.mk | 7 +-- 3 files changed, 6 insertions(+), 56 deletions(-) delete mode 100644 package/openocd/0003-CVE-2018-5704-Prevent-some-forms-of-Cross-Protocol-S.patch diff --git a/package/openocd/0003-CVE-2018-5704-Prevent-some-forms-of-Cross-Protocol-S.patch b/package/openocd/0003-CVE-2018-5704-Prevent-some-forms-of-Cross-Protocol-S.patch deleted file mode 100644 index ba19bf5735..0000000000 --- a/package/openocd/0003-CVE-2018-5704-Prevent-some-forms-of-Cross-Protocol-S.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 3a223ca3ebc7ac24d7726a0cd58e5695bc813657 Mon Sep 17 00:00:00 2001 -From: Andreas Fritiofson -Date: Sat, 13 Jan 2018 21:00:47 +0100 -Subject: [PATCH] CVE-2018-5704: Prevent some forms of Cross Protocol Scripting - attacks - -OpenOCD can be targeted by a Cross Protocol Scripting attack from -a web browser running malicious code, such as the following PoC: - -var x = new XMLHttpRequest(); -x.open("POST", "http://127.0.0.1:4444", true); -x.send("exec xcalc\r\n"); - -This mitigation should provide some protection from browser-based -attacks and is based on the corresponding fix in Redis: - -https://github.com/antirez/redis/blob/8075572207b5aebb1385c4f233f5302544439325/src/networking.c#L1758 - - -Upstream-status: Under review: http://openocd.zylin.com/#/c/4335/ -Change-Id: Ia96ebe19b74b5805dc228bf7364c7971a90a4581 -Signed-off-by: Andreas Fritiofson -Reported-by: Josef Gajdusek -Signed-off-by: Peter Korsgaard ---- - src/server/startup.tcl | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/src/server/startup.tcl b/src/server/startup.tcl -index 64ace407..dd1b31e4 100644 ---- a/src/server/startup.tcl -+++ b/src/server/startup.tcl -@@ -8,3 +8,14 @@ proc ocd_gdb_restart {target_id} { - # one target - reset halt - } -+ -+proc prevent_cps {} { -+ echo "Possible SECURITY ATTACK detected." -+ echo "It looks like somebody is sending POST or Host: commands to OpenOCD." -+ echo "This is likely due to an attacker attempting to use Cross Protocol Scripting" -+ echo "to compromise your OpenOCD instance. Connection aborted." -+ exit -+} -+ -+proc POST {args} { prevent_cps } -+proc Host: {args} { prevent_cps } --- -2.11.0 - diff --git a/package/openocd/openocd.hash b/package/openocd/openocd.hash index 3fb817b4a2..8575cd825d 100644 --- a/package/openocd/openocd.hash +++ b/package/openocd/openocd.hash @@ -1,4 +1,3 @@ -# From http://sourceforge.net/projects/openocd/files/openocd/0.10.0/ -sha1 3245d43d60a1a93f8b0f6b1ce20b53e38cab7a4a openocd-0.10.0.tar.bz2 -md5 b412bdef0481a3859c6585eb69f6f6ba openocd-0.10.0.tar.bz2 +# Locally calculated +sha256 a88acc1e7fc9af0d91d56041923b80563be7b17b2198a21c6c2656ce596ccd16 openocd-104a5cbef8965d47b9111f7e010f96ebb5fdf06c.tar.gz sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING diff --git a/package/openocd/openocd.mk b/package/openocd/openocd.mk index d35ed77cd1..0a3f1c9a21 100644 --- a/package/openocd/openocd.mk +++ b/package/openocd/openocd.mk @@ -4,9 +4,10 @@ # ################################################################################ -OPENOCD_VERSION = 0.10.0 -OPENOCD_SOURCE = openocd-$(OPENOCD_VERSION).tar.bz2 -OPENOCD_SITE = http://sourceforge.net/projects/openocd/files/openocd/$(OPENOCD_VERSION) +OPENOCD_VERSION = 104a5cbef8965d47b9111f7e010f96ebb5fdf06c +OPENOCD_SITE = git://git.code.sf.net/p/openocd/code +OPENOCD_METHOD = git +OPENOCD_GIT_SUBMODULES = YES OPENOCD_LICENSE = GPL-2.0+ OPENOCD_LICENSE_FILES = COPYING # 0002-configure-enable-build-on-uclinux.patch patches configure.ac