18 files changed, 48 insertions, 8 deletions
diff --git a/poky/meta/recipes-connectivity/avahi/avahi_0.8.bb b/poky/meta/recipes-connectivity/avahi/avahi_0.8.bb
index c8a3f876a..5c46bbf58 100644
--- a/poky/meta/recipes-connectivity/avahi/avahi_0.8.bb
+++ b/poky/meta/recipes-connectivity/avahi/avahi_0.8.bb
@@ -30,10 +30,13 @@ UPSTREAM_CHECK_URI = "https://github.com/lathiat/avahi/releases/"
 SRC_URI[md5sum] = "229c6aa30674fc43c202b22c5f8c2be7"
 SRC_URI[sha256sum] = "060309d7a333d38d951bc27598c677af1796934dbd98e1024e7ad8de798fedda"
 
+# Issue only affects Debian/SUSE, not us
+CVE_CHECK_WHITELIST += "CVE-2021-26720"
+
 DEPENDS = "expat libcap libdaemon glib-2.0 intltool-native"
 
 # For gtk related PACKAGECONFIGs: gtk, gtk3
-AVAHI_GTK ?= "gtk3"
+AVAHI_GTK ?= ""
 
 PACKAGECONFIG ??= "dbus ${@bb.utils.contains_any('DISTRO_FEATURES','x11 wayland','${AVAHI_GTK}','',d)}"
 PACKAGECONFIG[dbus] = "--enable-dbus,--disable-dbus,dbus"
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.12/0001-avoid-start-failure-with-bind-user.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.16/0001-avoid-start-failure-with-bind-user.patch
index 8db96ec04..8db96ec04 100644
--- a/poky/meta/recipes-connectivity/bind/bind-9.16.12/0001-avoid-start-failure-with-bind-user.patch
+++ b/poky/meta/recipes-connectivity/bind/bind-9.16.16/0001-avoid-start-failure-with-bind-user.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.12/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.16/0001-named-lwresd-V-and-start-log-hide-build-options.patch
index 5bcc16c9b..5bcc16c9b 100644
--- a/poky/meta/recipes-connectivity/bind/bind-9.16.12/0001-named-lwresd-V-and-start-log-hide-build-options.patch
+++ b/poky/meta/recipes-connectivity/bind/bind-9.16.16/0001-named-lwresd-V-and-start-log-hide-build-options.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.12/bind-ensure-searching-for-json-headers-searches-sysr.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.16/bind-ensure-searching-for-json-headers-searches-sysr.patch
index f9cdc7ca4..f9cdc7ca4 100644
--- a/poky/meta/recipes-connectivity/bind/bind-9.16.12/bind-ensure-searching-for-json-headers-searches-sysr.patch
+++ b/poky/meta/recipes-connectivity/bind/bind-9.16.16/bind-ensure-searching-for-json-headers-searches-sysr.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.12/bind9 b/poky/meta/recipes-connectivity/bind/bind-9.16.16/bind9
index 968679ff7..968679ff7 100644
--- a/poky/meta/recipes-connectivity/bind/bind-9.16.12/bind9
+++ b/poky/meta/recipes-connectivity/bind/bind-9.16.16/bind9
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.12/conf.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.16/conf.patch
index aad345f9f..aad345f9f 100644
--- a/poky/meta/recipes-connectivity/bind/bind-9.16.12/conf.patch
+++ b/poky/meta/recipes-connectivity/bind/bind-9.16.16/conf.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.12/generate-rndc-key.sh b/poky/meta/recipes-connectivity/bind/bind-9.16.16/generate-rndc-key.sh
index 633e29c0e..633e29c0e 100644
--- a/poky/meta/recipes-connectivity/bind/bind-9.16.12/generate-rndc-key.sh
+++ b/poky/meta/recipes-connectivity/bind/bind-9.16.16/generate-rndc-key.sh
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.12/init.d-add-support-for-read-only-rootfs.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.16/init.d-add-support-for-read-only-rootfs.patch
index 11db95ede..11db95ede 100644
--- a/poky/meta/recipes-connectivity/bind/bind-9.16.12/init.d-add-support-for-read-only-rootfs.patch
+++ b/poky/meta/recipes-connectivity/bind/bind-9.16.16/init.d-add-support-for-read-only-rootfs.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.12/make-etc-initd-bind-stop-work.patch b/poky/meta/recipes-connectivity/bind/bind-9.16.16/make-etc-initd-bind-stop-work.patch
index 146f3e35d..146f3e35d 100644
--- a/poky/meta/recipes-connectivity/bind/bind-9.16.12/make-etc-initd-bind-stop-work.patch
+++ b/poky/meta/recipes-connectivity/bind/bind-9.16.16/make-etc-initd-bind-stop-work.patch
diff --git a/poky/meta/recipes-connectivity/bind/bind-9.16.12/named.service b/poky/meta/recipes-connectivity/bind/bind-9.16.16/named.service
index cda56ef01..cda56ef01 100644
--- a/poky/meta/recipes-connectivity/bind/bind-9.16.12/named.service
+++ b/poky/meta/recipes-connectivity/bind/bind-9.16.16/named.service
diff --git a/poky/meta/recipes-connectivity/bind/bind_9.16.12.bb b/poky/meta/recipes-connectivity/bind/bind_9.16.16.bb
index 09f77038f..b15259840 100644
--- a/poky/meta/recipes-connectivity/bind/bind_9.16.12.bb
+++ b/poky/meta/recipes-connectivity/bind/bind_9.16.16.bb
@@ -20,12 +20,16 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
            file://0001-avoid-start-failure-with-bind-user.patch \
            "
 
-SRC_URI[sha256sum] = "9914af9311fd349cab441097898d94fb28d0bfd9bf6ed04fe1f97f042644da7f"
+SRC_URI[sha256sum] = "6c913902adf878e7dc5e229cea94faefc9d40f44775a30213edd08860f761d7b"
 
 UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
 # stay at 9.16 follow the ESV versions divisible by 4
 UPSTREAM_CHECK_REGEX = "(?P<pver>9.(16|20|24|28)(\.\d+)+(-P\d+)*)/"
 
+# Issue only affects dhcpd with recent bind versions. We don't ship dhcpd anymore
+# so the issue doesn't affect us.
+CVE_CHECK_WHITELIST += "CVE-2019-6470"
+
 inherit autotools update-rc.d systemd useradd pkgconfig multilib_header update-alternatives
 
 # PACKAGECONFIGs readline and libedit should NOT be set at same time
diff --git a/poky/meta/recipes-connectivity/bluez5/bluez5.inc b/poky/meta/recipes-connectivity/bluez5/bluez5.inc
index 74b59e406..635cad813 100644
--- a/poky/meta/recipes-connectivity/bluez5/bluez5.inc
+++ b/poky/meta/recipes-connectivity/bluez5/bluez5.inc
@@ -53,6 +53,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/bluetooth/bluez-${PV}.tar.xz \
            file://0001-tests-add-a-target-for-building-tests-without-runnin.patch \
            file://0001-test-gatt-Fix-hung-issue.patch \
            file://0001-audio-Rename-pause-funciton-to-avoid-shadowing-glibc.patch \
+           file://0001-Makefile.am-add-missing-mkdir-for-ell-shared.patch \
            "
 S = "${WORKDIR}/bluez-${PV}"
 
diff --git a/poky/meta/recipes-connectivity/bluez5/bluez5/0001-Makefile.am-add-missing-mkdir-for-ell-shared.patch b/poky/meta/recipes-connectivity/bluez5/bluez5/0001-Makefile.am-add-missing-mkdir-for-ell-shared.patch
new file mode 100644
index 000000000..03b42f73c
--- /dev/null
+++ b/poky/meta/recipes-connectivity/bluez5/bluez5/0001-Makefile.am-add-missing-mkdir-for-ell-shared.patch
@@ -0,0 +1,25 @@
+From d341ba650af1b7068d9ad034732b4f41b91bb2c1 Mon Sep 17 00:00:00 2001
+From: Alexander Kanavin <alex.kanavin@gmail.com>
+Date: Sun, 25 Apr 2021 18:56:41 +0200
+Subject: [PATCH] Makefile.am: add missing mkdir for ell/shared
+
+This addresses build errors out of source tree.
+
+Upstream-Status: Backport
+Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
+---
+ Makefile.am | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Makefile.am b/Makefile.am
+index be5d5c7..72ad425 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -623,6 +623,7 @@ lib/bluetooth/%.h: lib/%.h
+ 	$(AM_V_GEN)$(LN_S) -f $(abspath $<) $@
+ 
+ ell/shared: Makefile
++	$(AM_V_at)$(MKDIR_P) ell
+ 	$(AM_V_GEN)for f in $(ell_shared) ; do \
+ 		if [ ! -f $$f ] ; then \
+ 			$(LN_S) -t ell -f $(abs_srcdir)/../ell/$$f ; \
diff --git a/poky/meta/recipes-connectivity/bluez5/bluez5_5.56.bb b/poky/meta/recipes-connectivity/bluez5/bluez5_5.58.bb
index 676cb2dbb..eb8475ec1 100644
--- a/poky/meta/recipes-connectivity/bluez5/bluez5_5.56.bb
+++ b/poky/meta/recipes-connectivity/bluez5/bluez5_5.58.bb
@@ -1,7 +1,9 @@
 require bluez5.inc
 
-SRC_URI[md5sum] = "e6c51b2aefa7c56ff072819a78611fa5"
-SRC_URI[sha256sum] = "59c4dba9fc8aae2a6a5f8f12f19bc1b0c2dc27355c7ca3123eed3fe6bd7d0b9d"
+SRC_URI[sha256sum] = "c8065e75a5eb67236849ef68a354b1700540305a8c88ef0a0fd6288f19daf1f1"
+
+# These issues have kernel fixes rather than bluez fixes so exclude here
+CVE_CHECK_WHITELIST += "CVE-2020-12352 CVE-2020-24490"
 
 # noinst programs in Makefile.tools that are conditional on READLINE
 # support
diff --git a/poky/meta/recipes-connectivity/iproute2/iproute2_5.11.0.bb b/poky/meta/recipes-connectivity/iproute2/iproute2_5.12.0.bb
index e27b42d23..363112337 100644
--- a/poky/meta/recipes-connectivity/iproute2/iproute2_5.11.0.bb
+++ b/poky/meta/recipes-connectivity/iproute2/iproute2_5.12.0.bb
@@ -4,7 +4,7 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/net/${BPN}/${BP}.tar.xz \
            file://0001-libc-compat.h-add-musl-workaround.patch \
            "
 
-SRC_URI[sha256sum] = "c5e2ea108212b3445051b35953ec267f9f3469e1d5c67ac034ab559849505c54"
+SRC_URI[sha256sum] = "9d268db98a36ee2a0e3ff3b92b2efff66fc1138a51e409bdef6ab3cfe15f326f"
 
 # CFLAGS are computed in Makefile and reference CCOPTS
 #
diff --git a/poky/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.14.1.bb b/poky/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.15.bb
index 9a83898e5..75e8ba06d 100644
--- a/poky/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.14.1.bb
+++ b/poky/meta/recipes-connectivity/libnss-mdns/libnss-mdns_0.15.bb
@@ -11,7 +11,7 @@ DEPENDS = "avahi"
 SRC_URI = "git://github.com/lathiat/nss-mdns \
            "
 
-SRCREV = "41c9c5e78f287ed4b41ac438c1873fa71bfa70ae"
+SRCREV = "65ad25563937682ab2770c36d56667a754837102"
 
 S = "${WORKDIR}/git"
 
diff --git a/poky/meta/recipes-connectivity/ofono/ofono_1.31.bb b/poky/meta/recipes-connectivity/ofono/ofono_1.32.bb
index 2425ef76a..f3d875b20 100644
--- a/poky/meta/recipes-connectivity/ofono/ofono_1.31.bb
+++ b/poky/meta/recipes-connectivity/ofono/ofono_1.32.bb
@@ -13,8 +13,7 @@ SRC_URI = "\
     file://0001-mbim-add-an-optional-TEMP_FAILURE_RETRY-macro-copy.patch \
     file://0002-mbim-Fix-build-with-ell-0.39-by-restoring-unlikely-m.patch \
 "
-SRC_URI[md5sum] = "1c26340e3c6ed132cc812595081bb3dc"
-SRC_URI[sha256sum] = "a15c5d28096c10eb30e47a68b6dc2e7c4a5a99d7f4cfedf0b69624f33d859e9b"
+SRC_URI[sha256sum] = "f7d775887b7b80cf3b82e3f0a6c2696c6d01963d222ca2217919d21b9e803042"
 
 inherit autotools pkgconfig update-rc.d systemd gobject-introspection-data
 
diff --git a/poky/meta/recipes-connectivity/openssh/openssh_8.6p1.bb b/poky/meta/recipes-connectivity/openssh/openssh_8.6p1.bb
index be56fe43b..e8f041c58 100644
--- a/poky/meta/recipes-connectivity/openssh/openssh_8.6p1.bb
+++ b/poky/meta/recipes-connectivity/openssh/openssh_8.6p1.bb
@@ -27,10 +27,16 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
            "
 SRC_URI[sha256sum] = "c3e6e4da1621762c850d03b47eed1e48dff4cc9608ddeb547202a234df8ed7ae"
 
+# This CVE is specific to OpenSSH with the pam opie which we don't build/use here
+CVE_CHECK_WHITELIST += "CVE-2007-2768"
+
 # This CVE is specific to OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7
 # and when running in a Kerberos environment. As such it is not relevant to OpenEmbedded
 CVE_CHECK_WHITELIST += "CVE-2014-9278"
 
+# CVE only applies to some distributed RHEL binaries
+CVE_CHECK_WHITELIST += "CVE-2008-3844"
+
 PAM_SRC_URI = "file://sshd"
 
 inherit manpages useradd update-rc.d update-alternatives systemd