subtree updatesdunfell

poky: a631bfc3a3..733d919af4:
  Alex Kiernan (2):
        pypi.bbclass: Set CVE_PRODUCT to PYPI_PACKAGE
        openssh: Move sshdgenkeys.service to sshd.socket

  Arturo Buzarra (1):
        run-postinsts: Set dependency for ldconfig to avoid boot issues

  Ashish Sharma (2):
        connman: Fix CVE-2023-28488 DoS in client.c
        golang: Fix CVE-2023-24539

  Bruce Ashfield (5):
        linux-yocto/5.4: update to v5.4.238
        linux-yocto/5.4: update to v5.4.240
        linux-yocto/5.4: update to v5.4.241
        linux-yocto/5.4: update to v5.4.242
        linux-yocto/5.4: update to v5.4.243

  Dmitry Baryshkov (1):
        linux-firmware: upgrade 20230210 -> 20230404

  Hitendra Prajapati (2):
        git: fix CVE-2023-29007
        git: fix CVE-2023-25652

  Khem Raj (1):
        perf: Depend on native setuptools3

  Marek Vasut (1):
        cpio: Fix wrong CRC with ASCII CRC for large files

  Martin Jansa (1):
        populate_sdk_ext.bbclass: set METADATA_REVISION with an DISTRO override

  Nikhil R (1):
        ffmpeg: Fix CVE-2022-48434

  Peter Marko (1):
        libxml2: patch CVE-2023-28484 and CVE-2023-29469

  Randolph Sapp (1):
        wic/bootimg-efi: if fixed-size is set then use that for mkdosfs

  Ranjitsinh Rathod (1):
        libbsd: Add correct license for all packages

  Shubham Kulkarni (1):
        go: Security fix for CVE-2023-24538

  Siddharth (1):
        curl: ammend fix for CVE-2023-27534 to fix error when ssh is enabled

  Steve Sakoman (1):
        selftest: skip virgl test on ubuntu 22.10, fedora 37, and all rocky

  Thomas Roos (1):
        oeqa/utils/metadata.py: Fix running oe-selftest running with no distro set

  Vijay Anusuri (3):
        ghostscript: Fix CVE-2023-28879
        xserver-xorg: Security fix CVE-2023-0494 and CVE-2023-1393
        go: Security fix CVE-2023-24540

  Vivek Kumbhar (1):
        freetype: fix CVE-2023-2004 integer overflowin in tt_hvadvance_adjust() in src/truetype/ttgxvar.c

  Yoann Congal (1):
        linux-yocto: Exclude 294 CVEs already fixed upstream

meta-openembedded: 7007d14c25..116bfe8d5e:
  Alex Yao (1):
        lcov: Fix Perl Path

  Hitendra Prajapati (1):
        multipath-tools: CVE-2022-41973 Symlink attack multipathd operates insecurely

  Hugo SIMELIERE (3):
        openvpn: add CVE-2020-7224 and CVE-2020-27569 to allowlist
        openvpn: upgrade 2.4.9 -> 2.4.12
        libmodbus: Fix CVE-2022-0367

  Jack Mitchell (2):
        nss: backport fix for native build failure due to implicit casting with gcc13
        nss: backport fix for native build failure due to dangling pointer with gcc13

  Narpat Mali (1):
        nodejs: make 14.18.1 available but not default

  Valeria Petrov (1):
        apache2: upgrade 2.4.56 -> 2.4.57

  Viktor Rosendahl (1):
        jsoncpp: Fix broken handling of escape characters

Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Change-Id: I8260e0168ea1ddec7ee03555e4f5653155e0ab45

1 files changed, 125 insertions, 0 deletions

diff --git a/poky/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-1.patch b/poky/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-1.patch
new file mode 100644
index 0000000000..eda26e5ff6
--- /dev/null
+++ b/poky/meta/recipes-devtools/go/go-1.14/CVE-2023-24538-1.patch
@@ -0,0 +1,125 @@
+From 8acd01094d9ee17f6e763a61e49a8a808b3a9ddb Mon Sep 17 00:00:00 2001
+From: Brad Fitzpatrick <bradfitz@golang.org>
+Date: Mon, 2 Aug 2021 14:55:51 -0700
+Subject: [PATCH 1/3] net/netip: add new IP address package
+
+Co-authored-by: Alex Willmer <alex@moreati.org.uk> (GitHub @moreati)
+Co-authored-by: Alexander Yastrebov <yastrebov.alex@gmail.com>
+Co-authored-by: David Anderson <dave@natulte.net> (Tailscale CLA)
+Co-authored-by: David Crawshaw <crawshaw@tailscale.com> (Tailscale CLA)
+Co-authored-by: Dmytro Shynkevych <dmytro@tailscale.com> (Tailscale CLA)
+Co-authored-by: Elias Naur <mail@eliasnaur.com>
+Co-authored-by: Joe Tsai <joetsai@digital-static.net> (Tailscale CLA)
+Co-authored-by: Jonathan Yu <jawnsy@cpan.org> (GitHub @jawnsy)
+Co-authored-by: Josh Bleecher Snyder <josharian@gmail.com> (Tailscale CLA)
+Co-authored-by: Maisem Ali <maisem@tailscale.com> (Tailscale CLA)
+Co-authored-by: Manuel Mendez (Go AUTHORS mmendez534@...)
+Co-authored-by: Matt Layher <mdlayher@gmail.com>
+Co-authored-by: Noah Treuhaft <noah.treuhaft@gmail.com> (GitHub @nwt)
+Co-authored-by: Stefan Majer <stefan.majer@gmail.com>
+Co-authored-by: Terin Stock <terinjokes@gmail.com> (Cloudflare CLA)
+Co-authored-by: Tobias Klauser <tklauser@distanz.ch>
+
+Fixes #46518
+
+Change-Id: I0041f9e1115d61fa6e95fcf32b01d9faee708712
+Reviewed-on: https://go-review.googlesource.com/c/go/+/339309
+Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
+TryBot-Result: Go Bot <gobot@golang.org>
+Reviewed-by: Russ Cox <rsc@golang.org>
+Trust: Brad Fitzpatrick <bradfitz@golang.org>
+
+Dependency Patch #1
+
+Upstream-Status: Backport [https://github.com/golang/go/commit/a59e33224e42d60a97fa720a45e1b74eb6aaa3d0]
+CVE: CVE-2023-24538
+Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
+---
+ src/internal/godebug/godebug.go      | 34 ++++++++++++++++++++++++++++++++++
+ src/internal/godebug/godebug_test.go | 34 ++++++++++++++++++++++++++++++++++
+ 2 files changed, 68 insertions(+)
+ create mode 100644 src/internal/godebug/godebug.go
+ create mode 100644 src/internal/godebug/godebug_test.go
+
+diff --git a/src/internal/godebug/godebug.go b/src/internal/godebug/godebug.go
+new file mode 100644
+index 0000000..ac434e5
+--- /dev/null
++++ b/src/internal/godebug/godebug.go
+@@ -0,0 +1,34 @@
++// Copyright 2021 The Go Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style
++// license that can be found in the LICENSE file.
++
++// Package godebug parses the GODEBUG environment variable.
++package godebug
++
++import "os"
++
++// Get returns the value for the provided GODEBUG key.
++func Get(key string) string {
++	return get(os.Getenv("GODEBUG"), key)
++}
++
++// get returns the value part of key=value in s (a GODEBUG value).
++func get(s, key string) string {
++	for i := 0; i < len(s)-len(key)-1; i++ {
++		if i > 0 && s[i-1] != ',' {
++			continue
++		}
++		afterKey := s[i+len(key):]
++		if afterKey[0] != '=' || s[i:i+len(key)] != key {
++			continue
++		}
++		val := afterKey[1:]
++		for i, b := range val {
++			if b == ',' {
++				return val[:i]
++			}
++		}
++		return val
++	}
++	return ""
++}
+diff --git a/src/internal/godebug/godebug_test.go b/src/internal/godebug/godebug_test.go
+new file mode 100644
+index 0000000..41b9117
+--- /dev/null
++++ b/src/internal/godebug/godebug_test.go
+@@ -0,0 +1,34 @@
++// Copyright 2021 The Go Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style
++// license that can be found in the LICENSE file.
++
++package godebug
++
++import "testing"
++
++func TestGet(t *testing.T) {
++	tests := []struct {
++		godebug string
++		key     string
++		want    string
++	}{
++		{"", "", ""},
++		{"", "foo", ""},
++		{"foo=bar", "foo", "bar"},
++		{"foo=bar,after=x", "foo", "bar"},
++		{"before=x,foo=bar,after=x", "foo", "bar"},
++		{"before=x,foo=bar", "foo", "bar"},
++		{",,,foo=bar,,,", "foo", "bar"},
++		{"foodecoy=wrong,foo=bar", "foo", "bar"},
++		{"foo=", "foo", ""},
++		{"foo", "foo", ""},
++		{",foo", "foo", ""},
++		{"foo=bar,baz", "loooooooong", ""},
++	}
++	for _, tt := range tests {
++		got := get(tt.godebug, tt.key)
++		if got != tt.want {
++			t.Errorf("get(%q, %q) = %q; want %q", tt.godebug, tt.key, got, tt.want)
++		}
++	}
++}
+--
+2.7.4