reset upstream subtrees to HEAD
Reset the following subtrees on HEAD:
poky: 8217b477a1(master)
meta-xilinx: 64aa3d35ae(master)
meta-openembedded: 0435c9e193(master)
meta-raspberrypi: 490a4441ac(master)
meta-security: cb6d1c85ee(master)
Squashed patches:
meta-phosphor: drop systemd 239 patches
meta-phosphor: mrw-api: use correct install path
Change-Id: I268e2646d9174ad305630c6bbd3fbc1a6105f43d
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
diff --git a/meta-security/recipes-security/nikto/files/CVE-2018-11652.patch b/meta-security/recipes-security/nikto/files/CVE-2018-11652.patch
deleted file mode 100644
index 5ddb169..0000000
--- a/meta-security/recipes-security/nikto/files/CVE-2018-11652.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From e759b3300aace5314fe3d30800c8bd83c81c29f7 Mon Sep 17 00:00:00 2001
-From: sullo <sullo@cirt.net>
-Date: Thu, 31 May 2018 23:30:03 -0400
-Subject: [PATCH] Fix CSV injection issue if server responds with a malicious
- Server string & CSV output is opened in Excel or other spreadsheet app.
- Potentially malicious cell start characters are now prefaced with a ' mark.
- Thanks to Adam (@bytesoverbombs) for letting me know!
-
-Also fixed a crash in the outdated plugin if the $sepr field ends up being something that triggers a panic in split().
-
-CVE: CVE-2018-11652
-Upstream-Status: Backport
-Signed-off-by: Nagalakshmi Veeramallu <nveeramallu@mvista.com>
----
- plugins/nikto_outdated.plugin | 2 +-
- plugins/nikto_report_csv.plugin | 42 +++++++++++++++++++++++++++++------------
- 2 files changed, 31 insertions(+), 13 deletions(-)
-
-diff --git a/plugins/nikto_outdated.plugin b/plugins/nikto_outdated.plugin
-index 72379cc..eb1d889 100644
---- a/plugins/nikto_outdated.plugin
-+++ b/plugins/nikto_outdated.plugin
-@@ -83,7 +83,7 @@ sub nikto_outdated {
- $sepr = substr($sepr, (length($sepr) - 1), 1);
-
- # break up ID string on $sepr
-- my @T = split(/$sepr/, $mark->{'banner'});
-+ my @T = split(/\\$sepr/, $mark->{'banner'});
-
- # assume last is version...
- for ($i = 0 ; $i < $#T ; $i++) { $MATCHSTRING .= "$T[$i] "; }
-diff --git a/plugins/nikto_report_csv.plugin b/plugins/nikto_report_csv.plugin
-index d13acab..b942e78 100644
---- a/plugins/nikto_report_csv.plugin
-+++ b/plugins/nikto_report_csv.plugin
-@@ -52,10 +52,12 @@ sub csv_open {
- sub csv_host_start {
- my ($handle, $mark) = @_;
- $mark->{'banner'} =~ s/"/\\"/g;
-- print OUT "\"$mark->{'hostname'}\","
-- . "\"$mark->{'ip'}\","
-- . "\"$mark->{'port'}\"," . "\"\"," . "\"\"," . "\"\","
-- . "\"$mark->{'banner'}\"\n";
-+ print $handle "\"" . csv_safecell($hostname) . "\","
-+ . "\"" . csv_safecell($mark->{'ip'}) . "\","
-+ . "\"" . csv_safecell($mark->{'port'}) . "\"," . "\"\"," . "\"\"," . "\"\","
-+ #. "\"" . $mark->{'banner'} . "\"\n";
-+ . "\"" . csv_safecell($mark->{'banner'}) . "\"\n";
-+
- return;
- }
-
-@@ -65,26 +67,42 @@ sub csv_item {
- my ($handle, $mark, $item) = @_;
- foreach my $uri (split(' ', $item->{'uri'})) {
- my $line = '';
-- $line .= "\"$item->{'mark'}->{'hostname'}\",";
-- $line .= "\"$item->{'mark'}->{'ip'}\",";
-- $line .= "\"$item->{'mark'}->{'port'}\",";
-+ $line .= "\"" . csv_safecell($hostname) . "\",";
-+ $line .= "\"" . csv_safecell($item->{'mark'}->{'ip'}) . \",";
-+ $line .= "\"" . csv_safecell($item->{'mark'}->{'port'}) . "\",";
-
- $line .= "\"";
- if ($item->{'osvdb'} ne '') { $line .= "OSVDB-" . $item->{'osvdb'}; }
- $line .= "\",";
-
- $line .= "\"";
-- if ($item->{'method'} ne '') { $line .= $item->{'method'}; }
-+ if ($item->{'method'} ne '') { $line .= csv_safecell($item->{'method'}); }
- $line .= "\",";
-
- $line .= "\"";
-- if ($uri ne '') { $line .= $mark->{'root'} . $uri; }
-+ { $line .= csv_safecell($mark->{'root'}) . $uri; }
-+ else { $line .= csv_safecell($ur
- $line .= "\",";
-
-- $item->{'message'} =~ s/"/\\"/g;
-- $line .= "\"$item->{'message'}\"";
-- print $handle "$line\n";
-+ my $msg = $item->{'message'};
-+ $uri=quotemeta($uri);
-+ my $root = quotemeta($mark->{'root'});
-+ $msg =~ s/^$uri:\s//;
-+ $msg =~ s/^$root$uri:\s//;
-+ $msg =~ s/"/\\"/g;
-+ $line .= "\"" . csv_safecell($msg) ."\"";
-+ print $handle "$line\n";
-+
- }
- }
-
-+###############################################################################
-+# prevent CSV injection attacks
-+sub csv_safecell {
-+ my $celldata = $_[0] || return;
-+ if ($celldata =~ /^[=+@-]/) { $celldata = "'" . $celldata; }
-+ return $celldata;
-+}
-+
-+
- 1;
---
-2.6.4
-
diff --git a/meta-security/recipes-security/nikto/files/location.patch b/meta-security/recipes-security/nikto/files/location.patch
index a95b062..edaa204 100644
--- a/meta-security/recipes-security/nikto/files/location.patch
+++ b/meta-security/recipes-security/nikto/files/location.patch
@@ -1,36 +1,36 @@
-From e10b9b1f6704057ace39956ae1dc5c7caca07ff1 Mon Sep 17 00:00:00 2001
-From: Andrei Dinu <andrei.adrianx.dinu@intel.com>
-Date: Mon, 8 Jul 2013 11:53:54 +0300
-Subject: [PATCH] Setting the location of nikto on the image
+From d1cb702d5147abea0d3208a4d554c61a6f2decd6 Mon Sep 17 00:00:00 2001
+From: Scott Ellis <scott@jumpnowtek.com>
+Date: Fri, 28 Dec 2018 11:08:25 -0500
+Subject: [PATCH] Set custom paths
-Upstream Status: Inapropriate
+Upstream Status: Inappropriate
-Signed-off-by: Andrei Dinu <andrei.adrianx.dinu@intel.com>
+Signed-off-by: Scott Ellis <scott@jumpnowtek.com>
---
- nikto.conf | 10 +++++-----
+ nikto.conf | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
-diff --git a/nikto.conf b/nikto.conf
-index 25b784d..9577033 100644
+diff --git a/program/nikto.conf b/program/nikto.conf
+index bf36c58..8c55415 100644
--- a/nikto.conf
+++ b/nikto.conf
-@@ -61,11 +61,11 @@ CIRT=174.142.17.165
+@@ -61,11 +61,11 @@ CIRT=107.170.99.251
CHECKMETHODS=HEAD GET
# If you want to specify the location of any of the files, specify them here
-# EXECDIR=/opt/nikto # Location of Nikto
-# PLUGINDIR=/opt/nikto/plugins # Location of plugin dir
--# DBDIR=/opt/nikto/databases # Location of plugin dir
--# TEMPLATEDIR=/opt/nikto/templates # Location of tempmlate dir
+-# DBDIR=/opt/nikto/databases # Location of database dir
+-# TEMPLATEDIR=/opt/nikto/templates # Location of template dir
-# DOCDIR=/opt/nikto/docs # Location of docs dir
+EXECDIR=/usr/bin/nikto # Location of Nikto
+PLUGINDIR=/etc/nikto/plugins # Location of plugin dir
-+DBDIR=/etc/nikto/databases # Location of plugin dir
-+TEMPLATEDIR=/etc/nikto/templates # Location of tempmlate dir
++DBDIR=/etc/nikto/databases # Location of database dir
++TEMPLATEDIR=/etc/nikto/templates # Location of template dir
+DOCDIR=/usr/share/doc/nikto # Location of docs dir
# Default plugin macros
- @@MUTATE=dictionary;subdomain
+ # Remove plugins designed to be run standalone
--
-1.7.9.5
+2.7.4