AM3352: Json-C library vulnerablity in dunfell yocto

Hi Manu,

Manu kumar said:

as we are seeing the vulnerabilities in json-c 0.13.1 version so we want to upgrade the version 0.16 or 0.17.

We have since released SDK v9.1 for AM335x. So if you are trying to improve your security situation, you should consider moving to this newer SDK. While it "only" will bring in json-c v0.15 it will also have MANY MANY other security-related improvements across the entire software stack, so make sure to check this out if security/robustness is what you are after as the main goal here: https://www.ti.com/tool/PROCESSOR-SDK-AM335X

If you must have a later version of json-c, have you tried using the recipes from https://git.openembedded.org/openembedded-core/tree/meta/recipes-devtools/json-c directly?

Then, perhaps this commit here related to the override syntax is something you need to accommodate for. Only one of the methods may work for Yocto Dunfell (as used in our SDK v8.x) - I haven't tried this yet myself.
https://git.openembedded.org/openembedded-core/commit/meta/recipes-devtools/json-c?id=42344347be29f0997cc2f7636d9603b1fe1875ae

It may also be that adding json-c 0.16/0.17 may be more seamless in the context of SDK v9.1 rather than the combination you are trying, so it's worth a shot I'd say.

Regards, Andreas

Hello Andreas I appreciate your reply. Yes, it is a fantastic recommendation, and we will intend to update the TiSDK version to V9.1. additionally, as you pointed out, https://git.openembedded.org/openembedded-core/tree/meta/recipes-devtools/json-c I suggested using the 0.17.bb file at the same location to update the version of JSON-C. But as I already indicated, I received the errors.  Thus, it can be concluded that we are unable to upgrade the JSON-C library using Tisdk 8.1.

json-c « recipes-devtools « meta - openembedded-core - OpenEmbedded Core layer

Hi Manu,

it sounds like your plan is to move to v9.1, and we will no longer need to investigate this in the context of v8.1? Just trying to double-check and see if we can close this specific ticket here.

Regards, Andreas

if you investigate it would be better!!! need to check with our product owner on migrating to 9.1.. if he approves we will migrate to 9.1. i hope its better if ticket is open till that

Is there any further release for AM335X  apart 9.1.0.001? just want to know the roadmap for the same ?

you mean to say there will no more updated release version in this year ?  there will not be next version?

no, yearly releases will mean there is one per year and about the same time as last year. You can also follow internal progress on CI/CD page or use mainline Linux for such devices. 

https://software-dl.ti.com/cicd-report/linux/index.html?section=platform&platform=am335x

As far as I understand we do not plan new features. Only bug fixes and yearly update of LTS kernel, u-boot base, etc

Regards, Frank