mbox series

[v2,0/2] meta: remove reference in patches to rejected CVE

Message ID 20260223-update-patch-with-rejected-cve-v2-0-851e6f96b910@bootlin.com
Headers show
Series meta: remove reference in patches to rejected CVE | expand

Message

Benjamin Robin (Schneider Electric) Feb. 23, 2026, 8:11 a.m. UTC 
Remove the reference of 2 CVE identifiers in patch files, since the
CVEs are rejected. Remove reference to CVE-2025-62813 and to
CVE-2021-3502.

These 2 issues were found by using sbom-cve-check on the whole layer.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
Changes in v2:
- Update title of commit messages: use the recipe name as prefix
- Link to v1: https://lore.kernel.org/r/20260220-update-patch-with-rejected-cve-v1-0-cf113d8a15ca@bootlin.com

---
Benjamin Robin (Schneider Electric) (2):
      avahi: Remove a reference to the rejected CVE-2021-36217
      lz4: Remove a reference to the rejected CVE-2025-62813

 meta/recipes-connectivity/avahi/files/local-ping.patch                  | 1 -
 .../lz4/lz4/{CVE-2025-62813.patch => fix-null-error-handling.patch}     | 1 -
 meta/recipes-support/lz4/lz4_1.10.0.bb                                  | 2 +-
 3 files changed, 1 insertion(+), 3 deletions(-)
---
base-commit: 74ba238ff1ba1e9b612aece1989b828f3a8f8770
change-id: 20260220-update-patch-with-rejected-cve-13cd13bb3e4f

Best regards,