diff mbox series

[kirkstone,01/38] zlib: ignore CVE-2026-22184

Message ID	00eae842fe2989d5f72917e48ef748dfee93d57a.1771942869.git.yoann.congal@smile.fr
State	New
Headers	show Return-Path: <yoann.congal@smile.fr> ip: 209.85.128.53, mailfrom: yoann.congal@smile.fr) From: Yoann Congal <yoann.congal@smile.fr> To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 01/38] zlib: ignore CVE-2026-22184 Date: Tue, 24 Feb 2026 15:23:53 +0100 Message-ID: <00eae842fe2989d5f72917e48ef748dfee93d57a.1771942869.git.yoann.congal@smile.fr> In-Reply-To: <cover.1771942869.git.yoann.congal@smile.fr> References: <cover.1771942869.git.yoann.congal@smile.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[kirkstone,01/38] zlib: ignore CVE-2026-22184 \| expand [kirkstone,01/38] zlib: ignore CVE-2026-22184 [kirkstone,02/38] python3: patch CVE-2025-13837 [kirkstone,03/38] python3: patch CVE-2025-12084 [kirkstone,04/38] libxml2: patch CVE-2026-0990 [kirkstone,05/38] libxml2: patch CVE-2026-0992 [kirkstone,06/38] libxml2: add follow-up patch for CVE-2026-0992 [kirkstone,07/38] expat: patch CVE-2026-24515 [kirkstone,08/38] expat: patch CVE-2026-25210 [kirkstone,09/38] openssl: upgrade 3.0.18 -> 3.0.19 [kirkstone,10/38] inetutils: patch CVE-2026-24061 [kirkstone,11/38] scripts/install-buildtools: Update to 4.0.32 [kirkstone,12/38] linux-yocto/5.15: update to v5.15.195 [kirkstone,13/38] linux-yocto/5.15: update to v5.15.196 [kirkstone,14/38] linux-yocto/5.15: update to v5.15.197 [kirkstone,15/38] linux-yocto/5.15: update to v5.15.198 [kirkstone,16/38] linux-yocto/5.15: update to v5.15.199 [kirkstone,17/38] bind: Upgrade 9.18.41 -> 9.18.44 [kirkstone,18/38] libpng: patch CVE-2026-22695 [kirkstone,19/38] libpng: patch CVE-2026-22801 [kirkstone,20/38] libpng: patch CVE-2026-25646 [kirkstone,21/38] classes/buildhistory: Do not sign buildhistory commits [kirkstone,22/38] glib-2.0: patch CVE-2026-0988 [kirkstone,23/38] glib-2.0: patch CVE-2026-1484 [kirkstone,24/38] glib-2.0: patch CVE-2026-1485 [kirkstone,25/38] glib-2.0: patch CVE-2026-1489 [kirkstone,26/38] ffmpeg: set status of CVE-2025-25468 and CVE-2025-25469 [kirkstone,27/38] vim: ignore CVE-2025-66476 [kirkstone,28/38] avahi: patch CVE-2025-68276 [kirkstone,29/38] avahi: patch CVE-2025-68468 [kirkstone,30/38] avahi: patch CVE-2025-68471 [kirkstone,31/38] avahi: patch CVE-2026-24401 [kirkstone,32/38] pseudo: Update to 1.9.3 release [kirkstone,33/38] pseudo: Update to include an openat2 fix [kirkstone,34/38] pseudo: Update to include a fix for systems with kernel <5.6 [kirkstone,35/38] harfbuzz: ignore CVE-2026-22693 [kirkstone,36/38] glibc: stable 2.35 branch updates [kirkstone,37/38] libtasn1: Fix CVE-2025-13151 [kirkstone,38/38] u-boot: move CVE patch out of u-boot-common.inc

Commit Message

Yoann Congal Feb. 24, 2026, 2:23 p.m. UTC

From: Peter Marko <peter.marko@siemens.com>

This is CVE for example tool contrib/untgz.
This is not compiled in Yocto zlib recipe.

This CVE has controversial CVSS3 score of 9.8.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-core/zlib/zlib_1.2.11.bb | 2 ++
 1 file changed, 2 insertions(+)

diff mbox series

Patch

diff --git a/meta/recipes-core/zlib/zlib_1.2.11.bb b/meta/recipes-core/zlib/zlib_1.2.11.bb
index dc8f7c6c855..8dd0a90b523 100644
--- a/meta/recipes-core/zlib/zlib_1.2.11.bb
+++ b/meta/recipes-core/zlib/zlib_1.2.11.bb
@@ -58,3 +58,5 @@  BBCLASSEXTEND = "native nativesdk"
 
 # this CVE is for cloudflare zlib
 CVE_CHECK_IGNORE += "CVE-2023-6992"
+# vulnerable file is not compiled
+CVE_CHECK_IGNORE += "CVE-2026-22184"