diff mbox series

[scarthgap,01/27] cpio: mark CVE-2023-7216 as disputed

Message ID	0f2cd2bbaddba3b8c80d71db274bbcd941d0e60e.1720960579.git.steve@sakoman.com
State	Accepted
Delegated to:	Steve Sakoman
Headers	show Return-Path: <steve@sakoman.com> ip: 209.85.215.175, mailfrom: steve@sakoman.com) From: Steve Sakoman <steve@sakoman.com> To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 01/27] cpio: mark CVE-2023-7216 as disputed Date: Sun, 14 Jul 2024 05:38:30 -0700 Message-Id: <0f2cd2bbaddba3b8c80d71db274bbcd941d0e60e.1720960579.git.steve@sakoman.com> In-Reply-To: <cover.1720960579.git.steve@sakoman.com> References: <cover.1720960579.git.steve@sakoman.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[scarthgap,01/27] cpio: mark CVE-2023-7216 as disputed \| expand [scarthgap,01/27] cpio: mark CVE-2023-7216 as disputed [scarthgap,02/27] ruby: fix CVE-2024-27281 [scarthgap,03/27] libcap-ng: upgrade 0.8.4 -> 0.8.5 [scarthgap,04/27] libcap-ng-python: upgrade 0.8.4 -> 0.8.5 [scarthgap,05/27] fribidi: upgrade 1.0.13 -> 1.0.14 [scarthgap,06/27] ed: upgrade 1.20.1 -> 1.20.2 [scarthgap,07/27] llvm: upgrade 18.1.5 -> 18.1.6 [scarthgap,08/27] wic: engine.py: use raw string for escape sequence [scarthgap,09/27] gstreamer1.0: skip another known flaky test [scarthgap,10/27] libportal: fix rare build race [scarthgap,11/27] linux-yocto: Enable team net driver [scarthgap,12/27] populate_sdk_ext.bbclass: Fix undefined variable error [scarthgap,13/27] sdk: Fix path length limit to match reserved size [scarthgap,14/27] selftest/cases/runtime_test: Exclude centos-9 from virgl tests [scarthgap,15/27] ncurses: switch to new mirror [scarthgap,16/27] meson: don't use deprecated pkgconfig variable [scarthgap,17/27] curl: skip FTP tests in run-ptest [scarthgap,18/27] mesa: remove obsolete 0001-meson.build-check-for-all-linux-host_os-combinations.p… [scarthgap,19/27] dnf/mesa: Fix missing leading whitespace with ':append' [scarthgap,20/27] kexec-tools: submit 0003-kexec-ARM-Fix-add_buffer_phys_virt-align-issue.patch ups… [scarthgap,21/27] vorbis: mark patch as Inactive-Upstream [scarthgap,22/27] grub: mark grub-module-explicitly-keeps-symbole-.module_license.patch as a workar… [scarthgap,23/27] perl: submit the rest of determinism.patch upstream [scarthgap,24/27] iptables: submit 0001-configure-Add-option-to-enable-disable-libnfnetlink.patch u… [scarthgap,25/27] cve-exclusion: Drop the version comparision/warning [scarthgap,26/27] webkitgtk: fix do_configure error on beaglebone-yocto [scarthgap,27/27] webkitgtk: fix do_compile errors on beaglebone-yocto

Commit Message

Steve Sakoman July 14, 2024, 12:38 p.m. UTC

From: Ross Burton <ross.burton@arm.com>

Upstream consider the behaviour described in this CVE as intentional,
and provide an option to stop it.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6c99147037ba8ca424ee42520183bd2bd55c7056)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-extended/cpio/cpio_2.15.bb | 1 +
 1 file changed, 1 insertion(+)

diff mbox series

Patch

diff --git a/meta/recipes-extended/cpio/cpio_2.15.bb b/meta/recipes-extended/cpio/cpio_2.15.bb
index 52070f59a2..95f82cdf3a 100644
--- a/meta/recipes-extended/cpio/cpio_2.15.bb
+++ b/meta/recipes-extended/cpio/cpio_2.15.bb
@@ -16,6 +16,7 @@  SRC_URI[sha256sum] = "efa50ef983137eefc0a02fdb51509d624b5e3295c980aa127ceee41834
 inherit autotools gettext texinfo ptest
 
 CVE_STATUS[CVE-2010-4226] = "not-applicable-platform: Issue applies to use of cpio in SUSE/OBS"
+CVE_STATUS[CVE-2023-7216] = "disputed: intended behaviour, see https://lists.gnu.org/archive/html/bug-cpio/2024-03/msg00000.html"
 
 EXTRA_OECONF += "DEFAULT_RMT_DIR=${sbindir}"