| Message ID | 20260731103554.617510-1-adarsh.jagadish.kamini@est.tech |
|---|---|
| State | Rejected |
| Headers | show |
| Series | glibc: Ignore CVE-2026-5358 | expand |
This CVE has rejected state in all DBs that are used by Yocto cve-check/sbom. There is no reason to also carry this annotation for it. Peter > -----Original Message----- > From: openembedded-core@lists.openembedded.org <openembedded- > core@lists.openembedded.org> On Behalf Of Adarsh Jagadish Kamini > Sent: Friday, July 31, 2026 12:36 PM > To: openembedded-core@lists.openembedded.org > Subject: [OE-core][PATCH] glibc: Ignore CVE-2026-5358 > > This CVE has been marked as rejected upstream. > > https://sourceware.org/bugzilla/show_bug.cgi?id=34067#c6 > https://inbox.sourceware.org/libc-alpha/20260421164416.4031726-1- > carlos@redhat.com/T/#mf76c27025e603294611196b90e428769c9fc5a4e > > Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech> > --- > meta/recipes-core/glibc/glibc_2.44.bb | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/meta/recipes-core/glibc/glibc_2.44.bb b/meta/recipes- > core/glibc/glibc_2.44.bb > index 9c93c05fe9..97446c12e8 100644 > --- a/meta/recipes-core/glibc/glibc_2.44.bb > +++ b/meta/recipes-core/glibc/glibc_2.44.bb > @@ -4,8 +4,9 @@ require glibc-version.inc > # glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010022 > # glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010023 > # glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010024 > +# glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-5358 > CVE_STATUS_GROUPS = "CVE_STATUS_RECIPE" > -CVE_STATUS_RECIPE = "CVE-2019-1010022 CVE-2019-1010023 CVE-2019- > 1010024" > +CVE_STATUS_RECIPE = "CVE-2019-1010022 CVE-2019-1010023 CVE-2019- > 1010024 CVE-2026-5358" > CVE_STATUS_RECIPE[status] = "disputed: \ > Upstream glibc maintainers dispute there is any issue and have no plans to > address it further. \ > this is being treated as a non-security bug and no real threat."
diff --git a/meta/recipes-core/glibc/glibc_2.44.bb b/meta/recipes-core/glibc/glibc_2.44.bb index 9c93c05fe9..97446c12e8 100644 --- a/meta/recipes-core/glibc/glibc_2.44.bb +++ b/meta/recipes-core/glibc/glibc_2.44.bb @@ -4,8 +4,9 @@ require glibc-version.inc # glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010022 # glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010023 # glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010024 +# glibc https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-5358 CVE_STATUS_GROUPS = "CVE_STATUS_RECIPE" -CVE_STATUS_RECIPE = "CVE-2019-1010022 CVE-2019-1010023 CVE-2019-1010024" +CVE_STATUS_RECIPE = "CVE-2019-1010022 CVE-2019-1010023 CVE-2019-1010024 CVE-2026-5358" CVE_STATUS_RECIPE[status] = "disputed: \ Upstream glibc maintainers dispute there is any issue and have no plans to address it further. \ this is being treated as a non-security bug and no real threat."
This CVE has been marked as rejected upstream. https://sourceware.org/bugzilla/show_bug.cgi?id=34067#c6 https://inbox.sourceware.org/libc-alpha/20260421164416.4031726-1-carlos@redhat.com/T/#mf76c27025e603294611196b90e428769c9fc5a4e Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech> --- meta/recipes-core/glibc/glibc_2.44.bb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)