diff mbox series

[wrynose,1/8] glibc: set status for CVE-2011-0536 and CVE-2025-0577

Message ID 20260927085936.114900-1-peter.marko@siemens.com
State New
Headers show
Series [wrynose,1/8] glibc: set status for CVE-2011-0536 and CVE-2025-0577 | expand

Commit Message

Peter Marko Sept. 27, 2026, 8:59 a.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).

* CVE-2011-0536: CVE desciption says it's related to RedHat patches
* CVE-2025-0577: [1] linked CVE report says it's related to RedHat
  patches and no upstream release is impacted

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2338871

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 85babe3703588b00a03f7087c54440243a993ee5)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 meta/recipes-core/glibc/glibc_2.43.bb | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-core/glibc/glibc_2.43.bb b/meta/recipes-core/glibc/glibc_2.43.bb
index 9f3a3814d0..5c21223b55 100644
--- a/meta/recipes-core/glibc/glibc_2.43.bb
+++ b/meta/recipes-core/glibc/glibc_2.43.bb
@@ -16,6 +16,9 @@  CVE_STATUS[CVE-2019-1010025] = "disputed: \
 Allows for ASLR bypass so can bypass some hardening, not an exploit in itself, may allow \
 easier access for another. 'ASLR bypass itself is not a vulnerability.'"
 
+CVE_STATUS[CVE-2011-0536] = "not-applicable-platform: specific to RHEL patches"
+CVE_STATUS[CVE-2025-0577] = "not-applicable-platform: specific to RHEL patches"
+
 CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
 CVE_STATUS_STABLE_BACKPORTS = "CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 CVE-2026-4437 CVE-2026-4438 \
     CVE-2026-4046 \