| Message ID | 20261106011324.626292-2-ragaprasanth@gmail.com |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [v2,1/2] zlib: upgrade 1.3.2 -> 1.4 | expand |
zlib recipe version 1.4 does not assert this CVE as unpatched. I think it's not worth to carry patches which just switch patched:fixed-version to patched:cpe-incorrect. Peter > -----Original Message----- > From: Prasanth R <ragaprasanth@gmail.com> > Sent: Friday, November 6, 2026 2:13 AM > To: openembedded-core@lists.openembedded.org > Cc: paul@pbarker.dev; Marko, Peter (FT D EU SK BFS1) > <Peter.Marko@siemens.com>; Prasanth R <ragaprasanth@gmail.com> > Subject: [PATCH v2 2/2] zlib: ignore CVE-2026-76844 > > CVE-2026-76844 is a webpack-dev-middleware CVE. Its record got the zlib > gz_vacate details by mistake; the zlib CVE for that bug is > CVE-2026-85091 [1]. > > [1] https://github.com/madler/zlib/issues/1330 > > AI-Generated: Uses Claude > Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp> > --- > meta/recipes-core/zlib/zlib_1.4.bb | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/meta/recipes-core/zlib/zlib_1.4.bb b/meta/recipes-core/zlib/zlib_1.4.bb > index 18b27df878..2bc1967c0e 100644 > --- a/meta/recipes-core/zlib/zlib_1.4.bb > +++ b/meta/recipes-core/zlib/zlib_1.4.bb > @@ -47,3 +47,5 @@ BBCLASSEXTEND = "native nativesdk" > > # Adding 'CVE_PRODUCT' to avoid false detection of CVEs > CVE_PRODUCT = "zlib:zlib gnu:zlib" > + > +CVE_STATUS[CVE-2026-76844] = "cpe-incorrect: this CVE is for webpack-dev- > middleware, the zlib details were added in error" > -- > 2.34.1
Hi Peter, Makes sense for 1.4. I think we can drop patch 2/2, as patch 1/2 doesn't depend on it. I'll add the CVE_STATUS to the backport branches instead, if needed, there. Thanks, Prasanth On Fri, Nov 6, 2026 at 3:53 PM Marko, Peter <Peter.Marko@siemens.com> wrote: > zlib recipe version 1.4 does not assert this CVE as unpatched. > I think it's not worth to carry patches which just switch > patched:fixed-version to patched:cpe-incorrect. > > Peter > > > -----Original Message----- > > From: Prasanth R <ragaprasanth@gmail.com> > > Sent: Friday, November 6, 2026 2:13 AM > > To: openembedded-core@lists.openembedded.org > > Cc: paul@pbarker.dev; Marko, Peter (FT D EU SK BFS1) > > <Peter.Marko@siemens.com>; Prasanth R <ragaprasanth@gmail.com> > > Subject: [PATCH v2 2/2] zlib: ignore CVE-2026-76844 > > > > CVE-2026-76844 is a webpack-dev-middleware CVE. Its record got the zlib > > gz_vacate details by mistake; the zlib CVE for that bug is > > CVE-2026-85091 [1]. > > > > [1] https://github.com/madler/zlib/issues/1330 > > > > AI-Generated: Uses Claude > > Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp> > > --- > > meta/recipes-core/zlib/zlib_1.4.bb | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/meta/recipes-core/zlib/zlib_1.4.bb > b/meta/recipes-core/zlib/zlib_1.4.bb > > index 18b27df878..2bc1967c0e 100644 > > --- a/meta/recipes-core/zlib/zlib_1.4.bb > > +++ b/meta/recipes-core/zlib/zlib_1.4.bb > > @@ -47,3 +47,5 @@ BBCLASSEXTEND = "native nativesdk" > > > > # Adding 'CVE_PRODUCT' to avoid false detection of CVEs > > CVE_PRODUCT = "zlib:zlib gnu:zlib" > > + > > +CVE_STATUS[CVE-2026-76844] = "cpe-incorrect: this CVE is for > webpack-dev- > > middleware, the zlib details were added in error" > > -- > > 2.34.1 > >
Hi Paul, are you ok with dropping 2/2? Thanks, Prasanth On Fri, Nov 6, 2026 at 5:13 PM Prasanth Ramesh <ragaprasanth@gmail.com> wrote: > Hi Peter, > > Makes sense for 1.4. I think we can drop patch 2/2, as patch 1/2 doesn't > depend on it. > I'll add the CVE_STATUS to the backport branches instead, if needed, there. > > Thanks, > Prasanth > > > On Fri, Nov 6, 2026 at 3:53 PM Marko, Peter <Peter.Marko@siemens.com> > wrote: > >> zlib recipe version 1.4 does not assert this CVE as unpatched. >> I think it's not worth to carry patches which just switch >> patched:fixed-version to patched:cpe-incorrect. >> >> Peter >> >> > -----Original Message----- >> > From: Prasanth R <ragaprasanth@gmail.com> >> > Sent: Friday, November 6, 2026 2:13 AM >> > To: openembedded-core@lists.openembedded.org >> > Cc: paul@pbarker.dev; Marko, Peter (FT D EU SK BFS1) >> > <Peter.Marko@siemens.com>; Prasanth R <ragaprasanth@gmail.com> >> > Subject: [PATCH v2 2/2] zlib: ignore CVE-2026-76844 >> > >> > CVE-2026-76844 is a webpack-dev-middleware CVE. Its record got the zlib >> > gz_vacate details by mistake; the zlib CVE for that bug is >> > CVE-2026-85091 [1]. >> > >> > [1] https://github.com/madler/zlib/issues/1330 >> > >> > AI-Generated: Uses Claude >> > Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp> >> > --- >> > meta/recipes-core/zlib/zlib_1.4.bb | 2 ++ >> > 1 file changed, 2 insertions(+) >> > >> > diff --git a/meta/recipes-core/zlib/zlib_1.4.bb >> b/meta/recipes-core/zlib/zlib_1.4.bb >> > index 18b27df878..2bc1967c0e 100644 >> > --- a/meta/recipes-core/zlib/zlib_1.4.bb >> > +++ b/meta/recipes-core/zlib/zlib_1.4.bb >> > @@ -47,3 +47,5 @@ BBCLASSEXTEND = "native nativesdk" >> > >> > # Adding 'CVE_PRODUCT' to avoid false detection of CVEs >> > CVE_PRODUCT = "zlib:zlib gnu:zlib" >> > + >> > +CVE_STATUS[CVE-2026-76844] = "cpe-incorrect: this CVE is for >> webpack-dev- >> > middleware, the zlib details were added in error" >> > -- >> > 2.34.1 >> >>
On Fri Nov 6, 2026 at 8:28 AM GMT, Prasanth Ramesh wrote: > Hi Paul, > > are you ok with dropping 2/2? Hi Prasanth, https://app.opencve.io/cve/CVE-2026-76844 still shows this as a zlib CVE, but unaffected after v1.3.2. So yes, this can probably be dropped. Hopefully the upstream data will get fixed soon. Best regards,
diff --git a/meta/recipes-core/zlib/zlib_1.4.bb b/meta/recipes-core/zlib/zlib_1.4.bb index 18b27df878..2bc1967c0e 100644 --- a/meta/recipes-core/zlib/zlib_1.4.bb +++ b/meta/recipes-core/zlib/zlib_1.4.bb @@ -47,3 +47,5 @@ BBCLASSEXTEND = "native nativesdk" # Adding 'CVE_PRODUCT' to avoid false detection of CVEs CVE_PRODUCT = "zlib:zlib gnu:zlib" + +CVE_STATUS[CVE-2026-76844] = "cpe-incorrect: this CVE is for webpack-dev-middleware, the zlib details were added in error"
CVE-2026-76844 is a webpack-dev-middleware CVE. Its record got the zlib gz_vacate details by mistake; the zlib CVE for that bug is CVE-2026-85091 [1]. [1] https://github.com/madler/zlib/issues/1330 AI-Generated: Uses Claude Signed-off-by: Prasanth R <prasanth.r@lineo.co.jp> --- meta/recipes-core/zlib/zlib_1.4.bb | 2 ++ 1 file changed, 2 insertions(+)