diff mbox series

[blacksail] avahi: set status of 10 pre-rc5 CVEs

Message ID 20261112174257.333089-1-peter.marko@siemens.com
State Awaiting Upstream
Delegated to: Yoann Congal
Headers show
Series [blacksail] avahi: set status of 10 pre-rc5 CVEs | expand

Commit Message

Peter Marko Nov. 12, 2026, 5:42 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

New verstion of python3-sbom-cve-check (1.4.0) now correctly interprets
"0.9~rcX" as "<0.9", while previous version just dropped the suffix and
incorrectly treated it as "=0.9".
Unfortunately there is no prerelase (or other suffix) comparison
available, so all CVEs fixed e.g in 0.9~rc1 are evaluated as fixed in
0.9, which does not match version <0.9.

All these CVEs are fixed in RC1..4, while this commit leaves one CVE
which does not have a fix yet still as open in the report.
* rc1: CVE-2023-38469, CVE-2023-38470, CVE-2023-38471, CVE-2023-38472
  and CVE-2023-38473
* rc3: CVE-2025-68276, CVE-2025-68468, CVE-2025-68471, CVE-2026-24401
* rc4: CVE-2026-34933

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 meta/recipes-connectivity/avahi/avahi_0.9.bb | 6 ++++++
 1 file changed, 6 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-connectivity/avahi/avahi_0.9.bb b/meta/recipes-connectivity/avahi/avahi_0.9.bb
index 15189d09063..4f34b29fea3 100644
--- a/meta/recipes-connectivity/avahi/avahi_0.9.bb
+++ b/meta/recipes-connectivity/avahi/avahi_0.9.bb
@@ -32,6 +32,12 @@  SRCREV = "71b640e686964efb27cb708f4457ffaed183c319"
 GITHUB_BASE_URI = "https://github.com/avahi/avahi/releases/"
 
 CVE_STATUS[CVE-2021-26720] = "not-applicable-platform: Issue only affects Debian/SUSE"
+CVE_STATUS_GROUPS += "CVE_STATUS_RC"
+CVE_STATUS_RC = " \
+    CVE-2023-38469 CVE-2023-38470 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473 \
+    CVE-2025-68276 CVE-2025-68468 CVE-2025-68471 CVE-2026-24401 CVE-2026-34933 \
+"
+CVE_STATUS_RC[status] = "fixed-version: fix included in current rc tag"
 
 DEPENDS = "expat libcap libdaemon glib-2.0 glib-2.0-native"