| Message ID | 52cbace519c5d490a83550d7baa1c0fa200eafcb.1770626074.git.yoann.congal@smile.fr |
|---|---|
| State | RFC |
| Delegated to: | Yoann Congal |
| Headers | show |
| Series | [scarthgap,01/25] curl: fix CVE-2025-10148 | expand |
On Mon, 2026-02-09 at 10:28 +0100, Yoann Congal via lists.openembedded.org wrote: > From: Peter Marko <peter.marko@siemens.com> > > This is CVE for example tool contrib/untgz. > This is not compiled in Yocto zlib recipe. > > This CVE has controversial CVSS3 score of 9.8. > > Signed-off-by: Peter Marko <peter.marko@siemens.com> > Signed-off-by: Yoann Congal <yoann.congal@smile.fr> > --- > meta/recipes-core/zlib/zlib_1.3.1.bb | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/meta/recipes-core/zlib/zlib_1.3.1.bb b/meta/recipes-core/zlib/zlib_1.3.1.bb > index e6a81ef7898..8ebc6befc2b 100644 > --- a/meta/recipes-core/zlib/zlib_1.3.1.bb > +++ b/meta/recipes-core/zlib/zlib_1.3.1.bb > @@ -48,3 +48,4 @@ BBCLASSEXTEND = "native nativesdk" > > CVE_STATUS[CVE-2023-45853] = "not-applicable-config: we don't build minizip" > CVE_STATUS[CVE-2023-6992] = "cpe-incorrect: this CVE is for cloudflare zlib" > +CVE_STATUS[CVE-2026-22184] = "not-applicable-config: vulnerable file is not compiled" I think we should consider backporting 119b775b36df ("zlib: Add CVE_PRODUCT to exclude false positives") and the relevant bits of 73ee9789183a ("recipes: cleanup CVE_STATUS which are resolved now"), then we can cherry-pick b0592c51b6ad from master. Best regards,
On Mon Feb 9, 2026 at 11:49 AM CET, Paul Barker wrote: > On Mon, 2026-02-09 at 10:28 +0100, Yoann Congal via > lists.openembedded.org wrote: >> From: Peter Marko <peter.marko@siemens.com> >> >> This is CVE for example tool contrib/untgz. >> This is not compiled in Yocto zlib recipe. >> >> This CVE has controversial CVSS3 score of 9.8. >> >> Signed-off-by: Peter Marko <peter.marko@siemens.com> >> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> >> --- >> meta/recipes-core/zlib/zlib_1.3.1.bb | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/meta/recipes-core/zlib/zlib_1.3.1.bb b/meta/recipes-core/zlib/zlib_1.3.1.bb >> index e6a81ef7898..8ebc6befc2b 100644 >> --- a/meta/recipes-core/zlib/zlib_1.3.1.bb >> +++ b/meta/recipes-core/zlib/zlib_1.3.1.bb >> @@ -48,3 +48,4 @@ BBCLASSEXTEND = "native nativesdk" >> >> CVE_STATUS[CVE-2023-45853] = "not-applicable-config: we don't build minizip" >> CVE_STATUS[CVE-2023-6992] = "cpe-incorrect: this CVE is for cloudflare zlib" >> +CVE_STATUS[CVE-2026-22184] = "not-applicable-config: vulnerable file is not compiled" > > I think we should consider backporting 119b775b36df ("zlib: Add > CVE_PRODUCT to exclude false positives") and the relevant bits of > 73ee9789183a ("recipes: cleanup CVE_STATUS which are resolved now"), > then we can cherry-pick b0592c51b6ad from master. Since everything is in whinlatter, I've done that: 3 commits at https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/scarthgap-nut&id=ee55482f572f13b7194baa0eabc771ceef275a4b > > Best regards,
diff --git a/meta/recipes-core/zlib/zlib_1.3.1.bb b/meta/recipes-core/zlib/zlib_1.3.1.bb index e6a81ef7898..8ebc6befc2b 100644 --- a/meta/recipes-core/zlib/zlib_1.3.1.bb +++ b/meta/recipes-core/zlib/zlib_1.3.1.bb @@ -48,3 +48,4 @@ BBCLASSEXTEND = "native nativesdk" CVE_STATUS[CVE-2023-45853] = "not-applicable-config: we don't build minizip" CVE_STATUS[CVE-2023-6992] = "cpe-incorrect: this CVE is for cloudflare zlib" +CVE_STATUS[CVE-2026-22184] = "not-applicable-config: vulnerable file is not compiled"