[whinlatter,v2,06/22] zlib: ignore CVE-2026-22184

Message ID	583076ca73722543c358f97a7e476ab3e8a15437.1770109549.git.yoann.congal@smile.fr
State	New
Headers	show Return-Path: <yoann.congal@smile.fr> ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) From: Yoann Congal <yoann.congal@smile.fr> To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter v2 06/22] zlib: ignore CVE-2026-22184 Date: Tue, 3 Feb 2026 11:16:35 +0100 Message-ID: <583076ca73722543c358f97a7e476ab3e8a15437.1770109549.git.yoann.congal@smile.fr> In-Reply-To: <cover.1770109549.git.yoann.congal@smile.fr> References: <cover.1770109549.git.yoann.congal@smile.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[whinlatter,v2,01/22] oeqa/gitarchive: Fix git push URL parameter \| expand [whinlatter,v2,01/22] oeqa/gitarchive: Fix git push URL parameter [whinlatter,v2,02/22] oeqa/gitarchive: Push tag before copying log files [whinlatter,v2,03/22] scripts/oe-git-archive: Ensure new push parameter is specified [whinlatter,v2,04/22] grub: fix CVE-2025-54770 CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-202… [whinlatter,v2,05/22] go: upgrade 1.25.5 -> 1.25.6 [whinlatter,v2,06/22] zlib: ignore CVE-2026-22184 [whinlatter,v2,07/22] python3-urllib3: patch CVE-2026-21441 [whinlatter,v2,08/22] libtasn1: Fix CVE-2025-13151 [whinlatter,v2,09/22] glibc: stable 2.42 branch updates [whinlatter,v2,10/22] pseudo: Update to 1.9.3 release [whinlatter,v2,11/22] dpkg: Fix ADMINDIR [whinlatter,v2,12/22] docbook-xml-dtd4: fix the fetching failure [whinlatter,v2,13/22] dropbear: patch CVE-2025-14282 [whinlatter,v2,14/22] libtheora: set CVE_PRODUCT [whinlatter,v2,15/22] libpng: upgrade 1.6.53 -> 1.6.54 [whinlatter,v2,16/22] glib-2.0: patch CVE-2026-0988 [whinlatter,v2,17/22] libxml2: patch CVE-2026-0989 [whinlatter,v2,18/22] libxml2: patch CVE-2026-0990 [whinlatter,v2,19/22] libxml2: patch CVE-2026-0992 [whinlatter,v2,20/22] libxml2: add follow-up patch for CVE-2026-0992 [whinlatter,v2,21/22] expat: upgrade 2.7.3 -> 2.7.4 [whinlatter,v2,22/22] inetutils: patch CVE-2026-24061

Message ID

583076ca73722543c358f97a7e476ab3e8a15437.1770109549.git.yoann.congal@smile.fr

State

New

Headers

From: Yoann Congal <yoann.congal@smile.fr>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][whinlatter v2 06/22] zlib: ignore CVE-2026-22184
Date: Tue,  3 Feb 2026 11:16:35 +0100
Message-ID: 
 <583076ca73722543c358f97a7e476ab3e8a15437.1770109549.git.yoann.congal@smile.fr>
In-Reply-To: <cover.1770109549.git.yoann.congal@smile.fr>
References: <cover.1770109549.git.yoann.congal@smile.fr>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[whinlatter,v2,01/22] oeqa/gitarchive: Fix git push URL parameter | expand

Commit Message

Yoann Congal Feb. 3, 2026, 10:16 a.m. UTC

From: Peter Marko <peter.marko@siemens.com>

This is CVE for example tool contrib/untgz.
This is not compiled in Yocto zlib recipe.

This CVE has controversial CVSS3 score of 9.8.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b0592c51b6ad038d737d2f6b30977bd0c5c50058)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-core/zlib/zlib_1.3.1.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-core/zlib/zlib_1.3.1.bb b/meta/recipes-core/zlib/zlib_1.3.1.bb
index 592b7f14229..ef831421216 100644
--- a/meta/recipes-core/zlib/zlib_1.3.1.bb
+++ b/meta/recipes-core/zlib/zlib_1.3.1.bb
@@ -51,3 +51,5 @@  BBCLASSEXTEND = "native nativesdk"
 
 # Adding 'CVE_PRODUCT' to avoid false detection of CVEs
 CVE_PRODUCT = "zlib:zlib gnu:zlib"
+
+CVE_STATUS[CVE-2026-22184] = "not-applicable-config: vulnerable file is not compiled"

[whinlatter,v2,06/22] zlib: ignore CVE-2026-22184

Commit Message

Patch