[whinlatter,07/22] zlib: ignore CVE-2026-22184

Message ID	70a80c9ff8662981ff442abf1708f6cd21ce6479.1769845858.git.yoann.congal@smile.fr
State	New
Headers	show Return-Path: <yoann.congal@smile.fr> ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) From: Yoann Congal <yoann.congal@smile.fr> To: openembedded-core@lists.openembedded.org Subject: [OE-core][whinlatter 07/22] zlib: ignore CVE-2026-22184 Date: Sat, 31 Jan 2026 08:56:18 +0100 Message-ID: <70a80c9ff8662981ff442abf1708f6cd21ce6479.1769845858.git.yoann.congal@smile.fr> In-Reply-To: <cover.1769845858.git.yoann.congal@smile.fr> References: <cover.1769845858.git.yoann.congal@smile.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[whinlatter,01/22] oeqa/gitarchive: Fix git push URL parameter \| expand [whinlatter,01/22] oeqa/gitarchive: Fix git push URL parameter [whinlatter,02/22] oeqa/gitarchive: Push tag before copying log files [whinlatter,03/22] scripts/oe-git-archive: Ensure new push parameter is specified [whinlatter,04/22] grub: fix CVE-2025-54770 CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-6… [whinlatter,05/22] mesa: fix build error with llvmpipe gallium driver [whinlatter,06/22] go: upgrade 1.25.5 -> 1.25.6 [whinlatter,07/22] zlib: ignore CVE-2026-22184 [whinlatter,08/22] python3-urllib3: patch CVE-2026-21441 [whinlatter,09/22] libtasn1: Fix CVE-2025-13151 [whinlatter,10/22] glibc: stable 2.42 branch updates [whinlatter,11/22] expat: patch CVE-2026-24515 [whinlatter,12/22] pseudo: Update to 1.9.3 release [whinlatter,13/22] dpkg: Fix ADMINDIR [whinlatter,14/22] docbook-xml-dtd4: fix the fetching failure [whinlatter,15/22] dropbear: patch CVE-2025-14282 [whinlatter,16/22] libtheora: set CVE_PRODUCT [whinlatter,17/22] libpng: upgrade 1.6.53 -> 1.6.54 [whinlatter,18/22] glib-2.0: patch CVE-2026-0988 [whinlatter,19/22] libxml2: patch CVE-2026-0989 [whinlatter,20/22] libxml2: patch CVE-2026-0990 [whinlatter,21/22] binutils: Upgrade to 2.45.1 release [whinlatter,22/22] openssl: upgrade 3.5.4 -> 3.5.5

Message ID

70a80c9ff8662981ff442abf1708f6cd21ce6479.1769845858.git.yoann.congal@smile.fr

State

New

Headers

From: Yoann Congal <yoann.congal@smile.fr>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][whinlatter 07/22] zlib: ignore CVE-2026-22184
Date: Sat, 31 Jan 2026 08:56:18 +0100
Message-ID: 
 <70a80c9ff8662981ff442abf1708f6cd21ce6479.1769845858.git.yoann.congal@smile.fr>
In-Reply-To: <cover.1769845858.git.yoann.congal@smile.fr>
References: <cover.1769845858.git.yoann.congal@smile.fr>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[whinlatter,01/22] oeqa/gitarchive: Fix git push URL parameter | expand

Commit Message

Yoann Congal Jan. 31, 2026, 7:56 a.m. UTC

From: Peter Marko <peter.marko@siemens.com>

This is CVE for example tool contrib/untgz.
This is not compiled in Yocto zlib recipe.

This CVE has controversial CVSS3 score of 9.8.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b0592c51b6ad038d737d2f6b30977bd0c5c50058)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-core/zlib/zlib_1.3.1.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-core/zlib/zlib_1.3.1.bb b/meta/recipes-core/zlib/zlib_1.3.1.bb
index 592b7f14229..ef831421216 100644
--- a/meta/recipes-core/zlib/zlib_1.3.1.bb
+++ b/meta/recipes-core/zlib/zlib_1.3.1.bb
@@ -51,3 +51,5 @@  BBCLASSEXTEND = "native nativesdk"
 
 # Adding 'CVE_PRODUCT' to avoid false detection of CVEs
 CVE_PRODUCT = "zlib:zlib gnu:zlib"
+
+CVE_STATUS[CVE-2026-22184] = "not-applicable-config: vulnerable file is not compiled"

[whinlatter,07/22] zlib: ignore CVE-2026-22184

Commit Message

Patch