[scarthgap,05/26] gnupg: mark CVE-2025-30258 as patched

Message ID	88fe1eaa4bcd7c838902d8cdc067276c5f32624d.1760733431.git.steve@sakoman.com
State	Accepted
Delegated to:	Steve Sakoman
Headers	show Return-Path: <steve@sakoman.com> ip: 209.85.210.176, mailfrom: steve@sakoman.com) From: Steve Sakoman <steve@sakoman.com> To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 05/26] gnupg: mark CVE-2025-30258 as patched Date: Fri, 17 Oct 2025 13:38:48 -0700 Message-ID: <88fe1eaa4bcd7c838902d8cdc067276c5f32624d.1760733431.git.steve@sakoman.com> In-Reply-To: <cover.1760733431.git.steve@sakoman.com> References: <cover.1760733431.git.steve@sakoman.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[scarthgap,01/26] qemu: patch CVE-2024-8354 \| expand [scarthgap,01/26] qemu: patch CVE-2024-8354 [scarthgap,02/26] python3-xmltodict: fix CVE-2025-9375 [scarthgap,03/26] binutils: patch CVE-2025-11082 [scarthgap,04/26] binutils: patch CVE-2025-11083 [scarthgap,05/26] gnupg: mark CVE-2025-30258 as patched [scarthgap,06/26] glib-networking: fix CVE-2025-60018 [scarthgap,07/26] openssh: fix CVE-2025-61985 [scarthgap,08/26] openssh: fix CVE-2025-61984 [scarthgap,09/26] cmake: fix CVE-2025-9301 [scarthgap,10/26] glib-networking: fix CVE-2025-60019 [scarthgap,11/26] glibc: stable 2.39 branch updates [scarthgap,12/26] linux-yocto/6.6: update to v6.6.98 [scarthgap,13/26] linux-yocto/6.6: update to v6.6.99 [scarthgap,14/26] linux-yocto/6.6: update to v6.6.100 [scarthgap,15/26] linux-yocto/6.6: update to v6.6.101 [scarthgap,16/26] linux-yocto/6.6: update to v6.6.102 [scarthgap,17/26] linux-yocto/6.6: update to v6.6.103 [scarthgap,18/26] linux-yocto/6.6: update to v6.6.106 [scarthgap,19/26] linux-yocto/6.6: update to v6.6.107 [scarthgap,20/26] linux-yocto/6.6: update to v6.6.108 [scarthgap,21/26] linux-yocto/6.6: update to v6.6.109 [scarthgap,22/26] linux-yocto/6.6: update to v6.6.110 [scarthgap,23/26] linux-yocto/6.6: update to v6.6.111 [scarthgap,24/26] python3: upgrade 3.12.11 -> 3.12.12 [scarthgap,25/26] icu: Backport patch to fix build issues with long paths (>512 chars) [scarthgap,26/26] oeqa/runtime/ping: don't bother trying to ping localhost

Message ID

88fe1eaa4bcd7c838902d8cdc067276c5f32624d.1760733431.git.steve@sakoman.com

State

Accepted

Delegated to:

Steve Sakoman

Headers

From: Steve Sakoman <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][scarthgap 05/26] gnupg: mark CVE-2025-30258 as patched
Date: Fri, 17 Oct 2025 13:38:48 -0700
Message-ID: 
 <88fe1eaa4bcd7c838902d8cdc067276c5f32624d.1760733431.git.steve@sakoman.com>
In-Reply-To: <cover.1760733431.git.steve@sakoman.com>
References: <cover.1760733431.git.steve@sakoman.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[scarthgap,01/26] qemu: patch CVE-2024-8354 | expand

Commit Message

Steve Sakoman Oct. 17, 2025, 8:38 p.m. UTC

From: Peter Marko <peter.marko@siemens.com>

Per NVD report [1] this CVE is fixed by [2].
This commit was backported to 2.4.8 via [3].

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-30258
[2] https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158
[3] https://gitlab.com/freepg/gnupg/-/commit/da0164efc7f32013bc24d97b9afa9f8d67c318bb

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-support/gnupg/gnupg_2.4.8.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-support/gnupg/gnupg_2.4.8.bb b/meta/recipes-support/gnupg/gnupg_2.4.8.bb
index 9c5de263c5..a6e777abf8 100644
--- a/meta/recipes-support/gnupg/gnupg_2.4.8.bb
+++ b/meta/recipes-support/gnupg/gnupg_2.4.8.bb
@@ -82,3 +82,4 @@  BBCLASSEXTEND = "native nativesdk"
 lcl_maybe_fortify:mipsarch = ""
 
 CVE_STATUS[CVE-2022-3219] = "upstream-wontfix: Upstream doesn't seem to be keen on merging the proposed commit - https://dev.gnupg.org/T5993"
+CVE_STATUS[CVE-2025-30258] = "cpe-stable-backport: fir for this CVE was backported to version 2.4.8"

[scarthgap,05/26] gnupg: mark CVE-2025-30258 as patched

Commit Message

Patch