[meta-oe,v2,00/12] ignore or mark fixed several CVEs

Message ID	20241219204901.347009-1-peter.marko@siemens.com
Headers	show Return-Path: <peter.marko@siemens.com> ip: 185.136.65.225, mailfrom: fm-256628-20241219204950f9f8f89825cec2a0df-gjx_l1@rts-flowmailer.siemens.com) From: Peter Marko <peter.marko@siemens.com> To: openembedded-devel@lists.openembedded.org Cc: Peter Marko <peter.marko@siemens.com> Subject: [meta-oe][PATCH v2 00/12] ignore or mark fixed several CVEs Date: Thu, 19 Dec 2024 21:48:49 +0100 Message-Id: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Feedback-ID: 519:519-256628:519-21489:flowmailer
Series	ignore or mark fixed several CVEs \| expand [meta-oe,v2,00/12] ignore or mark fixed several CVEs [meta-oe,v2,01/12] ace: ignore CVE-2009-1147 [meta-oe,v2,02/12] apache2: ignore CVE-1999-0678 and CVE-1999-1412 [meta-oe,v2,03/12] apache2: remove old version references from CVEs [meta-oe,v2,04/12] spice: ignore CVE-2016-0749 [meta-oe,v2,05/12] gattlib: mark CVE-2019-6498 as fixed [meta-oe,v2,06/12] monkey: ignore CVE-2013-1771 [meta-oe,v2,07/12] redis: ignore CVE-2022-0543 [meta-oe,v2,08/12] spice-gtk: mark CVE-2012-4425 as fixed [meta-oe,v2,09/12] apache2: ignore disputed CVE CVE-2007-0086 [meta-oe,v2,10/12] swagger-ui: mark CVE-2016-1000229 as fixed [meta-oe,v2,11/12] memcached: ignore disputed CVE-2022-26635 [meta-oe,v2,12/12] emlog: set CVE_PRODUCT

Message ID

20241219204901.347009-1-peter.marko@siemens.com

Headers

From: Peter Marko <peter.marko@siemens.com>
To: openembedded-devel@lists.openembedded.org
Cc: Peter Marko <peter.marko@siemens.com>
Subject: [meta-oe][PATCH v2 00/12] ignore or mark fixed several CVEs
Date: Thu, 19 Dec 2024 21:48:49 +0100
Message-Id: <20241219204901.347009-1-peter.marko@siemens.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Feedback-ID: 519:519-256628:519-21489:flowmailer

Series

ignore or mark fixed several CVEs | expand

Message

Marko, Peter Dec. 19, 2024, 8:48 p.m. UTC

This series handles all CVEs in meta-openembedded master report which I
think that can be removed from reports without doing an upgrade or patch.

Peter Marko (12):
  ace: ignore CVE-2009-1147
  apache2: ignore CVE-1999-0678 and CVE-1999-1412
  apache2: remove old version references from CVEs
  spice: ignore CVE-2016-0749
  gattlib: mark CVE-2019-6498 as fixed
  monkey: ignore CVE-2013-1771
  redis: ignore CVE-2022-0543
  spice-gtk: mark CVE-2012-4425 as fixed
  apache2: ignore disputed CVE CVE-2007-0086
  swagger-ui: mark CVE-2016-1000229 as fixed
  memcached: ignore disputed CVE-2022-26635
  emlog: set CVE_PRODUCT

 .../memcached/memcached_1.6.17.bb               |  2 ++
 .../recipes-support/spice/spice-gtk_0.42.bb     |  2 ++
 .../recipes-support/spice/spice_git.bb          |  1 +
 meta-oe/recipes-connectivity/ace/ace_8.0.1.bb   |  2 ++
 .../recipes-connectivity/gattlib/gattlib_git.bb |  2 ++
 meta-oe/recipes-core/emlog/emlog.inc            |  2 ++
 meta-oe/recipes-extended/redis/redis_7.2.6.bb   |  1 +
 .../swagger-ui/swagger-ui_5.18.2.bb             |  2 ++
 .../recipes-httpd/apache2/apache2_2.4.62.bb     | 17 ++++++++++-------
 .../recipes-httpd/monkey/monkey_1.6.9.bb        |  1 +
 10 files changed, 25 insertions(+), 7 deletions(-)