ecryptfs-utils: add CVE-2016-1572 to allowlist

Patch for CVE-2016-1572 is applied in version 109.

Signed-off-by: matsunaga-shinji <shin.matsunaga@fujitsu.com>
---
 recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb | 3 +++
 1 file changed, 3 insertions(+)

I guess this belongs to meta-security, please prefix the patch subject
with layer name [meta-security] in this case.

On Thu, Mar 10, 2022 at 8:14 PM Matsunaga-Shinji
<shin.matsunaga@fujitsu.com> wrote:
>
> Patch for CVE-2016-1572 is applied in version 109.
>
> Signed-off-by: matsunaga-shinji <shin.matsunaga@fujitsu.com>
> ---
>  recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> index 9aefc32..d98724c 100644
> --- a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> +++ b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> @@ -68,3 +68,6 @@ FILES:${PN} += "${base_libdir}/security/* ${base_libdir}/ecryptfs/*"
>
>  RDEPENDS:${PN} += "cryptsetup"
>  RRECOMMENDS:${PN} = "gettext-runtime"
> +
> +# Patch for CVE-2016-1572 is applied in version 109.
> +CVE_CHECK_IGNORE += "CVE-2016-1572"
> --
> 2.25.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#95945): https://lists.openembedded.org/g/openembedded-devel/message/95945
> Mute This Topic: https://lists.openembedded.org/mt/89704285/1997914
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

On Fri, Mar 11, 2022, 05:14 Matsunaga-Shinji <shin.matsunaga@fujitsu.com>
wrote:

> Patch for CVE-2016-1572 is applied in version 109.
>
> Signed-off-by: matsunaga-shinji <shin.matsunaga@fujitsu.com>
> ---
>  recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> index 9aefc32..d98724c 100644
> --- a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> +++ b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> @@ -68,3 +68,6 @@ FILES:${PN} += "${base_libdir}/security/*
> ${base_libdir}/ecryptfs/*"
>
>  RDEPENDS:${PN} += "cryptsetup"
>  RRECOMMENDS:${PN} = "gettext-runtime"
> +
> +# Patch for CVE-2016-1572 is applied in version 109.
> +CVE_CHECK_IGNORE += "CVE-2016-1572"
>

Wouldn't it be better to report this to the NVD and do the fix in the
database instead?

Regards
Marta

>

Thank you for your comment.

When I sent a mail to NVD about a database modification request, this has been approved.

NVD has made the appropriate modifications to reflect that the affected versions are up to (excluding) 109.

So we can confirm that the website has changed. The same is the data feeds.
https://nvd.nist.gov/vuln/detail/CVE-2016-1572

Regards
Shinji


From: Marta Rybczynska <rybczynska@gmail.com>
Sent: Friday, March 11, 2022 2:27 PM
To: Matsunaga, Shinji/松永 慎司 <shin.matsunaga@fujitsu.com>
Cc: OpenEmbedded Devel List <openembedded-devel@lists.openembedded.org>
Subject: Re: [oe] [PATCH] ecryptfs-utils: add CVE-2016-1572 to allowlist


On Fri, Mar 11, 2022, 05:14 Matsunaga-Shinji <shin.matsunaga@fujitsu.com<mailto:shin.matsunaga@fujitsu.com>> wrote:
Patch for CVE-2016-1572 is applied in version 109.

Signed-off-by: matsunaga-shinji <shin.matsunaga@fujitsu.com<mailto:shin.matsunaga@fujitsu.com>>
---
 recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb>
index 9aefc32..d98724c 100644
--- a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb>
+++ b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb>
@@ -68,3 +68,6 @@ FILES:${PN} += "${base_libdir}/security/* ${base_libdir}/ecryptfs/*"

 RDEPENDS:${PN} += "cryptsetup"
 RRECOMMENDS:${PN} = "gettext-runtime"
+
+# Patch for CVE-2016-1572 is applied in version 109.
+CVE_CHECK_IGNORE += "CVE-2016-1572"

Wouldn't it be better to report this to the NVD and do the fix in the database instead?

Regards
Marta