[meta-oe,11/12] memcached: ignore disputed CVE-2022-26635

Message ID	20241219202738.346121-12-peter.marko@siemens.com
State	New
Headers	show Return-Path: <peter.marko@siemens.com> ip: 185.136.65.225, mailfrom: fm-256628-20241219202916875f3f728104897ef1-x_q2nt@rts-flowmailer.siemens.com) From: Peter Marko <peter.marko@siemens.com> To: openembedded-devel@lists.openembedded.org Cc: Peter Marko <peter.marko@siemens.com> Subject: [meta-oe][PATCH 11/12] memcached: ignore disputed CVE-2022-26635 Date: Thu, 19 Dec 2024 21:27:37 +0100 Message-Id: <20241219202738.346121-12-peter.marko@siemens.com> In-Reply-To: <20241219202738.346121-1-peter.marko@siemens.com> References: <20241219202738.346121-1-peter.marko@siemens.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Feedback-ID: 519:519-256628:519-21489:flowmailer
Series	ignore or mark fixed several CVEs \| expand [meta-oe,00/12] ignore or mark fixed several CVEs [meta-oe,01/12] ace: ignore CVE-2009-1147 [meta-oe,02/12] apache2: ignore CVE-1999-0678 and CVE-1999-1412 [meta-oe,03/12] apache2: remove old version references from CVEs [meta-oe,04/12] spice: ignore CVE-2016-0749 [meta-oe,05/12] gattlib: mark CVE-2019-6498 as fixed [meta-oe,06/12] monkey: ignore CVE-2013-1771 [meta-oe,07/12] redis: ignore CVE-2022-0543 [meta-oe,08/12] spice-gtk: mark CVE-2012-4425 as fixed [meta-oe,09/12] apache2: ignore disputed CVE CVE-2007-0086 [meta-oe,10/12] swagger-ui: mark CVE-2016-1000229 as fixed [meta-oe,11/12] memcached: ignore disputed CVE-2022-26635 [meta-oe,12/12] emlog: set CVE_PRODUCT

Message ID

20241219202738.346121-12-peter.marko@siemens.com

State

New

Headers

From: Peter Marko <peter.marko@siemens.com>
To: openembedded-devel@lists.openembedded.org
Cc: Peter Marko <peter.marko@siemens.com>
Subject: [meta-oe][PATCH 11/12] memcached: ignore disputed CVE-2022-26635
Date: Thu, 19 Dec 2024 21:27:37 +0100
Message-Id: <20241219202738.346121-12-peter.marko@siemens.com>
In-Reply-To: <20241219202738.346121-1-peter.marko@siemens.com>
References: <20241219202738.346121-1-peter.marko@siemens.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Feedback-ID: 519:519-256628:519-21489:flowmailer

Series

ignore or mark fixed several CVEs | expand

Commit Message

Marko, Peter Dec. 19, 2024, 8:27 p.m. UTC

From: Peter Marko <peter.marko@siemens.com>

Per [1] this is a problem of applications using memcached inproperly.

This should not be a CVE against php-memcached, but for whatever
software the issue was actually found in. php-memcached and
libmemcached provide a VERIFY_KEY flag if they're too lazy to
filter untrusted user input.

[1] https://github.com/php-memcached-dev/php-memcached/issues/519

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 meta-networking/recipes-support/memcached/memcached_1.6.17.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-networking/recipes-support/memcached/memcached_1.6.17.bb b/meta-networking/recipes-support/memcached/memcached_1.6.17.bb
index 270ad5486d..7234f02a13 100644
--- a/meta-networking/recipes-support/memcached/memcached_1.6.17.bb
+++ b/meta-networking/recipes-support/memcached/memcached_1.6.17.bb
@@ -25,6 +25,8 @@  SRC_URI = "http://www.memcached.org/files/${BP}.tar.gz \
            "
 SRC_URI[sha256sum] = "2055e373613d8fc21529aff9f0adce3e23b9ce01ba0478d30e7941d9f2bd1224"
 
+CVE_STATUS[CVE-2022-26635] = "disputed: this is a problem of applications using php-memcached inproperly"
+
 # set the same COMPATIBLE_HOST as libhugetlbfs
 COMPATIBLE_HOST = "(i.86|x86_64|powerpc|powerpc64|aarch64|arm).*-linux*"

[meta-oe,11/12] memcached: ignore disputed CVE-2022-26635

Commit Message

Patch