[meta-oe,v2,04/12] spice: ignore CVE-2016-0749

Message ID	20241219204901.347009-5-peter.marko@siemens.com
State	Under Review
Headers	show Return-Path: <peter.marko@siemens.com> ip: 185.136.64.226, mailfrom: fm-256628-20241219205004c6bcffc7f20ca977d4-mt_6uh@rts-flowmailer.siemens.com) From: Peter Marko <peter.marko@siemens.com> To: openembedded-devel@lists.openembedded.org Cc: Peter Marko <peter.marko@siemens.com> Subject: [meta-oe][PATCH v2 04/12] spice: ignore CVE-2016-0749 Date: Thu, 19 Dec 2024 21:48:53 +0100 Message-Id: <20241219204901.347009-5-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Feedback-ID: 519:519-256628:519-21489:flowmailer
Series	ignore or mark fixed several CVEs \| expand [meta-oe,v2,00/12] ignore or mark fixed several CVEs [meta-oe,v2,01/12] ace: ignore CVE-2009-1147 [meta-oe,v2,02/12] apache2: ignore CVE-1999-0678 and CVE-1999-1412 [meta-oe,v2,03/12] apache2: remove old version references from CVEs [meta-oe,v2,04/12] spice: ignore CVE-2016-0749 [meta-oe,v2,05/12] gattlib: mark CVE-2019-6498 as fixed [meta-oe,v2,06/12] monkey: ignore CVE-2013-1771 [meta-oe,v2,07/12] redis: ignore CVE-2022-0543 [meta-oe,v2,08/12] spice-gtk: mark CVE-2012-4425 as fixed [meta-oe,v2,09/12] apache2: ignore disputed CVE CVE-2007-0086 [meta-oe,v2,10/12] swagger-ui: mark CVE-2016-1000229 as fixed [meta-oe,v2,11/12] memcached: ignore disputed CVE-2022-26635 [meta-oe,v2,12/12] emlog: set CVE_PRODUCT

Message ID

20241219204901.347009-5-peter.marko@siemens.com

State

Under Review

Headers

From: Peter Marko <peter.marko@siemens.com>
To: openembedded-devel@lists.openembedded.org
Cc: Peter Marko <peter.marko@siemens.com>
Subject: [meta-oe][PATCH v2 04/12] spice: ignore CVE-2016-0749
Date: Thu, 19 Dec 2024 21:48:53 +0100
Message-Id: <20241219204901.347009-5-peter.marko@siemens.com>
In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com>
References: <20241219204901.347009-1-peter.marko@siemens.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Feedback-ID: 519:519-256628:519-21489:flowmailer

Series

ignore or mark fixed several CVEs | expand

Commit Message

Marko, Peter Dec. 19, 2024, 8:48 p.m. UTC

From: Peter Marko <peter.marko@siemens.com>

NVD tracks this as version-less CVE for spice.
It was fixed by [1] and [2] included in 0.13.2.

[1] https://gitlab.freedesktop.org/spice/spice/-/commit/6b32af3e1746988bb5a5123263bcf61b65e5be7e
[2] https://gitlab.freedesktop.org/spice/spice/-/commit/359ac42a7ac02dcd1013757559292006647cd5c4

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 meta-networking/recipes-support/spice/spice_git.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta-networking/recipes-support/spice/spice_git.bb b/meta-networking/recipes-support/spice/spice_git.bb
index 419316a26e..5e6d8584e3 100644
--- a/meta-networking/recipes-support/spice/spice_git.bb
+++ b/meta-networking/recipes-support/spice/spice_git.bb
@@ -21,6 +21,7 @@  SRC_URI = "gitsm://gitlab.freedesktop.org/spice/spice;branch=master;protocol=htt
 
 S = "${WORKDIR}/git"
 
+CVE_STATUS[CVE-2016-0749] = "fixed-version: patched since 0.13.2"
 CVE_STATUS[CVE-2018-10893] = "fixed-version: patched already, caused by inaccurate CPE in the NVD database."
 
 inherit meson gettext python3native python3-dir pkgconfig

[meta-oe,v2,04/12] spice: ignore CVE-2016-0749

Commit Message

Patch