[meta-oe,styhead,07/24] dash: set CVE_PRODUCT

Message ID	20250105232358.1502946-7-akuster808@gmail.com
State	New
Headers	show Return-Path: <akuster808@gmail.com> ip: 209.85.219.175, mailfrom: akuster808@gmail.com) From: Armin Kuster <akuster808@gmail.com> To: openembedded-devel@lists.openembedded.org Cc: Peter Marko <peter.marko@siemens.com>, Khem Raj <raj.khem@gmail.com> Subject: [meta-oe][styhead][PATCH 07/24] dash: set CVE_PRODUCT Date: Sun, 5 Jan 2025 18:23:40 -0500 Message-ID: <20250105232358.1502946-7-akuster808@gmail.com> In-Reply-To: <20250105232358.1502946-1-akuster808@gmail.com> References: <20250105232358.1502946-1-akuster808@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[meta-oe,styhead,01/24] abseil-cpp: Do not leak -Wnon-virtual-dtor into the .pc files \| expand [meta-oe,styhead,01/24] abseil-cpp: Do not leak -Wnon-virtual-dtor into the .pc files [meta-oe,styhead,02/24] mariadb: Fix build with clang-20/trunk [meta-oe,styhead,03/24] mariadb: Ensure compatibility with ARMv9 by updating .arch directive [meta-oe,styhead,04/24] proftpd: set status of CVE-2001-0027 [meta-oe,styhead,05/24] wireshark: use inherit_defer for conditional cases [meta-oe,styhead,06/24] ntfs-3g-ntfsprogs: fix CVE-2023-52890 [meta-oe,styhead,07/24] dash: set CVE_PRODUCT [meta-oe,styhead,09/24] bridge-utils: add CVE_PRODUCT [meta-oe,styhead,10/24] ace: ignore CVE-2009-1147 [meta-oe,styhead,11/24] nginx: Upgrade mainline release version 1.27.1 -> 1.27.3 [meta-oe,styhead,12/24] apache2: ignore CVE-1999-0678 and CVE-1999-1412 [meta-oe,styhead,13/24] apache2: remove old version references from CVEs [meta-oe,styhead,14/24] spice: ignore CVE-2016-0749 [meta-oe,styhead,15/24] gattlib: mark CVE-2019-6498 as fixed [meta-oe,styhead,16/24] monkey: ignore CVE-2013-1771 [meta-oe,styhead,17/24] redis: ignore CVE-2022-0543 [meta-oe,styhead,18/24] spice-gtk: mark CVE-2012-4425 as fixed [meta-oe,styhead,19/24] apache2: ignore disputed CVE CVE-2007-0086 [meta-oe,styhead,20/24] memcached: ignore disputed CVE-2022-26635 [meta-oe,styhead,21/24] emlog: set CVE_PRODUCT [meta-oe,styhead,22/24] postgresql: upgrade 16.4 -> 16.5 [meta-oe,styhead,23/24] php: upgrade 8.2.20 -> 8.2.26 [meta-oe,styhead,24/24] wireshark: upgrade 4.2.8 -> 4.2.9

Message ID

20250105232358.1502946-7-akuster808@gmail.com

State

New

Headers

From: Armin Kuster <akuster808@gmail.com>
To: openembedded-devel@lists.openembedded.org
Cc: Peter Marko <peter.marko@siemens.com>,
	Khem Raj <raj.khem@gmail.com>
Subject: [meta-oe][styhead][PATCH 07/24] dash: set CVE_PRODUCT
Date: Sun,  5 Jan 2025 18:23:40 -0500
Message-ID: <20250105232358.1502946-7-akuster808@gmail.com>
In-Reply-To: <20250105232358.1502946-1-akuster808@gmail.com>
References: <20250105232358.1502946-1-akuster808@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[meta-oe,styhead,01/24] abseil-cpp: Do not leak -Wnon-virtual-dtor into the .pc files | expand

Commit Message

akuster808 Jan. 5, 2025, 11:23 p.m. UTC

From: Peter Marko <peter.marko@siemens.com>

This removes false positive CVE-2024-21485 from cve reports.

$ sqlite3 nvdcve_2-2.db
sqlite> select * from products where product = 'dash';
CVE-2009-0854|dash|dash|0.5.4|=||
CVE-2024-21485|plotly|dash|||2.13.0|<
CVE-2024-21485|plotly|dash|2.14.0|>=|2.15.0|<

Our dash:dash did not reach major version 1 yet.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e1427013e01df44b9275908f7605e8e25fc3fd83)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 meta-oe/recipes-shells/dash/dash_0.5.12.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-oe/recipes-shells/dash/dash_0.5.12.bb b/meta-oe/recipes-shells/dash/dash_0.5.12.bb
index 947ef702d7..1bf3625760 100644
--- a/meta-oe/recipes-shells/dash/dash_0.5.12.bb
+++ b/meta-oe/recipes-shells/dash/dash_0.5.12.bb
@@ -10,6 +10,8 @@  inherit autotools update-alternatives
 SRC_URI = "http://gondor.apana.org.au/~herbert/${BPN}/files/${BP}.tar.gz"
 SRC_URI[sha256sum] = "6a474ac46e8b0b32916c4c60df694c82058d3297d8b385b74508030ca4a8f28a"
 
+CVE_PRODUCT = "dash:dash"
+
 EXTRA_OECONF += "--bindir=${base_bindir}"
 
 ALTERNATIVE:${PN} = "sh"

[meta-oe,styhead,07/24] dash: set CVE_PRODUCT

Commit Message

Patch