diff mbox series

[meta-openembedded,scarthgap] nodejs 20.18.2: ignore CVE-2024-3566

Message ID 20251110031300.3852180-1-adongare@cisco.com
State New
Headers show
Series [meta-openembedded,scarthgap] nodejs 20.18.2: ignore CVE-2024-3566 | expand

Commit Message

Anil Dongare -X (adongare - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 10, 2025, 3:12 a.m. UTC 
From: Anil Dongare <adongare@cisco.com>

Upstream Repository: https://github.com/nodejs/node.git

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-3566
Type: Security Advisory
CVE: CVE-2024-3566
Score: 9.8

Analysis:
- The vulnerability (CVE-2024-3566) affects Windows builds of Node.js where
  applications indirectly depend on the CreateProcess API.
- The issue allows command injection when specific conditions are met within
  that API call sequence.
- This flaw is specific to Windows platforms; Node.js on Linux or UNIX-based
  systems (such as Yocto builds) is not affected because CreateProcess is a
  Windows-only API.

 Reference:
 - https://nvd.nist.gov/vuln/detail/CVE-2024-3566

Signed-off-by: Anil Dongare <adongare@cisco.com>
---
 meta-oe/recipes-devtools/nodejs/nodejs_20.18.2.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta-oe/recipes-devtools/nodejs/nodejs_20.18.2.bb b/meta-oe/recipes-devtools/nodejs/nodejs_20.18.2.bb
index bef62f88eb..9a2841b245 100644
--- a/meta-oe/recipes-devtools/nodejs/nodejs_20.18.2.bb
+++ b/meta-oe/recipes-devtools/nodejs/nodejs_20.18.2.bb
@@ -40,6 +40,8 @@  SRC_URI[sha256sum] = "69bf81b70f3a95ae0763459f02860c282d7e3a47567c8afaf126cc7781
 S = "${WORKDIR}/node-v${PV}"
 
 CVE_PRODUCT += "node.js"
+CVE_STATUS[CVE-2024-3566] = "not-applicable-platform: Issue only applies on Windows"
+
 
 # v8 errors out if you have set CCACHE
 CCACHE = ""