diff mbox series

[meta-webserver] nginx: set status for CVE-2026-90439

Message ID 20261002155828.11703-1-peter.marko@siemens.com
State New
Headers show
Series [meta-webserver] nginx: set status for CVE-2026-90439 | expand

Commit Message

Peter Marko Oct. 2, 2026, 3:58 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

CVE information now contains separate version range for mainline and
stable nginx version.
Problem is that mainline version range includes stable verion fix and
since cve-check marks CVE as applicable if one of ranges contains
current recipe version, it's reported as vulnerable.

* Affected 1.29.2 < 1.31.6 (semver) < matches 1.30.5, so false positive
* Affected 1.30.4 < 1.30.5 (semver) < correct fix version, but overridden

Add also a note to remove these explicit entries when new minor stable
version is available which does not fall into the mainline version range
(for all 3 currently explicitly handled CVEs).

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb
index 4dda52c62d..6b638cdd96 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb
@@ -6,5 +6,7 @@  SRC_URI[sha256sum] = "6c20565aa2325cb82216ae804f4a4ff1875179014759a381c42ddc8e11
 
 inherit upstream-version-is-even
 
+# Remove following entries when upgrading recipe to 1.32
 CVE_STATUS[CVE-2026-42055] = "fixed-version: Fixed since 1.30.3"
 CVE_STATUS[CVE-2026-48142] = "fixed-version: Fixed since 1.30.3"
+CVE_STATUS[CVE-2026-90439] = "fixed-version: Fixed since 1.30.5"