[meta-networking,3/28] dovecot: ignore already fixed CVEs

Message ID	20261012001007.2541673-3-ankur.tyagi85@gmail.com
State	New
Headers	show Return-Path: <ankur.tyagi85@gmail.com> ip: 209.85.216.52, mailfrom: ankur.tyagi85@gmail.com) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi <ankur.tyagi85@gmail.com>, Anuj Mittal <anuj.mittal@oss.qualcomm.com> Subject: [oe][meta-networking][PATCH 3/28] dovecot: ignore already fixed CVEs Date: Mon, 12 Oct 2026 13:09:41 +1300 Message-ID: <20261012001007.2541673-3-ankur.tyagi85@gmail.com> In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[meta-oe,1/28] capnproto: ignore CVE-2026-59704 \| expand [meta-oe,1/28] capnproto: ignore CVE-2026-59704 [meta-networking,2/28] civetweb: ignore CVE-2026-5789 [meta-networking,3/28] dovecot: ignore already fixed CVEs [meta-oe,4/28] eject: ignore CVE-2026-28065 [meta-oe,5/28] gpsd: patch CVE-2026-58459 [meta-oe,6/28] bcc: correct CVE_PRODUCT mapping [meta-oe,7/28] dool: patch CVE-2026-56651 [meta-oe,8/28] dool: patch CVE-2026-56652 [meta-oe,9/28] haveged: ignore CVE-2026-41054 [meta-oe,10/28] gpm: ignore CVE-2025-4558 [meta-multimedia,11/28] gerbera: ignore CVE-2025-23386 [meta-oe,12/28] iniparser: mark CVE-2025-0633 pached [meta-networking,13/28] wolfssl: mark CVEs patched [meta-python,14/28] python3-gunicorn: mark CVE-2024-1135 patched [meta-multimedia,15/28] libde265: patch CVE-2026-49295 [meta-multimedia,16/28] libde265: patch CVE-2026-49337 [meta-multimedia,17/28] libde265: patch CVE-2026-49346 [meta-multimedia,18/28] libde265: patch CVE-2026-54240 and CVE-2026-54241 [meta-oe,19/28] hdf5: patch CVE-2026-17572 [meta-oe,20/28] hdf5: patch CVE-2026-17573 [meta-oe,21/28] hdf5: patch CVE-2026-17574 [meta-oe,22/28] hdf5: patch CVE-2026-19025 [meta-networking,23/28] libiec61850: mark CVE-2024-45969 patched [meta-networking,24/28] miniupnpd: patch CVE-2026-107159 [meta-oe,25/28] libyang: patch CVE-2026-41401 [meta-networking,26/28] tinyproxy: patch CVE-2026-31842 [meta-networking,27/28] tinyproxy: patch CVE-2026-54387 [meta-networking,28/28] tinyproxy: patch CVE-2026-55202

Message ID

20261012001007.2541673-3-ankur.tyagi85@gmail.com

State

New

Headers

From: ankur.tyagi85@gmail.com
To: openembedded-devel@lists.openembedded.org
Cc: Ankur Tyagi <ankur.tyagi85@gmail.com>,
	Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Subject: [oe][meta-networking][PATCH 3/28] dovecot: ignore already fixed CVEs
Date: Mon, 12 Oct 2026 13:09:41 +1300
Message-ID: <20261012001007.2541673-3-ankur.tyagi85@gmail.com>
In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com>
References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[meta-oe,1/28] capnproto: ignore CVE-2026-59704 | expand

Commit Message

Ankur Tyagi Oct. 12, 2026, 12:09 a.m. UTC

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Upstream has confirmed that these vulnerabilities are fixed,
and Debian has also identified the relevant commits:

CVE-2025-59028: https://security-tracker.debian.org/tracker/CVE-2025-59028
CVE-2025-59032: https://security-tracker.debian.org/tracker/CVE-2025-59032
CVE-2026-27859: https://security-tracker.debian.org/tracker/CVE-2026-27859
CVE-2026-27851: https://security-tracker.debian.org/tracker/CVE-2026-27851
CVE-2026-33603: https://security-tracker.debian.org/tracker/CVE-2026-33603
CVE-2026-40016: https://security-tracker.debian.org/tracker/CVE-2026-40016
CVE-2026-40020: https://security-tracker.debian.org/tracker/CVE-2026-40020
CVE-2026-42006: https://security-tracker.debian.org/tracker/CVE-2026-42006

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 86a9ad852a7180edf8b03fca7d0a69e9f1d9e550)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb b/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb
index 993453eaa30..06e6ee39fa3 100644
--- a/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb
+++ b/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb
@@ -89,3 +89,11 @@  CVE_STATUS[CVE-2026-0394] = "fixed-version: fixed since v2.4.1"
 CVE_STATUS[CVE-2026-24031] = "fixed-version: fixed since v2.4.3"
 CVE_STATUS[CVE-2026-27855] = "fixed-version: fixed since v2.4.3"
 CVE_STATUS[CVE-2026-27860] = "fixed-version: fixed since v2.4.3"
+CVE_STATUS[CVE-2025-59028] = "fixed-version: fixed since v2.4.3"
+CVE_STATUS[CVE-2025-59032] = "fixed-version: fixed since v2.4.3"
+CVE_STATUS[CVE-2026-27859] = "fixed-version: fixed since v2.4.3"
+CVE_STATUS[CVE-2026-27851] = "fixed-version: fixed in v2.4.4"
+CVE_STATUS[CVE-2026-33603] = "fixed-version: fixed in v2.4.4"
+CVE_STATUS[CVE-2026-40016] = "fixed-version: fixed in v2.4.4"
+CVE_STATUS[CVE-2026-40020] = "fixed-version: fixed in v2.4.4"
+CVE_STATUS[CVE-2026-42006] = "fixed-version: fixed in v2.4.4"

[meta-networking,3/28] dovecot: ignore already fixed CVEs

Commit Message

Patch