diff mbox series

[meta-webserver] nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629

Message ID 20261015214631.3943220-1-peter.marko@siemens.com
State Under Review
Headers show
Series [meta-webserver] nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629 | expand

Commit Message

Peter Marko Oct. 15, 2026, 9:46 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

These CVEs are fixed in latest release however still show-up in open
CVE reports. Reason is that the DB contains entries:
  {
    "lessThan": "*",
    "status": "affected",
    "version": "1.23.3",
    "versionType": "custom"
  }

Which should mean that the first affected release is 1.23.3, however
without the upper limit it will match all higher releases.
The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it
works by flagging CVEs where at least one version match is present.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
index 5d699e63ce..73204da558 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
@@ -6,6 +6,9 @@  SRC_URI[sha256sum] = "3cf46f5ed7504d460125866b7bea99fb357f31d887e2e63b35503310e9
 
 inherit upstream-version-is-even
 
+CVE_STATUS[CVE-2026-95101] = "fixed-version: Fixed since 1.30.6"
+CVE_STATUS[CVE-2026-97629] = "fixed-version: Fixed since 1.30.6"
+
 # Remove following entries when upgrading recipe to 1.32
 CVE_STATUS[CVE-2026-42055] = "fixed-version: Fixed since 1.30.3"
 CVE_STATUS[CVE-2026-48142] = "fixed-version: Fixed since 1.30.3"