diff mbox series

[blacksail,37/60] nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629

Message ID ac8179c9b1737817ad2404645f489a2e1a1288ba.1793161233.git.ankur.tyagi85@gmail.com
State New
Headers show
Series [blacksail,01/60] zeroconf: ignore CVEs | expand

Commit Message

Ankur Tyagi Oct. 28, 2026, 4:23 a.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

These CVEs are fixed in latest release however still show-up in open
CVE reports. Reason is that the DB contains entries:
  {
    "lessThan": "*",
    "status": "affected",
    "version": "1.23.3",
    "versionType": "custom"
  }

Which should mean that the first affected release is 1.23.3, however
without the upper limit it will match all higher releases.
The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it
works by flagging CVEs where at least one version match is present.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 959f4c8f098a90c24a818831a5e3dd8090cee641)
Tested-by: Mohammad Abdoli <mominux@gmail.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
index 5d699e63ce..73204da558 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
@@ -6,6 +6,9 @@  SRC_URI[sha256sum] = "3cf46f5ed7504d460125866b7bea99fb357f31d887e2e63b35503310e9
 
 inherit upstream-version-is-even
 
+CVE_STATUS[CVE-2026-95101] = "fixed-version: Fixed since 1.30.6"
+CVE_STATUS[CVE-2026-97629] = "fixed-version: Fixed since 1.30.6"
+
 # Remove following entries when upgrading recipe to 1.32
 CVE_STATUS[CVE-2026-42055] = "fixed-version: Fixed since 1.30.3"
 CVE_STATUS[CVE-2026-48142] = "fixed-version: Fixed since 1.30.3"