diff mbox series

[meta-lts-mixins,scarthgap/go,2/7] go: set status for CVE-2024-24786

Message ID 20260513170902.2468061-2-peter.marko@siemens.com
State New
Headers show
Series [meta-lts-mixins,scarthgap/go,1/7] go-helloworld: upgrade to latest revision | expand

Commit Message

Peter Marko May 13, 2026, 5:08 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

cvelistV5 has wrong CPE:
* "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"

The CVE is actually for golang-google-protobuf as links in the CVE
report prove:
* https://pkg.go.dev/vuln/GO-2024-2611

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: be622a8da624b8cf04e4bfbbf6d751825ec37f9a)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 recipes-devtools/go/go-binary-native_1.26.2.bb | 1 +
 recipes-devtools/go/go-common.inc              | 1 +
 2 files changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/recipes-devtools/go/go-binary-native_1.26.2.bb b/recipes-devtools/go/go-binary-native_1.26.2.bb
index 3c76a67..f36606b 100644
--- a/recipes-devtools/go/go-binary-native_1.26.2.bb
+++ b/recipes-devtools/go/go-binary-native_1.26.2.bb
@@ -18,6 +18,7 @@  UPSTREAM_CHECK_REGEX = "go(?P<pver>\d+(\.\d+)+)\.linux"
 
 CVE_PRODUCT = "golang:go"
 CVE_STATUS[CVE-2024-3566] = "not-applicable-platform: Issue only applies on Windows"
+CVE_STATUS[CVE-2024-24786] = "cpe-incorrect: this CVE is for golang-google-protobuf"
 
 S = "${WORKDIR}/go"
 
diff --git a/recipes-devtools/go/go-common.inc b/recipes-devtools/go/go-common.inc
index a79c90f..2d617bd 100644
--- a/recipes-devtools/go/go-common.inc
+++ b/recipes-devtools/go/go-common.inc
@@ -22,6 +22,7 @@  UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)\.src\.tar"
 # all recipe variants are created from the same product
 CVE_PRODUCT = "golang:go"
 CVE_STATUS[CVE-2024-3566] = "not-applicable-platform: Issue only applies on Windows"
+CVE_STATUS[CVE-2024-24786] = "cpe-incorrect: this CVE is for golang-google-protobuf"
 
 INHIBIT_PACKAGE_DEBUG_SPLIT = "1"
 SSTATE_SCAN_CMD = "true"