From patchwork Thu Dec 19 20:24:12 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54369 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB088E77184 for ; Thu, 19 Dec 2024 20:25:35 +0000 (UTC) Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.web11.138051.1734639927807988727 for ; Thu, 19 Dec 2024 12:25:28 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=QEk1oo/a; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-256628-2024121920252543babc0adb7c0426d9-2wdkp7@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 2024121920252543babc0adb7c0426d9 for ; Thu, 19 Dec 2024 21:25:25 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=qJxvY7AjijVm77gr5baJcPyRsffAx9huVKAH8kj8aK8=; b=QEk1oo/a7XrUcLTS/h8KwqZUQNQITBb1+FlJkBfARSHKn7iUU6LrcteVxZg/lBiNoKSZpB KBqDQj1PkJUOgZTQM7qo8ZL2O1Letp9uSu5rnHdXado2tTiLlWTc7TltuIM8+9HsEjpRa3/e vhHX52NGfd+x6XOffC7mXYNQ5EU7mdLNMl2IJx3bGhM5egI36EMnxc1zgN2ncw8C4DdofDHu 968aw3x7GZiY8xtdeepUSOdLouVctLjKLO6P7tYpiDBeN5+8tpNC5p4HSv9QboHPBAfv7lQw aDgFz5jy4f7vP7Uwf2LSx6BMXIuFjp2TI0R0jgWpps4q/4l3IsPWSWAg==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 01/12] ace: ignore CVE-2009-1147 Date: Thu, 19 Dec 2024 21:24:12 +0100 Message-Id: <20241219202423.346033-2-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:25:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208934 From: Peter Marko This CVE is for vmware ace. Signed-off-by: Peter Marko --- meta-oe/recipes-connectivity/ace/ace_8.0.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-connectivity/ace/ace_8.0.1.bb b/meta-oe/recipes-connectivity/ace/ace_8.0.1.bb index c79fba323c..88df9ae5df 100644 --- a/meta-oe/recipes-connectivity/ace/ace_8.0.1.bb +++ b/meta-oe/recipes-connectivity/ace/ace_8.0.1.bb @@ -16,6 +16,8 @@ SRC_URI[sha256sum] = "8d379f37d56db33f3ae447725b632d48b1c13e887593547ac3568e3b42 UPSTREAM_CHECK_URI = "https://github.com/DOCGroup/ACE_TAO/releases" UPSTREAM_CHECK_REGEX = "(?P\d+(\.\d+)+)" +CVE_STATUS[CVE-2009-1147] = "cpe-incorrect: this CVE is for vmware ace" + COMPATIBLE_HOST:libc-musl = "null" S = "${WORKDIR}/ACE_wrappers" From patchwork Thu Dec 19 20:24:13 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54370 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BCC9BE7718B for ; Thu, 19 Dec 2024 20:25:35 +0000 (UTC) Received: from mta-64-226.siemens.flowmailer.net (mta-64-226.siemens.flowmailer.net [185.136.64.226]) by mx.groups.io with SMTP id smtpd.web11.138057.1734639933914495007 for ; Thu, 19 Dec 2024 12:25:34 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=pN8VnLj1; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.226, mailfrom: fm-256628-202412192025315c9ab2d397dfae48a7-mfkz_b@rts-flowmailer.siemens.com) Received: by mta-64-226.siemens.flowmailer.net with ESMTPSA id 202412192025315c9ab2d397dfae48a7 for ; Thu, 19 Dec 2024 21:25:31 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=WFJAebSTIhKoSSwZ+/PYe4YSGZ11zJgfuOvqNNDRvv8=; b=pN8VnLj1EelLfUnkH44Rr3x2AmdtZu04c1PTiQfgFtQwl2bfKJEKakmejt5h2Tto7cZMvV dt2QqCmELBk3y8OWjHgEGnH3OSGc8O/c//rjuuKY+FCzh6dmlJrjuQkzFxH3ceO7oUxNspr5 TlhvEJv0NzK/q6w/7xgL2GkJDNZ38SBNpMd/vhMl16lVw9qUL5BWhYui8AkL3PdpqGKTbV7T DKT/uE8hRb80DMEj4SraqaBHWxmmqtUUFHos1PN2J0DVPl6ssHH7bxZszWnHthW1EQ3kTtAB /5jD2cN5yj98QRKhoEUEWpZqnYv2eYl1nIR6Gcsck8VMnvhag5qlh2iA==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 02/12] apache2: ignore CVE-1999-0678 and CVE-1999-1412 Date: Thu, 19 Dec 2024 21:24:13 +0100 Message-Id: <20241219202423.346033-3-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:25:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208935 From: Peter Marko These CVEs are specific to Debian and MAC OS X respectively. Signed-off-by: Peter Marko --- meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb index 7d6ea27e7e..475f77d41b 100644 --- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb +++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb @@ -38,6 +38,8 @@ DEPENDS = "openssl expat pcre apr apr-util apache2-native " CVE_PRODUCT = "apache:http_server" CVE_STATUS[CVE-1999-0289] = "not-applicable-platform: The current version (2.4.6) is not affected. It only applies for Windows" +CVE_STATUS[CVE-1999-0678] = "not-applicable-platform: this CVE is for Debian packaging configuration" +CVE_STATUS[CVE-1999-1412] = "not-applicable-platform: this CVE is for MAC OS X specific problem" CVE_STATUS[CVE-2007-0450] = "not-applicable-platform: The current version (2.4.6) is not affected. It only applies for Windows." CVE_STATUS[CVE-2007-6421] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" CVE_STATUS[CVE-2007-6422] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" From patchwork Thu Dec 19 20:24:14 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54372 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9326E77184 for ; Thu, 19 Dec 2024 20:25:45 +0000 (UTC) Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.web11.138060.1734639938711483086 for ; Thu, 19 Dec 2024 12:25:39 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=OmsYdqvS; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-256628-2024121920253674e5e8b0917c4336c4-o_uy9m@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 2024121920253674e5e8b0917c4336c4 for ; Thu, 19 Dec 2024 21:25:36 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=Jy34stIp+lY+uv0iwtz26dtttQc0niJABEgYOofh01U=; b=OmsYdqvS6c4Ur8pq5NnbXzu3NonJGOHlfIZuv11O1Nbjz6JGPdq+1XHglPa7WWEAUSCrdJ SGRS7Jfx5Umxx7Z2tcowsQZY0I+LkhUVslmZBNcimDx8WSAciwP5CkYf/xqZgwQqQJoC377z U13oFd29QMEJ9IMr5HM/BE62pr2QNVUURDjzHz9HXiVzTJ396fRFiI4HI/6uX12cYXxh1bkr 4iopClJ5++fDwjomVY5Ar/9ZujAhYzdiG5AEJd7ITVmi2i8L5rX1PMHPQrd07bHlJJD+hWWD ghfjdxShQyKHx2qf8y1MKkH4qsQgH0OmwNjv+0gyhIQqzAXo6v8ngfnw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 03/12] apache2: remove old version references from CVEs Date: Thu, 19 Dec 2024 21:24:14 +0100 Message-Id: <20241219202423.346033-4-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:25:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208936 From: Peter Marko These were not updated on recipe upgrade. To make maintenance easier, remove exact versions. Signed-off-by: Peter Marko --- .../recipes-httpd/apache2/apache2_2.4.62.bb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb index 475f77d41b..3a988f2494 100644 --- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb +++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb @@ -37,15 +37,15 @@ DEPENDS = "openssl expat pcre apr apr-util apache2-native " CVE_PRODUCT = "apache:http_server" -CVE_STATUS[CVE-1999-0289] = "not-applicable-platform: The current version (2.4.6) is not affected. It only applies for Windows" +CVE_STATUS[CVE-1999-0289] = "not-applicable-platform: The current version is not affected. It only applies for Windows" CVE_STATUS[CVE-1999-0678] = "not-applicable-platform: this CVE is for Debian packaging configuration" CVE_STATUS[CVE-1999-1412] = "not-applicable-platform: this CVE is for MAC OS X specific problem" -CVE_STATUS[CVE-2007-0450] = "not-applicable-platform: The current version (2.4.6) is not affected. It only applies for Windows." -CVE_STATUS[CVE-2007-6421] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" -CVE_STATUS[CVE-2007-6422] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" -CVE_STATUS[CVE-2007-6423] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions from 2.2.x to 2.2.7-dev" -CVE_STATUS[CVE-2008-2168] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions up to 2.2.6 (excl.)" -CVE_STATUS[CVE-2010-0425] = "not-applicable-platform: The current version (2.4.6) is not affected. It only applies for Windows." +CVE_STATUS[CVE-2007-0450] = "not-applicable-platform: The current version is not affected. It only applies for Windows." +CVE_STATUS[CVE-2007-6421] = "cpe-incorrect: The current version is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" +CVE_STATUS[CVE-2007-6422] = "cpe-incorrect: The current version is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" +CVE_STATUS[CVE-2007-6423] = "cpe-incorrect: The current version is not affected by the CVE which affects versions from 2.2.x to 2.2.7-dev" +CVE_STATUS[CVE-2008-2168] = "cpe-incorrect: The current version is not affected by the CVE which affects versions up to 2.2.6 (excl.)" +CVE_STATUS[CVE-2010-0425] = "not-applicable-platform: The current version is not affected. It only applies for Windows." SSTATE_SCAN_FILES += "apxs config_vars.mk config.nice" From patchwork Thu Dec 19 20:24:15 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54371 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD141E7718B for ; Thu, 19 Dec 2024 20:25:45 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.web11.138065.1734639943211622746 for ; Thu, 19 Dec 2024 12:25:43 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=nCxjVrEC; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-20241219202541c77875b84d9b29093d-ovztdi@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 20241219202541c77875b84d9b29093d for ; Thu, 19 Dec 2024 21:25:41 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=zckjIG4ArPlEhgmqUritxRmajoxQPfJpF7IrFoWHt70=; b=nCxjVrECpeWnkybdtbGy25Cby+AJV09P/mQj1Z7sDid0Bqxvl1xys7NWq4BMFdvErm8u6H Sk8DDJPRbRYFeVrrQolPQGYriAdp5vr9GjEKWDqIIeuNpQ43qPprhVvxrtVphIz5SE/HVv5D fuXJGt5jolcq6TLKAGTJXxRMD0NfINgGxrzXELeRM+TIgO9YaDGcqV9mc2Hho2CTTkELTmsG I3VP3PAthC6yHVSnS0+3A1cUyjs8hSxhs5oB5o5bbYBHxQp7Tj9z+XlvhHUvEhSG6eqvBaBM Y5Q9gJzN7V5oVQZlQ5UI46oqLc54o7Q+Q9ADFoFG5DeAr7OpnKye9f8w==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 04/12] spice: ignore CVE-2016-0749 Date: Thu, 19 Dec 2024 21:24:15 +0100 Message-Id: <20241219202423.346033-5-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:25:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208937 From: Peter Marko NVD tracks this as version-less CVE for spice. It was fixed by [1] and [2] included in 0.13.2. [1] https://gitlab.freedesktop.org/spice/spice/-/commit/6b32af3e1746988bb5a5123263bcf61b65e5be7e [2] https://gitlab.freedesktop.org/spice/spice/-/commit/359ac42a7ac02dcd1013757559292006647cd5c4 Signed-off-by: Peter Marko --- meta-networking/recipes-support/spice/spice_git.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-networking/recipes-support/spice/spice_git.bb b/meta-networking/recipes-support/spice/spice_git.bb index 419316a26e..5e6d8584e3 100644 --- a/meta-networking/recipes-support/spice/spice_git.bb +++ b/meta-networking/recipes-support/spice/spice_git.bb @@ -21,6 +21,7 @@ SRC_URI = "gitsm://gitlab.freedesktop.org/spice/spice;branch=master;protocol=htt S = "${WORKDIR}/git" +CVE_STATUS[CVE-2016-0749] = "fixed-version: patched since 0.13.2" CVE_STATUS[CVE-2018-10893] = "fixed-version: patched already, caused by inaccurate CPE in the NVD database." inherit meson gettext python3native python3-dir pkgconfig From patchwork Thu Dec 19 20:24:16 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54375 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB204E7718B for ; Thu, 19 Dec 2024 20:25:55 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.web11.138065.1734639943211622746 for ; Thu, 19 Dec 2024 12:25:46 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=XoTRLMXV; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-202412192025456f827c19601f003a67-hdwvu3@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 202412192025456f827c19601f003a67 for ; Thu, 19 Dec 2024 21:25:45 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=8nbAoc/20xQfjyyA28I5Ummr1jXjPqN4Pm/zBnc5BKQ=; b=XoTRLMXVB0jkJmpc2XJwn+iutEtGxvp+KU1KuAmOpWis8Jw1tJJRm7p4LWlhkz2YoeLmC4 aVqip8hvJVNBY7v9unH8C24tJc3Ca8YZ7cYArBKW1pdMtjzNZNvvIeqdh9FPGf2Z9rf85alD U0CNQdTUvGdQ2NCgN66gx09vctY+rxF5xBc/s5lYyjOGlgy9FwIx+gp94CaMBKIgjrH5NaR3 NsXwtz89T8ziB2Xa2q8JKnUAC3ieJEFMaOlE7mnwV9Cslwy1tVDokgxRcgrJAV8hFVnvr9L1 YrbUMd4zXTajQhh7Igx7xO97q4J03dtVwufhh8lit9/H28HYm7u/8szg==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 05/12] gattlib: mark CVE-2019-6498 as fixed Date: Thu, 19 Dec 2024 21:24:16 +0100 Message-Id: <20241219202423.346033-6-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:25:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208938 From: Peter Marko Our hash does not point to exact tag and CVE patch is already in. We use: 33a8a275928b186381bb0aea0f9778e330e57ec3 Fix: https://github.com/labapart/gattlib/commit/60b813a770e42fdb0e85c1d2da7a55327784b8d6 git describe --tags --match=v0.2 33a8a275928b186381bb0aea0f9778e330e57ec3 60b813a770e42fdb0e85c1d2da7a55327784b8d6 v0.2-262-g33a8a27 v0.2-85-g60b813a Signed-off-by: Peter Marko --- meta-oe/recipes-connectivity/gattlib/gattlib_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-connectivity/gattlib/gattlib_git.bb b/meta-oe/recipes-connectivity/gattlib/gattlib_git.bb index 7ad28d594d..0841dc2596 100644 --- a/meta-oe/recipes-connectivity/gattlib/gattlib_git.bb +++ b/meta-oe/recipes-connectivity/gattlib/gattlib_git.bb @@ -17,6 +17,8 @@ SRCREV = "33a8a275928b186381bb0aea0f9778e330e57ec3" S = "${WORKDIR}/git" +CVE_STATUS[CVE-2019-6498] = "fixed-version: patch is already included in sources" + PACKAGECONFIG[examples] = "-DGATTLIB_BUILD_EXAMPLES=ON,-DGATTLIB_BUILD_EXAMPLES=OFF" # Set this to force use of DBus API if Bluez version is older than 5.42 From patchwork Thu Dec 19 20:24:17 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54373 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BCCEFE77184 for ; Thu, 19 Dec 2024 20:25:55 +0000 (UTC) Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net [185.136.64.227]) by mx.groups.io with SMTP id smtpd.web10.138097.1734639952313877772 for ; Thu, 19 Dec 2024 12:25:52 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=ENppPzTA; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.227, mailfrom: fm-256628-20241219202549a6e5efb913c88788bc-a95itr@rts-flowmailer.siemens.com) Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 20241219202549a6e5efb913c88788bc for ; Thu, 19 Dec 2024 21:25:49 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=b89PgISj3f+nh6Od870RQV68D4NBIoczGd/7zSUnAbs=; b=ENppPzTADtL7LzRzupDJQyREXf69/dgq6eobFxGXMDCRQ6KKXXUWuYIH4M/qeBZcW2fH3P cmoBgp9/SZXXz/Je9FF8EyAGGvMtkxtl+X7NG1Tlr4YpaWcRClSGoVW9W3XtwtNRZoN6OI9f zZRvyAZnNHVLJ668wqtxnPiFQnwqdujbFu6zM8R/5thBLC/aqEZ4Wb21VlDy8UzBH4Ahzeaw 4PaKdwxGMAFxucTXE/y5PUCRIoR2NJLOLkfucHIrslIKseWMepUNM6RHn82dEgBZpI0Yje4+ udHXl9huHiLTgBTxnvh3HSHzVNquQ/5Tsemmy3Jk248R2rvjqBVsjhIQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 06/12] monkey: ignore CVE-2013-1771 Date: Thu, 19 Dec 2024 21:24:17 +0100 Message-Id: <20241219202423.346033-7-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:25:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208939 From: Peter Marko This is gentoo specific CVE. NVD tracks this as version-less CVE. Signed-off-by: Peter Marko --- meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb b/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb index f10262366a..a11af8129a 100644 --- a/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb +++ b/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb @@ -91,3 +91,4 @@ CONFFILES:${PN} = "${sysconfdir}/monkey/monkey.conf \ " CVE_STATUS[CVE-2013-2183] = "cpe-incorrect: Current version (1.6.9) is not affected. Issue was addressed in version 1.3.0" +CVE_STATUS[CVE-2013-1771] = "not-applicable-platform: this is gentoo specific CVE" From patchwork Thu Dec 19 20:24:18 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54374 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B6E1FE7718A for ; Thu, 19 Dec 2024 20:25:55 +0000 (UTC) Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) by mx.groups.io with SMTP id smtpd.web10.138098.1734639954958202579 for ; Thu, 19 Dec 2024 12:25:55 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=WX1B3Iar; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.225, mailfrom: fm-256628-2024121920255317b20c77989bf81030-mcwfdd@rts-flowmailer.siemens.com) Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 2024121920255317b20c77989bf81030 for ; Thu, 19 Dec 2024 21:25:53 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=kjCysLd5go4DSZo5G/gE1KWqsvuNtE+rvEqbnOv1R5Q=; b=WX1B3IarX/diP56s0Zt0+KCSzHg4u7SrVxNox7VRIeRR0i1MjNyJS6jJWdgrlbPGCBWrkw SqRwa5+GwJohOy/ca7WCoyp1VeIyQ2r4Eyki4b65Jravia9KXinqoklNL8PCWo8Qi6CYzBy2 y7joUmKRRPuUfGgAmPxpGFLi6cpYawmQGW7Z6g8GvrlxOBHzGkbNoS3TvaSCUuzxkMxaNzy9 QytTSzqsDJ9RXcvQLisPWo5q/S6YYCLi+NEowe5zGBfyj2q2EPNMvzjCtELiQvCE/Sg0NXD3 PjZ9yCCZnpfrCx/zjZEn4jlEZLhh/phNx1P28jdjaZ/olyyyCF0/fS7w==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 07/12] redis: ignore CVE-2022-0543 Date: Thu, 19 Dec 2024 21:24:18 +0100 Message-Id: <20241219202423.346033-8-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:25:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208940 From: Peter Marko This is Debian-specific CVE. NVD tracks this CVE as version-less. Signed-off-by: Peter Marko --- meta-oe/recipes-extended/redis/redis_7.2.6.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-extended/redis/redis_7.2.6.bb b/meta-oe/recipes-extended/redis/redis_7.2.6.bb index dcfd532cff..b52381c7aa 100644 --- a/meta-oe/recipes-extended/redis/redis_7.2.6.bb +++ b/meta-oe/recipes-extended/redis/redis_7.2.6.bb @@ -71,3 +71,4 @@ INITSCRIPT_PARAMS = "defaults 87" SYSTEMD_SERVICE:${PN} = "redis.service" CVE_STATUS[CVE-2022-3734] = "not-applicable-platform: CVE only applies for Windows." +CVE_STATUS[CVE-2022-0543] = "not-applicable-platform: Debian-specific CVE" From patchwork Thu Dec 19 20:24:19 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54377 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B6BE7E77184 for ; Thu, 19 Dec 2024 20:26:05 +0000 (UTC) Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.web10.138102.1734639959522168271 for ; Thu, 19 Dec 2024 12:25:59 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=SDpm1zWx; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-256628-20241219202557908df2f8cc3903c82f-fbfdwv@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 20241219202557908df2f8cc3903c82f for ; Thu, 19 Dec 2024 21:25:57 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=CtQ9GB0634YwQcAsdGLWyX2e8VCqvZaZqLiaR50JVu0=; b=SDpm1zWxQYqkywNM9axGq7Roq/rO8KN+cRX++jASQNDUDq7aPKevK7HcQZJQRh9HeuIucD JMyLCj/M7dXjjJGIv3w4LjY0rnTcwMz0IfVKFX/Ad4ejDJmwEhkGPXykaDfMrIVegcRJzcu5 ZIF2Wy0zjiRzw3egnVYJPF9rlFH/ykwnFCXAn1gP/TVjRxJcD5jkVueOysDl38byTbbmVTbl bd42v55CMkPEV0JKNvAYp7tFX4aojWHTaA7nVYbJku4z0Ic6olbsQPnZdcCjwAgNvQY0bwsx 9q0eCSrTxQ9xJqfLMwuQOuygVBHXotdTssIR2mgPazthWcShiGe+v0nw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 08/12] spice-gtk: mark CVE-2012-4425 as fixed Date: Thu, 19 Dec 2024 21:24:19 +0100 Message-Id: <20241219202423.346033-9-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:26:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208941 From: Peter Marko It is fixed by [1] since 0.15.3. NVD tracks this CVE as version-less. [1] https://cgit.freedesktop.org/spice/spice-gtk/commit/?id=efbf867bb88845d5edf839550b54494b1bb752b9 Signed-off-by: Peter Marko --- meta-networking/recipes-support/spice/spice-gtk_0.42.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-support/spice/spice-gtk_0.42.bb b/meta-networking/recipes-support/spice/spice-gtk_0.42.bb index c8a3f7f532..4ef39f0904 100644 --- a/meta-networking/recipes-support/spice/spice-gtk_0.42.bb +++ b/meta-networking/recipes-support/spice/spice-gtk_0.42.bb @@ -12,6 +12,8 @@ SRCREV = "f04479c16f0969fb394ebe74b6eff74e560a42f0" SRC_URI = "gitsm://gitlab.freedesktop.org/spice/spice-gtk.git;protocol=https;branch=master" +CVE_STATUS[CVE-2012-4425] = "fixed-version: fixed since 0.15.3" + S = "${WORKDIR}/git" DEPENDS = " \ From patchwork Thu Dec 19 20:24:20 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54376 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C06F0E7718B for ; Thu, 19 Dec 2024 20:26:05 +0000 (UTC) Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.web11.138079.1734639963866026237 for ; Thu, 19 Dec 2024 12:26:04 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=NveDKFuX; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-202412192026011b4719e1703d74e2df-mi40qy@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 202412192026011b4719e1703d74e2df for ; Thu, 19 Dec 2024 21:26:02 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=WnsI+jvsU+NMy6iuJe3KmFnclv3g3xVF0hc31cN9oJY=; b=NveDKFuXhD/9bfHqjtTY/FSm6Vedj3xZJKRMGU6xqFypig68sz6UaYPMCZnPGZSOWUdO3c +moqmGp5DYOyJViyADscA2pFqDbJU1whOnwT9lz0ZttvD+fzvkSttIlDCqxsoCOdsy9EEg3g I3sS6c4DiDYzybL7sMZCTkJ4sy08hMEfCDCY9j2RISSJa1rakqS5wwBIV15AdAnAgE99pKfd bjZbnQgqFLViys47AxaLowPuteuC5wIwQk+6CoR9QjujPDb5AUAbEsJEXxNCnip728j47fjJ mnu7LCElnvAYbBpo4+OYMw401RlYjTelxcMv1fOcL48LLUZ2gKqkMW6Q==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 09/12] apache2: ignore disputed CVE CVE-2007-0086 Date: Thu, 19 Dec 2024 21:24:20 +0100 Message-Id: <20241219202423.346033-10-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:26:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208942 From: Peter Marko This CVE is officially disputed by Redhat with official statement in https://nvd.nist.gov/vuln/detail/CVE-2007-0086 Red Hat does not consider this issue to be a security vulnerability. The pottential attacker has to send acknowledgement packets periodically to make server generate traffic. Exactly the same effect could be achieved by simply downloading the file. The statement that setting the TCP window size to arbitrarily high value would permit the attacker to disconnect and stop sending ACKs is false, because Red Hat Enterprise Linux limits the size of the TCP send buffer to 4MB by default. Signed-off-by: Peter Marko --- meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb index 3a988f2494..bba00fb95c 100644 --- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb +++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb @@ -40,6 +40,7 @@ CVE_PRODUCT = "apache:http_server" CVE_STATUS[CVE-1999-0289] = "not-applicable-platform: The current version is not affected. It only applies for Windows" CVE_STATUS[CVE-1999-0678] = "not-applicable-platform: this CVE is for Debian packaging configuration" CVE_STATUS[CVE-1999-1412] = "not-applicable-platform: this CVE is for MAC OS X specific problem" +CVE_STATUS[CVE-2007-0086] = "disputed: this CVE is officially disputed by Redhat" CVE_STATUS[CVE-2007-0450] = "not-applicable-platform: The current version is not affected. It only applies for Windows." CVE_STATUS[CVE-2007-6421] = "cpe-incorrect: The current version is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" CVE_STATUS[CVE-2007-6422] = "cpe-incorrect: The current version is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" From patchwork Thu Dec 19 20:24:21 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54378 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB46FE7718A for ; Thu, 19 Dec 2024 20:26:15 +0000 (UTC) Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.web11.138082.1734639968056495792 for ; Thu, 19 Dec 2024 12:26:08 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=FJ2YGs2u; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-2024121920260640241b9a5669cec0ec-te1r_o@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 2024121920260640241b9a5669cec0ec for ; Thu, 19 Dec 2024 21:26:06 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=4acOEUW0KM6GDiDuJ1RI4womNLDA1sjdrTgPxfqv/0w=; b=FJ2YGs2utPv9k16p/ArjzqNcY7gNWnMhGphwfCseWX7IbM8+LIIU5UyyYynPpeRLvQ9BcG napR0wS8S4hg5lm7b+/WzHXMgsBEEUvgSAls6zBT39aN1sWxrDu/JTcSAMS7qsEoCsGzBNPc sfgg0V2r5UvwzSHEdnTV6WRRaenKLFdjMQ3Y+LM1sWiXK0iTrxfKjoRX58A8upIkEzgDXWw8 zrkAsiT/sU5tVT1LyM+/tlkA8IMuIv41ULB5tZwTC24QJavFwV262TQDAyQbG6fjwOmDa1r9 npmbhweDDXOOIhxprKSdFE8eIKWaRQWEVbzKzaCJMD/60UgU7XopIIHw==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 10/12] swagger-ui: mark CVE-2016-1000229 as fixed Date: Thu, 19 Dec 2024 21:24:21 +0100 Message-Id: <20241219202423.346033-11-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:26:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208943 From: Peter Marko as per https://github.com/swagger-api/swagger-ui/issues/1865 NVD tracks this CVE as version-less. Signed-off-by: Peter Marko --- meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.18.2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.18.2.bb b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.18.2.bb index 5add32db43..0998643b2a 100644 --- a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.18.2.bb +++ b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.18.2.bb @@ -14,6 +14,8 @@ SRC_URI = "git://github.com/swagger-api/swagger-ui;branch=master;protocol=https" SRCREV = "3c7e281d97fd3e70b25f7ff4a001eabd56e375d7" +CVE_STATUS[CVE-2016-1000229] = "fixed-version: fixed since 2.2.1" + S = "${WORKDIR}/git" do_install() { From patchwork Thu Dec 19 20:24:22 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54379 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB367E77184 for ; Thu, 19 Dec 2024 20:26:15 +0000 (UTC) Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.web11.138082.1734639968056495792 for ; Thu, 19 Dec 2024 12:26:10 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=VPKhtGT7; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-2024121920260964a8ee4e53ed71f5e7-syd9dm@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 2024121920260964a8ee4e53ed71f5e7 for ; Thu, 19 Dec 2024 21:26:09 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=+CqQucpsP7m2LFK/bL1AYFG69D94dVZCTjbxt4kkx7w=; b=VPKhtGT73MYleLISumxrFZg6g60fT+IB/7J0xWCLk/JFEyT2DGaNb+AX7NFi0mUcksqs39 UtsW7KIhGKKQ07IsD9bS2HeENu03gECqfhayIT9ZrMplzyP4giy4Kl4USIDCV/5CGj9uq65A uwFNom1HcXLfafzTDVps0XwjlOy+iXT8E17a+RbWhS4S/zlVI+M4aUfJ0N8nvx/SRUs990sM bRQ5A48XaLmxU8gZBCEBHbLojY56oFJJT9sgbA2oz3/VPR+9rWc2Yuk9yca1NVG5DoShK/i1 T99gYW8sX99mPThlpQDqqmiUGAnYKV+uUUEdXg79L28RqPo5XF+8XrwQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 11/12] memcached: ignore disputed CVE-2022-26635 Date: Thu, 19 Dec 2024 21:24:22 +0100 Message-Id: <20241219202423.346033-12-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:26:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208944 From: Peter Marko Per [1] this is a problem of applications using memcached inproperly. This should not be a CVE against php-memcached, but for whatever software the issue was actually found in. php-memcached and libmemcached provide a VERIFY_KEY flag if they're too lazy to filter untrusted user input. [1] https://github.com/php-memcached-dev/php-memcached/issues/519 Signed-off-by: Peter Marko --- meta-networking/recipes-support/memcached/memcached_1.6.17.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-support/memcached/memcached_1.6.17.bb b/meta-networking/recipes-support/memcached/memcached_1.6.17.bb index 270ad5486d..7234f02a13 100644 --- a/meta-networking/recipes-support/memcached/memcached_1.6.17.bb +++ b/meta-networking/recipes-support/memcached/memcached_1.6.17.bb @@ -25,6 +25,8 @@ SRC_URI = "http://www.memcached.org/files/${BP}.tar.gz \ " SRC_URI[sha256sum] = "2055e373613d8fc21529aff9f0adce3e23b9ce01ba0478d30e7941d9f2bd1224" +CVE_STATUS[CVE-2022-26635] = "disputed: this is a problem of applications using php-memcached inproperly" + # set the same COMPATIBLE_HOST as libhugetlbfs COMPATIBLE_HOST = "(i.86|x86_64|powerpc|powerpc64|aarch64|arm).*-linux*" From patchwork Thu Dec 19 20:24:23 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54380 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8473E77184 for ; Thu, 19 Dec 2024 20:26:25 +0000 (UTC) Received: from mta-65-228.siemens.flowmailer.net (mta-65-228.siemens.flowmailer.net [185.136.65.228]) by mx.groups.io with SMTP id smtpd.web10.138114.1734639975917498897 for ; Thu, 19 Dec 2024 12:26:16 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=FkADOFHe; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.228, mailfrom: fm-256628-20241219202614146b1ce2f5d377c5f2-8hc62q@rts-flowmailer.siemens.com) Received: by mta-65-228.siemens.flowmailer.net with ESMTPSA id 20241219202614146b1ce2f5d377c5f2 for ; Thu, 19 Dec 2024 21:26:14 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=eIRcIhOQXyt7HWnN9kEN0Sasr6gzdtwJ351HnmzuX5M=; b=FkADOFHejzAJ0JFbpFOKP+kSgquQmd9XUMZhASd9lbAq2lw9x0wHgXX98bD4ZD86Z0u/Na TtA0AVzRxFBWycH3jjWmVM3ltQAtCu5qQMWumAwhSEXiH6JrKc8lT0SDcbmzMQESSa36KkMh agkMptZtn7M+iMTOdrREFt8xvB9NohztwAtxKHS8UqX42i+0XoLLHjUwffIVrgoibHtHI7NF oMG0/52DXVKjPjCw5UeUqAhPUTxMTqmmH2TYIab0qzGwE5WQHZl8/pKl5GDaV9HeR3R/Hk8k F+6v8Diz88zAhMc4FSgCTx0ImIq0puyz27hxsVtI5yASYPYsBxhf4riQ==; From: Peter Marko To: openembedded-core@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH 12/12] emlog: set CVE_PRODUCT Date: Thu, 19 Dec 2024 21:24:23 +0100 Message-Id: <20241219202423.346033-13-peter.marko@siemens.com> In-Reply-To: <20241219202423.346033-1-peter.marko@siemens.com> References: <20241219202423.346033-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:26:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208945 From: Peter Marko This will remove false-positive CVE-2024-50655 from reports. There are different emlog components from other vendors around. Signed-off-by: Peter Marko --- meta-oe/recipes-core/emlog/emlog.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-core/emlog/emlog.inc b/meta-oe/recipes-core/emlog/emlog.inc index 631e52f388..ec78a11086 100644 --- a/meta-oe/recipes-core/emlog/emlog.inc +++ b/meta-oe/recipes-core/emlog/emlog.inc @@ -8,6 +8,8 @@ SRCREV = "a9bbf324fde131ff4cf064e32674086c4ced4dca" PV = "0.70+git" S = "${WORKDIR}/git" +CVE_PRODUCT = "nicupavel:emlog" + EXTRA_OEMAKE += " \ CFLAGS='${TARGET_CFLAGS}' \ "