From patchwork Thu Dec 19 20:48:50 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54393 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52F0CE7718B for ; Thu, 19 Dec 2024 20:50:06 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.web11.138537.1734641396222594907 for ; Thu, 19 Dec 2024 12:49:56 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=OktzdDej; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-20241219204953badbdedca8d9923b61-99imby@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 20241219204953badbdedca8d9923b61 for ; Thu, 19 Dec 2024 21:49:54 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=vw2v2dUM10fC6Zi403QfkCg/8gzbd42Kblr7QHAGCK0=; b=OktzdDej4pU4d5nVDVc9GDEO7jUN7j1Fq/FygXNtnrHUGXr48IJUVBsyBcbR1QwEjvy4cv knR+xCcAMZXT4uUNoT3CJLGt+7Ii6X3i9Z5g9PI1N7LG4PNv0Qj1lmKn7GW8zyz2+Binpahs 3PxyfA4fOIu3wIjZAgl50jO/vNH0YVKaJyjqrSX4jL+1Y2KBP5Q9hv+WPdYxrln/fKuKSF0F OWY+ZYL46doYHWvdVbFE3WOI1lfg5lVBKHjO6kUnnpuwVV/pW/43YfDTpYP907qsdocZAXNc xpB0qBMQtn/qWVFhGm2kFIfXWrAFctiLcS8TQ7ZWF2oiirDGGVpQKWsw==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 01/12] ace: ignore CVE-2009-1147 Date: Thu, 19 Dec 2024 21:48:50 +0100 Message-Id: <20241219204901.347009-2-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114417 From: Peter Marko This CVE is for vmware ace. Signed-off-by: Peter Marko --- meta-oe/recipes-connectivity/ace/ace_8.0.2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-connectivity/ace/ace_8.0.2.bb b/meta-oe/recipes-connectivity/ace/ace_8.0.2.bb index 64a4e7575f..2f3121e5a6 100644 --- a/meta-oe/recipes-connectivity/ace/ace_8.0.2.bb +++ b/meta-oe/recipes-connectivity/ace/ace_8.0.2.bb @@ -16,6 +16,8 @@ SRC_URI[sha256sum] = "dba38a905858ec4a44c04b4bbaef42b891adf061e8c0bbdaa1dce2c04f UPSTREAM_CHECK_URI = "https://github.com/DOCGroup/ACE_TAO/releases" UPSTREAM_CHECK_REGEX = "(?P\d+(\.\d+)+)" +CVE_STATUS[CVE-2009-1147] = "cpe-incorrect: this CVE is for vmware ace" + COMPATIBLE_HOST:libc-musl = "null" S = "${WORKDIR}/ACE_wrappers" From patchwork Thu Dec 19 20:48:51 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54395 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65CF5E7718D for ; Thu, 19 Dec 2024 20:50:06 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.web11.138537.1734641396222594907 for ; Thu, 19 Dec 2024 12:49:58 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=TozEnjcu; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-20241219204957f5b5e6aa826b58b6d9-rcaomf@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 20241219204957f5b5e6aa826b58b6d9 for ; Thu, 19 Dec 2024 21:49:57 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=WFJAebSTIhKoSSwZ+/PYe4YSGZ11zJgfuOvqNNDRvv8=; b=TozEnjcurocii/NW4fmwyKtDzRZrFZ6MwNNYg/WUqL2mwguhWWpHDDRgrypkxq4e/60bb4 yjUP0iXGH6IsR9TuY4F4CJVKNtQOl9PoU5yLkq/RStrZtCukYLBp1x5k7K0wG69aQRZwdg+T TgNYXdCb61TGAb5oes8pgI4RR/+8MjChoDDRfvso0I3C5tEyKum9dcZqpvJLZ4S7oDgOZMHN Fy6BiaWlhmwEkRzGoBYGZ3Kc393NwsQWdP2wbQRyz+wi9zHHFRS0WBwo9Jrmgf1xHOE2X6Oj lShu4IiMnRNa9wWJQVWqf8aG9L1b2VXmrsTPJDlA7EinRJX65u8wb3ww==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 02/12] apache2: ignore CVE-1999-0678 and CVE-1999-1412 Date: Thu, 19 Dec 2024 21:48:51 +0100 Message-Id: <20241219204901.347009-3-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114418 From: Peter Marko These CVEs are specific to Debian and MAC OS X respectively. Signed-off-by: Peter Marko --- meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb index 7d6ea27e7e..475f77d41b 100644 --- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb +++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb @@ -38,6 +38,8 @@ DEPENDS = "openssl expat pcre apr apr-util apache2-native " CVE_PRODUCT = "apache:http_server" CVE_STATUS[CVE-1999-0289] = "not-applicable-platform: The current version (2.4.6) is not affected. It only applies for Windows" +CVE_STATUS[CVE-1999-0678] = "not-applicable-platform: this CVE is for Debian packaging configuration" +CVE_STATUS[CVE-1999-1412] = "not-applicable-platform: this CVE is for MAC OS X specific problem" CVE_STATUS[CVE-2007-0450] = "not-applicable-platform: The current version (2.4.6) is not affected. It only applies for Windows." CVE_STATUS[CVE-2007-6421] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" CVE_STATUS[CVE-2007-6422] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" From patchwork Thu Dec 19 20:48:52 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54396 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54DD9E7718C for ; Thu, 19 Dec 2024 20:50:06 +0000 (UTC) Received: from mta-64-226.siemens.flowmailer.net (mta-64-226.siemens.flowmailer.net [185.136.64.226]) by mx.groups.io with SMTP id smtpd.web10.138544.1734641403368672295 for ; Thu, 19 Dec 2024 12:50:03 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=kwoWA9GB; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.226, mailfrom: fm-256628-20241219205000d15415e0d32a52c2e6-qthdp_@rts-flowmailer.siemens.com) Received: by mta-64-226.siemens.flowmailer.net with ESMTPSA id 20241219205000d15415e0d32a52c2e6 for ; Thu, 19 Dec 2024 21:50:00 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=Jy34stIp+lY+uv0iwtz26dtttQc0niJABEgYOofh01U=; b=kwoWA9GBxsn2PSdRUmWzQc4IT04CpzqewpbXbRxHiT9HbAKhJRoKPIgXsdSMDiAatw1LAC Fv5J9pOGu9LQ1yHsZ5IhDXVBAfnoa75m8pm7ID6yl/6YC4zyO48XGqJgzYL/FpAs/Q86zJQF UzzWCGV0p35XtcmTTnryiWDa5c8H888GJMWqlqPcsdtuHwMMXoYTykv6AIoxRwkT57azdExW L2WWinjKDMTRT6rxA2eTmLvbahKTcyozXLqDhZ5KU96sjFDz3ezAKFqxOSkvb5/yadLra99h 49gLcB7iENcsVfXyTzJUv1iT5kk4iBUJ/8FME6zD/iSMcvftS+w+RTog==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 03/12] apache2: remove old version references from CVEs Date: Thu, 19 Dec 2024 21:48:52 +0100 Message-Id: <20241219204901.347009-4-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114419 From: Peter Marko These were not updated on recipe upgrade. To make maintenance easier, remove exact versions. Signed-off-by: Peter Marko --- .../recipes-httpd/apache2/apache2_2.4.62.bb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb index 475f77d41b..3a988f2494 100644 --- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb +++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb @@ -37,15 +37,15 @@ DEPENDS = "openssl expat pcre apr apr-util apache2-native " CVE_PRODUCT = "apache:http_server" -CVE_STATUS[CVE-1999-0289] = "not-applicable-platform: The current version (2.4.6) is not affected. It only applies for Windows" +CVE_STATUS[CVE-1999-0289] = "not-applicable-platform: The current version is not affected. It only applies for Windows" CVE_STATUS[CVE-1999-0678] = "not-applicable-platform: this CVE is for Debian packaging configuration" CVE_STATUS[CVE-1999-1412] = "not-applicable-platform: this CVE is for MAC OS X specific problem" -CVE_STATUS[CVE-2007-0450] = "not-applicable-platform: The current version (2.4.6) is not affected. It only applies for Windows." -CVE_STATUS[CVE-2007-6421] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" -CVE_STATUS[CVE-2007-6422] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" -CVE_STATUS[CVE-2007-6423] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions from 2.2.x to 2.2.7-dev" -CVE_STATUS[CVE-2008-2168] = "cpe-incorrect: The current version (2.4.59) is not affected by the CVE which affects versions up to 2.2.6 (excl.)" -CVE_STATUS[CVE-2010-0425] = "not-applicable-platform: The current version (2.4.6) is not affected. It only applies for Windows." +CVE_STATUS[CVE-2007-0450] = "not-applicable-platform: The current version is not affected. It only applies for Windows." +CVE_STATUS[CVE-2007-6421] = "cpe-incorrect: The current version is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" +CVE_STATUS[CVE-2007-6422] = "cpe-incorrect: The current version is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" +CVE_STATUS[CVE-2007-6423] = "cpe-incorrect: The current version is not affected by the CVE which affects versions from 2.2.x to 2.2.7-dev" +CVE_STATUS[CVE-2008-2168] = "cpe-incorrect: The current version is not affected by the CVE which affects versions up to 2.2.6 (excl.)" +CVE_STATUS[CVE-2010-0425] = "not-applicable-platform: The current version is not affected. It only applies for Windows." SSTATE_SCAN_FILES += "apxs config_vars.mk config.nice" From patchwork Thu Dec 19 20:48:53 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54394 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4F737E77184 for ; Thu, 19 Dec 2024 20:50:06 +0000 (UTC) Received: from mta-64-226.siemens.flowmailer.net (mta-64-226.siemens.flowmailer.net [185.136.64.226]) by mx.groups.io with SMTP id smtpd.web10.138544.1734641403368672295 for ; Thu, 19 Dec 2024 12:50:04 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=ajkH7Orh; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.226, mailfrom: fm-256628-20241219205004c6bcffc7f20ca977d4-mt_6uh@rts-flowmailer.siemens.com) Received: by mta-64-226.siemens.flowmailer.net with ESMTPSA id 20241219205004c6bcffc7f20ca977d4 for ; Thu, 19 Dec 2024 21:50:04 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=zckjIG4ArPlEhgmqUritxRmajoxQPfJpF7IrFoWHt70=; b=ajkH7OrhwJzx2hVV0n1PWt3cQj6G22mVlofp1AD4BjyIsSP8nwuBPb7jc8GtexT0Uze1PD 31oISwLwXLaGlORUbKfu+mdif2e4NRsuF+AwNohFwBNGdkjVKfwZwRjpqJzYVwD/handKN2h Vte6YJcFKen6WPFc47tXtj6+ZA7fs2YWPuDb80bHD6dSU+Buy2wWXk9yEGGCgVKI61smwfib 6GFdfZIjgfrW6yYdzgoy4vZw7cJkdAMfQDqAMQojqszSV4sv1Po3utg5r/u57SLoRIzQ0oOS 7TpybnWAFCAW34lg2SM7LtMgm7C5gpMURAJn4U2h4PKPGWXeB4HzZ7Jw==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 04/12] spice: ignore CVE-2016-0749 Date: Thu, 19 Dec 2024 21:48:53 +0100 Message-Id: <20241219204901.347009-5-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114420 From: Peter Marko NVD tracks this as version-less CVE for spice. It was fixed by [1] and [2] included in 0.13.2. [1] https://gitlab.freedesktop.org/spice/spice/-/commit/6b32af3e1746988bb5a5123263bcf61b65e5be7e [2] https://gitlab.freedesktop.org/spice/spice/-/commit/359ac42a7ac02dcd1013757559292006647cd5c4 Signed-off-by: Peter Marko --- meta-networking/recipes-support/spice/spice_git.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-networking/recipes-support/spice/spice_git.bb b/meta-networking/recipes-support/spice/spice_git.bb index 419316a26e..5e6d8584e3 100644 --- a/meta-networking/recipes-support/spice/spice_git.bb +++ b/meta-networking/recipes-support/spice/spice_git.bb @@ -21,6 +21,7 @@ SRC_URI = "gitsm://gitlab.freedesktop.org/spice/spice;branch=master;protocol=htt S = "${WORKDIR}/git" +CVE_STATUS[CVE-2016-0749] = "fixed-version: patched since 0.13.2" CVE_STATUS[CVE-2018-10893] = "fixed-version: patched already, caused by inaccurate CPE in the NVD database." inherit meson gettext python3native python3-dir pkgconfig From patchwork Thu Dec 19 20:48:54 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54398 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4DEBEE77184 for ; Thu, 19 Dec 2024 20:50:16 +0000 (UTC) Received: from mta-65-227.siemens.flowmailer.net (mta-65-227.siemens.flowmailer.net [185.136.65.227]) by mx.groups.io with SMTP id smtpd.web11.138544.1734641410256811100 for ; Thu, 19 Dec 2024 12:50:10 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=hUEUi0RU; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.227, mailfrom: fm-256628-20241219205008e494c64005ec29978f-bit7dd@rts-flowmailer.siemens.com) Received: by mta-65-227.siemens.flowmailer.net with ESMTPSA id 20241219205008e494c64005ec29978f for ; Thu, 19 Dec 2024 21:50:08 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=8nbAoc/20xQfjyyA28I5Ummr1jXjPqN4Pm/zBnc5BKQ=; b=hUEUi0RUqDTsN4TchhGTx9Yr8I6bs97TcT4NfpG0gHOEJMptS0NDrhSa/GYUAN95vVxxFr z7+y8/TMoJau83oRcGWMVH4FU7HQqD+wh6Dbt1JkBaW6S17LwDiUduHqvDjyUFownqK2BEt0 +JL5LIF+B+jDQjM60VuaWPNHgkv95uPVmI+A6hNBRvSFdEwvnoao0z38l+eMeUAJbMkqz3IC UKqrf7lJspPSk9LZW/qLyof3u/mV1PjBU5y7a4aMPtjcC39c4w/9sd7twIPegnkz5oex9Eka PS3rbEXryhjhk8UD2LJ2b2w9AXm2QWGOkwjGbJ1x/kw0rpGV1UQpGRrA==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 05/12] gattlib: mark CVE-2019-6498 as fixed Date: Thu, 19 Dec 2024 21:48:54 +0100 Message-Id: <20241219204901.347009-6-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114421 From: Peter Marko Our hash does not point to exact tag and CVE patch is already in. We use: 33a8a275928b186381bb0aea0f9778e330e57ec3 Fix: https://github.com/labapart/gattlib/commit/60b813a770e42fdb0e85c1d2da7a55327784b8d6 git describe --tags --match=v0.2 33a8a275928b186381bb0aea0f9778e330e57ec3 60b813a770e42fdb0e85c1d2da7a55327784b8d6 v0.2-262-g33a8a27 v0.2-85-g60b813a Signed-off-by: Peter Marko --- meta-oe/recipes-connectivity/gattlib/gattlib_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-connectivity/gattlib/gattlib_git.bb b/meta-oe/recipes-connectivity/gattlib/gattlib_git.bb index 7ad28d594d..0841dc2596 100644 --- a/meta-oe/recipes-connectivity/gattlib/gattlib_git.bb +++ b/meta-oe/recipes-connectivity/gattlib/gattlib_git.bb @@ -17,6 +17,8 @@ SRCREV = "33a8a275928b186381bb0aea0f9778e330e57ec3" S = "${WORKDIR}/git" +CVE_STATUS[CVE-2019-6498] = "fixed-version: patch is already included in sources" + PACKAGECONFIG[examples] = "-DGATTLIB_BUILD_EXAMPLES=ON,-DGATTLIB_BUILD_EXAMPLES=OFF" # Set this to force use of DBus API if Bluez version is older than 5.42 From patchwork Thu Dec 19 20:48:55 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54397 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50881E7718A for ; Thu, 19 Dec 2024 20:50:16 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.web10.138547.1734641414016121433 for ; Thu, 19 Dec 2024 12:50:14 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=MnDyWHie; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-20241219205012586f730a93aad5a4d4-56z9sq@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 20241219205012586f730a93aad5a4d4 for ; Thu, 19 Dec 2024 21:50:12 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=b89PgISj3f+nh6Od870RQV68D4NBIoczGd/7zSUnAbs=; b=MnDyWHie8TkulqTxrPWLiG6svr+JKvigvtsaPUSdE2Ie+L7+NxY7mvnXN0l+Aob9MExl9L jzS/wXKwC6cYdf2q5LKA/6a7pHl0vf02dXQR1Uq4JDSTwOhYxmdQxfVE2+lpdLjR6JObf3G6 YOr26Vvo8DctcJ5k8VmsrYONmbLbgaU4piS583vc7GXSoLRXnjA+yGUYPKQIUpuT+mnmaJNA et0yhLX8YKY/+aBaWcDVdfCEhb47q357L1zlBLXtVwJ0B757qzvIPUeSeR6bfDUz1TITo2Yj FQnLB/V6GTd6VUAu5Dv3PMMxdlyIOgkxhBPApbX4lnJIaqW6IlnDg2ow==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 06/12] monkey: ignore CVE-2013-1771 Date: Thu, 19 Dec 2024 21:48:55 +0100 Message-Id: <20241219204901.347009-7-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114422 From: Peter Marko This is gentoo specific CVE. NVD tracks this as version-less CVE. Signed-off-by: Peter Marko --- meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb b/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb index f10262366a..a11af8129a 100644 --- a/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb +++ b/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb @@ -91,3 +91,4 @@ CONFFILES:${PN} = "${sysconfdir}/monkey/monkey.conf \ " CVE_STATUS[CVE-2013-2183] = "cpe-incorrect: Current version (1.6.9) is not affected. Issue was addressed in version 1.3.0" +CVE_STATUS[CVE-2013-1771] = "not-applicable-platform: this is gentoo specific CVE" From patchwork Thu Dec 19 20:48:56 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54399 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D346E77184 for ; Thu, 19 Dec 2024 20:50:26 +0000 (UTC) Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.web11.138546.1734641419497766176 for ; Thu, 19 Dec 2024 12:50:19 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=gyJBIsMd; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-256628-2024121920501756e8bb21a689bd093b-m4zllg@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 2024121920501756e8bb21a689bd093b for ; Thu, 19 Dec 2024 21:50:17 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=kjCysLd5go4DSZo5G/gE1KWqsvuNtE+rvEqbnOv1R5Q=; b=gyJBIsMdi8n/wTA83OQ5Xeeo1vqSEPJe6X8USCoalmQGIMfADCnPFHwQabT5hmyEHeHyXR XlLyUMoqbQ7mV/dzJXIzldB6CKUFM1hleRwQOeJrcq1rxqNtz0tPhe+8ALAsy8/ksNTaxKDB 6eSXd3EEfCYE+ce98D42bIyqE4LKgPYIW0q646U4RLUAtWvYZUeOGkLgkGuSq3LuczVhIn5Q Sr+ZFVPMASxvFJj806KRs/W3d/jEdKSy+IrFCvZQ0xyynrcP47PnpMpiVI2a6nBWpHnKyltX U4I8RK+m9bCLBdX9TYd9LboTQh+/qav3kV+7TBiV4O9Cl4uxqxcYcGTA==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 07/12] redis: ignore CVE-2022-0543 Date: Thu, 19 Dec 2024 21:48:56 +0100 Message-Id: <20241219204901.347009-8-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114423 From: Peter Marko This is Debian-specific CVE. NVD tracks this CVE as version-less. Signed-off-by: Peter Marko --- meta-oe/recipes-extended/redis/redis_7.2.6.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-extended/redis/redis_7.2.6.bb b/meta-oe/recipes-extended/redis/redis_7.2.6.bb index dcfd532cff..b52381c7aa 100644 --- a/meta-oe/recipes-extended/redis/redis_7.2.6.bb +++ b/meta-oe/recipes-extended/redis/redis_7.2.6.bb @@ -71,3 +71,4 @@ INITSCRIPT_PARAMS = "defaults 87" SYSTEMD_SERVICE:${PN} = "redis.service" CVE_STATUS[CVE-2022-3734] = "not-applicable-platform: CVE only applies for Windows." +CVE_STATUS[CVE-2022-0543] = "not-applicable-platform: Debian-specific CVE" From patchwork Thu Dec 19 20:48:57 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54401 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51B83E7718B for ; Thu, 19 Dec 2024 20:50:36 +0000 (UTC) Received: from mta-65-225.siemens.flowmailer.net (mta-65-225.siemens.flowmailer.net [185.136.65.225]) by mx.groups.io with SMTP id smtpd.web11.138547.1734641426677226628 for ; Thu, 19 Dec 2024 12:50:26 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=ezJXU6/e; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.225, mailfrom: fm-256628-202412192050243696be039639db3414-sefk3r@rts-flowmailer.siemens.com) Received: by mta-65-225.siemens.flowmailer.net with ESMTPSA id 202412192050243696be039639db3414 for ; Thu, 19 Dec 2024 21:50:25 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=CtQ9GB0634YwQcAsdGLWyX2e8VCqvZaZqLiaR50JVu0=; b=ezJXU6/eUyTmmj6lSJDaMVIm/xA+ATR+RWqFUxnMMjSaJbPlGn+YkXMF94sT0rLFNDzhsI 5Io1AfnUMHT3ga6xxn6rdwi+r5xGrgx6FjG4k5MV6PreVEI29V3ceTT+6vvfCuG8rDiUo6hf +Hmm92he1UNvS8XoiwRCxQWYuYxjdyu9TK6aQUR21Y3LgbK/3WB2ac3yp+nkC8g2UzB6FNMX ML5ewSAcn7uPEmeINnyGm7XKmRPkO7QZIExVQrgDXwi5YDJWwFa/bXYF1QnUqov8G4lFsgxR lAGU58Jo2sHH2TQXFQmJZdGT38Xn4NsWd9KXRxZAFP6uxtPLA5Tf+62A==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 08/12] spice-gtk: mark CVE-2012-4425 as fixed Date: Thu, 19 Dec 2024 21:48:57 +0100 Message-Id: <20241219204901.347009-9-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114424 From: Peter Marko It is fixed by [1] since 0.15.3. NVD tracks this CVE as version-less. [1] https://cgit.freedesktop.org/spice/spice-gtk/commit/?id=efbf867bb88845d5edf839550b54494b1bb752b9 Signed-off-by: Peter Marko --- meta-networking/recipes-support/spice/spice-gtk_0.42.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-support/spice/spice-gtk_0.42.bb b/meta-networking/recipes-support/spice/spice-gtk_0.42.bb index c8a3f7f532..4ef39f0904 100644 --- a/meta-networking/recipes-support/spice/spice-gtk_0.42.bb +++ b/meta-networking/recipes-support/spice/spice-gtk_0.42.bb @@ -12,6 +12,8 @@ SRCREV = "f04479c16f0969fb394ebe74b6eff74e560a42f0" SRC_URI = "gitsm://gitlab.freedesktop.org/spice/spice-gtk.git;protocol=https;branch=master" +CVE_STATUS[CVE-2012-4425] = "fixed-version: fixed since 0.15.3" + S = "${WORKDIR}/git" DEPENDS = " \ From patchwork Thu Dec 19 20:48:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54402 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52B42E77184 for ; Thu, 19 Dec 2024 20:50:36 +0000 (UTC) Received: from mta-64-225.siemens.flowmailer.net (mta-64-225.siemens.flowmailer.net [185.136.64.225]) by mx.groups.io with SMTP id smtpd.web10.138554.1734641430795655954 for ; Thu, 19 Dec 2024 12:50:31 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=VvqeQZgD; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.225, mailfrom: fm-256628-202412192050284b12ffaaa0d51e2344-ghnv5l@rts-flowmailer.siemens.com) Received: by mta-64-225.siemens.flowmailer.net with ESMTPSA id 202412192050284b12ffaaa0d51e2344 for ; Thu, 19 Dec 2024 21:50:29 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=WnsI+jvsU+NMy6iuJe3KmFnclv3g3xVF0hc31cN9oJY=; b=VvqeQZgDLnxFDOO3sPjNzlOxxItyzHO1M7B70cKxmhDMnIGySzohkn1zuCqO/8rWj+H/OV A5Y2VD1rPQUI5DtGrcZCPHsVP0BIibBZqP+7lFGO7bKejqLPwaO/t0+ywdaO+Y4r/Vbsj3Um weGj6O/U9s0vX8EDF6dG0bNT+5mHDFcsHs2YAGHyNg2c01MEHolSfuRIv4WUXzgrYXY6mvty 7LetUsaqul1Yu4hC9wmxJ53etXR4LjDGnYrPcFCEQd4DejpK0Tu/tt3MsjZUagCTFf3f2GXh TdNYf07KlDyZnc+RAvZBIVCsr/zV6tHtqSyQ4g4MP+jLUKQ4ESSokBUQ==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 09/12] apache2: ignore disputed CVE CVE-2007-0086 Date: Thu, 19 Dec 2024 21:48:58 +0100 Message-Id: <20241219204901.347009-10-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114425 From: Peter Marko This CVE is officially disputed by Redhat with official statement in https://nvd.nist.gov/vuln/detail/CVE-2007-0086 Red Hat does not consider this issue to be a security vulnerability. The pottential attacker has to send acknowledgement packets periodically to make server generate traffic. Exactly the same effect could be achieved by simply downloading the file. The statement that setting the TCP window size to arbitrarily high value would permit the attacker to disconnect and stop sending ACKs is false, because Red Hat Enterprise Linux limits the size of the TCP send buffer to 4MB by default. Signed-off-by: Peter Marko --- meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb index 3a988f2494..bba00fb95c 100644 --- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb +++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.62.bb @@ -40,6 +40,7 @@ CVE_PRODUCT = "apache:http_server" CVE_STATUS[CVE-1999-0289] = "not-applicable-platform: The current version is not affected. It only applies for Windows" CVE_STATUS[CVE-1999-0678] = "not-applicable-platform: this CVE is for Debian packaging configuration" CVE_STATUS[CVE-1999-1412] = "not-applicable-platform: this CVE is for MAC OS X specific problem" +CVE_STATUS[CVE-2007-0086] = "disputed: this CVE is officially disputed by Redhat" CVE_STATUS[CVE-2007-0450] = "not-applicable-platform: The current version is not affected. It only applies for Windows." CVE_STATUS[CVE-2007-6421] = "cpe-incorrect: The current version is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" CVE_STATUS[CVE-2007-6422] = "cpe-incorrect: The current version is not affected by the CVE which affects versions from 2.2 (incl.) to 2.2.8 (excl.)" From patchwork Thu Dec 19 20:48:59 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54400 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4CE74E7718A for ; Thu, 19 Dec 2024 20:50:36 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.web10.138557.1734641434959316738 for ; Thu, 19 Dec 2024 12:50:35 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=nuQxKo96; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-20241219205033ae4b339928358e13a9-g9l3_u@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 20241219205033ae4b339928358e13a9 for ; Thu, 19 Dec 2024 21:50:33 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=4acOEUW0KM6GDiDuJ1RI4womNLDA1sjdrTgPxfqv/0w=; b=nuQxKo963kxNGKuoZWKxVlkfvOMIJafbHNezf69YM7SwAUu8tp6SyMlqFlTyDxx5ya5YxG INdPru2IHeIeK2TblHphJ8JTGAH17+zWNDdSqlwqHECrc2CiU9R1fMo70q6PJh7bNQQwc22p 1u+oHPXvBEt3Z5WdtjNikVX6oWA2v8cT8oME2zOXZvy000ThUq7tB1sqdPwQH3Y87JJwoVF1 9ym52LHjn2i5jTHLigl6VtK4Mab7oMuRTOTJS0Y8mmyWqBob4Sl6I3TO3MFMI7EEn4FALtRe wdlPsfRLgHuUSbGZRWnIHtpwK3hw9DquH1AnValS8Kr8OYAEjjkB+N4g==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 10/12] swagger-ui: mark CVE-2016-1000229 as fixed Date: Thu, 19 Dec 2024 21:48:59 +0100 Message-Id: <20241219204901.347009-11-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114426 From: Peter Marko as per https://github.com/swagger-api/swagger-ui/issues/1865 NVD tracks this CVE as version-less. Signed-off-by: Peter Marko --- meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.18.2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.18.2.bb b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.18.2.bb index 5add32db43..0998643b2a 100644 --- a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.18.2.bb +++ b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.18.2.bb @@ -14,6 +14,8 @@ SRC_URI = "git://github.com/swagger-api/swagger-ui;branch=master;protocol=https" SRCREV = "3c7e281d97fd3e70b25f7ff4a001eabd56e375d7" +CVE_STATUS[CVE-2016-1000229] = "fixed-version: fixed since 2.2.1" + S = "${WORKDIR}/git" do_install() { From patchwork Thu Dec 19 20:49:00 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54404 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4DCF3E77184 for ; Thu, 19 Dec 2024 20:50:46 +0000 (UTC) Received: from mta-65-226.siemens.flowmailer.net (mta-65-226.siemens.flowmailer.net [185.136.65.226]) by mx.groups.io with SMTP id smtpd.web10.138557.1734641434959316738 for ; Thu, 19 Dec 2024 12:50:37 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=Lxul8eup; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.65.226, mailfrom: fm-256628-20241219205036815911113a5effffd0-6h4eya@rts-flowmailer.siemens.com) Received: by mta-65-226.siemens.flowmailer.net with ESMTPSA id 20241219205036815911113a5effffd0 for ; Thu, 19 Dec 2024 21:50:36 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=+CqQucpsP7m2LFK/bL1AYFG69D94dVZCTjbxt4kkx7w=; b=Lxul8eupPhA2C7PYMVUL5Javxrh1MBqhXVPtRi3pArid8IuU7XAHjhUtch5umx898CJixN T336eTDm8AVWDs7bDX45B2O/JJRh7cP14UZJR4oM4h9zlZhe11n/l1A9pg3SmtjneSqhHst9 4OG3cSQJI77wQf6bI51PIccMSIZaviI6g/MpFxCwAkw4eNraVYOmSXKydQTliR1dNChqvpcb EJDacLuE/DkYNTme95emzhM5Twp53CsXqfhyhmnBARQYLwR1rw5hRlP3+O1XIX0dlIrshjK4 vOY1DsJwW5j51tflshhgLqDWx81Ix6l02Uutv/aOIVPiryHo35hFaBfA==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 11/12] memcached: ignore disputed CVE-2022-26635 Date: Thu, 19 Dec 2024 21:49:00 +0100 Message-Id: <20241219204901.347009-12-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114427 From: Peter Marko Per [1] this is a problem of applications using memcached inproperly. This should not be a CVE against php-memcached, but for whatever software the issue was actually found in. php-memcached and libmemcached provide a VERIFY_KEY flag if they're too lazy to filter untrusted user input. [1] https://github.com/php-memcached-dev/php-memcached/issues/519 Signed-off-by: Peter Marko --- meta-networking/recipes-support/memcached/memcached_1.6.17.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-support/memcached/memcached_1.6.17.bb b/meta-networking/recipes-support/memcached/memcached_1.6.17.bb index 270ad5486d..7234f02a13 100644 --- a/meta-networking/recipes-support/memcached/memcached_1.6.17.bb +++ b/meta-networking/recipes-support/memcached/memcached_1.6.17.bb @@ -25,6 +25,8 @@ SRC_URI = "http://www.memcached.org/files/${BP}.tar.gz \ " SRC_URI[sha256sum] = "2055e373613d8fc21529aff9f0adce3e23b9ce01ba0478d30e7941d9f2bd1224" +CVE_STATUS[CVE-2022-26635] = "disputed: this is a problem of applications using php-memcached inproperly" + # set the same COMPATIBLE_HOST as libhugetlbfs COMPATIBLE_HOST = "(i.86|x86_64|powerpc|powerpc64|aarch64|arm).*-linux*" From patchwork Thu Dec 19 20:49:01 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Marko, Peter" X-Patchwork-Id: 54403 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50B5EE7718B for ; Thu, 19 Dec 2024 20:50:46 +0000 (UTC) Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net [185.136.64.227]) by mx.groups.io with SMTP id smtpd.web11.138554.1734641442181272351 for ; Thu, 19 Dec 2024 12:50:42 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=peter.marko@siemens.com header.s=fm1 header.b=qPqtqA+5; spf=pass (domain: rts-flowmailer.siemens.com, ip: 185.136.64.227, mailfrom: fm-256628-20241219205040023a4b91a33d016edf-g_807r@rts-flowmailer.siemens.com) Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 20241219205040023a4b91a33d016edf for ; Thu, 19 Dec 2024 21:50:40 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=fm1; d=siemens.com; i=peter.marko@siemens.com; h=Date:From:Subject:To:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding:Cc:References:In-Reply-To; bh=U498zA2ePoSiXAKI+I8apUyTLea2di3JThk5YbDXaYk=; b=qPqtqA+5S4CGym8OkfgA1k/RDII3GLgxU1KsuO/WeHyyuW6pVVDIThfJbMVFhlk5DE2Guc qi8QSOPISRA3CJHtRlt1glZCMVhW0hmYO3hJ//mEr5Yj8CSdeZfKerEebB/zXBa8dkFuTn98 LkOMi9yg3zyagJiNPFOCSzH5MVjShj0F2fFvtPQCZNr5cBiWxX5DxR8D8yNFY+bMtgsKwo2l s1RbQMaE+G740E8c/hlR0zX8gptlpJsZbTpRVNout0eBMNhDc/cpq5T/iy2WYJH4iV1GkjZ+ BKoCeff0fKEKGjmxGk4vIEYuaTXT+e2ccI3dlOz/bKUIDytcSbTff0vw==; From: Peter Marko To: openembedded-devel@lists.openembedded.org Cc: Peter Marko Subject: [meta-oe][PATCH v2 12/12] emlog: set CVE_PRODUCT Date: Thu, 19 Dec 2024 21:49:01 +0100 Message-Id: <20241219204901.347009-13-peter.marko@siemens.com> In-Reply-To: <20241219204901.347009-1-peter.marko@siemens.com> References: <20241219204901.347009-1-peter.marko@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-256628:519-21489:flowmailer List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 19 Dec 2024 20:50:46 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/114428 From: Peter Marko This will remove false-positive CVE-2024-50655 from reports. There are different emlog components from other vendors around. Signed-off-by: Peter Marko --- meta-oe/recipes-core/emlog/emlog.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-core/emlog/emlog.inc b/meta-oe/recipes-core/emlog/emlog.inc index 5e96b8b3bd..713b012177 100644 --- a/meta-oe/recipes-core/emlog/emlog.inc +++ b/meta-oe/recipes-core/emlog/emlog.inc @@ -9,6 +9,8 @@ SRCREV = "a9bbf324fde131ff4cf064e32674086c4ced4dca" PV = "0.70+git" S = "${WORKDIR}/git" +CVE_PRODUCT = "nicupavel:emlog" + EXTRA_OEMAKE += " \ CFLAGS='${TARGET_CFLAGS}' \ "