diff mbox series

[langdale,26/41] nss: Whitelist CVEs related to libnssdbm

Message ID	309fde5ae782a7961aa0c0cec9d477374eff62f4.1674653280.git.akuster808@gmail.com
State	New
Headers	show Return-Path: <akuster808@gmail.com> ip: 209.85.161.53, mailfrom: akuster808@gmail.com) From: Armin Kuster <akuster808@gmail.com> To: openembedded-devel@lists.openembedded.org Subject: [langdale 26/41] nss: Whitelist CVEs related to libnssdbm Date: Wed, 25 Jan 2023 08:31:08 -0500 Message-Id: <309fde5ae782a7961aa0c0cec9d477374eff62f4.1674653280.git.akuster808@gmail.com> In-Reply-To: <cover.1674653280.git.akuster808@gmail.com> References: <cover.1674653280.git.akuster808@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[langdale,01/41] blueman: add RDEPEND on python3-fcntl \| expand [langdale,01/41] blueman: add RDEPEND on python3-fcntl [langdale,02/41] nss: fix SRC_URI [langdale,03/41] xfce4-verve-plugin: fix do_configure faiure about missing libpcre [langdale,04/41] gnome-text-editor: Add missing libpcre build time depenedency [langdale,05/41] ettercap: Add missing dependency on libpcre [langdale,06/41] ntfs-3g-ntfsprogs: Upgrade 2022.5.17 to 2022.10.3 [langdale,07/41] freeradius: fix multilib systemd service start failure [langdale,08/41] Nodejs - Upgrade to 16.18.1 [langdale,09/41] protobuf: stage protoc binary to sysroot [langdale,10/41] imapfilter: Upgrade to 2.7.6 [langdale,11/41] ostree: fix selinux policy rebuild error on first deployment [langdale,12/41] botan: upgrade 2.19.2 -> 2.19.3 [langdale,13/41] audit: upgrade 3.0.8 -> 3.0.9 [langdale,14/41] colord: upgrade 1.4.5 -> 1.4.6 [langdale,15/41] aufs-util: Fix build with large file support enabled systems [langdale,16/41] volume-key: Inherit python3targetconfig [langdale,17/41] audit: Inherit python3targetconfig [langdale,18/41] waf-samba.bbclass: point PYTHON_CONFIG to target python3-config [langdale,19/41] fontforge: Inherit python3targetconfig [langdale,20/41] smcroute: upgrade 2.5.5 -> 2.5.6 [langdale,21/41] postfix: fix multilib conflict of sample-main.cf [langdale,22/41] dool: Add patch to fix rebuild [langdale,23/41] networkmanager: fix dhcpcd PACKAGECONFIG [langdale,24/41] networkmanager: install config files into correct place [langdale,25/41] nss: Add missing CVE product [langdale,26/41] nss: Whitelist CVEs related to libnssdbm [langdale,27/41] zsh: Fix CVE-2021-45444 [langdale,28/41] fwupd: Fix CVE-2022-3287 [langdale,29/41] redis: 7.0.5 -> 7.0.7 [langdale,30/41] redis: 6.2.7 -> 6.2.8 [langdale,31/41] redis: Upgrade to 7.0.8 [langdale,32/41] redis: Upgrade to 6.2.9 [langdale,33/41] kernel_add_regdb: Change the task order [langdale,34/41] Revert "waf-samba.bbclass: point PYTHON_CONFIG to target python3-config" [langdale,35/41] networkmanager: fix /etc/resolv.conf handling [langdale,36/41] fluidsynth: update SRC_URI to remove non-existing 2.2.x branch [langdale,37/41] openwsman: upgrade 2.7.1 -> 2.7.2 [langdale,38/41] sshpass: Use SPDX identified string for GPLv2 [langdale,39/41] strongswan: upgrade 5.9.8 -> 5.9.9 [langdale,40/41] perfetto: pass TUNE_CCARGS to use machine tune [langdale,41/41] perfetto: Do not pass TUNE_CCARGS to native/host compiler

Commit Message

akuster808 Jan. 25, 2023, 1:31 p.m. UTC

From: Mathieu Dubois-Briand <mbriand@witekio.com>

These CVEs only affect libnssdbm, compiled when --enable-legacy-db is
used.

https://bugzilla.mozilla.org/show_bug.cgi?id=1360782#c6
https://bugzilla.mozilla.org/show_bug.cgi?id=1360778#c8
https://bugzilla.mozilla.org/show_bug.cgi?id=1360900#c6
https://bugzilla.mozilla.org/show_bug.cgi?id=1360779#c9
Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 90645db2fa078b50ec6807c75acea913b49ea669)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 meta-oe/recipes-support/nss/nss_3.74.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff mbox series

Patch

diff --git a/meta-oe/recipes-support/nss/nss_3.74.bb b/meta-oe/recipes-support/nss/nss_3.74.bb
index 73701393e6..4a9482fca4 100644
--- a/meta-oe/recipes-support/nss/nss_3.74.bb
+++ b/meta-oe/recipes-support/nss/nss_3.74.bb
@@ -284,3 +284,7 @@  CVE_PRODUCT += "network_security_services"
 
 # CVE-2006-5201 affects only Sun Solaris
 CVE_CHECK_IGNORE += "CVE-2006-5201"
+
+# CVES CVE-2017-11695 CVE-2017-11696 CVE-2017-11697 CVE-2017-11698 only affect
+# the legacy db (libnssdbm), only compiled with --enable-legacy-db.
+CVE_CHECK_IGNORE += "CVE-2017-11695 CVE-2017-11696 CVE-2017-11697 CVE-2017-11698"