summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPurushottam Choudhary <Purushottam.Choudhary@kpit.com>2021-03-03 16:20:38 +0530
committerAnuj Mittal <anuj.mittal@intel.com>2021-03-10 10:16:46 +0800
commit1474dcb84c925603736bafbe9fc802a99a014a39 (patch)
tree9eeff1c9f2409ee4294b43793bf7f3ae92c1577a
parent87205779f6198fa22996722381c8015a3b068e71 (diff)
downloadopenembedded-core-contrib-1474dcb84c925603736bafbe9fc802a99a014a39.tar.gz
openembedded-core-contrib-1474dcb84c925603736bafbe9fc802a99a014a39.tar.bz2
openembedded-core-contrib-1474dcb84c925603736bafbe9fc802a99a014a39.zip
shadow: whitelist CVE-2013-4235
This CVE is about TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees which had very low severity problem and marked as closed and won't fix. Therefore whitelisted CVE-2013-4235. Master, gatesgarth and dunfell all have shadow version 4.81. Hence, this is applicable for master, gatesgarth and dunfell. Link: https://bugzilla.redhat.com/show_bug.cgi?id=884658 Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b1c6cd87bee6b019619dc5728fd6c36bc87ed696) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
-rw-r--r--meta/recipes-extended/shadow/shadow_4.8.1.bb5
1 files changed, 3 insertions, 2 deletions
diff --git a/meta/recipes-extended/shadow/shadow_4.8.1.bb b/meta/recipes-extended/shadow/shadow_4.8.1.bb
index c975395ff8..ff4aad926f 100644
--- a/meta/recipes-extended/shadow/shadow_4.8.1.bb
+++ b/meta/recipes-extended/shadow/shadow_4.8.1.bb
@@ -6,5 +6,6 @@ BUILD_LDFLAGS_append_class-target = " ${@bb.utils.contains('DISTRO_FEATURES', 'p
BBCLASSEXTEND = "native nativesdk"
-
-
+# Severity is low and marked as closed and won't fix.
+# https://bugzilla.redhat.com/show_bug.cgi?id=884658
+CVE_CHECK_WHITELIST += "CVE-2013-4235"