diff options
| author |   Mikko Rapeli <mikko.rapeli@bmw.de> | 2021-01-15 19:05:44 +0200 |
|---|---|---|
| committer |   Steve Sakoman <steve@sakoman.com> | 2021-01-19 04:22:10 -1000 |
| commit | 872342a37d6159844fcb8d9f0cbf37f011643195 (patch) | |
| tree | 3507048d54bca9dcfea90cd3919df45b8880170f | |
| parent | 104f36216f0be7278c1f03694ce8b7f72aca9952 (diff) | |
| download | openembedded-core-872342a37d6159844fcb8d9f0cbf37f011643195.tar.gz | |
zip: whitelist CVE-2018-13410 and CVE-2018-13684
https://nvd.nist.gov/vuln/detail/CVE-2018-13410 is disputed and
also Debian considers it not a vulnerability:
https://security-tracker.debian.org/tracker/CVE-2018-13410
http://seclists.org/fulldisclosure/2018/Jul/24
"Negligible security impact, would involve that a untrusted party controls the -TT value."
https://nvd.nist.gov/vuln/detail/CVE-2018-13684 is not for zip, also Debian concludes this:
https://security-tracker.debian.org/tracker/CVE-2018-13684
"NOT-FOR-US: smart contract implementation for ZIP"
Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 06b72a91b6dcf63fed437fd2105c59e922ba6525)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
| -rw-r--r-- | meta/recipes-extended/zip/zip_3.0.bb | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/meta/recipes-extended/zip/zip_3.0.bb b/meta/recipes-extended/zip/zip_3.0.bb index c00a932763..97e5e57533 100644 --- a/meta/recipes-extended/zip/zip_3.0.bb +++ b/meta/recipes-extended/zip/zip_3.0.bb @@ -19,6 +19,12 @@ UPSTREAM_VERSION_UNKNOWN = "1" SRC_URI[md5sum] = "7b74551e63f8ee6aab6fbc86676c0d37" SRC_URI[sha256sum] = "f0e8bb1f9b7eb0b01285495a2699df3a4b766784c1765a8f1aeedf63c0806369" +# Disputed and also Debian doesn't consider a vulnerability +CVE_CHECK_WHITELIST += "CVE-2018-13410" + +# Not for zip but for smart contract implementation for it +CVE_CHECK_WHITELIST += "CVE-2018-13684" + # zip.inc sets CFLAGS, but what Makefile actually uses is # CFLAGS_NOOPT. It will also force -O3 optimization, overriding # whatever we set. |