[poky][master][PATCH] gnutls: Whitelisted CVE patches

* [poky][master][PATCH] gnutls: Whitelisted CVE patches
@ 2020-10-28 17:17 saloni
  2020-10-28 18:26 ` [OE-core] " Steve Sakoman
  2020-10-29 14:01 ` Ross Burton
  0 siblings, 2 replies; 4+ messages in thread
From: saloni @ 2020-10-28 17:17 UTC (permalink / raw)
  To: openembedded-core, raj.khem; +Cc: nisha.parrakat, anuj.chougule, Saloni Jain

From: Saloni Jain <Saloni.Jain@kpit.com>

Below CVE patches are whitelisted as changes
are already present in source code:
1. CVE-2018-10844
Link: https://security-tracker.debian.org/tracker/CVE-2018-10844
Link: https://gitlab.com/gnutls/gnutls/commit/c32a8690f9f9b05994078fe9d2e7a41b18da5b09
2. CVE-2018-10845
Link: https://security-tracker.debian.org/tracker/CVE-2018-10845
Link: https://gitlab.com/gnutls/gnutls/commit/cc14ec5ece856cb083d64e6a5a8657323da661cb
3. CVE-2018-10846
Link: https://security-tracker.debian.org/tracker/CVE-2018-10846
Link: https://gitlab.com/gnutls/gnutls/commit/ce671a6db9e47006cff152d485091141b1569f39
4. CVE-2018-16868
Link: https://gitlab.com/gnutls/gnutls/-/merge_requests/832
Link: https://gitlab.com/gnutls/gnutls/-/commit/4804febddc2ed958e5ae774de2a8f85edeeff538

Signed-off-by: Saloni.Jain <Saloni.Jain@kpit.com>
---
 meta/recipes-support/gnutls/gnutls_3.6.14.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta/recipes-support/gnutls/gnutls_3.6.14.bb b/meta/recipes-support/gnutls/gnutls_3.6.14.bb
index 51578b4..727a12f 100644
--- a/meta/recipes-support/gnutls/gnutls_3.6.14.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.6.14.bb
@@ -17,6 +17,9 @@ DEPENDS_append_libc-musl = " argp-standalone"

 SHRT_VER = "${@d.getVar('PV').split('.')[0]}.${@d.getVar('PV').split('.')[1]}"

+#Changes are already present in source-code, hence whitelisted.
+CVE_CHECK_WHITELIST += "CVE-2018-16868 CVE-2018-10844 CVE-2018-10845 CVE-2018-10845"
+
 SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar.xz \
            file://arm_eabi.patch \
            file://0001-Modied-the-license-to-GPLv2.1-to-keep-with-LICENSE-f.patch \
--
2.7.4

This message contains information that may be privileged or confidential and is the property of the KPIT Technologies Ltd. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message. KPIT Technologies Ltd. does not accept any liability for virus infected mails.

^ permalink raw reply related	[flat|nested] 4+ messages in thread