* [PATCH] rpm: Exclude CVE-2021-20266 from cve-check
@ 2021-05-17 9:48 Richard Purdie
2021-05-17 9:50 ` [OE-core] " Jacob Kroon
0 siblings, 1 reply; 4+ messages in thread
From: Richard Purdie @ 2021-05-17 9:48 UTC (permalink / raw)
To: openembedded-core
This is included in the release we have, it was the reason for the last rpm
point release.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
meta/recipes-devtools/rpm/rpm_4.16.1.3.bb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb b/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
index 2857cd730c4..760adab02b5 100644
--- a/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
+++ b/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
@@ -51,6 +51,10 @@ S = "${WORKDIR}/git"
# included in 4.16.1.3
CVE_CHECK_WHIETLIST += "CVE-2021-20271"
+# Fix https://github.com/rpm-software-management/rpm/commit/2e21a178fcc76565c09ed3a28624ca8aeda1880a
+# included in 4.16.1.3
+CVE_CHECK_WHIETLIST += "CVE-2021-20266"
+
DEPENDS = "libgcrypt db file popt xz bzip2 elfutils python3"
DEPENDS_append_class-native = " file-replacement-native bzip2-replacement-native"
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [OE-core] [PATCH] rpm: Exclude CVE-2021-20266 from cve-check
2021-05-17 9:48 [PATCH] rpm: Exclude CVE-2021-20266 from cve-check Richard Purdie
@ 2021-05-17 9:50 ` Jacob Kroon
2021-05-17 9:56 ` Richard Purdie
[not found] ` <167FD211EC31BA98.24037@lists.openembedded.org>
0 siblings, 2 replies; 4+ messages in thread
From: Jacob Kroon @ 2021-05-17 9:50 UTC (permalink / raw)
To: Richard Purdie, openembedded-core
On 5/17/21 11:48 AM, Richard Purdie wrote:
> This is included in the release we have, it was the reason for the last rpm
> point release.
>
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> ---
> meta/recipes-devtools/rpm/rpm_4.16.1.3.bb | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb b/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
> index 2857cd730c4..760adab02b5 100644
> --- a/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
> +++ b/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
> @@ -51,6 +51,10 @@ S = "${WORKDIR}/git"
> # included in 4.16.1.3
> CVE_CHECK_WHIETLIST += "CVE-2021-20271"
>
> +# Fix https://github.com/rpm-software-management/rpm/commit/2e21a178fcc76565c09ed3a28624ca8aeda1880a
> +# included in 4.16.1.3
> +CVE_CHECK_WHIETLIST += "CVE-2021-20266"
> +
Is the same spelling already exists above, but is that really
intentional, "WHIET" instead of "WHITE" ?
/Jacob
> DEPENDS = "libgcrypt db file popt xz bzip2 elfutils python3"
> DEPENDS_append_class-native = " file-replacement-native bzip2-replacement-native"
>
>
>
>
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [OE-core] [PATCH] rpm: Exclude CVE-2021-20266 from cve-check
2021-05-17 9:50 ` [OE-core] " Jacob Kroon
@ 2021-05-17 9:56 ` Richard Purdie
[not found] ` <167FD211EC31BA98.24037@lists.openembedded.org>
1 sibling, 0 replies; 4+ messages in thread
From: Richard Purdie @ 2021-05-17 9:56 UTC (permalink / raw)
To: Jacob Kroon, openembedded-core
On Mon, 2021-05-17 at 11:50 +0200, Jacob Kroon wrote:
>
> On 5/17/21 11:48 AM, Richard Purdie wrote:
> > This is included in the release we have, it was the reason for the last rpm
> > point release.
> >
> > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> > ---
> > meta/recipes-devtools/rpm/rpm_4.16.1.3.bb | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> > diff --git a/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb b/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
> > index 2857cd730c4..760adab02b5 100644
> > --- a/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
> > +++ b/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
> > @@ -51,6 +51,10 @@ S = "${WORKDIR}/git"
> > # included in 4.16.1.3
> > CVE_CHECK_WHIETLIST += "CVE-2021-20271"
> >
> >
> >
> >
> > +# Fix https://github.com/rpm-software-management/rpm/commit/2e21a178fcc76565c09ed3a28624ca8aeda1880a
> > +# included in 4.16.1.3
> > +CVE_CHECK_WHIETLIST += "CVE-2021-20266"
> > +
>
> Is the same spelling already exists above, but is that really
> intentional, "WHIET" instead of "WHITE" ?
Well spotted, I'll fix that, thanks.
Cheers,
Richard
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [OE-core] [PATCH] rpm: Exclude CVE-2021-20266 from cve-check
[not found] ` <167FD211EC31BA98.24037@lists.openembedded.org>
@ 2021-05-17 10:04 ` Richard Purdie
0 siblings, 0 replies; 4+ messages in thread
From: Richard Purdie @ 2021-05-17 10:04 UTC (permalink / raw)
To: Jacob Kroon, openembedded-core
On Mon, 2021-05-17 at 10:56 +0100, Richard Purdie via lists.openembedded.org wrote:
> On Mon, 2021-05-17 at 11:50 +0200, Jacob Kroon wrote:
> >
> > On 5/17/21 11:48 AM, Richard Purdie wrote:
> > > This is included in the release we have, it was the reason for the last rpm
> > > point release.
> > >
> > > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> > > ---
> > > meta/recipes-devtools/rpm/rpm_4.16.1.3.bb | 4 ++++
> > > 1 file changed, 4 insertions(+)
> > >
> > > diff --git a/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb b/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
> > > index 2857cd730c4..760adab02b5 100644
> > > --- a/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
> > > +++ b/meta/recipes-devtools/rpm/rpm_4.16.1.3.bb
> > > @@ -51,6 +51,10 @@ S = "${WORKDIR}/git"
> > > # included in 4.16.1.3
> > > CVE_CHECK_WHIETLIST += "CVE-2021-20271"
> > >
> > >
> > >
> > >
> > > +# Fix https://github.com/rpm-software-management/rpm/commit/2e21a178fcc76565c09ed3a28624ca8aeda1880a
> > > +# included in 4.16.1.3
> > > +CVE_CHECK_WHIETLIST += "CVE-2021-20266"
> > > +
> >
> > Is the same spelling already exists above, but is that really
> > intentional, "WHIET" instead of "WHITE" ?
>
> Well spotted, I'll fix that, thanks.
The upstream database updated so we can remove that entry. I've sent a CPE update
for this issue so whilst I'll leave this patch in -next, we may be able to simply
remove the other entry and not add this one.
Cheers,
Richard
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-05-17 10:04 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-17 9:48 [PATCH] rpm: Exclude CVE-2021-20266 from cve-check Richard Purdie
2021-05-17 9:50 ` [OE-core] " Jacob Kroon
2021-05-17 9:56 ` Richard Purdie
[not found] ` <167FD211EC31BA98.24037@lists.openembedded.org>
2021-05-17 10:04 ` Richard Purdie
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.