[PATCH] ecryptfs-utils: add CVE-2016-1572 to allowlist

[PATCH] ecryptfs-utils: add CVE-2016-1572 to allowlist

[matsunaga-shinji]

Patch for CVE-2016-1572 is applied in version 109.

Signed-off-by: matsunaga-shinji <shin.matsunaga@fujitsu.com>
---
 recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
index 9aefc32..d98724c 100644
--- a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
+++ b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
@@ -68,3 +68,6 @@ FILES:${PN} += "${base_libdir}/security/* ${base_libdir}/ecryptfs/*"
 
 RDEPENDS:${PN} += "cryptsetup"
 RRECOMMENDS:${PN} = "gettext-runtime"
+
+# Patch for CVE-2016-1572 is applied in version 109.
+CVE_CHECK_IGNORE += "CVE-2016-1572"
-- 
2.25.1

Re: [oe] [PATCH] ecryptfs-utils: add CVE-2016-1572 to allowlist

[Khem Raj]

I guess this belongs to meta-security, please prefix the patch subject
with layer name [meta-security] in this case.

On Thu, Mar 10, 2022 at 8:14 PM Matsunaga-Shinji
<shin.matsunaga@fujitsu.com> wrote:
>
> Patch for CVE-2016-1572 is applied in version 109.
>
> Signed-off-by: matsunaga-shinji <shin.matsunaga@fujitsu.com>
> ---
>  recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> index 9aefc32..d98724c 100644
> --- a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> +++ b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> @@ -68,3 +68,6 @@ FILES:${PN} += "${base_libdir}/security/* ${base_libdir}/ecryptfs/*"
>
>  RDEPENDS:${PN} += "cryptsetup"
>  RRECOMMENDS:${PN} = "gettext-runtime"
> +
> +# Patch for CVE-2016-1572 is applied in version 109.
> +CVE_CHECK_IGNORE += "CVE-2016-1572"
> --
> 2.25.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#95945): https://lists.openembedded.org/g/openembedded-devel/message/95945
> Mute This Topic: https://lists.openembedded.org/mt/89704285/1997914
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

Re: [oe] [PATCH] ecryptfs-utils: add CVE-2016-1572 to allowlist

[Marta Rybczynska]

[-- Attachment #1: Type: text/plain, Size: 967 bytes --]

On Fri, Mar 11, 2022, 05:14 Matsunaga-Shinji <shin.matsunaga@fujitsu.com>
wrote:

> Patch for CVE-2016-1572 is applied in version 109.
>
> Signed-off-by: matsunaga-shinji <shin.matsunaga@fujitsu.com>
> ---
>  recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> index 9aefc32..d98724c 100644
> --- a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> +++ b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
> @@ -68,3 +68,6 @@ FILES:${PN} += "${base_libdir}/security/*
> ${base_libdir}/ecryptfs/*"
>
>  RDEPENDS:${PN} += "cryptsetup"
>  RRECOMMENDS:${PN} = "gettext-runtime"
> +
> +# Patch for CVE-2016-1572 is applied in version 109.
> +CVE_CHECK_IGNORE += "CVE-2016-1572"
>

Wouldn't it be better to report this to the NVD and do the fix in the
database instead?

Regards
Marta

>

[-- Attachment #2: Type: text/html, Size: 2151 bytes --]

RE: [oe] [PATCH] ecryptfs-utils: add CVE-2016-1572 to allowlist

[shin.matsunaga]

[-- Attachment #1: Type: text/plain, Size: 1860 bytes --]

Thank you for your comment.

When I sent a mail to NVD about a database modification request, this has been approved.

NVD has made the appropriate modifications to reflect that the affected versions are up to (excluding) 109.

So we can confirm that the website has changed. The same is the data feeds.
https://nvd.nist.gov/vuln/detail/CVE-2016-1572

Regards
Shinji


From: Marta Rybczynska <rybczynska@gmail.com>
Sent: Friday, March 11, 2022 2:27 PM
To: Matsunaga, Shinji/松永 慎司 <shin.matsunaga@fujitsu.com>
Cc: OpenEmbedded Devel List <openembedded-devel@lists.openembedded.org>
Subject: Re: [oe] [PATCH] ecryptfs-utils: add CVE-2016-1572 to allowlist


On Fri, Mar 11, 2022, 05:14 Matsunaga-Shinji <shin.matsunaga@fujitsu.com<mailto:shin.matsunaga@fujitsu.com>> wrote:
Patch for CVE-2016-1572 is applied in version 109.

Signed-off-by: matsunaga-shinji <shin.matsunaga@fujitsu.com<mailto:shin.matsunaga@fujitsu.com>>
---
 recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb>
index 9aefc32..d98724c 100644
--- a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb>
+++ b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb>
@@ -68,3 +68,6 @@ FILES:${PN} += "${base_libdir}/security/* ${base_libdir}/ecryptfs/*"

 RDEPENDS:${PN} += "cryptsetup"
 RRECOMMENDS:${PN} = "gettext-runtime"
+
+# Patch for CVE-2016-1572 is applied in version 109.
+CVE_CHECK_IGNORE += "CVE-2016-1572"

Wouldn't it be better to report this to the NVD and do the fix in the database instead?

Regards
Marta

[-- Attachment #2: Type: text/html, Size: 7407 bytes --]