All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Anuj Mittal" <anuj.mittal@intel.com>
To: openembedded-core@lists.openembedded.org
Subject: [gatesgarth][PATCH 01/20] zip: whitelist CVE-2018-13410 and CVE-2018-13684
Date: Fri, 22 Jan 2021 00:21:46 +0800	[thread overview]
Message-ID: <f0314a6937a63b3274bcd84817476834c1de876e.1611245974.git.anuj.mittal@intel.com> (raw)
In-Reply-To: <cover.1611245974.git.anuj.mittal@intel.com>

From: Mikko Rapeli <mikko.rapeli@bmw.de>

https://nvd.nist.gov/vuln/detail/CVE-2018-13410 is disputed and
also Debian considers it not a vulnerability:

https://security-tracker.debian.org/tracker/CVE-2018-13410

http://seclists.org/fulldisclosure/2018/Jul/24
"Negligible security impact, would involve that a untrusted party controls the -TT value."

https://nvd.nist.gov/vuln/detail/CVE-2018-13684 is not for zip, also Debian concludes this:

https://security-tracker.debian.org/tracker/CVE-2018-13684

"NOT-FOR-US: smart contract implementation for ZIP"

Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
---
 meta/recipes-extended/zip/zip_3.0.bb | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/meta/recipes-extended/zip/zip_3.0.bb b/meta/recipes-extended/zip/zip_3.0.bb
index c00a932763..97e5e57533 100644
--- a/meta/recipes-extended/zip/zip_3.0.bb
+++ b/meta/recipes-extended/zip/zip_3.0.bb
@@ -19,6 +19,12 @@ UPSTREAM_VERSION_UNKNOWN = "1"
 SRC_URI[md5sum] = "7b74551e63f8ee6aab6fbc86676c0d37"
 SRC_URI[sha256sum] = "f0e8bb1f9b7eb0b01285495a2699df3a4b766784c1765a8f1aeedf63c0806369"
 
+# Disputed and also Debian doesn't consider a vulnerability
+CVE_CHECK_WHITELIST += "CVE-2018-13410"
+
+# Not for zip but for smart contract implementation for it
+CVE_CHECK_WHITELIST += "CVE-2018-13684"
+
 # zip.inc sets CFLAGS, but what Makefile actually uses is
 # CFLAGS_NOOPT.  It will also force -O3 optimization, overriding
 # whatever we set.
-- 
2.29.2


  reply	other threads:[~2021-01-21 16:22 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-21 16:21 [gatesgarth][PATCH 00/20] patch review request Anuj Mittal
2021-01-21 16:21 ` Anuj Mittal [this message]
2021-01-21 16:21 ` [gatesgarth][PATCH 02/20] scripts: oe-run-native, fix *-native directories Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 03/20] toolchain-shar-extract.sh: Handle special characters in script path Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 04/20] systemd.bbclass: improve error message when a service unit specified in SYSTEMD_SERVICE is not found Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 05/20] boost: drop arm-intrinsics.patch Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 06/20] binutils: Fix CVE-2020-35448 Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 07/20] meta: toolchain-shar-relocate.sh: Do not use $target_sdk_dir as regex Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 08/20] meta: toolchain-shar-relocate.sh: Filter out post-relocate-setup script Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 09/20] lib/oe/utils: Return empty string in parallel_make Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 10/20] gcc: Backport patch to resolve i*86 tune configuration overrides Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 11/20] wic: Add workdir argument Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 12/20] wic: Ensure internal workdir is not reused Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 13/20] wic: Allow exec_native_cmd to run HOSTTOOLS Anuj Mittal
2021-01-21 16:21 ` [gatesgarth][PATCH 14/20] image_types_wic: Move wic working directory Anuj Mittal
2021-01-21 16:22 ` [gatesgarth][PATCH 15/20] wic: Update pseudo db when excluding content from rootfs Anuj Mittal
2021-01-21 16:22 ` [gatesgarth][PATCH 16/20] wic: Copy rootfs dir if fstab needs updating Anuj Mittal
2021-01-21 16:22 ` [gatesgarth][PATCH 17/20] wic: Optimise fstab modification for ext2/3/4 and msdos partitions Anuj Mittal
2021-01-21 16:22 ` [gatesgarth][PATCH 18/20] toolchain-shar-relocate.sh: Fix handling files with colons Anuj Mittal
2021-01-21 16:22 ` [gatesgarth][PATCH 19/20] devtool: Fix source extraction for gcc shared source Anuj Mittal
2021-01-21 16:22 ` [gatesgarth][PATCH 20/20] flex: Fix --noline option behavior Anuj Mittal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=f0314a6937a63b3274bcd84817476834c1de876e.1611245974.git.anuj.mittal@intel.com \
    --to=anuj.mittal@intel.com \
    --cc=openembedded-core@lists.openembedded.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.