[Buildroot] [git commit branch/2025.02.x] package/busybox: re-introduce IGNORE_CVES for CVE-2023-42366
Titouan Christophe via buildroot <[email protected]>
| Newsgroups | net.busybox.buildroot |
|---|---|
| Message-ID | <[email protected]> |
commit: https://gitlab.com/buildroot.org/buildroot/-/commit/a0ac9811437eb947ae252e3145904fb8f09e546a branch: https://gitlab.com/buildroot.org/buildroot/-/tree/2025.02.x The patch `0008-awk.c-fix-CVE-2023-42366-bug-15874.patch` was introduced in [1]. The IGNORE_CVES entry was removed while the patch is still present in [2]. Re-introduce this IGNORE_CVES entry. [1] 75c594d446 package/busybox: fix pending CVEs [2] f88537c46b package/busybox: drop stale IGNORE_CVES entries Signed-off-by: Thomas Perale <[email protected]> (alternative to commit 092abbe0352d62af8c17167e4f48e76aeea7ce99) Signed-off-by: Titouan Christophe <[email protected]> --- package/busybox/busybox.mk | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk index 6c0f945e01..092fd5d1e1 100644 --- a/package/busybox/busybox.mk +++ b/package/busybox/busybox.mk @@ -15,6 +15,10 @@ BUSYBOX_CPE_ID_VENDOR = busybox # 0004-nslookup-sanitize-all-printed-strings-with-printable.patch BUSYBOX_IGNORE_CVES += CVE-2022-28391 +# This is not stale just wrong NVD entry. +# 0008-awk.c-fix-CVE-2023-42366-bug-15874.patch +BUSYBOX_IGNORE_CVES += CVE-2023-42366 + # 0012-archival-libarchive-sanitize-filenames-on-output.patch # 0013-testsuite-tar-tests-fix-test-after-cve-2025-46394.patch BUSYBOX_IGNORE_CVES += CVE-2025-46394 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot