[meta-oe][wrynose][PATCH 3/6] protobuf: set status for CVE-2024-7254
Peter Marko <[email protected]>
| Newsgroups | org.openembedded.lists.openembedded-devel |
|---|---|
| Message-ID | <[email protected]> |
From: Peter Marko <[email protected]> Version 4.28.2 is correctly set in [1]. Unfortunately also protoc version 28.2 with the same CPE is mentioned which creates a false positive which needs to be handled. [1] https://github.com/CVEProject/cvelistV5/blob/main/cves/2024/7xxx/CVE-2024-7254.json Signed-off-by: Peter Marko <[email protected]> --- meta-oe/recipes-devtools/protobuf/protobuf_6.33.6.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-devtools/protobuf/protobuf_6.33.6.bb b/meta-oe/recipes-devtools/protobuf/protobuf_6.33.6.bb index 880dd82b1d..6aa858f2fc 100644 --- a/meta-oe/recipes-devtools/protobuf/protobuf_6.33.6.bb +++ b/meta-oe/recipes-devtools/protobuf/protobuf_6.33.6.bb @@ -129,3 +129,5 @@ RDEPENDS:${PN}-ptest = "bash ${@bb.utils.contains('PACKAGECONFIG', 'python', 'py MIPS_INSTRUCTION_SET = "mips" BBCLASSEXTEND = "native nativesdk" + +CVE_STATUS[CVE-2024-7254] = "fixed-version: Fixed since 4.28.2"