[meta-virtualization][wrynose][PATCH] docker-compose: add CVE_PRODUCT and CVE_STATUS for CVE-2025-62725
"Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)" <[email protected]>
| Newsgroups | org.yoctoproject.lists.meta-virtualization |
|---|---|
| Message-ID | <[email protected]> |
From: "mark.yang" <[email protected]> Add CVE_PRODUCT to docker-compose that matches CPE. <vendor>:<product> must be set to docker:compose for proper matching. CVE-2025-62725 was fixed in 2.40.2, but its record encodes the range as a plain "< 2.40.2" version string that automated version comparison cannot use, so mark it as fixed-version. Signed-off-by: mark.yang <[email protected]> Signed-off-by: Bruce Ashfield <[email protected]> (cherry picked from commit e456f38266f55e32521903cddd8a0f9fee2fd5eb) Signed-off-by: Devansh Patel <[email protected]> --- recipes-containers/docker-compose/docker-compose_git.bb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/recipes-containers/docker-compose/docker-compose_git.bb b/recipes-containers/docker-compose/docker-compose_git.bb index 3eb78c04..aa61d245 100644 --- a/recipes-containers/docker-compose/docker-compose_git.bb +++ b/recipes-containers/docker-compose/docker-compose_git.bb @@ -30,6 +30,10 @@ GO_IMPORT = "import" PV = "5.1.0" +CVE_PRODUCT = "docker:compose" + +CVE_STATUS[CVE-2025-62725] = "fixed-version: fixed in 2.40.2" + COMPOSE_PKG = "github.com/docker/compose/v2" # go-mod-discovery configuration -- 2.53.0