[meta-virtualization] [Scarthgap] [PATCH] go-distribution: CVE-2020-29591

From: Anil Dongare <[email protected]>

Details: https://nvd.nist.gov/vuln/detail/CVE-2020-29591

CVE-2020-29591 affects official Docker Hub registry container images
that shipped with an unlocked root account. This recipe is source-only:
it does not compile binaries and does not ship the official registry
container image or root filesystem where the vulnerable configuration
existed.

Mark this CVE as cpe-incorrect because the affected artifact is the
official container image configuration, not the go-distribution source
recipe.

Signed-off-by: Anil Dongare <[email protected]>
---
 recipes-devtools/go/go-distribution_git.bb | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/recipes-devtools/go/go-distribution_git.bb b/recipes-devtools/go/go-distribution_git.bb
index 740fdfe4..4e0b2a44 100644
--- a/recipes-devtools/go/go-distribution_git.bb
+++ b/recipes-devtools/go/go-distribution_git.bb
@@ -14,6 +14,13 @@ PV = "2.6.0+git"
 
 S = "${WORKDIR}/git"
 
+# CVE-2020-29591 affects official Docker Hub registry container images
+# with an unlocked root account, not the go-distribution source recipe.
+# This recipe is source-only and does not ship the official registry
+# container image or rootfs where the vulnerable /etc/shadow
+# configuration existed.
+CVE_STATUS[CVE-2020-29591] = "cpe-incorrect: affects official registry container image configuration, not this source-only recipe"
+
 inherit meta-virt-depreciated-warning
 
 # NO-OP the do compile rule because this recipe is source only.
-- 
2.44.4