Re: [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965

I have no record of the original email.

Can you resend ?

Bruce

On Tue, Jul 28, 2026 at 2:40=E2=80=AFPM Marko, Peter <[email protected]=
om> wrote:
>
> Gentle ping.
>
> -----Original Message-----
> From: [email protected] <meta-virtualization@lis=
ts.yoctoproject.org> On Behalf Of Peter Marko via lists.yoctoproject.org
> Sent: Sunday, July 19, 2026 10:49 PM
> To: [email protected]
> Cc: Marko, Peter (FT D EU SK BFS1) <[email protected]>
> Subject: [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2=
025-24965
>
> From: Peter Marko <[email protected]>
>
> This CVE was fixed in v1.20.
> This is mentione in NVD report description [1] and github advisory [2].
> Explicitly set CVE_STATUS because cve-check still reports it as open.
>
> [1] https://nvd.nist.gov/vuln/detail/CVE-2025-24965
> [2] https://github.com/containers/crun/security/advisories/GHSA-f42g-r5jj=
-qh4j
>
> Signed-off-by: Peter Marko <[email protected]>
> ---
>  recipes-containers/crun/crun_git.bb | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/recipes-containers/crun/crun_git.bb b/recipes-containers/cru=
n/crun_git.bb
> index d2f7b63b..ea14e8ec 100644
> --- a/recipes-containers/crun/crun_git.bb
> +++ b/recipes-containers/crun/crun_git.bb
> @@ -67,3 +67,5 @@ RCONFLICTS:${PN} =3D "${@'runc' if d.getVar('CRUN_AS_RU=
NC') else ''}"
>  REQUIRED_DISTRO_FEATURES:class-native ?=3D ""
>  DEPENDS:class-native +=3D "yajl libcap go-md2man m4 libseccomp"
>  BBCLASSEXTEND =3D "native"
> +
> +CVE_STATUS[CVE-2025-24965] =3D "fixed-version: Fixed since 1.20"



--=20
- Thou shalt not follow the NULL pointer, for chaos and madness await
thee at its end
- "Use the force Harry" - Gandalf, Star Trek II