[meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965

Peter Marko <[email protected]> Tue, 28 Jul 2026 21:36:01 +0200
Newsgroups org.yoctoproject.lists.meta-virtualization
Message-ID <[email protected]>
From: Peter Marko <[email protected]>

This CVE was fixed in v1.20.
This is mentione in NVD report description [1] and github advisory [2].
Explicitly set CVE_STATUS because cve-check still reports it as open.

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-24965
[2] https://github.com/containers/crun/security/advisories/GHSA-f42g-r5jj-qh4j

Signed-off-by: Peter Marko <[email protected]>
---
 recipes-containers/crun/crun_git.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/recipes-containers/crun/crun_git.bb b/recipes-containers/crun/crun_git.bb
index d2f7b63b..ea14e8ec 100644
--- a/recipes-containers/crun/crun_git.bb
+++ b/recipes-containers/crun/crun_git.bb
@@ -67,3 +67,5 @@ RCONFLICTS:${PN} = "${@'runc' if d.getVar('CRUN_AS_RUNC') else ''}"
 REQUIRED_DISTRO_FEATURES:class-native ?= ""
 DEPENDS:class-native += "yajl libcap go-md2man m4 libseccomp"
 BBCLASSEXTEND = "native"
+
+CVE_STATUS[CVE-2025-24965] = "fixed-version: Fixed since 1.20"