[meta-lts-mixins][scarthgap/go][PATCH 2/7] go: set status for CVE-2024-24786
Peter Marko <[email protected]>
| Newsgroups | org.yoctoproject.lists.yocto-patches |
|---|---|
| Message-ID | <[email protected]> |
From: Peter Marko <[email protected]> cvelistV5 has wrong CPE: * "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*" The CVE is actually for golang-google-protobuf as links in the CVE report prove: * https://pkg.go.dev/vuln/GO-2024-2611 Signed-off-by: Peter Marko <[email protected]> Signed-off-by: Richard Purdie <[email protected]> (From OE-Core rev: be622a8da624b8cf04e4bfbbf6d751825ec37f9a) Signed-off-by: Peter Marko <[email protected]> --- recipes-devtools/go/go-binary-native_1.26.2.bb | 1 + recipes-devtools/go/go-common.inc | 1 + 2 files changed, 2 insertions(+) diff --git a/recipes-devtools/go/go-binary-native_1.26.2.bb b/recipes-devtools/go/go-binary-native_1.26.2.bb index 3c76a67..f36606b 100644 --- a/recipes-devtools/go/go-binary-native_1.26.2.bb +++ b/recipes-devtools/go/go-binary-native_1.26.2.bb @@ -18,6 +18,7 @@ UPSTREAM_CHECK_REGEX = "go(?P<pver>\d+(\.\d+)+)\.linux" CVE_PRODUCT = "golang:go" CVE_STATUS[CVE-2024-3566] = "not-applicable-platform: Issue only applies on Windows" +CVE_STATUS[CVE-2024-24786] = "cpe-incorrect: this CVE is for golang-google-protobuf" S = "${WORKDIR}/go" diff --git a/recipes-devtools/go/go-common.inc b/recipes-devtools/go/go-common.inc index a79c90f..2d617bd 100644 --- a/recipes-devtools/go/go-common.inc +++ b/recipes-devtools/go/go-common.inc @@ -22,6 +22,7 @@ UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)\.src\.tar" # all recipe variants are created from the same product CVE_PRODUCT = "golang:go" CVE_STATUS[CVE-2024-3566] = "not-applicable-platform: Issue only applies on Windows" +CVE_STATUS[CVE-2024-24786] = "cpe-incorrect: this CVE is for golang-google-protobuf" INHIBIT_PACKAGE_DEBUG_SPLIT = "1" SSTATE_SCAN_CMD = "true"