From: Peter Marko <[email protected]> Commit fixing this CVE [3] is available in current hash. It is listed via [1] -> [2] and has CVE reference in commit message.
Additionally add comment that CVE_STATUS_STABLE_BACKPORTS variable should be kept during recipe upgrades. [1] https://nvd.nist.gov/vuln/detail/CVE-2026-5435 [2] https://sourceware.org/bugzilla/show_bug.cgi?id=34033 [3] https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ca44a6609c29a683b03575fa035c6d17aa591e72 Signed-off-by: Peter Marko <[email protected]> --- meta/recipes-core/glibc/glibc_2.44.bb | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-core/glibc/glibc_2.44.bb b/meta/recipes-core/glibc/glibc_2.44.bb index 9c93c05fe9..c629b30827 100644 --- a/meta/recipes-core/glibc/glibc_2.44.bb +++ b/meta/recipes-core/glibc/glibc_2.44.bb @@ -16,6 +16,13 @@ CVE_STATUS[CVE-2019-1010025] = "disputed: \ Allows for ASLR bypass so can bypass some hardening, not an exploit in itself, may allow \ easier access for another. 'ASLR bypass itself is not a vulnerability.'" +# when upgrading, clear CVE list but keep the variables +CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS" +CVE_STATUS_STABLE_BACKPORTS = "\ + CVE-2026-5435 \ +" +CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash" + DEPENDS += "gperf-native bison-native" NATIVESDKFIXES ?= ""
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242489): https://lists.openembedded.org/g/openembedded-core/message/242489 Mute This Topic: https://lists.openembedded.org/mt/120546982/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
