package/avahi: ignore CVE-2021-26720
PATCH 1/1 package/avahi: ignore CVE-2021-26720
CVE-2021-26720 is an issue in avahi-daemon-check-dns.sh, which is part of the Debian packaging and not part of upstream avahi - So ignore the CVE.
https://security-tracker.debian.org/tracker/CVE-2021-26720
--- package/avahi/avahi.mk | 4 ++++ 1 file changed, 4 insertions(+)
package/avahi/avahi.mk +4 -0
@@ -11,6 +11,10 @@ AVAHI_LICENSE_FILES = LICENSE AVAHI_CPE_ID_VENDOR = avahi AVAHI_INSTALL_STAGING = YES +# CVE-2021-26720 is an issue in avahi-daemon-check-dns.sh, which is +# part of the Debian packaging and not part of upstream avahi +AVAHI_IGNORE_CVES += CVE-2021-26720 + AVAHI_CONF_ENV = \ avahi_cv_sys_cxx_works=yes \ DATADIRNAME=share
Signature · 1 line
2.20.1
Arnout Vandecappelle
AppliedPATCH 1/1 package/avahi: ignore CVE-2021-26720
Quoted 6 lines · Peter Korsgaard
CVE-2021-26720 is an issue in
avahi-daemon-check-dns.sh, which is part of the Debian packaging and not part of upstream avahi - So ignore the CVE.https://security-tracker.debian.org/tracker/CVE-2021-26720
Signed-off-by Peter Korsgaard <[email protected]>
Applied to master, thanks.
BTW, is there an easy way to run the CVE check for a single package? Or do you
really have to go through configure + pkg-stats?
Regards,
Arnout
Quoted 20 lines
--- package/avahi/avahi.mk | 4 ++++ 1 file changed, 4 insertions(+)package/avahi/avahi.mk +4
-0@@ -11,6 +11,10 @@ AVAHI_LICENSE_FILES = LICENSE AVAHI_CPE_ID_VENDOR = avahi AVAHI_INSTALL_STAGING = YES +# CVE-2021-26720 is an issue in avahi-daemon-check-dns.sh, which is +# part of the Debian packaging and not part of upstream avahi +AVAHI_IGNORE_CVES += CVE-2021-26720 + AVAHI_CONF_ENV = \ avahi_cv_sys_cxx_works=yes \ DATADIRNAME=share
PATCH 1/1 package/avahi: ignore CVE-2021-26720
Quoted 6 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Arnout" == Arnout Vandecappelle <[email protected]> writes:
Quoted 3 lines · Peter Korsgaard
CVE-2021-26720 is an issue in
avahi-daemon-check-dns.sh, which is part of the Debian packaging and not part of upstream avahi - So ignore the CVE.
Quoted 8 lines
Quoted 3 lines
https://security-tracker.debian.org/tracker/CVE-2021-26720
Signed-off-by Peter Korsgaard <[email protected]>Applied to master, thanks.
BTW, is there an easy way to run the CVE check for a single package? Or do you
really have to go through configure + pkg-stats?
I'm afraid so. Thomas?
Signature · 1 line
Bye, Peter Korsgaard
PATCH 1/1 package/avahi: ignore CVE-2021-26720
Quoted 8 lines · On Thu, 08 Apr 2021 09:32:36 +0200 Peter Korsgaard <[email protected]> wrote:
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Arnout" == Arnout Vandecappelle <[email protected]> writes:
Quoted 5 lines · Peter Korsgaard
CVE-2021-26720 is an issue in
avahi-daemon-check-dns.sh, which is part of the Debian packaging and not part of upstream avahi - So ignore the CVE.
Quoted 8 lines
Quoted 6 lines
Quoted 1 line
Signed-off-by Peter Korsgaard <[email protected]>Applied to master, thanks.
BTW, is there an easy way to run the CVE check for a single package? Or do you
really have to go through configure + pkg-stats?I'm afraid so. Thomas?
Without any Buildroot configuration defined:
./support/scripts/pkg-stats --nvd-path /path/to/nvd/data -p avahi --html foobar.html
Best regards,
Thomas
Signature · 3 lines
Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
PATCH 1/1 package/avahi: ignore CVE-2021-26720
In reply to Peter KorsgaardQuoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
CVE-2021-26720 is an issue in
avahi-daemon-check-dns.sh, which is part of the Debian packaging and not part of upstream avahi - So ignore the CVE.https://security-tracker.debian.org/tracker/CVE-2021-26720
Signed-off-by Peter Korsgaard <[email protected]>
Committed to 2021.02.x, thanks.
Signature · 1 line
Bye, Peter Korsgaard