Skip to contentSkip to conversation

package/ripgrep: ignore CVE-2021-3013 as Windows only

PATCH Applied [email protected] 3 participants 3 messages Sep 30, 2021 – Oct 6, 2021

lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 package/ripgrep: ignore CVE-2021-3013 as Windows only

From: Sam Voss <[email protected]>

CVE-2021-3013 does not impact any buildroot versions of ripgrep as it is a Windows-only exploit targeting ripgrep versions earlier than 13. It can be safely ignored on our LTS branches.

Signed-off-by Sam Voss <[email protected]>

---

Note: Please apply this patch to:

* 2021.02.x
* 2021.05.x
* 2021.08.x

Master currently has version 13, which does not report this CVE.

---
 package/ripgrep/ripgrep.mk | 3 +++
 1 file changed, 3 insertions(+)
package/ripgrep/ripgrep.mk +3 -0
index 450bb020e3..8d0185595d 100644
@@ -10,6 +10,9 @@ RIPGREP_LICENSE = MIT
 RIPGREP_LICENSE_FILES = LICENSE-MIT
 RIPGREP_CPE_ID_VENDOR = ripgrep_project
 
+# CVE only impacts ripgrep on Windows
+RIPGREP_IGNORE_CVES += CVE-2021-3013
+
 RIPGREP_DEPENDENCIES = host-rustc
 RIPGREP_CARGO_ENV = CARGO_HOME=$(HOST_DIR)/share/cargo \
 	__CARGO_TEST_CHANNEL_OVERRIDE_DO_NOT_USE_THIS="nightly" \
Signature · 6 lines
2.33.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Applied
#1 lore raw

Sam, All

On 2021-09-29 22:52 -0500, [email protected] spake thusly:

Quoted 7 lines

From: Sam Voss <[email protected]>

CVE-2021-3013 does not impact any buildroot versions of ripgrep as it is a Windows-only exploit targeting ripgrep versions earlier than 13. It can be safely ignored on our LTS branches.

Signed-off-by Sam Voss <[email protected]>

Applied to master, thanks.

I've just added an URL to the NVD for reference.

Regards,
Yann E. MORIN.

Quoted 34 lines

---

Note: Please apply this patch to:

* 2021.02.x
* 2021.05.x
* 2021.08.x

Master currently has version 13, which does not report this CVE.

---
 package/ripgrep/ripgrep.mk | 3 +++
 1 file changed, 3 insertions(+)
package/ripgrep/ripgrep.mk +3 -0
index 450bb020e3..8d0185595d 100644
@@ -10,6 +10,9 @@ RIPGREP_LICENSE = MIT
 RIPGREP_LICENSE_FILES = LICENSE-MIT
 RIPGREP_CPE_ID_VENDOR = ripgrep_project
 
+# CVE only impacts ripgrep on Windows
+RIPGREP_IGNORE_CVES += CVE-2021-3013
+
 RIPGREP_DEPENDENCIES = host-rustc
 RIPGREP_CARGO_ENV = CARGO_HOME=$(HOST_DIR)/share/cargo \
 	__CARGO_TEST_CHANNEL_OVERRIDE_DO_NOT_USE_THIS="nightly" \
Signature · 6 lines
2.33.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Signature · 10 lines
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
#2 lore raw
In reply to [email protected]
Quoted 11 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"sam" == sam voss <[email protected]> writes:

From: Sam Voss <[email protected]>
CVE-2021-3013 does not impact any buildroot versions of ripgrep as it is a Windows-only exploit targeting ripgrep versions earlier than 13. It can be safely ignored on our LTS branches.

Signed-off-by Sam Voss <[email protected]>

---

Quoted 7 lines

Note: Please apply this patch to:

* 2021.02.x
* 2021.05.x
* 2021.08.x

Master currently has version 13, which does not report this CVE.

Committed to 2021.02.x, 2021.05.x and 2021.08.x, thanks.

Signature · 5 lines
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot