package/sysstat: drop CVE-2022-39377 from IGNORE_CVES
PATCH 1/1 package/sysstat: drop CVE-2022-39377 from IGNORE_CVES
As off 2022-11-22 CVE-2022-39377 is listed as affecting sysstat < 2.16.1 instead of < 2.17.1.
--- package/sysstat/sysstat.mk | 3 --- 1 file changed, 3 deletions(-)
package/sysstat/sysstat.mk +0 -3
@@ -14,9 +14,6 @@ SYSSTAT_LICENSE_FILES = COPYING SYSSTAT_CPE_ID_VENDOR = sysstat_project SYSSTAT_SELINUX_MODULES = sysstat -# NVD is not up-to-date; 12.6.1 includes c1e631eddc50, which fixes the issue -SYSSTAT_IGNORE_CVES += CVE-2022-39377 - ifeq ($(BR2_PACKAGE_LM_SENSORS),y) SYSSTAT_DEPENDENCIES += lm-sensors SYSSTAT_CONF_OPTS += --enable-sensors
Signature · 6 lines
2.42.0 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 2 lines · On Thu, 21 Sep 2023 06:15:18 +0200 Daniel Lang <[email protected]> wrote:
As off 2022-11-22 CVE-2022-39377 is listed as affecting sysstat < 2.16.1 instead of < 2.17.1.
Hm, the comment below talks about 12.6.1, here's you talking about 2.16.1 vs. 2.17.1. Could you clarify this?
Quoted 1 line
-# NVD is not up-to-date; 12.6.1 includes
c1e631eddc50, which fixes the issue
^^^^^^ here
Quoted 1 line
-SYSSTAT_IGNORE_CVES += CVE-2022-39377
Thomas
Signature · 7 lines
Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 4 lines · Daniel Lang
As off 2022-11-22 CVE-2022-39377 is listed as affecting sysstat < 2.16.1 instead of < 2.17.1.
Signed-off-by Daniel Lang <[email protected]>
Applied to master, thanks.
Because of Thomas's comment, I've extended the commit message with "The text
is not updated, but the CPE info is." Probably not enough to address his concern though. The thing is, the comment itself was a bit confusing: the original CPE info said "Up to (excluding) 12.7.1" and that has been corrected to 12.6.1. So indeed, the CVE info is currently correct.
Regards,
Arnout
Quoted 9 lines
--- package/sysstat/sysstat.mk | 3 --- 1 file changed, 3 deletions(-)package/sysstat/sysstat.mk +0
-0
package/sysstat/sysstat.mk SYSSTAT_LICENSE_FILES = COPYING · line 19
Quoted 9 lines
package/sysstat/sysstat.mk +0
-3@@ -14,9 +14,6 @@ SYSSTAT_LICENSE_FILES = COPYING SYSSTAT_CPE_ID_VENDOR = sysstat_project SYSSTAT_SELINUX_MODULES = sysstat -# NVD is not up-to-date; 12.6.1 includes c1e631eddc50, which fixes the issue -SYSSTAT_IGNORE_CVES += CVE-2022-39377 - ifeq ($(BR2_PACKAGE_LM_SENSORS),y) SYSSTAT_DEPENDENCIES += lm-sensors SYSSTAT_CONF_OPTS += --enable-sensors
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 6 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Daniel" == Daniel Lang <[email protected]> writes:
As off 2022-11-22 CVE-2022-39377 is listed as affecting sysstat < 2.16.1 instead of < 2.17.1.
Signed-off-by Daniel Lang <[email protected]>
Committed to 2023.02.x, 2023.05.x and 2023.08.x, thanks.
Signature · 5 lines
Bye, Peter Korsgaard _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot