Skip to contentSkip to conversation

package/libxml2: properly set LIBXML2_IGNORE_CVES

PATCH New Thomas Petazzoni 3 participants 4 messages Feb 18, 2020 – Feb 19, 2020

lore
Share & tools
lore

Thomas Petazzoni

author
#0 lore raw

PATCH 1/1 package/libxml2: properly set LIBXML2_IGNORE_CVES

The libxml2 package has two patches that fix the two CVEs affecting libxml2 in version 2.9.10, so let's use LIBXML2_IGNORE_CVES to ensure these CVEs are no longer reported by pkg-stats.

Cc Titouan Christophe <[email protected]>
Cc Thomas De Schampheleire <[email protected]>
Signed-off-by Thomas Petazzoni <[email protected]>
---
 package/libxml2/libxml2.mk | 4 ++++
 1 file changed, 4 insertions(+)
package/libxml2/libxml2.mk +4 -0
index f6cf084b2b..ea6a8c1f6d 100644
@@ -9,6 +9,10 @@ LIBXML2_SITE = http://xmlsoft.org/sources
 LIBXML2_INSTALL_STAGING = YES
 LIBXML2_LICENSE = MIT
 LIBXML2_LICENSE_FILES = COPYING
+# 0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
+LIBXML2_IGNORE_CVES += CVE-2020-7595
+# 0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
+LIBXML2_IGNORE_CVES += CVE-2019-20388
 LIBXML2_CONFIG_SCRIPTS = xml2-config
 
 # relocation truncated to fit: R_68K_GOT16O
Signature · 1 line
2.24.1
#1 lore raw

PATCH 1/1 package/libxml2: properly set LIBXML2_IGNORE_CVES

Quoted 9 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Thomas" == Thomas Petazzoni <[email protected]> writes:

The libxml2 package has two patches that fix the two CVEs affecting libxml2 in version 2.9.10, so let's use LIBXML2_IGNORE_CVES to ensure these CVEs are no longer reported by pkg-stats.

Cc Titouan Christophe <[email protected]>
Cc Thomas De Schampheleire <[email protected]>
Signed-off-by Thomas Petazzoni <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard
#2 lore raw

PATCH 1/1 package/libxml2: properly set LIBXML2_IGNORE_CVES

In reply to Thomas Petazzoni

El mi?., 19 feb. 2020 a las 0:37, Thomas Petazzoni (<[email protected]>) escribi?:

Quoted 18 lines

The libxml2 package has two patches that fix the two CVEs affecting libxml2 in version 2.9.10, so let's use LIBXML2_IGNORE_CVES to ensure these CVEs are no longer reported by pkg-stats.

Cc Titouan Christophe <[email protected]>
Cc Thomas De Schampheleire <[email protected]>
Signed-off-by Thomas Petazzoni <[email protected]>
---
 package/libxml2/libxml2.mk | 4 ++++
 1 file changed, 4 insertions(+)
package/libxml2/libxml2.mk +0 -0
index f6cf084b2b..ea6a8c1f6d 100644
@@ -9,6 +9,10 @@ LIBXML2_SITE = http://xmlsoft.org/sources
 LIBXML2_INSTALL_STAGING = YES

package/libxml2/libxml2.mk LIBXML2_SITE = http://xmlsoft.org/sources

Quoted 10 lines
package/libxml2/libxml2.mk +4 -1
 LIBXML2_LICENSE = MIT
 LIBXML2_LICENSE_FILES = COPYING
+# 0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
+LIBXML2_IGNORE_CVES += CVE-2020-7595
+# 0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
+LIBXML2_IGNORE_CVES += CVE-2019-20388
 LIBXML2_CONFIG_SCRIPTS = xml2-config
 
 # relocation truncated to fit: R_68K_GOT16O
--

Thanks, I was just going to make this change after Peter's mail :-)

What is the update frequency of http://autobuild.buildroot.org/stats/ ?

/Thomas

author
#3 lore raw

PATCH 1/1 package/libxml2: properly set LIBXML2_IGNORE_CVES

Quoted 1 line · On Wed, 19 Feb 2020 10:11:51 +0100 Thomas De Schampheleire…

What is the update frequency of http://autobuild.buildroot.org/stats/ ?

Normally every day at 8:00 AM CET. Based on the data of the next branch when a next branch exists, otherwise using data of the master branch.

However, we will probably want to run it on master / LTS as well in order to have CVE information for these branches as well.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com