RE: [yocto] CVE patch updates

["Monsees, Steven C (US)" <steven.monsees@baesystems.com>]

[-- Attachment #1: Type: text/plain, Size: 2604 bytes --]


Thanks Tim,  subscribed…

From: Tim Orling <ticotimo@gmail.com>
Sent: Thursday, March 24, 2022 9:03 PM
To: Richard Purdie <richard.purdie@linuxfoundation.org>
Cc: Monsees, Steven C (US) <steven.monsees@baesystems.com>; yocto@lists.yoctoproject.org
Subject: Re: [yocto] CVE patch updates

External Email Alert

This email has been sent from an account outside of the BAE Systems network.
Please treat the email with caution, especially if you are requested to click on a link, decrypt/open an attachment, or enable macros.  For further information on how to spot phishing, access “Cybersecurity OneSpace Page” and report phishing by clicking the button “Report Phishing” on the Outlook toolbar.




On Thu, Mar 24, 2022 at 2:45 PM Richard Purdie <richard.purdie@linuxfoundation.org<mailto:richard.purdie@linuxfoundation.org>> wrote:
On Thu, 2022-03-24 at 16:56 +0000, Monsees, Steven C (US) via
lists.yoctoproject.org<http://lists.yoctoproject.org> wrote:
>
> I am currently building in cve-check to see what is reported, and I was curious
> if Yocto might provide any CVE based patch repositories ?
>
> Is there a yocto page somewhere that goes over this side of things ?,
> I did not see much in the mega-manual… I am running on zeus based platforms (for
> both armarch64 and x86_64).
>

You'll see output of cve-check on the yocto-security list for layers that are
still in maintenance:

https://lists.yoctoproject.org/g/yocto-security/messages

although zeus is out of maintenance.

We merge CVE fixes to the branches that are in maintenance.

A graph showing the data over time:

https://docs.google.com/spreadsheets/d/e/2PACX-1vRgNISmH0Ditf0bRtSezeR2XsgKIiSFJKF6KJUHpnzocNGzvKZbuSDKfmV3n64BFXDRqElBSJnhHtG4/pubchart?oid=1993375488&format=interactive

Steven, if you haven’t already, you should subscribe to
https://lists.yoctoproject.org/g/yocto-security

Emails are sent out, usually on Sunday. If you see a CVE that interests you… grab it and fix it.

This is mostly a community effort. There is no special dedicated squad of security champions.


Cheers,

Richard




-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#56555): https://lists.yoctoproject.org/g/yocto/message/56555
Mute This Topic: https://lists.yoctoproject.org/mt/90004034/924729
Group Owner: yocto+owner@lists.yoctoproject.org<mailto:yocto%2Bowner@lists.yoctoproject.org>
Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [ticotimo@gmail.com<mailto:ticotimo@gmail.com>]
-=-=-=-=-=-=-=-=-=-=-=-

[-- Attachment #2: Type: text/html, Size: 8347 bytes --]