[meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953

["Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2023-33953 affects the gRPC C-core HPACK parser used by the
  C++, Python, and Ruby implementations [1][2].
- grpc-go is an independent Go implementation and does not contain the
  affected C-core HPACK path [1][2].
- The grpc-go v1.56.1 to v1.56.2 comparison contains no HPACK security
  fix, so the C-core 1.56.2 fixed-version boundary does not apply [3].
- Hence ignoring the CVE for grpc-go.

Reference:
[1] https://cloud.google.com/support/bulletins#gcp-2023-022
[2] https://github.com/advisories/GHSA-496j-2rq6-j6cc
[3] https://github.com/grpc/grpc-go/compare/v1.56.1...v1.56.2

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 recipes-devtools/go/grpc-go_git.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/recipes-devtools/go/grpc-go_git.bb b/recipes-devtools/go/grpc-go_git.bb
index 2b5894d3..7c8e05ca 100644
--- a/recipes-devtools/go/grpc-go_git.bb
+++ b/recipes-devtools/go/grpc-go_git.bb
@@ -46,3 +46,4 @@ CVE_PRODUCT += "grpc"
 # grpc-go (Go implementation in meta-virtualization) does not
 # contain the affected HPACK code path.
 CVE_STATUS[CVE-2024-7246] = "not-applicable-config: CVE is for grpc (C-core), not grpc-go."
+CVE_STATUS[CVE-2023-33953] = "not-applicable-config: CVE affects gRPC C-core-based implementations, not grpc-go."
-- 
2.35.6