[meta-virtualization][wrynose][PATCH 2/2] grpc-go: Ignore CVE-2024-37168

["Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" <hthakar@cisco.com>]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2024-37168 affects the JavaScript implementation distributed as
  the @grpc/grpc-js npm package [1].
- The grpc-go recipe builds the independent Go implementation and does
  not contain the affected JavaScript message handling paths [1].
- Hence ignoring the CVE for grpc-go as an incorrect CPE match.

Reference:
[1] https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 recipes-devtools/go/grpc-go_git.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/recipes-devtools/go/grpc-go_git.bb b/recipes-devtools/go/grpc-go_git.bb
index 7c8e05ca..6d56ed20 100644
--- a/recipes-devtools/go/grpc-go_git.bb
+++ b/recipes-devtools/go/grpc-go_git.bb
@@ -47,3 +47,4 @@ CVE_PRODUCT += "grpc"
 # contain the affected HPACK code path.
 CVE_STATUS[CVE-2024-7246] = "not-applicable-config: CVE is for grpc (C-core), not grpc-go."
 CVE_STATUS[CVE-2023-33953] = "not-applicable-config: CVE affects gRPC C-core-based implementations, not grpc-go."
+CVE_STATUS[CVE-2024-37168] = "cpe-incorrect: affects @grpc/grpc-js, not grpc-go"
-- 
2.35.6