[meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953

[meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2023-33953 affects the gRPC C-core HPACK parser used by the
  C++, Python, and Ruby implementations [1][2].
- grpc-go is an independent Go implementation and does not contain the
  affected C-core HPACK path [1][2].
- The grpc-go v1.56.1 to v1.56.2 comparison contains no HPACK security
  fix, so the C-core 1.56.2 fixed-version boundary does not apply [3].
- Hence ignoring the CVE for grpc-go.

Reference:
[1] https://cloud.google.com/support/bulletins#gcp-2023-022
[2] https://github.com/advisories/GHSA-496j-2rq6-j6cc
[3] https://github.com/grpc/grpc-go/compare/v1.56.1...v1.56.2

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 recipes-devtools/go/grpc-go_git.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/recipes-devtools/go/grpc-go_git.bb b/recipes-devtools/go/grpc-go_git.bb
index 2b5894d3..7c8e05ca 100644
--- a/recipes-devtools/go/grpc-go_git.bb
+++ b/recipes-devtools/go/grpc-go_git.bb
@@ -46,3 +46,4 @@ CVE_PRODUCT += "grpc"
 # grpc-go (Go implementation in meta-virtualization) does not
 # contain the affected HPACK code path.
 CVE_STATUS[CVE-2024-7246] = "not-applicable-config: CVE is for grpc (C-core), not grpc-go."
+CVE_STATUS[CVE-2023-33953] = "not-applicable-config: CVE affects gRPC C-core-based implementations, not grpc-go."
-- 
2.35.6

[meta-virtualization][wrynose][PATCH 2/2] grpc-go: Ignore CVE-2024-37168

[Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- CVE-2024-37168 affects the JavaScript implementation distributed as
  the @grpc/grpc-js npm package [1].
- The grpc-go recipe builds the independent Go implementation and does
  not contain the affected JavaScript message handling paths [1].
- Hence ignoring the CVE for grpc-go as an incorrect CPE match.

Reference:
[1] https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 recipes-devtools/go/grpc-go_git.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/recipes-devtools/go/grpc-go_git.bb b/recipes-devtools/go/grpc-go_git.bb
index 7c8e05ca..6d56ed20 100644
--- a/recipes-devtools/go/grpc-go_git.bb
+++ b/recipes-devtools/go/grpc-go_git.bb
@@ -47,3 +47,4 @@ CVE_PRODUCT += "grpc"
 # contain the affected HPACK code path.
 CVE_STATUS[CVE-2024-7246] = "not-applicable-config: CVE is for grpc (C-core), not grpc-go."
 CVE_STATUS[CVE-2023-33953] = "not-applicable-config: CVE affects gRPC C-core-based implementations, not grpc-go."
+CVE_STATUS[CVE-2024-37168] = "cpe-incorrect: affects @grpc/grpc-js, not grpc-go"
-- 
2.35.6

Re: [meta-virtualization][wrynose][PATCH 1/2] grpc-go: Ignore CVE-2023-33953

[Bruce Ashfield]

merged

Bruce

Re: [meta-virtualization][wrynose][PATCH 2/2] grpc-go: Ignore CVE-2024-37168

[Bruce Ashfield]

merged

Bruce