[meta-virtualization][PATCH] podman: set status of several CVEs

[meta-virtualization][PATCH] podman: set status of several CVEs

[Peter Marko]

From: Peter Marko <peter.marko@siemens.com>

These CVEs are showing up in CVE reports as open due to sbom-cve-check
tooling not being able to make decision.

All statements are based on Debian CVE tracker links/comments.
The 4th one also additionally by checking commit marked as "unaffected"
in [1] which updated buildah to 1.27.6 while we already have 1.43.4.

* CVE-2019-10214: no-version-ranges (no unaffected tags in DB)
* CVE-2022-2738: no-version-ranges (only RedHat package versions in DB)
* CVE-2022-2739: no-version-ranges (only RedHat package versions in DB)
* CVE-2025-4953: no-version-ranges (unaffected version is git hash)

[1] https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/4xxx/CVE-2025-4953.json

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 recipes-containers/podman/podman_git.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/recipes-containers/podman/podman_git.bb b/recipes-containers/podman/podman_git.bb
index 161d0c6a..707ede83 100644
--- a/recipes-containers/podman/podman_git.bb
+++ b/recipes-containers/podman/podman_git.bb
@@ -32,9 +32,13 @@ PV = "6.2.0-dev"
 CVE_PRODUCT = "podman_project:podman libpod_project:libpod"
 
 CVE_STATUS[CVE-2019-10152] = "fixed-version: fixed since v1.4.0"
+CVE_STATUS[CVE-2019-10214] = "fixed-version: fixed since v3.0.0"
 CVE_STATUS[CVE-2020-1726] = "fixed-version: fixed since v1.8.1"
+CVE_STATUS[CVE-2022-2738] = "not-applicable-platform: RedHat specific issue"
+CVE_STATUS[CVE-2022-2739] = "not-applicable-platform: RedHat specific issue"
 CVE_STATUS[CVE-2022-2989] = "fixed-version: fixed since v4.3.0"
 CVE_STATUS[CVE-2023-0778] = "fixed-version: fixed since v4.5.0"
+CVE_STATUS[CVE-2025-4953] = "fixed-version: fixed in used buildah version"
 
 PACKAGES =+ "${PN}-contrib"
 

Re: [meta-virtualization][PATCH] podman: set status of several CVEs

[Bruce Ashfield]

merged

Is this applicable to wrynose as well ? If so, let me know and I can
apply it there. If it doesn't apply cleanly to that branch, send a
version for it.

Bruce

RE: [meta-virtualization][PATCH] podman: set status of several CVEs

[Marko, Peter]

Sent for blacksail and wrynose, too.

Peter

> -----Original Message-----
> From: Bruce Ashfield <bruce.ashfield@gmail.com>
> Sent: Thursday, November 5, 2026 5:29 PM
> To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>
> Cc: meta-virtualization@lists.yoctoproject.org
> Subject: Re: [meta-virtualization][PATCH] podman: set status of several CVEs
> 
> merged
> 
> Is this applicable to wrynose as well ? If so, let me know and I can
> apply it there. If it doesn't apply cleanly to that branch, send a
> version for it.
> 
> Bruce