Re: [Buildroot] [PATCH 09/14] package/libconfuse: add CVE trailer in patch

[Baruch Siach via buildroot <buildroot@buildroot.org>]

Hi Arnout,

On Wed, Jan 07 2026, Arnout Vandecappelle via buildroot wrote:
> In reply of:
>> Since Buildroot commit [1] the patches that fixes a security
>> vulnerability needs to reference the fixed vulnerability.
>> 
>> This patch adds the relevant information to the patch header
>> and adds the `Upstream` trailer.
>> 
>> [1] 1167d0ff3d docs/manual: mention CVE trailer
>> 
>> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
>
> Applied to 2025.02.x and 2025.11.x. Thanks

Not in 2025.11.x as of commit e98515299 ("package/mupdf: add
CVE-2024-2425{8, 9} to IGNORE_CVES").

baruch

>
>> ---
>>  .../0001-Fix-163-unterminated-username-used-with-getpwnam.patch | 2 ++
>>  1 file changed, 2 insertions(+)
>> 
>> diff --git
>> a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
>> b/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
>> index 9ff3f5ec1c..4c2aa114aa 100644
>> --- a/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
>> +++ b/package/libconfuse/0001-Fix-163-unterminated-username-used-with-getpwnam.patch
>> @@ -5,6 +5,8 @@ Subject: [PATCH] Fix #163: unterminated username used with getpwnam()
>>  
>>  Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
>>  
>> +CVE: CVE-2022-40320
>> +Upstream: https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b
>>  [Retrieved (and backported) from:
>>  https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b]
>>  Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
>> -- 
>> 2.52.0
>> 
>> _______________________________________________
>> buildroot mailing list
>> buildroot@buildroot.org
>> https://lists.buildroot.org/mailman/listinfo/buildroot
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
                                                     ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot