Re: [oe] [meta-java][dunfell][PATCH] xerces-j: Whitelisted CVE-2018-2799

["Richard Leitner" <richard.leitner@skidata.com>]

Hi,
thanks for the patch and sorry for the late reply.
Unfortunately there are some problems with your patch.

Your git author seems to be set up incorrectly. Please set it up
correctly using the following commands before formatting the patch:

	$ git config user.name "John Doe"
	$ git config user.email johndoe@example.com

On Tue, Jul 20, 2021 at 04:11:40AM -0400, Saloni Jain via lists.openembedded.org wrote:
> Whitelisted below CVE:
> CVE-2018-2799:
> CVE only applies to some Oracle Java SE and Red Hat
> Enterprise Linux versions which is already fixed with
> updates and the issue is closed.
> Link: https://access.redhat.com/security/cve/CVE-2018-2799
> Link: https://bugzilla.redhat.com/show_bug.cgi?id=1567542

Furthermore you are missing a Signed-Off-By line here. Please add it.

> ---
>  recipes-core/xerces-j/xerces-j_2.11.0.bb | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/recipes-core/xerces-j/xerces-j_2.11.0.bb b/recipes-core/xerces-j/xerces-j_2.11.0.bb
> index 98ef32f..f2a4434 100644
> --- a/recipes-core/xerces-j/xerces-j_2.11.0.bb
> +++ b/recipes-core/xerces-j/xerces-j_2.11.0.bb
> @@ -14,6 +14,12 @@ LIC_FILES_CHKSUM = " \
>  
>  SRC_URI = "http://archive.apache.org/dist/xerces/j/Xerces-J-src.${PV}.tar.gz"
>  
> +# CVE only applies to some Oracle Java SE and Red Hat Enterprise Linux versions.
> +# Already fixed with updates and closed.
> +# https://access.redhat.com/security/cve/CVE-2018-2799
> +# https://bugzilla.redhat.com/show_bug.cgi?id=1567542
> +CVE_CHECK_WHITELIST += "CVE-2018-2799"
> +
>  S = "${WORKDIR}/xerces-2_11_0"
>  
>  inherit java-library
> -- 
> 2.17.1

Otherwise the patch seems fine to me. So I'm looking forward to receive
a v2 from you 😉

regards;rl