[Buildroot] [PATCH] package/libxml2: properly set LIBXML2_IGNORE_CVES

[Buildroot] [PATCH] package/libxml2: properly set LIBXML2_IGNORE_CVES

[Thomas Petazzoni]

The libxml2 package has two patches that fix the two CVEs affecting
libxml2 in version 2.9.10, so let's use LIBXML2_IGNORE_CVES to ensure
these CVEs are no longer reported by pkg-stats.

Cc: Titouan Christophe <titouan.christophe@railnova.eu>
Cc: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
---
 package/libxml2/libxml2.mk | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/package/libxml2/libxml2.mk b/package/libxml2/libxml2.mk
index f6cf084b2b..ea6a8c1f6d 100644
--- a/package/libxml2/libxml2.mk
+++ b/package/libxml2/libxml2.mk
@@ -9,6 +9,10 @@ LIBXML2_SITE = http://xmlsoft.org/sources
 LIBXML2_INSTALL_STAGING = YES
 LIBXML2_LICENSE = MIT
 LIBXML2_LICENSE_FILES = COPYING
+# 0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
+LIBXML2_IGNORE_CVES += CVE-2020-7595
+# 0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
+LIBXML2_IGNORE_CVES += CVE-2019-20388
 LIBXML2_CONFIG_SCRIPTS = xml2-config
 
 # relocation truncated to fit: R_68K_GOT16O
-- 
2.24.1

[Buildroot] [PATCH] package/libxml2: properly set LIBXML2_IGNORE_CVES

[Peter Korsgaard]

>>>>> "Thomas" == Thomas Petazzoni <thomas.petazzoni@bootlin.com> writes:

 > The libxml2 package has two patches that fix the two CVEs affecting
 > libxml2 in version 2.9.10, so let's use LIBXML2_IGNORE_CVES to ensure
 > these CVEs are no longer reported by pkg-stats.

 > Cc: Titouan Christophe <titouan.christophe@railnova.eu>
 > Cc: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
 > Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

Committed, thanks.

-- 
Bye, Peter Korsgaard

[Buildroot] [PATCH] package/libxml2: properly set LIBXML2_IGNORE_CVES

[Thomas De Schampheleire]

El mi?., 19 feb. 2020 a las 0:37, Thomas Petazzoni
(<thomas.petazzoni@bootlin.com>) escribi?:
>
> The libxml2 package has two patches that fix the two CVEs affecting
> libxml2 in version 2.9.10, so let's use LIBXML2_IGNORE_CVES to ensure
> these CVEs are no longer reported by pkg-stats.
>
> Cc: Titouan Christophe <titouan.christophe@railnova.eu>
> Cc: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
> ---
>  package/libxml2/libxml2.mk | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/package/libxml2/libxml2.mk b/package/libxml2/libxml2.mk
> index f6cf084b2b..ea6a8c1f6d 100644
> --- a/package/libxml2/libxml2.mk
> +++ b/package/libxml2/libxml2.mk
> @@ -9,6 +9,10 @@ LIBXML2_SITE = http://xmlsoft.org/sources
>  LIBXML2_INSTALL_STAGING = YES
>  LIBXML2_LICENSE = MIT
>  LIBXML2_LICENSE_FILES = COPYING
> +# 0001-Fix-infinite-loop-in-xmlStringLenDecodeEntities.patch
> +LIBXML2_IGNORE_CVES += CVE-2020-7595
> +# 0002-Fix-memory-leak-in-xmlSchemaValidateStream.patch
> +LIBXML2_IGNORE_CVES += CVE-2019-20388
>  LIBXML2_CONFIG_SCRIPTS = xml2-config
>
>  # relocation truncated to fit: R_68K_GOT16O
> --

Thanks, I was just going to make this change after Peter's mail :-)

What is the update frequency of http://autobuild.buildroot.org/stats/ ?

/Thomas

[Buildroot] [PATCH] package/libxml2: properly set LIBXML2_IGNORE_CVES

[Thomas Petazzoni]

On Wed, 19 Feb 2020 10:11:51 +0100
Thomas De Schampheleire <patrickdepinguin@gmail.com> wrote:

> What is the update frequency of http://autobuild.buildroot.org/stats/ ?

Normally every day at 8:00 AM CET. Based on the data of the next branch
when a next branch exists, otherwise using data of the master branch.

However, we will probably want to run it on master / LTS as well in
order to have CVE information for these branches as well.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com