* [Buildroot] [PATCH 1/1] package/ed: annotate CVE-2015-2987
@ 2020-03-01 19:46 Fabrice Fontaine
2020-03-01 20:02 ` Thomas Petazzoni
0 siblings, 1 reply; 3+ messages in thread
From: Fabrice Fontaine @ 2020-03-01 19:46 UTC (permalink / raw)
To: buildroot
CVE-2015-2987 is misclassified (by our CVE tracker) as affecting ed,
while in fact it affects Type74 ED (http://type74.org/edman5-1.php).
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
package/ed/ed.mk | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/package/ed/ed.mk b/package/ed/ed.mk
index 6ef8f951cf..271297f60a 100644
--- a/package/ed/ed.mk
+++ b/package/ed/ed.mk
@@ -10,6 +10,10 @@ ED_SOURCE = ed-$(ED_VERSION).tar.lz
ED_LICENSE = GPL-3.0+
ED_LICENSE_FILES = COPYING
+# CVE-2015-2987 is misclassified (by our CVE tracker) as affecting ed, while in
+# fact it affects Type74 ED (http://type74.org/edman5-1.php).
+ED_IGNORE_CVES += CVE-2015-2987
+
define ED_CONFIGURE_CMDS
(cd $(@D); \
$(TARGET_MAKE_ENV) ./configure \
--
2.25.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH 1/1] package/ed: annotate CVE-2015-2987
2020-03-01 19:46 [Buildroot] [PATCH 1/1] package/ed: annotate CVE-2015-2987 Fabrice Fontaine
@ 2020-03-01 20:02 ` Thomas Petazzoni
2020-03-01 20:22 ` Fabrice Fontaine
0 siblings, 1 reply; 3+ messages in thread
From: Thomas Petazzoni @ 2020-03-01 20:02 UTC (permalink / raw)
To: buildroot
On Sun, 1 Mar 2020 20:46:37 +0100
Fabrice Fontaine <fontaine.fabrice@gmail.com> wrote:
> CVE-2015-2987 is misclassified (by our CVE tracker) as affecting ed,
> while in fact it affects Type74 ED (http://type74.org/edman5-1.php).
>
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Same comment as for smack and argus: we need to add a CPE ID mapping
mechanism, and not add these IGNORE_CVES entries.
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH 1/1] package/ed: annotate CVE-2015-2987
2020-03-01 20:02 ` Thomas Petazzoni
@ 2020-03-01 20:22 ` Fabrice Fontaine
0 siblings, 0 replies; 3+ messages in thread
From: Fabrice Fontaine @ 2020-03-01 20:22 UTC (permalink / raw)
To: buildroot
Le dim. 1 mars 2020 ? 21:02, Thomas Petazzoni
<thomas.petazzoni@bootlin.com> a ?crit :
>
> On Sun, 1 Mar 2020 20:46:37 +0100
> Fabrice Fontaine <fontaine.fabrice@gmail.com> wrote:
>
> > CVE-2015-2987 is misclassified (by our CVE tracker) as affecting ed,
> > while in fact it affects Type74 ED (http://type74.org/edman5-1.php).
> >
> > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
>
> Same comment as for smack and argus: we need to add a CPE ID mapping
> mechanism, and not add these IGNORE_CVES entries.
OK, then I'll stop sending patches for those kind of issues ;-)
>
> Thomas
> --
> Thomas Petazzoni, CTO, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-03-01 20:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-03-01 19:46 [Buildroot] [PATCH 1/1] package/ed: annotate CVE-2015-2987 Fabrice Fontaine
2020-03-01 20:02 ` Thomas Petazzoni
2020-03-01 20:22 ` Fabrice Fontaine
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox