[Buildroot] [PATCH] package/cpio: drop CVE-2021-38185 from IGNORE_CVES

[Buildroot] [PATCH] package/cpio: drop CVE-2021-38185 from IGNORE_CVES

[Daniel Lang]

CVE-2021-38185 affects cpio <= 2.13.
The mentioned patches were removed in b0306d94 when bumping to 2.14.

Signed-off-by: Daniel Lang <dalang@gmx.at>
---
 package/cpio/cpio.mk | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/package/cpio/cpio.mk b/package/cpio/cpio.mk
index 19224000bb..911d16822b 100644
--- a/package/cpio/cpio.mk
+++ b/package/cpio/cpio.mk
@@ -12,10 +12,6 @@ CPIO_LICENSE = GPL-3.0+
 CPIO_LICENSE_FILES = COPYING
 CPIO_CPE_ID_VENDOR = gnu
 
-# 0002-Rewrite-dynamic-string-support.patch
-# 0003-Fix-previous-commit.patch
-CPIO_IGNORE_CVES += CVE-2021-38185
-
 # cpio uses argp.h which is not provided by uclibc or musl by default.
 # Use the argp-standalone package to provide this.
 ifeq ($(BR2_PACKAGE_ARGP_STANDALONE),y)
-- 
2.42.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/cpio: drop CVE-2021-38185 from IGNORE_CVES

[Yann E. MORIN]

Daniel, All,

On 2023-09-20 06:34 +0200, Daniel Lang spake thusly:
> CVE-2021-38185 affects cpio <= 2.13.
> The mentioned patches were removed in b0306d94 when bumping to 2.14.
> 
> Signed-off-by: Daniel Lang <dalang@gmx.at>

Applied to master, thanks.

Regards,
Yann E. MORIN.

> ---
>  package/cpio/cpio.mk | 4 ----
>  1 file changed, 4 deletions(-)
> 
> diff --git a/package/cpio/cpio.mk b/package/cpio/cpio.mk
> index 19224000bb..911d16822b 100644
> --- a/package/cpio/cpio.mk
> +++ b/package/cpio/cpio.mk
> @@ -12,10 +12,6 @@ CPIO_LICENSE = GPL-3.0+
>  CPIO_LICENSE_FILES = COPYING
>  CPIO_CPE_ID_VENDOR = gnu
>  
> -# 0002-Rewrite-dynamic-string-support.patch
> -# 0003-Fix-previous-commit.patch
> -CPIO_IGNORE_CVES += CVE-2021-38185
> -
>  # cpio uses argp.h which is not provided by uclibc or musl by default.
>  # Use the argp-standalone package to provide this.
>  ifeq ($(BR2_PACKAGE_ARGP_STANDALONE),y)
> -- 
> 2.42.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/cpio: drop CVE-2021-38185 from IGNORE_CVES

[Peter Korsgaard]

>>>>> "Daniel" == Daniel Lang <dalang@gmx.at> writes:

 > CVE-2021-38185 affects cpio <= 2.13.
 > The mentioned patches were removed in b0306d94 when bumping to 2.14.

 > Signed-off-by: Daniel Lang <dalang@gmx.at>

Committed to 2023.05.x and 2023.08.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot