Re: [Buildroot] [PATCH v2] package/qt6base: fix CVE-2024-39936

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello Roy,

On Thu, 15 Aug 2024 11:26:14 +0200
Roy Kollen Svendsen <roykollensvendsen@gmail.com> wrote:

> Fixes:
> https://security-tracker.debian.org/tracker/CVE-2024-39936
> 
> Got patch from:
> https://github.com/qt/qtbase/commit/2b1e36e183ce75c224305c7a94457b92f7a5cf58
> 
> Signed-off-by: Roy Kollen Svendsen <roykollensvendsen@gmail.com>

Thanks, applied to master, after doing two tweaks. First,
package/qt6/qt6base: as the prefix in the commit title (to match the
real location of the package).

> diff --git a/package/qt6/qt6base/qt6base.mk b/package/qt6/qt6base/qt6base.mk
> index 5ab61ba3e0..71dff3e672 100644
> --- a/package/qt6/qt6base/qt6base.mk
> +++ b/package/qt6/qt6base/qt6base.mk
> @@ -10,6 +10,8 @@ QT6BASE_SOURCE = qtbase-$(QT6_SOURCE_TARBALL_PREFIX)-$(QT6BASE_VERSION).tar.xz
>  QT6BASE_CPE_ID_VENDOR = qt
>  QT6BASE_CPE_ID_PRODUCT = qt
>  
> +QT6BASE_IGNORE_CVES += CVE-2024-39936

And second, after adding a comment above this line that clarifies why
this CVE is ignored (just mentioning the patch file name is enough).

Indeed, not all CVEs are ignored because we have patches. Sometimes, we
ignore CVEs because they are irrelevant in the Buildroot context for
example, in which case we have a comment that explains why.

Thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot