From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3F983C3ABC9 for ; Sun, 18 May 2025 08:57:35 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 0F8AD408A3; Sun, 18 May 2025 08:57:35 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 1uuR0AxSn89p; Sun, 18 May 2025 08:57:34 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=buildroot-bounces@buildroot.org; receiver= DKIM-Filter: OpenDKIM Filter v2.11.0 smtp4.osuosl.org 532A7408A5 Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp4.osuosl.org (Postfix) with ESMTP id 532A7408A5; Sun, 18 May 2025 08:57:34 +0000 (UTC) Received: from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136]) by lists1.osuosl.org (Postfix) with ESMTP id 0417EE4 for ; Sun, 18 May 2025 08:57:29 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id DD35960775 for ; Sun, 18 May 2025 08:57:28 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id UxFS-8yRW30T for ; Sun, 18 May 2025 08:57:28 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2001:4b98:dc4:8::225; helo=relay5-d.mail.gandi.net; envelope-from=thomas.petazzoni@bootlin.com; receiver= DMARC-Filter: OpenDMARC Filter v1.4.2 smtp3.osuosl.org 2429160699 DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 2429160699 Received: from relay5-d.mail.gandi.net (relay5-d.mail.gandi.net [IPv6:2001:4b98:dc4:8::225]) by smtp3.osuosl.org (Postfix) with ESMTPS id 2429160699 for ; Sun, 18 May 2025 08:57:27 +0000 (UTC) Received: by mail.gandi.net (Postfix) with ESMTPA id 4C8E4432FD; Sun, 18 May 2025 08:57:26 +0000 (UTC) To: Buildroot List Cc: =?UTF-8?q?Rapha=C3=ABl=20M=C3=A9lotte?= , Thomas Petazzoni Date: Sun, 18 May 2025 10:56:55 +0200 Message-ID: <20250518085723.23020-3-thomas.petazzoni@bootlin.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250518085723.23020-1-thomas.petazzoni@bootlin.com> References: <20250518085723.23020-1-thomas.petazzoni@bootlin.com> MIME-Version: 1.0 X-GND-State: clean X-GND-Score: -100 X-GND-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdefudektdelucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuifetpfffkfdpucggtfgfnhhsuhgsshgtrhhisggvnecuuegrihhlohhuthemuceftddunecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjughrpefhvfevufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpefvhhhomhgrshcurfgvthgriiiiohhnihcuoehthhhomhgrshdrphgvthgriiiiohhnihessghoohhtlhhinhdrtghomheqnecuggftrfgrthhtvghrnheptedtgedutdfghfetfeelhfdtteevvdeludekkeeiudegjeehgfevudeuudeutefhnecukfhppedvrgdtvdemkeegvdgrmeeghegrtgemleegtddumegufeduvgemvdefheemtgehvgdvmegvugekfeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpedvrgdtvdemkeegvdgrmeeghegrtgemleegtddumegufeduvgemvdefheemtgehvgdvmegvugekfedphhgvlhhopeifihhnughsuhhrfhdrrddpmhgrihhlfhhrohhmpehthhhomhgrshdrphgvthgriiiiohhnihessghoohhtlhhinhdrtghomhdpnhgspghrtghpthhtohepfedprhgtphhtthhopegsuhhilhgurhhoohhtsegsuhhilhgurhhoohhtrdhorhhgpdhrtghpthhtoheprhgrphhhrggvlhdrmhgvlhhothhtvgesmhhinhgurdgsvgdprhgtphhtthhopehthhhomhgrshdrphgvthgriiiiohhnihessghoohhtl hhinhdrtghomh X-GND-Sasl: thomas.petazzoni@bootlin.com X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1747558646; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FwJGxD5Xz6pir3QpsbwAo7utTmyQMi1HagbRFaX5sSM=; b=MSZLidHRn97p+ohp6YN7mWZjbVAvEXfIguxiUhppWwMhIElBaIOIH4tRLESxUKuKJxeL3Q 7GdCtLFP8PTUwdwy9ioppu9PtGvPrsyDvb9oDBOpr7KiwAvI4HPBnu60eiaguPhCh79us8 oDSeHvg4s4RX1iL5D0vExI4JB3XB3FHjnqiCA86VHQJxwwivlmsz4cEWEW/mijHjQMRxCo z7iwSilZsJjqjN0EOxCBLE4pU6upzIyUmk+SomUkKBWClEiiY3kpno8Dl7cBeNFxMMIqS0 Ie2qeSNKhx2EZbwXFVxpWk6a8am/frjQ4Ywj3wScAfBaHIQqTjZQdlBD1najOw== X-Mailman-Original-Authentication-Results: smtp3.osuosl.org; dmarc=pass (p=reject dis=none) header.from=bootlin.com X-Mailman-Original-Authentication-Results: smtp3.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=bootlin.com header.i=@bootlin.com header.a=rsa-sha256 header.s=gm1 header.b=MSZLidHR Subject: [Buildroot] [PATCH 02/22] package/busybox: drop stale IGNORE_CVES entries X-BeenThere: buildroot@buildroot.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Thomas Petazzoni via buildroot Reply-To: Thomas Petazzoni Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: buildroot-bounces@buildroot.org Sender: "buildroot" All of CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366 were fixed by patches that we no longer have since we bumped Busybox. Those IGNORE_CVES entries are therefore no longer needed. The CVE-2022-28391 ignore CVE entry is also reported as stale, but we believe the NVD database is incorrect in saying this vulnerability only affects Busybox up to 1.35.0. Indeed, Busybox 1.37.0 still doesn't have the fixes and is therefore still affected. Signed-off-by: Thomas Petazzoni --- package/busybox/busybox.mk | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk index d3074d2218..532932ec8f 100644 --- a/package/busybox/busybox.mk +++ b/package/busybox/busybox.mk @@ -15,16 +15,6 @@ BUSYBOX_CPE_ID_VENDOR = busybox # 0004-nslookup-sanitize-all-printed-strings-with-printable.patch BUSYBOX_IGNORE_CVES += CVE-2022-28391 -# 0012-awk-fix-use-after-free-CVE-2023-42363.patch -BUSYBOX_IGNORE_CVES += CVE-2023-42363 - -# 0013-awk-fix-precedence-of-relative-to.patch -# 0014-awk-fix-ternary-operator-and-precedence-of.patch -BUSYBOX_IGNORE_CVES += CVE-2023-42364 CVE-2023-42365 - -# 0015-awk.c-fix-CVE-2023-42366-bug-15874.patch -BUSYBOX_IGNORE_CVES += CVE-2023-42366 - BUSYBOX_CFLAGS = \ $(TARGET_CFLAGS) -- 2.49.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot