* [Buildroot] [PATCH] package/mender: ignore mender CVE because it doesn't affect the client package
@ 2025-05-06 14:52 Titouan Christophe via buildroot
2026-01-02 21:50 ` Thomas Petazzoni via buildroot
2026-01-13 19:44 ` Arnout Vandecappelle via buildroot
0 siblings, 2 replies; 3+ messages in thread
From: Titouan Christophe via buildroot @ 2025-05-06 14:52 UTC (permalink / raw)
To: buildroot; +Cc: Angelo Compagnucci
CVE-2024-46948 only affects the device management and update server part
of Mender, and not the client running on the devices
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
---
package/mender/mender.mk | 2 ++
1 file changed, 2 insertions(+)
diff --git a/package/mender/mender.mk b/package/mender/mender.mk
index 146e6b2b73..1050277db1 100644
--- a/package/mender/mender.mk
+++ b/package/mender/mender.mk
@@ -8,6 +8,8 @@ MENDER_VERSION = 3.5.3
MENDER_SITE = $(call github,mendersoftware,mender,$(MENDER_VERSION))
MENDER_LICENSE = Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MIT, OLDAP-2.8
MENDER_CPE_ID_VENDOR = northern.tech
+# CVE-2024-46948 only affects mender-server
+MENDER_IGNORE_CVES = CVE-2024-46948
# Vendor license paths generated with:
# awk '{print $2}' LIC_FILES_CHKSUM.sha256 | grep vendor
--
2.49.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH] package/mender: ignore mender CVE because it doesn't affect the client package
2025-05-06 14:52 [Buildroot] [PATCH] package/mender: ignore mender CVE because it doesn't affect the client package Titouan Christophe via buildroot
@ 2026-01-02 21:50 ` Thomas Petazzoni via buildroot
2026-01-13 19:44 ` Arnout Vandecappelle via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Thomas Petazzoni via buildroot @ 2026-01-02 21:50 UTC (permalink / raw)
To: Titouan Christophe via buildroot; +Cc: Titouan Christophe, Angelo Compagnucci
On Tue, 6 May 2025 16:52:36 +0200
Titouan Christophe via buildroot <buildroot@buildroot.org> wrote:
> CVE-2024-46948 only affects the device management and update server part
> of Mender, and not the client running on the devices
>
> Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
> ---
> package/mender/mender.mk | 2 ++
> 1 file changed, 2 insertions(+)
Applied to master, thanks.
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH] package/mender: ignore mender CVE because it doesn't affect the client package
2025-05-06 14:52 [Buildroot] [PATCH] package/mender: ignore mender CVE because it doesn't affect the client package Titouan Christophe via buildroot
2026-01-02 21:50 ` Thomas Petazzoni via buildroot
@ 2026-01-13 19:44 ` Arnout Vandecappelle via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Arnout Vandecappelle via buildroot @ 2026-01-13 19:44 UTC (permalink / raw)
To: Titouan Christophe; +Cc: Arnout Vandecappelle, buildroot
In reply of:
> CVE-2024-46948 only affects the device management and update server part
> of Mender, and not the client running on the devices
>
> Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Applied to 2025.02.x and 2025.11.x. Thanks
> ---
> package/mender/mender.mk | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/package/mender/mender.mk b/package/mender/mender.mk
> index 146e6b2b73..1050277db1 100644
> --- a/package/mender/mender.mk
> +++ b/package/mender/mender.mk
> @@ -8,6 +8,8 @@ MENDER_VERSION = 3.5.3
> MENDER_SITE = $(call github,mendersoftware,mender,$(MENDER_VERSION))
> MENDER_LICENSE = Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MIT, OLDAP-2.8
> MENDER_CPE_ID_VENDOR = northern.tech
> +# CVE-2024-46948 only affects mender-server
> +MENDER_IGNORE_CVES = CVE-2024-46948
>
> # Vendor license paths generated with:
> # awk '{print $2}' LIC_FILES_CHKSUM.sha256 | grep vendor
> --
> 2.49.0
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-01-13 19:45 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-05-06 14:52 [Buildroot] [PATCH] package/mender: ignore mender CVE because it doesn't affect the client package Titouan Christophe via buildroot
2026-01-02 21:50 ` Thomas Petazzoni via buildroot
2026-01-13 19:44 ` Arnout Vandecappelle via buildroot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox