[Buildroot] [RFC PATCH 13/14] package/flex: add vulnerability details

[Thomas Perale via buildroot <buildroot@buildroot.org>]

The upstream project as discarded the vulnerability as it works as
expected.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/flex/flex.mk | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/package/flex/flex.mk b/package/flex/flex.mk
index c6417fea83..2acd6d1e3d 100644
--- a/package/flex/flex.mk
+++ b/package/flex/flex.mk
@@ -10,12 +10,13 @@ FLEX_INSTALL_STAGING = YES
 FLEX_LICENSE = FLEX
 FLEX_LICENSE_FILES = COPYING
 FLEX_CPE_ID_VENDOR = westes
-# bug does not cause stack overflows in the generated code and has been
-# noted upstream as a bug in the code generator
-FLEX_IGNORE_CVES = CVE-2019-6293
 FLEX_DEPENDENCIES = $(TARGET_NLS_DEPENDENCIES) host-m4
 HOST_FLEX_DEPENDENCIES = host-m4
 
+FLEX_IGNORE_CVES = CVE-2019-6293
+FLEX_CVE-2019-6293_STATUS = not-affected-vulnerable-code-not-present
+FLEX_CVE-2019-6293_DETAIL = bug does not cause stack overflows in the generated code and has been noted upstream as a bug in the code generator
+
 # 0001-build-AC_USE_SYSTEM_EXTENSIONS-in-configure.ac.patch
 # 0002-build-make-it-possible-to-disable-the-build-of-the-f.patch
 # 0003-build-make-it-possible-to-disable-the-build-of-the-d.patch
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot