[Buildroot] [PATCH] package/e2fsprogs: drop CVE-2022-1304

[Buildroot] [PATCH] package/e2fsprogs: drop CVE-2022-1304

[Daniel Lang]

CVE-2022-1304 only affects e2fsprogs 1.46.5.
The mentioned patch was removed in 6a21733f when bumping to 1.47.0.

Signed-off-by: Daniel Lang <dalang@gmx.at>
---
 package/e2fsprogs/e2fsprogs.mk | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/package/e2fsprogs/e2fsprogs.mk b/package/e2fsprogs/e2fsprogs.mk
index 80090621bf..7491f4c067 100644
--- a/package/e2fsprogs/e2fsprogs.mk
+++ b/package/e2fsprogs/e2fsprogs.mk
@@ -12,9 +12,6 @@ E2FSPROGS_LICENSE_FILES = NOTICE lib/ss/mit-sipb-copyright.h lib/et/internal.h
 E2FSPROGS_CPE_ID_VENDOR = e2fsprogs_project
 E2FSPROGS_INSTALL_STAGING = YES
 
-# 0001-libext2fs-add-sanity-check-to-extent-manipulation.patch
-E2FSPROGS_IGNORE_CVES += CVE-2022-1304
-
 # Use libblkid and libuuid from util-linux for host and target packages.
 # This prevents overriding them with e2fsprogs' ones, which may cause
 # problems for other packages.
-- 
2.42.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/e2fsprogs: drop CVE-2022-1304

[Yann E. MORIN]

Daniel, All,

On 2023-09-20 06:36 +0200, Daniel Lang spake thusly:
> CVE-2022-1304 only affects e2fsprogs 1.46.5.
> The mentioned patch was removed in 6a21733f when bumping to 1.47.0.
> 
> Signed-off-by: Daniel Lang <dalang@gmx.at>

Applied to master, thanks.

Regards,
Yann E. MORIN.

> ---
>  package/e2fsprogs/e2fsprogs.mk | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/package/e2fsprogs/e2fsprogs.mk b/package/e2fsprogs/e2fsprogs.mk
> index 80090621bf..7491f4c067 100644
> --- a/package/e2fsprogs/e2fsprogs.mk
> +++ b/package/e2fsprogs/e2fsprogs.mk
> @@ -12,9 +12,6 @@ E2FSPROGS_LICENSE_FILES = NOTICE lib/ss/mit-sipb-copyright.h lib/et/internal.h
>  E2FSPROGS_CPE_ID_VENDOR = e2fsprogs_project
>  E2FSPROGS_INSTALL_STAGING = YES
>  
> -# 0001-libext2fs-add-sanity-check-to-extent-manipulation.patch
> -E2FSPROGS_IGNORE_CVES += CVE-2022-1304
> -
>  # Use libblkid and libuuid from util-linux for host and target packages.
>  # This prevents overriding them with e2fsprogs' ones, which may cause
>  # problems for other packages.
> -- 
> 2.42.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/e2fsprogs: drop CVE-2022-1304

[Peter Korsgaard]

>>>>> "Daniel" == Daniel Lang <dalang@gmx.at> writes:

 > CVE-2022-1304 only affects e2fsprogs 1.46.5.
 > The mentioned patch was removed in 6a21733f when bumping to 1.47.0.

 > Signed-off-by: Daniel Lang <dalang@gmx.at>

Committed to 2023.08.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot