[Buildroot] [PATCH 1/1] package/php: ignore various CVEs

[Buildroot] [PATCH 1/1] package/php: ignore various CVEs

[Bernd Kuhls]

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
 package/php/php.mk | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/package/php/php.mk b/package/php/php.mk
index cb7a8d71d4..8e362ba144 100644
--- a/package/php/php.mk
+++ b/package/php/php.mk
@@ -14,6 +14,12 @@ PHP_DEPENDENCIES = host-pkgconf pcre2
 PHP_LICENSE = PHP-3.01
 PHP_LICENSE_FILES = LICENSE
 PHP_CPE_ID_VENDOR = php
+# fixed with version 5.x: https://ubuntu.com/security/notices/USN-485-1
+PHP_IGNORE_CVES += CVE-2007-2728
+# not a security vulnerability according to Red Hat
+PHP_IGNORE_CVES += CVE-2007-3205
+# not a security vulnerability according to Mandriva
+PHP_IGNORE_CVES += CVE-2007-4596
 PHP_CONF_OPTS = \
 	--mandir=/usr/share/man \
 	--infodir=/usr/share/info \
-- 
2.30.2

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/php: ignore various CVEs

[Baruch Siach via buildroot]

Hi Bernd,

On Sun, Jul 31 2022, Bernd Kuhls wrote:
> Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
> ---
>  package/php/php.mk | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/package/php/php.mk b/package/php/php.mk
> index cb7a8d71d4..8e362ba144 100644
> --- a/package/php/php.mk
> +++ b/package/php/php.mk
> @@ -14,6 +14,12 @@ PHP_DEPENDENCIES = host-pkgconf pcre2
>  PHP_LICENSE = PHP-3.01
>  PHP_LICENSE_FILES = LICENSE
>  PHP_CPE_ID_VENDOR = php
> +# fixed with version 5.x: https://ubuntu.com/security/notices/USN-485-1
> +PHP_IGNORE_CVES += CVE-2007-2728

Why do we need to ignore these old CVEs? Isn't the package version check
sufficient?

Same question for a few other similar patches that you posted earlier.

baruch

> +# not a security vulnerability according to Red Hat
> +PHP_IGNORE_CVES += CVE-2007-3205
> +# not a security vulnerability according to Mandriva
> +PHP_IGNORE_CVES += CVE-2007-4596
>  PHP_CONF_OPTS = \
>  	--mandir=/usr/share/man \
>  	--infodir=/usr/share/info \


-- 
                                                     ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/php: ignore various CVEs

[Bernd Kuhls]

Am Sun, 31 Jul 2022 14:45:27 +0300 schrieb Baruch Siach via buildroot:

> Why do we need to ignore these old CVEs?

Hi,

to reduce the lenght of the weekly mail:
https://lists.buildroot.org/pipermail/buildroot/2022-July/646199.html

Regards, Bernd

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/php: ignore various CVEs

[Baruch Siach via buildroot]

Hi Bernd,

On Sun, Jul 31 2022, Bernd Kuhls wrote:
> Am Sun, 31 Jul 2022 14:45:27 +0300 schrieb Baruch Siach via buildroot:
>
>> Why do we need to ignore these old CVEs?
>
> to reduce the lenght of the weekly mail:
> https://lists.buildroot.org/pipermail/buildroot/2022-July/646199.html

I share your desire to make the weekly list more useful. My question is
why current version check method does not filter out these CVEs
automatically?  I think that the value in moving the list from the
weekly mail to a permanent location in Buildroot source tree is
questionable. An explanation of why this is necessary would be nice.

baruch

-- 
                                                     ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/php: ignore various CVEs

[Bernd Kuhls]

Am Sun, 31 Jul 2022 15:02:57 +0300 schrieb Baruch Siach via buildroot:

> I share your desire to make the weekly list more useful. My question is
> why current version check method does not filter out these CVEs
> automatically?

Hi Baruch,

because many CVS entries I added to the ignore lists do not contain any 
version number in the NVD database, for example:

https://nvd.nist.gov/vuln/detail/CVE-1999-0236

cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:*

Regards, Bernd

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot