[Buildroot] [PATCH] package/libraw: fix IGNORE_CVES assignment

[Buildroot] [PATCH] package/libraw: fix IGNORE_CVES assignment

[Baruch Siach via buildroot]

Commit bc4110b0739 ("package/libraw: fix CVE-2023-1729") mistakenly
added the patch name to IGNORE_CVES instead of the CVE reference. Fix
that.

Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
 package/libraw/libraw.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/libraw/libraw.mk b/package/libraw/libraw.mk
index cbd509cfea8c..63b50e340da9 100644
--- a/package/libraw/libraw.mk
+++ b/package/libraw/libraw.mk
@@ -19,7 +19,7 @@ LIBRAW_CXXFLAGS = $(TARGET_CXXFLAGS)
 LIBRAW_CONF_ENV = CXXFLAGS="$(LIBRAW_CXXFLAGS)"
 
 # 0001-do-not-set-shrink-flag-for-3-4-component-images.patch
-LIBRAW_IGNORE_CVES += 0001-do-not-set-shrink-flag-for-3-4-component-images.patch
+LIBRAW_IGNORE_CVES += CVE-2023-1729
 
 ifeq ($(BR2_PACKAGE_JASPER),y)
 LIBRAW_CONF_OPTS += --enable-jasper
-- 
2.40.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libraw: fix IGNORE_CVES assignment

[Thomas Petazzoni via buildroot]

On Mon, 18 Sep 2023 08:24:55 +0300
Baruch Siach via buildroot <buildroot@buildroot.org> wrote:

> Commit bc4110b0739 ("package/libraw: fix CVE-2023-1729") mistakenly
> added the patch name to IGNORE_CVES instead of the CVE reference. Fix
> that.
> 
> Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> Signed-off-by: Baruch Siach <baruch@tkos.co.il>
> ---
>  package/libraw/libraw.mk | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/package/libraw/libraw.mk b/package/libraw/libraw.mk
> index cbd509cfea8c..63b50e340da9 100644
> --- a/package/libraw/libraw.mk
> +++ b/package/libraw/libraw.mk
> @@ -19,7 +19,7 @@ LIBRAW_CXXFLAGS = $(TARGET_CXXFLAGS)
>  LIBRAW_CONF_ENV = CXXFLAGS="$(LIBRAW_CXXFLAGS)"
>  
>  # 0001-do-not-set-shrink-flag-for-3-4-component-images.patch
> -LIBRAW_IGNORE_CVES += 0001-do-not-set-shrink-flag-for-3-4-component-images.patch
> +LIBRAW_IGNORE_CVES += CVE-2023-1729

Wow, I'm impressed that pkg-stats didn't even blow up on such a bogus
IGNORE_CVES value.

Applied, thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libraw: fix IGNORE_CVES assignment

[Peter Korsgaard]

>>>>> "Baruch" == Baruch Siach via buildroot <buildroot@buildroot.org> writes:

 > Commit bc4110b0739 ("package/libraw: fix CVE-2023-1729") mistakenly
 > added the patch name to IGNORE_CVES instead of the CVE reference. Fix
 > that.

 > Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
 > Signed-off-by: Baruch Siach <baruch@tkos.co.il>

Committed to 2023.02.x, 2023.05.x and 2023.08.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot