Openembedded Core Discussions
 help / color / mirror / Atom feed
From: Khem Raj <raj.khem@gmail.com>
To: openembedded-core@lists.openembedded.org
Cc: Khem Raj <raj.khem@gmail.com>
Subject: [PATCH 03/10] zlib: Resolve CVE-2022-37434
Date: Sun, 14 Aug 2022 15:20:30 -0700	[thread overview]
Message-ID: <20220814222037.283943-3-raj.khem@gmail.com> (raw)
In-Reply-To: <20220814222037.283943-1-raj.khem@gmail.com>

This is only seen in development branch as per [1]

[1] https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1#commitcomment-80753451
CVE: CVE-2022-37434

Signed-off-by: Khem Raj <raj.khem@gmail.com>
---
 meta/recipes-core/zlib/zlib_1.2.12.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta/recipes-core/zlib/zlib_1.2.12.bb b/meta/recipes-core/zlib/zlib_1.2.12.bb
index 77e7a4937fa..d3e0f25295d 100644
--- a/meta/recipes-core/zlib/zlib_1.2.12.bb
+++ b/meta/recipes-core/zlib/zlib_1.2.12.bb
@@ -17,6 +17,10 @@ UPSTREAM_CHECK_URI = "http://zlib.net/"
 
 SRC_URI[sha256sum] = "7db46b8d7726232a621befaab4a1c870f00a90805511c0e0090441dac57def18"
 
+# 1.2.12 or any other released zlib version does not have this issue see
+# https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1#commitcomment-80801182
+CVE_CHECK_IGNORE += "CVE-2022-37434"
+
 CFLAGS += "-D_REENTRANT"
 
 RDEPENDS:${PN}-ptest += "make"
-- 
2.37.2



  parent reply	other threads:[~2022-08-14 22:20 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-14 22:20 [PATCH 01/10] json-c: Fix function prototypes Khem Raj
2022-08-14 22:20 ` [PATCH 02/10] xmlto: Update to use upstream tip of trunk Khem Raj
2022-08-15  6:54   ` [OE-core] " Alexander Kanavin
2022-08-14 22:20 ` Khem Raj [this message]
2022-08-15  2:32   ` [OE-core] [PATCH 03/10] zlib: Resolve CVE-2022-37434 Paul Eggleton
2022-08-15  2:40     ` Khem Raj
2022-08-14 22:20 ` [PATCH 04/10] rsync: Backport fix to address CVE-2022-29154 Khem Raj
2022-08-14 22:20 ` [PATCH 05/10] rsync: Upgrade to 3.2.5 Khem Raj
2022-08-14 22:20 ` [PATCH 06/10] connman: Backports for security fixes Khem Raj
2022-08-14 22:20 ` [PATCH 07/10] libtirpc: Backport fix for CVE-2021-46828 Khem Raj
2022-08-14 22:20 ` [PATCH 08/10] libxml2: Ignore CVE-2016-3709 Khem Raj
2022-08-14 22:20 ` [PATCH 09/10] tiff: Backport a patch for CVE-2022-34526 Khem Raj
2022-08-14 22:20 ` [PATCH 10/10] libtirpc: Upgrade to 1.3.3 Khem Raj

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220814222037.283943-3-raj.khem@gmail.com \
    --to=raj.khem@gmail.com \
    --cc=openembedded-core@lists.openembedded.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox