[OE-core][PATCH v2 1/1] go: ignore CVE-2023-45283 and CVE-2023-45284

[OE-core][PATCH v2 1/1] go: ignore CVE-2023-45283 and CVE-2023-45284

[ssambu]

From: Soumya Sambu <soumya.sambu@windriver.com>

These CVEs affect path handling on Windows.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-45283
https://nvd.nist.gov/vuln/detail/CVE-2023-45284

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
---
 meta/recipes-devtools/go/go-1.20.10.inc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta/recipes-devtools/go/go-1.20.10.inc b/meta/recipes-devtools/go/go-1.20.10.inc
index 39509ed986..0c0a736084 100644
--- a/meta/recipes-devtools/go/go-1.20.10.inc
+++ b/meta/recipes-devtools/go/go-1.20.10.inc
@@ -16,3 +16,6 @@ SRC_URI += "\
     file://0009-go-Filter-build-paths-on-staticly-linked-arches.patch \
 "
 SRC_URI[main.sha256sum] = "72d2f51805c47150066c103754c75fddb2c19d48c9219fa33d1e46696c841dbb"
+
+CVE_STATUS[CVE-2023-45283] = "not-applicable-platform: Issue only applies on Windows"
+CVE_STATUS[CVE-2023-45284] = "not-applicable-platform: Issue only applies on Windows"
-- 
2.40.0

Re: [OE-core][PATCH v2 1/1] go: ignore CVE-2023-45283 and CVE-2023-45284

[Alexandre Belloni]

Hello,

We had go upgrades in between, can you rebase (and check if this is
still needed)?

On 08/12/2023 10:42:15+0000, Soumya via lists.openembedded.org wrote:
> From: Soumya Sambu <soumya.sambu@windriver.com>
> 
> These CVEs affect path handling on Windows.
> 
> References:
> https://nvd.nist.gov/vuln/detail/CVE-2023-45283
> https://nvd.nist.gov/vuln/detail/CVE-2023-45284
> 
> Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
> ---
>  meta/recipes-devtools/go/go-1.20.10.inc | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/meta/recipes-devtools/go/go-1.20.10.inc b/meta/recipes-devtools/go/go-1.20.10.inc
> index 39509ed986..0c0a736084 100644
> --- a/meta/recipes-devtools/go/go-1.20.10.inc
> +++ b/meta/recipes-devtools/go/go-1.20.10.inc
> @@ -16,3 +16,6 @@ SRC_URI += "\
>      file://0009-go-Filter-build-paths-on-staticly-linked-arches.patch \
>  "
>  SRC_URI[main.sha256sum] = "72d2f51805c47150066c103754c75fddb2c19d48c9219fa33d1e46696c841dbb"
> +
> +CVE_STATUS[CVE-2023-45283] = "not-applicable-platform: Issue only applies on Windows"
> +CVE_STATUS[CVE-2023-45284] = "not-applicable-platform: Issue only applies on Windows"
> -- 
> 2.40.0
> 

> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#192038): https://lists.openembedded.org/g/openembedded-core/message/192038
> Mute This Topic: https://lists.openembedded.org/mt/103052741/3617179
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [alexandre.belloni@bootlin.com]
> -=-=-=-=-=-=-=-=-=-=-=-
> 


-- 
Alexandre Belloni, co-owner and COO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [OE-core][PATCH v2 1/1] go: ignore CVE-2023-45283 and CVE-2023-45284

[Sambu, Soumya]

[-- Attachment #1: Type: text/plain, Size: 2447 bytes --]

Hi Alexandre,

I see that current go version is 1.20.12 which is not vulnerable to these CVEs. Kindly ignore this patch.

Regards,
Soumya




________________________________
From: Alexandre Belloni <alexandre.belloni@bootlin.com>
Sent: Saturday, December 9, 2023 5:55 PM
To: Sambu, Soumya <Soumya.Sambu@windriver.com>
Cc: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org>
Subject: Re: [OE-core][PATCH v2 1/1] go: ignore CVE-2023-45283 and CVE-2023-45284

CAUTION: This email comes from a non Wind River email account!
Do not click links or open attachments unless you recognize the sender and know the content is safe.

Hello,

We had go upgrades in between, can you rebase (and check if this is
still needed)?

On 08/12/2023 10:42:15+0000, Soumya via lists.openembedded.org wrote:
> From: Soumya Sambu <soumya.sambu@windriver.com>
>
> These CVEs affect path handling on Windows.
>
> References:
> https://nvd.nist.gov/vuln/detail/CVE-2023-45283
> https://nvd.nist.gov/vuln/detail/CVE-2023-45284
>
> Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
> ---
>  meta/recipes-devtools/go/go-1.20.10.inc | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/meta/recipes-devtools/go/go-1.20.10.inc b/meta/recipes-devtools/go/go-1.20.10.inc
> index 39509ed986..0c0a736084 100644
> --- a/meta/recipes-devtools/go/go-1.20.10.inc
> +++ b/meta/recipes-devtools/go/go-1.20.10.inc
> @@ -16,3 +16,6 @@ SRC_URI += "\
>      file://0009-go-Filter-build-paths-on-staticly-linked-arches.patch \
>  "
>  SRC_URI[main.sha256sum] = "72d2f51805c47150066c103754c75fddb2c19d48c9219fa33d1e46696c841dbb"
> +
> +CVE_STATUS[CVE-2023-45283] = "not-applicable-platform: Issue only applies on Windows"
> +CVE_STATUS[CVE-2023-45284] = "not-applicable-platform: Issue only applies on Windows"
> --
> 2.40.0
>

>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#192038): https://lists.openembedded.org/g/openembedded-core/message/192038
> Mute This Topic: https://lists.openembedded.org/mt/103052741/3617179
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [alexandre.belloni@bootlin.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>


--
Alexandre Belloni, co-owner and COO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

[-- Attachment #2: Type: text/html, Size: 4738 bytes --]