RE: [OE-core] [PATCH 1/2] meta: update avahi patch to remove ref to rejected CVE

Peter Kjellerstedt
2026-02-20T15:47:09Z

> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-core@lists.openembedded.org> On Behalf Of Benjamin Robin via lists.openembedded.org
> Sent: den 20 februari 2026 12:02
> To: openembedded-core@lists.openembedded.org
> Cc: ross.burton@arm.com; thomas.petazzoni@bootlin.com; mathieu.dubois-briand@bootlin.com; antonin.godard@bootlin.com; jpewhacker@gmail.com; Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> Subject: [OE-core] [PATCH 1/2] meta: update avahi patch to remove ref to rejected CVE

Please use the recipe name as prefix, e.g.:

avahi: Remove a reference to the rejected CVE-2021-36217

>
> CVE-2021-36217 is rejected, and should no longer be referenced.
> CVE-2021-36217 is a duplicate of CVE-2021-3502 which is already
> referenced in the local-ping.patch.
>
> The CVE database indicates the following reason:
> ConsultIDs: CVE-2021-3502. Reason: This candidate is a duplicate of
> CVE-2021-3502. Notes: All CVE users should reference CVE-2021-3502
> instead of this candidate. All references and descriptions in this
> candidate have been removed to prevent accidental usage.
>
> Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
> ---
> meta/recipes-connectivity/avahi/files/local-ping.patch | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/meta/recipes-connectivity/avahi/files/local-ping.patch b/meta/recipes-connectivity/avahi/files/local-ping.patch
> index 29c192d296e0..8f102815df04 100644
> --- a/meta/recipes-connectivity/avahi/files/local-ping.patch
> +++ b/meta/recipes-connectivity/avahi/files/local-ping.patch
> @@ -1,4 +1,3 @@
> -CVE: CVE-2021-36217
> CVE: CVE-2021-3502
> Upstream-Status: Backport
> Signed-off-by: Ross Burton <ross.burton@arm.com>
>
> --
> 2.52.0