From: Ross Burton <Ross.Burton@arm.com>
To: "steve@sakoman.com" <steve@sakoman.com>
Cc: OE Core mailing list <openembedded-core@lists.openembedded.org>,
"yocto-security@lists.yoctoproject.org"
<yocto-security@lists.yoctoproject.org>
Subject: Re: [yocto-security] OE-core CVE metrics for master on Sun 21 Jan 2024 01:00:01 AM HST
Date: Mon, 22 Jan 2024 12:51:57 +0000 [thread overview]
Message-ID: <66B61CE3-5886-4895-8DEE-53DD04181C2D@arm.com> (raw)
In-Reply-To: <20240121111840.BFB881069A4@builder.sakoman.com>
On 21 Jan 2024, at 11:18, Steve Sakoman via lists.yoctoproject.org <steve=sakoman.com@lists.yoctoproject.org> wrote:
> New this week: 0 CVEs
Hurray!
> Full list: Found 39 unpatched CVEs
Ouch!
I did a pass of triage on the non-kernel issues.
> CVE-2022-3219 (CVSS3: 3.3 LOW): gnupg:gnupg-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3219 *
> CVE-2022-46456 (CVSS3: 6.1 MEDIUM): nasm:nasm-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-46456 *
> CVE-2023-1386 (CVSS3: 7.8 HIGH): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1386 *
These are still open upstream.
> CVE-2023-3019 (CVSS3: 6.5 MEDIUM): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3019 *
> CVE-2023-38559 (CVSS3: 5.5 MEDIUM): ghostscript https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38559 *
> CVE-2023-5088 (CVSS3: 7.0 HIGH): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-5088 *
> CVE-2023-46407 (CVSS3: 5.5 MEDIUM): ffmpeg https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-46407 *
These have been fixed but the CPE is incorrect, updates mailed to NIST.
> CVE-2023-4039 (CVSS3: 4.8 MEDIUM): gcc:gcc-cross-x86_64:gcc-runtime:gcc-sanitizers:libgcc:libgcc-initial https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-4039 *
We have a fix but the checker doesn’t see it, Simone Weiß has a patch that needs a respin
> CVE-2023-5574 (CVSS3: 7.0 HIGH): xserver-xorg https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-5574 *
Not fixed upstream, but also specific to Xvfb. Xvfb is pretty ancient now so I propose we disable this by default anyway.
> CVE-2023-6228 (CVSS3: 5.5 MEDIUM): tiff https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6228 *
Patch upstream but no release, sending a backport.
> CVE-2023-6693 (CVSS3: 5.3 MEDIUM): qemu:qemu-native:qemu-system-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6693 *
Patch at https://lore.kernel.org/qemu-devel/20240102032901.3234-1-jasowang@redhat.com/, not yet merged.
> CVE-2023-6992 (CVSS3: 5.5 MEDIUM): zlib:zlib-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6992 *
Specific to the Cloudflare fork, sending a patch to ignore it.
The rest are outstanding and the kernel list will change (hopefully for the better) when master-next merges.
Ross
next prev parent reply other threads:[~2024-01-22 12:52 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-21 11:18 OE-core CVE metrics for master on Sun 21 Jan 2024 01:00:01 AM HST steve
2024-01-22 12:51 ` Ross Burton [this message]
2024-01-22 17:01 ` [yocto-security] " Ross Burton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=66B61CE3-5886-4895-8DEE-53DD04181C2D@arm.com \
--to=ross.burton@arm.com \
--cc=openembedded-core@lists.openembedded.org \
--cc=steve@sakoman.com \
--cc=yocto-security@lists.yoctoproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox