RE: [PATCH 6/6] ffmpeg: set status for 5 CVEs

["Marko, Peter" <Peter.Marko@siemens.com>]

> -----Original Message-----
> From: Benjamin Robin <benjamin.robin@bootlin.com>
> Sent: Monday, April 27, 2026 9:45 AM
> To: openembedded-core@lists.openembedded.org; Marko, Peter (FT D EU SK
> BFS1) <Peter.Marko@siemens.com>
> Subject: Re: [PATCH 6/6] ffmpeg: set status for 5 CVEs
> 
> Hello Peter,
> 
> On Sunday, April 26, 2026 at 8:50 PM, Peter Marko wrote:
> > From: Peter Marko <peter.marko@siemens.com>
> >
> > These reappeared after update of sbom-cve-check tooling.
> > Fixed version found by links from Debian security tracker.
> >
> > Signed-off-by: Peter Marko <peter.marko@siemens.com>
> > ---
> >  meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb b/meta/recipes-
> multimedia/ffmpeg/ffmpeg_8.0.1.bb
> > index 7bb7de3d25..9780abe184 100644
> > --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb
> > +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_8.0.1.bb
> > @@ -176,6 +176,11 @@ CVE_STATUS_GROUPS =
> "CVE_STATUS_WRONG_CPE"
> >  CVE_STATUS_WRONG_CPE = "CVE-2023-51791 CVE-2023-51793 CVE-
> 2023-51794 CVE-2023-51795 CVE-2023-51796 CVE-2023-51797 CVE-2023-
> 51798 CVE-2025-22921"
> >  CVE_STATUS_WRONG_CPE[status] = "fixed-version: these CVEs are fixed in
> used version"
> >
> > +CVE_STATUS[CVE-2022-2566] = "fixed-version: these CVEs are fixed since
> v5.1.1"
> > +CVE_STATUS[CVE-2025-9951] = "fixed-version: these CVEs are fixed since
> v8.0"
> >  CVE_STATUS[CVE-2025-25468] = "fixed-version: these CVEs are fixed since
> v8.0"
> >  CVE_STATUS[CVE-2025-25469] = "fixed-version: these CVEs are fixed since
> v8.0"
> >  CVE_STATUS[CVE-2025-12343] = "fixed-version: this CVE are fixed since
> v8.0"
> > +CVE_STATUS[CVE-2025-59729] = "fixed-version: this CVE are fixed since
> v8.0"
> > +CVE_STATUS[CVE-2025-59730] = "fixed-version: this CVE are fixed since
> v8.0"
> 
> > +CVE_STATUS[CVE-2025-69693] = "fixed-version: this CVE are fixed since
> v8.1"
> 
> Why the CVE-2025-69693 is marked has fixed?
> 
> It is affecting the version 8.0.1 which is the current version of the recipe,
> as reported by NVD:
> https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-69693

Thanks for noticing.
I guess I just want to have the cleanup finally finished and didn't think about the current version too much, just that there is already a version with a fix out.
Will send a v2 shortly.

> 
> { vulnerable: true, criteria: "cpe:2.3:a:ffmpeg:ffmpeg:8.0.1:*:*:*:*:*:*:*",
>   matchCriteriaId: "7F5CACA2-6FB6-4D6D-92D0-C9FF0E7CDB14" }
> 
> I did not investigate in which version this CVE was fixed.
> 
> --
> Benjamin Robin, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com
> 
>