Re: [OE-core] [PATCH][dunfell][gatesgarth][master] cairo: whitelist CVE-2013-0800

["Richard Purdie" <richard.purdie@linuxfoundation.org>]

On Fri, 2021-01-15 at 11:46 +0000, Mikko.Rapeli@bmw.de wrote:
> On Fri, Jan 15, 2021 at 11:23:39AM +0000, Richard Purdie wrote:
> > On Fri, 2021-01-15 at 12:47 +0200, Mikko Rapeli wrote:
> > > It affects only cairo embedded into Firefox.
> > > 
> > > https://security-tracker.debian.org/tracker/CVE-2013-0800
> > > 
> > > "The description is misleading: Firefox embeds a copy of Cairo, the interdiff
> > > shows the respective change at mozilla-esr17/gfx/cairo/cairo/src/cairo-image-surface.c
> > > Apparently the forked copy has changed, the code isn't present in vanilla Cairo"
> > > 
> > > Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
> > > ---
> > >  meta/recipes-graphics/cairo/cairo_1.16.0.bb | 3 +++
> > >  1 file changed, 3 insertions(+)
> > > 
> > > diff --git a/meta/recipes-graphics/cairo/cairo_1.16.0.bb b/meta/recipes-graphics/cairo/cairo_1.16.0.bb
> > > index 8663dec404..29088ab0d6 100644
> > > --- a/meta/recipes-graphics/cairo/cairo_1.16.0.bb
> > > +++ b/meta/recipes-graphics/cairo/cairo_1.16.0.bb
> > > @@ -29,6 +29,9 @@ SRC_URI = "http://cairographics.org/releases/cairo-${PV}.tar.xz \
> > >             file://CVE-2019-6462.patch \
> > >            "
> > >  
> > > 
> > > 
> > > 
> > > +# Affects only embedded cairo in Firefox
> > > +CVE_CHECK_WHITELIST += "CVE-2013-0800"
> > > +
> > 
> > That sounds a lot like we should send a CPE change upstream to classify
> > it as firefox rather than cairo?
> 
> Ok, I sent an email to cpe_dictionary@nist.gov for removal of
> "cpe:2.3:a:cairographics:cairo:-:*:*:*:*:*:*:*" from CVE-2013-0800 data citing
> the Debian details.
> 
> I hope this was the correct way to do this.

Sounds good to me, thanks!

Cheers,

Richard