* [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965
@ 2026-07-28 19:36 Peter Marko
2026-08-05 21:50 ` Bruce Ashfield
0 siblings, 1 reply; 6+ messages in thread
From: Peter Marko @ 2026-07-28 19:36 UTC (permalink / raw)
To: meta-virtualization; +Cc: Peter Marko
From: Peter Marko <peter.marko@siemens.com>
This CVE was fixed in v1.20.
This is mentione in NVD report description [1] and github advisory [2].
Explicitly set CVE_STATUS because cve-check still reports it as open.
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-24965
[2] https://github.com/containers/crun/security/advisories/GHSA-f42g-r5jj-qh4j
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
recipes-containers/crun/crun_git.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/recipes-containers/crun/crun_git.bb b/recipes-containers/crun/crun_git.bb
index d2f7b63b..ea14e8ec 100644
--- a/recipes-containers/crun/crun_git.bb
+++ b/recipes-containers/crun/crun_git.bb
@@ -67,3 +67,5 @@ RCONFLICTS:${PN} = "${@'runc' if d.getVar('CRUN_AS_RUNC') else ''}"
REQUIRED_DISTRO_FEATURES:class-native ?= ""
DEPENDS:class-native += "yajl libcap go-md2man m4 libseccomp"
BBCLASSEXTEND = "native"
+
+CVE_STATUS[CVE-2025-24965] = "fixed-version: Fixed since 1.20"
^ permalink raw reply related [flat|nested] 6+ messages in thread[parent not found: <18C3CBFF4B8615C4.1217577@lists.yoctoproject.org>]
* RE: [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965
[not found] <18C3CBFF4B8615C4.1217577@lists.yoctoproject.org>
@ 2026-07-28 18:39 ` Marko, Peter
2026-07-28 19:20 ` Bruce Ashfield
0 siblings, 1 reply; 6+ messages in thread
From: Marko, Peter @ 2026-07-28 18:39 UTC (permalink / raw)
To: meta-virtualization@lists.yoctoproject.org, Bruce Ashfield
Gentle ping.
-----Original Message-----
From: meta-virtualization@lists.yoctoproject.org <meta-virtualization@lists.yoctoproject.org> On Behalf Of Peter Marko via lists.yoctoproject.org
Sent: Sunday, July 19, 2026 10:49 PM
To: meta-virtualization@lists.yoctoproject.org
Cc: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>
Subject: [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965
From: Peter Marko <peter.marko@siemens.com>
This CVE was fixed in v1.20.
This is mentione in NVD report description [1] and github advisory [2].
Explicitly set CVE_STATUS because cve-check still reports it as open.
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-24965
[2] https://github.com/containers/crun/security/advisories/GHSA-f42g-r5jj-qh4j
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
recipes-containers/crun/crun_git.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/recipes-containers/crun/crun_git.bb b/recipes-containers/crun/crun_git.bb
index d2f7b63b..ea14e8ec 100644
--- a/recipes-containers/crun/crun_git.bb
+++ b/recipes-containers/crun/crun_git.bb
@@ -67,3 +67,5 @@ RCONFLICTS:${PN} = "${@'runc' if d.getVar('CRUN_AS_RUNC') else ''}"
REQUIRED_DISTRO_FEATURES:class-native ?= ""
DEPENDS:class-native += "yajl libcap go-md2man m4 libseccomp"
BBCLASSEXTEND = "native"
+
+CVE_STATUS[CVE-2025-24965] = "fixed-version: Fixed since 1.20"
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965
2026-07-28 18:39 ` Marko, Peter
@ 2026-07-28 19:20 ` Bruce Ashfield
2026-07-28 19:36 ` Marko, Peter
0 siblings, 1 reply; 6+ messages in thread
From: Bruce Ashfield @ 2026-07-28 19:20 UTC (permalink / raw)
To: Marko, Peter; +Cc: meta-virtualization@lists.yoctoproject.org
I have no record of the original email.
Can you resend ?
Bruce
On Tue, Jul 28, 2026 at 2:40 PM Marko, Peter <Peter.Marko@siemens.com> wrote:
>
> Gentle ping.
>
> -----Original Message-----
> From: meta-virtualization@lists.yoctoproject.org <meta-virtualization@lists.yoctoproject.org> On Behalf Of Peter Marko via lists.yoctoproject.org
> Sent: Sunday, July 19, 2026 10:49 PM
> To: meta-virtualization@lists.yoctoproject.org
> Cc: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>
> Subject: [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965
>
> From: Peter Marko <peter.marko@siemens.com>
>
> This CVE was fixed in v1.20.
> This is mentione in NVD report description [1] and github advisory [2].
> Explicitly set CVE_STATUS because cve-check still reports it as open.
>
> [1] https://nvd.nist.gov/vuln/detail/CVE-2025-24965
> [2] https://github.com/containers/crun/security/advisories/GHSA-f42g-r5jj-qh4j
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
> recipes-containers/crun/crun_git.bb | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/recipes-containers/crun/crun_git.bb b/recipes-containers/crun/crun_git.bb
> index d2f7b63b..ea14e8ec 100644
> --- a/recipes-containers/crun/crun_git.bb
> +++ b/recipes-containers/crun/crun_git.bb
> @@ -67,3 +67,5 @@ RCONFLICTS:${PN} = "${@'runc' if d.getVar('CRUN_AS_RUNC') else ''}"
> REQUIRED_DISTRO_FEATURES:class-native ?= ""
> DEPENDS:class-native += "yajl libcap go-md2man m4 libseccomp"
> BBCLASSEXTEND = "native"
> +
> +CVE_STATUS[CVE-2025-24965] = "fixed-version: Fixed since 1.20"
--
- Thou shalt not follow the NULL pointer, for chaos and madness await
thee at its end
- "Use the force Harry" - Gandalf, Star Trek II
^ permalink raw reply [flat|nested] 6+ messages in thread* RE: [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965
2026-07-28 19:20 ` Bruce Ashfield
@ 2026-07-28 19:36 ` Marko, Peter
0 siblings, 0 replies; 6+ messages in thread
From: Marko, Peter @ 2026-07-28 19:36 UTC (permalink / raw)
To: Bruce Ashfield; +Cc: meta-virtualization@lists.yoctoproject.org
Should be this one - https://lists.yoctoproject.org/g/meta-virtualization/message/9958
Now resent under - https://lists.yoctoproject.org/g/meta-virtualization/message/10010
Peter
-----Original Message-----
From: Bruce Ashfield <bruce.ashfield@gmail.com>
Sent: Tuesday, July 28, 2026 9:21 PM
To: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>
Cc: meta-virtualization@lists.yoctoproject.org
Subject: Re: [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965
I have no record of the original email.
Can you resend ?
Bruce
On Tue, Jul 28, 2026 at 2:40 PM Marko, Peter <Peter.Marko@siemens.com> wrote:
>
> Gentle ping.
>
> -----Original Message-----
> From: meta-virtualization@lists.yoctoproject.org <meta-virtualization@lists.yoctoproject.org> On Behalf Of Peter Marko via lists.yoctoproject.org
> Sent: Sunday, July 19, 2026 10:49 PM
> To: meta-virtualization@lists.yoctoproject.org
> Cc: Marko, Peter (FT D EU SK BFS1) <Peter.Marko@siemens.com>
> Subject: [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965
>
> From: Peter Marko <peter.marko@siemens.com>
>
> This CVE was fixed in v1.20.
> This is mentione in NVD report description [1] and github advisory [2].
> Explicitly set CVE_STATUS because cve-check still reports it as open.
>
> [1] https://nvd.nist.gov/vuln/detail/CVE-2025-24965
> [2] https://github.com/containers/crun/security/advisories/GHSA-f42g-r5jj-qh4j
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
> recipes-containers/crun/crun_git.bb | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/recipes-containers/crun/crun_git.bb b/recipes-containers/crun/crun_git.bb
> index d2f7b63b..ea14e8ec 100644
> --- a/recipes-containers/crun/crun_git.bb
> +++ b/recipes-containers/crun/crun_git.bb
> @@ -67,3 +67,5 @@ RCONFLICTS:${PN} = "${@'runc' if d.getVar('CRUN_AS_RUNC') else ''}"
> REQUIRED_DISTRO_FEATURES:class-native ?= ""
> DEPENDS:class-native += "yajl libcap go-md2man m4 libseccomp"
> BBCLASSEXTEND = "native"
> +
> +CVE_STATUS[CVE-2025-24965] = "fixed-version: Fixed since 1.20"
--
- Thou shalt not follow the NULL pointer, for chaos and madness await
thee at its end
- "Use the force Harry" - Gandalf, Star Trek II
^ permalink raw reply [flat|nested] 6+ messages in thread
* [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965
@ 2026-07-19 20:48 Peter Marko
0 siblings, 0 replies; 6+ messages in thread
From: Peter Marko @ 2026-07-19 20:48 UTC (permalink / raw)
To: meta-virtualization; +Cc: Peter Marko
From: Peter Marko <peter.marko@siemens.com>
This CVE was fixed in v1.20.
This is mentione in NVD report description [1] and github advisory [2].
Explicitly set CVE_STATUS because cve-check still reports it as open.
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-24965
[2] https://github.com/containers/crun/security/advisories/GHSA-f42g-r5jj-qh4j
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
recipes-containers/crun/crun_git.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/recipes-containers/crun/crun_git.bb b/recipes-containers/crun/crun_git.bb
index d2f7b63b..ea14e8ec 100644
--- a/recipes-containers/crun/crun_git.bb
+++ b/recipes-containers/crun/crun_git.bb
@@ -67,3 +67,5 @@ RCONFLICTS:${PN} = "${@'runc' if d.getVar('CRUN_AS_RUNC') else ''}"
REQUIRED_DISTRO_FEATURES:class-native ?= ""
DEPENDS:class-native += "yajl libcap go-md2man m4 libseccomp"
BBCLASSEXTEND = "native"
+
+CVE_STATUS[CVE-2025-24965] = "fixed-version: Fixed since 1.20"
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-05 21:51 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-28 19:36 [meta-virtualization][wrynose][PATCH] crun: set status for CVE-2025-24965 Peter Marko
2026-08-05 21:50 ` Bruce Ashfield
[not found] <18C3CBFF4B8615C4.1217577@lists.yoctoproject.org>
2026-07-28 18:39 ` Marko, Peter
2026-07-28 19:20 ` Bruce Ashfield
2026-07-28 19:36 ` Marko, Peter
-- strict thread matches above, loose matches on Subject: below --
2026-07-19 20:48 Peter Marko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox