RE: [yocto] [meta-security][kirkstone][PATCH] tpm2-tss: ignore CVE-2023-22745

RE: [yocto] [meta-security][kirkstone][PATCH] tpm2-tss: ignore CVE-2023-22745

[Marko, Peter]

Hi Armin,

Gentle ping to pick this commit to kirkstone.

Thanks,
  Peter

> -----Original Message-----
> From: yocto@lists.yoctoproject.org <yocto@lists.yoctoproject.org> On Behalf Of Peter Marko via lists.yoctoproject.org
> Sent: Friday, June 30, 2023 0:10
> To: yocto@lists.yoctoproject.org
> Cc: Marko, Peter (ADV D EU SK BFS1) <Peter.Marko@siemens.com>
> Subject: [yocto] [meta-security][kirkstone][PATCH] tpm2-tss: ignore CVE-2023-22745
>
> From: Peter Marko <peter.marko@siemens.com>
>
> As already mentioned in upgrade commit, this CVE is fixed.
> But cve_check still reports it as NVD DB was not updated.
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> ---
>  meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_3.2.2.bb | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_3.2.2.bb b/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_3.2.2.bb
> index 9b76c2f..4d2c911 100644
> --- a/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_3.2.2.bb
> +++ b/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_3.2.2.bb
> @@ -88,3 +88,6 @@ FILES:${PN} = "\
>      ${sysconfdir}/sysusers.d"
>  
>  RDEPENDS:libtss2 = "libgcrypt"
> +
> +# This is patched in 3.2.2, NVD DB was not updated to reflect this backport
> +CVE_CHECK_IGNORE += "CVE-2023-22745"
> -- 
> 2.30.2
>

Re: [yocto] [meta-security][kirkstone][PATCH] tpm2-tss: ignore CVE-2023-22745

[akuster808]

On 7/29/23 5:34 PM, Marko, Peter wrote:
> Hi Armin,
>
> Gentle ping to pick this commit to kirkstone.

merged. thanks.
-armin
>
> Thanks,
>    Peter
>
>> -----Original Message-----
>> From: yocto@lists.yoctoproject.org <yocto@lists.yoctoproject.org> On Behalf Of Peter Marko via lists.yoctoproject.org
>> Sent: Friday, June 30, 2023 0:10
>> To: yocto@lists.yoctoproject.org
>> Cc: Marko, Peter (ADV D EU SK BFS1) <Peter.Marko@siemens.com>
>> Subject: [yocto] [meta-security][kirkstone][PATCH] tpm2-tss: ignore CVE-2023-22745
>>
>> From: Peter Marko <peter.marko@siemens.com>
>>
>> As already mentioned in upgrade commit, this CVE is fixed.
>> But cve_check still reports it as NVD DB was not updated.
>>
>> Signed-off-by: Peter Marko <peter.marko@siemens.com>
>> ---
>>   meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_3.2.2.bb | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_3.2.2.bb b/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_3.2.2.bb
>> index 9b76c2f..4d2c911 100644
>> --- a/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_3.2.2.bb
>> +++ b/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_3.2.2.bb
>> @@ -88,3 +88,6 @@ FILES:${PN} = "\
>>       ${sysconfdir}/sysusers.d"
>>   
>>   RDEPENDS:libtss2 = "libgcrypt"
>> +
>> +# This is patched in 3.2.2, NVD DB was not updated to reflect this backport
>> +CVE_CHECK_IGNORE += "CVE-2023-22745"
>> -- 
>> 2.30.2
>>