From 114784cb7bc1d1d5c244a12e3c8899c688e00da3 Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Sun, 18 May 2025 10:56:59 +0200 Subject: [PATCH] package/exim: update comment on CVE-2022-3559 We no longer have the patch fixing CVE-2022-3559 because we've updated to a version of exim that includes it. However, the ignore CVE entry is not stale because the NVD database is incorrect on this CVE. We reported the issue to upstream NVD at: https://lore.kernel.org/buildroot/20250517183423.07951665@windsurf/ Let's document this above the ignore CVE entry. Signed-off-by: Thomas Petazzoni Signed-off-by: Julien Olivain --- package/exim/exim.mk | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/package/exim/exim.mk b/package/exim/exim.mk index bee3a79808..6fa16e69a2 100644 --- a/package/exim/exim.mk +++ b/package/exim/exim.mk @@ -13,7 +13,8 @@ EXIM_CPE_ID_VENDOR = exim EXIM_SELINUX_MODULES = exim mta EXIM_DEPENDENCIES = host-berkeleydb host-pcre2 pcre2 berkeleydb host-pkgconf -# 0006-Fix-regex-n-use-after-free.-Bug-2915.patch +# Incorrect NVD database, reported at +# https://lore.kernel.org/buildroot/20250517183423.07951665@windsurf/ EXIM_IGNORE_CVES += CVE-2022-3559 # Modify a variable value. It must already exist in the file, either