mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 00:04:06 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/glibc: add proper CPE ID version detail

Browse Source 
As reported in bug 15895, the GLIBC_VERSION field having a value
looking like 2.38-27-g750a45a783906a19591fb8ff6b7841470f1f5701, it
prevents the CPE/CVE matching with the NVD database to work correctly.

This commit fixes that by defining GLIBC_CPE_ID_VERSION, derived from
GLIBC_VERSION, by extracting the base version.

Also, we update GLIBC_IGNORE_CVES to account for the CVEs that have
clearly been fixed between 2.38 and
2.38-27-g750a45a783906a19591fb8ff6b7841470f1f5701. There are a number
of other CVEs still affecting the glibc package, but they are not
related to this
2.38...2.38-27-g750a45a783906a19591fb8ff6b7841470f1f5701 range.

Fixes: #15895

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit af8c0e5c74)
[Peter: adjust for glibc 2.36.x on 2023.02.x]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Thomas Petazzoni
2023-12-20 21:01:07 +01:00
committed by Peter Korsgaard
parent c01b8fd38a
commit 2fdf355b2a
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
package/glibc/glibc.mk
View File

@@ -20,6 +20,30 @@ GLIBC_LICENSE = GPL-2.0+ (programs), LGPL-2.1+, BSD-3-Clause, MIT (library)
GLIBC_LICENSE_FILES = COPYING COPYING.LIB LICENSES
GLIBC_CPE_ID_VENDOR = gnu
# Extract the base version (e.g. 2.36) from GLIBC_VERSION in order to
# allow proper matching with the CPE database.
GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION)))
# Fixed by b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9, which is between
# 2.36 and the version we're really using
GLIBC_IGNORE_CVES += CVE-2022-39046
# Fixed by 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f, which is between
# 2.36 and the version we're really using
GLIBC_IGNORE_CVES += CVE-2023-4527
# Fixed by a9728f798ec7f05454c95637ee6581afaa9b487d, which is between
# 2.36 and the version we're really using
GLIBC_IGNORE_CVES += CVE-2023-4806
# Fixed by 22955ad85186ee05834e47e665056148ca07699c, which is between
# 2.36 and the version we're really using.
GLIBC_IGNORE_CVES += CVE-2023-4911
# Fixed by 856bac55f98dc840e7c27cfa82262b933385de90, which is between
# 2.36 and the version we're really using.
GLIBC_IGNORE_CVES += CVE-2023-5156
# glibc is part of the toolchain so disable the toolchain dependency
GLIBC_ADD_TOOLCHAIN_DEPENDENCY = NO