From 2fdf355b2a208af3a6f30a243e71561bd30c3ba1 Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Wed, 20 Dec 2023 21:01:07 +0100 Subject: [PATCH] package/glibc: add proper CPE ID version detail As reported in bug 15895, the GLIBC_VERSION field having a value looking like 2.38-27-g750a45a783906a19591fb8ff6b7841470f1f5701, it prevents the CPE/CVE matching with the NVD database to work correctly. This commit fixes that by defining GLIBC_CPE_ID_VERSION, derived from GLIBC_VERSION, by extracting the base version. Also, we update GLIBC_IGNORE_CVES to account for the CVEs that have clearly been fixed between 2.38 and 2.38-27-g750a45a783906a19591fb8ff6b7841470f1f5701. There are a number of other CVEs still affecting the glibc package, but they are not related to this 2.38...2.38-27-g750a45a783906a19591fb8ff6b7841470f1f5701 range. Fixes: #15895 Signed-off-by: Thomas Petazzoni Signed-off-by: Yann E. MORIN (cherry picked from commit af8c0e5c746b11872b57e660afc2118e882f7722) [Peter: adjust for glibc 2.36.x on 2023.02.x] Signed-off-by: Peter Korsgaard --- package/glibc/glibc.mk | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk index a3a84e86ec..8a31779afb 100644 --- a/package/glibc/glibc.mk +++ b/package/glibc/glibc.mk @@ -20,6 +20,30 @@ GLIBC_LICENSE = GPL-2.0+ (programs), LGPL-2.1+, BSD-3-Clause, MIT (library) GLIBC_LICENSE_FILES = COPYING COPYING.LIB LICENSES GLIBC_CPE_ID_VENDOR = gnu +# Extract the base version (e.g. 2.36) from GLIBC_VERSION in order to +# allow proper matching with the CPE database. +GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION))) + +# Fixed by b0e7888d1fa2dbd2d9e1645ec8c796abf78880b9, which is between +# 2.36 and the version we're really using +GLIBC_IGNORE_CVES += CVE-2022-39046 + +# Fixed by 4ea972b7edd7e36610e8cde18bf7a8149d7bac4f, which is between +# 2.36 and the version we're really using +GLIBC_IGNORE_CVES += CVE-2023-4527 + +# Fixed by a9728f798ec7f05454c95637ee6581afaa9b487d, which is between +# 2.36 and the version we're really using +GLIBC_IGNORE_CVES += CVE-2023-4806 + +# Fixed by 22955ad85186ee05834e47e665056148ca07699c, which is between +# 2.36 and the version we're really using. +GLIBC_IGNORE_CVES += CVE-2023-4911 + +# Fixed by 856bac55f98dc840e7c27cfa82262b933385de90, which is between +# 2.36 and the version we're really using. +GLIBC_IGNORE_CVES += CVE-2023-5156 + # glibc is part of the toolchain so disable the toolchain dependency GLIBC_ADD_TOOLCHAIN_DEPENDENCY = NO