mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-29 13:31:43 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/tinyxml: set TINYXML_CPE_ID_VERSION

Browse Source 
With the recent addition in pkg-stats to detect stale ignore CVE
entries, the CVE-2021-42260 ignore CVE entry is reported as
stale. This is because TINYXML_VERSION is 2.6.2_2, and the CVE is
annotated as affecting versions up to and including 2.6.2.

But in fact, 2.6.2_2 is a special version from the Kodi community, but
it's close to the 2.6.2 release, and CVE-2021-42260 is not fixed in
it. To get meaningful results, let's tell our CVE checking logic that
the tinyxml version is 2.6.2 by setting TINYXML_CPE_ID_VERSION (we're
splitting on the _ and keeping the part before).

Because we're now setting TINYXML_CPE_ID_VERSION, we must drop
TINYXML_CPE_ID_VALID to avoid a check-package warning.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 677b24ebaf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Petazzoni
2025-05-18 10:57:15 +02:00
committed by Thomas Perale
parent 8b59257b82
commit 36e2512893
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/tinyxml/tinyxml.mk
View File

@@ -12,7 +12,7 @@ TINYXML_AUTORECONF = YES
TINYXML_INSTALL_STAGING = YES
TINYXML_LICENSE = Zlib
TINYXML_LICENSE_FILES = README
TINYXML_CPE_ID_VALID = YES
TINYXML_CPE_ID_VERSION = $(firstword $(subst _,$(space),$(TINYXML_VERSION)))
# 0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch
TINYXML_IGNORE_CVES += CVE-2021-42260