From 36e25128937644488b0864b2386991a7e96dcf62 Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Sun, 18 May 2025 10:57:15 +0200 Subject: [PATCH] package/tinyxml: set TINYXML_CPE_ID_VERSION With the recent addition in pkg-stats to detect stale ignore CVE entries, the CVE-2021-42260 ignore CVE entry is reported as stale. This is because TINYXML_VERSION is 2.6.2_2, and the CVE is annotated as affecting versions up to and including 2.6.2. But in fact, 2.6.2_2 is a special version from the Kodi community, but it's close to the 2.6.2 release, and CVE-2021-42260 is not fixed in it. To get meaningful results, let's tell our CVE checking logic that the tinyxml version is 2.6.2 by setting TINYXML_CPE_ID_VERSION (we're splitting on the _ and keeping the part before). Because we're now setting TINYXML_CPE_ID_VERSION, we must drop TINYXML_CPE_ID_VALID to avoid a check-package warning. Signed-off-by: Thomas Petazzoni Signed-off-by: Julien Olivain (cherry picked from commit 677b24ebaf154aaa0af59d34e91471b95d9a861b) Signed-off-by: Thomas Perale --- package/tinyxml/tinyxml.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package/tinyxml/tinyxml.mk b/package/tinyxml/tinyxml.mk index 01c25f7c1c..c6150b13fe 100644 --- a/package/tinyxml/tinyxml.mk +++ b/package/tinyxml/tinyxml.mk @@ -12,7 +12,7 @@ TINYXML_AUTORECONF = YES TINYXML_INSTALL_STAGING = YES TINYXML_LICENSE = Zlib TINYXML_LICENSE_FILES = README -TINYXML_CPE_ID_VALID = YES +TINYXML_CPE_ID_VERSION = $(firstword $(subst _,$(space),$(TINYXML_VERSION))) # 0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch TINYXML_IGNORE_CVES += CVE-2021-42260