From 39e201a1a1ca93883d37316f7e0472123c5cb28c Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sun, 28 Dec 2025 19:56:29 +0100 Subject: [PATCH] package/openvmtools: add CVE trailer in patch Since Buildroot commit [1] the patches that fixes a security vulnerability needs to reference the fixed vulnerability. This patch adds the relevant information to the patch header. [1] 1167d0ff3d docs/manual: mention CVE trailer Signed-off-by: Thomas Perale Signed-off-by: Thomas Petazzoni (cherry picked from commit 0669124d77f5b4980398a792914065736df676eb) Signed-off-by: Thomas Perale --- ...13-Properly-check-authorization-on-incoming-guestOps-re.patch | 1 + .../0014-CVE-2025-22247-1100-1225-VGAuth-updates.patch | 1 + 2 files changed, 2 insertions(+) diff --git a/package/openvmtools/0013-Properly-check-authorization-on-incoming-guestOps-re.patch b/package/openvmtools/0013-Properly-check-authorization-on-incoming-guestOps-re.patch index 91e379b9a6..c257e77504 100644 --- a/package/openvmtools/0013-Properly-check-authorization-on-incoming-guestOps-re.patch +++ b/package/openvmtools/0013-Properly-check-authorization-on-incoming-guestOps-re.patch @@ -7,6 +7,7 @@ Subject: [PATCH] Properly check authorization on incoming guestOps requests Fix public pipe request checks. Only a SessionRequest type should be accepted on the public pipe. +CVE: CVE-2022-31676 Upstream: https://github.com/vmware/open-vm-tools/blob/CVE-2022-31676.patch/1205-Properly-check-authorization-on-incoming-guestOps-re.patch Signed-off-by: Stefan Agner --- diff --git a/package/openvmtools/0014-CVE-2025-22247-1100-1225-VGAuth-updates.patch b/package/openvmtools/0014-CVE-2025-22247-1100-1225-VGAuth-updates.patch index f47fabb71b..48962857ba 100644 --- a/package/openvmtools/0014-CVE-2025-22247-1100-1225-VGAuth-updates.patch +++ b/package/openvmtools/0014-CVE-2025-22247-1100-1225-VGAuth-updates.patch @@ -19,6 +19,7 @@ The 2025 Broadcom copyright information update is not part of this patch set to allow the patch to be easily applied to previous open-vm-tools source releases. +CVE: CVE-2025-22247 Upstream: https://github.com/vmware/blob/CVE-2025-22247.patch/CVE-2025-22247-1100-1225-VGAuth-updates.patch Signed-off-by: Peter Korsgaard ---