From 3e03873ff1ddb2edb629c215615a84338689272c Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Sun, 18 May 2025 10:56:57 +0200 Subject: [PATCH] package/dovecot: document why the ignore CVE entry is not stale The new pkg-stats feature of stale ignore CVE entry detection reports CVE-2022-30550 as stale, but it's not correct: the NVD database is incorrect, and this has been reported in https://lore.kernel.org/buildroot/20250517181815.02ce0393@windsurf/. Let's annotate this information in dovecot.mk so that we don't wonder why it's reported stale. Signed-off-by: Thomas Petazzoni Signed-off-by: Julien Olivain --- package/dovecot/dovecot.mk | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package/dovecot/dovecot.mk b/package/dovecot/dovecot.mk index e116bd3b78..a48cd7536d 100644 --- a/package/dovecot/dovecot.mk +++ b/package/dovecot/dovecot.mk @@ -22,6 +22,10 @@ DOVECOT_DEPENDENCIES = \ DOVECOT_IGNORE_CVES += CVE-2016-4983 # 0001-auth-Fix-handling-passdbs-with-identical-driver-args.patch + +# Note: this ignore CVE entry is reported as stale by pkg-stats, but +# the NVD database is incorrect: +# https://lore.kernel.org/buildroot/20250517181815.02ce0393@windsurf/ DOVECOT_IGNORE_CVES += CVE-2022-30550 DOVECOT_CONF_ENV = \