From 61f1fe83bfc078db2094951e5c22b09afd02e212 Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Mon, 3 Feb 2025 22:51:51 +0100 Subject: [PATCH] package/glibc: drop bogus IGNORE_CVES entries When glibc was bumped from 2.39 to 2.40 in commit 74cb378aff231c4f4605d7f479b9ae1a7a4e1fb6 ("package/{glibc, localdef}: bump to version 2.40"), the IGNORE_CVES entries should have been dropped, as they were applicable to the 2.39 branch. Drop them now. We did verify the pkg-stats output, and those CVEs don't show up as affecting glibc even after this change, as expected. Signed-off-by: Thomas Petazzoni Signed-off-by: Peter Korsgaard (cherry picked from commit 4b133efbd30ef2116b8f76663ef0bf1fcd1dbc42) Signed-off-by: Peter Korsgaard --- package/glibc/glibc.mk | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk index cee03a16fd..d1f13ff0b6 100644 --- a/package/glibc/glibc.mk +++ b/package/glibc/glibc.mk @@ -24,18 +24,6 @@ GLIBC_CPE_ID_VENDOR = gnu # allow proper matching with the CPE database. GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION))) -# Fixed by glibc-2.39-31-g31da30f23cddd36db29d5b6a1c7619361b271fb4 -GLIBC_IGNORE_CVES += CVE-2024-2961 - -# Fixed by glibc-2.39-35-g1263d583d2e28afb8be53f8d6922f0842036f35d -GLIBC_IGNORE_CVES += CVE-2024-33599 - -# Fixed by glibc-2.39-37-gc99f886de54446cd4447db6b44be93dabbdc2f8b -GLIBC_IGNORE_CVES += CVE-2024-33600 - -# Fixed by glibc-2.39-38-ga9a8d3eebb145779a18d90e3966009a1daa63cd -GLIBC_IGNORE_CVES += CVE-2024-33601 CVE-2024-33602 - # All these CVEs are considered as not being security issues by # upstream glibc: # https://security-tracker.debian.org/tracker/CVE-2010-4756