From 79b670f497cf1fb6153554f73827a701ae3bc244 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sat, 27 Dec 2025 14:06:10 +0100 Subject: [PATCH] package/linenoise: add CPE The CPE 'cpe:2.3:a:antirez:linenoise:1.0:*:*:*:*:*:*:*' is valid for the package linenoise [1]. Since the latest version is '1.0' since 2015 the CPE_ID_VERSION is set to that version. The CVE that applies on version 1.0 were checked with the 'cve-check' script: ``` echo '{"components": [{"bom-ref": "linenoise", "name": "linenoise", "version": "1.0", "cpe": "cpe:2.3:a:antirez:linenoise:1.0:-:*:*:*:*:*:*"}]}' | support/scripts/cve-check | jq -r '.vulnerabilities[].id' ``` Only the CVE-2025-9810 exists and that was fixed in [2]. [1] https://nvd.nist.gov/products/cpe/detail/10423C23-6AAA-439E-B723-1FCDEB3A769F [2] 3c7cbf97d7 package/linenoise: security bump to version e26268de5e Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain (cherry picked from commit 2668d121e5add1f999206b5c43fa325587de81b7) Signed-off-by: Thomas Perale --- package/linenoise/linenoise.mk | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/package/linenoise/linenoise.mk b/package/linenoise/linenoise.mk index 05f8aa4845..29bed3ce4f 100644 --- a/package/linenoise/linenoise.mk +++ b/package/linenoise/linenoise.mk @@ -8,10 +8,15 @@ LINENOISE_VERSION = e26268de5e56bfaad773786471844578fe9f7f4b LINENOISE_SITE = $(call github,antirez,linenoise,$(LINENOISE_VERSION)) LINENOISE_LICENSE = BSD-2-Clause LINENOISE_LICENSE_FILES = LICENSE +LINENOISE_CPE_ID_VENDOR = antirez +LINENOISE_CPE_ID_VERSION = 1.0 LINENOISE_INSTALL_STAGING = YES # Static library only, nothing to install on target LINENOISE_INSTALL_TARGET = NO +# Fixed in https://github.com/antirez/linenoise/commit/880b94130ffa5f8236392392b447ff2234b11983 +LINENOISE_IGNORE_CVES += CVE-2025-9810 + define LINENOISE_BUILD_CMDS cd $(@D); $(TARGET_CC) $(TARGET_CFLAGS) -c linenoise.c cd $(@D); $(TARGET_AR) rcu liblinenoise.a linenoise.o