From 897df024b8be78bfe31ef889b9b8ed9642c80594 Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Sun, 18 May 2025 10:57:01 +0200 Subject: [PATCH] package/libssh: drop stale ignore CVE entry CVE-2023-3603 has never affected any release, but NVD decided to document it as affecting all versions up to 0.8.9. While this is incorrect, we don't really care much, as we're now using 0.11 which according to NVD is not affected, making our ignore CVE entry stale. Signed-off-by: Thomas Petazzoni Signed-off-by: Julien Olivain (cherry picked from commit ae116161ac289ecf30cd81ae117bcf8e30b29a58) Signed-off-by: Thomas Perale --- package/libssh/libssh.mk | 4 ---- 1 file changed, 4 deletions(-) diff --git a/package/libssh/libssh.mk b/package/libssh/libssh.mk index 6f8a1ac389..a00e6a9445 100644 --- a/package/libssh/libssh.mk +++ b/package/libssh/libssh.mk @@ -17,10 +17,6 @@ LIBSSH_CONF_OPTS = \ -DWITH_STACK_PROTECTOR=OFF \ -DWITH_EXAMPLES=OFF -# Not part of any release -# https://www.libssh.org/2023/07/14/cve-2023-3603-potential-null-dereference-in-libsshs-sftp-server/ -LIBSSH_IGNORE_CVES += CVE-2023-3603 - ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y) LIBSSH_CONF_OPTS += -DWITH_STACK_CLASH_PROTECTION=OFF endif