From ae710096ba890f51c5d4f8fccb8a7ff43dda3921 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Fri, 29 May 2026 22:43:49 +0200 Subject: [PATCH] package/podman: ignore CVE-2026-33414 As stated in the advisory: The affected code is only used on Windows, all other operating systems are not affected by this and can thus ignore the CVE patch. https://github.com/containers/podman/security/advisories/GHSA-hc8w-h2mf-hp59 So mark it as ignored. Signed-off-by: Peter Korsgaard Signed-off-by: Arnout Vandecappelle (cherry picked from commit b3c1619c565c15416ec9c0131e1b688a79ae3e90) Signed-off-by: Thomas Perale --- package/podman/podman.mk | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package/podman/podman.mk b/package/podman/podman.mk index 80107f3d9e..f601f7e6d7 100644 --- a/package/podman/podman.mk +++ b/package/podman/podman.mk @@ -33,6 +33,10 @@ PODMAN_TAGS += libsubid PODMAN_CPE_ID_VERSION = $(subst v,,$(PODMAN_VERSION)) +# Windows only issue: +# https://github.com/containers/podman/security/advisories/GHSA-hc8w-h2mf-hp59 +PODMAN_IGNORE_CVES += CVE-2026-33414 + ifeq ($(BR2_PACKAGE_BTRFS_PROGS),y) PODMAN_DEPENDENCIES += btrfs-progs define PODMAN_LINUX_CONFIG_FIXUPS_BTRFS