mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 00:04:06 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libopenh264: ignore CVE-2025-27091

Browse Source 
Both openh264 2.6.0 and 2.5.1 contain the fix for this CVE (see the
release notes at [1]).

In other words the version we have is no longer vulnerable since
a7aeb5a46e ("package/libopenh264:
security bump to version 2.5.1") but pkg-stats still reports it.

An email was sent to the NVD to fix the CPE version number, but in the
meantime let's ignore it to reduce the noise in our CVE checker.

[1]: https://github.com/cisco/openh264/releases/tag/2.5.1

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2488d97719)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Raphaël Mélotte
2025-04-14 15:32:33 +02:00
committed by Thomas Perale
parent ca5f3492fc
commit b072b1018e
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
package/libopenh264/libopenh264.mk
View File

@@ -12,6 +12,9 @@ LIBOPENH264_CPE_ID_VENDOR = cisco
LIBOPENH264_CPE_ID_PRODUCT = openh264
LIBOPENH264_INSTALL_STAGING = YES
# The following CVE is fixed in 2.5.1, the NVD CPE is not up to date
LIBOPENH264_IGNORE_CVES += CVE-2025-27091
ifeq ($(BR2_aarch64),y)
LIBOPENH264_ARCH = aarch64
else ifeq ($(BR2_arm)$(BR2_armeb),y)