From bda1452e19236bc58eb52d747126ba95209c0a77 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sun, 15 Feb 2026 15:49:22 +0100 Subject: [PATCH] package/haproxy: ignore CVE-2023-45539 The CVE-2023-45539 has incomplete informations (see [1]) and will be reported as exploitable by pkg-stats for haproxy v2.6.22. The vulnerability has been fixed upstream since version 2.6.15 [2][3]. This commit mark this vulnerability as ignored. [1] https://nvd.nist.gov/vuln/detail/CVE-2023-45539 [2] https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=832b672eee54866c7a42a1d46078cc9ae0d544d9 [3] https://security-tracker.debian.org/tracker/CVE-2023-45539 Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain (cherry picked from commit d6e219adf0dec76cbf0d68eafb4739651562031b) Signed-off-by: Thomas Perale --- package/haproxy/haproxy.mk | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package/haproxy/haproxy.mk b/package/haproxy/haproxy.mk index 77195d966b..f60cb1e08a 100644 --- a/package/haproxy/haproxy.mk +++ b/package/haproxy/haproxy.mk @@ -11,6 +11,10 @@ HAPROXY_LICENSE = GPL-2.0+ and LGPL-2.1+ with exceptions HAPROXY_LICENSE_FILES = LICENSE doc/lgpl.txt doc/gpl.txt HAPROXY_CPE_ID_VENDOR = haproxy +# Incomplete NVD annotations, fixed since v2.6.15 +# https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=832b672eee54866c7a42a1d46078cc9ae0d544d9 +HAPROXY_IGNORE_CVES += CVE-2023-45539 + HAPROXY_MAKE_OPTS = \ LD=$(TARGET_CC) \ PREFIX=/usr \