From c4958f7b985fa035da30c42b988a8202764baf99 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 30 Dec 2025 09:19:14 +0100 Subject: [PATCH] package/glibc: remove stale IGNORE_CVES The IGNORE_CVES entries introduced in [1] no longer match to the glibc package following the bump to v2.42 in [2]. The version boundaries specified on the NVD DB are specific to 2.40 & 2.41. The CVE-2025-8058 though don't have any information available on the NVD DB and will remain on the IGNORE_CVES then. [1] feaf53585a package/glibc: security bump to version 2.41-70 [2] fb6256c0ef package/{glibc, localdef}: bump to version 2.42 Signed-off-by: Thomas Perale Signed-off-by: Thomas Petazzoni (cherry picked from commit 6fc37d7c6e8320679eff6bf7a602e3bd5b486e6b) Signed-off-by: Thomas Perale --- package/glibc/glibc.mk | 6 ------ 1 file changed, 6 deletions(-) diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk index 924274a7d6..9c3ff7124e 100644 --- a/package/glibc/glibc.mk +++ b/package/glibc/glibc.mk @@ -25,12 +25,6 @@ GLIBC_CPE_ID_VENDOR = gnu # allow proper matching with the CPE database. GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION))) -# Fixed by glibc-2.41-57-g84bdbf8a6f2fdafd3661489dbb7f79835a52da82 -GLIBC_IGNORE_CVES += CVE-2025-5745 - -# Fixed by glibc-2.41-60-g0c76c951620f9e12df2a89b2c684878b55bb6795 -GLIBC_IGNORE_CVES += CVE-2025-5702 - # Fixed by glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65 GLIBC_IGNORE_CVES += CVE-2025-8058