From f35f54020599af914b5f2f138bd6e3e24cc623a2 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Thu, 7 Aug 2025 17:29:07 +0200 Subject: [PATCH] package/luajit: ignore multiple CVEs This patch ignores the following CVEs that are already fixed in the current version. - CVE-2020-15890 For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2020-15890 - https://github.com/LuaJIT/LuaJIT/commit/53f82e6e2e858a0a62fd1a2ff47e9866693382e6 - CVE-2020-24372 For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2020-24372 - https://github.com/LuaJIT/LuaJIT/commit/e296f56b825c688c3530a981dc6b495d972f3d01 - CVE-2024-25176 For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2024-25176 - https://github.com/LuaJIT/LuaJIT/commit/343ce0edaf3906a62022936175b2f5410024cbfc - CVE-2024-25177 For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2024-25177 - https://github.com/LuaJIT/LuaJIT/commit/85b4fed0b0353dd78c8c875c2f562d522a2b310f - CVE-2024-25178 For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2024-25178 - https://github.com/LuaJIT/LuaJIT/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8 Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard (cherry picked from commit 98f0d8ad01e6834aab889ff80c59a46e341a42ed) Signed-off-by: Thomas Perale --- package/luajit/luajit.mk | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/package/luajit/luajit.mk b/package/luajit/luajit.mk index ebec4d87ac..f4836df91d 100644 --- a/package/luajit/luajit.mk +++ b/package/luajit/luajit.mk @@ -12,6 +12,21 @@ LUAJIT_CPE_ID_VENDOR = luajit LUAJIT_CPE_ID_VERSION = 2.1.0 LUAJIT_CPE_ID_UPDATE = beta3 +# Fixed in 53f82e6e2e858a0a62fd1a2ff47e9866693382e6 +LUAJIT_IGNORE_CVES += CVE-2020-15890 + +# Fixed in e296f56b825c688c3530a981dc6b495d972f3d01 +LUAJIT_IGNORE_CVES += CVE-2020-24372 + +# Fixed in 343ce0edaf3906a62022936175b2f5410024cbfc +LUAJIT_IGNORE_CVES += CVE-2024-25176 + +# Fixed in 85b4fed0b0353dd78c8c875c2f562d522a2b310f +LUAJIT_IGNORE_CVES += CVE-2024-25177 + +# Fixed in defe61a56751a0db5f00ff3ab7b8f45436ba74c8 +LUAJIT_IGNORE_CVES += CVE-2024-25178 + LUAJIT_INSTALL_STAGING = YES LUAJIT_PROVIDES = luainterpreter