From 210e6bd55991497c45eb3a6baf9ed0c20a88067c Mon Sep 17 00:00:00 2001 From: Andreas Ziegler Date: Thu, 3 Feb 2022 10:47:46 +0100 Subject: [PATCH] package/mpd: ignore CVE-2020-746[56] intended for FreeBSD PPP daemon cpe:2.3:a:mpd_project:mpd:*:*:*:*:*:*:*:* is not a valid CPE identifier for mpd (musicpd.org); this string refers to MPD /FreeBSD PPP daemon (sourceforge.net/projects/mpd) Since mpd does not have entries in the CVE database, put these two CVE identifiers on the mpd ignore list: https://nvd.nist.gov/vuln/detail/CVE-2020-7465 https://nvd.nist.gov/vuln/detail/CVE-2020-7466 Signed-off-by: Andreas Ziegler Signed-off-by: Arnout Vandecappelle (Essensium/Mind) --- package/mpd/mpd.mk | 2 ++ 1 file changed, 2 insertions(+) diff --git a/package/mpd/mpd.mk b/package/mpd/mpd.mk index 6f01b29c6d..a55e4adde2 100644 --- a/package/mpd/mpd.mk +++ b/package/mpd/mpd.mk @@ -11,6 +11,8 @@ MPD_SITE = https://www.musicpd.org/download/mpd/$(MPD_VERSION_MAJOR) MPD_DEPENDENCIES = host-pkgconf boost fmt MPD_LICENSE = GPL-2.0+ MPD_LICENSE_FILES = COPYING +# these refer to the FreeBSD PPP daemon +MPD_IGNORE_CVES = CVE-2020-7465 CVE-2020-7466 MPD_SELINUX_MODULES = mpd MPD_CONF_OPTS = \ -Daudiofile=disabled \