From 62b767fd3ed27d245937066f77ec53bd0b1e9329 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Wed, 31 Jan 2024 09:12:53 +0100 Subject: [PATCH] package/glibc: add CVE ignore for CVE-2023-4806 Commit 8519de517e22 (package/{glibc, localedef}: security bump to version glibc-2.38-27-g750a45a783906a19591fb8ff6b7841470f1f5701) correctly mentioned CVE-2023-4806 in the commit message, but forgot to add an ignore for it. Fix that. Signed-off-by: Peter Korsgaard --- package/glibc/glibc.mk | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk index 596697bb8f..d49da6457c 100644 --- a/package/glibc/glibc.mk +++ b/package/glibc/glibc.mk @@ -28,6 +28,10 @@ GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION))) # 2.38 and the version we're really using GLIBC_IGNORE_CVES += CVE-2023-4527 +# Fixed by 5ee59ca371b99984232d7584fe2b1a758b4421d3, which is between +# 2.38 and the version we're really using +GLIBC_IGNORE_CVES += CVE-2023-4806 + # Fixed by 750a45a783906a19591fb8ff6b7841470f1f5710, which is between # 2.38 and the version we're really using. GLIBC_IGNORE_CVES += CVE-2023-4911