package/tar: ignore CVE-2007-4476
https://security-tracker.debian.org/tracker/CVE-2007-4476 Currently NVD has this incorrectly tagged for all versions. The bug trackers on different distros show it was generally fixed in versions >= 1.16 but because the impacted source code is in the GNU paxutils, it is hard to follow in what cases tar has been fixed around that 1.16 version. https://bugs.gentoo.org/196978 https://www.itsecdb.com/oval/definition/oval/org.mitre.oval/def/9336/Buffer-overflow-in-the-safer-name-suffix-function-in-GNU-tar.html Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
This commit is contained in:
parent
fb4402b516
commit
9486774bbf
@ -13,6 +13,8 @@ TAR_CONF_OPTS = --exec-prefix=/
|
||||
TAR_LICENSE = GPL-3.0+
|
||||
TAR_LICENSE_FILES = COPYING
|
||||
TAR_CPE_ID_VENDOR = gnu
|
||||
# only tar <= 1.16
|
||||
TAR_IGNORE_CVES += CVE-2007-4476
|
||||
|
||||
ifeq ($(BR2_PACKAGE_ACL),y)
|
||||
TAR_DEPENDENCIES += acl
|
||||
|
Loading…
Reference in New Issue
Block a user