From 18809021cc690ab58255556ff8ef026c98c65194 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Thu, 28 Aug 2025 12:01:44 +0200 Subject: [PATCH] package/unbound: mark CVE-2025-5994 as not applicable Unbound is vulnerable to CVE-2025-5994: "Cache poisoning via the ECS-enabled Rebirthday Attack" if built with --enable-subnet, which is not the case in Buildroot, so mark it as not applicable. https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt Signed-off-by: Peter Korsgaard (cherry picked from commit c7721b0174d9e978e58bdffba26ff2151b47af9c) Signed-off-by: Titouan Christophe --- package/unbound/unbound.mk | 3 +++ 1 file changed, 3 insertions(+) diff --git a/package/unbound/unbound.mk b/package/unbound/unbound.mk index 03a5e8e150..e9a32e6129 100644 --- a/package/unbound/unbound.mk +++ b/package/unbound/unbound.mk @@ -23,6 +23,9 @@ UNBOUND_CONF_OPTS = \ --with-libexpat=$(STAGING_DIR)/usr \ --with-ssl=$(STAGING_DIR)/usr +# Only vulnerable if built with --enable-subnet +UNBOUND_IGNORE_CVES += CVE-2025-5994 + ifeq ($(BR2_TOOLCHAIN_HAS_THREADS_NPTL),y) UNBOUND_CONF_OPTS += --with-pthreads else