mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 00:20:38 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/qt5/qt5base: drop stale ignore CVE entries, add CPE version

Browse Source 
The qt5base was reported to have 2 stale ignore CVE entries, one not
stale. Turns out that because the version is a Git commit hash, the
version comparaison did not make a lot of sense.

This commit adds QT5BASE_CPE_ID_VERSION, assigned to the closest
upstream version that we package (the Git repo we fetch is 5.15.14
plus a number of fixes). With this done, all 3 ignore CVE entries are
stale because the vulnerabilities have been fixed prior to 5.15.14.

In addition, setting QT5BASE_CPE_ID_VERSION allows to reduce the
number of CVEs affecting qt5base from 20 to 8.

Cc: Roy Kollen Svendsen <roykollensvendsen@gmail.com>
Cc: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Cc: Christian Hitz <christian.hitz@bbv.ch>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Thomas Petazzoni
2025-05-18 10:57:03 +02:00
committed by Julien Olivain
parent 4a3eab8341
commit 381ff2bf69
1 changed files with 2 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
package/qt5/qt5base/qt5base.mk
View File

@@ -9,20 +9,13 @@ QT5BASE_SITE = $(QT5_SITE)/qtbase
QT5BASE_SITE_METHOD = git
QT5BASE_CPE_ID_VENDOR = qt
QT5BASE_CPE_ID_PRODUCT = qt
# Closest upstream version
QT5BASE_CPE_ID_VERSION = 5.15.14
QT5BASE_DEPENDENCIES = host-pkgconf pcre2 zlib
QT5BASE_INSTALL_STAGING = YES
QT5BASE_SYNC_QT_HEADERS = YES
# From commits:
# 4ce7053a59 "Avoid processing-intensive painting of high number of tiny dashes"
# e7ea2ed27c "Improve fix for avoiding huge number of tiny dashes"
QT5BASE_IGNORE_CVES += CVE-2021-38593
# From commit 2766b2cba6ca4b1c430304df5437e2a6c874b107 "QProcess/Unix: ensure we don't accidentally execute something from CWD"
QT5BASE_IGNORE_CVES += CVE-2022-25255
# From commit e68ca8e51375d963b2391715f70b42707992dbd8 "Windows: use QSystemLibrary instead of LoadLibrary directly"
QT5BASE_IGNORE_CVES += CVE-2022-25634
# A few comments:
# * -no-pch to workaround the issue described at
# http://comments.gmane.org/gmane.comp.lib.qt.devel/5933.