From 9dbd14df2291b5c6566d7fcd73c3934b931aed1a Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 30 Dec 2025 09:19:16 +0100 Subject: [PATCH] package/dovecot: remove stale IGNORE_CVES Since Buildroot commit [1] the CVEs are no longer matched to CPEs with versions using '-'. These IGNORE_CVES entry introduced in [2] is then no longer matched to the dovecot package. For more information, see the explanation in commit [1]. [1] 35f376d88e support/scripts/cve.py: fix CPE matching [2] 948e71689a package/dovecot: ignore CVE-2016-4983 Signed-off-by: Thomas Perale Signed-off-by: Thomas Petazzoni --- package/dovecot/dovecot.mk | 5 ----- 1 file changed, 5 deletions(-) diff --git a/package/dovecot/dovecot.mk b/package/dovecot/dovecot.mk index 6612787a94..a4c799221c 100644 --- a/package/dovecot/dovecot.mk +++ b/package/dovecot/dovecot.mk @@ -21,12 +21,7 @@ DOVECOT_DEPENDENCIES = \ $(if $(BR2_PACKAGE_LIBICONV),libiconv) \ openssl -# CVE-2016-4983 is an issue in a postinstall script in the dovecot rpm, which -# is part of the Red Hat packaging and not part of upstream dovecot -DOVECOT_IGNORE_CVES += CVE-2016-4983 - # 0001-auth-Fix-handling-passdbs-with-identical-driver-args.patch - # Note: this ignore CVE entry is reported as stale by pkg-stats, but # the NVD database is incorrect: # https://lore.kernel.org/buildroot/20250517181815.02ce0393@windsurf/