From b155395a52e50327db98e9bcfc62410e5eb109cd Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 30 Dec 2025 09:19:11 +0100 Subject: [PATCH] package/libcurl: remove stale IGNORE_CVES Since Buildroot commit [1] the CVEs are no longer matched to CPEs with versions using '-'. The CVE-2024-32928 introduced in [2] is then no longer matched to the libcurl package. For more information, see the explanation in commit [1]. [1] 35f376d88e support/scripts/cve.py: fix CPE matching [2] 7e739d49b2 package/libcurl: ignore CVE-2024-32928 Signed-off-by: Thomas Perale Signed-off-by: Thomas Petazzoni --- package/libcurl/libcurl.mk | 4 ---- 1 file changed, 4 deletions(-) diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk index 9e32c38d97..6924631735 100644 --- a/package/libcurl/libcurl.mk +++ b/package/libcurl/libcurl.mk @@ -25,10 +25,6 @@ LIBCURL_CONF_OPTS = \ --disable-ldap \ --disable-ldaps -# Only affects Nest products. -# https://nvd.nist.gov/vuln/detail/CVE-2024-32928 -LIBCURL_IGNORE_CVES += CVE-2024-32928 - # threaded resolver cannot be used with c-ares # https://github.com/curl/curl/commit/d364f1347f05c53eea5d25a15b4ad8a62ecc85b8 ifeq ($(BR2_TOOLCHAIN_HAS_THREADS)x$(BR2_PACKAGE_C_ARES),yx)