mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 00:20:38 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/busybox: drop stale IGNORE_CVES entries

Browse Source 
All of CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366
were fixed by patches that we no longer have since we bumped
Busybox. Those IGNORE_CVES entries are therefore no longer needed.

The CVE-2022-28391 ignore CVE entry is also reported as stale, but we
believe the NVD database is incorrect in saying this vulnerability
only affects Busybox up to 1.35.0. Indeed, Busybox 1.37.0 still
doesn't have the fixes and is therefore still affected.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Thomas Petazzoni
2025-05-18 10:56:55 +02:00
committed by Julien Olivain
parent 06afaf5347
commit f88537c46b
1 changed files with 0 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
package/busybox/busybox.mk
View File

@@ -15,16 +15,6 @@ BUSYBOX_CPE_ID_VENDOR = busybox
# 0004-nslookup-sanitize-all-printed-strings-with-printable.patch
BUSYBOX_IGNORE_CVES += CVE-2022-28391
# 0012-awk-fix-use-after-free-CVE-2023-42363.patch
BUSYBOX_IGNORE_CVES += CVE-2023-42363
# 0013-awk-fix-precedence-of-relative-to.patch
# 0014-awk-fix-ternary-operator-and-precedence-of.patch
BUSYBOX_IGNORE_CVES += CVE-2023-42364 CVE-2023-42365
# 0015-awk.c-fix-CVE-2023-42366-bug-15874.patch
BUSYBOX_IGNORE_CVES += CVE-2023-42366
BUSYBOX_CFLAGS = \
$(TARGET_CFLAGS)