From f88537c46b29c6159f62606b1a631dd5befb4fa2 Mon Sep 17 00:00:00 2001 From: Thomas Petazzoni Date: Sun, 18 May 2025 10:56:55 +0200 Subject: [PATCH] package/busybox: drop stale IGNORE_CVES entries All of CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366 were fixed by patches that we no longer have since we bumped Busybox. Those IGNORE_CVES entries are therefore no longer needed. The CVE-2022-28391 ignore CVE entry is also reported as stale, but we believe the NVD database is incorrect in saying this vulnerability only affects Busybox up to 1.35.0. Indeed, Busybox 1.37.0 still doesn't have the fixes and is therefore still affected. Signed-off-by: Thomas Petazzoni Signed-off-by: Julien Olivain --- package/busybox/busybox.mk | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk index d3074d2218..532932ec8f 100644 --- a/package/busybox/busybox.mk +++ b/package/busybox/busybox.mk @@ -15,16 +15,6 @@ BUSYBOX_CPE_ID_VENDOR = busybox # 0004-nslookup-sanitize-all-printed-strings-with-printable.patch BUSYBOX_IGNORE_CVES += CVE-2022-28391 -# 0012-awk-fix-use-after-free-CVE-2023-42363.patch -BUSYBOX_IGNORE_CVES += CVE-2023-42363 - -# 0013-awk-fix-precedence-of-relative-to.patch -# 0014-awk-fix-ternary-operator-and-precedence-of.patch -BUSYBOX_IGNORE_CVES += CVE-2023-42364 CVE-2023-42365 - -# 0015-awk.c-fix-CVE-2023-42366-bug-15874.patch -BUSYBOX_IGNORE_CVES += CVE-2023-42366 - BUSYBOX_CFLAGS = \ $(TARGET_CFLAGS)