diff options
author | Peter Marko <peter.marko@siemens.com> | 2023-07-29 20:23:19 +0200 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2023-08-16 03:55:12 -1000 |
commit | 0de5f6a27a794c915a2ef2483901ab915056d961 (patch) | |
tree | 23a73ff8bc5f00c7c2473999efd6f077585f6424 /meta/recipes-extended | |
parent | f7f7d5514cf0f63a34d1c75efb031829808ddf2e (diff) | |
download | poky-0de5f6a27a794c915a2ef2483901ab915056d961.tar.gz |
libarchive: ignore CVE-2023-30571
This issue was reported and discusses under [1] which is linked in NVD CVE report.
It was already documented that some parts or libarchive are thread safe and some not.
[2] was now merged to document that also reported function is not thread safe.
So this CVE *now* reports thread race condition for non-thread-safe function.
And as such the CVE report is now invalid.
The issue is still not closed for 2 reasons:
* better document what is and what is not thread safe
* request to public if someone could make these functions thread safe
This should however not invalidate above statment about ignoring this CVE.
[1] https://github.com/libarchive/libarchive/issues/1876
[2] https://github.com/libarchive/libarchive/pull/1875
(From OE-Core rev: 9374e680ae2376589a9bfe4565dfcf4dc9791aa8)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-extended')
-rw-r--r-- | meta/recipes-extended/libarchive/libarchive_3.4.2.bb | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/meta/recipes-extended/libarchive/libarchive_3.4.2.bb b/meta/recipes-extended/libarchive/libarchive_3.4.2.bb index 582787d3f3..728eedc401 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.4.2.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.4.2.bb | |||
@@ -46,6 +46,9 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \ | |||
46 | SRC_URI[md5sum] = "d953ed6b47694dadf0e6042f8f9ff451" | 46 | SRC_URI[md5sum] = "d953ed6b47694dadf0e6042f8f9ff451" |
47 | SRC_URI[sha256sum] = "b60d58d12632ecf1e8fad7316dc82c6b9738a35625746b47ecdcaf4aed176176" | 47 | SRC_URI[sha256sum] = "b60d58d12632ecf1e8fad7316dc82c6b9738a35625746b47ecdcaf4aed176176" |
48 | 48 | ||
49 | # upstream-wontfix: upstream has documented that reported function is not thread-safe | ||
50 | CVE_CHECK_WHITELIST += "CVE-2023-30571" | ||
51 | |||
49 | inherit autotools update-alternatives pkgconfig | 52 | inherit autotools update-alternatives pkgconfig |
50 | 53 | ||
51 | CPPFLAGS += "-I${WORKDIR}/extra-includes" | 54 | CPPFLAGS += "-I${WORKDIR}/extra-includes" |