From 26e1179507275a2440593bbf5ad2110175ab83a1 Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Wed, 6 Nov 2019 17:37:55 +0200 Subject: procps: whitelist CVE-2018-1121 This CVE is about race conditions in 'ps' which make it unsuitable for security audits. As these race conditions are unavoidable ps shouldn't be used for security auditing, so this isn't a valid CVE. (From OE-Core rev: b3fa0654abf9ac32f683ac174e453ea5e64b6cb8) (From OE-Core rev: 618a3203d53d33e6403386f1204bcaf327b68f37) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Conflicts: meta/recipes-extended/procps/procps_3.3.15.bb --- meta/recipes-extended/procps/procps_3.3.12.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-extended/procps/procps_3.3.12.bb b/meta/recipes-extended/procps/procps_3.3.12.bb index 6e15b0a5a0..d4ebaf9db0 100644 --- a/meta/recipes-extended/procps/procps_3.3.12.bb +++ b/meta/recipes-extended/procps/procps_3.3.12.bb @@ -64,3 +64,6 @@ python __anonymous() { d.setVarFlag('ALTERNATIVE_LINK_NAME', prog, '%s/%s' % (d.getVar('base_sbindir'), prog)) } +# 'ps' isn't suitable for use as a security tool so whitelist this CVE. +# https://bugzilla.redhat.com/show_bug.cgi?id=1575473#c3 +CVE_CHECK_WHITELIST += "CVE-2018-1121" -- cgit v1.2.3-54-g00ecf