From 6110dcd60f31bcfc8f20df26651dd1807118be05 Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Tue, 8 Sep 2020 13:23:24 +0100 Subject: curl: add vendors to CVE_PRODUCT to exclude false positives To avoid false positives (such as CVE-2010-0734, rubygems:curl), expand the CVE_PRODUCT list to include all the vendors that have been used. (From OE-Core rev: 3c0029c9cf22b6983020edf9ce2aeb7b326d8c12) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit bb265122cccea9466405fdd924ad10ce8cda0dec) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie --- meta/recipes-support/curl/curl_7.69.1.bb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/meta/recipes-support/curl/curl_7.69.1.bb b/meta/recipes-support/curl/curl_7.69.1.bb index 8b5170f021..dfcd533c80 100644 --- a/meta/recipes-support/curl/curl_7.69.1.bb +++ b/meta/recipes-support/curl/curl_7.69.1.bb @@ -14,7 +14,9 @@ SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \ SRC_URI[md5sum] = "ec5fc263f898a3dfef08e805f1ecca42" SRC_URI[sha256sum] = "2ff5e5bd507adf6aa88ff4bbafd4c7af464867ffb688be93b9930717a56c4de8" -CVE_PRODUCT = "curl libcurl" +# Curl has used many names over the years... +CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl" + inherit autotools pkgconfig binconfig multilib_header PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} gnutls libidn proxy threaded-resolver verbose zlib" -- cgit v1.2.3-54-g00ecf