From 94dfcaff64ee971d9e5a3edebe8f13ca20ea3555 Mon Sep 17 00:00:00 2001 From: Ross Burton Date: Mon, 16 Aug 2021 10:05:49 +0100 Subject: tar: ignore node-tar CVEs These two CVEs are specific to the Node package node-tar. (From OE-Core rev: bc7216e8148d0dee7b56e6851da6615e93647a0a) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- meta/recipes-extended/tar/tar_1.34.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-extended/tar/tar_1.34.bb b/meta/recipes-extended/tar/tar_1.34.bb index c096a8c9a8..98755a11cc 100644 --- a/meta/recipes-extended/tar/tar_1.34.bb +++ b/meta/recipes-extended/tar/tar_1.34.bb @@ -61,3 +61,6 @@ PROVIDES:append:class-native = " tar-replacement-native" NATIVE_PACKAGE_PATH_SUFFIX = "/${PN}" BBCLASSEXTEND = "native nativesdk" + +# These are both specific to the NPM package node-tar +CVE_CHECK_WHITELIST += "CVE-2021-32803 CVE-2021-32804" -- cgit v1.2.3-54-g00ecf