[langdale,26/26] nss: Whitelist CVEs related to libnssdbm

Message ID	309fde5ae782a7961aa0c0cec9d477374eff62f4.1673191116.git.akuster808@gmail.com
State	New
Headers	show Return-Path: <akuster808@gmail.com> ip: 209.85.167.175, mailfrom: akuster808@gmail.com) From: Armin Kuster <akuster808@gmail.com> To: openembedded-devel@lists.openembedded.org Subject: [langdale 26/26] nss: Whitelist CVEs related to libnssdbm Date: Sun, 8 Jan 2023 10:21:01 -0500 Message-Id: <309fde5ae782a7961aa0c0cec9d477374eff62f4.1673191116.git.akuster808@gmail.com> In-Reply-To: <cover.1673191116.git.akuster808@gmail.com> References: <cover.1673191116.git.akuster808@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[langdale,01/26] blueman: add RDEPEND on python3-fcntl \| expand [langdale,01/26] blueman: add RDEPEND on python3-fcntl [langdale,02/26] nss: fix SRC_URI [langdale,03/26] xfce4-verve-plugin: fix do_configure faiure about missing libpcre [langdale,04/26] gnome-text-editor: Add missing libpcre build time depenedency [langdale,05/26] ettercap: Add missing dependency on libpcre [langdale,06/26] ntfs-3g-ntfsprogs: Upgrade 2022.5.17 to 2022.10.3 [langdale,07/26] freeradius: fix multilib systemd service start failure [langdale,08/26] Nodejs - Upgrade to 16.18.1 [langdale,09/26] protobuf: stage protoc binary to sysroot [langdale,10/26] imapfilter: Upgrade to 2.7.6 [langdale,11/26] ostree: fix selinux policy rebuild error on first deployment [langdale,12/26] botan: upgrade 2.19.2 -> 2.19.3 [langdale,13/26] audit: upgrade 3.0.8 -> 3.0.9 [langdale,14/26] colord: upgrade 1.4.5 -> 1.4.6 [langdale,15/26] aufs-util: Fix build with large file support enabled systems [langdale,16/26] volume-key: Inherit python3targetconfig [langdale,17/26] audit: Inherit python3targetconfig [langdale,18/26] waf-samba.bbclass: point PYTHON_CONFIG to target python3-config [langdale,19/26] fontforge: Inherit python3targetconfig [langdale,20/26] smcroute: upgrade 2.5.5 -> 2.5.6 [langdale,21/26] postfix: fix multilib conflict of sample-main.cf [langdale,22/26] dool: Add patch to fix rebuild [langdale,23/26] networkmanager: fix dhcpcd PACKAGECONFIG [langdale,24/26] networkmanager: install config files into correct place [langdale,25/26] nss: Add missing CVE product [langdale,26/26] nss: Whitelist CVEs related to libnssdbm

Message ID

309fde5ae782a7961aa0c0cec9d477374eff62f4.1673191116.git.akuster808@gmail.com

State

New

Headers

From: Armin Kuster <akuster808@gmail.com>
To: openembedded-devel@lists.openembedded.org
Subject: [langdale 26/26] nss: Whitelist CVEs related to libnssdbm
Date: Sun,  8 Jan 2023 10:21:01 -0500
Message-Id: 
 <309fde5ae782a7961aa0c0cec9d477374eff62f4.1673191116.git.akuster808@gmail.com>
In-Reply-To: <cover.1673191116.git.akuster808@gmail.com>
References: <cover.1673191116.git.akuster808@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[langdale,01/26] blueman: add RDEPEND on python3-fcntl | expand

Commit Message

akuster808 Jan. 8, 2023, 3:21 p.m. UTC

From: Mathieu Dubois-Briand <mbriand@witekio.com>

These CVEs only affect libnssdbm, compiled when --enable-legacy-db is
used.

https://bugzilla.mozilla.org/show_bug.cgi?id=1360782#c6
https://bugzilla.mozilla.org/show_bug.cgi?id=1360778#c8
https://bugzilla.mozilla.org/show_bug.cgi?id=1360900#c6
https://bugzilla.mozilla.org/show_bug.cgi?id=1360779#c9
Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 90645db2fa078b50ec6807c75acea913b49ea669)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 meta-oe/recipes-support/nss/nss_3.74.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta-oe/recipes-support/nss/nss_3.74.bb b/meta-oe/recipes-support/nss/nss_3.74.bb
index 73701393e6..4a9482fca4 100644
--- a/meta-oe/recipes-support/nss/nss_3.74.bb
+++ b/meta-oe/recipes-support/nss/nss_3.74.bb
@@ -284,3 +284,7 @@  CVE_PRODUCT += "network_security_services"
 
 # CVE-2006-5201 affects only Sun Solaris
 CVE_CHECK_IGNORE += "CVE-2006-5201"
+
+# CVES CVE-2017-11695 CVE-2017-11696 CVE-2017-11697 CVE-2017-11698 only affect
+# the legacy db (libnssdbm), only compiled with --enable-legacy-db.
+CVE_CHECK_IGNORE += "CVE-2017-11695 CVE-2017-11696 CVE-2017-11697 CVE-2017-11698"

[langdale,26/26] nss: Whitelist CVEs related to libnssdbm

Commit Message

Patch