Message ID | 20240307092113.3674886-1-soumya.sambu@windriver.com |
---|---|
State | New |
Headers | show |
Series | [meta-oe,kirkstone,1/1] openvpn: ignore CVE-2023-7235 | expand |
Hi, Le jeu. 7 mars 2024 à 10:21, Soumya via lists.openembedded.org <soumya.sambu=windriver.com@lists.openembedded.org> a écrit : > From: Soumya Sambu <soumya.sambu@windriver.com> > > This CVE is related to OpenVPN 2.x GUI on Windows. > > References: > https://community.openvpn.net/openvpn/wiki/CVE-2023-7235 > https://security-tracker.debian.org/tracker/CVE-2023-7235 > > Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> > --- > meta-networking/recipes-support/openvpn/openvpn_2.5.6.bb | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.5.6.bb > b/meta-networking/recipes-support/openvpn/openvpn_2.5.6.bb > index 218e72b7a..828cd5033 100644 > --- a/meta-networking/recipes-support/openvpn/openvpn_2.5.6.bb > +++ b/meta-networking/recipes-support/openvpn/openvpn_2.5.6.bb > @@ -19,6 +19,9 @@ SRC_URI[sha256sum] = > "333a7ef3d5b317968aca2c77bdc29aa7c6d6bb3316eb3f79743b59c532 > # CVE-2020-7224 and CVE-2020-27569 are for Aviatrix OpenVPN client, not > for openvpn. > CVE_CHECK_IGNORE += "CVE-2020-7224 CVE-2020-27569" > > +# CVE-2023-7235 is specific to Windows platform > +CVE_CHECK_IGNORE += "CVE-2023-7235" > That's weird, this CVE does not appear as applicable neither locally for me or on the AB: https://autobuilder.yocto.io/pub/non-release/patchmetrics-meta-oe/cve-status-kirkstone.txt Did you do something specific to see this CVE? > + > SYSTEMD_SERVICE:${PN} += "openvpn@loopback-server.service > openvpn@loopback-client.service" > SYSTEMD_AUTO_ENABLE = "disable" > > -- > 2.40.0 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#109193): > https://lists.openembedded.org/g/openembedded-devel/message/109193 > Mute This Topic: https://lists.openembedded.org/mt/104784192/4316185 > Group Owner: openembedded-devel+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [ > yoann.congal@smile.fr] > -=-=-=-=-=-=-=-=-=-=-=- > >
diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.5.6.bb b/meta-networking/recipes-support/openvpn/openvpn_2.5.6.bb index 218e72b7a..828cd5033 100644 --- a/meta-networking/recipes-support/openvpn/openvpn_2.5.6.bb +++ b/meta-networking/recipes-support/openvpn/openvpn_2.5.6.bb @@ -19,6 +19,9 @@ SRC_URI[sha256sum] = "333a7ef3d5b317968aca2c77bdc29aa7c6d6bb3316eb3f79743b59c532 # CVE-2020-7224 and CVE-2020-27569 are for Aviatrix OpenVPN client, not for openvpn. CVE_CHECK_IGNORE += "CVE-2020-7224 CVE-2020-27569" +# CVE-2023-7235 is specific to Windows platform +CVE_CHECK_IGNORE += "CVE-2023-7235" + SYSTEMD_SERVICE:${PN} += "openvpn@loopback-server.service openvpn@loopback-client.service" SYSTEMD_AUTO_ENABLE = "disable"