openRuyi-tutorials/buildroot
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/busybox: drop stale IGNORE_CVES entries

Browse Source 
All of CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366
were fixed by patches that we no longer have since we bumped
Busybox. Those IGNORE_CVES entries are therefore no longer needed.

The CVE-2022-28391 ignore CVE entry is also reported as stale, but we
believe the NVD database is incorrect in saying this vulnerability
only affects Busybox up to 1.35.0. Indeed, Busybox 1.37.0 still
doesn't have the fixes and is therefore still affected.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f88537c46b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Petazzoni
2025-05-18 10:56:55 +02:00
committed by Thomas Perale
parent c07f2fb051
commit ae3119bc05
1 changed files with 0 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
package/busybox/busybox.mk
View File

@@ -15,16 +15,6 @@ BUSYBOX_CPE_ID_VENDOR = busybox
# 0004-nslookup-sanitize-all-printed-strings-with-printable.patch
BUSYBOX_IGNORE_CVES += CVE-2022-28391
# 0012-awk-fix-use-after-free-CVE-2023-42363.patch
BUSYBOX_IGNORE_CVES += CVE-2023-42363
# 0013-awk-fix-precedence-of-relative-to.patch
# 0014-awk-fix-ternary-operator-and-precedence-of.patch
BUSYBOX_IGNORE_CVES += CVE-2023-42364 CVE-2023-42365
# 0015-awk.c-fix-CVE-2023-42366-bug-15874.patch
BUSYBOX_IGNORE_CVES += CVE-2023-42366
BUSYBOX_CFLAGS = \
$(TARGET_CFLAGS)