From 8c3b4a604b40260e7ca9575715dd8017e17d35c0 Mon Sep 17 00:00:00 2001 From: Poonam Jadhav Date: Tue, 4 Mar 2025 17:38:52 +0530 Subject: [PATCH] curl: ignore CVE-2025-0725 CVE-2025-0725 can only trigger for curl when using a runtime zlib version 1.2.0.3 or older and scarthgap supports zlib 1.3.1 version, hence ignore cve for scarthgap https://curl.se/docs/CVE-2025-0725.html Signed-off-by: Poonam Jadhav Signed-off-by: Steve Sakoman --- meta/recipes-support/curl/curl_8.7.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 439fcb78813..ddd591dd963 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -27,6 +27,8 @@ SRC_URI[sha256sum] = "6fea2aac6a4610fbd0400afb0bcddbe7258a64c63f1f68e5855ebc0c65 CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl" CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack" +CVE_STATUS[CVE-2025-0725] = "not-applicable-config: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older" + inherit autotools pkgconfig binconfig multilib_header ptest # Entropy source for random PACKAGECONFIG option -- 2.47.3