]> git.ipfire.org Git - thirdparty/openembedded/openembedded-core.git/commit
ffmpeg: add CVE_CHECK_IGNORE for CVE-2023-39018
authorNarpat Mali <narpat.mali@windriver.com>
Thu, 24 Aug 2023 14:58:42 +0000 (14:58 +0000)
committerSteve Sakoman <steve@sakoman.com>
Sun, 27 Aug 2023 14:03:37 +0000 (04:03 -1000)
commite787e364efbba372675081aadd802b43274097f0
tree0da45cad8844a40c4f17eee6b53bcbf23e87acbd
parentea920e3c8075f3a1b79039341f8c889f6197a07f
ffmpeg: add CVE_CHECK_IGNORE for CVE-2023-39018

CVE-2023-39018 belongs to ffmpeg-cli-wrapper (Java wrapper around the FFmpeg CLI)
and not ffmpeg itself. As per CVE description, it is mentioned as FFmpeg 0.7.0 which
is the version for ffmpeg-cli-wrapper and ffmpeg don't have 0.7.0 version at all.

Debian & Bugzilla trackers have already marked as NOT-FOR-US/RESOLVED-INVALID.
As it won't be affecting the ffmpeg package so, we can ignore the CVE-2023-39018
in ffmpeg recipe.

References:
https://github.com/bramp/ffmpeg-cli-wrapper
https://github.com/FFmpeg/FFmpeg
https://security-tracker.debian.org/tracker/CVE-2023-39018
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-39018

Upstream master patch:
https://git.openembedded.org/openembedded-core/commit/?id=c21ed498b423c13463a4ae0bb475883cc7901847

Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb