From: Purushottam Choudhary Date: Wed, 3 Mar 2021 10:50:38 +0000 (+0530) Subject: shadow: whitelist CVE-2013-4235 X-Git-Tag: lucaceresoli/bug-15201-perf-libtraceevent-missing~8507 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b1c6cd87bee6b019619dc5728fd6c36bc87ed696;p=thirdparty%2Fopenembedded%2Fopenembedded-core-contrib.git shadow: whitelist CVE-2013-4235 This CVE is about TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees which had very low severity problem and marked as closed and won't fix. Therefore whitelisted CVE-2013-4235. Master, gatesgarth and dunfell all have shadow version 4.81. Hence, this is applicable for master, gatesgarth and dunfell. Link: https://bugzilla.redhat.com/show_bug.cgi?id=884658 Signed-off-by: Sana Kazi Signed-off-by: Richard Purdie --- diff --git a/meta/recipes-extended/shadow/shadow_4.8.1.bb b/meta/recipes-extended/shadow/shadow_4.8.1.bb index c975395ff8d..ff4aad926f6 100644 --- a/meta/recipes-extended/shadow/shadow_4.8.1.bb +++ b/meta/recipes-extended/shadow/shadow_4.8.1.bb @@ -6,5 +6,6 @@ BUILD_LDFLAGS_append_class-target = " ${@bb.utils.contains('DISTRO_FEATURES', 'p BBCLASSEXTEND = "native nativesdk" - - +# Severity is low and marked as closed and won't fix. +# https://bugzilla.redhat.com/show_bug.cgi?id=884658 +CVE_CHECK_WHITELIST += "CVE-2013-4235"