From bf7654877ba99f0b18a1cf6f83032af5ecabd01f Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Fri, 28 Mar 2025 18:37:16 +0100 Subject: [PATCH] libarchive: ignore CVE-2025-1632 As already mentioned in [1] when backporting commit including fix for this CVE, this vulnerability applies only from libarchive 3.7.0 commit [2] which introduced bsdunzip which contains this vulnerability. [1] https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=ec837d3b21b4f8b98abac53e2833f1490ba6bf1e [2] https://github.com/libarchive/libarchive/commit/c157e4ce8eb170a92945cc2d292fd7106bdfcce1 Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman --- meta/recipes-extended/libarchive/libarchive_3.6.2.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-extended/libarchive/libarchive_3.6.2.bb b/meta/recipes-extended/libarchive/libarchive_3.6.2.bb index 4ceb0df2c0..f7e576b688 100644 --- a/meta/recipes-extended/libarchive/libarchive_3.6.2.bb +++ b/meta/recipes-extended/libarchive/libarchive_3.6.2.bb @@ -44,6 +44,8 @@ SRC_URI[sha256sum] = "ba6d02f15ba04aba9c23fd5f236bb234eab9d5209e95d1c4df85c44d5f CVE_CHECK_IGNORE += "CVE-2023-30571" # cpe-incorrect: this vulnerability was not in any release; introduced in v3.7.3-14-g91f27004; fixed in b6a97948 CVE_CHECK_IGNORE += "CVE-2024-37407" +# cpe-incorrect: bsdtar was introduced in v3.7.0, so 3.6.2 is not affected yet +CVE_CHECK_IGNORE += "CVE-2025-1632" inherit autotools update-alternatives pkgconfig -- 2.47.2