From 081f4ecaed813d5027cfb5100017abe8cf200e67 Mon Sep 17 00:00:00 2001 From: Narpat Mali Date: Fri, 18 Aug 2023 14:59:59 +0000 Subject: [PATCH] ffmpeg: add CVE_STATUS for CVE-2023-39018 CVE-2023-39018 belongs to ffmpeg-cli-wrapper (Java wrapper around the FFmpeg CLI) and not ffmpeg itself. As per CVE description, it is mentioned as FFmpeg 0.7.0 which is the version for ffmpeg-cli-wrapper and ffmpeg don't have 0.7.0 version at all. Debian & Bugzilla trackers have already marked as NOT-FOR-US/RESOLVED-INVALID. As it won't be affecting the ffmpeg package so, we can ignore the CVE-2023-39018 in ffmpeg recipe. References: https://github.com/bramp/ffmpeg-cli-wrapper https://github.com/FFmpeg/FFmpeg https://security-tracker.debian.org/tracker/CVE-2023-39018 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-39018 (From OE-Core rev: c21ed498b423c13463a4ae0bb475883cc7901847) Signed-off-by: Narpat Mali Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie --- meta/recipes-multimedia/ffmpeg/ffmpeg_6.0.bb | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.0.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.0.bb index 07c641dc96..eb8dcad8a2 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.0.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.0.bb @@ -28,6 +28,13 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ SRC_URI[sha256sum] = "57be87c22d9b49c112b6d24bc67d42508660e6b718b3db89c44e47e289137082" +# https://nvd.nist.gov/vuln/detail/CVE-2023-39018 +# https://github.com/bramp/ffmpeg-cli-wrapper/issues/291 +# https://security-tracker.debian.org/tracker/CVE-2023-39018 +# https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-39018 +CVE_STATUS[CVE-2023-39018] = "cpe-incorrect: This issue belongs to ffmpeg-cli-wrapper \ +(Java wrapper around the FFmpeg CLI) and not ffmepg itself." + # Build fails when thumb is enabled: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7717 ARM_INSTRUCTION_SET:armv4 = "arm" ARM_INSTRUCTION_SET:armv5 = "arm"