From 0f437fb0f2bc7f27aab3dee70544f2a339cdccaa Mon Sep 17 00:00:00 2001 From: Harish Sadineni Date: Tue, 16 Apr 2024 04:51:31 -0700 Subject: [PATCH] rust: add CVE_CHECK_IGNORE for CVE-2024-24576 CVE-2024-24576 only applies when invoking batch files (with the `bat` and `cmd` extensions) on Windows & No other platform or use is affected. More details about CVE is here: https://nvd.nist.gov/vuln/detail/CVE-2024-24576 (From OE-Core rev: 44e0b6b028657d32de5971d6a42a88767ef8c710) Signed-off-by: Harish Sadineni Signed-off-by: Steve Sakoman --- meta/recipes-devtools/rust/rust-source.inc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-devtools/rust/rust-source.inc b/meta/recipes-devtools/rust/rust-source.inc index ea70ad786f..c377a680a7 100644 --- a/meta/recipes-devtools/rust/rust-source.inc +++ b/meta/recipes-devtools/rust/rust-source.inc @@ -5,3 +5,6 @@ RUSTSRC = "${WORKDIR}/rustc-${PV}-src" UPSTREAM_CHECK_URI = "https://forge.rust-lang.org/infra/other-installation-methods.html" UPSTREAM_CHECK_REGEX = "rustc-(?P\d+(\.\d+)+)-src" + +#CVE-2024-24576 is specific to Microsoft Windows +CVE_CHECK_IGNORE += "CVE-2024-24576"