From 1d8a4f3ba2447e8b4fa46c67ca315486fb7c5c2a Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Wed, 5 Aug 2026 03:09:53 -0700 Subject: [PATCH] shadow: set CVE_PRODUCT This will remove CVE-2016-15024 from open cve reports. This CVE for is for "doomsider:shadow" [1]. It will also remove * CVE-2018-16588 (suse:shadow, [2]) * CVE-2019-16110 (blade-group:shadow [3]) which can be verified that they don't affect Yocto shadow. [1] https://security-tracker.debian.org/tracker/CVE-2016-15024 [2] https://security-tracker.debian.org/tracker/CVE-2018-16588 [3] https://security-tracker.debian.org/tracker/CVE-2019-16110 (From OE-Core rev: ce42a12d7270ed25ce46f5a67cbf3889f7b456ee) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie (cherry picked from commit 2946e238d2a3947c1a51c4ac1c86c8284f68e4cf) Signed-off-by: Devansh Patel Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker --- meta/recipes-extended/shadow/shadow.inc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-extended/shadow/shadow.inc b/meta/recipes-extended/shadow/shadow.inc index 40e6ab0b30..a308ea00d2 100644 --- a/meta/recipes-extended/shadow/shadow.inc +++ b/meta/recipes-extended/shadow/shadow.inc @@ -36,6 +36,8 @@ PAM_SRC_URI = "file://pam.d/chfn \ file://pam.d/passwd \ file://pam.d/su" +CVE_PRODUCT = "debian:shadow shadow_project:shadow" + inherit autotools gettext github-releases pkgconfig export CONFIG_SHELL="/bin/sh"