From 1f5be803eeddc4e10a6fa82b32c314b5e239e0db Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Mon, 26 Aug 2024 18:54:02 +0200 Subject: [PATCH] curl: Ignore CVE-2024-32928 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This CVE affects google cloud services that utilize libcurl wrongly. (From OE-Core rev: 27ac7879711e7119b4ec8b190b0a9da5b3ede269) Changed CVE ignore syntax (From OE-Core rev: ad703de483258f459acc6a40385ad00a5182eb64) Signed-off-by: Simone Weiß Signed-off-by: Richard Purdie Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman --- meta/recipes-support/curl/curl_7.82.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-support/curl/curl_7.82.0.bb b/meta/recipes-support/curl/curl_7.82.0.bb index 81a653b583..308b508072 100644 --- a/meta/recipes-support/curl/curl_7.82.0.bb +++ b/meta/recipes-support/curl/curl_7.82.0.bb @@ -68,6 +68,8 @@ CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl dan # This CVE reports that apple had to upgrade curl because of other already reported CVEs CVE_CHECK_IGNORE += "CVE-2023-42915" +# ignored: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack +CVE_CHECK_IGNORE += "CVE-2024-32928" inherit autotools pkgconfig binconfig multilib_header