mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-06-12 04:53:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

perl: link to the system zlib instead of a vendored copy

Browse Source 
The perl module Compress-Raw-Zlib defaults to using a vendored copy of
the zlib sources which has a number of CVEs.  A newer version of perl
updates this to zlib 1.3.2 to resolve them, but we should be linking to
our zlib recipe instead of the vendored code.

This mitigates CVE-2026-4176 so mark it as not appropriate.

(From OE-Core rev: 6e83e5520f415fc6ca9029a8aaa0af31cd832a90)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bf515229043685d4f00c965eb3e0236c37b6b403)
Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Ross Burton
2026-05-14 03:33:18 -07:00
committed by Paul Barker
parent b233e7b40f
commit 4e2dac74d5
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
meta/recipes-devtools/perl/perl_5.38.4.bb
View File

@@ -49,6 +49,11 @@ export ENC2XS_NO_COMMENTS = "1"
CFLAGS += "-D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
# Link Compress-Raw-Zlib to the system zlib instead of a vendored copy
EXTRA_OEMAKE += "BUILD_ZLIB=False ZLIB_INCLUDE=${STAGING_INCDIR} ZLIB_LIB=${STAGING_LIBDIR}"
CVE_STATUS[CVE-2026-4176] = "not-applicable-config: we do not use the vendorered zlib"
do_configure:prepend() {
rm -rf ${B}
cp -rfp ${S} ${B}