mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-18 21:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

libsdl2: ignore CVE-2020-14409 and CVE-2020-14410

Browse Source 
This was fixed in 2.0.14, but NVD DB lists > 2.0.20 causing
false positives in CVE metrics.

NVD entries [1] and [2] list commit [3] which redirects to commit [4].
Also Debian 10 uses this commit, while Debian 11 with 2.0.14 does not
patch it and claims it's fixed.

Trying to apply the patch shows it's already applied.

Following shows git history of this commit wrt tags.
SDL$ git describe a7ff6e96155f550a5597621ebeddd03c98aa9294 --tags
release-2.0.12-305-ga7ff6e961
SDL$ git describe release-2.0.14 --tags --match=release-2.0.12
release-2.0.12-873-g4cd981609
SDL$ git describe release-2.0.20 --tags --match=release-2.0.12
release-2.0.12-3126-gb424665e0

[1] https://nvd.nist.gov/vuln/detail/CVE-2020-14409
[2] https://nvd.nist.gov/vuln/detail/CVE-2020-14410
[3] https://hg.libsdl.org/SDL/rev/3f9b4e92c1d9
[4] a7ff6e9615

(From OE-Core rev: 3079d562b4df69ab0ac20ec8d13a4240ce0a3514)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko
2024-12-07 00:01:40 +01:00
committed by Steve Sakoman
parent ccf5b0a889
commit c6bb0ec77c
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
meta/recipes-graphics/libsdl2/libsdl2_2.0.20.bb
View File

@@ -82,3 +82,6 @@ PACKAGECONFIG[x11] = "-DSDL_X11=ON,-DSDL_X11=OFF,virtual/libx11 libxext l
CFLAGS:append:class-native = " -DNO_SHARED_MEMORY"
BBCLASSEXTEND = "native nativesdk"
# These are fixed since 2.0.14, NVD DB incorrectly lists > 20.0.20
CVE_CHECK_IGNORE += "CVE-2020-14409 CVE-2020-14410"