From e4a273eb58edd98e00a242a380e1de3b06e61da1 Mon Sep 17 00:00:00 2001 From: Ralph Siemsen Date: Thu, 17 Nov 2022 11:54:52 -0500 Subject: [PATCH] golang: ignore CVE-2022-29804 The issue only affects Windows per the golang announcement [1]: On Windows, the filepath.Clean function could convert an invalid path to a valid, absolute path. For example, Clean(`.\c:`) returned `c:`. [1] https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg (From OE-Core rev: bca720eca95929752436b56aa01e7fddfa1c834f) Signed-off-by: Ralph Siemsen Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie --- meta/recipes-devtools/go/go-1.14.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-devtools/go/go-1.14.inc b/meta/recipes-devtools/go/go-1.14.inc index 6e596f4141..a0278b9816 100644 --- a/meta/recipes-devtools/go/go-1.14.inc +++ b/meta/recipes-devtools/go/go-1.14.inc @@ -64,4 +64,5 @@ CVE_CHECK_WHITELIST += "CVE-2021-29923" CVE_CHECK_WHITELIST += "CVE-2022-29526" # Issue only on windows +CVE_CHECK_WHITELIST += "CVE-2022-29804" CVE_CHECK_WHITELIST += "CVE-2022-30634"