mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
3ffe50e092
Details: https://security-tracker.debian.org/tracker/CVE-2011-3374 The vulnerability is a design-level flaw in the legacy apt-key utility regarding the global trust model of GPG keys. This is marked as not-applicable-config because apt-key net-update is disabled by default, and Debian vendor configuration does not define the archive keyring URI required to use that path. Ignore this CVE in this recipe due to this configuration. (From OE-Core rev: fea209d2e34efbd3bc3dc5af0f6df61f6a8a4353) Signed-off-by: Anil Dongare <adongare@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> [YC: made commit title more precise. net-update is disabled by default here: https://salsa.debian.org/apt-team/apt/-/blob/2.6.1/cmdline/apt-key.in?ref_type=tags#L179 ] Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>