From 13915b76c5411a7f3992ecfa7001bf9b9d32e5a6 Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Fri, 2 Oct 2026 17:58:28 +0200 Subject: [PATCH] nginx: set status for CVE-2026-90439 CVE information now contains separate version range for mainline and stable nginx version. Problem is that mainline version range includes stable verion fix and since cve-check marks CVE as applicable if one of ranges contains current recipe version, it's reported as vulnerable. * Affected 1.29.2 < 1.31.6 (semver) < matches 1.30.5, so false positive * Affected 1.30.4 < 1.30.5 (semver) < correct fix version, but overridden Add also a note to remove these explicit entries when new minor stable version is available which does not fall into the mainline version range (for all 3 currently explicitly handled CVEs). Signed-off-by: Peter Marko Signed-off-by: Khem Raj --- meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb index 4dda52c62d..6b638cdd96 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb @@ -6,5 +6,7 @@ SRC_URI[sha256sum] = "6c20565aa2325cb82216ae804f4a4ff1875179014759a381c42ddc8e11 inherit upstream-version-is-even +# Remove following entries when upgrading recipe to 1.32 CVE_STATUS[CVE-2026-42055] = "fixed-version: Fixed since 1.30.3" CVE_STATUS[CVE-2026-48142] = "fixed-version: Fixed since 1.30.3" +CVE_STATUS[CVE-2026-90439] = "fixed-version: Fixed since 1.30.5"