From 1dac3dca9d4006115ce33b0e8a3caf1cbdc3a300 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Sun, 11 Oct 2026 09:39:31 +1300 Subject: [PATCH] jq: ignore already fixed CVEs All these CVEs are already fixed in the recipe version[1]. Details: https://nvd.nist.gov/vuln/detail/cve-2026-33948 https://nvd.nist.gov/vuln/detail/cve-2026-39979 https://nvd.nist.gov/vuln/detail/cve-2026-40164 https://nvd.nist.gov/vuln/detail/cve-2026-44777 [1]https://github.com/jqlang/jq/releases/tag/jq-1.8.2 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-devtools/jq/jq_1.8.2.bb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/meta-oe/recipes-devtools/jq/jq_1.8.2.bb b/meta-oe/recipes-devtools/jq/jq_1.8.2.bb index 0bbe6e009f..9f586eb18d 100644 --- a/meta-oe/recipes-devtools/jq/jq_1.8.2.bb +++ b/meta-oe/recipes-devtools/jq/jq_1.8.2.bb @@ -48,3 +48,7 @@ do_install_ptest() { RDEPENDS:${PN}-ptest += "tzdata" BBCLASSEXTEND = "native" + +CVE_STATUS_GROUPS += "CVE_STATUS_FIXED_ALREADY" +CVE_STATUS_FIXED_ALREADY[status] = "fixed-version: The issue is fixed in v1.8.2" +CVE_STATUS_FIXED_ALREADY = "CVE-2026-33948 CVE-2026-39979 CVE-2026-40164 CVE-2026-44777"