From 594491969eba6115113b7f25a0b63a8723dc56e6 Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Wed, 14 Oct 2026 22:17:16 -0700 Subject: [PATCH] python3-grpcio-tools: set status for CVE-2024-37168 CVE-2024-37168 affects @grpc/grpc-js, the pure JavaScript implementation, not the gRPC core code included in grpcio-tools. Therefore the grpc:grpc CPE association is incorrect. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-37168 Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- .../recipes-devtools/python/python3-grpcio-tools_1.76.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-python/recipes-devtools/python/python3-grpcio-tools_1.76.0.bb b/meta-python/recipes-devtools/python/python3-grpcio-tools_1.76.0.bb index 8a04fecf27..1733dd0e88 100644 --- a/meta-python/recipes-devtools/python/python3-grpcio-tools_1.76.0.bb +++ b/meta-python/recipes-devtools/python/python3-grpcio-tools_1.76.0.bb @@ -27,3 +27,4 @@ BBCLASSEXTEND = "native nativesdk" CVE_PRODUCT += "grpc:grpc" CVE_STATUS[CVE-2023-33953] = "fixed-version: Fixed since 1.56.2" +CVE_STATUS[CVE-2024-37168] = "cpe-incorrect: affects @grpc/grpc-js, not gRPC core"