mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 03:37:15 +00:00
Code Issues Projects Releases Wiki Activity

nginx: Ignore CVE-2026-60005

Browse Source 
Analysis:
- CVE-2026-60005 affects the optional ngx_http_slice_module [1].
- The slice module is not built by default and requires the explicit
  --with-http_slice_module configure option, which neither Wrynose nginx
  recipe enables by default [1][2].
- Mark the CVE not applicable only when that option is absent; report it
  as unpatched when a bbappend enables the module.

Reference:
[1] https://github.com/advisories/GHSA-vxcv-h5wj-jxr5
[2] https://nginx.org/en/docs/configure.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hetvi Thakar authored and Anuj Mittal committed 2026-10-28 12:31:45 +05:30
1 parent 9b332333cd
commit 66ad06b673
2 files changed
+2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb
+1
View File
@@ -24,3 +24,4 @@ SRC_URI[sha256sum] = "2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee
CVE_STATUS[CVE-2025-53859] = "cpe-stable-backport: Fix is included in 1.28.1"
CVE_STATUS[CVE-2026-1642] = "fixed-version: fixed since v1.28.2"
CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}"
CVE_STATUS[CVE-2026-60005] = "${@ 'unpatched' if '--with-http_slice_module' in ( (d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_slice_module is not enabled' }"
meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb
+1
View File
@@ -26,3 +26,4 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=79da1c70d587d3a199af9255ad393f99"
SRC_URI[sha256sum] = "673f8fb8c0961c44fbd9410d6161831453609b44063d3f2948253fc2b5692139"
CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}"
CVE_STATUS[CVE-2026-60005] = "${@ 'unpatched' if '--with-http_slice_module' in ( (d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_slice_module is not enabled' }"