From 66ad06b673bcc553debb98e56e4c26ea9d85d26a Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Thu, 15 Oct 2026 20:20:56 -0700 Subject: [PATCH] nginx: Ignore CVE-2026-60005 Analysis: - CVE-2026-60005 affects the optional ngx_http_slice_module [1]. - The slice module is not built by default and requires the explicit --with-http_slice_module configure option, which neither Wrynose nginx recipe enables by default [1][2]. - Mark the CVE not applicable only when that option is absent; report it as unpatched when a bbappend enables the module. Reference: [1] https://github.com/advisories/GHSA-vxcv-h5wj-jxr5 [2] https://nginx.org/en/docs/configure.html Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb | 1 + meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 2 files changed, 2 insertions(+) diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index ca8e7129fb..d087ae8804 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -24,3 +24,4 @@ SRC_URI[sha256sum] = "2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee CVE_STATUS[CVE-2025-53859] = "cpe-stable-backport: Fix is included in 1.28.1" CVE_STATUS[CVE-2026-1642] = "fixed-version: fixed since v1.28.2" CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}" +CVE_STATUS[CVE-2026-60005] = "${@ 'unpatched' if '--with-http_slice_module' in ( (d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_slice_module is not enabled' }" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index 2aae2091a0..3b57994069 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -26,3 +26,4 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=79da1c70d587d3a199af9255ad393f99" SRC_URI[sha256sum] = "673f8fb8c0961c44fbd9410d6161831453609b44063d3f2948253fc2b5692139" CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}" +CVE_STATUS[CVE-2026-60005] = "${@ 'unpatched' if '--with-http_slice_module' in ( (d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_slice_module is not enabled' }"