From 850b7f6fd7a48186a4738d4e92907d6eb44f0aaa Mon Sep 17 00:00:00 2001 From: Gyorgy Sarvari Date: Fri, 24 Apr 2026 00:48:15 +1200 Subject: [PATCH] protobuf, python3-protobuf: ignore CVE-2026-6409 Details: https://nvd.nist.gov/vuln/detail/CVE-2026-6409 The vulnerability impacts only the PHP library component, not the cpp/python one. Ignore this CVE due to this. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit aef8bc34225cd0a56057749d0db1dfac773b17cb) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- meta-oe/recipes-devtools/protobuf/protobuf_6.31.1.bb | 1 + meta-python/recipes-devtools/python/python3-protobuf_6.33.5.bb | 1 + 2 files changed, 2 insertions(+) diff --git a/meta-oe/recipes-devtools/protobuf/protobuf_6.31.1.bb b/meta-oe/recipes-devtools/protobuf/protobuf_6.31.1.bb index 4356ebeecf..cce2ad11f4 100644 --- a/meta-oe/recipes-devtools/protobuf/protobuf_6.31.1.bb +++ b/meta-oe/recipes-devtools/protobuf/protobuf_6.31.1.bb @@ -27,6 +27,7 @@ UPSTREAM_CHECK_GITTAGREGEX = "v(?P\d\.\d+\.\d+)" CVE_PRODUCT = "google:protobuf protobuf:protobuf google-protobuf protobuf-cpp" CVE_STATUS[CVE-2026-0994] = "cpe-incorrect: the vulnerability affects only python3-protobuf recipe" +CVE_STATUS[CVE-2026-6409] = "cpe-incorrect: the vulnerability affects only the php library" inherit cmake pkgconfig ptest diff --git a/meta-python/recipes-devtools/python/python3-protobuf_6.33.5.bb b/meta-python/recipes-devtools/python/python3-protobuf_6.33.5.bb index af9ff85f20..3abee615d5 100644 --- a/meta-python/recipes-devtools/python/python3-protobuf_6.33.5.bb +++ b/meta-python/recipes-devtools/python/python3-protobuf_6.33.5.bb @@ -14,6 +14,7 @@ SRC_URI[sha256sum] = "6ddcac2a081f8b7b9642c09406bc6a4290128fce5f471cddd165960bb9 CVE_PRODUCT += "google:protobuf protobuf:protobuf google-protobuf protobuf-python" CVE_STATUS[CVE-2026-0994] = "fixed-version: it is fixed in 6.33.5" +CVE_STATUS[CVE-2026-6409] = "cpe-incorrect: the vulnerability affects only the php library" # http://errors.yoctoproject.org/Errors/Details/184715/ # Can't find required file: ../src/google/protobuf/descriptor.proto