mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-16 18:48:07 +00:00
Code Issues Projects Releases Wiki Activity

nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629

Browse Source 
These CVEs are fixed in latest release however still show-up in open
CVE reports. Reason is that the DB contains entries:
  {
    "lessThan": "*",
    "status": "affected",
    "version": "1.23.3",
    "versionType": "custom"
  }

Which should mean that the first affected release is 1.23.3, however
without the upper limit it will match all higher releases.
The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it
works by flagging CVEs where at least one version match is present.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
This commit is contained in:
Peter Marko authored and Khem Raj committed 2026-10-15 22:27:00 -07:00
1 parent ae297b5d0a
commit 959f4c8f09
1 file changed
+3
Download Patch File Download Diff File Expand all files Collapse all files
meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
+3
View File
@@ -6,6 +6,9 @@ SRC_URI[sha256sum] = "3cf46f5ed7504d460125866b7bea99fb357f31d887e2e63b35503310e9
inherit upstream-version-is-even
CVE_STATUS[CVE-2026-95101] = "fixed-version: Fixed since 1.30.6"
CVE_STATUS[CVE-2026-97629] = "fixed-version: Fixed since 1.30.6"
# Remove following entries when upgrading recipe to 1.32
CVE_STATUS[CVE-2026-42055] = "fixed-version: Fixed since 1.30.3"
CVE_STATUS[CVE-2026-48142] = "fixed-version: Fixed since 1.30.3"