From 959f4c8f098a90c24a818831a5e3dd8090cee641 Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Thu, 15 Oct 2026 23:46:31 +0200 Subject: [PATCH] nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629 These CVEs are fixed in latest release however still show-up in open CVE reports. Reason is that the DB contains entries: { "lessThan": "*", "status": "affected", "version": "1.23.3", "versionType": "custom" } Which should mean that the first affected release is 1.23.3, however without the upper limit it will match all higher releases. The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it works by flagging CVEs where at least one version match is present. Signed-off-by: Peter Marko Signed-off-by: Khem Raj --- meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb index 5d699e63ce..73204da558 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb @@ -6,6 +6,9 @@ SRC_URI[sha256sum] = "3cf46f5ed7504d460125866b7bea99fb357f31d887e2e63b35503310e9 inherit upstream-version-is-even +CVE_STATUS[CVE-2026-95101] = "fixed-version: Fixed since 1.30.6" +CVE_STATUS[CVE-2026-97629] = "fixed-version: Fixed since 1.30.6" + # Remove following entries when upgrading recipe to 1.32 CVE_STATUS[CVE-2026-42055] = "fixed-version: Fixed since 1.30.3" CVE_STATUS[CVE-2026-48142] = "fixed-version: Fixed since 1.30.3"