quagga: ignore CVE-2021-44038

mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2021-44038

The main point of the vulnerability is that the application
comes with its own systemd unit files, which execute chmod and chown
commands upon start on some files. So when the services are
restarted (e.g. after an update), these unit files can be tricked
to change the permissions on a malicious file.

However OE does not use these unit files - the recipe comes
with its own custom unit files, and chown/chmod isn't used
at all.

Due to this, ignore this vulnerability.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>

This commit is contained in:

Gyorgy Sarvari

2026-02-27 13:03:21 +01:00

parent 3054edf8bb

commit b3c43cc096

1 changed files with 1 additions and 0 deletions

									
										meta-networking/recipes-protocols/quagga/quagga_1.2.4.bb
									
		+1
		
												View File
												
				@@ -5,4 +5,5 @@ SRC_URI[sha256sum] = "e364c082c3309910e1eb7b068bf39ee298e2f2f3f31a6431a5c115193b

				CVE_CHECK_IGNORE += "\

				    CVE-2016-4049 \

				    CVE-2021-44038 \

				"