mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-01-11 15:11:26 +00:00
Code Issues Projects Releases Wiki Activity

minio: ignore irrelevant CVEs

Browse Source 
The minio umbrella covers multiple projects. The recipe itself builds
"minio client", which is a set of basic tools to query data from
"minio server" - like ls, mv, find...

The CVEs were files against minio server. Looking at the go mod list,
this recipe doesn't use minio server even as a build dependency - so ignore
the CVEs.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Gyorgy Sarvari
2025-12-16 10:02:14 +01:00
committed by Khem Raj
parent 88ebc14186
commit df462075be
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
meta-oe/recipes-extended/minio/minio_git.bb
View File

@@ -164,3 +164,9 @@ do_install() {
install -d ${D}/${sbindir}
install ${S}/src/${GO_IMPORT}/mc ${D}/${sbindir}/mc
}
CVE_STATUS_GROUPS += "CVE_STATUS_WRONG_CPE"
CVE_STATUS_WRONG_CPE[status] = "cpe-incorrect: The vulnerability is in minio server, not in minio client-tools"
CVE_STATUS_WRONG_CPE = "CVE-2018-1000538 CVE-2020-11012 CVE-2021-21287 CVE-2021-21362 \
CVE-2021-21390 CVE-2021-43858 CVE-2022-35919 CVE-2023-28433 \
CVE-2023-28434 CVE-2024-36107"