mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-27 07:57:27 +00:00
Sana Kazi
a38c92d8e9
Whitelist CVE-2020-27844 as it is introduced by https://github.com/uclouvain/openjpeg/commit/4edb8c83374f52cd6a8f2c7c875e8ffacccb5fa5 but the contents of this patch is not present in openjpeg_2.3.1 Link: https://security-tracker.debian.org/tracker/CVE-2020-27844 Whitelist CVE-2015-1239 as the CVE description clearly states that j2k_read_ppm_v3 function in openjpeg is affected due to CVE-2015-1239 but in openjpeg_2.3.1 this function is not present. Hence, CVE-2015-1239 does not affect openjpeg_2.3.1. Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
50 lines
1.7 KiB
BlitzBasic
50 lines
1.7 KiB
BlitzBasic
DESCRIPTION = "OpenJPEG library is an open-source JPEG 2000 codec"
|
|
HOMEPAGE = "http://www.openjpeg.org"
|
|
LICENSE = "BSD-2-Clause"
|
|
LIC_FILES_CHKSUM = "file://LICENSE;md5=c648878b4840d7babaade1303e7f108c"
|
|
|
|
DEPENDS = "libpng tiff lcms zlib"
|
|
|
|
SRC_URI = " \
|
|
git://github.com/uclouvain/openjpeg.git;branch=master;protocol=https \
|
|
file://0002-Do-not-ask-cmake-to-export-binaries-they-don-t-make-.patch \
|
|
file://CVE-2019-12973-1.patch \
|
|
file://CVE-2019-12973-2.patch \
|
|
file://CVE-2020-6851.patch \
|
|
file://CVE-2020-8112.patch \
|
|
file://CVE-2020-15389.patch \
|
|
file://CVE-2020-27814-1.patch \
|
|
file://CVE-2020-27814-2.patch \
|
|
file://CVE-2020-27814-3.patch \
|
|
file://CVE-2020-27814-4.patch \
|
|
file://CVE-2020-27823.patch \
|
|
file://CVE-2020-27824.patch \
|
|
file://CVE-2020-27841.patch \
|
|
file://CVE-2020-27842.patch \
|
|
file://CVE-2020-27843.patch \
|
|
file://CVE-2020-27845.patch \
|
|
"
|
|
SRCREV = "57096325457f96d8cd07bd3af04fe81d7a2ba788"
|
|
S = "${WORKDIR}/git"
|
|
|
|
inherit cmake
|
|
|
|
# for multilib
|
|
EXTRA_OECMAKE += "-DOPENJPEG_INSTALL_LIB_DIR=${@d.getVar('baselib').replace('/', '')}"
|
|
|
|
FILES_${PN} += "${libdir}/openjpeg*"
|
|
|
|
# This flaw is introduced by
|
|
# https://github.com/uclouvain/openjpeg/commit/4edb8c83374f52cd6a8f2c7c875e8ffacccb5fa5
|
|
# but the contents of this patch is not present in openjpeg_2.3.1
|
|
# Hence, it can be whitelisted.
|
|
# https://security-tracker.debian.org/tracker/CVE-2020-27844
|
|
|
|
CVE_CHECK_WHITELIST += "CVE-2020-27844"
|
|
|
|
# The CVE description clearly states that j2k_read_ppm_v3 function in openjpeg
|
|
# is affected due to CVE-2015-1239 but in openjpeg_2.3.1 this function is not present.
|
|
# Hence, CVE-2015-1239 does not affect openjpeg_2.3.1
|
|
|
|
CVE_CHECK_WHITELIST += "CVE-2015-1239"
|