mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-01 16:10:25 +00:00
Sudhir Dumbhare
0cbca3f031
Analysis: - CVE-2024-11407 [1] affects gRPC-C++ servers with transmit zero copy enabled. - The upstream fix modifies gRPC core runtime source src/core/lib/event_engine/posix_engine/posix_endpoint.cc [2]. - python3-grpcio-tools does not include or compile this runtime source. - Hence CVE-2024-11407 is not applicable to python3-grpcio-tools. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-11407 [2] https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791 Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
30 lines
1.1 KiB
BlitzBasic
30 lines
1.1 KiB
BlitzBasic
DESCRIPTION = "Google gRPC tools"
|
|
HOMEPAGE = "http://www.grpc.io/"
|
|
SECTION = "devel/python"
|
|
|
|
LICENSE = "Apache-2.0"
|
|
LIC_FILES_CHKSUM = "file://PKG-INFO;beginline=8;endline=8;md5=7145f7cdd263359b62d342a02f005515"
|
|
|
|
inherit pypi setuptools3
|
|
|
|
DEPENDS += "python3-grpcio"
|
|
|
|
SRC_URI += "file://0001-setup.py-Do-not-mix-C-and-C-compiler-options.patch \
|
|
file://0001-protobuf-Disable-musttail-attribute-on-mips.patch \
|
|
"
|
|
SRC_URI[sha256sum] = "5fd5e1582b678e6b941ee5f5809340be5e0724691df5299aae8226640f94e18f"
|
|
|
|
RDEPENDS:${PN} = "python3-grpcio"
|
|
|
|
do_compile:prepend() {
|
|
export GRPC_PYTHON_BUILD_EXT_COMPILER_JOBS="${@oe.utils.parallel_make(d, False)}"
|
|
}
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|
|
|
|
CVE_PRODUCT += "grpc:grpc"
|
|
|
|
CVE_STATUS[CVE-2026-33186] = "cpe-incorrect: this CVE is for golang version of grpc"
|
|
CVE_STATUS[CVE-2024-7246] = "not-applicable-config: the vulnerable gRPC C-core HPACK parser code is not present in grpcio-tools"
|
|
CVE_STATUS[CVE-2024-11407] = "not-applicable-config: CVE affects gRPC C++ server zero-copy transport code, which is not present in grpcio-tools"
|