mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-10-15 06:17:16 +00:00
Peter Marko
13915b76c5
CVE information now contains separate version range for mainline and stable nginx version. Problem is that mainline version range includes stable verion fix and since cve-check marks CVE as applicable if one of ranges contains current recipe version, it's reported as vulnerable. * Affected 1.29.2 < 1.31.6 (semver) < matches 1.30.5, so false positive * Affected 1.30.4 < 1.30.5 (semver) < correct fix version, but overridden Add also a note to remove these explicit entries when new minor stable version is available which does not fall into the mainline version range (for all 3 currently explicitly handled CVEs). Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Collection of layers for the OE-core universe
Main layer maintainer: Khem Raj raj.khem@gmail.com
This repository is a collection of layers to supplement OE-Core with additional packages, Each layer have designated maintainer Please see the respective READMEs in the layer subdirectories