mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-11-14 03:57:15 +00:00
Peter Marko
959f4c8f09
These CVEs are fixed in latest release however still show-up in open
CVE reports. Reason is that the DB contains entries:
{
"lessThan": "*",
"status": "affected",
"version": "1.23.3",
"versionType": "custom"
}
Which should mean that the first affected release is 1.23.3, however
without the upper limit it will match all higher releases.
The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it
works by flagging CVEs where at least one version match is present.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>