mirror of
https://git.yoctoproject.org/poky
synced 2026-10-15 04:57:15 +00:00
gnutls: set status for CVE-2026-3832
Analysis: - CVE-2026-3832 affects GnuTLS OCSP multi-record response handling. - The vulnerable OCSP response handling code was introduced in GnuTLS 3.8.8. - This vulnerable code is not present in the current GnuTLS 3.8.4. - Hence ignoring the CVE for this version. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-3832 https://security-tracker.debian.org/tracker/CVE-2026-3832 https://gitlab.com/gnutls/gnutls/-/issues/1801 (From OE-Core rev: e07d9d20c8c53b21b57f824a8ea471cb4657e717) Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
1 parent
9747726708
commit
ffc5320e51
1 file changed
+2
@@ -124,3 +124,5 @@ pkg_postinst_ontarget:${PN}-fips () {
|
||||
${bindir}/fipshmac ${libdir}/libhogweed.so.6.* > ${libdir}/.libhogweed.so.6.hmac
|
||||
fi
|
||||
}
|
||||
|
||||
CVE_STATUS[CVE-2026-3832] = "fixed-version: vulnerable multi-record OCSP response handling was introduced in 3.8.8 and is not present in 3.8.4"
|
||||
Reference in new issue
Block a user